tinbase 0.1.0

package/dist/db/database.js

@@ -0,0 +1,270 @@
+import { BOOTSTRAP_SQL } from './bootstrap.js';
+import { createPgliteEngine } from './pglite-engine.js';
+export class Database {
+    engine;
+    schemaCache = new Map();
+    fnCache = new Map();
+    cdcListeners = new Set();
+    cdcStarted = false;
+    constructor(engine) {
+        this.engine = engine;
+    }
+    /** Create a Database on PGlite (default) or any custom DbEngine. */
+    static async create(dataDirOrEngine) {
+        const engine = dataDirOrEngine && typeof dataDirOrEngine === 'object'
+            ? dataDirOrEngine
+            : await createPgliteEngine(dataDirOrEngine);
+        await engine.exec(BOOTSTRAP_SQL);
+        return new Database(engine);
+    }
+    /** Superuser query — used by auth/storage internals and introspection. */
+    query(sql, params) {
+        return this.engine.query(sql, params);
+    }
+    exec(sql) {
+        return this.engine.exec(sql);
+    }
+    /**
+     * Run `fn` inside a transaction with the request's Postgres role and JWT
+     * claims applied via SET LOCAL — this is what makes RLS behave exactly
+     * like hosted Supabase.
+     */
+    async withContext(ctx, fn) {
+        return this.engine.transaction(async (tx) => {
+            await tx.query(`select set_config('role', $1, true),
+                set_config('request.jwt.claims', $2, true)`, [ctx.role, ctx.claims ? JSON.stringify(ctx.claims) : '']);
+            return fn((sql, params) => tx.query(sql, params));
+        });
+    }
+    // ── Migrations (Supabase CLI conventions) ────────────────────────────
+    async runMigrations(migrations, seedSql) {
+        const applied = [];
+        const sorted = [...migrations].sort((a, b) => a.name.localeCompare(b.name));
+        for (const m of sorted) {
+            const version = m.name.match(/^(\d+)/)?.[1] ?? m.name;
+            const seen = await this.engine.query(`select 1 from supabase_migrations.schema_migrations where version = $1`, [version]);
+            if (seen.rows.length > 0)
+                continue;
+            await this.engine.transaction(async (tx) => {
+                await tx.exec(m.sql);
+                await tx.query(`insert into supabase_migrations.schema_migrations (version, name, statements)
+           values ($1, $2, $3)`, [version, m.name, [m.sql]]);
+            });
+            applied.push(m.name);
+        }
+        if (seedSql) {
+            const hash = await sha256Hex(seedSql);
+            const seen = await this.engine.query(`select 1 from supabase_migrations.seed_files where path = 'supabase/seed.sql' and hash = $1`, [hash]);
+            if (seen.rows.length === 0) {
+                await this.engine.transaction(async (tx) => {
+                    await tx.exec(seedSql);
+                    await tx.query(`insert into supabase_migrations.seed_files (path, hash) values ('supabase/seed.sql', $1)
+             on conflict (path) do update set hash = excluded.hash, applied_at = now()`, [hash]);
+                });
+                applied.push('seed.sql');
+            }
+        }
+        if (applied.length > 0)
+            this.invalidateSchemaCache();
+        return applied;
+    }
+    async listAppliedMigrations() {
+        const res = await this.engine.query(`select version, name from supabase_migrations.schema_migrations order by version`);
+        return res.rows;
+    }
+    // ── Introspection ────────────────────────────────────────────────────
+    invalidateSchemaCache() {
+        this.schemaCache.clear();
+        this.fnCache.clear();
+    }
+    async getSchemaInfo(schema) {
+        const cached = this.schemaCache.get(schema);
+        if (cached)
+            return cached;
+        const cols = await this.engine.query(`select table_name, column_name, udt_name, is_nullable,
+              column_default is not null as has_default
+       from information_schema.columns
+       where table_schema = $1
+       order by ordinal_position`, [schema]);
+        const pks = await this.engine.query(`select kcu.table_name, kcu.column_name
+       from information_schema.table_constraints tc
+       join information_schema.key_column_usage kcu
+         on kcu.constraint_name = tc.constraint_name
+        and kcu.constraint_schema = tc.constraint_schema
+       where tc.constraint_type = 'PRIMARY KEY' and tc.table_schema = $1`, [schema]);
+        const fks = await this.engine.query(`select
+         tc.constraint_name,
+         tc.table_schema as src_schema, tc.table_name as src_table,
+         kcu.column_name as src_column,
+         ccu.table_schema as tgt_schema, ccu.table_name as tgt_table,
+         ccu.column_name as tgt_column,
+         kcu.ordinal_position as ordinal
+       from information_schema.table_constraints tc
+       join information_schema.key_column_usage kcu
+         on kcu.constraint_name = tc.constraint_name
+        and kcu.constraint_schema = tc.constraint_schema
+       join information_schema.constraint_column_usage ccu
+         on ccu.constraint_name = tc.constraint_name
+        and ccu.constraint_schema = tc.constraint_schema
+       where tc.constraint_type = 'FOREIGN KEY'
+         and (tc.table_schema = $1 or ccu.table_schema = $1)
+       order by tc.constraint_name, kcu.ordinal_position`, [schema]);
+        const pkSet = new Map();
+        for (const pk of pks.rows) {
+            if (!pkSet.has(pk.table_name))
+                pkSet.set(pk.table_name, new Set());
+            pkSet.get(pk.table_name).add(pk.column_name);
+        }
+        const tables = new Map();
+        for (const c of cols.rows) {
+            if (!tables.has(c.table_name)) {
+                tables.set(c.table_name, {
+                    schema,
+                    name: c.table_name,
+                    columns: [],
+                    primaryKey: [...(pkSet.get(c.table_name) ?? [])],
+                });
+            }
+            tables.get(c.table_name).columns.push({
+                name: c.column_name,
+                udtName: c.udt_name,
+                isNullable: c.is_nullable === 'YES',
+                hasDefault: c.has_default,
+                isPrimaryKey: pkSet.get(c.table_name)?.has(c.column_name) ?? false,
+            });
+        }
+        const fkMap = new Map();
+        for (const fk of fks.rows) {
+            let entry = fkMap.get(fk.constraint_name);
+            if (!entry) {
+                entry = {
+                    constraintName: fk.constraint_name,
+                    srcSchema: fk.src_schema,
+                    srcTable: fk.src_table,
+                    srcColumns: [],
+                    tgtSchema: fk.tgt_schema,
+                    tgtTable: fk.tgt_table,
+                    tgtColumns: [],
+                };
+                fkMap.set(fk.constraint_name, entry);
+            }
+            if (!entry.srcColumns.includes(fk.src_column))
+                entry.srcColumns.push(fk.src_column);
+            if (!entry.tgtColumns.includes(fk.tgt_column))
+                entry.tgtColumns.push(fk.tgt_column);
+        }
+        const info = { tables, foreignKeys: [...fkMap.values()] };
+        this.schemaCache.set(schema, info);
+        return info;
+    }
+    async getFunctions(schema, name) {
+        const key = `${schema}.${name}`;
+        const cached = this.fnCache.get(key);
+        if (cached)
+            return cached;
+        const res = await this.engine.query(`select p.proname as name, p.proretset as returns_set,
+              t.typname as return_type, t.typtype as return_typtype,
+              pg_get_function_identity_arguments(p.oid) as identity_args
+       from pg_proc p
+       join pg_namespace n on n.oid = p.pronamespace
+       join pg_type t on t.oid = p.prorettype
+       where n.nspname = $1 and p.proname = $2`, [schema, name]);
+        const fns = res.rows.map((r) => ({
+            schema,
+            name: r.name,
+            returnsSet: r.returns_set,
+            returnType: r.return_type,
+            returnTypType: r.return_typtype,
+            args: parseIdentityArgs(r.identity_args),
+        }));
+        this.fnCache.set(key, fns);
+        return fns;
+    }
+    // ── Realtime CDC ─────────────────────────────────────────────────────
+    async ensureCdcTrigger(schema, table) {
+        const s = quoteIdent(schema);
+        const t = quoteIdent(table);
+        await this.engine.exec(`
+      do $$ begin
+        if not exists (
+          select from pg_trigger tg
+          join pg_class c on c.oid = tg.tgrelid
+          join pg_namespace n on n.oid = c.relnamespace
+          where tg.tgname = 'tinbase_cdc'
+            and n.nspname = ${quoteLiteral(schema)}
+            and c.relname = ${quoteLiteral(table)}
+        ) then
+          create trigger tinbase_cdc
+            after insert or update or delete on ${s}.${t}
+            for each row execute function tinbase.cdc_notify();
+        end if;
+      end $$;
+    `);
+    }
+    async onCdcEvent(cb) {
+        this.cdcListeners.add(cb);
+        if (!this.cdcStarted) {
+            this.cdcStarted = true;
+            await this.engine.listen('tinbase_cdc', (payload) => {
+                try {
+                    const event = JSON.parse(payload);
+                    for (const listener of this.cdcListeners)
+                        listener(event);
+                }
+                catch {
+                    // malformed payload — drop
+                }
+            });
+        }
+        return () => this.cdcListeners.delete(cb);
+    }
+    async close() {
+        await this.engine.close();
+    }
+}
+/** Parse pg_get_function_identity_arguments output: "a integer, b text[]". */
+function parseIdentityArgs(identity) {
+    if (!identity.trim())
+        return [];
+    const parts = [];
+    let depth = 0;
+    let current = '';
+    for (const ch of identity) {
+        if (ch === '(')
+            depth++;
+        if (ch === ')')
+            depth--;
+        if (ch === ',' && depth === 0) {
+            parts.push(current);
+            current = '';
+        }
+        else {
+            current += ch;
+        }
+    }
+    if (current.trim())
+        parts.push(current);
+    return parts.map((part) => {
+        const tokens = part.trim().split(/\s+/);
+        while (tokens.length > 1 && ['IN', 'OUT', 'INOUT', 'VARIADIC'].includes(tokens[0])) {
+            tokens.shift();
+        }
+        if (tokens.length === 1)
+            return { name: '', type: tokens[0] };
+        const name = tokens[0].replace(/^"|"$/g, '');
+        return { name, type: tokens.slice(1).join(' ') };
+    });
+}
+export function quoteIdent(name) {
+    if (name.includes('\0'))
+        throw new Error('invalid identifier');
+    return `"${name.replaceAll('"', '""')}"`;
+}
+export function quoteLiteral(value) {
+    return `'${value.replaceAll("'", "''")}'`;
+}
+async function sha256Hex(text) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));
+    return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+//# sourceMappingURL=database.js.map

package/dist/db/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../src/db/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AA6DvD,MAAM,OAAO,QAAQ;IAMQ;IALnB,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAA;IAC3C,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAA;IAC3C,YAAY,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC/C,UAAU,GAAG,KAAK,CAAA;IAE1B,YAA2B,MAAgB;QAAhB,WAAM,GAAN,MAAM,CAAU;IAAG,CAAC;IAE/C,oEAAoE;IACpE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,eAAmC;QACrD,MAAM,MAAM,GACV,eAAe,IAAI,OAAO,eAAe,KAAK,QAAQ;YACpD,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,MAAM,kBAAkB,CAAC,eAAe,CAAC,CAAA;QAC/C,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAChC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAU,GAAW,EAAE,MAAkB;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1C,CAAC;IAED,IAAI,CAAC,GAAW;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAI,GAAmB,EAAE,EAA8B;QACtE,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAY,EAAE,EAAE;YACpD,MAAM,EAAE,CAAC,KAAK,CACZ;2DACmD,EACnD,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACzD,CAAA;YACD,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,wEAAwE;IAExE,KAAK,CAAC,aAAa,CAAC,UAA2B,EAAE,OAAgB;QAC/D,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;YACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAClC,wEAAwE,EACxE,CAAC,OAAO,CAAC,CACV,CAAA;YACD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAQ;YAClC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACzC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBACpB,MAAM,EAAE,CAAC,KAAK,CACZ;+BACqB,EACrB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAC3B,CAAA;YACH,CAAC,CAAC,CAAA;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACtB,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAA;YACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAClC,6FAA6F,EAC7F,CAAC,IAAI,CAAC,CACP,CAAA;YACD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;oBACzC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;oBACtB,MAAM,EAAE,CAAC,KAAK,CACZ;uFAC2E,EAC3E,CAAC,IAAI,CAAC,CACP,CAAA;gBACH,CAAC,CAAC,CAAA;gBACF,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,qBAAqB,EAAE,CAAA;QACpD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CACjC,kFAAkF,CACnF,CAAA;QACD,OAAO,GAAG,CAAC,IAAI,CAAA;IACjB,CAAC;IAED,wEAAwE;IAExE,qBAAqB;QACnB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAA;QACxB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC3C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QAEzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAOlC;;;;iCAI2B,EAC3B,CAAC,MAAM,CAAC,CACT,CAAA;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CACjC;;;;;yEAKmE,EACnE,CAAC,MAAM,CAAC,CACT,CAAA;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAUjC;;;;;;;;;;;;;;;;yDAgBmD,EACnD,CAAC,MAAM,CAAC,CACT,CAAA;QAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAA;QAC5C,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,GAAG,EAAE,CAAC,CAAA;YAClE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAE,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,CAAA;QAC/C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAA;QAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE;oBACvB,MAAM;oBACN,IAAI,EAAE,CAAC,CAAC,UAAU;oBAClB,OAAO,EAAE,EAAE;oBACX,UAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;iBACjD,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAE,CAAC,OAAO,CAAC,IAAI,CAAC;gBACrC,IAAI,EAAE,CAAC,CAAC,WAAW;gBACnB,OAAO,EAAE,CAAC,CAAC,QAAQ;gBACnB,UAAU,EAAE,CAAC,CAAC,WAAW,KAAK,KAAK;gBACnC,UAAU,EAAE,CAAC,CAAC,WAAW;gBACzB,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK;aACnE,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAA;QAC3C,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,CAAA;YACzC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,GAAG;oBACN,cAAc,EAAE,EAAE,CAAC,eAAe;oBAClC,SAAS,EAAE,EAAE,CAAC,UAAU;oBACxB,QAAQ,EAAE,EAAE,CAAC,SAAS;oBACtB,UAAU,EAAE,EAAE;oBACd,SAAS,EAAE,EAAE,CAAC,UAAU;oBACxB,QAAQ,EAAE,EAAE,CAAC,SAAS;oBACtB,UAAU,EAAE,EAAE;iBACf,CAAA;gBACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,EAAE,KAAK,CAAC,CAAA;YACtC,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC;gBAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;YACnF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC;gBAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;QACrF,CAAC;QAED,MAAM,IAAI,GAAe,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAA;QACrE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAClC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,IAAY;QAC7C,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAA;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAOjC;;;;;;+CAMyC,EACzC,CAAC,MAAM,EAAE,IAAI,CAAC,CACf,CAAA;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,MAAM;YACN,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,UAAU,EAAE,CAAC,CAAC,WAAW;YACzB,UAAU,EAAE,CAAC,CAAC,WAAW;YACzB,aAAa,EAAE,CAAC,CAAC,cAAc;YAC/B,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC;SACzC,CAAC,CAAC,CAAA;QACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAC1B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,wEAAwE;IAExE,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,KAAa;QAClD,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;QAC3B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;;;;;;;8BAOG,YAAY,CAAC,MAAM,CAAC;8BACpB,YAAY,CAAC,KAAK,CAAC;;;kDAGC,CAAC,IAAI,CAAC;;;;KAInD,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAyB;QACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;YACtB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,OAAe,EAAE,EAAE;gBAC1D,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAa,CAAA;oBAC7C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,YAAY;wBAAE,QAAQ,CAAC,KAAK,CAAC,CAAA;gBAC3D,CAAC;gBAAC,MAAM,CAAC;oBACP,2BAA2B;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;IAC3B,CAAC;CACF;AAED,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAA;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAA;QACvB,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAA;QACvB,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACnB,OAAO,GAAG,EAAE,CAAA;QACd,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACvC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACvC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,MAAM,CAAC,KAAK,EAAE,CAAA;QAChB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;QAC5C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;IAClD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAC9D,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAA;AAC3C,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACpF,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACzF,CAAC"}

package/dist/db/engine.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Database engine abstraction. Two implementations:
+ *  - PGlite (WASM Postgres) — portable, runs in the browser; heavier RAM.
+ *  - Native embedded Postgres (Node only) — PocketBase-class footprint.
+ * The rest of tinbase only talks to this interface.
+ */
+export interface EngineResults<T = any> {
+    rows: T[];
+    affectedRows?: number;
+}
+export interface EngineTx {
+    query<T = any>(sql: string, params?: unknown[]): Promise<EngineResults<T>>;
+    exec(sql: string): Promise<void>;
+}
+export interface DbEngine {
+    query<T = any>(sql: string, params?: unknown[]): Promise<EngineResults<T>>;
+    /** Run multiple SQL statements (no params). */
+    exec(sql: string): Promise<void>;
+    /** Serialized transaction — implementations must guarantee mutual exclusion. */
+    transaction<T>(fn: (tx: EngineTx) => Promise<T>): Promise<T>;
+    /** Subscribe to pg_notify on a channel. Returns unsubscribe. */
+    listen(channel: string, cb: (payload: string) => void): Promise<() => void>;
+    close(): Promise<void>;
+}
+/** Simple async mutex for engines that serialize over one connection. */
+export declare class Mutex {
+    private tail;
+    lock(): Promise<() => void>;
+    run<T>(fn: () => Promise<T>): Promise<T>;
+}

package/dist/db/engine.js

@@ -0,0 +1,28 @@
+/**
+ * Database engine abstraction. Two implementations:
+ *  - PGlite (WASM Postgres) — portable, runs in the browser; heavier RAM.
+ *  - Native embedded Postgres (Node only) — PocketBase-class footprint.
+ * The rest of tinbase only talks to this interface.
+ */
+/** Simple async mutex for engines that serialize over one connection. */
+export class Mutex {
+    tail = Promise.resolve();
+    async lock() {
+        let release;
+        const next = new Promise((r) => (release = r));
+        const prev = this.tail;
+        this.tail = this.tail.then(() => next);
+        await prev;
+        return release;
+    }
+    async run(fn) {
+        const release = await this.lock();
+        try {
+            return await fn();
+        }
+        finally {
+            release();
+        }
+    }
+}
+//# sourceMappingURL=engine.js.map

package/dist/db/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/db/engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuBH,yEAAyE;AACzE,MAAM,OAAO,KAAK;IACR,IAAI,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAE/C,KAAK,CAAC,IAAI;QACR,IAAI,OAAoB,CAAA;QACxB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,IAAI,CAAA;QACV,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,EAAoB;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAA;QACnB,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;CACF"}

package/dist/db/pglite-engine.d.ts

@@ -0,0 +1,3 @@
+/** PGlite (WASM) engine — imported dynamically so native mode never loads the WASM bundle. */
+import type { DbEngine } from './engine.js';
+export declare function createPgliteEngine(dataDir?: string): Promise<DbEngine>;

package/dist/db/pglite-engine.js

@@ -0,0 +1,39 @@
+export async function createPgliteEngine(dataDir) {
+    let PGlite;
+    try {
+        ;
+        ({ PGlite } = await import('@electric-sql/pglite'));
+    }
+    catch {
+        throw new Error('the PGlite (wasm) engine is not available in this build — run with --engine native');
+    }
+    const pg = dataDir ? new PGlite(dataDir) : new PGlite();
+    await pg.waitReady;
+    return {
+        async query(sql, params) {
+            const res = await pg.query(sql, params);
+            return { rows: res.rows, affectedRows: res.affectedRows };
+        },
+        async exec(sql) {
+            await pg.exec(sql);
+        },
+        transaction(fn) {
+            return pg.transaction(async (tx) => {
+                return fn({
+                    async query(sql, params) {
+                        const res = await tx.query(sql, params);
+                        return { rows: res.rows, affectedRows: res.affectedRows };
+                    },
+                    async exec(sql) {
+                        await tx.exec(sql);
+                    },
+                });
+            });
+        },
+        async listen(channel, cb) {
+            return pg.listen(channel, cb);
+        },
+        close: () => pg.close(),
+    };
+}
+//# sourceMappingURL=pglite-engine.js.map

package/dist/db/pglite-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pglite-engine.js","sourceRoot":"","sources":["../../src/db/pglite-engine.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAgB;IACvD,IAAI,MAAM,CAAA;IACV,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAA;IACH,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAA;IACvD,MAAM,EAAE,CAAC,SAAS,CAAA;IAElB,OAAO;QACL,KAAK,CAAC,KAAK,CAAI,GAAW,EAAE,MAAkB;YAC5C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;YAC1C,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAA;QAC3D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAW;YACpB,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACpB,CAAC;QACD,WAAW,CAAI,EAAgC;YAC7C,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACjC,OAAO,EAAE,CAAC;oBACR,KAAK,CAAC,KAAK,CAAI,GAAW,EAAE,MAAkB;wBAC5C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAA;wBAC1C,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAA;oBAC3D,CAAC;oBACD,KAAK,CAAC,IAAI,CAAC,GAAW;wBACpB,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBACpB,CAAC;iBACF,CAAC,CAAA;YACJ,CAAC,CAAe,CAAA;QAClB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,EAA6B;YACzD,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE;KACxB,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,23 @@
+import { Database } from './db/database.js';
+import { RealtimeEngine } from './realtime/engine.js';
+import { type BackendConfig, type MigrationFile } from './types.js';
+export * from './types.js';
+export { Database } from './db/database.js';
+export { MemoryStorageDriver } from './storage/driver.js';
+export { RealtimeEngine, type RealtimeSocketLike } from './realtime/engine.js';
+export { signJwt, verifyJwt, decodeJwt } from './jwt.js';
+export interface TinbaseBackend {
+    /** The whole backend as a fetch handler. Pass to supabase-js as global.fetch for in-process use. */
+    fetch: (req: Request) => Promise<Response>;
+    db: Database;
+    realtime: RealtimeEngine;
+    /** JWT for the anon role — use as supabase-js's supabaseKey. */
+    anonKey: string;
+    /** JWT for the service_role — bypasses RLS. */
+    serviceRoleKey: string;
+    jwtSecret: string;
+    /** Apply additional migrations at runtime. */
+    migrate: (migrations: MigrationFile[], seedSql?: string) => Promise<string[]>;
+    close: () => Promise<void>;
+}
+export declare function createBackend(config?: BackendConfig): Promise<TinbaseBackend>;

package/dist/index.js

@@ -0,0 +1,145 @@
+/**
+ * tinbase — a pure-JS, Docker-free Supabase backend on PGlite that speaks
+ * the same wire protocols as hosted Supabase, so the official supabase-js
+ * SDK works unchanged.
+ *
+ * The core is a fetch handler (Request → Response): serve it over HTTP in
+ * Node, or call it in-process in the browser by passing it as supabase-js's
+ * `global.fetch`.
+ */
+import { AuthHandler } from './auth/handler.js';
+import { Database } from './db/database.js';
+import { signJwt, verifyJwt } from './jwt.js';
+import { RealtimeEngine } from './realtime/engine.js';
+import { RestHandler } from './rest/handler.js';
+import { MemoryStorageDriver } from './storage/driver.js';
+import { StorageHandler } from './storage/handler.js';
+import { DEFAULT_JWT_SECRET } from './types.js';
+export * from './types.js';
+export { Database } from './db/database.js';
+export { MemoryStorageDriver } from './storage/driver.js';
+export { RealtimeEngine } from './realtime/engine.js';
+export { signJwt, verifyJwt, decodeJwt } from './jwt.js';
+const CORS_HEADERS = {
+    'access-control-allow-origin': '*',
+    'access-control-allow-methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD',
+    'access-control-allow-headers': 'authorization, apikey, content-type, prefer, accept, accept-profile, content-profile, range, x-upsert, x-client-info, x-supabase-api-version, cache-control',
+    'access-control-expose-headers': 'content-range, range-unit, content-profile',
+    'access-control-max-age': '86400',
+};
+export async function createBackend(config = {}) {
+    const jwtSecret = config.jwtSecret ?? DEFAULT_JWT_SECRET;
+    const siteUrl = config.siteUrl ?? 'http://localhost:54321';
+    const jwtExpiry = config.jwtExpiry ?? 3600;
+    const db = await Database.create(config.engine ?? config.dataDir);
+    if (config.migrations?.length || config.seedSql) {
+        const applied = await db.runMigrations(config.migrations ?? [], config.seedSql);
+        if (applied.length > 0)
+            config.log?.(`applied migrations: ${applied.join(', ')}`);
+    }
+    const now = Math.floor(Date.now() / 1000);
+    const tenYears = 10 * 365 * 24 * 3600;
+    const anonKey = await signJwt({ iss: 'supabase', ref: 'tinbase', role: 'anon', iat: now, exp: now + tenYears }, jwtSecret);
+    const serviceRoleKey = await signJwt({ iss: 'supabase', ref: 'tinbase', role: 'service_role', iat: now, exp: now + tenYears }, jwtSecret);
+    const rest = new RestHandler(db);
+    const auth = new AuthHandler(db, { jwtSecret, siteUrl, jwtExpiry });
+    const storage = new StorageHandler(db, config.storageDriver ?? new MemoryStorageDriver(), { jwtSecret });
+    const realtime = new RealtimeEngine(db);
+    await realtime.start();
+    async function resolveContext(req, url) {
+        const authz = req.headers.get('authorization');
+        const bearer = authz?.toLowerCase().startsWith('bearer ') ? authz.slice(7) : null;
+        const token = bearer ?? req.headers.get('apikey') ?? url.searchParams.get('apikey');
+        if (!token) {
+            return withCors(new Response(JSON.stringify({ message: 'No API key found in request', hint: 'No `apikey` request header or url param was found.' }), {
+                status: 401,
+                headers: { 'content-type': 'application/json' },
+            }));
+        }
+        const claims = await verifyJwt(token, jwtSecret);
+        if (!claims) {
+            return withCors(new Response(JSON.stringify({ message: 'Invalid API key' }), {
+                status: 401,
+                headers: { 'content-type': 'application/json' },
+            }));
+        }
+        const role = typeof claims.role === 'string' ? claims.role : 'anon';
+        if (!['anon', 'authenticated', 'service_role'].includes(role)) {
+            return withCors(new Response(JSON.stringify({ message: `Invalid role: ${role}` }), {
+                status: 401,
+                headers: { 'content-type': 'application/json' },
+            }));
+        }
+        return { role, claims };
+    }
+    async function handle(req) {
+        const url = new URL(req.url);
+        const path = url.pathname;
+        if (req.method === 'OPTIONS') {
+            return new Response(null, { status: 204, headers: CORS_HEADERS });
+        }
+        if (path === '/' || path === '/health') {
+            return withCors(new Response(JSON.stringify({ name: 'tinbase', status: 'healthy' }), {
+                status: 200,
+                headers: { 'content-type': 'application/json' },
+            }));
+        }
+        // public endpoints that skip apikey checks
+        if (path.startsWith('/storage/v1/object/public/') || path.startsWith('/storage/v1/object/sign/')) {
+            if (req.method === 'GET' || req.method === 'HEAD') {
+                return withCors(await storage.handle(req, { role: 'anon', claims: null }, url));
+            }
+        }
+        if (path.startsWith('/auth/v1/')) {
+            // GoTrue validates the apikey header, but user JWTs ride Authorization
+            const apikey = req.headers.get('apikey') ?? url.searchParams.get('apikey');
+            if (!apikey || !(await verifyJwt(apikey, jwtSecret))) {
+                return withCors(new Response(JSON.stringify({ message: 'No API key found in request' }), {
+                    status: 401,
+                    headers: { 'content-type': 'application/json' },
+                }));
+            }
+            const keyClaims = await verifyJwt(apikey, jwtSecret);
+            const ctx = { role: String(keyClaims?.role ?? 'anon'), claims: keyClaims };
+            return withCors(await auth.handle(req, ctx, url));
+        }
+        const ctx = await resolveContext(req, url);
+        if (ctx instanceof Response)
+            return ctx;
+        if (path.startsWith('/rest/v1'))
+            return withCors(await rest.handle(req, ctx, url));
+        if (path.startsWith('/storage/v1'))
+            return withCors(await storage.handle(req, ctx, url));
+        if (path.startsWith('/realtime/v1')) {
+            return withCors(new Response(JSON.stringify({ message: 'Realtime requires a WebSocket connection' }), {
+                status: 426,
+                headers: { 'content-type': 'application/json' },
+            }));
+        }
+        return withCors(new Response(JSON.stringify({ message: `Unknown endpoint: ${path}` }), {
+            status: 404,
+            headers: { 'content-type': 'application/json' },
+        }));
+    }
+    return {
+        fetch: handle,
+        db,
+        realtime,
+        anonKey,
+        serviceRoleKey,
+        jwtSecret,
+        migrate: (migrations, seedSql) => db.runMigrations(migrations, seedSql),
+        close: async () => {
+            realtime.stop();
+            await db.close();
+        },
+    };
+}
+function withCors(res) {
+    for (const [k, v] of Object.entries(CORS_HEADERS)) {
+        if (!res.headers.has(k))
+            res.headers.set(k, v);
+    }
+    return res;
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAA+D,MAAM,YAAY,CAAA;AAE5G,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,cAAc,EAA2B,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAiBxD,MAAM,YAAY,GAA2B;IAC3C,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,8CAA8C;IAC9E,8BAA8B,EAC5B,6JAA6J;IAC/J,+BAA+B,EAAE,4CAA4C;IAC7E,wBAAwB,EAAE,OAAO;CAClC,CAAA;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAwB,EAAE;IAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAA;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,wBAAwB,CAAA;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAA;IAE1C,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;IACjE,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QAC/E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,EAAE,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,CAAA;IACrC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAA;IAC1H,MAAM,cAAc,GAAG,MAAM,OAAO,CAClC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,QAAQ,EAAE,EACxF,SAAS,CACV,CAAA;IAED,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;IACnE,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI,mBAAmB,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;IACxG,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,EAAE,CAAC,CAAA;IACvC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAA;IAEtB,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,GAAQ;QAClD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,KAAK,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACjF,MAAM,KAAK,GAAG,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACnF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,QAAQ,CACb,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,IAAI,EAAE,oDAAoD,EAAE,CAAC,EAAE;gBACnI,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CACH,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAChD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,QAAQ,CACb,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,EAAE;gBAC3D,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CACH,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;QACnE,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO,QAAQ,CACb,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC,EAAE;gBACjE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CACH,CAAA;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACzB,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,GAAY;QAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAA;QAEzB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,QAAQ,CACb,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE;gBACnE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CACH,CAAA;QACH,CAAC;QAED,2CAA2C;QAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,4BAA4B,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;YACjG,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAClD,OAAO,QAAQ,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;YACjF,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,uEAAuE;YACvE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC1E,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;gBACrD,OAAO,QAAQ,CACb,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,EAAE;oBACvE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CAAC,CACH,CAAA;YACH,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;YACpD,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;YAC1F,OAAO,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACnD,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAC1C,IAAI,GAAG,YAAY,QAAQ;YAAE,OAAO,GAAG,CAAA;QAEvC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QAClF,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,QAAQ,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACxF,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACpC,OAAO,QAAQ,CACb,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC,EAAE;gBACpF,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CACH,CAAA;QACH,CAAC;QACD,OAAO,QAAQ,CACb,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,qBAAqB,IAAI,EAAE,EAAE,CAAC,EAAE;YACrE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CACH,CAAA;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM;QACb,EAAE;QACF,QAAQ;QACR,OAAO;QACP,cAAc;QACd,SAAS;QACT,OAAO,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC;QACvE,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,QAAQ,CAAC,IAAI,EAAE,CAAA;YACf,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;QAClB,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAa;IAC7B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/jwt.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Minimal HS256 JWT implementation on WebCrypto.
+ * Works in Node (>=18) and browsers — no dependencies.
+ */
+export interface JwtClaims {
+    [key: string]: unknown;
+    sub?: string;
+    role?: string;
+    exp?: number;
+    iat?: number;
+    iss?: string;
+    aud?: string;
+    email?: string;
+}
+export declare function signJwt(claims: JwtClaims, secret: string): Promise<string>;
+/** Verifies signature and expiry. Returns claims, or null when invalid. */
+export declare function verifyJwt(token: string, secret: string): Promise<JwtClaims | null>;
+/** Decode without verification (for introspection/debugging only). */
+export declare function decodeJwt(token: string): JwtClaims | null;
+export declare function randomToken(bytes?: number): string;