tinbase 0.1.0

package/dist/cli.js

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+/**
+ * tinbase CLI — a Docker-free Supabase-compatible backend.
+ *
+ *   tinbase start     start the server (applies pending migrations first)
+ *   tinbase migrate   apply pending migrations and exit
+ *   tinbase status    show applied migrations
+ *   tinbase keys      print anon/service_role keys for the JWT secret
+ */
+import { mkdir } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { createBackend } from './index.js';
+import { createNativeEngine } from './node/native/engine.js';
+import { FsStorageDriver } from './node/fs-driver.js';
+import { loadSupabaseProject } from './node/project.js';
+import { serve } from './node/server.js';
+import { serveBun } from './node/bun-server.js';
+const IS_BUN = typeof globalThis.Bun !== 'undefined';
+// single-file builds ship without the WASM engine; native is the default there
+const IS_BINARY = process.env.TINBASE_SINGLE_BINARY === '1';
+import { signJwt } from './jwt.js';
+import { DEFAULT_JWT_SECRET } from './types.js';
+function parseArgs(argv) {
+    const args = [...argv];
+    const command = args[0] && !args[0].startsWith('-') ? args.shift() : 'start';
+    const opts = {
+        command,
+        port: 54321,
+        host: '127.0.0.1',
+        dir: process.cwd(),
+        dataDir: undefined,
+        storageDir: '',
+        jwtSecret: process.env.TINBASE_JWT_SECRET ?? DEFAULT_JWT_SECRET,
+        memory: false,
+        engine: process.env.TINBASE_ENGINE ?? (IS_BINARY ? 'native' : 'wasm'),
+    };
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        const next = () => args[++i];
+        if (a === '--port' || a === '-p')
+            opts.port = parseInt(next(), 10);
+        else if (a === '--host')
+            opts.host = next();
+        else if (a === '--dir')
+            opts.dir = resolve(next());
+        else if (a === '--data-dir')
+            opts.dataDir = resolve(next());
+        else if (a === '--storage-dir')
+            opts.storageDir = resolve(next());
+        else if (a === '--jwt-secret')
+            opts.jwtSecret = next();
+        else if (a === '--memory')
+            opts.memory = true;
+        else if (a === '--engine') {
+            const v = next();
+            if (v !== 'wasm' && v !== 'native') {
+                console.error(`--engine must be wasm or native, got: ${v}`);
+                process.exit(1);
+            }
+            opts.engine = v;
+        }
+        else if (a === '--help' || a === '-h') {
+            printHelp();
+            process.exit(0);
+        }
+        else {
+            console.error(`unknown option: ${a}`);
+            process.exit(1);
+        }
+    }
+    if (!opts.dataDir && !opts.memory)
+        opts.dataDir = join(opts.dir, '.tinbase', 'db');
+    if (!opts.storageDir)
+        opts.storageDir = join(opts.dir, '.tinbase', 'storage');
+    return opts;
+}
+function printHelp() {
+    console.log(`tinbase — Supabase-compatible backend on PGlite (no Docker)
+
+Usage: tinbase [command] [options]
+
+Commands:
+  start      start the server (default)
+  migrate    apply pending supabase/migrations/*.sql and exit
+  status     list applied migrations
+  keys       print anon and service_role keys
+
+Options:
+  -p, --port <n>        port to listen on (default 54321)
+      --host <host>     host to bind (default 127.0.0.1)
+      --dir <path>      project directory containing supabase/ (default cwd)
+      --data-dir <path> PGlite data directory (default <dir>/.tinbase/db)
+      --storage-dir <p> storage files directory (default <dir>/.tinbase/storage)
+      --jwt-secret <s>  JWT secret (or TINBASE_JWT_SECRET env var)
+      --memory          in-memory database (no persistence, wasm engine only)
+      --engine <e>      wasm (PGlite, default) or native (embedded Postgres,
+                        ~4x lighter memory; downloads binaries on first run)
+`);
+}
+async function main() {
+    const opts = parseArgs(process.argv.slice(2));
+    if (opts.command === 'keys') {
+        const now = Math.floor(Date.now() / 1000);
+        const exp = now + 10 * 365 * 24 * 3600;
+        console.log('anon key:');
+        console.log(await signJwt({ iss: 'supabase', ref: 'tinbase', role: 'anon', iat: now, exp }, opts.jwtSecret));
+        console.log('\nservice_role key:');
+        console.log(await signJwt({ iss: 'supabase', ref: 'tinbase', role: 'service_role', iat: now, exp }, opts.jwtSecret));
+        return;
+    }
+    const project = await loadSupabaseProject(opts.dir);
+    if (opts.dataDir)
+        await mkdir(opts.dataDir, { recursive: true });
+    await mkdir(opts.storageDir, { recursive: true });
+    const engine = opts.engine === 'native'
+        ? await createNativeEngine({
+            dataDir: join(opts.dir, '.tinbase', 'pgdata'),
+            log: (msg) => console.log(`  ${msg}`),
+        })
+        : undefined;
+    const backend = await createBackend({
+        engine,
+        dataDir: opts.memory ? undefined : opts.dataDir,
+        jwtSecret: opts.jwtSecret,
+        siteUrl: `http://${opts.host}:${opts.port}`,
+        migrations: project.migrations,
+        seedSql: project.seedSql,
+        storageDriver: new FsStorageDriver(opts.storageDir),
+        log: (msg) => console.log(`  ${msg}`),
+    });
+    if (opts.command === 'migrate') {
+        const applied = await backend.db.listAppliedMigrations();
+        console.log(`${applied.length} migration(s) applied.`);
+        await backend.close();
+        return;
+    }
+    if (opts.command === 'status') {
+        const applied = await backend.db.listAppliedMigrations();
+        if (applied.length === 0)
+            console.log('no migrations applied');
+        for (const m of applied)
+            console.log(`${m.version}  ${m.name ?? ''}`);
+        await backend.close();
+        return;
+    }
+    if (opts.command !== 'start') {
+        console.error(`unknown command: ${opts.command}`);
+        printHelp();
+        process.exit(1);
+    }
+    const server = IS_BUN
+        ? await serveBun(backend, { port: opts.port, host: opts.host })
+        : await serve(backend, { port: opts.port, host: opts.host });
+    console.log(`
+  tinbase running
+
+           API URL: ${server.url}
+            Engine: ${opts.engine === 'native' ? 'native postgres' : `PGlite (${opts.memory ? 'in-memory' : opts.dataDir})`}
+           Storage: ${opts.storageDir}
+        Migrations: ${project.migrations.length} file(s)
+
+          anon key: ${backend.anonKey}
+  service_role key: ${backend.serviceRoleKey}
+
+  Use with supabase-js:
+    const supabase = createClient('${server.url}', '<anon key>')
+`);
+    const shutdown = async () => {
+        console.log('\nshutting down…');
+        await server.close().catch(() => { });
+        await backend.close().catch(() => { });
+        process.exit(0);
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+}
+main().catch((e) => {
+    console.error(e);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,MAAM,MAAM,GAAG,OAAQ,UAAgC,CAAC,GAAG,KAAK,WAAW,CAAA;AAC3E,+EAA+E;AAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAc/C,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;IACtB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAG,CAAC,CAAC,CAAC,OAAO,CAAA;IAC7E,MAAM,IAAI,GAAe;QACvB,OAAO;QACP,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,kBAAkB;QAC/D,MAAM,EAAE,KAAK;QACb,MAAM,EAAG,OAAO,CAAC,GAAG,CAAC,cAAoC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;KAC7F,CAAA;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAC5B,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;aAC7D,IAAI,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAA;aACtC,IAAI,CAAC,KAAK,OAAO;YAAE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;aAC7C,IAAI,CAAC,KAAK,YAAY;YAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;aACtD,IAAI,CAAC,KAAK,eAAe;YAAE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;aAC5D,IAAI,CAAC,KAAK,cAAc;YAAE,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,CAAA;aACjD,IAAI,CAAC,KAAK,UAAU;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;aACxC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;YAChB,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,EAAE,CAAC,CAAA;gBAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACjB,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,CAAC,CAAA;QACjB,CAAC;aACI,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,SAAS,EAAE,CAAA;YACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAA;YACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;IAClF,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;IAC7E,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;CAoBb,CAAC,CAAA;AACF,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAE7C,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACzC,MAAM,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,CAAA;QACtC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACxB,OAAO,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;QAC5G,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAA;QAClC,OAAO,CAAC,GAAG,CACT,MAAM,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CACxG,CAAA;QACD,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnD,IAAI,IAAI,CAAC,OAAO;QAAE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAChE,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEjD,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,KAAK,QAAQ;QACtB,CAAC,CAAC,MAAM,kBAAkB,CAAC;YACvB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC;YAC7C,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;SACtC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IAEf,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;QAClC,MAAM;QACN,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;QAC/C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE;QAC3C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;QACnD,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;KACtC,CAAC,CAAA;IAEF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAA;QACxD,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,wBAAwB,CAAC,CAAA;QACtD,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;QACrB,OAAM;IACR,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAA;QACxD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;QAC9D,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;QACrE,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;QACrB,OAAM;IACR,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QACjD,SAAS,EAAE,CAAA;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM;QACnB,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/D,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9D,OAAO,CAAC,GAAG,CAAC;;;sBAGQ,MAAM,CAAC,GAAG;sBACV,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG;sBACrG,IAAI,CAAC,UAAU;sBACf,OAAO,CAAC,UAAU,CAAC,MAAM;;sBAEzB,OAAO,CAAC,OAAO;sBACf,OAAO,CAAC,cAAc;;;qCAGP,MAAM,CAAC,GAAG;CAC9C,CAAC,CAAA;IAEA,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;QAC/B,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACpC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAA;IACD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;AACjC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/db/bootstrap.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Idempotent bootstrap SQL that shapes a fresh PGlite database like a
+ * Supabase project: roles, auth schema, storage schema, helper functions,
+ * migration bookkeeping, and the realtime CDC plumbing.
+ */
+export declare const BOOTSTRAP_SQL = "\n-- \u2500\u2500 Roles \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ndo $$\nbegin\n  if not exists (select from pg_roles where rolname = 'anon') then\n    create role anon nologin noinherit;\n  end if;\n  if not exists (select from pg_roles where rolname = 'authenticated') then\n    create role authenticated nologin noinherit;\n  end if;\n  if not exists (select from pg_roles where rolname = 'service_role') then\n    create role service_role nologin noinherit bypassrls;\n  end if;\nend $$;\n\ngrant usage on schema public to anon, authenticated, service_role;\ngrant all on all tables in schema public to anon, authenticated, service_role;\ngrant all on all sequences in schema public to anon, authenticated, service_role;\ngrant execute on all functions in schema public to anon, authenticated, service_role;\n\nalter default privileges in schema public\n  grant all on tables to anon, authenticated, service_role;\nalter default privileges in schema public\n  grant all on sequences to anon, authenticated, service_role;\nalter default privileges in schema public\n  grant execute on functions to anon, authenticated, service_role;\n\n-- \u2500\u2500 Auth schema (GoTrue-compatible subset) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists auth;\n\ncreate table if not exists auth.users (\n  id uuid primary key default gen_random_uuid(),\n  aud text default 'authenticated',\n  role text default 'authenticated',\n  email text unique,\n  encrypted_password text,\n  email_confirmed_at timestamptz,\n  invited_at timestamptz,\n  confirmation_token text,\n  recovery_token text,\n  last_sign_in_at timestamptz,\n  raw_app_meta_data jsonb default '{}'::jsonb,\n  raw_user_meta_data jsonb default '{}'::jsonb,\n  is_super_admin boolean default false,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  phone text unique,\n  phone_confirmed_at timestamptz,\n  banned_until timestamptz,\n  deleted_at timestamptz,\n  is_anonymous boolean default false\n);\n\ncreate table if not exists auth.refresh_tokens (\n  id bigint generated by default as identity primary key,\n  token text unique not null,\n  user_id uuid not null references auth.users(id) on delete cascade,\n  parent text,\n  session_id uuid,\n  revoked boolean default false,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate index if not exists refresh_tokens_user_id_idx on auth.refresh_tokens(user_id);\n\ngrant usage on schema auth to anon, authenticated, service_role;\n\ncreate or replace function auth.jwt() returns jsonb\nlanguage sql stable as $$\n  select coalesce(\n    nullif(current_setting('request.jwt.claims', true), ''),\n    '{}'\n  )::jsonb\n$$;\n\ncreate or replace function auth.uid() returns uuid\nlanguage sql stable as $$\n  select nullif(auth.jwt() ->> 'sub', '')::uuid\n$$;\n\ncreate or replace function auth.role() returns text\nlanguage sql stable as $$\n  select coalesce(auth.jwt() ->> 'role', 'anon')\n$$;\n\ncreate or replace function auth.email() returns text\nlanguage sql stable as $$\n  select auth.jwt() ->> 'email'\n$$;\n\ngrant execute on function auth.jwt(), auth.uid(), auth.role(), auth.email()\n  to anon, authenticated, service_role;\n\n-- \u2500\u2500 Storage schema (storage-api-compatible subset) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists storage;\n\ncreate table if not exists storage.buckets (\n  id text primary key,\n  name text not null unique,\n  owner uuid,\n  public boolean default false,\n  file_size_limit bigint,\n  allowed_mime_types text[],\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists storage.objects (\n  id uuid primary key default gen_random_uuid(),\n  bucket_id text not null references storage.buckets(id),\n  name text not null,\n  owner uuid,\n  version text,\n  metadata jsonb default '{}'::jsonb,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  last_accessed_at timestamptz default now(),\n  unique (bucket_id, name)\n);\n\ncreate index if not exists objects_bucket_name_idx on storage.objects(bucket_id, name);\n\ngrant usage on schema storage to anon, authenticated, service_role;\ngrant select on storage.buckets to anon, authenticated, service_role;\ngrant all on storage.buckets to service_role;\ngrant all on storage.objects to anon, authenticated, service_role;\n\ncreate or replace function storage.foldername(name text) returns text[]\nlanguage sql immutable as $$\n  select (string_to_array(name, '/'))[1 : array_length(string_to_array(name, '/'), 1) - 1]\n$$;\n\ncreate or replace function storage.filename(name text) returns text\nlanguage sql immutable as $$\n  select (string_to_array(name, '/'))[array_length(string_to_array(name, '/'), 1)]\n$$;\n\ncreate or replace function storage.extension(name text) returns text\nlanguage sql immutable as $$\n  select reverse(split_part(reverse(storage.filename(name)), '.', 1))\n$$;\n\nalter table storage.objects enable row level security;\n\n-- Dev-friendly default policies. Replace them in your migrations to lock down.\ndo $$\nbegin\n  if not exists (select from pg_policies where schemaname = 'storage' and tablename = 'objects' and policyname = 'tinbase_authenticated_all') then\n    create policy tinbase_authenticated_all on storage.objects\n      for all to authenticated using (true) with check (true);\n  end if;\n  if not exists (select from pg_policies where schemaname = 'storage' and tablename = 'objects' and policyname = 'tinbase_public_read') then\n    create policy tinbase_public_read on storage.objects\n      for select to anon\n      using (bucket_id in (select id from storage.buckets where public));\n  end if;\nend $$;\n\n-- \u2500\u2500 Migration bookkeeping (same table the Supabase CLI uses) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists supabase_migrations;\n\ncreate table if not exists supabase_migrations.schema_migrations (\n  version text primary key,\n  name text,\n  statements text[],\n  applied_at timestamptz default now()\n);\n\ncreate table if not exists supabase_migrations.seed_files (\n  path text primary key,\n  hash text,\n  applied_at timestamptz default now()\n);\n\n-- \u2500\u2500 Realtime CDC plumbing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists tinbase;\n\ncreate or replace function tinbase.cdc_notify() returns trigger\nlanguage plpgsql security definer as $$\ndeclare\n  payload text;\nbegin\n  payload := json_build_object(\n    'schema', TG_TABLE_SCHEMA,\n    'table', TG_TABLE_NAME,\n    'type', TG_OP,\n    'commit_timestamp', to_char(now() at time zone 'utc', 'YYYY-MM-DD\"T\"HH24:MI:SS.MS\"Z\"'),\n    'record', case when TG_OP in ('INSERT', 'UPDATE') then row_to_json(NEW) else null end,\n    'old_record', case when TG_OP in ('UPDATE', 'DELETE') then row_to_json(OLD) else null end\n  )::text;\n  -- pg_notify payloads are capped at ~8kB; degrade like Supabase does.\n  if octet_length(payload) > 7500 then\n    payload := json_build_object(\n      'schema', TG_TABLE_SCHEMA,\n      'table', TG_TABLE_NAME,\n      'type', TG_OP,\n      'commit_timestamp', to_char(now() at time zone 'utc', 'YYYY-MM-DD\"T\"HH24:MI:SS.MS\"Z\"'),\n      'record', null,\n      'old_record', null,\n      'errors', json_build_array('Payload too large')\n    )::text;\n  end if;\n  perform pg_notify('tinbase_cdc', payload);\n  return coalesce(NEW, OLD);\nend $$;\n";

package/dist/db/bootstrap.js

@@ -0,0 +1,213 @@
+/**
+ * Idempotent bootstrap SQL that shapes a fresh PGlite database like a
+ * Supabase project: roles, auth schema, storage schema, helper functions,
+ * migration bookkeeping, and the realtime CDC plumbing.
+ */
+export const BOOTSTRAP_SQL = `
+-- ── Roles ────────────────────────────────────────────────────────────────
+do $$
+begin
+  if not exists (select from pg_roles where rolname = 'anon') then
+    create role anon nologin noinherit;
+  end if;
+  if not exists (select from pg_roles where rolname = 'authenticated') then
+    create role authenticated nologin noinherit;
+  end if;
+  if not exists (select from pg_roles where rolname = 'service_role') then
+    create role service_role nologin noinherit bypassrls;
+  end if;
+end $$;
+
+grant usage on schema public to anon, authenticated, service_role;
+grant all on all tables in schema public to anon, authenticated, service_role;
+grant all on all sequences in schema public to anon, authenticated, service_role;
+grant execute on all functions in schema public to anon, authenticated, service_role;
+
+alter default privileges in schema public
+  grant all on tables to anon, authenticated, service_role;
+alter default privileges in schema public
+  grant all on sequences to anon, authenticated, service_role;
+alter default privileges in schema public
+  grant execute on functions to anon, authenticated, service_role;
+
+-- ── Auth schema (GoTrue-compatible subset) ───────────────────────────────
+create schema if not exists auth;
+
+create table if not exists auth.users (
+  id uuid primary key default gen_random_uuid(),
+  aud text default 'authenticated',
+  role text default 'authenticated',
+  email text unique,
+  encrypted_password text,
+  email_confirmed_at timestamptz,
+  invited_at timestamptz,
+  confirmation_token text,
+  recovery_token text,
+  last_sign_in_at timestamptz,
+  raw_app_meta_data jsonb default '{}'::jsonb,
+  raw_user_meta_data jsonb default '{}'::jsonb,
+  is_super_admin boolean default false,
+  created_at timestamptz default now(),
+  updated_at timestamptz default now(),
+  phone text unique,
+  phone_confirmed_at timestamptz,
+  banned_until timestamptz,
+  deleted_at timestamptz,
+  is_anonymous boolean default false
+);
+
+create table if not exists auth.refresh_tokens (
+  id bigint generated by default as identity primary key,
+  token text unique not null,
+  user_id uuid not null references auth.users(id) on delete cascade,
+  parent text,
+  session_id uuid,
+  revoked boolean default false,
+  created_at timestamptz default now(),
+  updated_at timestamptz default now()
+);
+
+create index if not exists refresh_tokens_user_id_idx on auth.refresh_tokens(user_id);
+
+grant usage on schema auth to anon, authenticated, service_role;
+
+create or replace function auth.jwt() returns jsonb
+language sql stable as $$
+  select coalesce(
+    nullif(current_setting('request.jwt.claims', true), ''),
+    '{}'
+  )::jsonb
+$$;
+
+create or replace function auth.uid() returns uuid
+language sql stable as $$
+  select nullif(auth.jwt() ->> 'sub', '')::uuid
+$$;
+
+create or replace function auth.role() returns text
+language sql stable as $$
+  select coalesce(auth.jwt() ->> 'role', 'anon')
+$$;
+
+create or replace function auth.email() returns text
+language sql stable as $$
+  select auth.jwt() ->> 'email'
+$$;
+
+grant execute on function auth.jwt(), auth.uid(), auth.role(), auth.email()
+  to anon, authenticated, service_role;
+
+-- ── Storage schema (storage-api-compatible subset) ───────────────────────
+create schema if not exists storage;
+
+create table if not exists storage.buckets (
+  id text primary key,
+  name text not null unique,
+  owner uuid,
+  public boolean default false,
+  file_size_limit bigint,
+  allowed_mime_types text[],
+  created_at timestamptz default now(),
+  updated_at timestamptz default now()
+);
+
+create table if not exists storage.objects (
+  id uuid primary key default gen_random_uuid(),
+  bucket_id text not null references storage.buckets(id),
+  name text not null,
+  owner uuid,
+  version text,
+  metadata jsonb default '{}'::jsonb,
+  created_at timestamptz default now(),
+  updated_at timestamptz default now(),
+  last_accessed_at timestamptz default now(),
+  unique (bucket_id, name)
+);
+
+create index if not exists objects_bucket_name_idx on storage.objects(bucket_id, name);
+
+grant usage on schema storage to anon, authenticated, service_role;
+grant select on storage.buckets to anon, authenticated, service_role;
+grant all on storage.buckets to service_role;
+grant all on storage.objects to anon, authenticated, service_role;
+
+create or replace function storage.foldername(name text) returns text[]
+language sql immutable as $$
+  select (string_to_array(name, '/'))[1 : array_length(string_to_array(name, '/'), 1) - 1]
+$$;
+
+create or replace function storage.filename(name text) returns text
+language sql immutable as $$
+  select (string_to_array(name, '/'))[array_length(string_to_array(name, '/'), 1)]
+$$;
+
+create or replace function storage.extension(name text) returns text
+language sql immutable as $$
+  select reverse(split_part(reverse(storage.filename(name)), '.', 1))
+$$;
+
+alter table storage.objects enable row level security;
+
+-- Dev-friendly default policies. Replace them in your migrations to lock down.
+do $$
+begin
+  if not exists (select from pg_policies where schemaname = 'storage' and tablename = 'objects' and policyname = 'tinbase_authenticated_all') then
+    create policy tinbase_authenticated_all on storage.objects
+      for all to authenticated using (true) with check (true);
+  end if;
+  if not exists (select from pg_policies where schemaname = 'storage' and tablename = 'objects' and policyname = 'tinbase_public_read') then
+    create policy tinbase_public_read on storage.objects
+      for select to anon
+      using (bucket_id in (select id from storage.buckets where public));
+  end if;
+end $$;
+
+-- ── Migration bookkeeping (same table the Supabase CLI uses) ─────────────
+create schema if not exists supabase_migrations;
+
+create table if not exists supabase_migrations.schema_migrations (
+  version text primary key,
+  name text,
+  statements text[],
+  applied_at timestamptz default now()
+);
+
+create table if not exists supabase_migrations.seed_files (
+  path text primary key,
+  hash text,
+  applied_at timestamptz default now()
+);
+
+-- ── Realtime CDC plumbing ─────────────────────────────────────────────────
+create schema if not exists tinbase;
+
+create or replace function tinbase.cdc_notify() returns trigger
+language plpgsql security definer as $$
+declare
+  payload text;
+begin
+  payload := json_build_object(
+    'schema', TG_TABLE_SCHEMA,
+    'table', TG_TABLE_NAME,
+    'type', TG_OP,
+    'commit_timestamp', to_char(now() at time zone 'utc', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
+    'record', case when TG_OP in ('INSERT', 'UPDATE') then row_to_json(NEW) else null end,
+    'old_record', case when TG_OP in ('UPDATE', 'DELETE') then row_to_json(OLD) else null end
+  )::text;
+  -- pg_notify payloads are capped at ~8kB; degrade like Supabase does.
+  if octet_length(payload) > 7500 then
+    payload := json_build_object(
+      'schema', TG_TABLE_SCHEMA,
+      'table', TG_TABLE_NAME,
+      'type', TG_OP,
+      'commit_timestamp', to_char(now() at time zone 'utc', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
+      'record', null,
+      'old_record', null,
+      'errors', json_build_array('Payload too large')
+    )::text;
+  end if;
+  perform pg_notify('tinbase_cdc', payload);
+  return coalesce(NEW, OLD);
+end $$;
+`;
+//# sourceMappingURL=bootstrap.js.map

package/dist/db/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/db/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8M5B,CAAA"}

package/dist/db/database.d.ts

@@ -0,0 +1,83 @@
+import type { DbEngine, EngineResults } from './engine.js';
+import type { MigrationFile, RequestContext } from '../types.js';
+export interface ColumnInfo {
+    name: string;
+    udtName: string;
+    isNullable: boolean;
+    hasDefault: boolean;
+    isPrimaryKey: boolean;
+}
+export interface ForeignKey {
+    constraintName: string;
+    srcSchema: string;
+    srcTable: string;
+    srcColumns: string[];
+    tgtSchema: string;
+    tgtTable: string;
+    tgtColumns: string[];
+}
+export interface TableInfo {
+    schema: string;
+    name: string;
+    columns: ColumnInfo[];
+    primaryKey: string[];
+}
+export interface FunctionArg {
+    name: string;
+    type: string;
+}
+export interface FunctionInfo {
+    schema: string;
+    name: string;
+    returnsSet: boolean;
+    returnType: string;
+    /** pg_type.typtype: b=base, c=composite, p=pseudo, d=domain, e=enum */
+    returnTypType: string;
+    args: FunctionArg[];
+}
+export interface SchemaInfo {
+    tables: Map<string, TableInfo>;
+    foreignKeys: ForeignKey[];
+}
+export type Querier = (sql: string, params?: unknown[]) => Promise<EngineResults>;
+export interface CdcEvent {
+    schema: string;
+    table: string;
+    type: 'INSERT' | 'UPDATE' | 'DELETE';
+    commit_timestamp: string;
+    record: Record<string, unknown> | null;
+    old_record: Record<string, unknown> | null;
+    errors?: string[];
+}
+export declare class Database {
+    engine: DbEngine;
+    private schemaCache;
+    private fnCache;
+    private cdcListeners;
+    private cdcStarted;
+    private constructor();
+    /** Create a Database on PGlite (default) or any custom DbEngine. */
+    static create(dataDirOrEngine?: string | DbEngine): Promise<Database>;
+    /** Superuser query — used by auth/storage internals and introspection. */
+    query<T = any>(sql: string, params?: unknown[]): Promise<EngineResults<T>>;
+    exec(sql: string): Promise<unknown>;
+    /**
+     * Run `fn` inside a transaction with the request's Postgres role and JWT
+     * claims applied via SET LOCAL — this is what makes RLS behave exactly
+     * like hosted Supabase.
+     */
+    withContext<T>(ctx: RequestContext, fn: (q: Querier) => Promise<T>): Promise<T>;
+    runMigrations(migrations: MigrationFile[], seedSql?: string): Promise<string[]>;
+    listAppliedMigrations(): Promise<{
+        version: string;
+        name: string | null;
+    }[]>;
+    invalidateSchemaCache(): void;
+    getSchemaInfo(schema: string): Promise<SchemaInfo>;
+    getFunctions(schema: string, name: string): Promise<FunctionInfo[]>;
+    ensureCdcTrigger(schema: string, table: string): Promise<void>;
+    onCdcEvent(cb: (e: CdcEvent) => void): Promise<() => void>;
+    close(): Promise<void>;
+}
+export declare function quoteIdent(name: string): string;
+export declare function quoteLiteral(value: string): string;