@supacloud/lite 0.29.5 → 0.31.0

package/CHANGELOG.md

@@ -1,5 +1,106 @@
 # Changelog
 
+## [0.31.0](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.30.0...supacloud-lite-v0.31.0) (2026-10-17)
+
+
+### ⚠ BREAKING CHANGES
+
+* @supacloud/app no longer publishes dist/index.cjs or a separate synchronous CommonJS entrypoint. CommonJS consumers should use dynamic import() or migrate to ESM. Release-please should handle the corresponding breaking version change.
+* @supacloud/app no longer publishes dist/index.cjs or a separate synchronous CommonJS entrypoint. CommonJS consumers should use dynamic import() or migrate to ESM. Release-please should handle the corresponding breaking version change.
+
+### Features
+
+* add agent backend authoring, runtime and observability workflows ([#1648](https://github.com/vibeunion/supacloud/issues/1648)) ([59a66d1](https://github.com/vibeunion/supacloud/commit/59a66d184a47d19c7f8895f24a6ba2c7e74e93d0))
+* **app:** add governed reactive event streams and lifecycle signals ([38a26e2](https://github.com/vibeunion/supacloud/commit/38a26e2d3b83226a7488df2ef4f1f5714573aeb2))
+* **compiler:** enforce vibecoding defaults ([886c82f](https://github.com/vibeunion/supacloud/commit/886c82f1462261e10c490586cc9446cb447a21ae))
+* converge SDK-aware vibecoding defaults and local development ([#1607](https://github.com/vibeunion/supacloud/issues/1607)) ([cd66672](https://github.com/vibeunion/supacloud/commit/cd6667252a6a8fe0cc0539bc8610ebb8a818af51))
+* default RxJS support with compatible SupaCloud JS calls ([#1556](https://github.com/vibeunion/supacloud/issues/1556)) ([b3015cb](https://github.com/vibeunion/supacloud/commit/b3015cb161c0d87e6611f6c4fc60c120a8c9fffe))
+* **effect:** upgrade runtime governance to Effect 4 ([#1748](https://github.com/vibeunion/supacloud/issues/1748)) ([2b48efc](https://github.com/vibeunion/supacloud/commit/2b48efcbe78db2a61c0c086f3350eaa87c697e90))
+* **elysia:** Elysia 2 AOT evaluation and end-to-end typing architecture ([#1654](https://github.com/vibeunion/supacloud/issues/1654)) ([39ee49f](https://github.com/vibeunion/supacloud/commit/39ee49f760e85e789c43c1d18cf5729db592f6bc))
+* enable strict Effect route governance by default ([#1742](https://github.com/vibeunion/supacloud/issues/1742)) ([4e18c90](https://github.com/vibeunion/supacloud/commit/4e18c908b9c08a8895be016b4e00a0158bf539c6))
+* **governance:** enforce strict user and platform type contracts ([#1754](https://github.com/vibeunion/supacloud/issues/1754)) ([b22f889](https://github.com/vibeunion/supacloud/commit/b22f88919c349f088848028f13b15e44994e0d9c))
+* **lite:** add offline auth user provisioning ([#1911](https://github.com/vibeunion/supacloud/issues/1911)) ([e9c8931](https://github.com/vibeunion/supacloud/commit/e9c89319cf39d9fe2d71ceac9ab76e6856bb5d84))
+* **lite:** bundle PostgreSQL extension parity set ([#1849](https://github.com/vibeunion/supacloud/issues/1849)) ([233fb1b](https://github.com/vibeunion/supacloud/commit/233fb1bb9d52673a7f38d77d47e8c1e6c0b7c5e4))
+* **platform:** close application platform P0/P1 capabilities ([dbaf3a6](https://github.com/vibeunion/supacloud/commit/dbaf3a6d01daa71455a8cde96e9e233743bfdfca))
+* reduce approval infrastructure wiring and reuse business contracts ([#1948](https://github.com/vibeunion/supacloud/issues/1948)) ([7c68543](https://github.com/vibeunion/supacloud/commit/7c6854338968209c2bbd658782224db238650aeb))
+
+
+### Bug Fixes
+
+* **deps,perf:** replace Bun native APIs and resolve audit vulnerabilities ([#1667](https://github.com/vibeunion/supacloud/issues/1667)) ([06a9199](https://github.com/vibeunion/supacloud/commit/06a91990c754ce586f2a2353f253dc50f4fa0f98))
+* integrate reviewed customer, auth and release repairs ([#2027](https://github.com/vibeunion/supacloud/issues/2027)) ([5c07903](https://github.com/vibeunion/supacloud/commit/5c07903f20bfb069229cf3a829886fe96c78c288))
+* **lite:** classify PL/pgSQL failures as server errors ([#1986](https://github.com/vibeunion/supacloud/issues/1986)) ([27c5e29](https://github.com/vibeunion/supacloud/commit/27c5e29b351e2b6bc0d3da55a1ccb6607e4e06a5))
+* **lite:** close backend after startup failure ([#1903](https://github.com/vibeunion/supacloud/issues/1903)) ([3de47be](https://github.com/vibeunion/supacloud/commit/3de47be7821072b88563d51ee388bf76062040f4))
+* **lite:** enforce read-only table and view requests ([#1941](https://github.com/vibeunion/supacloud/issues/1941)) ([d726716](https://github.com/vibeunion/supacloud/commit/d726716a1492a5a581f99a1aa40f15a1125a23aa))
+* **lite:** enforce RPC transaction access modes ([#1936](https://github.com/vibeunion/supacloud/issues/1936)) ([fb90dcc](https://github.com/vibeunion/supacloud/commit/fb90dcc43ed49a45656e1877493eaa641ef494da))
+* **lite:** normalize filesystem storage roots ([#1902](https://github.com/vibeunion/supacloud/issues/1902)) ([f1b5141](https://github.com/vibeunion/supacloud/commit/f1b5141c1e831e68aaf94b505909c9e4942a42df))
+* **lite:** preserve single-column table RPC responses ([#1971](https://github.com/vibeunion/supacloud/issues/1971)) ([63edb93](https://github.com/vibeunion/supacloud/commit/63edb937322130796260a1284c09cc895735214e))
+* **lite:** reject ineligible password logins ([#1998](https://github.com/vibeunion/supacloud/issues/1998)) ([479e967](https://github.com/vibeunion/supacloud/commit/479e96719209f7aed26c44663d78e1442a7097f0))
+* **lite:** report effective local auth configuration in doctor ([#1907](https://github.com/vibeunion/supacloud/issues/1907)) ([c167617](https://github.com/vibeunion/supacloud/commit/c1676176bdd5a2c057114474186570b7e6d5d0dd))
+* **lite:** resolve RPC overloads using required arguments ([#1967](https://github.com/vibeunion/supacloud/issues/1967)) ([e00ffaf](https://github.com/vibeunion/supacloud/commit/e00ffafd41aa52c8f14c2e81f3bb8a8914b336c8))
+* **lite:** roll back rejected singular REST writes ([#1925](https://github.com/vibeunion/supacloud/issues/1925)) ([0af235d](https://github.com/vibeunion/supacloud/commit/0af235d55a3619ffd150e4b16751a27a32d1f2e0))
+* pin Elysia 2 beta compatibility boundary ([#1467](https://github.com/vibeunion/supacloud/issues/1467)) ([bdb2a2e](https://github.com/vibeunion/supacloud/commit/bdb2a2e658cae4160f2a774b5c459d1a2d8fb601))
+* **worker:** ship reviewed PGMQ job controls and concurrency repairs ([#1689](https://github.com/vibeunion/supacloud/issues/1689)) ([e283915](https://github.com/vibeunion/supacloud/commit/e283915e66e119b75ad1b909e18816270b5d01e3))
+
+
+### Elegance & Refactoring
+
+* use ESM-only owned packages and Lite launcher ([#1582](https://github.com/vibeunion/supacloud/issues/1582)) ([ed5ac78](https://github.com/vibeunion/supacloud/commit/ed5ac78ee3ab22567268fa276e5b016ad1e8b575))
+
+
+### Miscellaneous Chores
+
+* adopt AGPL-3.0-only licensing ([#1481](https://github.com/vibeunion/supacloud/issues/1481)) ([8787ad9](https://github.com/vibeunion/supacloud/commit/8787ad9466ebba8f487d28bf62d5f79a220b0ab8))
+* adopt current Supabase SDK baseline ([#1698](https://github.com/vibeunion/supacloud/issues/1698)) ([4e6613a](https://github.com/vibeunion/supacloud/commit/4e6613aeda3c5958e44cbe9604e30cce0622a66f))
+* release main ([#1474](https://github.com/vibeunion/supacloud/issues/1474)) ([6255eb7](https://github.com/vibeunion/supacloud/commit/6255eb7e7eefc4ee5cd06bef05d4c81a29be706a))
+* release main ([#1484](https://github.com/vibeunion/supacloud/issues/1484)) ([41b3e72](https://github.com/vibeunion/supacloud/commit/41b3e72d25dd8b1ea1d3dea5b75c90bdea9be797))
+* release main ([#1561](https://github.com/vibeunion/supacloud/issues/1561)) ([3ee71e3](https://github.com/vibeunion/supacloud/commit/3ee71e301e7a5499780b45ec6c64e53698000029))
+* release main ([#1609](https://github.com/vibeunion/supacloud/issues/1609)) ([b52c79c](https://github.com/vibeunion/supacloud/commit/b52c79ceda912786f1299ae2d618172f9252607a))
+* release main ([#1647](https://github.com/vibeunion/supacloud/issues/1647)) ([9afdb5c](https://github.com/vibeunion/supacloud/commit/9afdb5c348a2e87169e8898b3842091bb8f1ddea))
+* release main ([#1657](https://github.com/vibeunion/supacloud/issues/1657)) ([1a3f7ff](https://github.com/vibeunion/supacloud/commit/1a3f7ff901f05dda38ed4827d70a91a4acccd8b3))
+* release main ([#1668](https://github.com/vibeunion/supacloud/issues/1668)) ([a7ce18b](https://github.com/vibeunion/supacloud/commit/a7ce18b73e0a2e93df664fb8da08cd40f3bdae82))
+* release main ([#1691](https://github.com/vibeunion/supacloud/issues/1691)) ([2d47123](https://github.com/vibeunion/supacloud/commit/2d47123013522350129d49480ce6d132595976db))
+* release main ([#1695](https://github.com/vibeunion/supacloud/issues/1695)) ([2b9da10](https://github.com/vibeunion/supacloud/commit/2b9da1004b8cc1fd78cfcad79110d5c5eba5349d))
+* release main ([#1743](https://github.com/vibeunion/supacloud/issues/1743)) ([dcbf82c](https://github.com/vibeunion/supacloud/commit/dcbf82c29fb6de94bd6be0c37df20662a6861b2e))
+* release main ([#1747](https://github.com/vibeunion/supacloud/issues/1747)) ([cbdf2a4](https://github.com/vibeunion/supacloud/commit/cbdf2a426aeb5a405a4d27820fdfb51dd489b93a))
+* release main ([#1767](https://github.com/vibeunion/supacloud/issues/1767)) ([d31bf06](https://github.com/vibeunion/supacloud/commit/d31bf06a2bfbdb353554a44576d0c54685f46193))
+* release main ([#1825](https://github.com/vibeunion/supacloud/issues/1825)) ([4819f95](https://github.com/vibeunion/supacloud/commit/4819f95ae7ce722b58f4858261c100c448c9975e))
+* release main ([#1857](https://github.com/vibeunion/supacloud/issues/1857)) ([6b98454](https://github.com/vibeunion/supacloud/commit/6b9845403733f7ffac7711587982979d928702b2))
+* release main ([#1890](https://github.com/vibeunion/supacloud/issues/1890)) ([8b88c00](https://github.com/vibeunion/supacloud/commit/8b88c00e4eb523203520757219be1bc42e45e44d))
+* release main ([#1904](https://github.com/vibeunion/supacloud/issues/1904)) ([c9dc22b](https://github.com/vibeunion/supacloud/commit/c9dc22b89383eefffe11ae4cfa6df57114165a78))
+* release main ([#1909](https://github.com/vibeunion/supacloud/issues/1909)) ([e6590d5](https://github.com/vibeunion/supacloud/commit/e6590d539d92bd99a31e91f9a48f98d0d5a177a5))
+* release main ([#1930](https://github.com/vibeunion/supacloud/issues/1930)) ([2a0a7fa](https://github.com/vibeunion/supacloud/commit/2a0a7fa8ad5c2d88bd8b9ce76b9a6a1744428eb4))
+* release main ([#1937](https://github.com/vibeunion/supacloud/issues/1937)) ([c63b5dd](https://github.com/vibeunion/supacloud/commit/c63b5dd722571e884dbbca379781ecf44542d643))
+* release main ([#1944](https://github.com/vibeunion/supacloud/issues/1944)) ([206d711](https://github.com/vibeunion/supacloud/commit/206d711a0012bad9465283f2f2bfc5f4eb80d269))
+* release main ([#1952](https://github.com/vibeunion/supacloud/issues/1952)) ([1693369](https://github.com/vibeunion/supacloud/commit/1693369010c63e77de8012d0a8acd7b116def94c))
+* release main ([#1955](https://github.com/vibeunion/supacloud/issues/1955)) ([1d93a49](https://github.com/vibeunion/supacloud/commit/1d93a491a8ee2b514e18b802db71233c4535bc23))
+* release main ([#1969](https://github.com/vibeunion/supacloud/issues/1969)) ([89ba2f7](https://github.com/vibeunion/supacloud/commit/89ba2f77a0f8831cd4be3aa9ccca81886ec3bfb0))
+* release main ([#1982](https://github.com/vibeunion/supacloud/issues/1982)) ([02cb9a7](https://github.com/vibeunion/supacloud/commit/02cb9a7011588e7d02e22a84f972c324e4983de4))
+* release main ([#1988](https://github.com/vibeunion/supacloud/issues/1988)) ([e1b912d](https://github.com/vibeunion/supacloud/commit/e1b912df24c27cf822d1f82df6561248783abbb5))
+* release main ([#1999](https://github.com/vibeunion/supacloud/issues/1999)) ([af2a885](https://github.com/vibeunion/supacloud/commit/af2a885e70d8baf3bad4cc3c8264efe62b87d8e9))
+* release main ([#2030](https://github.com/vibeunion/supacloud/issues/2030)) ([2f7cf91](https://github.com/vibeunion/supacloud/commit/2f7cf91d941ab583ebe21d901069a16e55efc48a))
+* unify project licensing under Apache-2.0 ([#1566](https://github.com/vibeunion/supacloud/issues/1566)) ([36dd377](https://github.com/vibeunion/supacloud/commit/36dd37796147a5e7051534d6d9535f13ad881a93))
+* upgrade dependencies and caddy ([#1821](https://github.com/vibeunion/supacloud/issues/1821)) ([91c9a4b](https://github.com/vibeunion/supacloud/commit/91c9a4bd0a14f757670822a1aa953643a00a83c9))
+* upgrade workspace dependencies ([#1940](https://github.com/vibeunion/supacloud/issues/1940)) ([77ad418](https://github.com/vibeunion/supacloud/commit/77ad418e0568ceeeea0b59a10a3bbc451a68a95f))
+
+## [0.30.0](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.29.5...supacloud-lite-v0.30.0) (2026-10-17)
+
+
+### Features
+
+* add configurable image-transformation input and output limits with a 500 MiB default and maximum ([#2027](https://github.com/vibeunion/supacloud/issues/2027)) ([5c07903](https://github.com/vibeunion/supacloud/commit/5c07903f20bfb069229cf3a829886fe96c78c288))
+
+
+### Bug Fixes
+
+* enforce account eligibility consistently for bearer, email, OAuth and refresh authentication ([#2027](https://github.com/vibeunion/supacloud/issues/2027)) ([5c07903](https://github.com/vibeunion/supacloud/commit/5c07903f20bfb069229cf3a829886fe96c78c288))
+* prepare isolated package artifacts against the current database dependency ([#2027](https://github.com/vibeunion/supacloud/issues/2027)) ([5c07903](https://github.com/vibeunion/supacloud/commit/5c07903f20bfb069229cf3a829886fe96c78c288))
+
+
+### Dependencies
+
+* align the published @supacloud/db dependency to 0.18.1.
+
 ## [0.29.5](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.29.4...supacloud-lite-v0.29.5) (2026-10-16)
 
 

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.29.5",
+  version: "0.31.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -67,16 +67,16 @@ var package_default = {
     "@electric-sql/pglite-pgmq": "0.0.8",
     "@electric-sql/pglite-pgvector": "0.0.11",
     "@electric-sql/pglite-postgis": "0.2.10",
-    "@supacloud/db": "^0.17.0",
+    "@supacloud/db": "0.18.1",
     "exact-mirror": "1.2.6",
     tar: "^7.5.22",
     typebox: "1.3.37"
   },
   devDependencies: {
-    "@supacloud/app": "file:../app",
-    "@supacloud/contracts": "file:../contracts",
-    "@supacloud/compiler": "file:../compiler",
-    "@supacloud/elysia": "file:../elysia",
+    "@supacloud/app": "0.28.0",
+    "@supacloud/contracts": "0.11.2",
+    "@supacloud/compiler": "0.47.0",
+    "@supacloud/elysia": "0.33.2",
     "@supabase/supabase-js": "^2.117.3",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
@@ -85,13 +85,13 @@ var package_default = {
     typescript: "^7.0.2"
   },
   overrides: {
-    "@supacloud/db": "^0.17.0",
-    "@supacloud/app": "file:../app",
-    "@supacloud/compiler": "file:../compiler",
-    "@supacloud/elysia": "file:../elysia",
-    "@supacloud/contracts": "file:../contracts",
-    "@supacloud/commands": "file:../commands",
-    "@supacloud/delivery": "file:../delivery",
+    "@supacloud/db": "0.18.1",
+    "@supacloud/app": "0.28.0",
+    "@supacloud/compiler": "0.47.0",
+    "@supacloud/elysia": "0.33.2",
+    "@supacloud/contracts": "0.11.2",
+    "@supacloud/commands": "0.9.4",
+    "@supacloud/delivery": "0.19.1",
     "@graphql-tools/utils": "^12.0.4"
   },
   engines: {
@@ -242,6 +242,13 @@ function isAllowedRedirect(requested, siteUrl, allowList = []) {
 }
 
 // src/runtime/auth/oauth.ts
+class OAuthAccountIneligibleError extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+}
 var PRESETS = {
   google: {
     authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
@@ -364,14 +371,30 @@ class OAuthService {
       const msg = encodeURIComponent(e instanceof Error ? e.message : "oauth_error");
       return redirect(`${flow.redirect_to}#error=server_error&error_description=${msg}`);
     }
-    const userId = await this.upsertUser(provider.name, profile);
+    let userId;
+    try {
+      userId = await this.upsertUser(provider.name, profile);
+    } catch (e) {
+      if (e instanceof OAuthAccountIneligibleError) {
+        return redirect(`${flow.redirect_to}#error=access_denied&error_code=${e.code}`);
+      }
+      throw e;
+    }
     if (flow.code_challenge) {
       const authCode = randomToken(24);
       await this.db.query(`insert into auth.flow_state (provider, provider_state, redirect_to, code_challenge, code_challenge_method, auth_code, user_id, expires_at)
          values ($1, $2, $3, $4, $5, $6, $7, now() + interval '5 minutes')`, [flow.provider, randomToken(16), flow.redirect_to, flow.code_challenge, flow.code_challenge_method, authCode, userId]);
       return redirect(`${flow.redirect_to}?code=${authCode}`);
     }
-    const session = await createSession(userId);
+    let session;
+    try {
+      session = await createSession(userId);
+    } catch (e) {
+      if (e instanceof OAuthAccountIneligibleError) {
+        return redirect(`${flow.redirect_to}#error=access_denied&error_code=${e.code}`);
+      }
+      throw e;
+    }
     const hash = `#access_token=${session.access_token}&refresh_token=${session.refresh_token}&expires_in=${session.expires_in}&token_type=bearer&provider_token=`;
     return redirect(`${flow.redirect_to}${hash}`);
   }
@@ -422,31 +445,37 @@ class OAuthService {
     return profile;
   }
   async upsertUser(provider, profile) {
-    const existing = await this.db.query(`select user_id from auth.identities where provider = $1 and provider_id = $2`, [provider, profile.id]);
+    return this.db.transaction((query) => this.upsertUserInTransaction(query, provider, profile));
+  }
+  async upsertUserInTransaction(query, provider, profile) {
+    const existing = await query(`select user_id from auth.identities where provider = $1 and provider_id = $2`, [provider, profile.id]);
     if (existing.rows[0]) {
-      await this.db.query(`update auth.identities set last_sign_in_at = now(), identity_data = $3 where provider = $1 and provider_id = $2`, [
+      await this.assertUserEligible(query, existing.rows[0].user_id);
+      await query(`update auth.identities set last_sign_in_at = now(), identity_data = $3 where provider = $1 and provider_id = $2`, [
         provider,
         profile.id,
         JSON.stringify({ sub: profile.id, email: profile.email, ...profile.metadata })
       ]);
-      await this.db.query(`update auth.users set last_sign_in_at = now() where id = $1`, [existing.rows[0].user_id]);
+      await query(`update auth.users set last_sign_in_at = now() where id = $1`, [existing.rows[0].user_id]);
       return existing.rows[0].user_id;
     }
     let userId;
     const email = profile.email?.toLowerCase() ?? null;
     const verified = !!profile.email && profile.emailVerified === true;
     if (email && verified) {
-      const byEmail = await this.db.query(`select id from auth.users where email = $1`, [email]);
+      const byEmail = await query(`select id from auth.users where email = $1`, [email]);
       userId = byEmail.rows[0]?.id;
+      if (userId)
+        await this.assertUserEligible(query, userId);
     }
     if (!userId) {
       let userEmail = verified ? email : null;
       if (userEmail) {
-        const taken = await this.db.query(`select 1 from auth.users where email = $1`, [userEmail]);
+        const taken = await query(`select 1 from auth.users where email = $1`, [userEmail]);
         if (taken.rows.length > 0)
           userEmail = null;
       }
-      const created = await this.db.query(`insert into auth.users (aud, role, email, email_confirmed_at, last_sign_in_at, raw_app_meta_data, raw_user_meta_data)
+      const created = await query(`insert into auth.users (aud, role, email, email_confirmed_at, last_sign_in_at, raw_app_meta_data, raw_user_meta_data)
          values ('authenticated','authenticated',$1, $2, now(),
                  $3::jsonb, $4::jsonb) returning id`, [
         userEmail,
@@ -459,12 +488,22 @@ class OAuthService {
         throw new Error("OAuth user creation returned no row");
       userId = user.id;
     }
-    await this.db.query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+    await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
        values ($1, $2, $3, $4::jsonb)`, [userId, provider, profile.id, JSON.stringify({ sub: profile.id, email: profile.email, ...profile.metadata })]);
     if (!userId)
       throw new Error("OAuth identity has no user ID");
     return userId;
   }
+  async assertUserEligible(query, userId) {
+    const users = await query(`select deleted_at is not null as is_deleted,
+              coalesce(banned_until > now(), false) as is_banned
+       from auth.users where id = $1 for update`, [userId]);
+    const user = users.rows[0];
+    if (!user || user.is_deleted)
+      throw new OAuthAccountIneligibleError("user_not_found");
+    if (user.is_banned)
+      throw new OAuthAccountIneligibleError("user_banned");
+  }
 }
 function redirect(location) {
   return new Response(null, { status: 303, headers: { location } });
@@ -1350,6 +1389,8 @@ class AuthHandler {
         return await this.admin(req, ctx, path, method);
       return authError(404, "not_found", `unknown auth endpoint: ${path}`);
     } catch (e) {
+      if (e instanceof OAuthAccountIneligibleError)
+        return authError(400, e.code, e.message);
       const msg = e instanceof Error ? e.message : String(e);
       return authError(500, "unexpected_failure", msg);
     }
@@ -1444,8 +1485,7 @@ class AuthHandler {
       const userId = await this.oauth.exchangePkce(authCode, verifier);
       if (!userId)
         return authError(403, "flow_state_not_found", "invalid or expired auth code");
-      const ures = await this.db.query(`select * from auth.users where id = $1`, [userId]);
-      return json(200, await this.sessionForOAuth(ures.rows[0]));
+      return json(200, await this.sessionForOAuth(userId));
     }
     return authError(400, "invalid_grant", `unsupported grant_type: ${grantType}`);
   }
@@ -1740,7 +1780,10 @@ Or sign in with this link: ${link}`
       tokenTypes: `{${types.join(",")}}`,
       email: email?.toLowerCase().trim() ?? null
     };
-    return this.db.transaction((query) => this.claimEmailToken(query, redemption));
+    return this.db.transaction(async (query) => {
+      const user = await this.claimEmailToken(query, redemption);
+      return user ? this.sessionFor(user, undefined, undefined, query) : null;
+    });
   }
   async claimEmailToken(query, redemption) {
     const candidate = await this.findEmailTokenCandidate(query, redemption);
@@ -1752,7 +1795,10 @@ Or sign in with this link: ${link}`
     return claimedToken ? this.confirmEmailTokenUser(query, claimedToken) : null;
   }
   async lockAndDeleteEmailToken(query, candidate, redemption) {
-    await query(`select id from auth.users where id = $1 for update`, [candidate.user_id]);
+    const eligible = await query(`select id from auth.users where id = $1 and deleted_at is null
+         and (banned_until is null or banned_until <= now()) for update`, [candidate.user_id]);
+    if (eligible.rows.length === 0)
+      return null;
     const claimedTokens = await query(`delete from auth.one_time_tokens
        where id = $1 and token = $2 and token_type = any($3::text[])
          and expires_at > now() and attempts < $4
@@ -1805,10 +1851,10 @@ Or sign in with this link: ${link}`
       return json(200, session);
     }
     const types = body.type === "recovery" ? ["recovery"] : body.type === "magiclink" ? ["magiclink"] : ["otp", "magiclink"];
-    const user = await this.redeem(token, types, body.email);
-    if (!user)
+    const session = await this.redeem(token, types, body.email);
+    if (!session)
       return authError(403, "otp_expired", "Token has expired or is invalid");
-    return json(200, await this.sessionFor(user));
+    return json(200, session);
   }
   async redeemPhoneOtp(phone, code) {
     const tokenDigest = `hmac-sha256:v1:${await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-otp:v1", `${phone}\x00${code}`)}`;
@@ -1849,11 +1895,10 @@ Or sign in with this link: ${link}`
     const token = url.searchParams.get("token") ?? "";
     const type = url.searchParams.get("type") ?? "magiclink";
     const redirectTo = resolveRedirect(url.searchParams.get("redirect_to"), this.config.siteUrl, this.config.uriAllowList, this.config.enforceRedirectAllowList);
-    const user = await this.redeem(token, [type]);
-    if (!user) {
+    const session = await this.redeem(token, [type]);
+    if (!session) {
       return new Response(null, { status: 303, headers: { location: `${redirectTo}#error=access_denied&error_code=otp_expired` } });
     }
-    const session = await this.sessionFor(user);
     const hash = `#access_token=${session.access_token}&refresh_token=${session.refresh_token}&expires_in=${session.expires_in}&token_type=bearer&type=${type}`;
     return new Response(null, { status: 303, headers: { location: `${redirectTo}${hash}` } });
   }
@@ -2154,6 +2199,11 @@ Or sign in with this link: ${link}`
       return authError(422, "mfa_verification_failed", "Invalid TOTP code entered");
     }
     const session = await this.db.transaction(async (query) => {
+      const currentUsers = await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id]);
+      const currentUser = currentUsers.rows[0];
+      if (!currentUser)
+        return null;
       const claimed = await query(`update auth.mfa_challenges set verified_at = now()
          where id = $1 and factor_id = $2 and verified_at is null and expires_at >= now()
          returning id`, [challenge.id, factorId]);
@@ -2162,7 +2212,7 @@ Or sign in with this link: ${link}`
       if (factor.status !== "verified") {
         await query(`update auth.mfa_factors set status = 'verified', updated_at = now() where id = $1`, [factorId]);
       }
-      return this.sessionFor(user, undefined, {
+      return this.sessionFor(currentUser, undefined, {
         aal: "aal2",
         amr: [
           { method: "password", timestamp: Math.floor(Date.now() / 1000) },
@@ -2223,6 +2273,18 @@ Or sign in with this link: ${link}`
   }
   async rotateRefreshToken(token) {
     return this.db.transaction(async (query) => {
+      const availableToken = await this.findAvailableRefreshToken(query, token);
+      if (!availableToken)
+        return authError(400, "refresh_token_not_found", "Invalid Refresh Token: Refresh Token Not Found");
+      const userResult = await query(`select *, coalesce(banned_until > now(), false) as is_banned
+         from auth.users where id = $1 for update`, [availableToken.user_id]);
+      const user = userResult.rows[0];
+      if (!user || user.deleted_at !== null) {
+        return authError(400, "refresh_token_not_found", "Invalid Refresh Token: Refresh Token Not Found");
+      }
+      if (user.is_banned) {
+        return authError(400, "user_banned", "Invalid Refresh Token: User Banned");
+      }
       const claimedToken = await this.claimRefreshToken(query, token);
       if (!claimedToken)
         return authError(400, "refresh_token_not_found", "Invalid Refresh Token: Refresh Token Not Found");
@@ -2230,14 +2292,19 @@ Or sign in with this link: ${link}`
       const expiryError = this.refreshExpiryError(claimedToken, sessionStartedAt);
       if (expiryError)
         return expiryError;
-      const userResult = await query(`select * from auth.users where id = $1`, [claimedToken.user_id]);
-      const session = await this.sessionFor(userResult.rows[0], token, {
+      const session = await this.sessionFor(user, token, {
         sessionId: claimedToken.session_id ?? undefined,
         sessionStartedAt: sessionStartedAt === null ? undefined : Math.floor(sessionStartedAt / 1000)
       }, query);
       return json(200, session);
     });
   }
+  async findAvailableRefreshToken(query, token) {
+    const available = await query(`select user_id, session_id, created_at
+       from auth.refresh_tokens
+       where token = $1 and revoked is not true`, [token]);
+    return available.rows[0];
+  }
   async claimRefreshToken(query, token) {
     const claimed = await query(`update auth.refresh_tokens set revoked = true, updated_at = now()
        where token = $1 and revoked is not true
@@ -2265,7 +2332,8 @@ Or sign in with this link: ${link}`
     const claims = await this.claimsFromBearer(req);
     if (!claims?.sub)
       return null;
-    const res = await this.db.query(`select * from auth.users where id = $1`, [claims.sub]);
+    const res = await this.db.query(`select * from auth.users where id = $1 and deleted_at is null
+         and (banned_until is null or banned_until <= now())`, [claims.sub]);
     return res.rows[0] ?? null;
   }
   async claimsFromBearer(req) {
@@ -2294,14 +2362,22 @@ Or sign in with this link: ${link}`
       is_anonymous: u.is_anonymous ?? false
     };
   }
-  sessionForOAuth(user) {
-    return this.sessionFor(user, undefined, {
-      amr: [{ method: "oauth", timestamp: Math.floor(Date.now() / 1000) }]
+  sessionForOAuth(userId) {
+    return this.db.transaction(async (query) => {
+      const res = await query(`select *, coalesce(banned_until > now(), false) as is_banned
+         from auth.users where id = $1 for update`, [userId]);
+      const user = res.rows[0];
+      if (!user || user.deleted_at !== null)
+        throw new OAuthAccountIneligibleError("user_not_found");
+      if (user.is_banned)
+        throw new OAuthAccountIneligibleError("user_banned");
+      return this.sessionFor(user, undefined, {
+        amr: [{ method: "oauth", timestamp: Math.floor(Date.now() / 1000) }]
+      }, query);
     });
   }
   async oauthSessionTokensFor(userId) {
-    const res = await this.db.query(`select * from auth.users where id = $1`, [userId]);
-    const session = await this.sessionForOAuth(res.rows[0]);
+    const session = await this.sessionForOAuth(userId);
     return { access_token: session.access_token, refresh_token: session.refresh_token, expires_in: session.expires_in };
   }
   async sessionFor(user, parentToken, opts, query = (sql, params) => this.db.query(sql, params)) {
@@ -8978,8 +9054,18 @@ var IMAGE_FORMAT_CONTENT_TYPES = {
   gif: "image/gif"
 };
 var MAX_TRANSFORM_DIMENSION = 2500;
-var MAX_TRANSFORM_BYTES = 25 * 1024 * 1024;
+var MAX_TRANSFORM_BYTES = 500 * 1024 * 1024;
 var MAX_TRANSFORM_PIXELS = 50000000;
+function resolveImageTransformLimits(options = {}) {
+  const maxInputBytes = options.maxInputBytes === undefined ? MAX_TRANSFORM_BYTES : options.maxInputBytes;
+  const maxOutputBytes = options.maxOutputBytes === undefined ? MAX_TRANSFORM_BYTES : options.maxOutputBytes;
+  for (const [name, value] of Object.entries({ maxInputBytes, maxOutputBytes })) {
+    if (!Number.isSafeInteger(value) || value < 1 || value > MAX_TRANSFORM_BYTES) {
+      throw new Error(`Invalid image transformation ${name}: expected 1..${MAX_TRANSFORM_BYTES} bytes`);
+    }
+  }
+  return { maxInputBytes, maxOutputBytes };
+}
 function invalid(message) {
   return { ok: false, status: 400, error: "InvalidTransformation", message };
 }
@@ -9037,7 +9123,16 @@ function parseImageTransform(query) {
   if (quality !== undefined && format === "png") {
     return invalid("quality is supported only for jpeg and webp output");
   }
-  return { ok: true, value: { width, height, resize, quality, format } };
+  return {
+    ok: true,
+    value: {
+      resize,
+      format,
+      ...width === undefined ? {} : { width },
+      ...height === undefined ? {} : { height },
+      ...quality === undefined ? {} : { quality }
+    }
+  };
 }
 function imageTransformToSearchParams(options) {
   const query = new URLSearchParams;
@@ -9111,15 +9206,16 @@ function applyResize(image, metadata, options) {
   const proportionalWidth = Math.max(1, Math.round(metadata.width * height / metadata.height));
   image.resize(proportionalWidth);
 }
-async function transformImage(source, options, knownSourceSize) {
+async function transformImage(source, options, knownSourceSize, configuredLimits = {}) {
+  const limits = resolveImageTransformLimits(configuredLimits);
   const actualSourceSize = source instanceof Uint8Array ? source.byteLength : await Promise.resolve(source.size);
   const sourceSize = Math.max(knownSourceSize ?? 0, actualSourceSize);
-  if (sourceSize > MAX_TRANSFORM_BYTES) {
+  if (sourceSize > limits.maxInputBytes) {
     return {
       ok: false,
       status: 413,
       error: "ImageTooLarge",
-      message: "The source image exceeds the 25MB transformation limit"
+      message: `The source image exceeds the transformation limit (${limits.maxInputBytes} bytes)`
     };
   }
   const image = new Bun.Image(source, { maxPixels: MAX_TRANSFORM_PIXELS });
@@ -9152,12 +9248,12 @@ async function transformImage(source, options, knownSourceSize) {
   }
   try {
     const bytes = await image.bytes();
-    if (bytes.byteLength > MAX_TRANSFORM_BYTES) {
+    if (bytes.byteLength > limits.maxOutputBytes) {
       return {
         ok: false,
         status: 413,
         error: "ImageTooLarge",
-        message: "The transformed image exceeds the 25MB transformation limit"
+        message: `The transformed image exceeds the transformation limit (${limits.maxOutputBytes} bytes)`
       };
     }
     return { ok: true, bytes, contentType };
@@ -9360,10 +9456,12 @@ class StorageHandler {
   tusUploads = new Map;
   mutationTail = Promise.resolve();
   imageTransforms = new ImageTransformCache;
+  transformLimits;
   constructor(db, driver, config) {
     this.db = db;
     this.driver = driver;
     this.config = config;
+    this.transformLimits = resolveImageTransformLimits(config.imageTransformLimits);
   }
   async ensureBuckets(buckets) {
     for (const b of buckets) {
@@ -9639,7 +9737,7 @@ class StorageHandler {
         const source = await this.readObjectSource(row);
         if (source === null)
           throw new StorageObjectMissingError;
-        return transformImage(source, parsed.value, objectSize(row));
+        return transformImage(source, parsed.value, objectSize(row), this.transformLimits);
       });
     } catch (error) {
       if (error instanceof StorageObjectMissingError) {
@@ -11735,6 +11833,7 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
   const storage = new StorageHandler(db, config.storageDriver ?? new MemoryStorageDriver, {
     jwtSecret,
     defaultFileSizeLimit: config.storageFileSizeLimit,
+    imageTransformLimits: config.storageImageTransformLimits,
     log
   });
   if (config.buckets?.length) {
@@ -13274,8 +13373,22 @@ import { readFile as readFile2, stat } from "fs/promises";
 import { dirname as dirname3, resolve as resolve3 } from "path";
 import { pathToFileURL } from "url";
 
-// node_modules/@supacloud/db/dist/index.js
+// ../db/dist/index.js
 import { createHash as createHash3 } from "crypto";
+
+// ../contracts/dist/index.mjs
+var commandErrorBrand = Symbol.for("@supacloud/contracts/CommandError/v1");
+var commandErrorCodes = new Set([
+  "COMMAND_INPUT_INVALID",
+  "COMMAND_REJECTED",
+  "COMMAND_UNAVAILABLE",
+  "COMMAND_IDEMPOTENCY_CONFLICT",
+  "COMMAND_RECEIPT_INVALID",
+  "COMMAND_OUTCOME_UNKNOWN",
+  "COMMAND_INPUT_EXPIRED"
+]);
+
+// ../db/dist/index.js
 var TABLES_SQL = `
 SELECT n.nspname AS schema,
        c.relname AS name,
@@ -14684,6 +14797,19 @@ function readStorage(root) {
   const limit = getByteSize(storage, "file_size_limit");
   if (limit !== undefined)
     out.fileSizeLimit = limit;
+  const image = tableAt(root, "storage.image_transformation");
+  if (image) {
+    const limits = {};
+    for (const [key, field] of [["max_input_bytes", "maxInputBytes"], ["max_output_bytes", "maxOutputBytes"]]) {
+      if (!image.values.has(key))
+        continue;
+      const value = getByteSize(image, key);
+      if (value === undefined)
+        throw new Error(`Invalid image transformation ${key}`);
+      limits[field] = value;
+    }
+    out.imageTransformLimits = resolveImageTransformLimits(limits);
+  }
   const buckets = tableAt(root, "storage.buckets");
   if (buckets && buckets.children.size > 0) {
     out.buckets = [...buckets.children].map(([id, t]) => ({
@@ -15521,6 +15647,7 @@ async function createProjectBackend(options = {}) {
       dbSchemas: config.api.schemas,
       maxRows: config.api.maxRows,
       storageFileSizeLimit: config.storage.fileSizeLimit,
+      storageImageTransformLimits: config.storage.imageTransformLimits,
       buckets: config.storage.buckets,
       migrations: options.applyMigrations === false ? [] : project.migrations,
       seedSql: options.applyMigrations === false || options.includeSeed === false ? undefined : project.seedSql,