@supacloud/lite 0.31.1 → 0.31.3

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [0.31.3](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.31.2...supacloud-lite-v0.31.3) (2026-10-17)
+
+
+### Bug Fixes
+
+* **cli:** align verification target resolution ([#2052](https://github.com/vibeunion/supacloud/issues/2052)) ([3cfcc36](https://github.com/vibeunion/supacloud/commit/3cfcc362f87ecdaf82a4df303f5af436875fb36e))
+* **lite:** align default storage size limit ([#2053](https://github.com/vibeunion/supacloud/issues/2053)) ([8414234](https://github.com/vibeunion/supacloud/commit/8414234d72fc42440ea1133646d6b11422097a4a))
+* **lite:** validate image size metadata ([#2046](https://github.com/vibeunion/supacloud/issues/2046)) ([9ea248e](https://github.com/vibeunion/supacloud/commit/9ea248ecca9cebf5b1bba8b70ea50195613d1f3d))
+* **supacloud-lite:** bind email tokens to current account address ([#2047](https://github.com/vibeunion/supacloud/issues/2047)) ([355d08c](https://github.com/vibeunion/supacloud/commit/355d08cdbc7d0d90085a2208557f1decc1d15e82))
+
+## [0.31.2](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.31.1...supacloud-lite-v0.31.2) (2026-10-17)
+
+
+### Bug Fixes
+
+* **cli:** sync published compiler dependency ([#2041](https://github.com/vibeunion/supacloud/issues/2041)) ([be44641](https://github.com/vibeunion/supacloud/commit/be446416b87bf009eec892bc20368e3595d7326a))
+* **lite:** preflight image transformation size ([#2037](https://github.com/vibeunion/supacloud/issues/2037)) ([fd0e790](https://github.com/vibeunion/supacloud/commit/fd0e790a18513dfd7fa1682b7e72c0a147f392cc))
+* recheck password issuance and align published tool dependencies ([#2039](https://github.com/vibeunion/supacloud/issues/2039)) ([250b1af](https://github.com/vibeunion/supacloud/commit/250b1afef3f78d6dd4ab34e94147f65beb8a8677))
+
 ## [0.31.1](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.31.0...supacloud-lite-v0.31.1) (2026-10-17)
 
 

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.31.1",
+  version: "0.31.3",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -67,16 +67,16 @@ var package_default = {
     "@electric-sql/pglite-pgmq": "0.0.8",
     "@electric-sql/pglite-pgvector": "0.0.11",
     "@electric-sql/pglite-postgis": "0.2.10",
-    "@supacloud/db": "0.18.2",
+    "@supacloud/db": "0.18.4",
     "exact-mirror": "1.2.6",
     tar: "^7.5.22",
     typebox: "1.3.37"
   },
   devDependencies: {
-    "@supacloud/app": "0.28.1",
-    "@supacloud/contracts": "0.11.3",
-    "@supacloud/compiler": "0.47.1",
-    "@supacloud/elysia": "0.33.3",
+    "@supacloud/app": "0.28.3",
+    "@supacloud/contracts": "0.11.5",
+    "@supacloud/compiler": "0.47.3",
+    "@supacloud/elysia": "0.33.5",
     "@supabase/supabase-js": "^2.117.3",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
@@ -85,13 +85,13 @@ var package_default = {
     typescript: "^7.0.2"
   },
   overrides: {
-    "@supacloud/db": "0.18.2",
-    "@supacloud/app": "0.28.1",
-    "@supacloud/compiler": "0.47.1",
-    "@supacloud/elysia": "0.33.3",
-    "@supacloud/contracts": "0.11.3",
-    "@supacloud/commands": "0.9.5",
-    "@supacloud/delivery": "0.19.2",
+    "@supacloud/db": "0.18.4",
+    "@supacloud/app": "0.28.3",
+    "@supacloud/compiler": "0.47.3",
+    "@supacloud/elysia": "0.33.5",
+    "@supacloud/contracts": "0.11.5",
+    "@supacloud/commands": "0.9.7",
+    "@supacloud/delivery": "0.19.4",
     "@graphql-tools/utils": "^12.0.4"
   },
   engines: {
@@ -1464,12 +1464,33 @@ class AuthHandler {
         await this.audit("login_failed", { actorEmail: email, traits: { grant_type: "password" } });
         return authError(400, "invalid_credentials", "Invalid login credentials");
       }
-      if (!this.settings.autoconfirm && !user.email_confirmed_at) {
-        return authError(400, "email_not_confirmed", "Email not confirmed");
+      const response = await this.db.transaction(async (query) => {
+        const currentResult = await query(`select *, coalesce(banned_until > now(), false) as is_banned
+           from auth.users where id = $1 for update`, [user.id]);
+        const current = currentResult.rows[0];
+        if (!current || current.deleted_at !== null || !current.encrypted_password || current.email !== email) {
+          return authError(400, "invalid_credentials", "Invalid login credentials");
+        }
+        if (current.is_banned) {
+          return authError(400, "user_banned", "User is banned");
+        }
+        if (current.encrypted_password !== user.encrypted_password) {
+          return authError(400, "invalid_credentials", "Invalid login credentials");
+        }
+        if (!this.settings.autoconfirm && !current.email_confirmed_at) {
+          return authError(400, "email_not_confirmed", "Email not confirmed");
+        }
+        const signedIn = await query(`update auth.users set last_sign_in_at = now() where id = $1 returning *`, [current.id]);
+        const updated = signedIn.rows[0];
+        if (!updated) {
+          return authError(400, "invalid_credentials", "Invalid login credentials");
+        }
+        return json(200, await this.sessionFor(updated, undefined, undefined, query));
+      });
+      if (response.ok) {
+        await this.audit("login", { actorId: user.id, actorEmail: email, traits: { grant_type: "password" } });
       }
-      await this.db.query(`update auth.users set last_sign_in_at = now() where id = $1`, [user.id]);
-      await this.audit("login", { actorId: user.id, actorEmail: user.email, traits: { grant_type: "password" } });
-      return json(200, await this.sessionFor(user));
+      return response;
     }
     if (grantType === "refresh_token") {
       const token = body.refresh_token;
@@ -1505,16 +1526,6 @@ class AuthHandler {
     if (body.email && !this.settings.autoconfirm) {
       return authError(501, "email_change_confirmation_not_supported", "Email changes that require confirmation are not supported by SupaCloud Lite V1");
     }
-    const upgradingAnon = (user.is_anonymous ?? false) && !!body.email;
-    if (body.email) {
-      const email = body.email.toLowerCase().trim();
-      const clash = await this.db.query(`select id from auth.users where email = $1 and id <> $2`, [email, user.id]);
-      if (clash.rows.length > 0) {
-        return authError(422, "email_exists", "A user with this email address has already been registered");
-      }
-      params.push(email);
-      sets.push(`email = $${params.length}, email_confirmed_at = now()`);
-    }
     if (body.password) {
       if (body.password.length < this.settings.minPasswordLength) {
         return authError(422, "weak_password", `Password should be at least ${this.settings.minPasswordLength} characters.`);
@@ -1526,22 +1537,41 @@ class AuthHandler {
       params.push(JSON.stringify(body.data));
       sets.push(`raw_user_meta_data = coalesce(raw_user_meta_data, '{}'::jsonb) || $${params.length}::jsonb`);
     }
-    if (upgradingAnon) {
-      sets.push(`is_anonymous = false`);
-      sets.push(`raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb) || '{"provider":"email","providers":["email"]}'::jsonb`);
-    }
-    if (sets.length === 0) {
-      return json(200, this.userJson(user, await this.getUserFactors(user.id), await this.getUserIdentities(user.id)));
-    }
-    params.push(user.id);
-    const payload = await this.db.transaction(async (query) => {
-      const res = await query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
-      const updated = res.rows[0];
+    const response = await this.db.transaction(async (query) => {
+      const currentResult = await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id]);
+      const current = currentResult.rows[0];
+      if (!current)
+        return authError(401, "no_authorization", "Invalid or expired token");
+      const transactionSets = [...sets];
+      const transactionParams = [...params];
+      const upgradingAnon = (current.is_anonymous ?? false) && !!body.email;
+      if (body.email) {
+        const email = body.email.toLowerCase().trim();
+        const clash = await query(`select id from auth.users where email = $1 and id <> $2`, [email, current.id]);
+        if (clash.rows.length > 0) {
+          return authError(422, "email_exists", "A user with this email address has already been registered");
+        }
+        transactionParams.push(email);
+        transactionSets.push(`email = $${transactionParams.length}, email_confirmed_at = now()`);
+      }
+      if (upgradingAnon) {
+        transactionSets.push(`is_anonymous = false`);
+        transactionSets.push(`raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb) || '{"provider":"email","providers":["email"]}'::jsonb`);
+      }
+      if (transactionSets.length === 0) {
+        return json(200, await this.userJsonWithRelations(current, query));
+      }
+      transactionParams.push(current.id);
+      const updatedResult = await query(`update auth.users set ${transactionSets.join(", ")}, updated_at = now() where id = $${transactionParams.length} returning *`, transactionParams);
+      const updated = updatedResult.rows[0];
+      if (!updated)
+        return authError(401, "no_authorization", "Invalid or expired token");
       if (body.email)
         await this.ensureEmailIdentity(updated, query);
-      return this.userJsonWithRelations(updated, query);
+      return json(200, await this.userJsonWithRelations(updated, query));
     });
-    return json(200, payload);
+    return response;
   }
   async logout(req, url) {
     const claims = await this.claimsFromBearer(req);
@@ -1795,8 +1825,8 @@ Or sign in with this link: ${link}`
     return claimedToken ? this.confirmEmailTokenUser(query, claimedToken) : null;
   }
   async lockAndDeleteEmailToken(query, candidate, redemption) {
-    const eligible = await query(`select id from auth.users where id = $1 and deleted_at is null
-         and (banned_until is null or banned_until <= now()) for update`, [candidate.user_id]);
+    const eligible = await query(`select id from auth.users where id = $1 and lower(email) = lower($2)
+         and deleted_at is null and (banned_until is null or banned_until <= now()) for update`, [candidate.user_id, candidate.email]);
     if (eligible.rows.length === 0)
       return null;
     const claimedTokens = await query(`delete from auth.one_time_tokens
@@ -1859,11 +1889,10 @@ Or sign in with this link: ${link}`
   async redeemPhoneOtp(phone, code) {
     const tokenDigest = `hmac-sha256:v1:${await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-otp:v1", `${phone}\x00${code}`)}`;
     return this.db.transaction(async (query) => {
-      const claimed = await query(`delete from auth.one_time_tokens
+      const candidate = await query(`select user_id from auth.one_time_tokens
          where phone = $1 and token_type = 'sms' and token = $2
-           and expires_at > now() and attempts < $3
-         returning user_id`, [phone, tokenDigest, AuthHandler.MAX_OTP_ATTEMPTS]);
-      const userId = claimed.rows[0]?.user_id;
+           and expires_at > now() and attempts < $3`, [phone, tokenDigest, AuthHandler.MAX_OTP_ATTEMPTS]);
+      const userId = candidate.rows[0]?.user_id;
       if (!userId) {
         const attempt = await query(`update auth.one_time_tokens set attempts = attempts + 1
            where phone = $1 and token_type = 'sms' and expires_at > now()
@@ -1875,6 +1904,22 @@ Or sign in with this link: ${link}`
         await query(`delete from auth.one_time_tokens where phone = $1 and expires_at <= now()`, [phone]);
         return null;
       }
+      const currentUser = await query(`select phone,
+           deleted_at is null and (banned_until is null or banned_until <= now()) as auth_eligible
+         from auth.users where id = $1 for update`, [userId]);
+      const current = currentUser.rows[0];
+      if (!current || current.phone !== phone)
+        return null;
+      if (!current.auth_eligible) {
+        await query(`delete from auth.one_time_tokens where phone = $1`, [phone]);
+        return null;
+      }
+      const claimed = await query(`delete from auth.one_time_tokens
+         where phone = $1 and token_type = 'sms' and token = $2
+           and expires_at > now() and attempts < $3 and user_id = $4
+         returning user_id`, [phone, tokenDigest, AuthHandler.MAX_OTP_ATTEMPTS, userId]);
+      if (claimed.rows.length === 0)
+        return null;
       await query(`delete from auth.one_time_tokens where phone = $1`, [phone]);
       const users = await query(`update auth.users
          set phone_confirmed_at = coalesce(phone_confirmed_at, now()), last_sign_in_at = now(), updated_at = now()
@@ -2180,6 +2225,9 @@ Or sign in with this link: ${link}`
     const user = await this.userFromBearer(req);
     if (!user)
       return authError(401, "no_authorization", "This endpoint requires a Bearer token");
+    if (!this.settings.totpVerifyEnabled) {
+      return authError(422, "mfa_totp_verify_disabled", "TOTP verification is disabled");
+    }
     const body = await req.json().catch(() => ({}));
     const fr = await this.db.query(`select id, secret, status from auth.mfa_factors where id = $1 and user_id = $2`, [factorId, user.id]);
     const factor = fr.rows[0];
@@ -9066,6 +9114,14 @@ function resolveImageTransformLimits(options = {}) {
   }
   return { maxInputBytes, maxOutputBytes };
 }
+function imageTransformInputTooLarge(maxInputBytes) {
+  return {
+    ok: false,
+    status: 413,
+    error: "ImageTooLarge",
+    message: `The source image exceeds the transformation limit (${maxInputBytes} bytes)`
+  };
+}
 function invalid(message) {
   return { ok: false, status: 400, error: "InvalidTransformation", message };
 }
@@ -9209,14 +9265,10 @@ function applyResize(image, metadata, options) {
 async function transformImage(source, options, knownSourceSize, configuredLimits = {}) {
   const limits = resolveImageTransformLimits(configuredLimits);
   const actualSourceSize = source instanceof Uint8Array ? source.byteLength : await Promise.resolve(source.size);
-  const sourceSize = Math.max(knownSourceSize ?? 0, actualSourceSize);
+  const declaredSourceSize = typeof knownSourceSize === "number" && Number.isFinite(knownSourceSize) && knownSourceSize >= 0 ? knownSourceSize : 0;
+  const sourceSize = Math.max(declaredSourceSize, actualSourceSize);
   if (sourceSize > limits.maxInputBytes) {
-    return {
-      ok: false,
-      status: 413,
-      error: "ImageTooLarge",
-      message: `The source image exceeds the transformation limit (${limits.maxInputBytes} bytes)`
-    };
+    return imageTransformInputTooLarge(limits.maxInputBytes);
   }
   const image = new Bun.Image(source, { maxPixels: MAX_TRANSFORM_PIXELS });
   let metadata;
@@ -9440,7 +9492,7 @@ function isRenderableActiveType(contentType) {
   return t === "text/html" || t === "application/xhtml+xml" || t === "image/svg+xml" || t === "application/xml" || t === "text/xml";
 }
 var TUS_VERSION = "1.0.0";
-var DEFAULT_FILE_SIZE_LIMIT = 50 * 1024 * 1024;
+var DEFAULT_FILE_SIZE_LIMIT = 500 * 1024 * 1024;
 var MULTIPART_OVERHEAD_LIMIT = 1024 * 1024;
 var MAX_CONCURRENT_TUS_UPLOADS = 4;
 var MAX_COMPLETED_TUS_UPLOADS = 64;
@@ -9731,6 +9783,11 @@ class StorageHandler {
     const parsed = parseImageTransform(url.searchParams);
     if (!parsed.ok)
       return storageError(parsed.status, parsed.error, parsed.message);
+    const declaredSize = objectSize(row);
+    if (declaredSize !== undefined && declaredSize > this.transformLimits.maxInputBytes) {
+      const rejected = imageTransformInputTooLarge(this.transformLimits.maxInputBytes);
+      return storageError(rejected.status, rejected.error, rejected.message);
+    }
     let result;
     try {
       result = await this.imageTransforms.getOrTransform(imageTransformCacheKey(row.version, parsed.value), async () => {

package/dist/index.js

@@ -88,7 +88,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.31.1",
+  version: "0.31.3",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -147,16 +147,16 @@ var package_default = {
     "@electric-sql/pglite-pgmq": "0.0.8",
     "@electric-sql/pglite-pgvector": "0.0.11",
     "@electric-sql/pglite-postgis": "0.2.10",
-    "@supacloud/db": "0.18.2",
+    "@supacloud/db": "0.18.4",
     "exact-mirror": "1.2.6",
     tar: "^7.5.22",
     typebox: "1.3.37"
   },
   devDependencies: {
-    "@supacloud/app": "0.28.1",
-    "@supacloud/contracts": "0.11.3",
-    "@supacloud/compiler": "0.47.1",
-    "@supacloud/elysia": "0.33.3",
+    "@supacloud/app": "0.28.3",
+    "@supacloud/contracts": "0.11.5",
+    "@supacloud/compiler": "0.47.3",
+    "@supacloud/elysia": "0.33.5",
     "@supabase/supabase-js": "^2.117.3",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
@@ -165,13 +165,13 @@ var package_default = {
     typescript: "^7.0.2"
   },
   overrides: {
-    "@supacloud/db": "0.18.2",
-    "@supacloud/app": "0.28.1",
-    "@supacloud/compiler": "0.47.1",
-    "@supacloud/elysia": "0.33.3",
-    "@supacloud/contracts": "0.11.3",
-    "@supacloud/commands": "0.9.5",
-    "@supacloud/delivery": "0.19.2",
+    "@supacloud/db": "0.18.4",
+    "@supacloud/app": "0.28.3",
+    "@supacloud/compiler": "0.47.3",
+    "@supacloud/elysia": "0.33.5",
+    "@supacloud/contracts": "0.11.5",
+    "@supacloud/commands": "0.9.7",
+    "@supacloud/delivery": "0.19.4",
     "@graphql-tools/utils": "^12.0.4"
   },
   engines: {
@@ -1470,12 +1470,33 @@ class AuthHandler {
         await this.audit("login_failed", { actorEmail: email, traits: { grant_type: "password" } });
         return authError(400, "invalid_credentials", "Invalid login credentials");
       }
-      if (!this.settings.autoconfirm && !user.email_confirmed_at) {
-        return authError(400, "email_not_confirmed", "Email not confirmed");
+      const response = await this.db.transaction(async (query) => {
+        const currentResult = await query(`select *, coalesce(banned_until > now(), false) as is_banned
+           from auth.users where id = $1 for update`, [user.id]);
+        const current = currentResult.rows[0];
+        if (!current || current.deleted_at !== null || !current.encrypted_password || current.email !== email) {
+          return authError(400, "invalid_credentials", "Invalid login credentials");
+        }
+        if (current.is_banned) {
+          return authError(400, "user_banned", "User is banned");
+        }
+        if (current.encrypted_password !== user.encrypted_password) {
+          return authError(400, "invalid_credentials", "Invalid login credentials");
+        }
+        if (!this.settings.autoconfirm && !current.email_confirmed_at) {
+          return authError(400, "email_not_confirmed", "Email not confirmed");
+        }
+        const signedIn = await query(`update auth.users set last_sign_in_at = now() where id = $1 returning *`, [current.id]);
+        const updated = signedIn.rows[0];
+        if (!updated) {
+          return authError(400, "invalid_credentials", "Invalid login credentials");
+        }
+        return json(200, await this.sessionFor(updated, undefined, undefined, query));
+      });
+      if (response.ok) {
+        await this.audit("login", { actorId: user.id, actorEmail: email, traits: { grant_type: "password" } });
       }
-      await this.db.query(`update auth.users set last_sign_in_at = now() where id = $1`, [user.id]);
-      await this.audit("login", { actorId: user.id, actorEmail: user.email, traits: { grant_type: "password" } });
-      return json(200, await this.sessionFor(user));
+      return response;
     }
     if (grantType === "refresh_token") {
       const token = body.refresh_token;
@@ -1511,16 +1532,6 @@ class AuthHandler {
     if (body.email && !this.settings.autoconfirm) {
       return authError(501, "email_change_confirmation_not_supported", "Email changes that require confirmation are not supported by SupaCloud Lite V1");
     }
-    const upgradingAnon = (user.is_anonymous ?? false) && !!body.email;
-    if (body.email) {
-      const email = body.email.toLowerCase().trim();
-      const clash = await this.db.query(`select id from auth.users where email = $1 and id <> $2`, [email, user.id]);
-      if (clash.rows.length > 0) {
-        return authError(422, "email_exists", "A user with this email address has already been registered");
-      }
-      params.push(email);
-      sets.push(`email = $${params.length}, email_confirmed_at = now()`);
-    }
     if (body.password) {
       if (body.password.length < this.settings.minPasswordLength) {
         return authError(422, "weak_password", `Password should be at least ${this.settings.minPasswordLength} characters.`);
@@ -1532,22 +1543,41 @@ class AuthHandler {
       params.push(JSON.stringify(body.data));
       sets.push(`raw_user_meta_data = coalesce(raw_user_meta_data, '{}'::jsonb) || $${params.length}::jsonb`);
     }
-    if (upgradingAnon) {
-      sets.push(`is_anonymous = false`);
-      sets.push(`raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb) || '{"provider":"email","providers":["email"]}'::jsonb`);
-    }
-    if (sets.length === 0) {
-      return json(200, this.userJson(user, await this.getUserFactors(user.id), await this.getUserIdentities(user.id)));
-    }
-    params.push(user.id);
-    const payload = await this.db.transaction(async (query) => {
-      const res = await query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
-      const updated = res.rows[0];
+    const response = await this.db.transaction(async (query) => {
+      const currentResult = await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id]);
+      const current = currentResult.rows[0];
+      if (!current)
+        return authError(401, "no_authorization", "Invalid or expired token");
+      const transactionSets = [...sets];
+      const transactionParams = [...params];
+      const upgradingAnon = (current.is_anonymous ?? false) && !!body.email;
+      if (body.email) {
+        const email = body.email.toLowerCase().trim();
+        const clash = await query(`select id from auth.users where email = $1 and id <> $2`, [email, current.id]);
+        if (clash.rows.length > 0) {
+          return authError(422, "email_exists", "A user with this email address has already been registered");
+        }
+        transactionParams.push(email);
+        transactionSets.push(`email = $${transactionParams.length}, email_confirmed_at = now()`);
+      }
+      if (upgradingAnon) {
+        transactionSets.push(`is_anonymous = false`);
+        transactionSets.push(`raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb) || '{"provider":"email","providers":["email"]}'::jsonb`);
+      }
+      if (transactionSets.length === 0) {
+        return json(200, await this.userJsonWithRelations(current, query));
+      }
+      transactionParams.push(current.id);
+      const updatedResult = await query(`update auth.users set ${transactionSets.join(", ")}, updated_at = now() where id = $${transactionParams.length} returning *`, transactionParams);
+      const updated = updatedResult.rows[0];
+      if (!updated)
+        return authError(401, "no_authorization", "Invalid or expired token");
       if (body.email)
         await this.ensureEmailIdentity(updated, query);
-      return this.userJsonWithRelations(updated, query);
+      return json(200, await this.userJsonWithRelations(updated, query));
     });
-    return json(200, payload);
+    return response;
   }
   async logout(req, url) {
     const claims = await this.claimsFromBearer(req);
@@ -1801,8 +1831,8 @@ Or sign in with this link: ${link}`
     return claimedToken ? this.confirmEmailTokenUser(query, claimedToken) : null;
   }
   async lockAndDeleteEmailToken(query, candidate, redemption) {
-    const eligible = await query(`select id from auth.users where id = $1 and deleted_at is null
-         and (banned_until is null or banned_until <= now()) for update`, [candidate.user_id]);
+    const eligible = await query(`select id from auth.users where id = $1 and lower(email) = lower($2)
+         and deleted_at is null and (banned_until is null or banned_until <= now()) for update`, [candidate.user_id, candidate.email]);
     if (eligible.rows.length === 0)
       return null;
     const claimedTokens = await query(`delete from auth.one_time_tokens
@@ -1865,11 +1895,10 @@ Or sign in with this link: ${link}`
   async redeemPhoneOtp(phone, code) {
     const tokenDigest = `hmac-sha256:v1:${await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-otp:v1", `${phone}\x00${code}`)}`;
     return this.db.transaction(async (query) => {
-      const claimed = await query(`delete from auth.one_time_tokens
+      const candidate = await query(`select user_id from auth.one_time_tokens
          where phone = $1 and token_type = 'sms' and token = $2
-           and expires_at > now() and attempts < $3
-         returning user_id`, [phone, tokenDigest, AuthHandler.MAX_OTP_ATTEMPTS]);
-      const userId = claimed.rows[0]?.user_id;
+           and expires_at > now() and attempts < $3`, [phone, tokenDigest, AuthHandler.MAX_OTP_ATTEMPTS]);
+      const userId = candidate.rows[0]?.user_id;
       if (!userId) {
         const attempt = await query(`update auth.one_time_tokens set attempts = attempts + 1
            where phone = $1 and token_type = 'sms' and expires_at > now()
@@ -1881,6 +1910,22 @@ Or sign in with this link: ${link}`
         await query(`delete from auth.one_time_tokens where phone = $1 and expires_at <= now()`, [phone]);
         return null;
       }
+      const currentUser = await query(`select phone,
+           deleted_at is null and (banned_until is null or banned_until <= now()) as auth_eligible
+         from auth.users where id = $1 for update`, [userId]);
+      const current = currentUser.rows[0];
+      if (!current || current.phone !== phone)
+        return null;
+      if (!current.auth_eligible) {
+        await query(`delete from auth.one_time_tokens where phone = $1`, [phone]);
+        return null;
+      }
+      const claimed = await query(`delete from auth.one_time_tokens
+         where phone = $1 and token_type = 'sms' and token = $2
+           and expires_at > now() and attempts < $3 and user_id = $4
+         returning user_id`, [phone, tokenDigest, AuthHandler.MAX_OTP_ATTEMPTS, userId]);
+      if (claimed.rows.length === 0)
+        return null;
       await query(`delete from auth.one_time_tokens where phone = $1`, [phone]);
       const users = await query(`update auth.users
          set phone_confirmed_at = coalesce(phone_confirmed_at, now()), last_sign_in_at = now(), updated_at = now()
@@ -2186,6 +2231,9 @@ Or sign in with this link: ${link}`
     const user = await this.userFromBearer(req);
     if (!user)
       return authError(401, "no_authorization", "This endpoint requires a Bearer token");
+    if (!this.settings.totpVerifyEnabled) {
+      return authError(422, "mfa_totp_verify_disabled", "TOTP verification is disabled");
+    }
     const body = await req.json().catch(() => ({}));
     const fr = await this.db.query(`select id, secret, status from auth.mfa_factors where id = $1 and user_id = $2`, [factorId, user.id]);
     const factor = fr.rows[0];
@@ -9060,6 +9108,14 @@ function resolveImageTransformLimits(options = {}) {
   }
   return { maxInputBytes, maxOutputBytes };
 }
+function imageTransformInputTooLarge(maxInputBytes) {
+  return {
+    ok: false,
+    status: 413,
+    error: "ImageTooLarge",
+    message: `The source image exceeds the transformation limit (${maxInputBytes} bytes)`
+  };
+}
 function invalid(message) {
   return { ok: false, status: 400, error: "InvalidTransformation", message };
 }
@@ -9203,14 +9259,10 @@ function applyResize(image, metadata, options) {
 async function transformImage(source, options, knownSourceSize, configuredLimits = {}) {
   const limits = resolveImageTransformLimits(configuredLimits);
   const actualSourceSize = source instanceof Uint8Array ? source.byteLength : await Promise.resolve(source.size);
-  const sourceSize = Math.max(knownSourceSize ?? 0, actualSourceSize);
+  const declaredSourceSize = typeof knownSourceSize === "number" && Number.isFinite(knownSourceSize) && knownSourceSize >= 0 ? knownSourceSize : 0;
+  const sourceSize = Math.max(declaredSourceSize, actualSourceSize);
   if (sourceSize > limits.maxInputBytes) {
-    return {
-      ok: false,
-      status: 413,
-      error: "ImageTooLarge",
-      message: `The source image exceeds the transformation limit (${limits.maxInputBytes} bytes)`
-    };
+    return imageTransformInputTooLarge(limits.maxInputBytes);
   }
   const image = new Bun.Image(source, { maxPixels: MAX_TRANSFORM_PIXELS });
   let metadata;
@@ -9434,7 +9486,7 @@ function isRenderableActiveType(contentType) {
   return t === "text/html" || t === "application/xhtml+xml" || t === "image/svg+xml" || t === "application/xml" || t === "text/xml";
 }
 var TUS_VERSION = "1.0.0";
-var DEFAULT_FILE_SIZE_LIMIT = 50 * 1024 * 1024;
+var DEFAULT_FILE_SIZE_LIMIT = 500 * 1024 * 1024;
 var MULTIPART_OVERHEAD_LIMIT = 1024 * 1024;
 var MAX_CONCURRENT_TUS_UPLOADS = 4;
 var MAX_COMPLETED_TUS_UPLOADS = 64;
@@ -9725,6 +9777,11 @@ class StorageHandler {
     const parsed = parseImageTransform(url.searchParams);
     if (!parsed.ok)
       return storageError(parsed.status, parsed.error, parsed.message);
+    const declaredSize = objectSize(row);
+    if (declaredSize !== undefined && declaredSize > this.transformLimits.maxInputBytes) {
+      const rejected = imageTransformInputTooLarge(this.transformLimits.maxInputBytes);
+      return storageError(rejected.status, rejected.error, rejected.message);
+    }
     let result;
     try {
       result = await this.imageTransforms.getOrTransform(imageTransformCacheKey(row.version, parsed.value), async () => {

package/dist/runtime/auth/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAc,SAAS,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAA6C,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGhG,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAG7C,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,KAAK,CAAA;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CACjC;AAED,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACjD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAClD,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAClC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CACjC;AAgID,wEAAwE;AACxE,qBAAa,WAAW;IAYpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,OAAO,CAAC,KAAK,CAAc;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,wBAAwB,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAQ;gBAGd,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IAe5B;;;OAGG;IACH,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,QAAQ;IAUhB,4EAA4E;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAQb,oCAAoC;IAgBlD,8FAA8F;IACxF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YA2D9D,gBAAgB;YAYhB,MAAM;YAiEN,KAAK;YA8CL,OAAO;YAMP,UAAU;YA6DV,MAAM;YAwBN,UAAU;YA4CV,OAAO;YAqBP,eAAe;YAqDf,eAAe;YAmCf,SAAS;YAwBT,kBAAkB;IAShC,OAAO,CAAC,mBAAmB;YASb,eAAe;YAgBf,YAAY;YAaZ,qBAAqB;YAgBrB,qBAAqB;IAUnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,kBAAkB;YAQZ,YAAY;IAM1B,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAI;YAE9B,MAAM;YAYN,eAAe;YAWf,uBAAuB;YAuBvB,qBAAqB;YAUrB,uBAAuB;YAcvB,6BAA6B;YAa7B,WAAW;YAsCX,cAAc;YAyDd,UAAU;YAsBV,KAAK;YA0HL,sBAAsB;IAuEpC;;;OAGG;YACW,KAAK;IAqBnB;;;;;OAKG;YACW,UAAU;IA2CxB;;;;;;;;;OASG;YACW,SAAS;YAqBT,YAAY;YAyDZ,eAAe;YAqBf,YAAY;YA0DZ,cAAc;YAWd,cAAc;IAmB5B,oFAAoF;YACtE,iBAAiB;YAqBjB,mBAAmB;YAcnB,qBAAqB;YAarB,kBAAkB;YAmClB,yBAAyB;YAUzB,iBAAiB;YAUjB,uBAAuB;IASrC,OAAO,CAAC,kBAAkB;YAoBZ,cAAc;YAWd,gBAAgB;IAM9B,wEAAwE;IACxE,QAAQ,CACN,CAAC,EAAE,OAAO,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,EACvC,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAqB1B,OAAO,CAAC,eAAe;YAgBT,qBAAqB;YAWrB,UAAU;CAqDzB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAc,SAAS,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAA6C,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGhG,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAG7C,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,KAAK,CAAA;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CACjC;AAED,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACjD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAClD,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAClC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CACjC;AAgID,wEAAwE;AACxE,qBAAa,WAAW;IAYpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,OAAO,CAAC,KAAK,CAAc;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,wBAAwB,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAQ;gBAGd,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IAe5B;;;OAGG;IACH,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,QAAQ;IAUhB,4EAA4E;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAQb,oCAAoC;IAgBlD,8FAA8F;IACxF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YA2D9D,gBAAgB;YAYhB,MAAM;YAiEN,KAAK;YAyEL,OAAO;YAMP,UAAU;YAqEV,MAAM;YAwBN,UAAU;YA4CV,OAAO;YAqBP,eAAe;YAqDf,eAAe;YAmCf,SAAS;YAwBT,kBAAkB;IAShC,OAAO,CAAC,mBAAmB;YASb,eAAe;YAgBf,YAAY;YAaZ,qBAAqB;YAgBrB,qBAAqB;IAUnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,kBAAkB;YAQZ,YAAY;IAM1B,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAI;YAE9B,MAAM;YAYN,eAAe;YAWf,uBAAuB;YAuBvB,qBAAqB;YAUrB,uBAAuB;YAcvB,6BAA6B;YAa7B,WAAW;YAsCX,cAAc;YA6Ed,UAAU;YAsBV,KAAK;YA0HL,sBAAsB;IAuEpC;;;OAGG;YACW,KAAK;IAqBnB;;;;;OAKG;YACW,UAAU;IA2CxB;;;;;;;;;OASG;YACW,SAAS;YAqBT,YAAY;YAyDZ,eAAe;YAqBf,YAAY;YA6DZ,cAAc;YAWd,cAAc;IAmB5B,oFAAoF;YACtE,iBAAiB;YAqBjB,mBAAmB;YAcnB,qBAAqB;YAarB,kBAAkB;YAmClB,yBAAyB;YAUzB,iBAAiB;YAUjB,uBAAuB;IASrC,OAAO,CAAC,kBAAkB;YAoBZ,cAAc;YAWd,gBAAgB;IAM9B,wEAAwE;IACxE,QAAQ,CACN,CAAC,EAAE,OAAO,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,EACvC,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAqB1B,OAAO,CAAC,eAAe;YAgBT,qBAAqB;YAWrB,UAAU;CAqDzB"}

package/dist/runtime/storage/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/storage/handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAKL,KAAK,oBAAoB,EAG1B,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE5E,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAA;IACjB,0GAA0G;IAC1G,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C,uFAAuF;IACvF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAkJD,qEAAqE;AACrE,qBAAa,cAAc;IAOvB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,MAAM;IARhB,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,YAAY,CAAoB;IACxC,OAAO,CAAC,eAAe,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgC;gBAGtD,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,aAAa;IAK/B,4FAA4F;IACtF,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAazD,8GAA8G;IACxG,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YAgH9D,YAAY;IAgB1B,OAAO,CAAC,cAAc;YAOR,YAAY;YA2BZ,WAAW;YAKX,SAAS;YAMT,YAAY;YAqBZ,YAAY;YAYZ,WAAW;YAUX,UAAU;YAKV,MAAM;YA0DN,sBAAsB;IA0BpC,gFAAgF;YAClE,aAAa;YAmDb,SAAS;IA8KvB,2EAA2E;YAC7D,SAAS;IA2CvB,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,sBAAsB;YAMhB,oBAAoB;YA8CpB,QAAQ;YAMR,uBAAuB;YAavB,cAAc;YAMd,gBAAgB;YAYhB,WAAW;YAWX,aAAa;YAeb,SAAS;YAUT,UAAU;YAiFV,gBAAgB;YAUhB,kBAAkB;YASlB,eAAe;YAIf,gBAAgB;YAKhB,iBAAiB;YAcjB,WAAW;YAuDX,UAAU;YAyBV,OAAO;YAmBP,QAAQ;YAiBR,eAAe;YAMf,gBAAgB;YAehB,aAAa;YAab,kBAAkB;IAehC,OAAO,CAAC,aAAa;CAUtB;AA6ID,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,UAAU,CAAA;CACjB;AAED,+FAA+F;AAC/F,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,EAAE,CAqCnF"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/storage/handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAML,KAAK,oBAAoB,EAG1B,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE5E,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAA;IACjB,0GAA0G;IAC1G,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C,uFAAuF;IACvF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAkJD,qEAAqE;AACrE,qBAAa,cAAc;IAOvB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,MAAM;IARhB,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,YAAY,CAAoB;IACxC,OAAO,CAAC,eAAe,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgC;gBAGtD,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,aAAa;IAK/B,4FAA4F;IACtF,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAazD,8GAA8G;IACxG,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YAgH9D,YAAY;IAgB1B,OAAO,CAAC,cAAc;YAOR,YAAY;YA2BZ,WAAW;YAKX,SAAS;YAMT,YAAY;YAqBZ,YAAY;YAYZ,WAAW;YAUX,UAAU;YAKV,MAAM;YA0DN,sBAAsB;IA+BpC,gFAAgF;YAClE,aAAa;YAmDb,SAAS;IA8KvB,2EAA2E;YAC7D,SAAS;IA2CvB,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,sBAAsB;YAMhB,oBAAoB;YA8CpB,QAAQ;YAMR,uBAAuB;YAavB,cAAc;YAMd,gBAAgB;YAYhB,WAAW;YAWX,aAAa;YAeb,SAAS;YAUT,UAAU;YAiFV,gBAAgB;YAUhB,kBAAkB;YASlB,eAAe;YAIf,gBAAgB;YAKhB,iBAAiB;YAcjB,WAAW;YAuDX,UAAU;YAyBV,OAAO;YAmBP,QAAQ;YAiBR,eAAe;YAMf,gBAAgB;YAehB,aAAa;YAab,kBAAkB;IAehC,OAAO,CAAC,aAAa;CAUtB;AA6ID,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,UAAU,CAAA;CACjB;AAED,+FAA+F;AAC/F,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,EAAE,CAqCnF"}

package/dist/runtime/storage/image-transform.d.ts

@@ -35,6 +35,7 @@ export interface ImageTransformLimits {
 }
 /** Operator-owned limits, never taken from image URL parameters. */
 export declare function resolveImageTransformLimits(options?: ImageTransformLimits): Required<ImageTransformLimits>;
+export declare function imageTransformInputTooLarge(maxInputBytes: number): ImageTransformError;
 /** Parse Supabase Storage image query parameters without decoding the source. */
 export declare function parseImageTransform(query: URLSearchParams): ImageTransformParseResult;
 /** Encode a transform object into the query shape used by render/image URLs. */

package/dist/runtime/storage/image-transform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"image-transform.d.ts","sourceRoot":"","sources":["../../../src/runtime/storage/image-transform.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,MAAM,CAAA;AACrD,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAA;AAErE,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,oBAAoB,CAAA;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,oBAAoB,CAAA;CAC7B;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAA;IACvC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,oBAAoB,CAAA;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,KAAK,CAAA;IACT,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,qBAAqB,CAAA;CAAE,GAC1C,mBAAmB,CAAA;AAEvB,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpD,mBAAmB,CAAA;AAgBvB,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,oEAAoE;AACpE,wBAAgB,2BAA2B,CAAC,OAAO,GAAE,oBAAyB,GAAG,QAAQ,CAAC,oBAAoB,CAAC,CAS9G;AA6BD,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,yBAAyB,CAsCrF;AAED,gFAAgF;AAChF,wBAAgB,4BAA4B,CAAC,OAAO,CAAC,EAAE,4BAA4B,GAAG,eAAe,CASpG;AA0DD,iFAAiF;AACjF,wBAAsB,cAAc,CAClC,MAAM,EAAE,UAAU,GAAG,IAAI,EACzB,OAAO,EAAE,qBAAqB,EAC9B,eAAe,CAAC,EAAE,MAAM,EACxB,gBAAgB,GAAE,oBAAyB,GAC1C,OAAO,CAAC,oBAAoB,CAAC,CA2D/B"}
+{"version":3,"file":"image-transform.d.ts","sourceRoot":"","sources":["../../../src/runtime/storage/image-transform.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,MAAM,CAAA;AACrD,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAA;AAErE,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,oBAAoB,CAAA;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,oBAAoB,CAAA;CAC7B;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAA;IACvC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,oBAAoB,CAAA;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,KAAK,CAAA;IACT,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,qBAAqB,CAAA;CAAE,GAC1C,mBAAmB,CAAA;AAEvB,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpD,mBAAmB,CAAA;AAgBvB,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,oEAAoE;AACpE,wBAAgB,2BAA2B,CAAC,OAAO,GAAE,oBAAyB,GAAG,QAAQ,CAAC,oBAAoB,CAAC,CAS9G;AAED,wBAAgB,2BAA2B,CAAC,aAAa,EAAE,MAAM,GAAG,mBAAmB,CAOtF;AA6BD,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,yBAAyB,CAsCrF;AAED,gFAAgF;AAChF,wBAAgB,4BAA4B,CAAC,OAAO,CAAC,EAAE,4BAA4B,GAAG,eAAe,CASpG;AA0DD,iFAAiF;AACjF,wBAAsB,cAAc,CAClC,MAAM,EAAE,UAAU,GAAG,IAAI,EACzB,OAAO,EAAE,qBAAqB,EAC9B,eAAe,CAAC,EAAE,MAAM,EACxB,gBAAgB,GAAE,oBAAyB,GAC1C,OAAO,CAAC,oBAAoB,CAAC,CAyD/B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/lite",
-  "version": "0.31.1",
+  "version": "0.31.3",
   "description": "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   "type": "module",
   "license": "Apache-2.0",
@@ -59,16 +59,16 @@
     "@electric-sql/pglite-pgmq": "0.0.8",
     "@electric-sql/pglite-pgvector": "0.0.11",
     "@electric-sql/pglite-postgis": "0.2.10",
-    "@supacloud/db": "0.18.2",
+    "@supacloud/db": "0.18.4",
     "exact-mirror": "1.2.6",
     "tar": "^7.5.22",
     "typebox": "1.3.37"
   },
   "devDependencies": {
-    "@supacloud/app": "0.28.1",
-    "@supacloud/contracts": "0.11.3",
-    "@supacloud/compiler": "0.47.1",
-    "@supacloud/elysia": "0.33.3",
+    "@supacloud/app": "0.28.3",
+    "@supacloud/contracts": "0.11.5",
+    "@supacloud/compiler": "0.47.3",
+    "@supacloud/elysia": "0.33.5",
     "@supabase/supabase-js": "^2.117.3",
     "@types/bun": "^1.4.3",
     "effect": "4.0.5",
@@ -77,13 +77,13 @@
     "typescript": "^7.0.2"
   },
   "overrides": {
-    "@supacloud/db": "0.18.2",
-    "@supacloud/app": "0.28.1",
-    "@supacloud/compiler": "0.47.1",
-    "@supacloud/elysia": "0.33.3",
-    "@supacloud/contracts": "0.11.3",
-    "@supacloud/commands": "0.9.5",
-    "@supacloud/delivery": "0.19.2",
+    "@supacloud/db": "0.18.4",
+    "@supacloud/app": "0.28.3",
+    "@supacloud/compiler": "0.47.3",
+    "@supacloud/elysia": "0.33.5",
+    "@supacloud/contracts": "0.11.5",
+    "@supacloud/commands": "0.9.7",
+    "@supacloud/delivery": "0.19.4",
     "@graphql-tools/utils": "^12.0.4"
   },
   "engines": {