@supacloud/lite 0.29.5 → 0.31.0

package/dist/index.js

@@ -88,7 +88,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.29.5",
+  version: "0.31.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -147,16 +147,16 @@ var package_default = {
     "@electric-sql/pglite-pgmq": "0.0.8",
     "@electric-sql/pglite-pgvector": "0.0.11",
     "@electric-sql/pglite-postgis": "0.2.10",
-    "@supacloud/db": "^0.17.0",
+    "@supacloud/db": "0.18.1",
     "exact-mirror": "1.2.6",
     tar: "^7.5.22",
     typebox: "1.3.37"
   },
   devDependencies: {
-    "@supacloud/app": "file:../app",
-    "@supacloud/contracts": "file:../contracts",
-    "@supacloud/compiler": "file:../compiler",
-    "@supacloud/elysia": "file:../elysia",
+    "@supacloud/app": "0.28.0",
+    "@supacloud/contracts": "0.11.2",
+    "@supacloud/compiler": "0.47.0",
+    "@supacloud/elysia": "0.33.2",
     "@supabase/supabase-js": "^2.117.3",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
@@ -165,13 +165,13 @@ var package_default = {
     typescript: "^7.0.2"
   },
   overrides: {
-    "@supacloud/db": "^0.17.0",
-    "@supacloud/app": "file:../app",
-    "@supacloud/compiler": "file:../compiler",
-    "@supacloud/elysia": "file:../elysia",
-    "@supacloud/contracts": "file:../contracts",
-    "@supacloud/commands": "file:../commands",
-    "@supacloud/delivery": "file:../delivery",
+    "@supacloud/db": "0.18.1",
+    "@supacloud/app": "0.28.0",
+    "@supacloud/compiler": "0.47.0",
+    "@supacloud/elysia": "0.33.2",
+    "@supacloud/contracts": "0.11.2",
+    "@supacloud/commands": "0.9.4",
+    "@supacloud/delivery": "0.19.1",
     "@graphql-tools/utils": "^12.0.4"
   },
   engines: {
@@ -248,6 +248,13 @@ function isAllowedRedirect(requested, siteUrl, allowList = []) {
 }
 
 // src/runtime/auth/oauth.ts
+class OAuthAccountIneligibleError extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+}
 var PRESETS = {
   google: {
     authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
@@ -370,14 +377,30 @@ class OAuthService {
       const msg = encodeURIComponent(e instanceof Error ? e.message : "oauth_error");
       return redirect(`${flow.redirect_to}#error=server_error&error_description=${msg}`);
     }
-    const userId = await this.upsertUser(provider.name, profile);
+    let userId;
+    try {
+      userId = await this.upsertUser(provider.name, profile);
+    } catch (e) {
+      if (e instanceof OAuthAccountIneligibleError) {
+        return redirect(`${flow.redirect_to}#error=access_denied&error_code=${e.code}`);
+      }
+      throw e;
+    }
     if (flow.code_challenge) {
       const authCode = randomToken(24);
       await this.db.query(`insert into auth.flow_state (provider, provider_state, redirect_to, code_challenge, code_challenge_method, auth_code, user_id, expires_at)
          values ($1, $2, $3, $4, $5, $6, $7, now() + interval '5 minutes')`, [flow.provider, randomToken(16), flow.redirect_to, flow.code_challenge, flow.code_challenge_method, authCode, userId]);
       return redirect(`${flow.redirect_to}?code=${authCode}`);
     }
-    const session = await createSession(userId);
+    let session;
+    try {
+      session = await createSession(userId);
+    } catch (e) {
+      if (e instanceof OAuthAccountIneligibleError) {
+        return redirect(`${flow.redirect_to}#error=access_denied&error_code=${e.code}`);
+      }
+      throw e;
+    }
     const hash = `#access_token=${session.access_token}&refresh_token=${session.refresh_token}&expires_in=${session.expires_in}&token_type=bearer&provider_token=`;
     return redirect(`${flow.redirect_to}${hash}`);
   }
@@ -428,31 +451,37 @@ class OAuthService {
     return profile;
   }
   async upsertUser(provider, profile) {
-    const existing = await this.db.query(`select user_id from auth.identities where provider = $1 and provider_id = $2`, [provider, profile.id]);
+    return this.db.transaction((query) => this.upsertUserInTransaction(query, provider, profile));
+  }
+  async upsertUserInTransaction(query, provider, profile) {
+    const existing = await query(`select user_id from auth.identities where provider = $1 and provider_id = $2`, [provider, profile.id]);
     if (existing.rows[0]) {
-      await this.db.query(`update auth.identities set last_sign_in_at = now(), identity_data = $3 where provider = $1 and provider_id = $2`, [
+      await this.assertUserEligible(query, existing.rows[0].user_id);
+      await query(`update auth.identities set last_sign_in_at = now(), identity_data = $3 where provider = $1 and provider_id = $2`, [
         provider,
         profile.id,
         JSON.stringify({ sub: profile.id, email: profile.email, ...profile.metadata })
       ]);
-      await this.db.query(`update auth.users set last_sign_in_at = now() where id = $1`, [existing.rows[0].user_id]);
+      await query(`update auth.users set last_sign_in_at = now() where id = $1`, [existing.rows[0].user_id]);
       return existing.rows[0].user_id;
     }
     let userId;
     const email = profile.email?.toLowerCase() ?? null;
     const verified = !!profile.email && profile.emailVerified === true;
     if (email && verified) {
-      const byEmail = await this.db.query(`select id from auth.users where email = $1`, [email]);
+      const byEmail = await query(`select id from auth.users where email = $1`, [email]);
       userId = byEmail.rows[0]?.id;
+      if (userId)
+        await this.assertUserEligible(query, userId);
     }
     if (!userId) {
       let userEmail = verified ? email : null;
       if (userEmail) {
-        const taken = await this.db.query(`select 1 from auth.users where email = $1`, [userEmail]);
+        const taken = await query(`select 1 from auth.users where email = $1`, [userEmail]);
         if (taken.rows.length > 0)
           userEmail = null;
       }
-      const created = await this.db.query(`insert into auth.users (aud, role, email, email_confirmed_at, last_sign_in_at, raw_app_meta_data, raw_user_meta_data)
+      const created = await query(`insert into auth.users (aud, role, email, email_confirmed_at, last_sign_in_at, raw_app_meta_data, raw_user_meta_data)
          values ('authenticated','authenticated',$1, $2, now(),
                  $3::jsonb, $4::jsonb) returning id`, [
         userEmail,
@@ -465,12 +494,22 @@ class OAuthService {
         throw new Error("OAuth user creation returned no row");
       userId = user.id;
     }
-    await this.db.query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+    await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
        values ($1, $2, $3, $4::jsonb)`, [userId, provider, profile.id, JSON.stringify({ sub: profile.id, email: profile.email, ...profile.metadata })]);
     if (!userId)
       throw new Error("OAuth identity has no user ID");
     return userId;
   }
+  async assertUserEligible(query, userId) {
+    const users = await query(`select deleted_at is not null as is_deleted,
+              coalesce(banned_until > now(), false) as is_banned
+       from auth.users where id = $1 for update`, [userId]);
+    const user = users.rows[0];
+    if (!user || user.is_deleted)
+      throw new OAuthAccountIneligibleError("user_not_found");
+    if (user.is_banned)
+      throw new OAuthAccountIneligibleError("user_banned");
+  }
 }
 function redirect(location) {
   return new Response(null, { status: 303, headers: { location } });
@@ -1356,6 +1395,8 @@ class AuthHandler {
         return await this.admin(req, ctx, path, method);
       return authError(404, "not_found", `unknown auth endpoint: ${path}`);
     } catch (e) {
+      if (e instanceof OAuthAccountIneligibleError)
+        return authError(400, e.code, e.message);
       const msg = e instanceof Error ? e.message : String(e);
       return authError(500, "unexpected_failure", msg);
     }
@@ -1450,8 +1491,7 @@ class AuthHandler {
       const userId = await this.oauth.exchangePkce(authCode, verifier);
       if (!userId)
         return authError(403, "flow_state_not_found", "invalid or expired auth code");
-      const ures = await this.db.query(`select * from auth.users where id = $1`, [userId]);
-      return json(200, await this.sessionForOAuth(ures.rows[0]));
+      return json(200, await this.sessionForOAuth(userId));
     }
     return authError(400, "invalid_grant", `unsupported grant_type: ${grantType}`);
   }
@@ -1746,7 +1786,10 @@ Or sign in with this link: ${link}`
       tokenTypes: `{${types.join(",")}}`,
       email: email?.toLowerCase().trim() ?? null
     };
-    return this.db.transaction((query) => this.claimEmailToken(query, redemption));
+    return this.db.transaction(async (query) => {
+      const user = await this.claimEmailToken(query, redemption);
+      return user ? this.sessionFor(user, undefined, undefined, query) : null;
+    });
   }
   async claimEmailToken(query, redemption) {
     const candidate = await this.findEmailTokenCandidate(query, redemption);
@@ -1758,7 +1801,10 @@ Or sign in with this link: ${link}`
     return claimedToken ? this.confirmEmailTokenUser(query, claimedToken) : null;
   }
   async lockAndDeleteEmailToken(query, candidate, redemption) {
-    await query(`select id from auth.users where id = $1 for update`, [candidate.user_id]);
+    const eligible = await query(`select id from auth.users where id = $1 and deleted_at is null
+         and (banned_until is null or banned_until <= now()) for update`, [candidate.user_id]);
+    if (eligible.rows.length === 0)
+      return null;
     const claimedTokens = await query(`delete from auth.one_time_tokens
        where id = $1 and token = $2 and token_type = any($3::text[])
          and expires_at > now() and attempts < $4
@@ -1811,10 +1857,10 @@ Or sign in with this link: ${link}`
       return json(200, session);
     }
     const types = body.type === "recovery" ? ["recovery"] : body.type === "magiclink" ? ["magiclink"] : ["otp", "magiclink"];
-    const user = await this.redeem(token, types, body.email);
-    if (!user)
+    const session = await this.redeem(token, types, body.email);
+    if (!session)
       return authError(403, "otp_expired", "Token has expired or is invalid");
-    return json(200, await this.sessionFor(user));
+    return json(200, session);
   }
   async redeemPhoneOtp(phone, code) {
     const tokenDigest = `hmac-sha256:v1:${await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-otp:v1", `${phone}\x00${code}`)}`;
@@ -1855,11 +1901,10 @@ Or sign in with this link: ${link}`
     const token = url.searchParams.get("token") ?? "";
     const type = url.searchParams.get("type") ?? "magiclink";
     const redirectTo = resolveRedirect(url.searchParams.get("redirect_to"), this.config.siteUrl, this.config.uriAllowList, this.config.enforceRedirectAllowList);
-    const user = await this.redeem(token, [type]);
-    if (!user) {
+    const session = await this.redeem(token, [type]);
+    if (!session) {
       return new Response(null, { status: 303, headers: { location: `${redirectTo}#error=access_denied&error_code=otp_expired` } });
     }
-    const session = await this.sessionFor(user);
     const hash = `#access_token=${session.access_token}&refresh_token=${session.refresh_token}&expires_in=${session.expires_in}&token_type=bearer&type=${type}`;
     return new Response(null, { status: 303, headers: { location: `${redirectTo}${hash}` } });
   }
@@ -2160,6 +2205,11 @@ Or sign in with this link: ${link}`
       return authError(422, "mfa_verification_failed", "Invalid TOTP code entered");
     }
     const session = await this.db.transaction(async (query) => {
+      const currentUsers = await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id]);
+      const currentUser = currentUsers.rows[0];
+      if (!currentUser)
+        return null;
       const claimed = await query(`update auth.mfa_challenges set verified_at = now()
          where id = $1 and factor_id = $2 and verified_at is null and expires_at >= now()
          returning id`, [challenge.id, factorId]);
@@ -2168,7 +2218,7 @@ Or sign in with this link: ${link}`
       if (factor.status !== "verified") {
         await query(`update auth.mfa_factors set status = 'verified', updated_at = now() where id = $1`, [factorId]);
       }
-      return this.sessionFor(user, undefined, {
+      return this.sessionFor(currentUser, undefined, {
         aal: "aal2",
         amr: [
           { method: "password", timestamp: Math.floor(Date.now() / 1000) },
@@ -2229,6 +2279,18 @@ Or sign in with this link: ${link}`
   }
   async rotateRefreshToken(token) {
     return this.db.transaction(async (query) => {
+      const availableToken = await this.findAvailableRefreshToken(query, token);
+      if (!availableToken)
+        return authError(400, "refresh_token_not_found", "Invalid Refresh Token: Refresh Token Not Found");
+      const userResult = await query(`select *, coalesce(banned_until > now(), false) as is_banned
+         from auth.users where id = $1 for update`, [availableToken.user_id]);
+      const user = userResult.rows[0];
+      if (!user || user.deleted_at !== null) {
+        return authError(400, "refresh_token_not_found", "Invalid Refresh Token: Refresh Token Not Found");
+      }
+      if (user.is_banned) {
+        return authError(400, "user_banned", "Invalid Refresh Token: User Banned");
+      }
       const claimedToken = await this.claimRefreshToken(query, token);
       if (!claimedToken)
         return authError(400, "refresh_token_not_found", "Invalid Refresh Token: Refresh Token Not Found");
@@ -2236,14 +2298,19 @@ Or sign in with this link: ${link}`
       const expiryError = this.refreshExpiryError(claimedToken, sessionStartedAt);
       if (expiryError)
         return expiryError;
-      const userResult = await query(`select * from auth.users where id = $1`, [claimedToken.user_id]);
-      const session = await this.sessionFor(userResult.rows[0], token, {
+      const session = await this.sessionFor(user, token, {
         sessionId: claimedToken.session_id ?? undefined,
         sessionStartedAt: sessionStartedAt === null ? undefined : Math.floor(sessionStartedAt / 1000)
       }, query);
       return json(200, session);
     });
   }
+  async findAvailableRefreshToken(query, token) {
+    const available = await query(`select user_id, session_id, created_at
+       from auth.refresh_tokens
+       where token = $1 and revoked is not true`, [token]);
+    return available.rows[0];
+  }
   async claimRefreshToken(query, token) {
     const claimed = await query(`update auth.refresh_tokens set revoked = true, updated_at = now()
        where token = $1 and revoked is not true
@@ -2271,7 +2338,8 @@ Or sign in with this link: ${link}`
     const claims = await this.claimsFromBearer(req);
     if (!claims?.sub)
       return null;
-    const res = await this.db.query(`select * from auth.users where id = $1`, [claims.sub]);
+    const res = await this.db.query(`select * from auth.users where id = $1 and deleted_at is null
+         and (banned_until is null or banned_until <= now())`, [claims.sub]);
     return res.rows[0] ?? null;
   }
   async claimsFromBearer(req) {
@@ -2300,14 +2368,22 @@ Or sign in with this link: ${link}`
       is_anonymous: u.is_anonymous ?? false
     };
   }
-  sessionForOAuth(user) {
-    return this.sessionFor(user, undefined, {
-      amr: [{ method: "oauth", timestamp: Math.floor(Date.now() / 1000) }]
+  sessionForOAuth(userId) {
+    return this.db.transaction(async (query) => {
+      const res = await query(`select *, coalesce(banned_until > now(), false) as is_banned
+         from auth.users where id = $1 for update`, [userId]);
+      const user = res.rows[0];
+      if (!user || user.deleted_at !== null)
+        throw new OAuthAccountIneligibleError("user_not_found");
+      if (user.is_banned)
+        throw new OAuthAccountIneligibleError("user_banned");
+      return this.sessionFor(user, undefined, {
+        amr: [{ method: "oauth", timestamp: Math.floor(Date.now() / 1000) }]
+      }, query);
     });
   }
   async oauthSessionTokensFor(userId) {
-    const res = await this.db.query(`select * from auth.users where id = $1`, [userId]);
-    const session = await this.sessionForOAuth(res.rows[0]);
+    const session = await this.sessionForOAuth(userId);
     return { access_token: session.access_token, refresh_token: session.refresh_token, expires_in: session.expires_in };
   }
   async sessionFor(user, parentToken, opts, query = (sql, params) => this.db.query(sql, params)) {
@@ -8972,8 +9048,18 @@ var IMAGE_FORMAT_CONTENT_TYPES = {
   gif: "image/gif"
 };
 var MAX_TRANSFORM_DIMENSION = 2500;
-var MAX_TRANSFORM_BYTES = 25 * 1024 * 1024;
+var MAX_TRANSFORM_BYTES = 500 * 1024 * 1024;
 var MAX_TRANSFORM_PIXELS = 50000000;
+function resolveImageTransformLimits(options = {}) {
+  const maxInputBytes = options.maxInputBytes === undefined ? MAX_TRANSFORM_BYTES : options.maxInputBytes;
+  const maxOutputBytes = options.maxOutputBytes === undefined ? MAX_TRANSFORM_BYTES : options.maxOutputBytes;
+  for (const [name, value] of Object.entries({ maxInputBytes, maxOutputBytes })) {
+    if (!Number.isSafeInteger(value) || value < 1 || value > MAX_TRANSFORM_BYTES) {
+      throw new Error(`Invalid image transformation ${name}: expected 1..${MAX_TRANSFORM_BYTES} bytes`);
+    }
+  }
+  return { maxInputBytes, maxOutputBytes };
+}
 function invalid(message) {
   return { ok: false, status: 400, error: "InvalidTransformation", message };
 }
@@ -9031,7 +9117,16 @@ function parseImageTransform(query) {
   if (quality !== undefined && format === "png") {
     return invalid("quality is supported only for jpeg and webp output");
   }
-  return { ok: true, value: { width, height, resize, quality, format } };
+  return {
+    ok: true,
+    value: {
+      resize,
+      format,
+      ...width === undefined ? {} : { width },
+      ...height === undefined ? {} : { height },
+      ...quality === undefined ? {} : { quality }
+    }
+  };
 }
 function imageTransformToSearchParams(options) {
   const query = new URLSearchParams;
@@ -9105,15 +9200,16 @@ function applyResize(image, metadata, options) {
   const proportionalWidth = Math.max(1, Math.round(metadata.width * height / metadata.height));
   image.resize(proportionalWidth);
 }
-async function transformImage(source, options, knownSourceSize) {
+async function transformImage(source, options, knownSourceSize, configuredLimits = {}) {
+  const limits = resolveImageTransformLimits(configuredLimits);
   const actualSourceSize = source instanceof Uint8Array ? source.byteLength : await Promise.resolve(source.size);
   const sourceSize = Math.max(knownSourceSize ?? 0, actualSourceSize);
-  if (sourceSize > MAX_TRANSFORM_BYTES) {
+  if (sourceSize > limits.maxInputBytes) {
     return {
       ok: false,
       status: 413,
       error: "ImageTooLarge",
-      message: "The source image exceeds the 25MB transformation limit"
+      message: `The source image exceeds the transformation limit (${limits.maxInputBytes} bytes)`
     };
   }
   const image = new Bun.Image(source, { maxPixels: MAX_TRANSFORM_PIXELS });
@@ -9146,12 +9242,12 @@ async function transformImage(source, options, knownSourceSize) {
   }
   try {
     const bytes = await image.bytes();
-    if (bytes.byteLength > MAX_TRANSFORM_BYTES) {
+    if (bytes.byteLength > limits.maxOutputBytes) {
       return {
         ok: false,
         status: 413,
         error: "ImageTooLarge",
-        message: "The transformed image exceeds the 25MB transformation limit"
+        message: `The transformed image exceeds the transformation limit (${limits.maxOutputBytes} bytes)`
       };
     }
     return { ok: true, bytes, contentType };
@@ -9354,10 +9450,12 @@ class StorageHandler {
   tusUploads = new Map;
   mutationTail = Promise.resolve();
   imageTransforms = new ImageTransformCache;
+  transformLimits;
   constructor(db, driver, config) {
     this.db = db;
     this.driver = driver;
     this.config = config;
+    this.transformLimits = resolveImageTransformLimits(config.imageTransformLimits);
   }
   async ensureBuckets(buckets) {
     for (const b of buckets) {
@@ -9633,7 +9731,7 @@ class StorageHandler {
         const source = await this.readObjectSource(row);
         if (source === null)
           throw new StorageObjectMissingError;
-        return transformImage(source, parsed.value, objectSize(row));
+        return transformImage(source, parsed.value, objectSize(row), this.transformLimits);
       });
     } catch (error) {
       if (error instanceof StorageObjectMissingError) {
@@ -11480,6 +11578,7 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
   const storage = new StorageHandler(db, config.storageDriver ?? new MemoryStorageDriver, {
     jwtSecret,
     defaultFileSizeLimit: config.storageFileSizeLimit,
+    imageTransformLimits: config.storageImageTransformLimits,
     log
   });
   if (config.buckets?.length) {
@@ -13701,6 +13800,19 @@ function readStorage(root) {
   const limit = getByteSize(storage, "file_size_limit");
   if (limit !== undefined)
     out.fileSizeLimit = limit;
+  const image = tableAt(root, "storage.image_transformation");
+  if (image) {
+    const limits = {};
+    for (const [key, field] of [["max_input_bytes", "maxInputBytes"], ["max_output_bytes", "maxOutputBytes"]]) {
+      if (!image.values.has(key))
+        continue;
+      const value = getByteSize(image, key);
+      if (value === undefined)
+        throw new Error(`Invalid image transformation ${key}`);
+      limits[field] = value;
+    }
+    out.imageTransformLimits = resolveImageTransformLimits(limits);
+  }
   const buckets = tableAt(root, "storage.buckets");
   if (buckets && buckets.children.size > 0) {
     out.buckets = [...buckets.children].map(([id, t]) => ({
@@ -14041,8 +14153,22 @@ async function loadFunctionsUnlocked(projectDir, options, mode) {
 import { lstat, readdir as readdir2, readFile as readFile5 } from "fs/promises";
 import { join as join6 } from "path";
 
-// node_modules/@supacloud/db/dist/index.js
+// ../db/dist/index.js
 import { createHash as createHash4 } from "crypto";
+
+// ../contracts/dist/index.mjs
+var commandErrorBrand = Symbol.for("@supacloud/contracts/CommandError/v1");
+var commandErrorCodes = new Set([
+  "COMMAND_INPUT_INVALID",
+  "COMMAND_REJECTED",
+  "COMMAND_UNAVAILABLE",
+  "COMMAND_IDEMPOTENCY_CONFLICT",
+  "COMMAND_RECEIPT_INVALID",
+  "COMMAND_OUTCOME_UNKNOWN",
+  "COMMAND_INPUT_EXPIRED"
+]);
+
+// ../db/dist/index.js
 var TOKEN = /__[A-Z][A-Z0-9_]*__/g;
 var RESERVED_TOKEN = /__SC_BINDING_[A-Z0-9_]+__/;
 var HASH = /^[a-f0-9]{64}$/;
@@ -14586,6 +14712,7 @@ async function createProjectBackend(options = {}) {
       dbSchemas: config.api.schemas,
       maxRows: config.api.maxRows,
       storageFileSizeLimit: config.storage.fileSizeLimit,
+      storageImageTransformLimits: config.storage.imageTransformLimits,
       buckets: config.storage.buckets,
       migrations: options.applyMigrations === false ? [] : project.migrations,
       seedSql: options.applyMigrations === false || options.includeSeed === false ? undefined : project.seedSql,

package/dist/project-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-runtime.d.ts","sourceRoot":"","sources":["../src/project-runtime.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAG7E,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAE3E,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAGrF,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAE/D,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AAC7F,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAkC,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAGrG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAK5D,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,gBAAgB,CAAC,EAAE,wBAAwB,CAAA;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iBAAiB,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,CAAA;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,EAAE,CAAC,EAAE,sBAAsB,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAA;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;IAC1F,OAAO,EAAE,oBAAoB,CAAA;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,YAAY,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,cAAc,CAAA;IAC9B,cAAc,EAAE,cAAc,CAAA;IAC9B,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CACxC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAChD,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAC5C,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAA;AAC9D,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;AAExE,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,qBAA0B,GAAG,YAAY,CAsBrF;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B7E;AAqED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAqCvF;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAE7G;AAED,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,cAAc,CAAC,CA+GvG;AAED,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CASrH;AAeD,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,qBAAqB,EAC9B,cAAc,iBAAwD,GACrE,wBAAwB,GAAG,SAAS,CAyBtC;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,MAAM,UAAQ,GAAG,cAAc,CAa5F;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,CAIhG;AAiBD,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiC3G"}
+{"version":3,"file":"project-runtime.d.ts","sourceRoot":"","sources":["../src/project-runtime.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAG7E,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAE3E,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAGrF,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAE/D,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AAC7F,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAkC,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAGrG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAK5D,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,gBAAgB,CAAC,EAAE,wBAAwB,CAAA;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iBAAiB,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,CAAA;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,EAAE,CAAC,EAAE,sBAAsB,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAA;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;IAC1F,OAAO,EAAE,oBAAoB,CAAA;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,YAAY,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,cAAc,CAAA;IAC9B,cAAc,EAAE,cAAc,CAAA;IAC9B,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CACxC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAChD,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAC5C,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAA;AAC9D,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;AAExE,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,qBAA0B,GAAG,YAAY,CAsBrF;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B7E;AAqED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAqCvF;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAE7G;AAED,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,cAAc,CAAC,CAgHvG;AAED,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CASrH;AAeD,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,qBAAqB,EAC9B,cAAc,iBAAwD,GACrE,wBAAwB,GAAG,SAAS,CAyBtC;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,MAAM,UAAQ,GAAG,cAAc,CAa5F;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,CAIhG;AAiBD,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiC3G"}

package/dist/runtime/auth/handler.d.ts

@@ -163,6 +163,7 @@ export declare class AuthHandler {
     private ensureEmailIdentity;
     private userJsonWithRelations;
     private rotateRefreshToken;
+    private findAvailableRefreshToken;
     private claimRefreshToken;
     private refreshSessionStartedAt;
     private refreshExpiryError;

package/dist/runtime/auth/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAc,SAAS,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGnE,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAG7C,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,KAAK,CAAA;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CACjC;AAED,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACjD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAClD,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAClC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CACjC;AAgID,wEAAwE;AACxE,qBAAa,WAAW;IAYpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,OAAO,CAAC,KAAK,CAAc;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,wBAAwB,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAQ;gBAGd,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IAe5B;;;OAGG;IACH,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,QAAQ;IAUhB,4EAA4E;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAQb,oCAAoC;IAgBlD,8FAA8F;IACxF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YA0D9D,gBAAgB;YAYhB,MAAM;YAiEN,KAAK;YA+CL,OAAO;YAMP,UAAU;YA6DV,MAAM;YAwBN,UAAU;YA4CV,OAAO;YAqBP,eAAe;YAqDf,eAAe;YAmCf,SAAS;YAwBT,kBAAkB;IAShC,OAAO,CAAC,mBAAmB;YASb,eAAe;YAgBf,YAAY;YAaZ,qBAAqB;YAgBrB,qBAAqB;IAUnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,kBAAkB;YAQZ,YAAY;IAM1B,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAI;YAE9B,MAAM;YASN,eAAe;YAWf,uBAAuB;YAkBvB,qBAAqB;YAUrB,uBAAuB;YAcvB,6BAA6B;YAa7B,WAAW;YAsCX,cAAc;YAyDd,UAAU;YAuBV,KAAK;YA0HL,sBAAsB;IAuEpC;;;OAGG;YACW,KAAK;IAqBnB;;;;;OAKG;YACW,UAAU;IA2CxB;;;;;;;;;OASG;YACW,SAAS;YAqBT,YAAY;YAyDZ,eAAe;YAqBf,YAAY;YAmDZ,cAAc;YAWd,cAAc;IAmB5B,oFAAoF;YACtE,iBAAiB;YAqBjB,mBAAmB;YAcnB,qBAAqB;YAarB,kBAAkB;YAqBlB,iBAAiB;YAUjB,uBAAuB;IASrC,OAAO,CAAC,kBAAkB;YAoBZ,cAAc;YAOd,gBAAgB;IAM9B,wEAAwE;IACxE,QAAQ,CACN,CAAC,EAAE,OAAO,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,EACvC,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAqB1B,OAAO,CAAC,eAAe;YAMT,qBAAqB;YAYrB,UAAU;CAqDzB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAc,SAAS,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAA6C,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGhG,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAG7C,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,KAAK,CAAA;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CACjC;AAED,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACjD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAClD,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAClC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CACjC;AAgID,wEAAwE;AACxE,qBAAa,WAAW;IAYpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,OAAO,CAAC,KAAK,CAAc;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,wBAAwB,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAQ;gBAGd,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IAe5B;;;OAGG;IACH,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,QAAQ;IAUhB,4EAA4E;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAQb,oCAAoC;IAgBlD,8FAA8F;IACxF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YA2D9D,gBAAgB;YAYhB,MAAM;YAiEN,KAAK;YA8CL,OAAO;YAMP,UAAU;YA6DV,MAAM;YAwBN,UAAU;YA4CV,OAAO;YAqBP,eAAe;YAqDf,eAAe;YAmCf,SAAS;YAwBT,kBAAkB;IAShC,OAAO,CAAC,mBAAmB;YASb,eAAe;YAgBf,YAAY;YAaZ,qBAAqB;YAgBrB,qBAAqB;IAUnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,kBAAkB;YAQZ,YAAY;IAM1B,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAI;YAE9B,MAAM;YAYN,eAAe;YAWf,uBAAuB;YAuBvB,qBAAqB;YAUrB,uBAAuB;YAcvB,6BAA6B;YAa7B,WAAW;YAsCX,cAAc;YAyDd,UAAU;YAsBV,KAAK;YA0HL,sBAAsB;IAuEpC;;;OAGG;YACW,KAAK;IAqBnB;;;;;OAKG;YACW,UAAU;IA2CxB;;;;;;;;;OASG;YACW,SAAS;YAqBT,YAAY;YAyDZ,eAAe;YAqBf,YAAY;YA0DZ,cAAc;YAWd,cAAc;IAmB5B,oFAAoF;YACtE,iBAAiB;YAqBjB,mBAAmB;YAcnB,qBAAqB;YAarB,kBAAkB;YAmClB,yBAAyB;YAUzB,iBAAiB;YAUjB,uBAAuB;IASrC,OAAO,CAAC,kBAAkB;YAoBZ,cAAc;YAWd,gBAAgB;IAM9B,wEAAwE;IACxE,QAAQ,CACN,CAAC,EAAE,OAAO,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,EACvC,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAqB1B,OAAO,CAAC,eAAe;YAgBT,qBAAqB;YAWrB,UAAU;CAqDzB"}

package/dist/runtime/auth/oauth.d.ts

@@ -12,6 +12,10 @@
  */
 import type { Database } from '../db/database.js';
 type OAuthRawProfile = Record<string, unknown>;
+export declare class OAuthAccountIneligibleError extends Error {
+    readonly code: 'user_banned' | 'user_not_found';
+    constructor(code: 'user_banned' | 'user_not_found');
+}
 /** Operator-supplied config for one OAuth provider. Endpoint URLs are optional for presets (google, github). */
 export interface OAuthProviderConfig {
     /** OAuth client id issued by the provider */
@@ -75,6 +79,8 @@ export declare class OAuthService {
     private exchangeCode;
     private fetchProfile;
     private upsertUser;
+    private upsertUserInTransaction;
+    private assertUserEligible;
 }
 /** The minimal session the callback puts in the redirect fragment for the implicit flow. */
 export interface OAuthSession {

package/dist/runtime/auth/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAIjD,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE9C,gHAAgH;AAChH,MAAM,WAAW,mBAAmB;IAClC,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAA;IACpB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,YAAY,CAAA;CACpD;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,EAAE,EAAE,MAAM,CAAA;IACV,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,qFAAqF;IACrF,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,UAAU,gBAAiB,SAAQ,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;IAClF,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,YAAY,CAAA;CACnD;AAgCD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,gBAAgB,CAsBxF;AAED,uFAAuF;AACvF,qBAAa,YAAY;IAIrB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,OAAO;IAEf,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,wBAAwB;IATlC,OAAO,CAAC,SAAS,CAAsC;gBAG7C,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACpC,SAAS,GAAE,OAAO,KAAa,EAC/B,YAAY,GAAE,MAAM,EAAO,EAC3B,wBAAwB,UAAQ;IAO1C,qDAAqD;IACrD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B,OAAO,CAAC,WAAW;IAInB,gEAAgE;IAC1D,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAgC5C,0EAA0E;IACpE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IA0CrG,oFAAoF;IAC9E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAiBhE,YAAY;YAmBZ,YAAY;YAUZ,UAAU;CA2DzB;AAED,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,gCAAgC;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,2BAA2B;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAA;CACnB"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,mBAAmB,CAAA;AAI1D,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE9C,qBAAa,2BAA4B,SAAQ,KAAK;aACxB,IAAI,EAAE,aAAa,GAAG,gBAAgB;gBAAtC,IAAI,EAAE,aAAa,GAAG,gBAAgB;CAGnE;AAED,gHAAgH;AAChH,MAAM,WAAW,mBAAmB;IAClC,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAA;IACpB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,YAAY,CAAA;CACpD;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,EAAE,EAAE,MAAM,CAAA;IACV,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,qFAAqF;IACrF,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,UAAU,gBAAiB,SAAQ,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;IAClF,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,YAAY,CAAA;CACnD;AAgCD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,gBAAgB,CAsBxF;AAED,uFAAuF;AACvF,qBAAa,YAAY;IAIrB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,OAAO;IAEf,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,wBAAwB;IATlC,OAAO,CAAC,SAAS,CAAsC;gBAG7C,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACpC,SAAS,GAAE,OAAO,KAAa,EAC/B,YAAY,GAAE,MAAM,EAAO,EAC3B,wBAAwB,UAAQ;IAO1C,qDAAqD;IACrD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B,OAAO,CAAC,WAAW;IAInB,gEAAgE;IAC1D,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAgC5C,0EAA0E;IACpE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IA0DrG,oFAAoF;IAC9E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAiBhE,YAAY;YAmBZ,YAAY;YAUZ,UAAU;YAIV,uBAAuB;YA8DvB,kBAAkB;CAWjC;AAED,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,gCAAgC;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,2BAA2B;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAA;CACnB"}

package/dist/runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAA8B,MAAM,wBAAwB,CAAA;AAGrF,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAIrD,OAAO,EAAE,eAAe,EAAwB,MAAM,uBAAuB,CAAA;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAU,aAAa,EAA6B,MAAM,YAAY,CAAA;AAEjG,OAAO,EAAkC,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAKrF,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAE,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACxD,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AACzE,OAAO,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACjG,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3D,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAExD;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,iBAAiB,CAAA;IAC1B,oGAAoG;IACpG,KAAK,EAAE,OAAO,KAAK,CAAA;IACnB,mFAAmF;IACnF,EAAE,EAAE,QAAQ,CAAA;IACZ,6EAA6E;IAC7E,QAAQ,EAAE,cAAc,CAAA;IACxB,6EAA6E;IAC7E,SAAS,EAAE,gBAAgB,CAAA;IAC3B,qEAAqE;IACrE,QAAQ,EAAE,eAAe,CAAA;IACzB,mCAAmC;IACnC,IAAI,EAAE,WAAW,CAAA;IACjB,wDAAwD;IACxD,GAAG,EAAE,UAAU,CAAA;IACf,6EAA6E;IAC7E,SAAS,EAAE,gBAAgB,CAAA;IAC3B,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAA;IACf,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAA;IACtB,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,IAAI,EAAE,SAAS,CAAA;IACf,4FAA4F;IAC5F,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,gHAAgH;IAChH,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,8CAA8C;IAC9C,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7E,gGAAgG;IAChG,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAWD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CAAC,MAAM,GAAE,aAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAwZ7F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAA8B,MAAM,wBAAwB,CAAA;AAGrF,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAIrD,OAAO,EAAE,eAAe,EAAwB,MAAM,uBAAuB,CAAA;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAU,aAAa,EAA6B,MAAM,YAAY,CAAA;AAEjG,OAAO,EAAkC,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAKrF,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAE,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACxD,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AACzE,OAAO,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACjG,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3D,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAExD;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,iBAAiB,CAAA;IAC1B,oGAAoG;IACpG,KAAK,EAAE,OAAO,KAAK,CAAA;IACnB,mFAAmF;IACnF,EAAE,EAAE,QAAQ,CAAA;IACZ,6EAA6E;IAC7E,QAAQ,EAAE,cAAc,CAAA;IACxB,6EAA6E;IAC7E,SAAS,EAAE,gBAAgB,CAAA;IAC3B,qEAAqE;IACrE,QAAQ,EAAE,eAAe,CAAA;IACzB,mCAAmC;IACnC,IAAI,EAAE,WAAW,CAAA;IACjB,wDAAwD;IACxD,GAAG,EAAE,UAAU,CAAA;IACf,6EAA6E;IAC7E,SAAS,EAAE,gBAAgB,CAAA;IAC3B,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAA;IACf,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAA;IACtB,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,IAAI,EAAE,SAAS,CAAA;IACf,4FAA4F;IAC5F,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,gHAAgH;IAChH,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,8CAA8C;IAC9C,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7E,gGAAgG;IAChG,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAWD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CAAC,MAAM,GAAE,aAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAyZ7F"}

package/dist/runtime/node/load-config.d.ts

@@ -12,6 +12,7 @@ import type { AuthSettings } from '../auth/settings.js';
 import type { OAuthProviderConfig } from '../auth/oauth.js';
 import type { RateLimitRule } from '../auth/rate-limit.js';
 import type { BucketSeed } from '../types.js';
+import { type ImageTransformLimits } from '../storage/image-transform.js';
 import { type RuntimeMode } from '../functions/profile.js';
 import type { GraphqlOptions } from '../graphql.js';
 import { type Environment } from './config-toml.js';
@@ -70,6 +71,8 @@ export interface ApiConfig {
 export interface StorageConfig {
     /** [storage].file_size_limit: default per-bucket byte limit */
     fileSizeLimit?: number;
+    /** [storage.image_transformation].max_input_bytes / max_output_bytes */
+    imageTransformLimits?: ImageTransformLimits;
     /** [storage.buckets.*]: buckets to create at boot */
     buckets?: BucketSeed[];
 }

package/dist/runtime/node/load-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"load-config.d.ts","sourceRoot":"","sources":["../../../src/runtime/node/load-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAUL,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAA;AAEzB,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE;QACJ,WAAW,EAAE,WAAW,CAAA;QACxB,OAAO,EAAE,cAAc,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,iBAAiB,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAA;KAClF,CAAA;IACD,0EAA0E;IAC1E,IAAI,EAAE,UAAU,CAAA;IAChB,mDAAmD;IACnD,GAAG,EAAE,SAAS,CAAA;IACd,kEAAkE;IAClE,OAAO,EAAE,aAAa,CAAA;IACtB,gDAAgD;IAChD,IAAI,EAAE,UAAU,CAAA;IAChB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;CAC3C;AAED,yFAAyF;AACzF,MAAM,WAAW,UAAU;IACzB,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IAC/B,sBAAsB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IAC1C,uCAAuC;IACvC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,kDAAkD;IAClD,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;CACpD;AAED,wCAAwC;AACxC,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,qDAAqD;IACrD,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;CACvB;AAED,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,wBAAwB;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,iDAAiD;AACjD,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,oCAAoC;IACpC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,yBAAyB,EAAE,iBAAiB,CAAA;IAC/D,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6FAA6F;IAC7F,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,+FAA+F;IAC/F,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,2FAA2F;IAC3F,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,yGAAyG;IACzG,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,uGAAuG;IACvG,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,8HAA8H;IAC9H,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,GAAE,WAAyB,EAAE,YAAY,CAAC,EAAE,WAAW,GAAG,aAAa,CAW/H"}
+{"version":3,"file":"load-config.d.ts","sourceRoot":"","sources":["../../../src/runtime/node/load-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAA+B,KAAK,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACtG,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAUL,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAA;AAEzB,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE;QACJ,WAAW,EAAE,WAAW,CAAA;QACxB,OAAO,EAAE,cAAc,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,iBAAiB,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAA;KAClF,CAAA;IACD,0EAA0E;IAC1E,IAAI,EAAE,UAAU,CAAA;IAChB,mDAAmD;IACnD,GAAG,EAAE,SAAS,CAAA;IACd,kEAAkE;IAClE,OAAO,EAAE,aAAa,CAAA;IACtB,gDAAgD;IAChD,IAAI,EAAE,UAAU,CAAA;IAChB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;CAC3C;AAED,yFAAyF;AACzF,MAAM,WAAW,UAAU;IACzB,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IAC/B,sBAAsB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IAC1C,uCAAuC;IACvC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,kDAAkD;IAClD,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;CACpD;AAED,wCAAwC;AACxC,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wEAAwE;IACxE,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C,qDAAqD;IACrD,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;CACvB;AAED,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,wBAAwB;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,iDAAiD;AACjD,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,oCAAoC;IACpC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,yBAAyB,EAAE,iBAAiB,CAAA;IAC/D,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6FAA6F;IAC7F,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,+FAA+F;IAC/F,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,2FAA2F;IAC3F,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,yGAAyG;IACzG,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,uGAAuG;IACvG,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,8HAA8H;IAC9H,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,GAAE,WAAyB,EAAE,YAAY,CAAC,EAAE,WAAW,GAAG,aAAa,CAW/H"}

package/dist/runtime/storage/handler.d.ts

@@ -4,6 +4,7 @@
  * through the request role); bytes live behind a StorageDriver.
  */
 import type { Database } from '../db/database.js';
+import { type ImageTransformLimits } from './image-transform.js';
 import type { BucketSeed, RequestContext, StorageDriver } from '../types.js';
 /** Construction options for {@link StorageHandler}. */
 export interface StorageConfig {
@@ -11,6 +12,7 @@ export interface StorageConfig {
     jwtSecret: string;
     /** default per-bucket byte limit applied when a bucket sets none (config.toml storage.file_size_limit) */
     defaultFileSizeLimit?: number;
+    imageTransformLimits?: ImageTransformLimits;
     /** sink for progress/warning lines (e.g. image-transform no-op); no-op when omitted */
     log?: (message: string) => void;
 }
@@ -22,6 +24,7 @@ export declare class StorageHandler {
     private tusUploads;
     private mutationTail;
     private imageTransforms;
+    private readonly transformLimits;
     constructor(db: Database, driver: StorageDriver, config: StorageConfig);
     /** Create the given buckets if they don't already exist (config.toml storage.buckets.*). */
     ensureBuckets(buckets: BucketSeed[]): Promise<void>;