tinbase 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sanket Sahu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,185 @@
+<p align="center"><img src="assets/logo.svg" width="96" alt="tinbase logo"></p>
+
+# tinbase
+
+A pure-JS, Docker-free Supabase backend built on [PGlite](https://pglite.dev) (Postgres compiled to WASM). It speaks the same wire protocols as hosted Supabase, so the **official `@supabase/supabase-js` SDK works unchanged** - REST, Auth, Storage, and Realtime.
+
+One command, one small binary, real Postgres with Row Level Security - and 1:1 with Supabase's APIs and migration conventions.
+
+```
+npx tinbase start
+```
+
+- **No Docker, no external services.** One runtime dependency: `@electric-sql/pglite`.
+- **Real Postgres semantics.** RLS policies, `auth.uid()`, triggers, FKs - it is Postgres.
+- **Two engines, one API.** Default is PGlite (WASM Postgres - portable, browser-ready). `--engine native` runs an embedded native Postgres instead: ~53 MB of RAM at boot, PocketBase-class footprint, zero semantic differences.
+- **Supabase CLI migration conventions.** Reads `supabase/migrations/*.sql` and `supabase/seed.sql`; tracks them in `supabase_migrations.schema_migrations`. Your migration files stay portable to hosted Supabase.
+- **Browser-ready core.** Every service is a pure `(Request) => Response` fetch handler. In Node it's served over HTTP; in the browser you can hand it to supabase-js as a custom `fetch` and run the whole backend in-process (PGlite already runs in the browser via IndexedDB/OPFS).
+
+## Quick start
+
+```bash
+# in a project with a supabase/ directory (or none - it still boots)
+npx tinbase start
+
+#   API URL: http://127.0.0.1:54321
+#   anon key: eyJ...
+#   service_role key: eyJ...
+```
+
+Point the ordinary supabase-js client at it:
+
+```ts
+import { createClient } from '@supabase/supabase-js'
+
+const supabase = createClient('http://127.0.0.1:54321', ANON_KEY)
+
+await supabase.auth.signUp({ email: 'me@example.com', password: 'secret123' })
+await supabase.from('todos').insert({ title: 'hello' })
+const { data } = await supabase.from('todos').select('*, author:users(name)').eq('done', false)
+
+supabase
+  .channel('feed')
+  .on('postgres_changes', { event: 'INSERT', schema: 'public', table: 'todos' }, console.log)
+  .subscribe()
+```
+
+### CLI
+
+```
+tinbase start      # boot the server (applies pending migrations first)
+tinbase migrate    # apply pending migrations and exit
+tinbase status     # list applied migrations
+tinbase keys       # print anon / service_role keys
+
+  -p, --port <n>        port (default 54321)
+      --dir <path>      project dir containing supabase/ (default cwd)
+      --data-dir <path> PGlite data dir (default <dir>/.tinbase/db)
+      --jwt-secret <s>  JWT secret (or TINBASE_JWT_SECRET)
+      --memory          in-memory database, no persistence (wasm engine)
+      --engine <e>      wasm (default) or native
+```
+
+### Engines
+
+- **wasm** (default): PGlite. Zero setup, runs anywhere Node runs - and in the browser. Costs ~350 MB RAM.
+- **native**: embedded native Postgres 17. First run downloads platform binaries (~12 MB, from [theseus-rs/postgresql-binaries](https://github.com/theseus-rs/postgresql-binaries), cached in `~/.cache/tinbase`), then `initdb` with memory-lean settings. ~53 MB RAM at boot. Listens only on a private unix socket (0700 dir, trust auth) - never TCP. macOS/Linux on x64/arm64; on Windows use wasm.
+
+Both engines run the identical bootstrap, migrations, RLS, and realtime CDC - the test suite passes on both (`TINBASE_TEST_ENGINE=native npm test`).
+
+### Single-binary build (PocketBase-style)
+
+```bash
+npm run build:binary   # requires bun; emits dist-bin/tinbase (~57 MB)
+
+./tinbase start        # that's the whole deployment
+```
+
+One compiled executable, no Node or npm on the target machine. It defaults to the native engine (Postgres binaries auto-download on first run, 12 MB) and serves everything - REST, Auth, Storage, Realtime WebSockets - at 44 MB of RAM at boot. Runs under Bun's runtime via a Bun-native server (`Bun.serve` + built-in WebSockets); the same CLI on Node uses the node:http server.
+
+## Embedding (Node or browser)
+
+```ts
+import { createBackend } from 'tinbase'
+
+const backend = await createBackend({
+  // dataDir: 'idb://my-app'  <- browser persistence
+  migrations: [{ name: '20240101000000_init', sql: 'create table notes (...)' }],
+})
+
+// supabase-js talks to it in-process - no HTTP server, no network
+const supabase = createClient('http://localhost', backend.anonKey, {
+  global: { fetch: (input, init) => backend.fetch(new Request(input, init)) },
+})
+```
+
+Node-only helpers live in `tinbase/node`:
+
+```ts
+import { serve, FsStorageDriver, loadSupabaseProject } from 'tinbase/node'
+
+const project = await loadSupabaseProject(process.cwd())
+const backend = await createBackend({ ...project, storageDriver: new FsStorageDriver('./files') })
+const server = await serve(backend, { port: 54321 })
+```
+
+## What's implemented
+
+| Service | Endpoint | Coverage |
+| --- | --- | --- |
+| REST (PostgREST) | `/rest/v1` | select with embedded resources (to-one, to-many, many-to-many via junction, nested, `!inner`, aliases, hints, casts, JSON paths), all common filter operators incl. `or`/`and` trees, full-text search, order/limit/offset (top-level and per-embed), `single`/`maybeSingle`, `count`, insert/bulk insert, upsert (merge/ignore), update, delete, `Prefer` handling, RPC (scalar, `setof`, void, filters on results), PostgREST-shaped errors |
+| Auth (GoTrue) | `/auth/v1` | email/password signup + sign-in, anonymous sign-in, session refresh with rotation, `getUser`, `updateUser`, sign-out, admin user CRUD (service key), GoTrue-shaped errors. JWTs are HS256 via WebCrypto; passwords are PBKDF2 |
+| Storage | `/storage/v1` | bucket CRUD, upload (raw + multipart), download, public objects, signed URLs, signed upload URLs, list with folder entries, move/copy, remove, size/MIME limits. Metadata lives in `storage.objects` with RLS enforced; bytes go through a pluggable driver (fs in Node, memory anywhere) |
+| Realtime | `/realtime/v1` | Phoenix protocol (v1 JSON and v2 array/binary serializers), `postgres_changes` (INSERT/UPDATE/DELETE, filters) fed by triggers + `pg_notify`, broadcast (incl. binary payloads), presence. WebSocket server is a ~150-line RFC 6455 implementation - no `ws` dependency |
+
+### RLS works like real Supabase
+
+Every REST/storage request runs inside a transaction with `SET LOCAL role` and `request.jwt.claims`, so policies like this behave identically to hosted Supabase:
+
+```sql
+create policy "own rows" on todos
+  for all to authenticated
+  using (user_id = auth.uid()) with check (user_id = auth.uid());
+```
+
+## Footprint: tinbase vs PocketBase vs Supabase local
+
+![Memory footprint comparison](assets/footprint.svg)
+
+Measured on an Apple Silicon Mac (48 GB), macOS 15. Same workload for all three: boot with one migrated table, then 1,000 single-row inserts followed by 1,000 filtered list queries. Memory is physical footprint (`vmmap`) for native processes and the sum of `docker stats` for containers. Reproduce with [`bench/footprint.ts`](bench/footprint.ts); raw numbers in [`bench/results.json`](bench/results.json).
+
+| | tinbase (single binary) | tinbase (native, Node) | tinbase (wasm) | PocketBase v0.39.5 | Supabase local (CLI 2.40) |
+| --- | --- | --- | --- | --- | --- |
+| Database | real Postgres 17 + RLS | real Postgres 17 + RLS | real Postgres (PGlite) + RLS | SQLite | Postgres 17 |
+| Runtime memory at boot | 44 MB | 53 MB | 573 MB | 16 MB | 1,441 MB |
+| Runtime memory after workload | 64 MB | 96 MB | 347 MB¹ | 25 MB | 1,626 MB |
+| Data on disk (1k rows) | 38 MB | 38 MB | 39 MB | 7 MB | 70 MB |
+| Install size | 92 MB (no runtime needed) | 35 MB² | 26 MB² | 30 MB | 2,291 MB³ |
+| Processes | 2 (tinbase + postgres) | 2 (node + postgres) | 1 | 1 | 12 containers + Docker |
+| 1,000 inserts | 0.4 s | 0.5 s | 0.8 s | 0.3 s | 1.1 s |
+| 1,000 filtered reads | 0.4 s | 0.4 s | 0.8 s | 0.3 s | 1.0 s |
+
+¹ PGlite's WASM instantiation peaks at boot, then the OS reclaims pages; steady state under load is ~350 MB.
+² Native: unpacked Postgres 17 binaries + `dist`. Wasm: `dist` + `@electric-sql/pglite`. Both exclude the Node runtime you already have.
+³ Sum of the Docker image sizes the default local stack runs, excluding Docker Desktop itself.
+
+**How to read this honestly:**
+
+- **vs Supabase local**: same SDK, same APIs, ~15-27x less memory (native engine), ~65x smaller install, 2 processes instead of a 12-container stack, and boots in ~2 s instead of a minute. That's the entire point of the project.
+- **vs PocketBase**: the single binary lands in PocketBase's weight class - ~2.5x the RAM, one downloadable file, no runtime prerequisite - while running *real Postgres* (RLS, jsonb, FKs, triggers) behind Supabase's exact wire APIs, so your code and migration files move to hosted Supabase unchanged. PocketBase is still the lightest option if you don't need any of that.
+- The wasm engine's memory is almost entirely the PGlite WASM heap; the API layers add single-digit MB. Use it where portability matters (browser, one-dependency installs); use `--engine native` on servers.
+
+## How complete is it?
+
+Rough coverage of the supabase-js SDK surface, measured against what each sub-library can express (all "supported" claims are exercised by the test suite):
+
+| Module | Coverage | Supported | Missing |
+| --- | --- | --- | --- |
+| Database (`postgrest-js`) | ~85% | full filter grammar, embeds (to-one/to-many/m2m/nested/`!inner`), JSON paths, upsert, count, single/maybeSingle, RPC | aggregates in select, full spread embeds, `.explain()`, `.csv()`, geojson |
+| Auth (`auth-js`) | ~40% | email/password, anonymous sign-in, refresh rotation, user updates, admin CRUD | OAuth, magic links, OTP, MFA, SSO/SAML, PKCE, phone auth, email delivery |
+| Storage (`storage-js`) | ~80% | buckets, upload/download, signed URLs + signed uploads, list/move/copy/remove, size/MIME limits | resumable (TUS) uploads, image transformations |
+| Realtime (`realtime-js`) | ~70% | postgres_changes with filters, broadcast (incl. binary), presence, v1+v2 serializers | RLS-filtered fan-out (WALRUS), private channel auth, DB-triggered broadcast |
+| Edge Functions (`functions-js`) | 0% | - | everything (`supabase.functions.invoke()`) |
+
+**Overall: roughly 65% of the SDK surface - but ~90% of what a typical CRUD + auth + storage + realtime app actually calls.** The biggest real-world gaps are OAuth logins and edge functions.
+
+## Known gaps
+
+- `postgres_changes` does not apply RLS to fan-out (all subscribers see change events); hosted Supabase filters via WALRUS.
+- Spread embeds (`...rel(col)`) support flat column lists only; aggregate functions in `select` are not implemented.
+- Auth: no OAuth providers, magic links, or OTP (endpoints accept and no-op); no email delivery.
+- `pg_notify` payloads cap at ~8 kB - realtime events for larger rows arrive with `record: null` and an `errors` entry, like Supabase's "payload too large".
+- One writer at a time: PGlite is single-connection, and the native engine currently serializes requests over one connection for parity (a connection pool is a straightforward future upgrade). Fine for dev tools and small apps, not for high-concurrency production.
+
+## Tests
+
+53 integration tests + 4 realtime e2e tests run the real `@supabase/supabase-js` against the backend (REST via in-process fetch, realtime over actual WebSockets):
+
+```bash
+npm test
+```
+
+## Why
+
+1. A lighter Supabase for local dev and self-contained apps - `npx tinbase start` instead of Docker Compose.
+2. The whole backend can run **in the browser** (PGlite WASM + fetch-handler architecture), e.g. inside [lifo.sh](https://lifo.sh).

package/assets/logo.svg

@@ -0,0 +1,18 @@
+<svg width="120" height="120" viewBox="0 0 120 120" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <linearGradient id="tin" x1="24" y1="30" x2="96" y2="104" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#10b981"/>
+      <stop offset="1" stop-color="#047857"/>
+    </linearGradient>
+  </defs>
+  <!-- can body: the classic database cylinder, tin-sized -->
+  <path d="M24 34v56c0 8.8 16.1 16 36 16s36-7.2 36-16V34" fill="url(#tin)"/>
+  <!-- seam highlights -->
+  <path d="M24 62c0 8.8 16.1 16 36 16s36-7.2 36-16" stroke="#ffffff" stroke-opacity="0.35" stroke-width="4" fill="none"/>
+  <!-- lid -->
+  <ellipse cx="60" cy="34" rx="36" ry="16" fill="#34d399"/>
+  <ellipse cx="60" cy="34" rx="36" ry="16" stroke="#065f46" stroke-opacity="0.25" stroke-width="2"/>
+  <!-- pull tab -->
+  <circle cx="72" cy="31" r="7" fill="none" stroke="#065f46" stroke-width="4"/>
+  <rect x="54" y="27.5" width="14" height="5" rx="2.5" fill="#065f46" transform="rotate(8 54 30)"/>
+</svg>

package/dist/auth/handler.d.ts

@@ -0,0 +1,43 @@
+/**
+ * GoTrue-compatible auth endpoints (/auth/v1/*) — the subset supabase-js
+ * uses for email/password auth, sessions, and admin user management.
+ */
+import type { Database } from '../db/database.js';
+import type { RequestContext } from '../types.js';
+export interface AuthConfig {
+    jwtSecret: string;
+    siteUrl: string;
+    jwtExpiry: number;
+}
+interface UserRow {
+    id: string;
+    aud: string | null;
+    role: string | null;
+    email: string | null;
+    encrypted_password: string | null;
+    email_confirmed_at: Date | string | null;
+    last_sign_in_at: Date | string | null;
+    raw_app_meta_data: Record<string, unknown> | null;
+    raw_user_meta_data: Record<string, unknown> | null;
+    created_at: Date | string | null;
+    updated_at: Date | string | null;
+    phone: string | null;
+    phone_confirmed_at: Date | string | null;
+    is_anonymous: boolean | null;
+}
+export declare class AuthHandler {
+    private db;
+    private config;
+    constructor(db: Database, config: AuthConfig);
+    handle(req: Request, ctx: RequestContext, url: URL): Promise<Response>;
+    private signup;
+    private token;
+    private getUser;
+    private updateUser;
+    private logout;
+    private admin;
+    private userFromBearer;
+    userJson(u: UserRow): Record<string, unknown>;
+    private sessionFor;
+}
+export {};

package/dist/auth/handler.js

@@ -0,0 +1,291 @@
+import { randomToken, signJwt, verifyJwt } from '../jwt.js';
+import { hashPassword, verifyPassword } from './password.js';
+function authError(status, errorCode, msg) {
+    return json(status, { code: status, error_code: errorCode, msg });
+}
+function json(status, body) {
+    return new Response(status === 204 ? null : JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json; charset=utf-8' },
+    });
+}
+function iso(v) {
+    if (v === null || v === undefined)
+        return null;
+    return v instanceof Date ? v.toISOString() : new Date(v).toISOString();
+}
+export class AuthHandler {
+    db;
+    config;
+    constructor(db, config) {
+        this.db = db;
+        this.config = config;
+    }
+    async handle(req, ctx, url) {
+        const path = url.pathname.replace(/^\/auth\/v1\/?/, '').replace(/\/+$/, '');
+        const method = req.method.toUpperCase();
+        try {
+            if (path === 'health')
+                return json(200, { name: 'tinbase-auth', version: '0.1.0', description: 'GoTrue-compatible auth' });
+            if (path === 'settings') {
+                return json(200, {
+                    external: { email: true, phone: false, anonymous_users: true },
+                    disable_signup: false,
+                    autoconfirm: true,
+                    mailer_autoconfirm: true,
+                });
+            }
+            if (path === 'signup' && method === 'POST')
+                return await this.signup(req);
+            if (path === 'token' && method === 'POST')
+                return await this.token(req, url);
+            if (path === 'user' && method === 'GET')
+                return await this.getUser(req);
+            if (path === 'user' && method === 'PUT')
+                return await this.updateUser(req);
+            if (path === 'logout' && method === 'POST')
+                return await this.logout(req);
+            if (['recover', 'otp', 'magiclink', 'resend'].includes(path) && method === 'POST') {
+                // no mail transport in tinbase — accept and no-op so flows don't crash
+                return json(200, {});
+            }
+            if (path.startsWith('admin/users'))
+                return await this.admin(req, ctx, path, method);
+            return authError(404, 'not_found', `unknown auth endpoint: ${path}`);
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            return authError(500, 'unexpected_failure', msg);
+        }
+    }
+    // ── flows ─────────────────────────────────────────────────────────────
+    async signup(req) {
+        const body = (await req.json().catch(() => ({})));
+        if (!body.email && !body.password) {
+            // supabase.auth.signInAnonymously()
+            const res = await this.db.query(`insert into auth.users (aud, role, raw_app_meta_data, raw_user_meta_data, is_anonymous, last_sign_in_at)
+         values ('authenticated', 'authenticated', '{}', $1, true, now())
+         returning *`, [JSON.stringify(body.data ?? {})]);
+            return json(200, await this.sessionFor(res.rows[0]));
+        }
+        if (!body.email || !body.password) {
+            return authError(400, 'validation_failed', 'Signup requires a valid email and password');
+        }
+        if (body.password.length < 6) {
+            return authError(422, 'weak_password', 'Password should be at least 6 characters.');
+        }
+        const email = body.email.toLowerCase().trim();
+        const existing = await this.db.query(`select id from auth.users where email = $1`, [email]);
+        if (existing.rows.length > 0) {
+            return authError(422, 'user_already_exists', 'User already registered');
+        }
+        const hashed = await hashPassword(body.password);
+        const res = await this.db.query(`insert into auth.users
+         (aud, role, email, encrypted_password, email_confirmed_at, last_sign_in_at,
+          raw_app_meta_data, raw_user_meta_data)
+       values ('authenticated', 'authenticated', $1, $2, now(), now(),
+               '{"provider":"email","providers":["email"]}', $3)
+       returning *`, [email, hashed, JSON.stringify(body.data ?? {})]);
+        return json(200, await this.sessionFor(res.rows[0]));
+    }
+    async token(req, url) {
+        const grantType = url.searchParams.get('grant_type');
+        const body = (await req.json().catch(() => ({})));
+        if (grantType === 'password') {
+            const email = (body.email ?? '').toLowerCase().trim();
+            const res = await this.db.query(`select * from auth.users where email = $1`, [email]);
+            const user = res.rows[0];
+            if (!user || !user.encrypted_password || !(await verifyPassword(body.password ?? '', user.encrypted_password))) {
+                return authError(400, 'invalid_credentials', 'Invalid login credentials');
+            }
+            await this.db.query(`update auth.users set last_sign_in_at = now() where id = $1`, [user.id]);
+            return json(200, await this.sessionFor(user));
+        }
+        if (grantType === 'refresh_token') {
+            const token = body.refresh_token;
+            if (!token)
+                return authError(400, 'validation_failed', 'refresh_token required');
+            const res = await this.db.query(`select rt.*, u.id as uid from auth.refresh_tokens rt
+         join auth.users u on u.id = rt.user_id
+         where rt.token = $1`, [token]);
+            const row = res.rows[0];
+            if (!row || row.revoked) {
+                return authError(400, 'refresh_token_not_found', 'Invalid Refresh Token: Refresh Token Not Found');
+            }
+            await this.db.query(`update auth.refresh_tokens set revoked = true, updated_at = now() where token = $1`, [token]);
+            const ures = await this.db.query(`select * from auth.users where id = $1`, [row.user_id]);
+            return json(200, await this.sessionFor(ures.rows[0], token));
+        }
+        return authError(400, 'invalid_grant', `unsupported grant_type: ${grantType}`);
+    }
+    async getUser(req) {
+        const user = await this.userFromBearer(req);
+        if (!user)
+            return authError(401, 'no_authorization', 'Invalid or expired token');
+        return json(200, this.userJson(user));
+    }
+    async updateUser(req) {
+        const user = await this.userFromBearer(req);
+        if (!user)
+            return authError(401, 'no_authorization', 'Invalid or expired token');
+        const body = (await req.json().catch(() => ({})));
+        const sets = [];
+        const params = [];
+        if (body.email) {
+            params.push(body.email.toLowerCase().trim());
+            sets.push(`email = $${params.length}, email_confirmed_at = now()`);
+        }
+        if (body.password) {
+            if (body.password.length < 6) {
+                return authError(422, 'weak_password', 'Password should be at least 6 characters.');
+            }
+            params.push(await hashPassword(body.password));
+            sets.push(`encrypted_password = $${params.length}`);
+        }
+        if (body.data) {
+            params.push(JSON.stringify(body.data));
+            sets.push(`raw_user_meta_data = coalesce(raw_user_meta_data, '{}'::jsonb) || $${params.length}::jsonb`);
+        }
+        if (sets.length === 0)
+            return json(200, this.userJson(user));
+        params.push(user.id);
+        const res = await this.db.query(`update auth.users set ${sets.join(', ')}, updated_at = now() where id = $${params.length} returning *`, params);
+        return json(200, this.userJson(res.rows[0]));
+    }
+    async logout(req) {
+        const user = await this.userFromBearer(req);
+        if (user) {
+            await this.db.query(`update auth.refresh_tokens set revoked = true where user_id = $1`, [user.id]);
+        }
+        return new Response(null, { status: 204 });
+    }
+    // ── admin ─────────────────────────────────────────────────────────────
+    async admin(req, ctx, path, method) {
+        if (ctx.role !== 'service_role') {
+            return authError(403, 'insufficient_permissions', 'Admin endpoints require the service_role key');
+        }
+        const idMatch = path.match(/^admin\/users\/([0-9a-f-]{36})$/);
+        if (path === 'admin/users' && method === 'GET') {
+            const res = await this.db.query(`select * from auth.users order by created_at desc limit 1000`);
+            return json(200, { users: res.rows.map((u) => this.userJson(u)), aud: 'authenticated' });
+        }
+        if (path === 'admin/users' && method === 'POST') {
+            const body = (await req.json().catch(() => ({})));
+            if (!body.email)
+                return authError(400, 'validation_failed', 'email is required');
+            const hashed = body.password ? await hashPassword(body.password) : null;
+            const res = await this.db.query(`insert into auth.users
+           (aud, role, email, encrypted_password, email_confirmed_at, raw_app_meta_data, raw_user_meta_data)
+         values ('authenticated', 'authenticated', $1, $2, case when $3 then now() else null end, $4, $5)
+         returning *`, [
+                body.email.toLowerCase().trim(),
+                hashed,
+                body.email_confirm ?? true,
+                JSON.stringify({ provider: 'email', providers: ['email'], ...(body.app_metadata ?? {}) }),
+                JSON.stringify(body.user_metadata ?? {}),
+            ]);
+            return json(200, this.userJson(res.rows[0]));
+        }
+        if (idMatch && method === 'GET') {
+            const res = await this.db.query(`select * from auth.users where id = $1`, [idMatch[1]]);
+            if (res.rows.length === 0)
+                return authError(404, 'user_not_found', 'User not found');
+            return json(200, this.userJson(res.rows[0]));
+        }
+        if (idMatch && method === 'PUT') {
+            const body = (await req.json().catch(() => ({})));
+            const sets = [];
+            const params = [];
+            if (typeof body.email === 'string') {
+                params.push(body.email.toLowerCase().trim());
+                sets.push(`email = $${params.length}`);
+            }
+            if (typeof body.password === 'string') {
+                params.push(await hashPassword(body.password));
+                sets.push(`encrypted_password = $${params.length}`);
+            }
+            if (body.user_metadata) {
+                params.push(JSON.stringify(body.user_metadata));
+                sets.push(`raw_user_meta_data = $${params.length}::jsonb`);
+            }
+            if (body.app_metadata) {
+                params.push(JSON.stringify(body.app_metadata));
+                sets.push(`raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb) || $${params.length}::jsonb`);
+            }
+            if (body.email_confirm === true)
+                sets.push(`email_confirmed_at = now()`);
+            if (sets.length === 0)
+                return authError(400, 'validation_failed', 'nothing to update');
+            params.push(idMatch[1]);
+            const res = await this.db.query(`update auth.users set ${sets.join(', ')}, updated_at = now() where id = $${params.length} returning *`, params);
+            if (res.rows.length === 0)
+                return authError(404, 'user_not_found', 'User not found');
+            return json(200, this.userJson(res.rows[0]));
+        }
+        if (idMatch && method === 'DELETE') {
+            await this.db.query(`delete from auth.users where id = $1`, [idMatch[1]]);
+            return json(200, {});
+        }
+        return authError(404, 'not_found', `unknown admin endpoint`);
+    }
+    // ── helpers ───────────────────────────────────────────────────────────
+    async userFromBearer(req) {
+        const authz = req.headers.get('authorization') ?? '';
+        if (!authz.toLowerCase().startsWith('bearer '))
+            return null;
+        const claims = await verifyJwt(authz.slice(7), this.config.jwtSecret);
+        if (!claims?.sub)
+            return null;
+        const res = await this.db.query(`select * from auth.users where id = $1`, [claims.sub]);
+        return res.rows[0] ?? null;
+    }
+    userJson(u) {
+        return {
+            id: u.id,
+            aud: u.aud ?? 'authenticated',
+            role: u.role ?? 'authenticated',
+            email: u.email ?? '',
+            email_confirmed_at: iso(u.email_confirmed_at),
+            phone: u.phone ?? '',
+            confirmed_at: iso(u.email_confirmed_at),
+            last_sign_in_at: iso(u.last_sign_in_at),
+            app_metadata: u.raw_app_meta_data ?? {},
+            user_metadata: u.raw_user_meta_data ?? {},
+            identities: [],
+            created_at: iso(u.created_at),
+            updated_at: iso(u.updated_at),
+            is_anonymous: u.is_anonymous ?? false,
+        };
+    }
+    async sessionFor(user, parentToken) {
+        const now = Math.floor(Date.now() / 1000);
+        const expiresAt = now + this.config.jwtExpiry;
+        const sessionId = crypto.randomUUID();
+        const claims = {
+            iss: `${this.config.siteUrl}/auth/v1`,
+            sub: user.id,
+            aud: user.aud ?? 'authenticated',
+            exp: expiresAt,
+            iat: now,
+            email: user.email ?? '',
+            phone: user.phone ?? '',
+            app_metadata: user.raw_app_meta_data ?? {},
+            user_metadata: user.raw_user_meta_data ?? {},
+            role: user.role ?? 'authenticated',
+            is_anonymous: user.is_anonymous ?? false,
+            session_id: sessionId,
+        };
+        const accessToken = await signJwt(claims, this.config.jwtSecret);
+        const refreshToken = randomToken(24);
+        await this.db.query(`insert into auth.refresh_tokens (token, user_id, parent, session_id) values ($1, $2, $3, $4)`, [refreshToken, user.id, parentToken ?? null, sessionId]);
+        return {
+            access_token: accessToken,
+            token_type: 'bearer',
+            expires_in: this.config.jwtExpiry,
+            expires_at: expiresAt,
+            refresh_token: refreshToken,
+            user: this.userJson(user),
+        };
+    }
+}
+//# sourceMappingURL=handler.js.map

package/dist/auth/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../src/auth/handler.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAkB,MAAM,WAAW,CAAA;AAE3E,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAyB5D,SAAS,SAAS,CAAC,MAAc,EAAE,SAAiB,EAAE,GAAW;IAC/D,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAA;AACnE,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,IAAa;IACzC,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAChE,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE;KAC/D,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,GAAG,CAAC,CAAuB;IAClC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC9C,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;AACxE,CAAC;AAED,MAAM,OAAO,WAAW;IAEZ;IACA;IAFV,YACU,EAAY,EACZ,MAAkB;QADlB,OAAE,GAAF,EAAE,CAAU;QACZ,WAAM,GAAN,MAAM,CAAY;IACzB,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,GAAY,EAAE,GAAmB,EAAE,GAAQ;QACtD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAA;QAEvC,IAAI,CAAC;YACH,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC,CAAA;YAC1H,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC,GAAG,EAAE;oBACf,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;oBAC9D,cAAc,EAAE,KAAK;oBACrB,WAAW,EAAE,IAAI;oBACjB,kBAAkB,EAAE,IAAI;iBACzB,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,IAAI,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACzE,IAAI,IAAI,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC5E,IAAI,IAAI,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACvE,IAAI,IAAI,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC1E,IAAI,IAAI,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACzE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAClF,uEAAuE;gBACvE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YACtB,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;gBAAE,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;YACnF,OAAO,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,0BAA0B,IAAI,EAAE,CAAC,CAAA;QACtE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YACtD,OAAO,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IAED,yEAAyE;IAEjE,KAAK,CAAC,MAAM,CAAC,GAAY;QAC/B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAI/C,CAAA;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,oCAAoC;YACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAC7B;;qBAEa,EACb,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAClC,CAAA;YACD,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAY,CAAC,CAAC,CAAA;QACjE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC,GAAG,EAAE,mBAAmB,EAAE,4CAA4C,CAAC,CAAA;QAC1F,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,2CAA2C,CAAC,CAAA;QACrF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;QAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;QAC3F,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,yBAAyB,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAC7B;;;;;mBAKa,EACb,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CACjD,CAAA;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAY,CAAC,CAAC,CAAA;IACjE,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAAY,EAAE,GAAQ;QACxC,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA2B,CAAA;QAE3E,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;YACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;YACrF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAwB,CAAA;YAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;gBAC/G,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,2BAA2B,CAAC,CAAA;YAC3E,CAAC;YACD,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,6DAA6D,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;YAC7F,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;QAC/C,CAAC;QAED,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAA;YAChC,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,mBAAmB,EAAE,wBAAwB,CAAC,CAAA;YAChF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAC7B;;6BAEqB,EACrB,CAAC,KAAK,CAAC,CACR,CAAA;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAsD,CAAA;YAC5E,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,gDAAgD,CAAC,CAAA;YACpG,CAAC;YACD,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,oFAAoF,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;YAClH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;YACzF,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAY,EAAE,KAAK,CAAC,CAAC,CAAA;QACzE,CAAC;QAED,OAAO,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,2BAA2B,SAAS,EAAE,CAAC,CAAA;IAChF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAY;QAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,0BAA0B,CAAC,CAAA;QAChF,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IACvC,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,GAAY;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,0BAA0B,CAAC,CAAA;QAChF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAI/C,CAAA;QACD,MAAM,IAAI,GAAa,EAAE,CAAA;QACzB,MAAM,MAAM,GAAc,EAAE,CAAA;QAC5B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;YAC5C,IAAI,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,MAAM,8BAA8B,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,OAAO,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,2CAA2C,CAAC,CAAA;YACrF,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC9C,IAAI,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QACrD,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YACtC,IAAI,CAAC,IAAI,CAAC,sEAAsE,MAAM,CAAC,MAAM,SAAS,CAAC,CAAA;QACzG,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;QAC5D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAC7B,yBAAyB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,MAAM,cAAc,EACvG,MAAM,CACP,CAAA;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAY,CAAC,CAAC,CAAA;IACzD,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,GAAY;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,kEAAkE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QACpG,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED,yEAAyE;IAEjE,KAAK,CAAC,KAAK,CAAC,GAAY,EAAE,GAAmB,EAAE,IAAY,EAAE,MAAc;QACjF,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC,GAAG,EAAE,0BAA0B,EAAE,8CAA8C,CAAC,CAAA;QACnG,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAA;QAE7D,IAAI,IAAI,KAAK,aAAa,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAA;YAC/F,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAG,GAAG,CAAC,IAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAA;QACzG,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAM/C,CAAA;YACD,IAAI,CAAC,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAA;YAChF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACvE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAC7B;;;qBAGa,EACb;gBACE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;gBAC/B,MAAM;gBACN,IAAI,CAAC,aAAa,IAAI,IAAI;gBAC1B,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;gBACzF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;aACzC,CACF,CAAA;YACD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAY,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,IAAI,OAAO,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACvF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;YACpF,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAY,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,IAAI,OAAO,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAA;YAC5E,MAAM,IAAI,GAAa,EAAE,CAAA;YACzB,MAAM,MAAM,GAAc,EAAE,CAAA;YAC5B,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC5C,IAAI,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;YACxC,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;gBAC9C,IAAI,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;YACrD,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;gBAC/C,IAAI,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,MAAM,SAAS,CAAC,CAAA;YAC5D,CAAC;YACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;gBAC9C,IAAI,CAAC,IAAI,CAAC,oEAAoE,MAAM,CAAC,MAAM,SAAS,CAAC,CAAA;YACvG,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;YACxE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAA;YACtF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;YACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAC7B,yBAAyB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,MAAM,cAAc,EACvG,MAAM,CACP,CAAA;YACD,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;YACpF,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAY,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,IAAI,OAAO,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,sCAAsC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACzE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QACtB,CAAC;QACD,OAAO,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAA;IAC9D,CAAC;IAED,yEAAyE;IAEjE,KAAK,CAAC,cAAc,CAAC,GAAY;QACvC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAA;QACpD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAA;QAC3D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACrE,IAAI,CAAC,MAAM,EAAE,GAAG;YAAE,OAAO,IAAI,CAAA;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QACvF,OAAQ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAa,IAAI,IAAI,CAAA;IACzC,CAAC;IAED,QAAQ,CAAC,CAAU;QACjB,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,eAAe;YAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,eAAe;YAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;YACpB,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC;YAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;YACpB,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC;YACvC,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;YACvC,YAAY,EAAE,CAAC,CAAC,iBAAiB,IAAI,EAAE;YACvC,aAAa,EAAE,CAAC,CAAC,kBAAkB,IAAI,EAAE;YACzC,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YAC7B,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YAC7B,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,KAAK;SACtC,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,WAAoB;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACzC,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAA;QAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QACrC,MAAM,MAAM,GAAc;YACxB,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,UAAU;YACrC,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,eAAe;YAChC,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,GAAG;YACR,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,YAAY,EAAE,IAAI,CAAC,iBAAiB,IAAI,EAAE;YAC1C,aAAa,EAAE,IAAI,CAAC,kBAAkB,IAAI,EAAE;YAC5C,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,eAAe;YAClC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;YACxC,UAAU,EAAE,SAAS;SACtB,CAAA;QACD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAChE,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QACpC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB,8FAA8F,EAC9F,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,IAAI,IAAI,EAAE,SAAS,CAAC,CACxD,CAAA;QACD,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YACjC,UAAU,EAAE,SAAS;YACrB,aAAa,EAAE,YAAY;YAC3B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;SAC1B,CAAA;IACH,CAAC;CACF"}

package/dist/auth/password.d.ts

@@ -0,0 +1,3 @@
+/** PBKDF2-SHA256 password hashing on WebCrypto (portable, no native deps). */
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(password: string, stored: string): Promise<boolean>;

package/dist/auth/password.js

@@ -0,0 +1,40 @@
+/** PBKDF2-SHA256 password hashing on WebCrypto (portable, no native deps). */
+const ITERATIONS = 100_000;
+function toHex(bytes) {
+    return [...bytes].map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+function fromHex(hex) {
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++)
+        out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    return out;
+}
+async function derive(password, salt, iterations) {
+    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(password), 'PBKDF2', false, [
+        'deriveBits',
+    ]);
+    const bits = await crypto.subtle.deriveBits({ name: 'PBKDF2', hash: 'SHA-256', salt: salt, iterations }, key, 256);
+    return new Uint8Array(bits);
+}
+export async function hashPassword(password) {
+    const salt = crypto.getRandomValues(new Uint8Array(16));
+    const hash = await derive(password, salt, ITERATIONS);
+    return `pbkdf2$${ITERATIONS}$${toHex(salt)}$${toHex(hash)}`;
+}
+export async function verifyPassword(password, stored) {
+    const parts = stored.split('$');
+    if (parts.length !== 4 || parts[0] !== 'pbkdf2')
+        return false;
+    const iterations = parseInt(parts[1], 10);
+    const salt = fromHex(parts[2]);
+    const expected = parts[3];
+    const hash = await derive(password, salt, iterations);
+    const actual = toHex(hash);
+    if (actual.length !== expected.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < actual.length; i++)
+        diff |= actual.charCodeAt(i) ^ expected.charCodeAt(i);
+    return diff === 0;
+}
+//# sourceMappingURL=password.js.map

package/dist/auth/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/auth/password.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAE9E,MAAM,UAAU,GAAG,OAAO,CAAA;AAE1B,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACxE,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACvF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB,EAAE,IAAgB,EAAE,UAAkB;IAC1E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;QACpG,YAAY;KACb,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAoB,EAAE,UAAU,EAAE,EAC3E,GAAG,EACH,GAAG,CACJ,CAAA;IACD,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACvD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACrD,OAAO,UAAU,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAA;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACzB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;IAC1B,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACnD,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7F,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};