@supacloud/lite 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.7.0](https://github.com/zuohuadong/supacloud/compare/supacloud-lite-v0.6.0...supacloud-lite-v0.7.0) (2026-08-11)
+
+
+### Features
+
+* **lite:** support admin magic link verification ([#788](https://github.com/zuohuadong/supacloud/issues/788)) ([97defa0](https://github.com/zuohuadong/supacloud/commit/97defa0e3ba875d1bd0363f9f64df02a089238ff))
+
 ## [0.6.0](https://github.com/zuohuadong/supacloud/compare/supacloud-lite-v0.5.10...supacloud-lite-v0.6.0) (2026-08-11)
 
 

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname5, join as join9, resolve as resolve4 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.6.0",
+  version: "0.7.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite",
   type: "module",
   license: "Apache-2.0",
@@ -1112,6 +1112,10 @@ function randomOtp(length) {
   }
   return code;
 }
+async function sha256Hex(value) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
 function normalizePhone(value) {
   if (typeof value !== "string")
     return null;
@@ -1650,33 +1654,58 @@ Or sign in with this link: ${link}`
   }
   static MAX_OTP_ATTEMPTS = 5;
   async redeem(token, types, email) {
-    const normalizedEmail = email?.toLowerCase().trim() ?? null;
-    const res = await this.db.query(`delete from auth.one_time_tokens
-       where token = $1 and token_type = any($2::text[])
-         and ($3::text is null or email = $3) and expires_at > now()
-         and attempts < $4
-       returning user_id, email`, [token, `{${types.join(",")}}`, normalizedEmail, AuthHandler.MAX_OTP_ATTEMPTS]);
-    const row = res.rows[0];
-    if (!row) {
-      if (normalizedEmail) {
-        await this.db.query(`update auth.one_time_tokens set attempts = attempts + 1
-           where email = $1 and token_type = any($2::text[]) and expires_at > now()`, [normalizedEmail, `{${types.join(",")}}`]);
-        await this.db.query(`delete from auth.one_time_tokens where email = $1 and attempts >= $2`, [normalizedEmail, AuthHandler.MAX_OTP_ATTEMPTS]);
-      }
+    const redemption = {
+      token,
+      tokenTypes: `{${types.join(",")}}`,
+      email: email?.toLowerCase().trim() ?? null
+    };
+    return this.db.transaction((query) => this.claimEmailToken(query, redemption));
+  }
+  async claimEmailToken(query, redemption) {
+    const candidate = await this.findEmailTokenCandidate(query, redemption);
+    if (!candidate) {
+      await this.recordFailedEmailTokenAttempt(query, redemption);
       return null;
     }
-    await this.db.query(`delete from auth.one_time_tokens where email = $1`, [row.email]);
-    const ures = await this.db.query(`update auth.users set email_confirmed_at = coalesce(email_confirmed_at, now()), last_sign_in_at = now()
-       where id = $1 returning *`, [row.user_id]);
-    return ures.rows[0] ?? null;
+    const claimedToken = await this.lockAndDeleteEmailToken(query, candidate, redemption);
+    return claimedToken ? this.confirmEmailTokenUser(query, claimedToken) : null;
+  }
+  async lockAndDeleteEmailToken(query, candidate, redemption) {
+    await query(`select id from auth.users where id = $1 for update`, [candidate.user_id]);
+    const claimedTokens = await query(`delete from auth.one_time_tokens
+       where id = $1 and token = $2 and token_type = any($3::text[])
+         and expires_at > now() and attempts < $4
+       returning id, user_id, email`, [candidate.id, redemption.token, redemption.tokenTypes, AuthHandler.MAX_OTP_ATTEMPTS]);
+    return claimedTokens.rows[0] ?? null;
+  }
+  async confirmEmailTokenUser(query, claimedToken) {
+    await query(`delete from auth.one_time_tokens where email = $1`, [claimedToken.email]);
+    const users = await query(`update auth.users set email_confirmed_at = coalesce(email_confirmed_at, now()), last_sign_in_at = now()
+       where id = $1 returning *`, [claimedToken.user_id]);
+    return users.rows[0] ?? null;
+  }
+  async findEmailTokenCandidate(query, redemption) {
+    const candidates = await query(`select id, user_id, email from auth.one_time_tokens
+       where token = $1 and token_type = any($2::text[])
+         and ($3::text is null or email = $3) and expires_at > now()
+         and attempts < $4`, [redemption.token, redemption.tokenTypes, redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
+    return candidates.rows[0] ?? null;
+  }
+  async recordFailedEmailTokenAttempt(query, redemption) {
+    if (!redemption.email)
+      return;
+    await query(`update auth.one_time_tokens set attempts = attempts + 1
+       where email = $1 and token_type = any($2::text[]) and expires_at > now()`, [redemption.email, redemption.tokenTypes]);
+    await query(`delete from auth.one_time_tokens where email = $1 and attempts >= $2`, [redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
   }
   async verifyToken(req) {
     const body = await req.json().catch(() => ({}));
-    if (!body.token)
-      return authError(400, "validation_failed", "token is required");
+    const token = body.token ?? body.token_hash;
+    if (!token)
+      return authError(400, "validation_failed", "token or token_hash is required");
     if (body.type === "sms" || body.phone !== undefined) {
       const phone = normalizePhone(body.phone);
-      if (body.type !== "sms" || !phone || !/^\d{6,10}$/.test(body.token)) {
+      if (body.type !== "sms" || !phone || !body.token || !/^\d{6,10}$/.test(body.token)) {
         return authError(400, "validation_failed", "phone, token, and type=sms are required");
       }
       const fingerprint = await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-fingerprint:v1", phone);
@@ -1695,7 +1724,7 @@ Or sign in with this link: ${link}`
       return json(200, session);
     }
     const types = body.type === "recovery" ? ["recovery"] : body.type === "magiclink" ? ["magiclink"] : ["otp", "magiclink"];
-    const user = await this.redeem(body.token, types, body.email);
+    const user = await this.redeem(token, types, body.email);
     if (!user)
       return authError(403, "otp_expired", "Token has expired or is invalid");
     return json(200, await this.sessionFor(user));
@@ -1753,6 +1782,9 @@ Or sign in with this link: ${link}`
     }
     const idMatch = path.match(/^admin\/users\/([0-9a-f-]{36})$/);
     const exportMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/export$/);
+    if (path === "admin/generate_link" && method === "POST") {
+      return await this.generateAdminMagicLink(req);
+    }
     if (path === "admin/audit" && method === "GET") {
       const res = await this.db.query(`select id, payload, created_at, ip_address from auth.audit_log_entries
          order by created_at desc limit 200`);
@@ -1823,6 +1855,50 @@ Or sign in with this link: ${link}`
     }
     return authError(404, "not_found", `unknown admin endpoint`);
   }
+  async generateAdminMagicLink(req) {
+    const body = await req.json().catch(() => ({}));
+    if (body.type !== "magiclink") {
+      return authError(422, "unsupported_link_type", "Only magiclink generation is supported");
+    }
+    if (!body.email)
+      return authError(400, "validation_failed", "email is required");
+    const email = body.email.toLowerCase().trim();
+    const emailOtp = randomOtp(this.settings.otpLength);
+    const hashedToken = await sha256Hex(randomToken(32));
+    const expiry = `${this.settings.otpExpirySeconds} seconds`;
+    const requestUrl = new URL(req.url);
+    const redirectTo = resolveRedirect(requestUrl.searchParams.get("redirect_to") ?? body.redirect_to, this.config.siteUrl, this.config.uriAllowList, this.config.enforceRedirectAllowList);
+    const user = await this.db.transaction(async (query) => {
+      const result = await query(`insert into auth.users
+           (aud, role, email, raw_app_meta_data, raw_user_meta_data)
+         values ('authenticated', 'authenticated', $1, '{"provider":"email","providers":["email"]}', $2::jsonb)
+         on conflict (email) do update set email = excluded.email
+         returning *`, [email, JSON.stringify(body.data ?? {})]);
+      const linkedUser = result.rows[0];
+      await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+         values ($1::uuid, 'email', $1::text, $2::jsonb)
+         on conflict (provider, provider_id) do nothing`, [linkedUser.id, JSON.stringify({ sub: linkedUser.id, email })]);
+      await query(`delete from auth.one_time_tokens
+         where email = $1 and token_type = any($2::text[])`, [email, "{otp,magiclink}"]);
+      await query(`insert into auth.one_time_tokens (user_id, email, token_type, token, expires_at)
+         values ($1, $2, 'otp', $3, now() + $5::interval),
+                ($1, $2, 'magiclink', $4, now() + $5::interval)`, [linkedUser.id, email, emailOtp, hashedToken, expiry]);
+      return linkedUser;
+    });
+    const actionUrl = new URL(`${this.config.apiUrl}/auth/v1/verify`);
+    actionUrl.searchParams.set("token", hashedToken);
+    actionUrl.searchParams.set("type", "magiclink");
+    actionUrl.searchParams.set("redirect_to", redirectTo);
+    await this.audit("user_magiclink_requested", { actorId: user.id, actorEmail: email, type: "admin" });
+    return json(200, {
+      ...this.userJson(user, [], await this.getUserIdentities(user.id)),
+      action_link: actionUrl.toString(),
+      email_otp: emailOtp,
+      hashed_token: hashedToken,
+      redirect_to: redirectTo,
+      verification_type: "magiclink"
+    });
+  }
   async audit(action, opts = {}) {
     try {
       const payload = {
@@ -4148,7 +4224,7 @@ class Database {
       }
     }
     if (seedSql) {
-      const hash = await sha256Hex(seedSql);
+      const hash = await sha256Hex2(seedSql);
       const seen = await this.engine.query(`select 1 from supabase_migrations.seed_files where path = 'supabase/seed.sql' and hash = $1`, [hash]);
       if (seen.rows.length === 0) {
         await this.engine.transaction(async (tx) => {
@@ -4441,7 +4517,7 @@ function quoteIdent(name) {
 function quoteLiteral(value) {
   return `'${value.replaceAll("'", "''")}'`;
 }
-async function sha256Hex(text) {
+async function sha256Hex2(text) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
   return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
 }

package/dist/index.js

@@ -71,7 +71,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.6.0",
+  version: "0.7.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite",
   type: "module",
   license: "Apache-2.0",
@@ -1117,6 +1117,10 @@ function randomOtp(length) {
   }
   return code;
 }
+async function sha256Hex(value) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
 function normalizePhone(value) {
   if (typeof value !== "string")
     return null;
@@ -1655,33 +1659,58 @@ Or sign in with this link: ${link}`
   }
   static MAX_OTP_ATTEMPTS = 5;
   async redeem(token, types, email) {
-    const normalizedEmail = email?.toLowerCase().trim() ?? null;
-    const res = await this.db.query(`delete from auth.one_time_tokens
-       where token = $1 and token_type = any($2::text[])
-         and ($3::text is null or email = $3) and expires_at > now()
-         and attempts < $4
-       returning user_id, email`, [token, `{${types.join(",")}}`, normalizedEmail, AuthHandler.MAX_OTP_ATTEMPTS]);
-    const row = res.rows[0];
-    if (!row) {
-      if (normalizedEmail) {
-        await this.db.query(`update auth.one_time_tokens set attempts = attempts + 1
-           where email = $1 and token_type = any($2::text[]) and expires_at > now()`, [normalizedEmail, `{${types.join(",")}}`]);
-        await this.db.query(`delete from auth.one_time_tokens where email = $1 and attempts >= $2`, [normalizedEmail, AuthHandler.MAX_OTP_ATTEMPTS]);
-      }
+    const redemption = {
+      token,
+      tokenTypes: `{${types.join(",")}}`,
+      email: email?.toLowerCase().trim() ?? null
+    };
+    return this.db.transaction((query) => this.claimEmailToken(query, redemption));
+  }
+  async claimEmailToken(query, redemption) {
+    const candidate = await this.findEmailTokenCandidate(query, redemption);
+    if (!candidate) {
+      await this.recordFailedEmailTokenAttempt(query, redemption);
       return null;
     }
-    await this.db.query(`delete from auth.one_time_tokens where email = $1`, [row.email]);
-    const ures = await this.db.query(`update auth.users set email_confirmed_at = coalesce(email_confirmed_at, now()), last_sign_in_at = now()
-       where id = $1 returning *`, [row.user_id]);
-    return ures.rows[0] ?? null;
+    const claimedToken = await this.lockAndDeleteEmailToken(query, candidate, redemption);
+    return claimedToken ? this.confirmEmailTokenUser(query, claimedToken) : null;
+  }
+  async lockAndDeleteEmailToken(query, candidate, redemption) {
+    await query(`select id from auth.users where id = $1 for update`, [candidate.user_id]);
+    const claimedTokens = await query(`delete from auth.one_time_tokens
+       where id = $1 and token = $2 and token_type = any($3::text[])
+         and expires_at > now() and attempts < $4
+       returning id, user_id, email`, [candidate.id, redemption.token, redemption.tokenTypes, AuthHandler.MAX_OTP_ATTEMPTS]);
+    return claimedTokens.rows[0] ?? null;
+  }
+  async confirmEmailTokenUser(query, claimedToken) {
+    await query(`delete from auth.one_time_tokens where email = $1`, [claimedToken.email]);
+    const users = await query(`update auth.users set email_confirmed_at = coalesce(email_confirmed_at, now()), last_sign_in_at = now()
+       where id = $1 returning *`, [claimedToken.user_id]);
+    return users.rows[0] ?? null;
+  }
+  async findEmailTokenCandidate(query, redemption) {
+    const candidates = await query(`select id, user_id, email from auth.one_time_tokens
+       where token = $1 and token_type = any($2::text[])
+         and ($3::text is null or email = $3) and expires_at > now()
+         and attempts < $4`, [redemption.token, redemption.tokenTypes, redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
+    return candidates.rows[0] ?? null;
+  }
+  async recordFailedEmailTokenAttempt(query, redemption) {
+    if (!redemption.email)
+      return;
+    await query(`update auth.one_time_tokens set attempts = attempts + 1
+       where email = $1 and token_type = any($2::text[]) and expires_at > now()`, [redemption.email, redemption.tokenTypes]);
+    await query(`delete from auth.one_time_tokens where email = $1 and attempts >= $2`, [redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
   }
   async verifyToken(req) {
     const body = await req.json().catch(() => ({}));
-    if (!body.token)
-      return authError(400, "validation_failed", "token is required");
+    const token = body.token ?? body.token_hash;
+    if (!token)
+      return authError(400, "validation_failed", "token or token_hash is required");
     if (body.type === "sms" || body.phone !== undefined) {
       const phone = normalizePhone(body.phone);
-      if (body.type !== "sms" || !phone || !/^\d{6,10}$/.test(body.token)) {
+      if (body.type !== "sms" || !phone || !body.token || !/^\d{6,10}$/.test(body.token)) {
         return authError(400, "validation_failed", "phone, token, and type=sms are required");
       }
       const fingerprint = await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-fingerprint:v1", phone);
@@ -1700,7 +1729,7 @@ Or sign in with this link: ${link}`
       return json(200, session);
     }
     const types = body.type === "recovery" ? ["recovery"] : body.type === "magiclink" ? ["magiclink"] : ["otp", "magiclink"];
-    const user = await this.redeem(body.token, types, body.email);
+    const user = await this.redeem(token, types, body.email);
     if (!user)
       return authError(403, "otp_expired", "Token has expired or is invalid");
     return json(200, await this.sessionFor(user));
@@ -1758,6 +1787,9 @@ Or sign in with this link: ${link}`
     }
     const idMatch = path.match(/^admin\/users\/([0-9a-f-]{36})$/);
     const exportMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/export$/);
+    if (path === "admin/generate_link" && method === "POST") {
+      return await this.generateAdminMagicLink(req);
+    }
     if (path === "admin/audit" && method === "GET") {
       const res = await this.db.query(`select id, payload, created_at, ip_address from auth.audit_log_entries
          order by created_at desc limit 200`);
@@ -1828,6 +1860,50 @@ Or sign in with this link: ${link}`
     }
     return authError(404, "not_found", `unknown admin endpoint`);
   }
+  async generateAdminMagicLink(req) {
+    const body = await req.json().catch(() => ({}));
+    if (body.type !== "magiclink") {
+      return authError(422, "unsupported_link_type", "Only magiclink generation is supported");
+    }
+    if (!body.email)
+      return authError(400, "validation_failed", "email is required");
+    const email = body.email.toLowerCase().trim();
+    const emailOtp = randomOtp(this.settings.otpLength);
+    const hashedToken = await sha256Hex(randomToken(32));
+    const expiry = `${this.settings.otpExpirySeconds} seconds`;
+    const requestUrl = new URL(req.url);
+    const redirectTo = resolveRedirect(requestUrl.searchParams.get("redirect_to") ?? body.redirect_to, this.config.siteUrl, this.config.uriAllowList, this.config.enforceRedirectAllowList);
+    const user = await this.db.transaction(async (query) => {
+      const result = await query(`insert into auth.users
+           (aud, role, email, raw_app_meta_data, raw_user_meta_data)
+         values ('authenticated', 'authenticated', $1, '{"provider":"email","providers":["email"]}', $2::jsonb)
+         on conflict (email) do update set email = excluded.email
+         returning *`, [email, JSON.stringify(body.data ?? {})]);
+      const linkedUser = result.rows[0];
+      await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+         values ($1::uuid, 'email', $1::text, $2::jsonb)
+         on conflict (provider, provider_id) do nothing`, [linkedUser.id, JSON.stringify({ sub: linkedUser.id, email })]);
+      await query(`delete from auth.one_time_tokens
+         where email = $1 and token_type = any($2::text[])`, [email, "{otp,magiclink}"]);
+      await query(`insert into auth.one_time_tokens (user_id, email, token_type, token, expires_at)
+         values ($1, $2, 'otp', $3, now() + $5::interval),
+                ($1, $2, 'magiclink', $4, now() + $5::interval)`, [linkedUser.id, email, emailOtp, hashedToken, expiry]);
+      return linkedUser;
+    });
+    const actionUrl = new URL(`${this.config.apiUrl}/auth/v1/verify`);
+    actionUrl.searchParams.set("token", hashedToken);
+    actionUrl.searchParams.set("type", "magiclink");
+    actionUrl.searchParams.set("redirect_to", redirectTo);
+    await this.audit("user_magiclink_requested", { actorId: user.id, actorEmail: email, type: "admin" });
+    return json(200, {
+      ...this.userJson(user, [], await this.getUserIdentities(user.id)),
+      action_link: actionUrl.toString(),
+      email_otp: emailOtp,
+      hashed_token: hashedToken,
+      redirect_to: redirectTo,
+      verification_type: "magiclink"
+    });
+  }
   async audit(action, opts = {}) {
     try {
       const payload = {
@@ -4153,7 +4229,7 @@ class Database {
       }
     }
     if (seedSql) {
-      const hash = await sha256Hex(seedSql);
+      const hash = await sha256Hex2(seedSql);
       const seen = await this.engine.query(`select 1 from supabase_migrations.seed_files where path = 'supabase/seed.sql' and hash = $1`, [hash]);
       if (seen.rows.length === 0) {
         await this.engine.transaction(async (tx) => {
@@ -4446,7 +4522,7 @@ function quoteIdent(name) {
 function quoteLiteral(value) {
   return `'${value.replaceAll("'", "''")}'`;
 }
-async function sha256Hex(text) {
+async function sha256Hex2(text) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
   return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
 }

package/dist/runtime/auth/handler.d.ts

@@ -119,10 +119,16 @@ export declare class AuthHandler {
     /** Max wrong guesses for a one-time code before its tokens are invalidated. */
     private static readonly MAX_OTP_ATTEMPTS;
     private redeem;
+    private claimEmailToken;
+    private lockAndDeleteEmailToken;
+    private confirmEmailTokenUser;
+    private findEmailTokenCandidate;
+    private recordFailedEmailTokenAttempt;
     private verifyToken;
     private redeemPhoneOtp;
     private verifyLink;
     private admin;
+    private generateAdminMagicLink;
     /**
      * Append a security event to auth.audit_log_entries (GoTrue-compatible
      * payload). Best-effort: a logging failure never breaks the request.

package/dist/runtime/auth/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAc,SAAS,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGnE,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAG7C,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,KAAK,CAAA;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CACjC;AAED,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACjD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAClD,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAClC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CACjC;AA+GD,wEAAwE;AACxE,qBAAa,WAAW;IAYpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,OAAO,CAAC,KAAK,CAAc;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,wBAAwB,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAQ;IAExB,YACU,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU,EAa3B;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,QAAQ;IAUhB,4EAA4E;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1B;YAEa,oCAAoC;IAgBlD,8FAA8F;IACxF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuD3E;YAIa,MAAM;YAiEN,KAAK;YAwCL,OAAO;YAMP,UAAU;YAgEV,MAAM;YAwBN,UAAU;YA4CV,OAAO;YAqBP,eAAe;YAqDf,eAAe;YAmCf,SAAS;YAwBT,kBAAkB;IAShC,OAAO,CAAC,mBAAmB;YASb,eAAe;YAgBf,YAAY;YAaZ,qBAAqB;YAgBrB,qBAAqB;IAUnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,kBAAkB;YAQZ,YAAY;IAM1B,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAI;YAE9B,MAAM;YAqCN,WAAW;YA+BX,cAAc;YAyDd,UAAU;YAuBV,KAAK;IA2FnB;;;OAGG;YACW,KAAK;IAqBnB;;;;;OAKG;YACW,UAAU;IA2CxB;;;;;;;;;OASG;YACW,SAAS;YAqBT,YAAY;YAyDZ,eAAe;YAqBf,YAAY;YAyCZ,cAAc;YAWd,cAAc;IAmB5B,oFAAoF;YACtE,iBAAiB;YAuBjB,kBAAkB;YAqBlB,iBAAiB;YAUjB,uBAAuB;IASrC,OAAO,CAAC,kBAAkB;YAoBZ,cAAc;YAOd,gBAAgB;IAM9B,wEAAwE;IACxE,QAAQ,CACN,CAAC,EAAE,OAAO,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,EACvC,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmBzB;IAED,+EAA+E;YACjE,gBAAgB;YAUhB,UAAU;CAqDzB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAc,SAAS,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGnE,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAG7C,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,KAAK,CAAA;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CACjC;AAED,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACjD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAClD,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAClC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CACjC;AAgID,wEAAwE;AACxE,qBAAa,WAAW;IAYpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,OAAO,CAAC,KAAK,CAAc;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,wBAAwB,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAQ;IAExB,YACU,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU,EAa3B;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,QAAQ;IAUhB,4EAA4E;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1B;YAEa,oCAAoC;IAgBlD,8FAA8F;IACxF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuD3E;YAIa,MAAM;YAiEN,KAAK;YAwCL,OAAO;YAMP,UAAU;YAgEV,MAAM;YAwBN,UAAU;YA4CV,OAAO;YAqBP,eAAe;YAqDf,eAAe;YAmCf,SAAS;YAwBT,kBAAkB;IAShC,OAAO,CAAC,mBAAmB;YASb,eAAe;YAgBf,YAAY;YAaZ,qBAAqB;YAgBrB,qBAAqB;IAUnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,kBAAkB;YAQZ,YAAY;IAM1B,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAI;YAE9B,MAAM;YASN,eAAe;YAWf,uBAAuB;YAkBvB,qBAAqB;YAUrB,uBAAuB;YAcvB,6BAA6B;YAa7B,WAAW;YAsCX,cAAc;YAyDd,UAAU;YAuBV,KAAK;YA6FL,sBAAsB;IAuEpC;;;OAGG;YACW,KAAK;IAqBnB;;;;;OAKG;YACW,UAAU;IA2CxB;;;;;;;;;OASG;YACW,SAAS;YAqBT,YAAY;YAyDZ,eAAe;YAqBf,YAAY;YAyCZ,cAAc;YAWd,cAAc;IAmB5B,oFAAoF;YACtE,iBAAiB;YAuBjB,kBAAkB;YAqBlB,iBAAiB;YAUjB,uBAAuB;IASrC,OAAO,CAAC,kBAAkB;YAoBZ,cAAc;YAOd,gBAAgB;IAM9B,wEAAwE;IACxE,QAAQ,CACN,CAAC,EAAE,OAAO,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,EACvC,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmBzB;IAED,+EAA+E;YACjE,gBAAgB;YAUhB,UAAU;CAqDzB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/lite",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Bun-native, single-project Supabase-compatible backend powered by PGlite",
   "type": "module",
   "license": "Apache-2.0",