@supacloud/lite 0.6.0 → 0.7.1

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.7.1](https://github.com/zuohuadong/supacloud/compare/supacloud-lite-v0.7.0...supacloud-lite-v0.7.1) (2026-08-11)
+
+
+### Bug Fixes
+
+* **lite:** bound standalone subprocess collection ([#827](https://github.com/zuohuadong/supacloud/issues/827)) ([4c37c33](https://github.com/zuohuadong/supacloud/commit/4c37c3325391de11ff6224b0297eb211a3627f5a))
+* **lite:** guard db reset on uninitialized state ([#826](https://github.com/zuohuadong/supacloud/issues/826)) ([1e45f5f](https://github.com/zuohuadong/supacloud/commit/1e45f5fdd0cda0dbe238043526eb8d5ab8ebf1e1))
+* **lite:** keep project API keys stable ([#817](https://github.com/zuohuadong/supacloud/issues/817)) ([80c5818](https://github.com/zuohuadong/supacloud/commit/80c581846a91654268af2b745f9a7d3d01ab8d5e))
+
+## [0.7.0](https://github.com/zuohuadong/supacloud/compare/supacloud-lite-v0.6.0...supacloud-lite-v0.7.0) (2026-08-11)
+
+
+### Features
+
+* **lite:** support admin magic link verification ([#788](https://github.com/zuohuadong/supacloud/issues/788)) ([97defa0](https://github.com/zuohuadong/supacloud/commit/97defa0e3ba875d1bd0363f9f64df02a089238ff))
+
 ## [0.6.0](https://github.com/zuohuadong/supacloud/compare/supacloud-lite-v0.5.10...supacloud-lite-v0.6.0) (2026-08-11)
 
 

package/README.md

@@ -109,6 +109,8 @@ supacloud-lite inspect
 supacloud-lite version
 ```
 
+首次初始化或 state 目录不存在/为空时，先运行 `supacloud-lite migrate`。`db reset` 只接受已经初始化且保留有效 `secrets.json` 标记的 state；它不会为 reset 创建或覆盖项目 secrets。
+
 通用参数：
 
 - `--project-dir`：包含 `supabase/` 的项目目录
@@ -257,7 +259,7 @@ RLS 表的 Realtime DELETE 无法在行删除后安全重放 SELECT policy，因
 应用代码、SQL migrations、RLS policy、Storage 调用和 Realtime 订阅可以保持原来的 Supabase 形状。迁移时仍需验证以下边界：
 
 1. 把现有 `supabase/migrations`、`config.toml`、Functions 和 seed 文件带到 Lite 项目。
-2. 用 `supacloud-lite db reset` 在空库重放 schema，再导入业务数据。
+2. 先用 `supacloud-lite migrate` 初始化空 state 并重放 schema；只有在已初始化的可丢弃 state 上需要再次重放时才使用 `supacloud-lite db reset`，然后导入业务数据。
 3. 对使用 PGlite 未提供扩展或 PostgREST 高级语法的 SQL/API 做替代处理。
 4. 通过真实 `@supabase/supabase-js` 集成测试验证关键查询、RLS、Storage 和 Realtime。
 
@@ -441,6 +443,8 @@ supacloud-lite inspect
 supacloud-lite version
 ```
 
+Run `supacloud-lite migrate` first when initializing a project or when the state directory is missing or empty. `db reset` only accepts initialized state with a valid `secrets.json` marker; it never creates or replaces project secrets for a reset.
+
 Common flags:
 
 - `--project-dir`: the project directory containing `supabase/`
@@ -589,7 +593,7 @@ Realtime DELETE on RLS tables cannot safely replay SELECT policies after a row i
 Application code, SQL migrations, RLS policies, Storage calls, and Realtime subscriptions can keep their original Supabase shape. When migrating, you still need to validate the following boundaries:
 
 1. Bring the existing `supabase/migrations`, `config.toml`, Functions, and seed files into the Lite project.
-2. Use `supacloud-lite db reset` to replay the schema on an empty database, then import business data.
+2. Use `supacloud-lite migrate` to initialize empty state and replay the schema. Use `supacloud-lite db reset` only when replaying an already initialized disposable state, then import business data.
 3. Provide alternatives for SQL/API that use extensions not offered by PGlite or advanced PostgREST syntax.
 4. Verify key queries, RLS, Storage, and Realtime through real `@supabase/supabase-js` integration tests.
 

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname5, join as join9, resolve as resolve4 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.6.0",
+  version: "0.7.1",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite",
   type: "module",
   license: "Apache-2.0",
@@ -83,6 +83,8 @@ var package_default = {
 // src/runtime/jwt.ts
 var encoder = new TextEncoder;
 var decoder = new TextDecoder;
+var PROJECT_API_KEY_ISSUED_AT = 1641769200;
+var PROJECT_API_KEY_EXPIRES_AT = 4102444800;
 function bytesToBase64Url(bytes) {
   let binary = "";
   const chunk = 32768;
@@ -111,6 +113,18 @@ async function signJwt(claims, secret) {
   const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
   return `${data}.${bytesToBase64Url(new Uint8Array(sig))}`;
 }
+async function mintProjectApiKeys(jwtSecret) {
+  const commonClaims = {
+    iss: "supabase",
+    ref: "local",
+    iat: PROJECT_API_KEY_ISSUED_AT,
+    exp: PROJECT_API_KEY_EXPIRES_AT
+  };
+  return {
+    anonKey: await signJwt({ ...commonClaims, role: "anon" }, jwtSecret),
+    serviceRoleKey: await signJwt({ ...commonClaims, role: "service_role" }, jwtSecret)
+  };
+}
 async function verifyJwt(token, secret) {
   const parts = token.split(".");
   if (parts.length !== 3)
@@ -1112,6 +1126,10 @@ function randomOtp(length) {
   }
   return code;
 }
+async function sha256Hex(value) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
 function normalizePhone(value) {
   if (typeof value !== "string")
     return null;
@@ -1650,33 +1668,58 @@ Or sign in with this link: ${link}`
   }
   static MAX_OTP_ATTEMPTS = 5;
   async redeem(token, types, email) {
-    const normalizedEmail = email?.toLowerCase().trim() ?? null;
-    const res = await this.db.query(`delete from auth.one_time_tokens
-       where token = $1 and token_type = any($2::text[])
-         and ($3::text is null or email = $3) and expires_at > now()
-         and attempts < $4
-       returning user_id, email`, [token, `{${types.join(",")}}`, normalizedEmail, AuthHandler.MAX_OTP_ATTEMPTS]);
-    const row = res.rows[0];
-    if (!row) {
-      if (normalizedEmail) {
-        await this.db.query(`update auth.one_time_tokens set attempts = attempts + 1
-           where email = $1 and token_type = any($2::text[]) and expires_at > now()`, [normalizedEmail, `{${types.join(",")}}`]);
-        await this.db.query(`delete from auth.one_time_tokens where email = $1 and attempts >= $2`, [normalizedEmail, AuthHandler.MAX_OTP_ATTEMPTS]);
-      }
+    const redemption = {
+      token,
+      tokenTypes: `{${types.join(",")}}`,
+      email: email?.toLowerCase().trim() ?? null
+    };
+    return this.db.transaction((query) => this.claimEmailToken(query, redemption));
+  }
+  async claimEmailToken(query, redemption) {
+    const candidate = await this.findEmailTokenCandidate(query, redemption);
+    if (!candidate) {
+      await this.recordFailedEmailTokenAttempt(query, redemption);
       return null;
     }
-    await this.db.query(`delete from auth.one_time_tokens where email = $1`, [row.email]);
-    const ures = await this.db.query(`update auth.users set email_confirmed_at = coalesce(email_confirmed_at, now()), last_sign_in_at = now()
-       where id = $1 returning *`, [row.user_id]);
-    return ures.rows[0] ?? null;
+    const claimedToken = await this.lockAndDeleteEmailToken(query, candidate, redemption);
+    return claimedToken ? this.confirmEmailTokenUser(query, claimedToken) : null;
+  }
+  async lockAndDeleteEmailToken(query, candidate, redemption) {
+    await query(`select id from auth.users where id = $1 for update`, [candidate.user_id]);
+    const claimedTokens = await query(`delete from auth.one_time_tokens
+       where id = $1 and token = $2 and token_type = any($3::text[])
+         and expires_at > now() and attempts < $4
+       returning id, user_id, email`, [candidate.id, redemption.token, redemption.tokenTypes, AuthHandler.MAX_OTP_ATTEMPTS]);
+    return claimedTokens.rows[0] ?? null;
+  }
+  async confirmEmailTokenUser(query, claimedToken) {
+    await query(`delete from auth.one_time_tokens where email = $1`, [claimedToken.email]);
+    const users = await query(`update auth.users set email_confirmed_at = coalesce(email_confirmed_at, now()), last_sign_in_at = now()
+       where id = $1 returning *`, [claimedToken.user_id]);
+    return users.rows[0] ?? null;
+  }
+  async findEmailTokenCandidate(query, redemption) {
+    const candidates = await query(`select id, user_id, email from auth.one_time_tokens
+       where token = $1 and token_type = any($2::text[])
+         and ($3::text is null or email = $3) and expires_at > now()
+         and attempts < $4`, [redemption.token, redemption.tokenTypes, redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
+    return candidates.rows[0] ?? null;
+  }
+  async recordFailedEmailTokenAttempt(query, redemption) {
+    if (!redemption.email)
+      return;
+    await query(`update auth.one_time_tokens set attempts = attempts + 1
+       where email = $1 and token_type = any($2::text[]) and expires_at > now()`, [redemption.email, redemption.tokenTypes]);
+    await query(`delete from auth.one_time_tokens where email = $1 and attempts >= $2`, [redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
   }
   async verifyToken(req) {
     const body = await req.json().catch(() => ({}));
-    if (!body.token)
-      return authError(400, "validation_failed", "token is required");
+    const token = body.token ?? body.token_hash;
+    if (!token)
+      return authError(400, "validation_failed", "token or token_hash is required");
     if (body.type === "sms" || body.phone !== undefined) {
       const phone = normalizePhone(body.phone);
-      if (body.type !== "sms" || !phone || !/^\d{6,10}$/.test(body.token)) {
+      if (body.type !== "sms" || !phone || !body.token || !/^\d{6,10}$/.test(body.token)) {
         return authError(400, "validation_failed", "phone, token, and type=sms are required");
       }
       const fingerprint = await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-fingerprint:v1", phone);
@@ -1695,7 +1738,7 @@ Or sign in with this link: ${link}`
       return json(200, session);
     }
     const types = body.type === "recovery" ? ["recovery"] : body.type === "magiclink" ? ["magiclink"] : ["otp", "magiclink"];
-    const user = await this.redeem(body.token, types, body.email);
+    const user = await this.redeem(token, types, body.email);
     if (!user)
       return authError(403, "otp_expired", "Token has expired or is invalid");
     return json(200, await this.sessionFor(user));
@@ -1753,6 +1796,9 @@ Or sign in with this link: ${link}`
     }
     const idMatch = path.match(/^admin\/users\/([0-9a-f-]{36})$/);
     const exportMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/export$/);
+    if (path === "admin/generate_link" && method === "POST") {
+      return await this.generateAdminMagicLink(req);
+    }
     if (path === "admin/audit" && method === "GET") {
       const res = await this.db.query(`select id, payload, created_at, ip_address from auth.audit_log_entries
          order by created_at desc limit 200`);
@@ -1823,6 +1869,50 @@ Or sign in with this link: ${link}`
     }
     return authError(404, "not_found", `unknown admin endpoint`);
   }
+  async generateAdminMagicLink(req) {
+    const body = await req.json().catch(() => ({}));
+    if (body.type !== "magiclink") {
+      return authError(422, "unsupported_link_type", "Only magiclink generation is supported");
+    }
+    if (!body.email)
+      return authError(400, "validation_failed", "email is required");
+    const email = body.email.toLowerCase().trim();
+    const emailOtp = randomOtp(this.settings.otpLength);
+    const hashedToken = await sha256Hex(randomToken(32));
+    const expiry = `${this.settings.otpExpirySeconds} seconds`;
+    const requestUrl = new URL(req.url);
+    const redirectTo = resolveRedirect(requestUrl.searchParams.get("redirect_to") ?? body.redirect_to, this.config.siteUrl, this.config.uriAllowList, this.config.enforceRedirectAllowList);
+    const user = await this.db.transaction(async (query) => {
+      const result = await query(`insert into auth.users
+           (aud, role, email, raw_app_meta_data, raw_user_meta_data)
+         values ('authenticated', 'authenticated', $1, '{"provider":"email","providers":["email"]}', $2::jsonb)
+         on conflict (email) do update set email = excluded.email
+         returning *`, [email, JSON.stringify(body.data ?? {})]);
+      const linkedUser = result.rows[0];
+      await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+         values ($1::uuid, 'email', $1::text, $2::jsonb)
+         on conflict (provider, provider_id) do nothing`, [linkedUser.id, JSON.stringify({ sub: linkedUser.id, email })]);
+      await query(`delete from auth.one_time_tokens
+         where email = $1 and token_type = any($2::text[])`, [email, "{otp,magiclink}"]);
+      await query(`insert into auth.one_time_tokens (user_id, email, token_type, token, expires_at)
+         values ($1, $2, 'otp', $3, now() + $5::interval),
+                ($1, $2, 'magiclink', $4, now() + $5::interval)`, [linkedUser.id, email, emailOtp, hashedToken, expiry]);
+      return linkedUser;
+    });
+    const actionUrl = new URL(`${this.config.apiUrl}/auth/v1/verify`);
+    actionUrl.searchParams.set("token", hashedToken);
+    actionUrl.searchParams.set("type", "magiclink");
+    actionUrl.searchParams.set("redirect_to", redirectTo);
+    await this.audit("user_magiclink_requested", { actorId: user.id, actorEmail: email, type: "admin" });
+    return json(200, {
+      ...this.userJson(user, [], await this.getUserIdentities(user.id)),
+      action_link: actionUrl.toString(),
+      email_otp: emailOtp,
+      hashed_token: hashedToken,
+      redirect_to: redirectTo,
+      verification_type: "magiclink"
+    });
+  }
   async audit(action, opts = {}) {
     try {
       const payload = {
@@ -4148,7 +4238,7 @@ class Database {
       }
     }
     if (seedSql) {
-      const hash = await sha256Hex(seedSql);
+      const hash = await sha256Hex2(seedSql);
       const seen = await this.engine.query(`select 1 from supabase_migrations.seed_files where path = 'supabase/seed.sql' and hash = $1`, [hash]);
       if (seen.rows.length === 0) {
         await this.engine.transaction(async (tx) => {
@@ -4441,7 +4531,7 @@ function quoteIdent(name) {
 function quoteLiteral(value) {
   return `'${value.replaceAll("'", "''")}'`;
 }
-async function sha256Hex(text) {
+async function sha256Hex2(text) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
   return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
@@ -8514,10 +8604,7 @@ async function createBackend(config = {}) {
     await failStartup(e);
   }
   const pgredis = await PgredisCache.create(db).catch(failStartup);
-  const now = Math.floor(Date.now() / 1000);
-  const tenYears = 10 * 365 * 24 * 3600;
-  const anonKey = await signJwt({ iss: "supabase", ref: "local", role: "anon", iat: now, exp: now + tenYears }, jwtSecret);
-  const serviceRoleKey = await signJwt({ iss: "supabase", ref: "local", role: "service_role", iat: now, exp: now + tenYears }, jwtSecret);
+  const { anonKey, serviceRoleKey } = await mintProjectApiKeys(jwtSecret);
   const exposedSchemas = [...new Set(config.dbSchemas ?? ["public", "pgmq_public"])];
   const rest = new RestHandler(db, { exposedSchemas, maxRows: config.maxRows });
   const exposed = isNetworkExposed(config.host);
@@ -9625,6 +9712,8 @@ class S3StorageDriver {
 }
 
 // src/project-runtime.ts
+var RESET_INITIALIZATION_ERROR = 'db reset requires initialized state; run "supacloud-lite migrate" first';
+var RESET_INVALID_SECRETS_ERROR = "db reset requires a valid project secrets marker; restore the state before retrying";
 function resolveProjectPaths(options = {}) {
   const projectDir = resolve2(options.projectDir ?? process.cwd());
   const stateDir = resolvePath(projectDir, options.stateDir ?? process.env.SUPACLOUD_LITE_STATE_DIR ?? ".supacloud-lite");
@@ -9642,7 +9731,7 @@ async function assertResetPathsSafe(paths) {
   const stateDir = resolve2(paths.stateDir);
   if (stateDir === parse(stateDir).root)
     throw new Error("refusing to use the filesystem root as the state directory");
-  const stateInfo = await lstat(stateDir);
+  const stateInfo = await requiredResetEntry(stateDir);
   if (!stateInfo.isDirectory() || stateInfo.isSymbolicLink()) {
     throw new Error(`refusing to reset through an invalid state directory: ${stateDir}`);
   }
@@ -9651,10 +9740,11 @@ async function assertResetPathsSafe(paths) {
   if (secretsFile !== join7(stateDir, "secrets.json")) {
     throw new Error(`refusing to reset a state directory with an invalid secrets marker path: ${secretsFile}`);
   }
-  const markerInfo = await lstat(secretsFile);
+  const markerInfo = await requiredResetEntry(secretsFile);
   if (!markerInfo.isFile() || markerInfo.isSymbolicLink()) {
-    throw new Error(`refusing to reset a state directory without a valid secrets marker: ${stateDir}`);
+    throw new Error(RESET_INVALID_SECRETS_ERROR);
   }
+  await assertResetSecretsValid(secretsFile);
   const targets = [
     ...paths.dataDir ? [["database", paths.dataDir]] : [],
     ["storage", paths.storageDir]
@@ -9668,6 +9758,30 @@ async function assertResetPathsSafe(paths) {
     await assertResetTargetCanonical(stateDir, canonicalStateDir, target, label);
   }
 }
+async function requiredResetEntry(path) {
+  try {
+    return await lstat(path);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      throw new Error(RESET_INITIALIZATION_ERROR);
+    throw error;
+  }
+}
+async function assertResetSecretsValid(path) {
+  let serializedSecrets;
+  try {
+    serializedSecrets = await readFile6(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      throw new Error(RESET_INITIALIZATION_ERROR);
+    throw error;
+  }
+  try {
+    validateSecrets(JSON.parse(serializedSecrets));
+  } catch {
+    throw new Error(RESET_INVALID_SECRETS_ERROR);
+  }
+}
 async function assertResetTargetCanonical(stateDir, canonicalStateDir, target, label) {
   let current = target;
   while (current !== stateDir) {
@@ -9750,13 +9864,7 @@ async function ensureProjectSecrets(paths) {
   });
 }
 async function mintProjectKeys(jwtSecret) {
-  const now = Math.floor(Date.now() / 1000);
-  const exp = now + 10 * 365 * 24 * 3600;
-  const common = { iss: "supabase", ref: "local", iat: now, exp };
-  return {
-    anonKey: await signJwt({ ...common, role: "anon" }, jwtSecret),
-    serviceRoleKey: await signJwt({ ...common, role: "service_role" }, jwtSecret)
-  };
+  return await mintProjectApiKeys(jwtSecret);
 }
 async function createProjectBackend(options = {}) {
   const paths = resolveProjectPaths(options);
@@ -9928,7 +10036,7 @@ async function findEphemeralPort(host = "127.0.0.1") {
 }
 
 // src/snapshot.ts
-import { chmod as chmod2, copyFile, link as link2, lstat as lstat2, mkdir as mkdir6, mkdtemp, readdir as readdir3, readFile as readFile7, rename as rename2, rm as rm3, writeFile as writeFile5 } from "fs/promises";
+import { chmod as chmod2, copyFile, lstat as lstat2, mkdir as mkdir6, mkdtemp, readdir as readdir3, readFile as readFile7, rename as rename2, rm as rm3, writeFile as writeFile5 } from "fs/promises";
 import { dirname as dirname4, join as join8, parse as parse2, relative as relative2, resolve as resolve3, sep as sep2 } from "path";
 import { create as createTar, extract as extractTar } from "tar";
 var SNAPSHOT_FORMAT = "supacloud-lite-snapshot";
@@ -10153,14 +10261,7 @@ async function stageDirectory(root, destination) {
 }
 async function stageFile(source, target) {
   await mkdir6(dirname4(target), { recursive: true });
-  try {
-    await link2(source, target);
-  } catch (error) {
-    const code = error.code;
-    if (code !== "EXDEV" && code !== "EPERM" && code !== "EACCES")
-      throw error;
-    await copyFile(source, target);
-  }
+  await copyFile(source, target);
 }
 async function readManifest(payloadRoot) {
   let parsed;
@@ -10677,7 +10778,7 @@ Commands:
   keys                  print the anon key
   keys --service-role   also print the privileged service_role key
   gen types             emit Supabase-shaped TypeScript database types
-  db reset              wipe database and storage, then re-run migrations
+  db reset              reset initialized database/storage and re-run migrations
   db diff               print schema changes outside migrations
   db pull [name]        write live schema changes as an applied migration
   snapshot create       create a compressed database/storage/secrets snapshot
@@ -10686,6 +10787,8 @@ Commands:
   inspect               show table rows and sizes
   version               print the package version
 
+Fresh projects must run "supacloud-lite migrate" before "db reset".
+
 Options:
   -p, --port <n>          port (default 54321)
       --host <host>       bind host (default 127.0.0.1)

package/dist/index.js

@@ -4,6 +4,8 @@ var __require = import.meta.require;
 // src/runtime/jwt.ts
 var encoder = new TextEncoder;
 var decoder = new TextDecoder;
+var PROJECT_API_KEY_ISSUED_AT = 1641769200;
+var PROJECT_API_KEY_EXPIRES_AT = 4102444800;
 function bytesToBase64Url(bytes) {
   let binary = "";
   const chunk = 32768;
@@ -32,6 +34,18 @@ async function signJwt(claims, secret) {
   const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
   return `${data}.${bytesToBase64Url(new Uint8Array(sig))}`;
 }
+async function mintProjectApiKeys(jwtSecret) {
+  const commonClaims = {
+    iss: "supabase",
+    ref: "local",
+    iat: PROJECT_API_KEY_ISSUED_AT,
+    exp: PROJECT_API_KEY_EXPIRES_AT
+  };
+  return {
+    anonKey: await signJwt({ ...commonClaims, role: "anon" }, jwtSecret),
+    serviceRoleKey: await signJwt({ ...commonClaims, role: "service_role" }, jwtSecret)
+  };
+}
 async function verifyJwt(token, secret) {
   const parts = token.split(".");
   if (parts.length !== 3)
@@ -71,7 +85,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.6.0",
+  version: "0.7.1",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite",
   type: "module",
   license: "Apache-2.0",
@@ -1117,6 +1131,10 @@ function randomOtp(length) {
   }
   return code;
 }
+async function sha256Hex(value) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
 function normalizePhone(value) {
   if (typeof value !== "string")
     return null;
@@ -1655,33 +1673,58 @@ Or sign in with this link: ${link}`
   }
   static MAX_OTP_ATTEMPTS = 5;
   async redeem(token, types, email) {
-    const normalizedEmail = email?.toLowerCase().trim() ?? null;
-    const res = await this.db.query(`delete from auth.one_time_tokens
-       where token = $1 and token_type = any($2::text[])
-         and ($3::text is null or email = $3) and expires_at > now()
-         and attempts < $4
-       returning user_id, email`, [token, `{${types.join(",")}}`, normalizedEmail, AuthHandler.MAX_OTP_ATTEMPTS]);
-    const row = res.rows[0];
-    if (!row) {
-      if (normalizedEmail) {
-        await this.db.query(`update auth.one_time_tokens set attempts = attempts + 1
-           where email = $1 and token_type = any($2::text[]) and expires_at > now()`, [normalizedEmail, `{${types.join(",")}}`]);
-        await this.db.query(`delete from auth.one_time_tokens where email = $1 and attempts >= $2`, [normalizedEmail, AuthHandler.MAX_OTP_ATTEMPTS]);
-      }
+    const redemption = {
+      token,
+      tokenTypes: `{${types.join(",")}}`,
+      email: email?.toLowerCase().trim() ?? null
+    };
+    return this.db.transaction((query) => this.claimEmailToken(query, redemption));
+  }
+  async claimEmailToken(query, redemption) {
+    const candidate = await this.findEmailTokenCandidate(query, redemption);
+    if (!candidate) {
+      await this.recordFailedEmailTokenAttempt(query, redemption);
       return null;
     }
-    await this.db.query(`delete from auth.one_time_tokens where email = $1`, [row.email]);
-    const ures = await this.db.query(`update auth.users set email_confirmed_at = coalesce(email_confirmed_at, now()), last_sign_in_at = now()
-       where id = $1 returning *`, [row.user_id]);
-    return ures.rows[0] ?? null;
+    const claimedToken = await this.lockAndDeleteEmailToken(query, candidate, redemption);
+    return claimedToken ? this.confirmEmailTokenUser(query, claimedToken) : null;
+  }
+  async lockAndDeleteEmailToken(query, candidate, redemption) {
+    await query(`select id from auth.users where id = $1 for update`, [candidate.user_id]);
+    const claimedTokens = await query(`delete from auth.one_time_tokens
+       where id = $1 and token = $2 and token_type = any($3::text[])
+         and expires_at > now() and attempts < $4
+       returning id, user_id, email`, [candidate.id, redemption.token, redemption.tokenTypes, AuthHandler.MAX_OTP_ATTEMPTS]);
+    return claimedTokens.rows[0] ?? null;
+  }
+  async confirmEmailTokenUser(query, claimedToken) {
+    await query(`delete from auth.one_time_tokens where email = $1`, [claimedToken.email]);
+    const users = await query(`update auth.users set email_confirmed_at = coalesce(email_confirmed_at, now()), last_sign_in_at = now()
+       where id = $1 returning *`, [claimedToken.user_id]);
+    return users.rows[0] ?? null;
+  }
+  async findEmailTokenCandidate(query, redemption) {
+    const candidates = await query(`select id, user_id, email from auth.one_time_tokens
+       where token = $1 and token_type = any($2::text[])
+         and ($3::text is null or email = $3) and expires_at > now()
+         and attempts < $4`, [redemption.token, redemption.tokenTypes, redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
+    return candidates.rows[0] ?? null;
+  }
+  async recordFailedEmailTokenAttempt(query, redemption) {
+    if (!redemption.email)
+      return;
+    await query(`update auth.one_time_tokens set attempts = attempts + 1
+       where email = $1 and token_type = any($2::text[]) and expires_at > now()`, [redemption.email, redemption.tokenTypes]);
+    await query(`delete from auth.one_time_tokens where email = $1 and attempts >= $2`, [redemption.email, AuthHandler.MAX_OTP_ATTEMPTS]);
   }
   async verifyToken(req) {
     const body = await req.json().catch(() => ({}));
-    if (!body.token)
-      return authError(400, "validation_failed", "token is required");
+    const token = body.token ?? body.token_hash;
+    if (!token)
+      return authError(400, "validation_failed", "token or token_hash is required");
     if (body.type === "sms" || body.phone !== undefined) {
       const phone = normalizePhone(body.phone);
-      if (body.type !== "sms" || !phone || !/^\d{6,10}$/.test(body.token)) {
+      if (body.type !== "sms" || !phone || !body.token || !/^\d{6,10}$/.test(body.token)) {
         return authError(400, "validation_failed", "phone, token, and type=sms are required");
       }
       const fingerprint = await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-fingerprint:v1", phone);
@@ -1700,7 +1743,7 @@ Or sign in with this link: ${link}`
       return json(200, session);
     }
     const types = body.type === "recovery" ? ["recovery"] : body.type === "magiclink" ? ["magiclink"] : ["otp", "magiclink"];
-    const user = await this.redeem(body.token, types, body.email);
+    const user = await this.redeem(token, types, body.email);
     if (!user)
       return authError(403, "otp_expired", "Token has expired or is invalid");
     return json(200, await this.sessionFor(user));
@@ -1758,6 +1801,9 @@ Or sign in with this link: ${link}`
     }
     const idMatch = path.match(/^admin\/users\/([0-9a-f-]{36})$/);
     const exportMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/export$/);
+    if (path === "admin/generate_link" && method === "POST") {
+      return await this.generateAdminMagicLink(req);
+    }
     if (path === "admin/audit" && method === "GET") {
       const res = await this.db.query(`select id, payload, created_at, ip_address from auth.audit_log_entries
          order by created_at desc limit 200`);
@@ -1828,6 +1874,50 @@ Or sign in with this link: ${link}`
     }
     return authError(404, "not_found", `unknown admin endpoint`);
   }
+  async generateAdminMagicLink(req) {
+    const body = await req.json().catch(() => ({}));
+    if (body.type !== "magiclink") {
+      return authError(422, "unsupported_link_type", "Only magiclink generation is supported");
+    }
+    if (!body.email)
+      return authError(400, "validation_failed", "email is required");
+    const email = body.email.toLowerCase().trim();
+    const emailOtp = randomOtp(this.settings.otpLength);
+    const hashedToken = await sha256Hex(randomToken(32));
+    const expiry = `${this.settings.otpExpirySeconds} seconds`;
+    const requestUrl = new URL(req.url);
+    const redirectTo = resolveRedirect(requestUrl.searchParams.get("redirect_to") ?? body.redirect_to, this.config.siteUrl, this.config.uriAllowList, this.config.enforceRedirectAllowList);
+    const user = await this.db.transaction(async (query) => {
+      const result = await query(`insert into auth.users
+           (aud, role, email, raw_app_meta_data, raw_user_meta_data)
+         values ('authenticated', 'authenticated', $1, '{"provider":"email","providers":["email"]}', $2::jsonb)
+         on conflict (email) do update set email = excluded.email
+         returning *`, [email, JSON.stringify(body.data ?? {})]);
+      const linkedUser = result.rows[0];
+      await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+         values ($1::uuid, 'email', $1::text, $2::jsonb)
+         on conflict (provider, provider_id) do nothing`, [linkedUser.id, JSON.stringify({ sub: linkedUser.id, email })]);
+      await query(`delete from auth.one_time_tokens
+         where email = $1 and token_type = any($2::text[])`, [email, "{otp,magiclink}"]);
+      await query(`insert into auth.one_time_tokens (user_id, email, token_type, token, expires_at)
+         values ($1, $2, 'otp', $3, now() + $5::interval),
+                ($1, $2, 'magiclink', $4, now() + $5::interval)`, [linkedUser.id, email, emailOtp, hashedToken, expiry]);
+      return linkedUser;
+    });
+    const actionUrl = new URL(`${this.config.apiUrl}/auth/v1/verify`);
+    actionUrl.searchParams.set("token", hashedToken);
+    actionUrl.searchParams.set("type", "magiclink");
+    actionUrl.searchParams.set("redirect_to", redirectTo);
+    await this.audit("user_magiclink_requested", { actorId: user.id, actorEmail: email, type: "admin" });
+    return json(200, {
+      ...this.userJson(user, [], await this.getUserIdentities(user.id)),
+      action_link: actionUrl.toString(),
+      email_otp: emailOtp,
+      hashed_token: hashedToken,
+      redirect_to: redirectTo,
+      verification_type: "magiclink"
+    });
+  }
   async audit(action, opts = {}) {
     try {
       const payload = {
@@ -4153,7 +4243,7 @@ class Database {
       }
     }
     if (seedSql) {
-      const hash = await sha256Hex(seedSql);
+      const hash = await sha256Hex2(seedSql);
       const seen = await this.engine.query(`select 1 from supabase_migrations.seed_files where path = 'supabase/seed.sql' and hash = $1`, [hash]);
       if (seen.rows.length === 0) {
         await this.engine.transaction(async (tx) => {
@@ -4446,7 +4536,7 @@ function quoteIdent(name) {
 function quoteLiteral(value) {
   return `'${value.replaceAll("'", "''")}'`;
 }
-async function sha256Hex(text) {
+async function sha256Hex2(text) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
   return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
@@ -8358,10 +8448,7 @@ async function createBackend(config = {}) {
     await failStartup(e);
   }
   const pgredis = await PgredisCache.create(db).catch(failStartup);
-  const now = Math.floor(Date.now() / 1000);
-  const tenYears = 10 * 365 * 24 * 3600;
-  const anonKey = await signJwt({ iss: "supabase", ref: "local", role: "anon", iat: now, exp: now + tenYears }, jwtSecret);
-  const serviceRoleKey = await signJwt({ iss: "supabase", ref: "local", role: "service_role", iat: now, exp: now + tenYears }, jwtSecret);
+  const { anonKey, serviceRoleKey } = await mintProjectApiKeys(jwtSecret);
   const exposedSchemas = [...new Set(config.dbSchemas ?? ["public", "pgmq_public"])];
   const rest = new RestHandler(db, { exposedSchemas, maxRows: config.maxRows });
   const exposed = isNetworkExposed(config.host);
@@ -9434,13 +9521,7 @@ async function ensureProjectSecrets(paths) {
   });
 }
 async function mintProjectKeys(jwtSecret) {
-  const now = Math.floor(Date.now() / 1000);
-  const exp = now + 10 * 365 * 24 * 3600;
-  const common = { iss: "supabase", ref: "local", iat: now, exp };
-  return {
-    anonKey: await signJwt({ ...common, role: "anon" }, jwtSecret),
-    serviceRoleKey: await signJwt({ ...common, role: "service_role" }, jwtSecret)
-  };
+  return await mintProjectApiKeys(jwtSecret);
 }
 async function createProjectBackend(options = {}) {
   const paths = resolveProjectPaths(options);
@@ -9611,7 +9692,7 @@ async function findEphemeralPort(host = "127.0.0.1") {
   return port;
 }
 // src/snapshot.ts
-import { chmod as chmod2, copyFile, link as link2, lstat as lstat2, mkdir as mkdir5, mkdtemp, readdir as readdir3, readFile as readFile7, rename as rename2, rm as rm3, writeFile as writeFile4 } from "fs/promises";
+import { chmod as chmod2, copyFile, lstat as lstat2, mkdir as mkdir5, mkdtemp, readdir as readdir3, readFile as readFile7, rename as rename2, rm as rm3, writeFile as writeFile4 } from "fs/promises";
 import { dirname as dirname4, join as join7, parse as parse2, relative as relative2, resolve as resolve3, sep as sep2 } from "path";
 import { create as createTar, extract as extractTar } from "tar";
 var SNAPSHOT_FORMAT = "supacloud-lite-snapshot";
@@ -9836,14 +9917,7 @@ async function stageDirectory(root, destination) {
 }
 async function stageFile(source, target) {
   await mkdir5(dirname4(target), { recursive: true });
-  try {
-    await link2(source, target);
-  } catch (error) {
-    const code = error.code;
-    if (code !== "EXDEV" && code !== "EPERM" && code !== "EACCES")
-      throw error;
-    await copyFile(source, target);
-  }
+  await copyFile(source, target);
 }
 async function readManifest(payloadRoot) {
   let parsed;

package/dist/project-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-runtime.d.ts","sourceRoot":"","sources":["../src/project-runtime.ts"],"names":[],"mappings":"AAEA,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAEtF,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAE3E,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAIrF,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AAC7F,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElE,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,EAAE,CAAC,EAAE,sBAAsB,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,oBAAoB,CAAA;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,YAAY,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,cAAc,CAAA;CAC/B;AAED,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAA;AAC9D,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;AAExE,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,qBAA0B,GAAG,YAAY,CAiBrF;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B7E;AA4CD,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAqCvF;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ7G;AAED,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,cAAc,CAAC,CAqEvG;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,CAIhG;AAiBD,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiC3G"}
+{"version":3,"file":"project-runtime.d.ts","sourceRoot":"","sources":["../src/project-runtime.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAG7E,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAE3E,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAIrF,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AAC7F,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAKlE,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,EAAE,CAAC,EAAE,sBAAsB,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,oBAAoB,CAAA;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,YAAY,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,cAAc,CAAA;CAC/B;AAED,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAA;AAC9D,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;AAExE,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,qBAA0B,GAAG,YAAY,CAiBrF;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B7E;AAqED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAqCvF;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAE7G;AAED,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,cAAc,CAAC,CAqEvG;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,CAIhG;AAiBD,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiC3G"}

package/dist/runtime/auth/handler.d.ts

@@ -119,10 +119,16 @@ export declare class AuthHandler {
     /** Max wrong guesses for a one-time code before its tokens are invalidated. */
     private static readonly MAX_OTP_ATTEMPTS;
     private redeem;
+    private claimEmailToken;
+    private lockAndDeleteEmailToken;
+    private confirmEmailTokenUser;
+    private findEmailTokenCandidate;
+    private recordFailedEmailTokenAttempt;
     private verifyToken;
     private redeemPhoneOtp;
     private verifyLink;
     private admin;
+    private generateAdminMagicLink;
     /**
      * Append a security event to auth.audit_log_entries (GoTrue-compatible
      * payload). Best-effort: a logging failure never breaks the request.

package/dist/runtime/auth/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAc,SAAS,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGnE,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAG7C,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,KAAK,CAAA;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CACjC;AAED,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACjD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAClD,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAClC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CACjC;AA+GD,wEAAwE;AACxE,qBAAa,WAAW;IAYpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,OAAO,CAAC,KAAK,CAAc;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,wBAAwB,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAQ;IAExB,YACU,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU,EAa3B;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,QAAQ;IAUhB,4EAA4E;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1B;YAEa,oCAAoC;IAgBlD,8FAA8F;IACxF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuD3E;YAIa,MAAM;YAiEN,KAAK;YAwCL,OAAO;YAMP,UAAU;YAgEV,MAAM;YAwBN,UAAU;YA4CV,OAAO;YAqBP,eAAe;YAqDf,eAAe;YAmCf,SAAS;YAwBT,kBAAkB;IAShC,OAAO,CAAC,mBAAmB;YASb,eAAe;YAgBf,YAAY;YAaZ,qBAAqB;YAgBrB,qBAAqB;IAUnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,kBAAkB;YAQZ,YAAY;IAM1B,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAI;YAE9B,MAAM;YAqCN,WAAW;YA+BX,cAAc;YAyDd,UAAU;YAuBV,KAAK;IA2FnB;;;OAGG;YACW,KAAK;IAqBnB;;;;;OAKG;YACW,UAAU;IA2CxB;;;;;;;;;OASG;YACW,SAAS;YAqBT,YAAY;YAyDZ,eAAe;YAqBf,YAAY;YAyCZ,cAAc;YAWd,cAAc;IAmB5B,oFAAoF;YACtE,iBAAiB;YAuBjB,kBAAkB;YAqBlB,iBAAiB;YAUjB,uBAAuB;IASrC,OAAO,CAAC,kBAAkB;YAoBZ,cAAc;YAOd,gBAAgB;IAM9B,wEAAwE;IACxE,QAAQ,CACN,CAAC,EAAE,OAAO,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,EACvC,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmBzB;IAED,+EAA+E;YACjE,gBAAgB;YAUhB,UAAU;CAqDzB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAc,SAAS,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGnE,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAG7C,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,KAAK,CAAA;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CACjC;AAED,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACjD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAClD,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAClC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CACjC;AAgID,wEAAwE;AACxE,qBAAa,WAAW;IAYpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,OAAO,CAAC,KAAK,CAAc;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,wBAAwB,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAQ;IAExB,YACU,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU,EAa3B;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,QAAQ;IAUhB,4EAA4E;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1B;YAEa,oCAAoC;IAgBlD,8FAA8F;IACxF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuD3E;YAIa,MAAM;YAiEN,KAAK;YAwCL,OAAO;YAMP,UAAU;YAgEV,MAAM;YAwBN,UAAU;YA4CV,OAAO;YAqBP,eAAe;YAqDf,eAAe;YAmCf,SAAS;YAwBT,kBAAkB;IAShC,OAAO,CAAC,mBAAmB;YASb,eAAe;YAgBf,YAAY;YAaZ,qBAAqB;YAgBrB,qBAAqB;IAUnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,kBAAkB;YAQZ,YAAY;IAM1B,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAI;YAE9B,MAAM;YASN,eAAe;YAWf,uBAAuB;YAkBvB,qBAAqB;YAUrB,uBAAuB;YAcvB,6BAA6B;YAa7B,WAAW;YAsCX,cAAc;YAyDd,UAAU;YAuBV,KAAK;YA6FL,sBAAsB;IAuEpC;;;OAGG;YACW,KAAK;IAqBnB;;;;;OAKG;YACW,UAAU;IA2CxB;;;;;;;;;OASG;YACW,SAAS;YAqBT,YAAY;YAyDZ,eAAe;YAqBf,YAAY;YAyCZ,cAAc;YAWd,cAAc;IAmB5B,oFAAoF;YACtE,iBAAiB;YAuBjB,kBAAkB;YAqBlB,iBAAiB;YAUjB,uBAAuB;IASrC,OAAO,CAAC,kBAAkB;YAoBZ,cAAc;YAOd,gBAAgB;IAM9B,wEAAwE;IACxE,QAAQ,CACN,CAAC,EAAE,OAAO,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,EACvC,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmBzB;IAED,+EAA+E;YACjE,gBAAgB;YAUhB,UAAU;CAqDzB"}

package/dist/runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAqB,MAAM,wBAAwB,CAAA;AAG5E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAIrD,OAAO,EAAE,eAAe,EAAwB,MAAM,uBAAuB,CAAA;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAU,aAAa,EAA6B,MAAM,YAAY,CAAA;AAGjG,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAE,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAClG,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACjG,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3D;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,oGAAoG;IACpG,KAAK,EAAE,OAAO,KAAK,CAAA;IACnB,mFAAmF;IACnF,EAAE,EAAE,QAAQ,CAAA;IACZ,6EAA6E;IAC7E,QAAQ,EAAE,cAAc,CAAA;IACxB,6EAA6E;IAC7E,SAAS,EAAE,gBAAgB,CAAA;IAC3B,qEAAqE;IACrE,QAAQ,EAAE,eAAe,CAAA;IACzB,mCAAmC;IACnC,IAAI,EAAE,WAAW,CAAA;IACjB,wDAAwD;IACxD,GAAG,EAAE,UAAU,CAAA;IACf,6EAA6E;IAC7E,SAAS,EAAE,gBAAgB,CAAA;IAC3B,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAA;IACf,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAA;IACtB,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,IAAI,EAAE,SAAS,CAAA;IACf,4FAA4F;IAC5F,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,gHAAgH;IAChH,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,8CAA8C;IAC9C,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7E,gGAAgG;IAChG,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAWD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CAAC,MAAM,GAAE,aAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoX7F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAqB,MAAM,wBAAwB,CAAA;AAG5E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAIrD,OAAO,EAAE,eAAe,EAAwB,MAAM,uBAAuB,CAAA;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAU,aAAa,EAA6B,MAAM,YAAY,CAAA;AAGjG,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAE,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAClG,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACjG,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3D;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,oGAAoG;IACpG,KAAK,EAAE,OAAO,KAAK,CAAA;IACnB,mFAAmF;IACnF,EAAE,EAAE,QAAQ,CAAA;IACZ,6EAA6E;IAC7E,QAAQ,EAAE,cAAc,CAAA;IACxB,6EAA6E;IAC7E,SAAS,EAAE,gBAAgB,CAAA;IAC3B,qEAAqE;IACrE,QAAQ,EAAE,eAAe,CAAA;IACzB,mCAAmC;IACnC,IAAI,EAAE,WAAW,CAAA;IACjB,wDAAwD;IACxD,GAAG,EAAE,UAAU,CAAA;IACf,6EAA6E;IAC7E,SAAS,EAAE,gBAAgB,CAAA;IAC3B,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAA;IACf,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAA;IACtB,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,IAAI,EAAE,SAAS,CAAA;IACf,4FAA4F;IAC5F,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,gHAAgH;IAChH,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,8CAA8C;IAC9C,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7E,gGAAgG;IAChG,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAWD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CAAC,MAAM,GAAE,aAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA8W7F"}

package/dist/runtime/jwt.d.ts

@@ -2,6 +2,10 @@
  * Minimal HS256 JWT implementation on WebCrypto.
  * Works in Node (>=18) and browsers - no dependencies.
  */
+export interface ProjectApiKeys {
+    anonKey: string;
+    serviceRoleKey: string;
+}
 /** Standard + Supabase/GoTrue claims carried in an access token. Open-ended: any extra claims are preserved. */
 export interface JwtClaims {
     [key: string]: unknown;
@@ -22,6 +26,8 @@ export interface JwtClaims {
 }
 /** Sign claims as an HS256 JWT. */
 export declare function signJwt(claims: JwtClaims, secret: string): Promise<string>;
+/** Keep project API keys canonical so CLI output and restarted runtimes remain byte-identical. */
+export declare function mintProjectApiKeys(jwtSecret: string): Promise<ProjectApiKeys>;
 /** Verifies signature and expiry. Returns claims, or null when invalid. */
 export declare function verifyJwt(token: string, secret: string): Promise<JwtClaims | null>;
 /** Decode without verification (for introspection/debugging only). */

package/dist/runtime/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/runtime/jwt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiCH,gHAAgH;AAChH,MAAM,WAAW,SAAS;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IACtB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,2FAA2F;IAC3F,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC9C;AAED,mCAAmC;AACnC,wBAAsB,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOhF;AAED,2EAA2E;AAC3E,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAuBxF;AAED,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAQzD;AAED,0GAA0G;AAC1G,wBAAgB,WAAW,CAAC,KAAK,SAAK,GAAG,MAAM,CAI9C"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/runtime/jwt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;CACvB;AA8BD,gHAAgH;AAChH,MAAM,WAAW,SAAS;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IACtB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,2FAA2F;IAC3F,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC9C;AAED,mCAAmC;AACnC,wBAAsB,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOhF;AAED,kGAAkG;AAClG,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAWnF;AAED,2EAA2E;AAC3E,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAuBxF;AAED,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAQzD;AAED,0GAA0G;AAC1G,wBAAgB,WAAW,CAAC,KAAK,SAAK,GAAG,MAAM,CAI9C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/lite",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Bun-native, single-project Supabase-compatible backend powered by PGlite",
   "type": "module",
   "license": "Apache-2.0",