@supacloud/lite 0.8.0 → 0.8.2

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.8.2](https://github.com/zuohuadong/supacloud/compare/supacloud-lite-v0.8.1...supacloud-lite-v0.8.2) (2026-08-15)
+
+
+### Bug Fixes
+
+* **lite:** support mirrored native postgres downloads ([#916](https://github.com/zuohuadong/supacloud/issues/916)) ([48224b7](https://github.com/zuohuadong/supacloud/commit/48224b7b067fcc56b3be8059301525cebeefb98d))
+
+## [0.8.1](https://github.com/zuohuadong/supacloud/compare/supacloud-lite-v0.8.0...supacloud-lite-v0.8.1) (2026-08-15)
+
+
+### Bug Fixes
+
+* **lite:** complete extended auth compatibility ([#912](https://github.com/zuohuadong/supacloud/issues/912)) ([dd657f5](https://github.com/zuohuadong/supacloud/commit/dd657f5b52f2f3d65c0178f76fd78d027c153c5a))
+
 ## [0.8.0](https://github.com/zuohuadong/supacloud/compare/supacloud-lite-v0.7.3...supacloud-lite-v0.8.0) (2026-08-15)
 
 

package/README.md

@@ -135,9 +135,16 @@ supacloud-lite version
 - `SUPACLOUD_LITE_STORAGE_DIR`
 - `SUPACLOUD_LITE_STORAGE_BACKEND`：`fs`（默认）、`memory` 或 `s3`
 - `SUPACLOUD_LITE_S3_PREFIX`：S3 对象 key 前缀，可被 `--s3-prefix` 覆盖
+- `SUPACLOUD_LITE_POSTGRES_MIRROR`：native 引擎下载 PostgreSQL 发布包时使用的 HTTPS 镜像前缀，例如 `https://ghproxy.net/`
 - `SUPACLOUD_LITE_JWT_SECRET`
 - `SUPACLOUD_LITE_VAULT_KEY`
 
+native 引擎首次运行会下载约 12 MB 的 Theseus PostgreSQL 发布包并缓存在 `~/.cache/supacloud-lite`。网络无法直连 GitHub 时，可设置镜像前缀；Lite 会把完整上游 URL 追加到该前缀，并在解压执行前继续校验固定或上游发布的 SHA-256。镜像不能包含 URL 凭据、query 或 fragment；除 loopback 测试地址外必须使用 HTTPS。
+
+```bash
+SUPACLOUD_LITE_POSTGRES_MIRROR=https://ghproxy.net/ supacloud-lite migrate --engine native
+```
+
 使用远端 S3 时，启动前设置 `SUPACLOUD_LITE_STORAGE_BACKEND=s3`，并按 Bun S3 约定提供 `S3_BUCKET`、`S3_ACCESS_KEY_ID`、`S3_SECRET_ACCESS_KEY`、`S3_ENDPOINT`、`S3_REGION` 等变量；也支持对应的 `AWS_*` 变量。CLI 不接受密钥参数，避免凭据出现在进程列表中。
 
 S3 模式下 `db reset` 会被拒绝，因为 Lite 不能把数据库元数据清理与远端对象删除做成原子操作；需要先明确处理远端 bucket/prefix，再切回本地或内存存储执行重置。
@@ -469,9 +476,16 @@ Environment variables:
 - `SUPACLOUD_LITE_STORAGE_DIR`
 - `SUPACLOUD_LITE_STORAGE_BACKEND`: `fs` (default), `memory`, or `s3`
 - `SUPACLOUD_LITE_S3_PREFIX`: S3 object key prefix, can be overridden by `--s3-prefix`
+- `SUPACLOUD_LITE_POSTGRES_MIRROR`: HTTPS prefix used to proxy native-engine PostgreSQL release downloads, for example `https://ghproxy.net/`
 - `SUPACLOUD_LITE_JWT_SECRET`
 - `SUPACLOUD_LITE_VAULT_KEY`
 
+On its first run, the native engine downloads an approximately 12 MB Theseus PostgreSQL release into `~/.cache/supacloud-lite`. If GitHub is not directly reachable, set a mirror prefix; Lite appends the complete upstream URL and still verifies the pinned or published SHA-256 before extracting or executing the archive. The mirror must not contain URL credentials, a query, or a fragment, and must use HTTPS except for loopback test endpoints.
+
+```bash
+SUPACLOUD_LITE_POSTGRES_MIRROR=https://ghproxy.net/ supacloud-lite migrate --engine native
+```
+
 When using remote S3, set `SUPACLOUD_LITE_STORAGE_BACKEND=s3` before starting, and provide variables such as `S3_BUCKET`, `S3_ACCESS_KEY_ID`, `S3_SECRET_ACCESS_KEY`, `S3_ENDPOINT`, and `S3_REGION` according to Bun S3 conventions; the corresponding `AWS_*` variables are also supported. The CLI does not accept secret parameters to avoid credentials appearing in the process list.
 
 In S3 mode, `db reset` is rejected because Lite cannot make database metadata cleanup and remote object deletion an atomic operation; you must explicitly handle the remote bucket/prefix first, then switch back to local or memory storage to perform the reset.

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname7, join as join10, resolve as resolve4 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.8.0",
+  version: "0.8.2",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -1296,7 +1296,8 @@ class AuthHandler {
         return await this.oauth.authorize(url);
       }
       if (path === "callback" && (method === "GET" || method === "POST")) {
-        return await this.oauth.callback(url, (userId) => this.sessionTokensFor(userId));
+        const callbackUrl = method === "POST" ? await this.oauthCallbackUrl(req, url) : url;
+        return await this.oauth.callback(callbackUrl, (userId) => this.oauthSessionTokensFor(userId));
       }
       if (path.startsWith("admin/"))
         return await this.admin(req, ctx, path, method);
@@ -1306,6 +1307,16 @@ class AuthHandler {
       return authError(500, "unexpected_failure", msg);
     }
   }
+  async oauthCallbackUrl(req, url) {
+    const callbackUrl = new URL(url);
+    const form = await req.formData();
+    for (const field of ["code", "state"]) {
+      const value = form.get(field);
+      if (typeof value === "string" && value)
+        callbackUrl.searchParams.set(field, value);
+    }
+    return callbackUrl;
+  }
   async signup(req) {
     const body = await req.json().catch(() => ({}));
     if (!body.email && !body.password) {
@@ -1383,7 +1394,7 @@ class AuthHandler {
       if (!userId)
         return authError(403, "flow_state_not_found", "invalid or expired auth code");
       const ures = await this.db.query(`select * from auth.users where id = $1`, [userId]);
-      return json(200, await this.sessionFor(ures.rows[0]));
+      return json(200, await this.sessionForOAuth(ures.rows[0]));
     }
     return authError(400, "invalid_grant", `unsupported grant_type: ${grantType}`);
   }
@@ -1428,17 +1439,18 @@ class AuthHandler {
       sets.push(`is_anonymous = false`);
       sets.push(`raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb) || '{"provider":"email","providers":["email"]}'::jsonb`);
     }
-    if (sets.length === 0)
-      return json(200, this.userJson(user));
-    params.push(user.id);
-    const res = await this.db.query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
-    const updated = res.rows[0];
-    if (upgradingAnon) {
-      await this.db.query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
-         values ($1, 'email', $2, $3)
-         on conflict (provider, provider_id) do nothing`, [updated.id, updated.id, JSON.stringify({ sub: updated.id, email: updated.email })]);
+    if (sets.length === 0) {
+      return json(200, this.userJson(user, await this.getUserFactors(user.id), await this.getUserIdentities(user.id)));
     }
-    return json(200, this.userJson(updated));
+    params.push(user.id);
+    const payload = await this.db.transaction(async (query) => {
+      const res = await query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
+      const updated = res.rows[0];
+      if (body.email)
+        await this.ensureEmailIdentity(updated, query);
+      return this.userJsonWithRelations(updated, query);
+    });
+    return json(200, payload);
   }
   async logout(req, url) {
     const claims = await this.claimsFromBearer(req);
@@ -1468,7 +1480,7 @@ class AuthHandler {
     let user = res.rows[0];
     if (!user) {
       if (!createUser)
-        return authError(422, "otp_disabled", "Signups not allowed for otp");
+        return json(200, {});
       if (this.settings.disableSignup)
         return authError(422, "signup_disabled", "Signups not allowed for this instance");
       res = await this.db.query(`insert into auth.users (aud, role, email, raw_app_meta_data, raw_user_meta_data)
@@ -1800,6 +1812,8 @@ Or sign in with this link: ${link}`
     }
     const idMatch = path.match(/^admin\/users\/([0-9a-f-]{36})$/);
     const exportMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/export$/);
+    const factorsMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/factors$/);
+    const factorMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/factors\/([0-9a-f-]{36})$/);
     if (path === "admin/generate_link" && method === "POST") {
       return await this.generateAdminMagicLink(req);
     }
@@ -1811,32 +1825,49 @@ Or sign in with this link: ${link}`
     if (exportMatch && method === "GET") {
       return await this.exportUser(exportMatch[1]);
     }
+    if (factorsMatch && method === "GET") {
+      const user = await this.db.query(`select 1 from auth.users where id = $1`, [factorsMatch[1]]);
+      if (user.rows.length === 0)
+        return authError(404, "user_not_found", "User not found");
+      return json(200, await this.getUserFactors(factorsMatch[1]));
+    }
+    if (factorMatch && method === "DELETE") {
+      const deleted = await this.db.query(`delete from auth.mfa_factors where user_id = $1 and id = $2 returning id`, [factorMatch[1], factorMatch[2]]);
+      if (deleted.rows.length === 0)
+        return authError(404, "mfa_factor_not_found", "MFA factor not found");
+      return json(200, { id: factorMatch[2] });
+    }
     if (path === "admin/users" && method === "GET") {
       const res = await this.db.query(`select * from auth.users order by created_at desc limit 1000`);
-      return json(200, { users: res.rows.map((u) => this.userJson(u)), aud: "authenticated" });
+      return json(200, { users: res.rows.map((user) => this.userJson(user)), aud: "authenticated" });
     }
     if (path === "admin/users" && method === "POST") {
       const body = await req.json().catch(() => ({}));
       if (!body.email)
         return authError(400, "validation_failed", "email is required");
       const hashed = body.password ? await hashPassword(body.password) : null;
-      const res = await this.db.query(`insert into auth.users
-           (aud, role, email, encrypted_password, email_confirmed_at, raw_app_meta_data, raw_user_meta_data)
-         values ('authenticated', 'authenticated', $1, $2, case when $3 then now() else null end, $4, $5)
-         returning *`, [
-        body.email.toLowerCase().trim(),
-        hashed,
-        body.email_confirm ?? true,
-        JSON.stringify({ provider: "email", providers: ["email"], ...body.app_metadata ?? {} }),
-        JSON.stringify(body.user_metadata ?? {})
-      ]);
-      return json(200, this.userJson(res.rows[0]));
+      const created = await this.db.transaction(async (query) => {
+        const res = await query(`insert into auth.users
+             (aud, role, email, encrypted_password, email_confirmed_at, raw_app_meta_data, raw_user_meta_data)
+           values ('authenticated', 'authenticated', $1, $2, case when $3 then now() else null end, $4, $5)
+           returning *`, [
+          body.email.toLowerCase().trim(),
+          hashed,
+          body.email_confirm ?? true,
+          JSON.stringify({ provider: "email", providers: ["email"], ...body.app_metadata ?? {} }),
+          JSON.stringify(body.user_metadata ?? {})
+        ]);
+        const user = res.rows[0];
+        await this.ensureEmailIdentity(user, query);
+        return this.userJsonWithRelations(user, query);
+      });
+      return json(200, created);
     }
     if (idMatch && method === "GET") {
       const res = await this.db.query(`select * from auth.users where id = $1`, [idMatch[1]]);
       if (res.rows.length === 0)
         return authError(404, "user_not_found", "User not found");
-      return json(200, this.userJson(res.rows[0]));
+      return json(200, await this.userJsonWithRelations(res.rows[0]));
     }
     if (idMatch && method === "PUT") {
       const body = await req.json().catch(() => ({}));
@@ -1863,10 +1894,18 @@ Or sign in with this link: ${link}`
       if (sets.length === 0)
         return authError(400, "validation_failed", "nothing to update");
       params.push(idMatch[1]);
-      const res = await this.db.query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
-      if (res.rows.length === 0)
+      const updated = await this.db.transaction(async (query) => {
+        const res = await query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
+        const user = res.rows[0];
+        if (!user)
+          return null;
+        if (typeof body.email === "string")
+          await this.ensureEmailIdentity(user, query);
+        return this.userJsonWithRelations(user, query);
+      });
+      if (!updated)
         return authError(404, "user_not_found", "User not found");
-      return json(200, this.userJson(res.rows[0]));
+      return json(200, updated);
     }
     if (idMatch && method === "DELETE") {
       return await this.eraseUser(idMatch[1]);
@@ -2062,17 +2101,26 @@ Or sign in with this link: ${link}`
     if (!await verifyTotp(factor.secret, body.code ?? "")) {
       return authError(422, "mfa_verification_failed", "Invalid TOTP code entered");
     }
-    await this.db.query(`update auth.mfa_challenges set verified_at = now() where id = $1`, [challenge.id]);
-    if (factor.status !== "verified") {
-      await this.db.query(`update auth.mfa_factors set status = 'verified', updated_at = now() where id = $1`, [factorId]);
-    }
-    const session = await this.sessionFor(user, undefined, {
-      aal: "aal2",
-      amr: [
-        { method: "password", timestamp: Math.floor(Date.now() / 1000) },
-        { method: "totp", timestamp: Math.floor(Date.now() / 1000) }
-      ]
+    const session = await this.db.transaction(async (query) => {
+      const claimed = await query(`update auth.mfa_challenges set verified_at = now()
+         where id = $1 and factor_id = $2 and verified_at is null and expires_at >= now()
+         returning id`, [challenge.id, factorId]);
+      if (claimed.rows.length === 0)
+        return null;
+      if (factor.status !== "verified") {
+        await query(`update auth.mfa_factors set status = 'verified', updated_at = now() where id = $1`, [factorId]);
+      }
+      return this.sessionFor(user, undefined, {
+        aal: "aal2",
+        amr: [
+          { method: "password", timestamp: Math.floor(Date.now() / 1000) },
+          { method: "totp", timestamp: Math.floor(Date.now() / 1000) }
+        ]
+      }, query);
     });
+    if (!session) {
+      return authError(422, "mfa_verification_failed", "This challenge has already been verified");
+    }
     return json(200, session);
   }
   async unenrollFactor(req, factorId) {
@@ -2110,6 +2158,17 @@ Or sign in with this link: ${link}`
       updated_at: iso(r.updated_at)
     }));
   }
+  async ensureEmailIdentity(user, query = (sql, params) => this.db.query(sql, params)) {
+    if (!user.email)
+      return;
+    await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+       values ($1::uuid, 'email', $1::text, $2::jsonb)
+       on conflict (provider, provider_id) do update
+       set identity_data = excluded.identity_data, updated_at = now()`, [user.id, JSON.stringify({ sub: user.id, email: user.email })]);
+  }
+  async userJsonWithRelations(user, query = (sql, params) => this.db.query(sql, params)) {
+    return this.userJson(user, await this.getUserFactors(user.id, query), await this.getUserIdentities(user.id, query));
+  }
   async rotateRefreshToken(token) {
     return this.db.transaction(async (query) => {
       const claimedToken = await this.claimRefreshToken(query, token);
@@ -2183,9 +2242,14 @@ Or sign in with this link: ${link}`
       is_anonymous: u.is_anonymous ?? false
     };
   }
-  async sessionTokensFor(userId) {
+  sessionForOAuth(user) {
+    return this.sessionFor(user, undefined, {
+      amr: [{ method: "oauth", timestamp: Math.floor(Date.now() / 1000) }]
+    });
+  }
+  async oauthSessionTokensFor(userId) {
     const res = await this.db.query(`select * from auth.users where id = $1`, [userId]);
-    const session = await this.sessionFor(res.rows[0]);
+    const session = await this.sessionForOAuth(res.rows[0]);
     return { access_token: session.access_token, refresh_token: session.refresh_token, expires_in: session.expires_in };
   }
   async sessionFor(user, parentToken, opts, query = (sql, params) => this.db.query(sql, params)) {
@@ -10732,6 +10796,7 @@ function toPgArrayLiteral(array) {
 
 // src/runtime/node/native/engine.ts
 var DEFAULT_PG_VERSION = "17.7.0";
+var POSTGRES_MIRROR_URL_ERROR = "SUPACLOUD_LITE_POSTGRES_MIRROR must be an absolute HTTPS URL or a loopback HTTP URL";
 var NATIVE_POSTGRES_MAJOR = DEFAULT_PG_VERSION.split(".")[0];
 function isNativeEngineSupported() {
   return (process.platform === "darwin" || process.platform === "linux") && (process.arch === "arm64" || process.arch === "x64") && (process.platform !== "linux" || isGlibcLinux());
@@ -10763,7 +10828,7 @@ var PINNED_SHA256 = {
   "postgresql-17.7.0-x86_64-apple-darwin": "0dd8c25173524bad4ae8ef6b970da1ac40f4c1f231150c416ccb8cd06feff8f2",
   "postgresql-17.7.0-aarch64-apple-darwin": "727ac08d20a704014a0d51eb3300aa0c8e292c1cf0a1c99d4f4b1002e1420220"
 };
-async function verifyTarball(tarball, key, url) {
+async function verifyTarball(tarball, key, upstreamUrl, downloadMirror) {
   const actual = createHash2("sha256").update(readFileSync(tarball)).digest("hex");
   const pinned = PINNED_SHA256[key];
   if (pinned) {
@@ -10772,7 +10837,8 @@ async function verifyTarball(tarball, key, url) {
     }
     return;
   }
-  const res = await fetchRelease(`${url}.sha256`);
+  const checksumUrl = resolvePostgresDownloadUrl(`${upstreamUrl}.sha256`, downloadMirror);
+  const res = await fetchRelease(checksumUrl);
   if (!res.ok)
     throw new Error(`could not fetch checksum for ${key}: HTTP ${res.status}`);
   const expected = (await res.text()).trim().split(/\s+/)[0].toLowerCase();
@@ -10782,13 +10848,14 @@ async function verifyTarball(tarball, key, url) {
     throw new Error(`postgres binary checksum mismatch for ${key}: expected ${expected}, got ${actual}`);
   }
 }
-async function ensurePostgres(version = DEFAULT_PG_VERSION, cacheDir, log) {
+async function ensurePostgres(version = DEFAULT_PG_VERSION, cacheDir, log, downloadMirror) {
   const t = target();
   const root = cacheDir ?? join(homedir(), ".cache", "supacloud-lite");
   const dir = join(root, `postgresql-${version}-${t}`);
   if (isCompleteInstall(dir))
     return dir;
-  const url = `https://github.com/theseus-rs/postgresql-binaries/releases/download/${version}/postgresql-${version}-${t}.tar.gz`;
+  const upstreamUrl = `https://github.com/theseus-rs/postgresql-binaries/releases/download/${version}/postgresql-${version}-${t}.tar.gz`;
+  const url = resolvePostgresDownloadUrl(upstreamUrl, downloadMirror);
   mkdirSync(root, { recursive: true });
   const uniq = `${process.pid}-${randomBytes2(6).toString("hex")}`;
   const tarball = join(root, `pg-${version}-${uniq}.tar.gz`);
@@ -10801,7 +10868,7 @@ async function ensurePostgres(version = DEFAULT_PG_VERSION, cacheDir, log) {
     if (!res.ok)
       throw new Error(`failed to download ${url}: HTTP ${res.status}`);
     await writeFile(tarball, Buffer.from(await res.arrayBuffer()));
-    await verifyTarball(tarball, `postgresql-${version}-${t}`, url);
+    await verifyTarball(tarball, `postgresql-${version}-${t}`, upstreamUrl, downloadMirror);
     mkdirSync(tmpDir, { recursive: true });
     await extractTar({ cwd: tmpDir, file: tarball, gzip: true, preserveOwner: false, strict: true, strip: 1 });
     if (!isCompleteInstall(tmpDir))
@@ -10821,6 +10888,32 @@ async function ensurePostgres(version = DEFAULT_PG_VERSION, cacheDir, log) {
     rmSync(tmpDir, { recursive: true, force: true });
   }
 }
+function resolvePostgresDownloadUrl(upstreamUrl, downloadMirror) {
+  const mirror = postgresDownloadMirror(downloadMirror);
+  return mirror ? `${mirror.toString().replace(/\/+$/, "")}/${upstreamUrl}` : upstreamUrl;
+}
+function postgresDownloadMirror(downloadMirror) {
+  const configuredMirror = downloadMirror ?? process.env.SUPACLOUD_LITE_POSTGRES_MIRROR;
+  const mirrorText = configuredMirror?.trim();
+  if (!mirrorText)
+    return;
+  let mirror;
+  try {
+    mirror = new URL(mirrorText);
+  } catch {
+    throw new Error(POSTGRES_MIRROR_URL_ERROR);
+  }
+  const loopbackHttp = mirror.protocol === "http:" && (mirror.hostname === "127.0.0.1" || mirror.hostname === "localhost" || mirror.hostname === "[::1]");
+  if (mirror.protocol !== "https:" && !loopbackHttp)
+    throw new Error(POSTGRES_MIRROR_URL_ERROR);
+  if (mirror.username || mirror.password) {
+    throw new Error("SUPACLOUD_LITE_POSTGRES_MIRROR must not contain credentials");
+  }
+  if (mirrorText.includes("?") || mirrorText.includes("#")) {
+    throw new Error("SUPACLOUD_LITE_POSTGRES_MIRROR must not contain a query or fragment");
+  }
+  return mirror;
+}
 async function fetchRelease(url) {
   let lastError;
   for (let attempt = 1;attempt <= 3; attempt++) {
@@ -10853,7 +10946,7 @@ async function createNativeEngine(opts) {
   let postgres;
   let removeExitHandler;
   try {
-    const installDir = await ensurePostgres(opts.version, opts.cacheDir, opts.log);
+    const installDir = await ensurePostgres(opts.version, opts.cacheDir, opts.log, opts.downloadMirror);
     const bin = (name) => join(installDir, "bin", name);
     if (!existsSync(join(opts.dataDir, "PG_VERSION"))) {
       mkdirSync(opts.dataDir, { recursive: true });

package/dist/index.js

@@ -85,7 +85,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.8.0",
+  version: "0.8.2",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -1301,7 +1301,8 @@ class AuthHandler {
         return await this.oauth.authorize(url);
       }
       if (path === "callback" && (method === "GET" || method === "POST")) {
-        return await this.oauth.callback(url, (userId) => this.sessionTokensFor(userId));
+        const callbackUrl = method === "POST" ? await this.oauthCallbackUrl(req, url) : url;
+        return await this.oauth.callback(callbackUrl, (userId) => this.oauthSessionTokensFor(userId));
       }
       if (path.startsWith("admin/"))
         return await this.admin(req, ctx, path, method);
@@ -1311,6 +1312,16 @@ class AuthHandler {
       return authError(500, "unexpected_failure", msg);
     }
   }
+  async oauthCallbackUrl(req, url) {
+    const callbackUrl = new URL(url);
+    const form = await req.formData();
+    for (const field of ["code", "state"]) {
+      const value = form.get(field);
+      if (typeof value === "string" && value)
+        callbackUrl.searchParams.set(field, value);
+    }
+    return callbackUrl;
+  }
   async signup(req) {
     const body = await req.json().catch(() => ({}));
     if (!body.email && !body.password) {
@@ -1388,7 +1399,7 @@ class AuthHandler {
       if (!userId)
         return authError(403, "flow_state_not_found", "invalid or expired auth code");
       const ures = await this.db.query(`select * from auth.users where id = $1`, [userId]);
-      return json(200, await this.sessionFor(ures.rows[0]));
+      return json(200, await this.sessionForOAuth(ures.rows[0]));
     }
     return authError(400, "invalid_grant", `unsupported grant_type: ${grantType}`);
   }
@@ -1433,17 +1444,18 @@ class AuthHandler {
       sets.push(`is_anonymous = false`);
       sets.push(`raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb) || '{"provider":"email","providers":["email"]}'::jsonb`);
     }
-    if (sets.length === 0)
-      return json(200, this.userJson(user));
-    params.push(user.id);
-    const res = await this.db.query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
-    const updated = res.rows[0];
-    if (upgradingAnon) {
-      await this.db.query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
-         values ($1, 'email', $2, $3)
-         on conflict (provider, provider_id) do nothing`, [updated.id, updated.id, JSON.stringify({ sub: updated.id, email: updated.email })]);
+    if (sets.length === 0) {
+      return json(200, this.userJson(user, await this.getUserFactors(user.id), await this.getUserIdentities(user.id)));
     }
-    return json(200, this.userJson(updated));
+    params.push(user.id);
+    const payload = await this.db.transaction(async (query) => {
+      const res = await query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
+      const updated = res.rows[0];
+      if (body.email)
+        await this.ensureEmailIdentity(updated, query);
+      return this.userJsonWithRelations(updated, query);
+    });
+    return json(200, payload);
   }
   async logout(req, url) {
     const claims = await this.claimsFromBearer(req);
@@ -1473,7 +1485,7 @@ class AuthHandler {
     let user = res.rows[0];
     if (!user) {
       if (!createUser)
-        return authError(422, "otp_disabled", "Signups not allowed for otp");
+        return json(200, {});
       if (this.settings.disableSignup)
         return authError(422, "signup_disabled", "Signups not allowed for this instance");
       res = await this.db.query(`insert into auth.users (aud, role, email, raw_app_meta_data, raw_user_meta_data)
@@ -1805,6 +1817,8 @@ Or sign in with this link: ${link}`
     }
     const idMatch = path.match(/^admin\/users\/([0-9a-f-]{36})$/);
     const exportMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/export$/);
+    const factorsMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/factors$/);
+    const factorMatch = path.match(/^admin\/users\/([0-9a-f-]{36})\/factors\/([0-9a-f-]{36})$/);
     if (path === "admin/generate_link" && method === "POST") {
       return await this.generateAdminMagicLink(req);
     }
@@ -1816,32 +1830,49 @@ Or sign in with this link: ${link}`
     if (exportMatch && method === "GET") {
       return await this.exportUser(exportMatch[1]);
     }
+    if (factorsMatch && method === "GET") {
+      const user = await this.db.query(`select 1 from auth.users where id = $1`, [factorsMatch[1]]);
+      if (user.rows.length === 0)
+        return authError(404, "user_not_found", "User not found");
+      return json(200, await this.getUserFactors(factorsMatch[1]));
+    }
+    if (factorMatch && method === "DELETE") {
+      const deleted = await this.db.query(`delete from auth.mfa_factors where user_id = $1 and id = $2 returning id`, [factorMatch[1], factorMatch[2]]);
+      if (deleted.rows.length === 0)
+        return authError(404, "mfa_factor_not_found", "MFA factor not found");
+      return json(200, { id: factorMatch[2] });
+    }
     if (path === "admin/users" && method === "GET") {
       const res = await this.db.query(`select * from auth.users order by created_at desc limit 1000`);
-      return json(200, { users: res.rows.map((u) => this.userJson(u)), aud: "authenticated" });
+      return json(200, { users: res.rows.map((user) => this.userJson(user)), aud: "authenticated" });
     }
     if (path === "admin/users" && method === "POST") {
       const body = await req.json().catch(() => ({}));
       if (!body.email)
         return authError(400, "validation_failed", "email is required");
       const hashed = body.password ? await hashPassword(body.password) : null;
-      const res = await this.db.query(`insert into auth.users
-           (aud, role, email, encrypted_password, email_confirmed_at, raw_app_meta_data, raw_user_meta_data)
-         values ('authenticated', 'authenticated', $1, $2, case when $3 then now() else null end, $4, $5)
-         returning *`, [
-        body.email.toLowerCase().trim(),
-        hashed,
-        body.email_confirm ?? true,
-        JSON.stringify({ provider: "email", providers: ["email"], ...body.app_metadata ?? {} }),
-        JSON.stringify(body.user_metadata ?? {})
-      ]);
-      return json(200, this.userJson(res.rows[0]));
+      const created = await this.db.transaction(async (query) => {
+        const res = await query(`insert into auth.users
+             (aud, role, email, encrypted_password, email_confirmed_at, raw_app_meta_data, raw_user_meta_data)
+           values ('authenticated', 'authenticated', $1, $2, case when $3 then now() else null end, $4, $5)
+           returning *`, [
+          body.email.toLowerCase().trim(),
+          hashed,
+          body.email_confirm ?? true,
+          JSON.stringify({ provider: "email", providers: ["email"], ...body.app_metadata ?? {} }),
+          JSON.stringify(body.user_metadata ?? {})
+        ]);
+        const user = res.rows[0];
+        await this.ensureEmailIdentity(user, query);
+        return this.userJsonWithRelations(user, query);
+      });
+      return json(200, created);
     }
     if (idMatch && method === "GET") {
       const res = await this.db.query(`select * from auth.users where id = $1`, [idMatch[1]]);
       if (res.rows.length === 0)
         return authError(404, "user_not_found", "User not found");
-      return json(200, this.userJson(res.rows[0]));
+      return json(200, await this.userJsonWithRelations(res.rows[0]));
     }
     if (idMatch && method === "PUT") {
       const body = await req.json().catch(() => ({}));
@@ -1868,10 +1899,18 @@ Or sign in with this link: ${link}`
       if (sets.length === 0)
         return authError(400, "validation_failed", "nothing to update");
       params.push(idMatch[1]);
-      const res = await this.db.query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
-      if (res.rows.length === 0)
+      const updated = await this.db.transaction(async (query) => {
+        const res = await query(`update auth.users set ${sets.join(", ")}, updated_at = now() where id = $${params.length} returning *`, params);
+        const user = res.rows[0];
+        if (!user)
+          return null;
+        if (typeof body.email === "string")
+          await this.ensureEmailIdentity(user, query);
+        return this.userJsonWithRelations(user, query);
+      });
+      if (!updated)
         return authError(404, "user_not_found", "User not found");
-      return json(200, this.userJson(res.rows[0]));
+      return json(200, updated);
     }
     if (idMatch && method === "DELETE") {
       return await this.eraseUser(idMatch[1]);
@@ -2067,17 +2106,26 @@ Or sign in with this link: ${link}`
     if (!await verifyTotp(factor.secret, body.code ?? "")) {
       return authError(422, "mfa_verification_failed", "Invalid TOTP code entered");
     }
-    await this.db.query(`update auth.mfa_challenges set verified_at = now() where id = $1`, [challenge.id]);
-    if (factor.status !== "verified") {
-      await this.db.query(`update auth.mfa_factors set status = 'verified', updated_at = now() where id = $1`, [factorId]);
-    }
-    const session = await this.sessionFor(user, undefined, {
-      aal: "aal2",
-      amr: [
-        { method: "password", timestamp: Math.floor(Date.now() / 1000) },
-        { method: "totp", timestamp: Math.floor(Date.now() / 1000) }
-      ]
+    const session = await this.db.transaction(async (query) => {
+      const claimed = await query(`update auth.mfa_challenges set verified_at = now()
+         where id = $1 and factor_id = $2 and verified_at is null and expires_at >= now()
+         returning id`, [challenge.id, factorId]);
+      if (claimed.rows.length === 0)
+        return null;
+      if (factor.status !== "verified") {
+        await query(`update auth.mfa_factors set status = 'verified', updated_at = now() where id = $1`, [factorId]);
+      }
+      return this.sessionFor(user, undefined, {
+        aal: "aal2",
+        amr: [
+          { method: "password", timestamp: Math.floor(Date.now() / 1000) },
+          { method: "totp", timestamp: Math.floor(Date.now() / 1000) }
+        ]
+      }, query);
     });
+    if (!session) {
+      return authError(422, "mfa_verification_failed", "This challenge has already been verified");
+    }
     return json(200, session);
   }
   async unenrollFactor(req, factorId) {
@@ -2115,6 +2163,17 @@ Or sign in with this link: ${link}`
       updated_at: iso(r.updated_at)
     }));
   }
+  async ensureEmailIdentity(user, query = (sql, params) => this.db.query(sql, params)) {
+    if (!user.email)
+      return;
+    await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+       values ($1::uuid, 'email', $1::text, $2::jsonb)
+       on conflict (provider, provider_id) do update
+       set identity_data = excluded.identity_data, updated_at = now()`, [user.id, JSON.stringify({ sub: user.id, email: user.email })]);
+  }
+  async userJsonWithRelations(user, query = (sql, params) => this.db.query(sql, params)) {
+    return this.userJson(user, await this.getUserFactors(user.id, query), await this.getUserIdentities(user.id, query));
+  }
   async rotateRefreshToken(token) {
     return this.db.transaction(async (query) => {
       const claimedToken = await this.claimRefreshToken(query, token);
@@ -2188,9 +2247,14 @@ Or sign in with this link: ${link}`
       is_anonymous: u.is_anonymous ?? false
     };
   }
-  async sessionTokensFor(userId) {
+  sessionForOAuth(user) {
+    return this.sessionFor(user, undefined, {
+      amr: [{ method: "oauth", timestamp: Math.floor(Date.now() / 1000) }]
+    });
+  }
+  async oauthSessionTokensFor(userId) {
     const res = await this.db.query(`select * from auth.users where id = $1`, [userId]);
-    const session = await this.sessionFor(res.rows[0]);
+    const session = await this.sessionForOAuth(res.rows[0]);
     return { access_token: session.access_token, refresh_token: session.refresh_token, expires_in: session.expires_in };
   }
   async sessionFor(user, parentToken, opts, query = (sql, params) => this.db.query(sql, params)) {
@@ -10745,6 +10809,7 @@ function toPgArrayLiteral(array) {
 
 // src/runtime/node/native/engine.ts
 var DEFAULT_PG_VERSION = "17.7.0";
+var POSTGRES_MIRROR_URL_ERROR = "SUPACLOUD_LITE_POSTGRES_MIRROR must be an absolute HTTPS URL or a loopback HTTP URL";
 var NATIVE_POSTGRES_MAJOR = DEFAULT_PG_VERSION.split(".")[0];
 function isNativeEngineSupported() {
   return (process.platform === "darwin" || process.platform === "linux") && (process.arch === "arm64" || process.arch === "x64") && (process.platform !== "linux" || isGlibcLinux());
@@ -10776,7 +10841,7 @@ var PINNED_SHA256 = {
   "postgresql-17.7.0-x86_64-apple-darwin": "0dd8c25173524bad4ae8ef6b970da1ac40f4c1f231150c416ccb8cd06feff8f2",
   "postgresql-17.7.0-aarch64-apple-darwin": "727ac08d20a704014a0d51eb3300aa0c8e292c1cf0a1c99d4f4b1002e1420220"
 };
-async function verifyTarball(tarball, key, url) {
+async function verifyTarball(tarball, key, upstreamUrl, downloadMirror) {
   const actual = createHash2("sha256").update(readFileSync(tarball)).digest("hex");
   const pinned = PINNED_SHA256[key];
   if (pinned) {
@@ -10785,7 +10850,8 @@ async function verifyTarball(tarball, key, url) {
     }
     return;
   }
-  const res = await fetchRelease(`${url}.sha256`);
+  const checksumUrl = resolvePostgresDownloadUrl(`${upstreamUrl}.sha256`, downloadMirror);
+  const res = await fetchRelease(checksumUrl);
   if (!res.ok)
     throw new Error(`could not fetch checksum for ${key}: HTTP ${res.status}`);
   const expected = (await res.text()).trim().split(/\s+/)[0].toLowerCase();
@@ -10795,13 +10861,14 @@ async function verifyTarball(tarball, key, url) {
     throw new Error(`postgres binary checksum mismatch for ${key}: expected ${expected}, got ${actual}`);
   }
 }
-async function ensurePostgres(version = DEFAULT_PG_VERSION, cacheDir, log) {
+async function ensurePostgres(version = DEFAULT_PG_VERSION, cacheDir, log, downloadMirror) {
   const t = target();
   const root = cacheDir ?? join2(homedir(), ".cache", "supacloud-lite");
   const dir = join2(root, `postgresql-${version}-${t}`);
   if (isCompleteInstall(dir))
     return dir;
-  const url = `https://github.com/theseus-rs/postgresql-binaries/releases/download/${version}/postgresql-${version}-${t}.tar.gz`;
+  const upstreamUrl = `https://github.com/theseus-rs/postgresql-binaries/releases/download/${version}/postgresql-${version}-${t}.tar.gz`;
+  const url = resolvePostgresDownloadUrl(upstreamUrl, downloadMirror);
   mkdirSync(root, { recursive: true });
   const uniq = `${process.pid}-${randomBytes2(6).toString("hex")}`;
   const tarball = join2(root, `pg-${version}-${uniq}.tar.gz`);
@@ -10814,7 +10881,7 @@ async function ensurePostgres(version = DEFAULT_PG_VERSION, cacheDir, log) {
     if (!res.ok)
       throw new Error(`failed to download ${url}: HTTP ${res.status}`);
     await writeFile2(tarball, Buffer.from(await res.arrayBuffer()));
-    await verifyTarball(tarball, `postgresql-${version}-${t}`, url);
+    await verifyTarball(tarball, `postgresql-${version}-${t}`, upstreamUrl, downloadMirror);
     mkdirSync(tmpDir, { recursive: true });
     await extractTar({ cwd: tmpDir, file: tarball, gzip: true, preserveOwner: false, strict: true, strip: 1 });
     if (!isCompleteInstall(tmpDir))
@@ -10834,6 +10901,32 @@ async function ensurePostgres(version = DEFAULT_PG_VERSION, cacheDir, log) {
     rmSync(tmpDir, { recursive: true, force: true });
   }
 }
+function resolvePostgresDownloadUrl(upstreamUrl, downloadMirror) {
+  const mirror = postgresDownloadMirror(downloadMirror);
+  return mirror ? `${mirror.toString().replace(/\/+$/, "")}/${upstreamUrl}` : upstreamUrl;
+}
+function postgresDownloadMirror(downloadMirror) {
+  const configuredMirror = downloadMirror ?? process.env.SUPACLOUD_LITE_POSTGRES_MIRROR;
+  const mirrorText = configuredMirror?.trim();
+  if (!mirrorText)
+    return;
+  let mirror;
+  try {
+    mirror = new URL(mirrorText);
+  } catch {
+    throw new Error(POSTGRES_MIRROR_URL_ERROR);
+  }
+  const loopbackHttp = mirror.protocol === "http:" && (mirror.hostname === "127.0.0.1" || mirror.hostname === "localhost" || mirror.hostname === "[::1]");
+  if (mirror.protocol !== "https:" && !loopbackHttp)
+    throw new Error(POSTGRES_MIRROR_URL_ERROR);
+  if (mirror.username || mirror.password) {
+    throw new Error("SUPACLOUD_LITE_POSTGRES_MIRROR must not contain credentials");
+  }
+  if (mirrorText.includes("?") || mirrorText.includes("#")) {
+    throw new Error("SUPACLOUD_LITE_POSTGRES_MIRROR must not contain a query or fragment");
+  }
+  return mirror;
+}
 async function fetchRelease(url) {
   let lastError;
   for (let attempt = 1;attempt <= 3; attempt++) {
@@ -10866,7 +10959,7 @@ async function createNativeEngine(opts) {
   let postgres;
   let removeExitHandler;
   try {
-    const installDir = await ensurePostgres(opts.version, opts.cacheDir, opts.log);
+    const installDir = await ensurePostgres(opts.version, opts.cacheDir, opts.log, opts.downloadMirror);
     const bin = (name) => join2(installDir, "bin", name);
     if (!existsSync(join2(opts.dataDir, "PG_VERSION"))) {
       mkdirSync(opts.dataDir, { recursive: true });

package/dist/runtime/auth/handler.d.ts

@@ -97,6 +97,7 @@ export declare class AuthHandler {
     private phoneDeliveriesSettledBeforeDeadline;
     /** Dispatch one `/auth/v1/*` request. Any thrown error becomes a 500 `unexpected_failure`. */
     handle(req: Request, ctx: RequestContext, url: URL): Promise<Response>;
+    private oauthCallbackUrl;
     private signup;
     private token;
     private getUser;
@@ -159,6 +160,8 @@ export declare class AuthHandler {
     private getUserFactors;
     /** GoTrue-shaped identities for a user (linked providers), from auth.identities. */
     private getUserIdentities;
+    private ensureEmailIdentity;
+    private userJsonWithRelations;
     private rotateRefreshToken;
     private claimRefreshToken;
     private refreshSessionStartedAt;
@@ -167,8 +170,8 @@ export declare class AuthHandler {
     private claimsFromBearer;
     /** Shape a user row into the GoTrue user object supabase-js expects. */
     userJson(u: UserRow, factors?: Record<string, unknown>[], identities?: Record<string, unknown>[]): Record<string, unknown>;
-    /** Session tokens for a bare user id (used by the OAuth implicit callback). */
-    private sessionTokensFor;
+    private sessionForOAuth;
+    private oauthSessionTokensFor;
     private sessionFor;
 }
 export {};

package/dist/runtime/auth/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAc,SAAS,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGnE,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAG7C,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,KAAK,CAAA;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CACjC;AAED,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACjD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAClD,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAClC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CACjC;AAgID,wEAAwE;AACxE,qBAAa,WAAW;IAYpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,OAAO,CAAC,KAAK,CAAc;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,wBAAwB,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAQ;IAExB,YACU,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU,EAa3B;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,QAAQ;IAUhB,4EAA4E;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1B;YAEa,oCAAoC;IAgBlD,8FAA8F;IACxF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuD3E;YAIa,MAAM;YAiEN,KAAK;YAwCL,OAAO;YAMP,UAAU;YAgEV,MAAM;YAwBN,UAAU;YA4CV,OAAO;YAqBP,eAAe;YAqDf,eAAe;YAmCf,SAAS;YAwBT,kBAAkB;IAShC,OAAO,CAAC,mBAAmB;YASb,eAAe;YAgBf,YAAY;YAaZ,qBAAqB;YAgBrB,qBAAqB;IAUnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,kBAAkB;YAQZ,YAAY;IAM1B,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAI;YAE9B,MAAM;YASN,eAAe;YAWf,uBAAuB;YAkBvB,qBAAqB;YAUrB,uBAAuB;YAcvB,6BAA6B;YAa7B,WAAW;YAsCX,cAAc;YAyDd,UAAU;YAuBV,KAAK;YA6FL,sBAAsB;IAuEpC;;;OAGG;YACW,KAAK;IAqBnB;;;;;OAKG;YACW,UAAU;IA2CxB;;;;;;;;;OASG;YACW,SAAS;YAqBT,YAAY;YAyDZ,eAAe;YAqBf,YAAY;YAyCZ,cAAc;YAWd,cAAc;IAmB5B,oFAAoF;YACtE,iBAAiB;YAuBjB,kBAAkB;YAqBlB,iBAAiB;YAUjB,uBAAuB;IASrC,OAAO,CAAC,kBAAkB;YAoBZ,cAAc;YAOd,gBAAgB;IAM9B,wEAAwE;IACxE,QAAQ,CACN,CAAC,EAAE,OAAO,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,EACvC,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmBzB;IAED,+EAA+E;YACjE,gBAAgB;YAUhB,UAAU;CAqDzB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAc,SAAS,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGnE,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAG7C,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,KAAK,CAAA;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CACjC;AAED,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACjD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAClD,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAClC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CACjC;AAgID,wEAAwE;AACxE,qBAAa,WAAW;IAYpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,OAAO,CAAC,KAAK,CAAc;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,wBAAwB,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAQ;IAExB,YACU,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU,EAa3B;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,QAAQ;IAUhB,4EAA4E;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1B;YAEa,oCAAoC;IAgBlD,8FAA8F;IACxF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwD3E;YAEa,gBAAgB;YAYhB,MAAM;YAiEN,KAAK;YAwCL,OAAO;YAMP,UAAU;YA6DV,MAAM;YAwBN,UAAU;YA4CV,OAAO;YAqBP,eAAe;YAqDf,eAAe;YAmCf,SAAS;YAwBT,kBAAkB;IAShC,OAAO,CAAC,mBAAmB;YASb,eAAe;YAgBf,YAAY;YAaZ,qBAAqB;YAgBrB,qBAAqB;IAUnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,kBAAkB;YAQZ,YAAY;IAM1B,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAI;YAE9B,MAAM;YASN,eAAe;YAWf,uBAAuB;YAkBvB,qBAAqB;YAUrB,uBAAuB;YAcvB,6BAA6B;YAa7B,WAAW;YAsCX,cAAc;YAyDd,UAAU;YAuBV,KAAK;YAyHL,sBAAsB;IAuEpC;;;OAGG;YACW,KAAK;IAqBnB;;;;;OAKG;YACW,UAAU;IA2CxB;;;;;;;;;OASG;YACW,SAAS;YAqBT,YAAY;YAyDZ,eAAe;YAqBf,YAAY;YAmDZ,cAAc;YAWd,cAAc;IAmB5B,oFAAoF;YACtE,iBAAiB;YAqBjB,mBAAmB;YAcnB,qBAAqB;YAarB,kBAAkB;YAqBlB,iBAAiB;YAUjB,uBAAuB;IASrC,OAAO,CAAC,kBAAkB;YAoBZ,cAAc;YAOd,gBAAgB;IAM9B,wEAAwE;IACxE,QAAQ,CACN,CAAC,EAAE,OAAO,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,EACvC,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmBzB;IAED,OAAO,CAAC,eAAe;YAMT,qBAAqB;YAYrB,UAAU;CAqDzB"}

package/dist/runtime/node/native/engine.d.ts

@@ -10,10 +10,17 @@ export interface NativeEngineOptions {
     cacheDir?: string;
     /** sink for progress lines (download, install); no-op when omitted */
     log?: (msg: string) => void;
+    /** Optional HTTPS or loopback HTTP prefix for proxying the PostgreSQL release download. */
+    downloadMirror?: string;
 }
 export declare function isNativeEngineSupported(): boolean;
 /** Download + unpack Postgres binaries if not already cached (concurrency-safe). Returns the install dir. */
-export declare function ensurePostgres(version?: string, cacheDir?: string, log?: (m: string) => void): Promise<string>;
+export declare function ensurePostgres(version?: string, cacheDir?: string, log?: (m: string) => void, downloadMirror?: string): Promise<string>;
+/**
+ * Prefix a trusted GitHub release URL with an operator-selected mirror. The
+ * archive is still checked against the pinned or published SHA-256 before use.
+ */
+export declare function resolvePostgresDownloadUrl(upstreamUrl: string, downloadMirror?: string): string;
 /**
  * Boot the embedded Postgres child (initdb on first run) and return a {@link DbEngine}
  * backed by two wire connections: one for queries/transactions (serialized by a mutex),

package/dist/runtime/node/native/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../../src/runtime/node/native/engine.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAKlD,eAAO,MAAM,qBAAqB,QAAoC,CAAA;AAEtE,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAC5B;AAED,wBAAgB,uBAAuB,IAAI,OAAO,CAIjD;AA4DD,6GAA6G;AAC7G,wBAAsB,cAAc,CAAC,OAAO,SAAqB,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CA2ChI;AA4BD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiFrF"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../../src/runtime/node/native/engine.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAOlD,eAAO,MAAM,qBAAqB,QAAoC,CAAA;AAEtE,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3B,2FAA2F;IAC3F,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,wBAAgB,uBAAuB,IAAI,OAAO,CAIjD;AA6DD,6GAA6G;AAC7G,wBAAsB,cAAc,CAClC,OAAO,SAAqB,EAC5B,QAAQ,CAAC,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,EACzB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAG/F;AAkDD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiFrF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/lite",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   "type": "module",
   "license": "Apache-2.0",