@supacloud/lite 0.5.6 → 0.5.8

package/dist/index.js

@@ -1,7 +1,7 @@
 // @bun
 var __require = import.meta.require;
 
-// src/vendor/tinbase/jwt.ts
+// src/runtime/jwt.ts
 var encoder = new TextEncoder;
 var decoder = new TextDecoder;
 function bytesToBase64Url(bytes) {
@@ -71,7 +71,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.5.6",
+  version: "0.5.8",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite",
   type: "module",
   license: "Apache-2.0",
@@ -96,7 +96,7 @@ var package_default = {
   ],
   scripts: {
     build: "bun run build:js && bun run build:types",
-    "build:js": "bun build src/index.ts --target=bun --format=esm --outdir=dist --external @electric-sql/pglite --external tar && bun build src/cli.ts --target=bun --format=esm --outdir=dist --external @electric-sql/pglite --external tar && bun run scripts/build-launcher.ts",
+    "build:js": "bun run clean && bun build src/index.ts --target=bun --format=esm --outdir=dist --external @electric-sql/pglite --external tar && bun build src/cli.ts --target=bun --format=esm --outdir=dist --external @electric-sql/pglite --external tar && bun run scripts/build-launcher.ts",
     "build:standalone:host": "bun run scripts/build-standalone.ts host",
     "build:standalone:linux": "bun run scripts/build-standalone.ts linux-x64 linux-arm64",
     "build:standalone:macos": "bun run scripts/build-standalone.ts macos-x64 macos-arm64",
@@ -104,6 +104,7 @@ var package_default = {
     "build:standalone:release": "bun run scripts/build-standalone.ts linux-x64 linux-arm64 macos-x64 macos-arm64 windows-x64",
     "build:types": "bun x tsc --emitDeclarationOnly -p tsconfig.build.json",
     check: "bun run typecheck && bun run test && bun run build && bun run test:package && bun run build:standalone:host && bun run test:standalone",
+    clean: `bun -e "import { rmSync } from 'node:fs'; rmSync('dist', { recursive: true, force: true })"`,
     dev: "bun run src/cli.ts start",
     start: "bun run src/cli.ts start",
     test: "bun test --timeout 20000",
@@ -145,7 +146,7 @@ var package_default = {
 // src/version.ts
 var SUPACLOUD_LITE_VERSION = package_default.version;
 
-// src/vendor/tinbase/auth/redirect.ts
+// src/runtime/auth/redirect.ts
 function globToRegExp(pattern) {
   let out = "";
   for (let i = 0;i < pattern.length; i++) {
@@ -194,7 +195,7 @@ function isAllowedRedirect(requested, siteUrl, allowList = []) {
   return allowList.some((entry) => globToRegExp(entry).test(requested));
 }
 
-// src/vendor/tinbase/auth/oauth.ts
+// src/runtime/auth/oauth.ts
 var PRESETS = {
   google: {
     authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
@@ -415,7 +416,7 @@ function base64url(bytes) {
   return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
-// src/vendor/tinbase/auth/password.ts
+// src/runtime/auth/password.ts
 function toHex(bytes) {
   return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
@@ -470,7 +471,7 @@ async function verifyPassword(password, stored) {
   return diff === 0;
 }
 
-// src/vendor/tinbase/auth/qr.ts
+// src/runtime/auth/qr.ts
 var ECC_M = { ordinal: 0, formatBits: 0 };
 var ECC_CODEWORDS_PER_BLOCK = [
   -1,
@@ -905,7 +906,7 @@ function qrSvgDataUri(text) {
   return `data:image/svg+xml;utf8,${encodeURIComponent(svg)}`;
 }
 
-// src/vendor/tinbase/auth/settings.ts
+// src/runtime/auth/settings.ts
 var DEFAULT_AUTH_SETTINGS = {
   disableSignup: false,
   anonymousUsers: true,
@@ -958,7 +959,7 @@ async function loadAuthSettings(db, defaults = {}) {
   }
 }
 
-// src/vendor/tinbase/auth/rate-limit.ts
+// src/runtime/auth/rate-limit.ts
 var DEFAULT_AUTH_RATE_LIMITS = {
   token: { limit: 30, windowMs: 5 * 60 * 1000 },
   signup: { limit: 30, windowMs: 60 * 60 * 1000 },
@@ -1003,7 +1004,7 @@ class RateLimiter {
   }
 }
 
-// src/vendor/tinbase/auth/totp.ts
+// src/runtime/auth/totp.ts
 var B32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
 function base32Encode(bytes) {
   let bits = 0;
@@ -1081,7 +1082,7 @@ async function verifyTotp(secretBase32, code, window = 1, atMs = Date.now()) {
   return false;
 }
 
-// src/vendor/tinbase/auth/handler.ts
+// src/runtime/auth/handler.ts
 function authError(status, errorCode, msg) {
   return json(status, { code: status, error_code: errorCode, msg });
 }
@@ -1833,7 +1834,7 @@ Or sign in with this link: ${link}`
   }
 }
 
-// src/vendor/tinbase/auth/inbox.ts
+// src/runtime/auth/inbox.ts
 var CAP = 200;
 
 class InboxMailer {
@@ -1945,7 +1946,7 @@ var INBOX_HTML = `<!doctype html>
 </body>
 </html>`;
 
-// src/vendor/tinbase/log-buffer.ts
+// src/runtime/log-buffer.ts
 class LogBuffer {
   cap;
   entries = [];
@@ -1965,7 +1966,7 @@ class LogBuffer {
   }
 }
 
-// src/vendor/tinbase/functions/deno-shim.ts
+// src/runtime/functions/deno-shim.ts
 import { AsyncLocalStorage } from "async_hooks";
 var captured = {};
 var envStore = new AsyncLocalStorage;
@@ -1974,11 +1975,11 @@ function runWithDenoEnv(env, fn) {
 }
 function installDenoShim() {
   const g = globalThis;
-  if (g.__tinbaseDeno)
+  if (g.__supacloudLiteDeno)
     return;
   if (g.Deno && typeof g.Deno.serve === "function")
     return;
-  g.__tinbaseDeno = true;
+  g.__supacloudLiteDeno = true;
   g.Deno = {
     serve(arg1, arg2) {
       captured.handler = typeof arg1 === "function" ? arg1 : arg2;
@@ -2014,7 +2015,7 @@ function resetCapturedHandler() {
   captured.handler = undefined;
 }
 
-// src/vendor/tinbase/functions/pgredis.ts
+// src/runtime/functions/pgredis.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 var CACHE_NAMESPACE = "supacloud-edge-runtime";
 var CACHE_TABLE = "public.supacloud_pgredis_kv";
@@ -2181,7 +2182,7 @@ async function upsertWithoutTtl(query, key, serializedValue) {
      on conflict (namespace, key) do update set value = excluded.value, expires_at = null, updated_at = now()`, [CACHE_NAMESPACE, key, serializedValue]);
 }
 
-// src/vendor/tinbase/functions/handler.ts
+// src/runtime/functions/handler.ts
 class FunctionsHandler {
   functions;
   env;
@@ -2226,7 +2227,7 @@ function json2(status, body) {
   });
 }
 
-// src/vendor/tinbase/db/bootstrap.ts
+// src/runtime/db/bootstrap.ts
 var MINIMAL_BOOTSTRAP_SQL = `
 create schema if not exists auth;
 create schema if not exists storage;
@@ -2650,8 +2651,22 @@ $$;
 
 alter table storage.objects enable row level security;
 
-drop policy if exists tinbase_authenticated_all on storage.objects;
-drop policy if exists tinbase_public_read on storage.objects;
+drop policy if exists supacloud_lite_authenticated_all on storage.objects;
+drop policy if exists supacloud_lite_public_read on storage.objects;
+
+do $legacy_policy_cleanup$
+declare
+  legacy_prefix constant text := 'tin' || 'base';
+begin
+  execute format(
+    'drop policy if exists %I on storage.objects',
+    legacy_prefix || '_authenticated_all'
+  );
+  execute format(
+    'drop policy if exists %I on storage.objects',
+    legacy_prefix || '_public_read'
+  );
+end $legacy_policy_cleanup$;
 
 -- \u2500\u2500 Migration bookkeeping (same table the Supabase CLI uses) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 create schema if not exists supabase_migrations;
@@ -2670,9 +2685,19 @@ create table if not exists supabase_migrations.seed_files (
 );
 
 -- \u2500\u2500 Realtime CDC plumbing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-create schema if not exists tinbase;
+do $legacy_schema_upgrade$
+declare
+  legacy_schema constant text := 'tin' || 'base';
+begin
+  if exists (select 1 from pg_namespace where nspname = legacy_schema)
+     and not exists (select 1 from pg_namespace where nspname = 'supacloud_lite') then
+    execute format('alter schema %I rename to supacloud_lite', legacy_schema);
+  end if;
+end $legacy_schema_upgrade$;
+
+create schema if not exists supacloud_lite;
 
-create or replace function tinbase.cdc_notify() returns trigger
+create or replace function supacloud_lite.cdc_notify() returns trigger
 language plpgsql security definer as $$
 declare
   payload text;
@@ -2697,10 +2722,78 @@ begin
       'errors', json_build_array('Payload too large')
     )::text;
   end if;
-  perform pg_notify('tinbase_cdc', payload);
+  perform pg_notify('supacloud_lite_cdc', payload);
   return coalesce(NEW, OLD);
 end $$;
 
+do $legacy_trigger_upgrade$
+declare
+  legacy_schema constant text := 'tin' || 'base';
+  legacy_trigger constant text := ('tin' || 'base') || '_cdc';
+  trigger_record record;
+  target_exists boolean;
+begin
+  for trigger_record in
+    select c.oid as relation_oid, n.nspname as schema_name, c.relname as table_name
+      from pg_trigger tg
+      join pg_class c on c.oid = tg.tgrelid
+      join pg_namespace n on n.oid = c.relnamespace
+      join pg_proc p on p.oid = tg.tgfoid
+      join pg_namespace pn on pn.oid = p.pronamespace
+     where not tg.tgisinternal
+       and tg.tgname = legacy_trigger
+       and p.proname = 'cdc_notify'
+       and pn.nspname in (legacy_schema, 'supacloud_lite')
+  loop
+    select exists (
+      select 1
+        from pg_trigger
+       where not tgisinternal
+         and tgrelid = trigger_record.relation_oid
+         and tgname = 'supacloud_lite_cdc'
+    ) into target_exists;
+
+    execute format(
+      'drop trigger %I on %I.%I',
+      legacy_trigger,
+      trigger_record.schema_name,
+      trigger_record.table_name
+    );
+
+    if not target_exists then
+      execute format(
+        'create trigger supacloud_lite_cdc after insert or update or delete on %I.%I for each row execute function supacloud_lite.cdc_notify()',
+        trigger_record.schema_name,
+        trigger_record.table_name
+      );
+    end if;
+  end loop;
+end $legacy_trigger_upgrade$;
+
+do $legacy_schema_cleanup$
+declare
+  legacy_schema constant text := 'tin' || 'base';
+begin
+  if exists (
+    select 1
+      from pg_proc p
+      join pg_namespace n on n.oid = p.pronamespace
+     where n.nspname = legacy_schema
+       and p.proname = 'cdc_notify'
+       and p.pronargs = 0
+  ) then
+    execute format('drop function %I.cdc_notify()', legacy_schema);
+  end if;
+
+  if exists (select 1 from pg_namespace where nspname = legacy_schema) then
+    begin
+      execute format('drop schema %I', legacy_schema);
+    exception when dependent_objects_still_exist then
+      raise notice 'SupaCloud Lite: retained non-empty legacy runtime schema';
+    end;
+  end if;
+end $legacy_schema_cleanup$;
+
 -- \u2500\u2500 Realtime Authorization + broadcast-from-database \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 -- Mirrors Supabase Realtime: developers write RLS policies on
 -- realtime.messages using realtime.topic(); a SELECT policy grants a private
@@ -2730,12 +2823,12 @@ create or replace function realtime.topic() returns text
 
 -- push a broadcast message to all subscribers of <topic> from SQL / triggers.
 -- Delivered over the websocket by the in-process realtime engine, which listens
--- on the 'tinbase_realtime_broadcast' channel.
+-- on the 'supacloud_lite_realtime_broadcast' channel.
 create or replace function realtime.send(payload jsonb, event text, topic text, private boolean default true)
   returns void language plpgsql security definer as $$
 begin
   perform pg_notify(
-    'tinbase_realtime_broadcast',
+    'supacloud_lite_realtime_broadcast',
     json_build_object('topic', topic, 'event', event, 'payload', payload, 'private', private)::text
   );
 exception when others then
@@ -2747,7 +2840,7 @@ grant execute on function realtime.topic() to anon, authenticated, service_role;
 grant execute on function realtime.send(jsonb, text, text, boolean) to anon, authenticated, service_role;
 `;
 
-// src/vendor/tinbase/db/emulated.ts
+// src/runtime/db/emulated.ts
 var PGMQ_SQL = `
 create schema if not exists pgmq;
 revoke all on schema pgmq from public, anon, authenticated;
@@ -3198,7 +3291,7 @@ end $vault$;
 grant execute on function vault.create_secret(text,text,text,uuid), vault.update_secret(uuid,text,text,text,uuid) to service_role;
 `;
 
-// src/vendor/tinbase/db/sql-compat.ts
+// src/runtime/db/sql-compat.ts
 function rewriteMigrationSql(sql) {
   const out = [];
   const n = sql.length;
@@ -3279,7 +3372,7 @@ function rewriteStatement(stmt) {
       return stmt;
     const inner = pickTag(bare, "tb_ext_stmt");
     const outer = pickTag(bare, "tb_ext");
-    return `${trivia}DO ${outer} BEGIN EXECUTE ${inner}${bare}${inner}; ` + `EXCEPTION WHEN OTHERS THEN RAISE NOTICE 'tinbase: skipped extension statement (%)', SQLERRM; END ${outer};`;
+    return `${trivia}DO ${outer} BEGIN EXECUTE ${inner}${bare}${inner}; ` + `EXCEPTION WHEN OTHERS THEN RAISE NOTICE 'SupaCloud Lite: skipped extension statement (%)', SQLERRM; END ${outer};`;
   }
   if (/^(?:create\s+(?:unique\s+)?index|drop\s+index|reindex)\b/i.test(rest)) {
     return trivia + rest.replace(/\s+concurrently\b/i, " ");
@@ -3294,11 +3387,11 @@ function pickTag(text, base) {
   return tag;
 }
 
-// src/vendor/tinbase/db/pglite-engine.ts
+// src/runtime/db/pglite-engine.ts
 import { mkdir, open, unlink as unlink2 } from "fs/promises";
 import { dirname, resolve } from "path";
 
-// src/vendor/tinbase/db/data-dir-lock.ts
+// src/runtime/db/data-dir-lock.ts
 import { readFile, unlink } from "fs/promises";
 async function recoverStaleDataDirLock(lockPath) {
   const lockState = await inspectDataDirLock(lockPath);
@@ -3349,7 +3442,7 @@ function isProcessAlive(pid) {
 // src/standalone-assets-protocol.ts
 var STANDALONE_PGLITE_ASSETS = Symbol.for("supacloud-lite.pglite-standalone-assets");
 
-// src/vendor/tinbase/db/pglite-engine.ts
+// src/runtime/db/pglite-engine.ts
 async function createPgliteEngine(dataDir) {
   const releaseLock = await acquireDataDirLock(dataDir);
   let PGlite, extensions;
@@ -3524,7 +3617,7 @@ function unreadableLockError(lockPath) {
   return new Error(`PGlite data directory has an unreadable lock: ${lockPath}. Confirm no SupaCloud Lite process is using it, then remove the lock manually.`);
 }
 
-// src/vendor/tinbase/db/database.ts
+// src/runtime/db/database.ts
 var DEFAULT_SEARCH_PATH_SQL = `set search_path to "$user", public, extensions`;
 
 class Database {
@@ -3768,13 +3861,13 @@ class Database {
           select from pg_trigger tg
           join pg_class c on c.oid = tg.tgrelid
           join pg_namespace n on n.oid = c.relnamespace
-          where tg.tgname = 'tinbase_cdc'
+          where tg.tgname = 'supacloud_lite_cdc'
             and n.nspname = ${quoteLiteral(schema)}
             and c.relname = ${quoteLiteral(table)}
         ) then
-          create trigger tinbase_cdc
+          create trigger supacloud_lite_cdc
             after insert or update or delete on ${s}.${t}
-            for each row execute function tinbase.cdc_notify();
+            for each row execute function supacloud_lite.cdc_notify();
         end if;
       end $$;
     `);
@@ -3808,7 +3901,7 @@ class Database {
     }
   }
   async attachCdcListener() {
-    this.cdcUnsubscribe = await this.engine.listen("tinbase_cdc", (payload) => {
+    this.cdcUnsubscribe = await this.engine.listen("supacloud_lite_cdc", (payload) => {
       try {
         const event = JSON.parse(payload);
         for (const listener of this.cdcListeners)
@@ -3896,7 +3989,7 @@ async function sha256Hex(text) {
   return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 
-// src/vendor/tinbase/realtime/engine.ts
+// src/runtime/realtime/engine.ts
 class RealtimeEngine {
   db;
   jwtSecret;
@@ -3961,7 +4054,7 @@ class RealtimeEngine {
     if (this.stopCdc)
       return;
     this.stopCdc = await this.db.onCdcEvent((e) => this.dispatchCdc(e));
-    this.stopDbBroadcast = await this.db.engine.listen("tinbase_realtime_broadcast", (payload) => {
+    this.stopDbBroadcast = await this.db.engine.listen("supacloud_lite_realtime_broadcast", (payload) => {
       try {
         this.dispatchDbBroadcast(JSON.parse(payload));
       } catch {}
@@ -4433,7 +4526,7 @@ function encodeUserBroadcast(topic, event, payload) {
   return out;
 }
 
-// src/vendor/tinbase/types.ts
+// src/runtime/types.ts
 var DEFAULT_JWT_SECRET = "";
 
 class ApiError extends Error {
@@ -4446,7 +4539,7 @@ class ApiError extends Error {
   }
 }
 
-// src/vendor/tinbase/rest/parse.ts
+// src/runtime/rest/parse.ts
 class ParseError extends Error {
 }
 var RESERVED = new Set(["select", "order", "limit", "offset", "on_conflict", "columns"]);
@@ -4720,7 +4813,7 @@ function findAliasColon(item) {
   return -1;
 }
 
-// src/vendor/tinbase/rest/build.ts
+// src/runtime/rest/build.ts
 var AGG_EMPTY = `'[]'::json`;
 
 class QueryBuilder {
@@ -5228,7 +5321,7 @@ function renderFilter(f, alias) {
   return f.negated ? `not (${expr})` : expr;
 }
 
-// src/vendor/tinbase/rest/errors.ts
+// src/runtime/rest/errors.ts
 function statusForSqlState(code) {
   switch (code) {
     case "42501":
@@ -5274,7 +5367,7 @@ function jsonResponse(status, body, headers = {}) {
   });
 }
 
-// src/vendor/tinbase/rest/handler.ts
+// src/runtime/rest/handler.ts
 function parsePrefer(header) {
   const prefer = {};
   if (!header)
@@ -5684,7 +5777,7 @@ async function readJsonBody(req) {
   }
 }
 
-// src/vendor/tinbase/storage/driver.ts
+// src/runtime/storage/driver.ts
 class MemoryStorageDriver {
   files = new Map;
   async put(key, data) {
@@ -5702,7 +5795,7 @@ class MemoryStorageDriver {
   }
 }
 
-// src/vendor/tinbase/storage/image-transform.ts
+// src/runtime/storage/image-transform.ts
 var IMAGE_FORMAT_CONTENT_TYPES = {
   jpeg: "image/jpeg",
   png: "image/png",
@@ -5888,7 +5981,7 @@ async function transformImage(bytes, options) {
   }
 }
 
-// src/vendor/tinbase/storage/handler.ts
+// src/runtime/storage/handler.ts
 var MAX_SIGNED_URL_EXPIRY = 7 * 24 * 60 * 60;
 function clampExpiry(expiresIn) {
   if (!Number.isFinite(expiresIn) || expiresIn <= 0)
@@ -5914,6 +6007,29 @@ function invalidObjectKey(key) {
 function storageError(status, error, message) {
   return json3(status, { statusCode: String(status), error, message });
 }
+var RLS_POLICY_HINT = "Upload denied by storage.objects RLS. Create a policy in supabase/migrations, e.g. " + "`create policy \"objects insert\" on storage.objects for insert to authenticated with check (bucket_id = '<bucket>');`. " + "Without a policy, RLS blocks every write by default.";
+
+class RlsPolicyError extends Error {
+  cause;
+  constructor(cause) {
+    super("storage.objects row-level security policy denied the write");
+    this.cause = cause;
+    this.name = "RlsPolicyError";
+  }
+}
+function rlsDeniedResponse() {
+  return storageError(403, "Unauthorized", RLS_POLICY_HINT);
+}
+function isRlsDenied(error) {
+  if (!error)
+    return false;
+  const pg = error;
+  if (pg.code === "42501")
+    return true;
+  if (error instanceof Error && /row-level security|permission denied/i.test(error.message))
+    return true;
+  return false;
+}
 function json3(status, body) {
   return new Response(JSON.stringify(body), {
     status,
@@ -6199,6 +6315,8 @@ class StorageHandler {
       const id = await this.persistObject(ctx, bucketId, key, bytes, contentType, cacheControl, upsert);
       return json3(200, { Key: `${bucketId}/${key}`, Id: id });
     } catch (e) {
+      if (e instanceof RlsPolicyError)
+        return rlsDeniedResponse();
       const pg = e;
       if (pg.code === "23505") {
         return storageError(409, "Duplicate", "The resource already exists");
@@ -6236,6 +6354,12 @@ class StorageHandler {
            values ($1, $2, $3, $4, $5::jsonb, $6) ${conflictClause} returning *`, [objectId, bucketId, key, ctx.claims?.sub ?? null, JSON.stringify(metadata), version]));
       inserted = result.rows[0];
     } catch (error) {
+      if (isRlsDenied(error)) {
+        try {
+          await this.driver.delete(stagedKey);
+        } catch {}
+        throw new RlsPolicyError(error);
+      }
       await this.discardStagedBytes(stagedKey, error);
     }
     if (!inserted)
@@ -6293,6 +6417,8 @@ class StorageHandler {
         try {
           await this.persistObject(ctx, bucketId, key, new Uint8Array, contentType, meta.cacheControl ?? "no-cache", upsert);
         } catch (error) {
+          if (error instanceof RlsPolicyError)
+            return rlsDeniedResponse();
           const pg = error;
           if (pg.code === "23505")
             return storageError(409, "Duplicate", "The resource already exists");
@@ -6423,6 +6549,8 @@ class StorageHandler {
       await this.persistObject(upload.ctx, upload.bucketId, upload.key, data, upload.contentType, upload.cacheControl, upload.upsert);
     } catch (e) {
       this.tusUploads.delete(id);
+      if (e instanceof RlsPolicyError)
+        return rlsDeniedResponse();
       const pg = e;
       if (pg.code === "23505")
         return storageError(409, "Duplicate", "The resource already exists");
@@ -6468,7 +6596,7 @@ class StorageHandler {
       if (pg.code === "23505")
         return storageError(409, "Duplicate", "The resource already exists");
       if (pg.code === "42501" || error instanceof Error && /row-level security|permission denied/i.test(error.message)) {
-        return storageError(403, "Unauthorized", "new row violates row-level security policy");
+        return rlsDeniedResponse();
       }
       throw error;
     }
@@ -6935,7 +7063,7 @@ function parseTusMetadata(header) {
   return out;
 }
 
-// src/vendor/tinbase/net/service.ts
+// src/runtime/net/service.ts
 var MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
 var MAX_REDIRECTS = 5;
 function blockedNetTarget(rawUrl) {
@@ -7132,7 +7260,7 @@ async function readCapped(res, maxBytes) {
   return new TextDecoder().decode(merged);
 }
 
-// src/vendor/tinbase/webhooks/service.ts
+// src/runtime/webhooks/service.ts
 class WebhooksService {
   db;
   fetchImpl;
@@ -7220,7 +7348,7 @@ class WebhooksService {
   }
 }
 
-// src/vendor/tinbase/cron/service.ts
+// src/runtime/cron/service.ts
 class CronService {
   db;
   tickMs;
@@ -7365,7 +7493,7 @@ function matchPart(part, value, min, max) {
   return (value - lo) % step === 0;
 }
 
-// src/vendor/tinbase/retention/service.ts
+// src/runtime/retention/service.ts
 var DAY_MS = 24 * 60 * 60 * 1000;
 
 class RetentionService {
@@ -7439,7 +7567,7 @@ class RetentionService {
   }
 }
 
-// src/vendor/tinbase/security.ts
+// src/runtime/security.ts
 var LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1", "", undefined]);
 function isNetworkExposed(host) {
   return !LOOPBACK_HOSTS.has(host);
@@ -7463,7 +7591,7 @@ function assertSecretsSafe(input) {
     warn("\u26A0 Vault key derived from the JWT secret - set an independent vaultKey before exposing this server.");
   }
 }
-// src/vendor/tinbase/gen-types.ts
+// src/runtime/gen-types.ts
 var JSON_TYPE = "Json";
 async function generateTypes(db, schema = "public") {
   const enums = await loadEnums(db, schema);
@@ -7689,7 +7817,7 @@ async function loadFunctions(db, schema) {
     args_json: parseIdentityArgs(r.identity_args)
   }));
 }
-// src/vendor/tinbase/db/inspect.ts
+// src/runtime/db/inspect.ts
 async function inspectDb(db, schema = "public") {
   const tables = await db.query(`select c.relname as table,
             pg_size_pretty(pg_total_relation_size(c.oid)) as size
@@ -7705,7 +7833,7 @@ async function inspectDb(db, schema = "public") {
   return out;
 }
 
-// src/vendor/tinbase/index.ts
+// src/runtime/index.ts
 var CORS_HEADERS = {
   "access-control-allow-origin": "*",
   "access-control-allow-methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD",
@@ -7991,7 +8119,7 @@ function withCors(res) {
   }
   return res;
 }
-// src/vendor/tinbase/storage/s3-driver.ts
+// src/runtime/storage/s3-driver.ts
 function normalizePath(value, label, allowEmpty) {
   if (value.includes("\x00")) {
     throw new TypeError(`${label} must not contain null bytes`);
@@ -8069,7 +8197,7 @@ class S3StorageDriver {
     return `${this.prefix}${normalizeKey(key)}`;
   }
 }
-// src/vendor/tinbase/node/fs-driver.ts
+// src/runtime/node/fs-driver.ts
 import { mkdir as mkdir2, readFile as readFile2, rename, rm, writeFile } from "fs/promises";
 import { dirname as dirname2, join, normalize, sep } from "path";
 
@@ -8114,7 +8242,7 @@ class FsStorageDriver {
       await this.delete(k);
   }
 }
-// src/vendor/tinbase/node/bun-server.ts
+// src/runtime/node/bun-server.ts
 async function serveBun(backend, opts = {}) {
   const host = opts.host ?? "127.0.0.1";
   const server = Bun.serve({
@@ -8164,7 +8292,7 @@ async function serveBun(backend, opts = {}) {
 import { chmod, link, lstat, mkdir as mkdir4, readFile as readFile6, realpath as realpath2, unlink as unlink3, writeFile as writeFile3 } from "fs/promises";
 import { dirname as dirname3, isAbsolute, join as join6, parse, relative, resolve as resolve2 } from "path";
 
-// src/vendor/tinbase/node/config-toml.ts
+// src/runtime/node/config-toml.ts
 import { readFileSync } from "fs";
 import { join as join2 } from "path";
 function emptyTable() {
@@ -8310,7 +8438,7 @@ function getByteSize(table, key) {
   return Math.round(n * (mult[unit] ?? 1));
 }
 
-// src/vendor/tinbase/node/load-config.ts
+// src/runtime/node/load-config.ts
 function loadProjectConfig(projectDir, env = process.env) {
   const root = loadConfigToml(projectDir, env);
   return {
@@ -8521,12 +8649,12 @@ function readFunctions(root) {
   return out;
 }
 
-// src/vendor/tinbase/node/load-functions.ts
+// src/runtime/node/load-functions.ts
 import { readdir, readFile as readFile4, realpath, rm as rm2, stat } from "fs/promises";
 import { join as join4 } from "path";
 import { pathToFileURL } from "url";
 
-// src/vendor/tinbase/node/bundle-function.ts
+// src/runtime/node/bundle-function.ts
 import { createHash } from "crypto";
 import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile2 } from "fs/promises";
 import { existsSync } from "fs";
@@ -8590,7 +8718,7 @@ async function bundleFunction(entryPath, name) {
   return result.outputs[0].path;
 }
 
-// src/vendor/tinbase/node/load-functions.ts
+// src/runtime/node/load-functions.ts
 async function loadFunctionEnv(projectDir) {
   let text;
   try {
@@ -8693,7 +8821,7 @@ async function loadFunctionsUnlocked(projectDir, options) {
   return functions;
 }
 
-// src/vendor/tinbase/node/project.ts
+// src/runtime/node/project.ts
 import { readdir as readdir2, readFile as readFile5 } from "fs/promises";
 import { join as join5 } from "path";
 async function loadSupabaseProject(projectDir, seed = {}) {