@supacloud/lite 0.33.2 → 0.34.0

package/dist/index.d.ts

@@ -6,6 +6,7 @@ export { S3StorageDriver, type S3StorageClientLike, type S3StorageDriverOptions,
 export type { EdgeFunction, FunctionContext } from './runtime/functions/handler.js';
 export type { PgredisCacheBinding } from './runtime/functions/pgredis.js';
 export { createSupAuthLiteIdentity, type ExternalIdentityVerifier, type VerifiedSupAuthContext } from './runtime/identity.js';
+export { createExternalAuthProxy, type ExternalAuthProxy, type ExternalAuthProxyOptions, } from './runtime/auth/proxy.js';
 export { inspectGraphql, type GraphqlCapability, type GraphqlOptions } from './runtime/graphql.js';
 export type { RuntimeMode } from './runtime/functions/profile.js';
 export { SUPACLOUD_LITE_VERSION } from './version.js';
@@ -14,6 +15,7 @@ export { serveBun } from './runtime/node/bun-server.js';
 export type { RunningServer, ServerHandle, ServeOptions } from './runtime/node/bun-server.js';
 export { createNativeEngine, ensurePostgres, isNativeEngineSupported, type NativeEngineOptions, } from './runtime/node/native/engine.js';
 export { POWERSYNC_PUBLICATION, POWERSYNC_REPLICATION_ROLE, buildPowerSyncPostgresArgs, ensurePowerSyncReplicationCatalog, validatePowerSyncReplicationOptions, writePowerSyncHba, type NativeReplicationOptions, type NativeReplicationTlsOptions, type PowerSyncReplicationOptions, } from './runtime/node/native/replication.js';
+export { productionReadiness, type ProductionReadiness, type ProductionReadinessInput, } from './runtime/node/production-readiness.js';
 export { inspectPowerSyncReadiness, liteCapabilities, type LiteCapabilityStatus, type LiteDoctorReport, type PowerSyncReadiness, } from './runtime/node/native/readiness.js';
 export { inspectPostgresExtensions, type ExtensionInventorySource, type ExtensionInventoryStatus, type PostgresExtension, type PostgresExtensionInventory, } from './runtime/node/native/extensions.js';
 export { createProjectBackend, ensureProjectSecrets, mintProjectKeys, resolveDatabaseEngine, resolveNativeReplicationOptions, resolveStorageBackend, resolveProjectPaths, startProjectServer, } from './project-runtime.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,IAAI,iBAAiB,EAClC,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,SAAS,EACT,OAAO,EACP,SAAS,GACV,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,aAAa,IAAI,mBAAmB,EACpC,oBAAoB,GACrB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,UAAU,EACV,MAAM,EACN,WAAW,EACX,UAAU,EACV,SAAS,EACT,aAAa,EACb,cAAc,EACd,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,gCAAgC,CAAA;AACvC,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AACnF,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AACzE,OAAO,EAAE,yBAAyB,EAAE,KAAK,wBAAwB,EAAE,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAC7H,OAAO,EAAE,cAAc,EAAE,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAClG,YAAY,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAC7F,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,KAAK,mBAAmB,GACzB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,iCAAiC,EACjC,mCAAmC,EACnC,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,GACjC,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,GAChC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,+BAA+B,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,cAAc,EACd,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,wBAAwB,EACxB,cAAc,EACd,cAAc,EACd,YAAY,EACZ,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,GACf,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,IAAI,iBAAiB,EAClC,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,SAAS,EACT,OAAO,EACP,SAAS,GACV,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,aAAa,IAAI,mBAAmB,EACpC,oBAAoB,GACrB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,UAAU,EACV,MAAM,EACN,WAAW,EACX,UAAU,EACV,SAAS,EACT,aAAa,EACb,cAAc,EACd,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,gCAAgC,CAAA;AACvC,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AACnF,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AACzE,OAAO,EAAE,yBAAyB,EAAE,KAAK,wBAAwB,EAAE,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAC7H,OAAO,EACL,uBAAuB,EACvB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,cAAc,EAAE,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAClG,YAAY,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAC7F,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,KAAK,mBAAmB,GACzB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,iCAAiC,EACjC,mCAAmC,EACnC,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,GACjC,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,GAChC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,+BAA+B,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,cAAc,EACd,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,wBAAwB,EACxB,cAAc,EACd,cAAc,EACd,YAAY,EACZ,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,GACf,MAAM,sBAAsB,CAAA"}

package/dist/index.js

@@ -88,7 +88,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.33.2",
+  version: "0.34.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -108,6 +108,7 @@ var package_default = {
     "dist",
     "!dist/standalone",
     "README.md",
+    "deploy",
     "CHANGELOG.md",
     "RELEASING.md",
     "THIRD_PARTY_NOTICES.md",
@@ -9524,10 +9525,21 @@ async function sha256Hex2(text) {
 }
 
 // src/runtime/realtime/engine.ts
+function normalizeBroadcastTopic(raw) {
+  const topic = raw.trim().replace(/^realtime:/, "");
+  if (!topic)
+    throw new Error("broadcast topic is required");
+  return topic;
+}
+
 class RealtimeEngine {
   db;
   jwtSecret;
   resolveExternalToken;
+  static MAX_HTTP_BROADCAST_MESSAGES = 100;
+  static MAX_HTTP_BROADCAST_TOPIC_BYTES = 256;
+  static MAX_HTTP_BROADCAST_EVENT_BYTES = 256;
+  static MAX_HTTP_BROADCAST_PAYLOAD_BYTES = 1024 * 1024;
   connections = new Set;
   bindingCounter = 1;
   phxRefCounter = 1;
@@ -9574,6 +9586,47 @@ class RealtimeEngine {
       return { read: false, write: false };
     }
   }
+  async broadcastHttp(messages, ctx) {
+    if (messages.length === 0)
+      throw new Error("messages must not be empty");
+    if (messages.length > RealtimeEngine.MAX_HTTP_BROADCAST_MESSAGES) {
+      throw new Error(`messages must contain at most ${RealtimeEngine.MAX_HTTP_BROADCAST_MESSAGES} items`);
+    }
+    const normalized = [];
+    for (const message of messages) {
+      if (typeof message.topic !== "string")
+        throw new Error("broadcast topic must be a string");
+      if (typeof message.event !== "string")
+        throw new Error("broadcast event must be a string");
+      const topic = normalizeBroadcastTopic(message.topic);
+      if (new TextEncoder().encode(topic).byteLength > RealtimeEngine.MAX_HTTP_BROADCAST_TOPIC_BYTES) {
+        throw new Error("broadcast topic is too large");
+      }
+      const event = message.event.trim();
+      if (!event)
+        throw new Error("broadcast event is required");
+      if (new TextEncoder().encode(event).byteLength > RealtimeEngine.MAX_HTTP_BROADCAST_EVENT_BYTES) {
+        throw new Error("broadcast event is too large");
+      }
+      let payloadText;
+      try {
+        payloadText = JSON.stringify(message.payload ?? null);
+      } catch {
+        throw new Error("broadcast payload must be JSON serializable");
+      }
+      if (new TextEncoder().encode(payloadText).byteLength > RealtimeEngine.MAX_HTTP_BROADCAST_PAYLOAD_BYTES) {
+        throw new Error("broadcast payload is too large");
+      }
+      if (message.private === true) {
+        const access = await this.authorizePrivate(topic, ctx);
+        if (!access.write)
+          throw new Error(`not authorized to broadcast on private topic: ${topic}`);
+      }
+      normalized.push({ topic, event, payload: message.payload ?? null });
+    }
+    for (const message of normalized)
+      this.dispatchDbBroadcast(message);
+  }
   dispatchDbBroadcast(msg) {
     const full = `realtime:${msg.topic}`;
     for (const conn of this.connections) {
@@ -11936,6 +11989,11 @@ class StorageHandler {
     const rest = url.pathname.replace(/^\/storage\/v1\/?/, "").replace(/\/+$/, "");
     const method = req.method.toUpperCase();
     try {
+      if (rest === "status" && method === "GET") {
+        return json3(200, { status: "ok", name: "supacloud-lite-storage", version: SUPACLOUD_LITE_VERSION });
+      }
+      if (rest === "metrics" && method === "GET")
+        return await this.metrics(ctx);
       if (rest === "bucket" && method === "POST")
         return await this.createBucket(req, ctx);
       if (rest === "bucket" && method === "GET")
@@ -12056,6 +12114,37 @@ class StorageHandler {
       release();
     }
   }
+  async metrics(ctx) {
+    const denied = this.requireService(ctx);
+    if (denied)
+      return denied;
+    const [buckets, objects] = await Promise.all([
+      this.db.query(`select count(*)::int as count from storage.buckets`),
+      this.db.query(`select count(*)::int as count,
+                coalesce(sum(case when metadata->>'size' ~ '^[0-9]+$' then (metadata->>'size')::bigint else 0 end), 0) as bytes
+         from storage.objects`)
+    ]);
+    const bucketCount = buckets.rows[0]?.count ?? 0;
+    const objectCount = objects.rows[0]?.count ?? 0;
+    const objectBytes = Number(objects.rows[0]?.bytes ?? 0);
+    const body = [
+      "# HELP storage_buckets_total Number of storage buckets.",
+      "# TYPE storage_buckets_total gauge",
+      `storage_buckets_total ${bucketCount}`,
+      "# HELP storage_objects_total Number of storage object metadata rows.",
+      "# TYPE storage_objects_total gauge",
+      `storage_objects_total ${objectCount}`,
+      "# HELP storage_object_bytes_total Sum of declared object sizes in bytes.",
+      "# TYPE storage_object_bytes_total gauge",
+      `storage_object_bytes_total ${Number.isFinite(objectBytes) ? objectBytes : 0}`,
+      ""
+    ].join(`
+`);
+    return new Response(body, {
+      status: 200,
+      headers: { "content-type": "text/plain; version=0.0.4; charset=utf-8" }
+    });
+  }
   requireService(ctx) {
     if (ctx.role !== "service_role") {
       return storageError(403, "Unauthorized", "Bucket management requires the service_role key");
@@ -14174,6 +14263,9 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     if (smsInbox && (path === "/sms-inbox" || path.startsWith("/sms-inbox/"))) {
       return withCors(smsInbox.serve(req, url));
     }
+    if (path === "/storage/v1/status" && req.method === "GET") {
+      return withCors(await storage.handle(req, { role: "anon", claims: null }, url));
+    }
     if (path.startsWith("/storage/v1/object/public/") || path.startsWith("/storage/v1/object/sign/") || path.startsWith("/storage/v1/render/image/public/") || path.startsWith("/storage/v1/render/image/sign/")) {
       if (req.method === "GET" || req.method === "HEAD") {
         return withCors(await storage.handle(req, { role: "anon", claims: null }, url));
@@ -14209,6 +14301,50 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     const ctx = await resolveContext(req, url);
     if (ctx instanceof Response)
       return ctx;
+    if (path === "/realtime/v1/api/broadcast" || path === "/realtime/v1/api/broadcast/") {
+      if (req.method !== "POST") {
+        return withCors(new Response(JSON.stringify({ message: "Method not allowed" }), {
+          status: 405,
+          headers: { "content-type": "application/json", allow: "POST" }
+        }));
+      }
+      const contentType = req.headers.get("content-type") ?? "";
+      if (contentType && !contentType.includes("application/json")) {
+        return withCors(new Response(JSON.stringify({ message: "Content-Type must be application/json" }), {
+          status: 415,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      let body;
+      try {
+        body = await req.json();
+      } catch {
+        return withCors(new Response(JSON.stringify({ message: "Invalid JSON body" }), {
+          status: 400,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      const messages = typeof body === "object" && body !== null && "messages" in body ? body.messages : undefined;
+      if (!Array.isArray(messages)) {
+        return withCors(new Response(JSON.stringify({ message: "messages must be an array" }), {
+          status: 400,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      try {
+        await realtime.broadcastHttp(messages, ctx);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Broadcast failed";
+        return withCors(new Response(JSON.stringify({ message }), {
+          status: message.startsWith("not authorized") ? 403 : 400,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      return withCors(new Response(JSON.stringify({ message: "Broadcast sent" }), {
+        status: 202,
+        headers: { "content-type": "application/json" }
+      }));
+    }
     if (path.startsWith("/rest/v1"))
       return withCors(await rest.handle(req, ctx, url));
     if (path === "/graphql/v1" || path === "/graphql/v1/")
@@ -14410,6 +14546,118 @@ class S3StorageDriver {
     return `${this.prefix}${normalizeKey(key)}`;
   }
 }
+// src/runtime/auth/proxy.ts
+var ALLOWED_ROUTES = {
+  "/auth/v1/oauth/token": new Set(["POST"]),
+  "/auth/v1/oauth/userinfo": new Set(["GET"]),
+  "/auth/v1/logout": new Set(["GET", "POST"])
+};
+var FORWARD_REQUEST_HEADERS = ["accept", "authorization", "content-type", "apikey"];
+var FORWARD_RESPONSE_HEADERS = [
+  "content-type",
+  "cache-control",
+  "retry-after",
+  "www-authenticate"
+];
+function proxyError(status, code, message, allow) {
+  const headers = new Headers({
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store"
+  });
+  if (allow)
+    headers.set("allow", allow);
+  return new Response(JSON.stringify({ code, message }), { status, headers });
+}
+function upstreamBase(issuer) {
+  let url;
+  try {
+    url = new URL(issuer);
+  } catch {
+    throw new TypeError("External auth issuer must be an absolute URL");
+  }
+  const loopback = url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]" || url.hostname === "::1";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new TypeError("External auth issuer must use HTTPS (HTTP is allowed only on loopback)");
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new TypeError("External auth issuer must not contain credentials, query or fragment");
+  }
+  if (url.pathname.replace(/\/+$/, "") !== "/auth/v1") {
+    throw new TypeError("External auth issuer must end with /auth/v1");
+  }
+  return url;
+}
+function redirectOrigins(base, extra = []) {
+  const origins = new Set([base.origin]);
+  for (const value of extra) {
+    let origin;
+    try {
+      origin = new URL(value);
+    } catch {
+      throw new TypeError("External auth redirect origin must be an absolute URL");
+    }
+    const loopback = origin.hostname === "127.0.0.1" || origin.hostname === "localhost" || origin.hostname === "[::1]" || origin.hostname === "::1";
+    if (origin.protocol !== "https:" && !(origin.protocol === "http:" && loopback)) {
+      throw new TypeError("External auth redirect origin must use HTTPS (HTTP is allowed only on loopback)");
+    }
+    if (origin.username || origin.password || origin.search || origin.hash) {
+      throw new TypeError("External auth redirect origin must not contain credentials, query or fragment");
+    }
+    origins.add(origin.origin);
+  }
+  return origins;
+}
+function createExternalAuthProxy(options) {
+  const base = upstreamBase(options.issuer);
+  const allowedRedirects = redirectOrigins(base, options.allowedRedirectOrigins);
+  const fetcher = options.fetch ?? globalThis.fetch;
+  if (typeof fetcher !== "function")
+    throw new TypeError("External auth proxy requires fetch");
+  return async (request) => {
+    const source = new URL(request.url);
+    const methods = ALLOWED_ROUTES[source.pathname];
+    if (!methods)
+      return null;
+    if (!methods.has(request.method)) {
+      return proxyError(405, "AUTH_PROXY_METHOD_NOT_ALLOWED", "Auth proxy method is not allowed", [...methods].join(", "));
+    }
+    const target = new URL(source.pathname + source.search, base.origin);
+    const headers = new Headers;
+    for (const name of FORWARD_REQUEST_HEADERS) {
+      const value = request.headers.get(name);
+      if (value !== null)
+        headers.set(name, value);
+    }
+    const body = request.method === "GET" || request.method === "HEAD" ? undefined : await request.arrayBuffer();
+    let upstream;
+    try {
+      upstream = await fetcher(target, {
+        method: request.method,
+        headers,
+        body,
+        redirect: "manual"
+      });
+    } catch {
+      return proxyError(503, "AUTH_PROXY_UNAVAILABLE", "Identity service is temporarily unavailable");
+    }
+    const responseHeaders = new Headers;
+    for (const name of FORWARD_RESPONSE_HEADERS) {
+      const value = upstream.headers.get(name);
+      if (value !== null)
+        responseHeaders.set(name, value);
+    }
+    const location = upstream.headers.get("location");
+    if (location !== null) {
+      const resolved = new URL(location, base.origin);
+      if (!allowedRedirects.has(resolved.origin)) {
+        return proxyError(502, "AUTH_PROXY_REDIRECT_REJECTED", "Identity service redirect was rejected");
+      }
+      responseHeaders.set("location", resolved.href);
+    }
+    responseHeaders.set("cache-control", "no-store");
+    return new Response(upstream.body, { status: upstream.status, headers: responseHeaders });
+  };
+}
 // src/runtime/node/fs-driver.ts
 import { mkdir as mkdir2, readFile as readFile2, rename, rm, writeFile } from "fs/promises";
 import { dirname as dirname2, isAbsolute, join, relative, resolve as resolvePath, sep } from "path";
@@ -14480,7 +14728,11 @@ async function serveBun(backend, opts = {}) {
       const ip = srv.requestIP(req)?.address;
       if (ip)
         headers.set("x-supacloud-lite-remote-addr", ip);
-      return backend.fetch(new Request(req, { headers }));
+      const request = new Request(req, { headers });
+      const hookResponse = await opts.beforeRequest?.(request);
+      if (hookResponse)
+        return hookResponse;
+      return backend.fetch(request);
     },
     websocket: {
       open(ws) {
@@ -15614,6 +15866,80 @@ function removeStalePidFile(pidPath) {
     }
   } catch {}
 }
+// src/runtime/node/production-readiness.ts
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve3 } from "path";
+var SNAPSHOT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+function within(parent, child) {
+  const rel = relative2(resolve3(parent), resolve3(child));
+  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
+}
+function loopback(host) {
+  return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]";
+}
+function absoluteHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return (url.protocol === "https:" || url.protocol === "http:" && loopback(url.hostname)) && !url.username && !url.password;
+  } catch {
+    return false;
+  }
+}
+function productionReadiness(input) {
+  const blockers = [];
+  const warnings = [];
+  const now = input.now ?? Date.now();
+  if (input.runtimeMode !== "strict") {
+    blockers.push("RUNTIME_MODE_NOT_STRICT: production functions require strict runtime mode");
+  }
+  if (input.storageBackend === "memory") {
+    blockers.push("MEMORY_STORAGE_NOT_DURABLE: memory storage loses objects on restart");
+  }
+  if (input.storageBackend === "fs") {
+    warnings.push("LOCAL_STORAGE_REQUIRES_DURABLE_VOLUME_AND_BACKUP");
+  }
+  if (input.storageBackend === "s3") {
+    warnings.push("S3_OBJECTS_NOT_INCLUDED_IN_SNAPSHOT: back up the bucket/prefix separately");
+  }
+  if (!loopback(input.host)) {
+    warnings.push("DIRECT_NETWORK_BIND_WITHOUT_LITE_TLS: terminate TLS in a trusted proxy or restrict the network boundary");
+  }
+  if (input.engine === "pglite") {
+    warnings.push("PGLITE_SINGLE_PROCESS_CAPACITY: validate the real schema, concurrency and Realtime load");
+  }
+  if (input.identityMode === "local") {
+    warnings.push("LOCAL_AUTH_IN_PRODUCTION: own account lifecycle, confirmation and password reset");
+  }
+  if (input.identityMode === "external" && !input.externalAuthProxyIssuer) {
+    warnings.push("EXTERNAL_AUTH_PROXY_NOT_CONFIGURED: cross-origin browser token/userinfo calls may fail CORS");
+  }
+  if (input.externalAuthProxyIssuer && !absoluteHttpUrl(input.externalAuthProxyIssuer)) {
+    blockers.push("EXTERNAL_AUTH_PROXY_ISSUER_INVALID: use an HTTPS issuer, or HTTP only on loopback");
+  }
+  if (!input.siteUrl) {
+    warnings.push("SITE_URL_NOT_CONFIGURED: set [auth].site_url for stable redirects");
+  } else if (!absoluteHttpUrl(input.siteUrl)) {
+    warnings.push("SITE_URL_NOT_HTTPS: production redirects should use HTTPS");
+  }
+  if (!input.apiUrl) {
+    warnings.push("API_URL_NOT_CONFIGURED: set the public API URL used by Auth and Functions");
+  } else if (!absoluteHttpUrl(input.apiUrl)) {
+    warnings.push("API_URL_NOT_HTTPS: production API URLs should use HTTPS");
+  }
+  if (within(input.projectDir, input.stateDir)) {
+    warnings.push("STATE_INSIDE_PROJECT: keep mutable state outside the reviewed project checkout");
+  }
+  if (input.dataDir && input.dataDir === input.storageDir) {
+    blockers.push("DATABASE_AND_STORAGE_PATH_OVERLAP: use separate directories");
+  } else if (input.dataDir && (within(input.dataDir, input.storageDir) || within(input.storageDir, input.dataDir))) {
+    warnings.push("DATABASE_AND_STORAGE_PATH_NESTED: keep database and storage trees independent");
+  }
+  if (input.latestSnapshotAt === undefined) {
+    warnings.push("NO_SNAPSHOT_FOUND: create and test a restore snapshot before promotion");
+  } else if (now - input.latestSnapshotAt > SNAPSHOT_MAX_AGE_MS) {
+    warnings.push("SNAPSHOT_STALE: newest snapshot is older than 7 days");
+  }
+  return { ready: blockers.length === 0, blockers, warnings };
+}
 // src/runtime/node/native/readiness.ts
 function liteCapabilities(engine, replicationProfile, authEnabled = true) {
   const extensionSource = engine === "native" ? "native-postgresql" : "pglite-bundled";
@@ -15902,7 +16228,7 @@ async function inspectPostgresExtensions(engine, source) {
 }
 // src/project-runtime.ts
 import { chmod, link, lstat as lstat2, mkdir as mkdir4, readFile as readFile6, realpath as realpath2, unlink as unlink2, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join7, parse, relative as relative2, resolve as resolve3 } from "path";
+import { dirname as dirname4, isAbsolute as isAbsolute3, join as join7, parse, relative as relative3, resolve as resolve4 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 
 // src/runtime/node/config-toml.ts
@@ -17093,7 +17419,7 @@ function isNotFound(error) {
 
 // src/project-runtime.ts
 function resolveProjectPaths(options = {}) {
-  const projectDir = resolve3(options.projectDir ?? process.cwd());
+  const projectDir = resolve4(options.projectDir ?? process.cwd());
   const stateDir = resolvePath2(projectDir, options.stateDir ?? process.env.SUPACLOUD_LITE_STATE_DIR ?? ".supacloud-lite");
   const databaseEngine = resolveDatabaseEngine(options.engine, options.memory);
   const dataDir = options.memory ? undefined : resolvePath2(projectDir, options.dataDir ?? process.env.SUPACLOUD_LITE_DATA_DIR ?? join7(stateDir, databaseEngine === "native" ? "pgdata" : "db"));
@@ -17263,7 +17589,7 @@ async function loadProjectBindings(projectDir, config) {
   const bindings = config.lite.migrationBindings;
   if (!bindings)
     return;
-  const manifest = JSON.parse(await readFile6(resolve3(projectDir, bindings.manifest), "utf8"));
+  const manifest = JSON.parse(await readFile6(resolve4(projectDir, bindings.manifest), "utf8"));
   return {
     manifest,
     target: { environment: bindings.environment, projectRef: bindings.projectRef },
@@ -17273,7 +17599,7 @@ async function loadProjectBindings(projectDir, config) {
 async function loadProjectIdentity(projectDir, module) {
   if (!module)
     return;
-  const imported = await import(pathToFileURL2(resolve3(projectDir, module)).href);
+  const imported = await import(pathToFileURL2(resolve4(projectDir, module)).href);
   if (!isRecord(imported) || typeof imported["default"] !== "function") {
     throw new Error("Lite identity module must default-export an external identity verifier");
   }
@@ -17339,7 +17665,11 @@ async function startProjectServer(options = {}) {
   const resolvedOptions = options.port === 0 ? { ...options, port: await findEphemeralPort(options.host) } : options;
   const project = await createProjectBackend({ ...resolvedOptions, startRuntimeServices: true });
   try {
-    const server = await serveBun(project.backend, { host: project.host, port: project.port });
+    const beforeRequest = options.externalAuthProxyIssuer ? createExternalAuthProxy({
+      issuer: options.externalAuthProxyIssuer,
+      allowedRedirectOrigins: options.externalAuthProxyRedirectOrigins
+    }) : undefined;
+    const server = await serveBun(project.backend, { host: project.host, port: project.port, beforeRequest });
     let closePromise = null;
     return {
       ...project,
@@ -17381,7 +17711,7 @@ async function loadWebhooks(projectDir) {
   }
 }
 function resolvePath2(projectDir, path) {
-  return isAbsolute2(path) ? path : resolve3(projectDir, path);
+  return isAbsolute3(path) ? path : resolve4(projectDir, path);
 }
 function randomHex(bytes) {
   const value = crypto.getRandomValues(new Uint8Array(bytes));
@@ -17426,7 +17756,7 @@ async function findEphemeralPort(host = "127.0.0.1") {
 }
 // src/snapshot.ts
 import { chmod as chmod2, copyFile, lstat as lstat3, mkdir as mkdir5, mkdtemp, readdir as readdir3, readFile as readFile7, rename as rename2, rm as rm4, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname5, join as join8, parse as parse2, relative as relative3, resolve as resolve4, sep as sep2 } from "path";
+import { dirname as dirname5, join as join8, parse as parse2, relative as relative4, resolve as resolve5, sep as sep2 } from "path";
 import { create as createTar, extract as extractTar2 } from "tar";
 var SNAPSHOT_FORMAT = "supacloud-lite-snapshot";
 var SNAPSHOT_VERSION = 1;
@@ -17450,7 +17780,7 @@ async function createSnapshot(options) {
       postgresMajor: await readPostgresMajor(paths.dataDir)
     } : {}
   };
-  const output = resolve4(options.output);
+  const output = resolve5(options.output);
   if (await existingInfo(output))
     throw new Error(`snapshot output already exists: ${output}`);
   await mkdir5(dirname5(output), { recursive: true });
@@ -17491,7 +17821,7 @@ async function restoreSnapshot(options) {
     await mkdir5(payloadRoot, { recursive: true });
     await extractTar2({
       cwd: payloadRoot,
-      file: resolve4(options.input),
+      file: resolve5(options.input),
       preserveOwner: false,
       preservePaths: false,
       strict: true,
@@ -17534,10 +17864,10 @@ async function restoreSnapshot(options) {
     await mkdir5(stateStage, { recursive: true });
     await copyEntry(join8(payloadRoot, "secrets.json"), join8(stateStage, "secrets.json"));
     if (paths.dataDir && isWithin(paths.stateDir, paths.dataDir)) {
-      await copyEntry(join8(payloadRoot, "database"), join8(stateStage, relative3(paths.stateDir, paths.dataDir)));
+      await copyEntry(join8(payloadRoot, "database"), join8(stateStage, relative4(paths.stateDir, paths.dataDir)));
     }
     if (options.storageBackend === "fs" && isWithin(paths.stateDir, paths.storageDir)) {
-      await copyEntry(join8(payloadRoot, "storage"), join8(stateStage, relative3(paths.stateDir, paths.storageDir)));
+      await copyEntry(join8(payloadRoot, "storage"), join8(stateStage, relative4(paths.stateDir, paths.storageDir)));
     }
     const swaps = [];
     try {
@@ -17571,11 +17901,11 @@ async function restoreSnapshot(options) {
 function normalizePaths(paths) {
   return {
     ...paths,
-    projectDir: resolve4(paths.projectDir),
-    stateDir: resolve4(paths.stateDir),
-    dataDir: paths.dataDir ? resolve4(paths.dataDir) : undefined,
-    storageDir: resolve4(paths.storageDir),
-    secretsFile: resolve4(paths.secretsFile)
+    projectDir: resolve5(paths.projectDir),
+    stateDir: resolve5(paths.stateDir),
+    dataDir: paths.dataDir ? resolve5(paths.dataDir) : undefined,
+    storageDir: resolve5(paths.storageDir),
+    secretsFile: resolve5(paths.secretsFile)
   };
 }
 async function assertSnapshotPaths(paths, options = {}) {
@@ -17605,7 +17935,7 @@ async function assertSnapshotPaths(paths, options = {}) {
 async function assertDirectoryOrMissing(path) {
   if (!path)
     return;
-  if (resolve4(path) === parse2(resolve4(path)).root)
+  if (resolve5(path) === parse2(resolve5(path)).root)
     throw new Error(`snapshot path must not be the filesystem root: ${path}`);
   try {
     const info = await lstat3(path);
@@ -17828,13 +18158,13 @@ async function assertNoSymlinks(root) {
   }
 }
 function isWithin(parent, child) {
-  const normalizedParent = resolve4(parent);
-  const normalizedChild = resolve4(child);
+  const normalizedParent = resolve5(parent);
+  const normalizedChild = resolve5(child);
   return normalizedChild !== normalizedParent && normalizedChild.startsWith(`${normalizedParent}${sep2}`);
 }
 function pathsOverlap(left, right) {
-  const normalizedLeft = resolve4(left);
-  const normalizedRight = resolve4(right);
+  const normalizedLeft = resolve5(left);
+  const normalizedRight = resolve5(right);
   return normalizedLeft === normalizedRight || isWithin(normalizedLeft, normalizedRight) || isWithin(normalizedRight, normalizedLeft);
 }
 export {
@@ -17845,6 +18175,7 @@ export {
   S3StorageDriver,
   SUPACLOUD_LITE_VERSION,
   buildPowerSyncPostgresArgs,
+  createExternalAuthProxy,
   createBackend as createLiteBackend,
   createNativeEngine,
   createPgliteEngine,
@@ -17863,6 +18194,7 @@ export {
   isNativeEngineSupported,
   liteCapabilities,
   mintProjectKeys,
+  productionReadiness,
   resolveDatabaseEngine,
   resolveNativeReplicationOptions,
   resolveProjectPaths,

package/dist/project-runtime.d.ts

@@ -27,6 +27,8 @@ export interface ProjectRuntimeOptions {
     graphql?: GraphqlOptions;
     externalIdentity?: ExternalIdentityVerifier;
     identityModule?: string;
+    externalAuthProxyIssuer?: string;
+    externalAuthProxyRedirectOrigins?: string[];
     postgresDir?: string;
     migrationBindings?: SeedOptions['bindings'];
     projectDir?: string;

package/dist/project-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-runtime.d.ts","sourceRoot":"","sources":["../src/project-runtime.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAG7E,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAE3E,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAGrF,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAE/D,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AAC7F,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAkC,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAGrG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAK5D,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,gBAAgB,CAAC,EAAE,wBAAwB,CAAA;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iBAAiB,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,CAAA;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,EAAE,CAAC,EAAE,sBAAsB,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAA;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;IAC1F,OAAO,EAAE,oBAAoB,CAAA;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,YAAY,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,cAAc,CAAA;IAC9B,cAAc,EAAE,cAAc,CAAA;IAC9B,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CACxC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAChD,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAC5C,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAA;AAC9D,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;AAExE,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,qBAA0B,GAAG,YAAY,CAsBrF;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B7E;AAqED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAqCvF;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAE7G;AAED,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,cAAc,CAAC,CAgHvG;AAED,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CASrH;AAeD,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,qBAAqB,EAC9B,cAAc,iBAAwD,GACrE,wBAAwB,GAAG,SAAS,CAyBtC;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,MAAM,UAAQ,GAAG,cAAc,CAa5F;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,CAIhG;AAiBD,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiC3G"}
+{"version":3,"file":"project-runtime.d.ts","sourceRoot":"","sources":["../src/project-runtime.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAG7E,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAE3E,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAGrF,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAE/D,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AAC7F,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAkC,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAGrG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAK5D,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,gBAAgB,CAAC,EAAE,wBAAwB,CAAA;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iBAAiB,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,CAAA;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,EAAE,CAAC,EAAE,sBAAsB,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAA;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;IAC1F,OAAO,EAAE,oBAAoB,CAAA;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,YAAY,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,cAAc,CAAA;IAC9B,cAAc,EAAE,cAAc,CAAA;IAC9B,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CACxC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAChD,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAC5C,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAA;AAC9D,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;AAExE,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,qBAA0B,GAAG,YAAY,CAsBrF;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B7E;AAqED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAqCvF;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAE7G;AAED,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,cAAc,CAAC,CAgHvG;AAED,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CASrH;AAeD,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,qBAAqB,EAC9B,cAAc,iBAAwD,GACrE,wBAAwB,GAAG,SAAS,CAyBtC;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,MAAM,UAAQ,GAAG,cAAc,CAa5F;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,CAIhG;AAiBD,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAuC3G"}

package/dist/runtime/auth/proxy.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Same-origin reverse proxy for an external SupAuth / GoTrue OAuth runtime.
+ *
+ * Browser applications often run on a business origin that the identity
+ * service does not allow via CORS. The authorization request is a top-level
+ * navigation and needs no proxy; token exchange, userinfo and logout are
+ * browser API calls and can be routed through this handler instead.
+ *
+ * This is deliberately not a general-purpose proxy: only exact OAuth paths and
+ * methods are accepted, the upstream origin is fixed by configuration, and
+ * credentials, cookies and hop-by-hop headers are never forwarded.
+ */
+export type ExternalAuthFetch = (input: URL | RequestInfo, init?: RequestInit) => Promise<Response>;
+export interface ExternalAuthProxyOptions {
+    /** Issuer URL, for example https://auth.example.com/auth/v1. */
+    issuer: string;
+    /** Extra origins allowed as logout redirect targets, such as the application origin. */
+    allowedRedirectOrigins?: readonly string[];
+    /** Trusted host override for tests. */
+    fetch?: ExternalAuthFetch;
+}
+export type ExternalAuthProxy = (request: Request) => Promise<Response | null>;
+/**
+ * Create a request handler that returns `null` for requests it does not own, so
+ * the caller can continue normal Lite routing.
+ */
+export declare function createExternalAuthProxy(options: ExternalAuthProxyOptions): ExternalAuthProxy;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/runtime/auth/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,WAAW,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEnG,MAAM,WAAW,wBAAwB;IACvC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAA;IACd,wFAAwF;IACxF,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,uCAAuC;IACvC,KAAK,CAAC,EAAE,iBAAiB,CAAA;CAC1B;AAED,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;AA0D9E;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,iBAAiB,CAoD5F"}