tinbase 0.10.0 → 0.10.1

package/dist/cron/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/cron/service.ts"],"names":[],"mappings":"AAkBA,MAAM,OAAO,WAAW;IAMZ;IAEA;IACA;IARF,KAAK,GAA0C,IAAI,CAAA;IACnD,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA,CAAC,+BAA+B;IACnE,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAA,CAAC,iCAAiC;IAEhF,YACU,EAAY;IACpB,kFAAkF;IAC1E,SAAS,IAAI,EACb,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAHlC,OAAE,GAAF,EAAE,CAAU;QAEZ,WAAM,GAAN,MAAM,CAAO;QACb,QAAG,GAAH,GAAG,CAA+B;IACzC,CAAC;IAEJ,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAM;QACtB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC7D,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;YAAG,IAAI,CAAC,KAA+B,CAAC,KAAK,EAAE,CAAA;IAC5G,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;IACnB,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,IAAI;QACR,IAAI,IAAc,CAAA;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAS,6EAA6E,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1H,CAAC;QAAC,MAAM,CAAC;YACP,OAAM,CAAC,2BAA2B;QACpC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAW,EAAE,GAAS;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAA;QACtD,IAAI,IAAI,EAAE,CAAC;YACT,2EAA2E;YAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;YAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC7C,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,QAAQ,CAAA;QACzC,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QACjD,2DAA2D;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAA;QAChD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAA;IAClD,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,GAAS;QACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAA;QACjE,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAA;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAChC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QAC/C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAClF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,MAAc,EAAE,OAAsB,EAAE,KAAW;QAChF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB;4CACoC,EACpC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAC/D,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAU;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACrH,MAAM,MAAM,GAAG;QACb,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,CAAC,CAAC,EAAE,CAAC,CAAC;KACP,CAAA;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IAClF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa,EAAE,GAAW,EAAE,GAAW;IAC1E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;IACnD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa,EAAE,GAAW,EAAE,GAAW;IACtE,uBAAuB;IACvB,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,QAAQ,GAAG,IAAI,CAAA;IACnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;QAC/C,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACjC,CAAC;IACD,IAAI,EAAE,GAAG,GAAG,CAAA;IACZ,IAAI,EAAE,GAAG,GAAG,CAAA;IACZ,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACrB,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC9C,EAAE,GAAG,CAAC,CAAA;YACN,EAAE,GAAG,CAAC,CAAA;QACR,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAA;YACjC,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,OAAO,CAAC,KAAK,KAAK,CAAA;YACpC,EAAE,GAAG,CAAC,CAAA;YACN,EAAE,GAAG,GAAG,CAAA;QACV,CAAC;IACH,CAAC;IACD,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAA;IAC1C,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,IAAI,KAAK,CAAC,CAAA;AAClC,CAAC"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/cron/service.ts"],"names":[],"mappings":"AAkBA;;;;GAIG;AACH,MAAM,OAAO,WAAW;IAQZ;IAEA;IACA;IAVF,KAAK,GAA0C,IAAI,CAAA;IACnD,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA,CAAC,+BAA+B;IACnE,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAA,CAAC,iCAAiC;IAChF,4EAA4E;IACpE,QAAQ,GAAyB,IAAI,CAAA;IAE7C,YACU,EAAY;IACpB,kFAAkF;IAC1E,SAAS,IAAI,EACb,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAHlC,OAAE,GAAF,EAAE,CAAU;QAEZ,WAAM,GAAN,MAAM,CAAO;QACb,QAAG,GAAH,GAAG,CAA+B;IACzC,CAAC;IAEJ,iFAAiF;IACjF,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAM;QACtB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC7B,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACf,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;YAAG,IAAI,CAAC,KAA+B,CAAC,KAAK,EAAE,CAAA;IAC5G,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACjB,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACpC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;IACtB,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,IAAI;QACR,IAAI,IAAc,CAAA;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAS,6EAA6E,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1H,CAAC;QAAC,MAAM,CAAC;YACP,OAAM,CAAC,2BAA2B;QACpC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAW,EAAE,GAAS;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAA;QACtD,IAAI,IAAI,EAAE,CAAC;YACT,2EAA2E;YAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;YAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC7C,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,QAAQ,CAAA;QACzC,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QACjD,2DAA2D;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAA;QAChD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAA;IAClD,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,GAAS;QACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAA;QACjE,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAA;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAChC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QAC/C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAClF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,MAAc,EAAE,OAAsB,EAAE,KAAW;QAChF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB;4CACoC,EACpC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAC/D,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAU;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACrH,MAAM,MAAM,GAAG;QACb,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,CAAC,CAAC,EAAE,EAAE,CAAC;QACP,CAAC,CAAC,EAAE,CAAC,CAAC;KACP,CAAA;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IAClF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa,EAAE,GAAW,EAAE,GAAW;IAC1E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;IACnD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa,EAAE,GAAW,EAAE,GAAW;IACtE,uBAAuB;IACvB,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,QAAQ,GAAG,IAAI,CAAA;IACnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;QAC/C,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACjC,CAAC;IACD,IAAI,EAAE,GAAG,GAAG,CAAA;IACZ,IAAI,EAAE,GAAG,GAAG,CAAA;IACZ,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACrB,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC9C,EAAE,GAAG,CAAC,CAAA;YACN,EAAE,GAAG,CAAC,CAAA;QACR,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAA;YACjC,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,OAAO,CAAC,KAAK,KAAK,CAAA;YACpC,EAAE,GAAG,CAAC,CAAA;YACN,EAAE,GAAG,GAAG,CAAA;QACV,CAAC;IACH,CAAC;IACD,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAA;IAC1C,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,IAAI,KAAK,CAAC,CAAA;AAClC,CAAC"}

package/dist/db/bootstrap.d.ts

@@ -1,13 +1,20 @@
 /**
- * Idempotent bootstrap SQL that shapes a fresh PGlite database like a
- * Supabase project: roles, auth schema, storage schema, helper functions,
- * migration bookkeeping, and the realtime CDC plumbing.
+ * Idempotent bootstrap SQL that shapes a fresh database like a Supabase
+ * project. Two variants: the full {@link BOOTSTRAP_SQL} for the real engines,
+ * and the reduced {@link MINIMAL_BOOTSTRAP_SQL} below for the pg-mem subset.
+ * Both are safe to re-run (create ... if not exists / create or replace).
  */
 /**
  * Reduced bootstrap for subset engines (pg-mem) that can't run plpgsql, RLS
  * policies, extensions, or LISTEN/NOTIFY. Just the schemas, core tables, and
  * SQL-language auth helpers needed for the REST + auth CRUD surface. No RLS is
- * enforced here — this path is for local-dev/preview only.
+ * enforced here - this path is for local-dev/preview only.
  */
-export declare const MINIMAL_BOOTSTRAP_SQL = "\ncreate schema if not exists auth;\ncreate schema if not exists storage;\ncreate schema if not exists supabase_migrations;\n\ncreate table if not exists auth.users (\n  id uuid primary key default gen_random_uuid(),\n  aud text default 'authenticated',\n  role text default 'authenticated',\n  email text unique,\n  encrypted_password text,\n  email_confirmed_at timestamptz,\n  last_sign_in_at timestamptz,\n  raw_app_meta_data jsonb default '{}'::jsonb,\n  raw_user_meta_data jsonb default '{}'::jsonb,\n  is_super_admin boolean default false,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  phone text unique,\n  phone_confirmed_at timestamptz,\n  banned_until timestamptz,\n  deleted_at timestamptz,\n  is_anonymous boolean default false\n);\n\ncreate table if not exists auth.refresh_tokens (\n  id bigserial primary key,\n  token text unique not null,\n  user_id uuid not null,\n  parent text,\n  session_id uuid,\n  revoked boolean default false,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists auth.one_time_tokens (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid,\n  email text not null,\n  token_type text not null,\n  token text not null,\n  attempts int not null default 0,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\ncreate table if not exists auth.identities (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid not null,\n  provider text not null,\n  provider_id text not null,\n  identity_data jsonb default '{}'::jsonb,\n  last_sign_in_at timestamptz default now(),\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  unique (provider, provider_id)\n);\n\ncreate table if not exists auth.flow_state (\n  id uuid primary key default gen_random_uuid(),\n  provider text not null,\n  provider_state text not null unique,\n  redirect_to text,\n  code_challenge text,\n  code_challenge_method text,\n  auth_code text unique,\n  user_id uuid,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\ncreate table if not exists auth.mfa_factors (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid not null,\n  friendly_name text,\n  factor_type text not null default 'totp',\n  status text not null default 'unverified',\n  secret text,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists auth.mfa_challenges (\n  id uuid primary key default gen_random_uuid(),\n  factor_id uuid not null,\n  verified_at timestamptz,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\ncreate table if not exists auth.audit_log_entries (\n  id uuid primary key default gen_random_uuid(),\n  payload jsonb,\n  created_at timestamptz default now(),\n  ip_address varchar(64) not null default ''\n);\n\ncreate table if not exists storage.buckets (\n  id text primary key,\n  name text not null unique,\n  owner uuid,\n  public boolean default false,\n  file_size_limit bigint,\n  allowed_mime_types text[],\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists storage.objects (\n  id uuid primary key default gen_random_uuid(),\n  bucket_id text not null,\n  name text not null,\n  owner uuid,\n  version text,\n  metadata jsonb default '{}'::jsonb,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  last_accessed_at timestamptz default now(),\n  unique (bucket_id, name)\n);\n\ncreate table if not exists supabase_migrations.schema_migrations (\n  version text primary key,\n  name text,\n  statements text[],\n  applied_at timestamptz default now()\n);\n\ncreate table if not exists supabase_migrations.seed_files (\n  path text primary key,\n  hash text,\n  applied_at timestamptz default now()\n);\n";
-export declare const BOOTSTRAP_SQL = "\n-- \u2500\u2500 Extensions \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n-- Supabase enables these by default and migrations lean on them\n-- (uuid_generate_v4(), crypt(), citext, pg_trgm, \u2026). Each is created into the\n-- 'extensions' schema like hosted Supabase; any not available in this engine\n-- build is skipped rather than aborting the whole bootstrap.\ncreate schema if not exists extensions;\ndo $$\ndeclare ext text;\nbegin\n  foreach ext in array array['uuid-ossp','pgcrypto','citext','pg_trgm','ltree','hstore','fuzzystrmatch'] loop\n    begin\n      execute format('create extension if not exists %I with schema extensions', ext);\n    exception when others then\n      -- extension not bundled in this engine build; continue\n    end;\n  end loop;\nend $$;\n\n-- uuid-ossp isn't in every Postgres build (it needs an external UUID lib at\n-- build time \u2014 e.g. the theseus Linux binaries omit it). uuid_generate_v4() is\n-- the single most-used function from it, so shim it onto core gen_random_uuid()\n-- (also a v4 UUID) whenever the real extension isn't present, so migrations\n-- that call it work identically on every engine and platform.\ndo $$\nbegin\n  if not exists (\n    select 1 from pg_proc p join pg_namespace n on n.oid = p.pronamespace\n    where p.proname = 'uuid_generate_v4' and n.nspname in ('public', 'extensions')\n  ) then\n    create function extensions.uuid_generate_v4() returns uuid\n      language sql volatile as 'select gen_random_uuid()';\n  end if;\nend $$;\n\n-- Make extension functions resolvable unqualified (uuid_generate_v4(), \u2026) on\n-- the current session (migrations run here) and for future connections.\ndo $$\nbegin\n  execute 'alter database ' || quote_ident(current_database()) ||\n          ' set search_path to \"$user\", public, extensions';\nexception when others then\n  -- some engines disallow altering the current database; session SET below still applies\nend $$;\nset search_path to \"$user\", public, extensions;\n\n-- \u2500\u2500 Roles \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ndo $$\nbegin\n  if not exists (select from pg_roles where rolname = 'anon') then\n    create role anon nologin noinherit;\n  end if;\n  if not exists (select from pg_roles where rolname = 'authenticated') then\n    create role authenticated nologin noinherit;\n  end if;\n  if not exists (select from pg_roles where rolname = 'service_role') then\n    create role service_role nologin noinherit bypassrls;\n  end if;\nend $$;\n\ngrant usage on schema extensions to anon, authenticated, service_role;\nalter role anon set search_path to \"$user\", public, extensions;\nalter role authenticated set search_path to \"$user\", public, extensions;\nalter role service_role set search_path to \"$user\", public, extensions;\n\ngrant usage on schema public to anon, authenticated, service_role;\ngrant all on all tables in schema public to anon, authenticated, service_role;\ngrant all on all sequences in schema public to anon, authenticated, service_role;\ngrant execute on all functions in schema public to anon, authenticated, service_role;\n\nalter default privileges in schema public\n  grant all on tables to anon, authenticated, service_role;\nalter default privileges in schema public\n  grant all on sequences to anon, authenticated, service_role;\nalter default privileges in schema public\n  grant execute on functions to anon, authenticated, service_role;\n\n-- \u2500\u2500 Auth schema (GoTrue-compatible subset) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists auth;\n\ncreate table if not exists auth.users (\n  instance_id uuid default '00000000-0000-0000-0000-000000000000',\n  id uuid primary key default gen_random_uuid(),\n  aud text default 'authenticated',\n  role text default 'authenticated',\n  email text unique,\n  encrypted_password text,\n  email_confirmed_at timestamptz,\n  invited_at timestamptz,\n  confirmation_token text default '',\n  confirmation_sent_at timestamptz,\n  recovery_token text default '',\n  recovery_sent_at timestamptz,\n  email_change_token_new text default '',\n  email_change text default '',\n  email_change_sent_at timestamptz,\n  email_change_token_current text default '',\n  email_change_confirm_status smallint default 0,\n  last_sign_in_at timestamptz,\n  raw_app_meta_data jsonb default '{}'::jsonb,\n  raw_user_meta_data jsonb default '{}'::jsonb,\n  is_super_admin boolean default false,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  phone text unique,\n  phone_confirmed_at timestamptz,\n  phone_change text default '',\n  phone_change_token text default '',\n  phone_change_sent_at timestamptz,\n  reauthentication_token text default '',\n  reauthentication_sent_at timestamptz,\n  banned_until timestamptz,\n  deleted_at timestamptz,\n  is_anonymous boolean default false\n);\n\ncreate table if not exists auth.refresh_tokens (\n  id bigint generated by default as identity primary key,\n  token text unique not null,\n  user_id uuid not null references auth.users(id) on delete cascade,\n  parent text,\n  session_id uuid,\n  revoked boolean default false,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate index if not exists refresh_tokens_user_id_idx on auth.refresh_tokens(user_id);\n\ncreate table if not exists auth.one_time_tokens (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid references auth.users(id) on delete cascade,\n  email text not null,\n  token_type text not null, -- otp | magiclink | recovery\n  token text not null,\n  attempts int not null default 0,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\ncreate table if not exists auth.identities (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid not null references auth.users(id) on delete cascade,\n  provider text not null,\n  provider_id text not null,\n  identity_data jsonb default '{}'::jsonb,\n  last_sign_in_at timestamptz default now(),\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  unique (provider, provider_id)\n);\n\n-- OAuth / PKCE flow state, bridging /authorize \u2192 provider \u2192 /callback \u2192 exchange\ncreate table if not exists auth.flow_state (\n  id uuid primary key default gen_random_uuid(),\n  provider text not null,\n  provider_state text not null unique,\n  redirect_to text,\n  code_challenge text,\n  code_challenge_method text,\n  auth_code text unique,\n  user_id uuid references auth.users(id) on delete cascade,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\ncreate table if not exists auth.mfa_factors (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid not null references auth.users(id) on delete cascade,\n  friendly_name text,\n  factor_type text not null default 'totp',\n  status text not null default 'unverified', -- unverified | verified\n  secret text,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists auth.mfa_challenges (\n  id uuid primary key default gen_random_uuid(),\n  factor_id uuid not null references auth.mfa_factors(id) on delete cascade,\n  verified_at timestamptz,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\n-- append-only security audit trail (GoTrue-compatible shape)\ncreate table if not exists auth.audit_log_entries (\n  instance_id uuid default '00000000-0000-0000-0000-000000000000',\n  id uuid primary key default gen_random_uuid(),\n  payload jsonb,\n  created_at timestamptz default now(),\n  ip_address varchar(64) not null default ''\n);\ncreate index if not exists audit_logs_instance_id_idx on auth.audit_log_entries(created_at);\n\ngrant usage on schema auth to anon, authenticated, service_role;\n\ncreate or replace function auth.jwt() returns jsonb\nlanguage sql stable as $$\n  select coalesce(\n    nullif(current_setting('request.jwt.claims', true), ''),\n    '{}'\n  )::jsonb\n$$;\n\ncreate or replace function auth.uid() returns uuid\nlanguage sql stable as $$\n  select nullif(auth.jwt() ->> 'sub', '')::uuid\n$$;\n\ncreate or replace function auth.role() returns text\nlanguage sql stable as $$\n  select coalesce(auth.jwt() ->> 'role', 'anon')\n$$;\n\ncreate or replace function auth.email() returns text\nlanguage sql stable as $$\n  select auth.jwt() ->> 'email'\n$$;\n\ngrant execute on function auth.jwt(), auth.uid(), auth.role(), auth.email()\n  to anon, authenticated, service_role;\n\n-- \u2500\u2500 Storage schema (storage-api-compatible subset) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists storage;\n\ncreate table if not exists storage.buckets (\n  id text primary key,\n  name text not null unique,\n  owner uuid,\n  public boolean default false,\n  file_size_limit bigint,\n  allowed_mime_types text[],\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists storage.objects (\n  id uuid primary key default gen_random_uuid(),\n  bucket_id text not null references storage.buckets(id),\n  name text not null,\n  owner uuid,\n  version text,\n  metadata jsonb default '{}'::jsonb,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  last_accessed_at timestamptz default now(),\n  unique (bucket_id, name)\n);\n\ncreate index if not exists objects_bucket_name_idx on storage.objects(bucket_id, name);\n\ngrant usage on schema storage to anon, authenticated, service_role;\ngrant select on storage.buckets to anon, authenticated, service_role;\ngrant all on storage.buckets to service_role;\ngrant all on storage.objects to anon, authenticated, service_role;\n\ncreate or replace function storage.foldername(name text) returns text[]\nlanguage sql immutable as $$\n  select (string_to_array(name, '/'))[1 : array_length(string_to_array(name, '/'), 1) - 1]\n$$;\n\ncreate or replace function storage.filename(name text) returns text\nlanguage sql immutable as $$\n  select (string_to_array(name, '/'))[array_length(string_to_array(name, '/'), 1)]\n$$;\n\ncreate or replace function storage.extension(name text) returns text\nlanguage sql immutable as $$\n  select reverse(split_part(reverse(storage.filename(name)), '.', 1))\n$$;\n\nalter table storage.objects enable row level security;\n\n-- Dev-friendly default policies. Replace them in your migrations to lock down.\ndo $$\nbegin\n  if not exists (select from pg_policies where schemaname = 'storage' and tablename = 'objects' and policyname = 'tinbase_authenticated_all') then\n    create policy tinbase_authenticated_all on storage.objects\n      for all to authenticated using (true) with check (true);\n  end if;\n  if not exists (select from pg_policies where schemaname = 'storage' and tablename = 'objects' and policyname = 'tinbase_public_read') then\n    create policy tinbase_public_read on storage.objects\n      for select to anon\n      using (bucket_id in (select id from storage.buckets where public));\n  end if;\nend $$;\n\n-- \u2500\u2500 Migration bookkeeping (same table the Supabase CLI uses) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists supabase_migrations;\n\ncreate table if not exists supabase_migrations.schema_migrations (\n  version text primary key,\n  name text,\n  statements text[],\n  applied_at timestamptz default now()\n);\n\ncreate table if not exists supabase_migrations.seed_files (\n  path text primary key,\n  hash text,\n  applied_at timestamptz default now()\n);\n\n-- \u2500\u2500 Realtime CDC plumbing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists tinbase;\n\ncreate or replace function tinbase.cdc_notify() returns trigger\nlanguage plpgsql security definer as $$\ndeclare\n  payload text;\nbegin\n  payload := json_build_object(\n    'schema', TG_TABLE_SCHEMA,\n    'table', TG_TABLE_NAME,\n    'type', TG_OP,\n    'commit_timestamp', to_char(now() at time zone 'utc', 'YYYY-MM-DD\"T\"HH24:MI:SS.MS\"Z\"'),\n    'record', case when TG_OP in ('INSERT', 'UPDATE') then row_to_json(NEW) else null end,\n    'old_record', case when TG_OP in ('UPDATE', 'DELETE') then row_to_json(OLD) else null end\n  )::text;\n  -- pg_notify payloads are capped at ~8kB; degrade like Supabase does.\n  if octet_length(payload) > 7500 then\n    payload := json_build_object(\n      'schema', TG_TABLE_SCHEMA,\n      'table', TG_TABLE_NAME,\n      'type', TG_OP,\n      'commit_timestamp', to_char(now() at time zone 'utc', 'YYYY-MM-DD\"T\"HH24:MI:SS.MS\"Z\"'),\n      'record', null,\n      'old_record', null,\n      'errors', json_build_array('Payload too large')\n    )::text;\n  end if;\n  perform pg_notify('tinbase_cdc', payload);\n  return coalesce(NEW, OLD);\nend $$;\n\n-- \u2500\u2500 Realtime Authorization + broadcast-from-database \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n-- Mirrors Supabase Realtime: developers write RLS policies on\n-- realtime.messages using realtime.topic(); a SELECT policy grants a private\n-- channel's subscribers the right to *receive*, an INSERT policy the right to\n-- *broadcast*. realtime.send() lets the database push a broadcast to a topic.\ncreate schema if not exists realtime;\n\ncreate table if not exists realtime.messages (\n  id uuid not null default gen_random_uuid(),\n  topic text not null,\n  extension text not null,\n  event text,\n  payload jsonb,\n  private boolean default false,\n  inserted_at timestamptz not null default now(),\n  updated_at timestamptz not null default now(),\n  primary key (id)\n);\nalter table realtime.messages enable row level security;\n\ngrant usage on schema realtime to anon, authenticated, service_role;\ngrant all on realtime.messages to anon, authenticated, service_role;\n\n-- the topic currently being authorized/broadcast (set per operation)\ncreate or replace function realtime.topic() returns text\n  language sql stable as $$ select nullif(current_setting('realtime.topic', true), '') $$;\n\n-- push a broadcast message to all subscribers of <topic> from SQL / triggers.\n-- Delivered over the websocket by the in-process realtime engine, which listens\n-- on the 'tinbase_realtime_broadcast' channel.\ncreate or replace function realtime.send(payload jsonb, event text, topic text, private boolean default true)\n  returns void language plpgsql security definer as $$\nbegin\n  perform pg_notify(\n    'tinbase_realtime_broadcast',\n    json_build_object('topic', topic, 'event', event, 'payload', payload, 'private', private)::text\n  );\nexception when others then\n  -- never let a notify failure abort the caller's transaction\n  null;\nend $$;\n\ngrant execute on function realtime.topic() to anon, authenticated, service_role;\ngrant execute on function realtime.send(jsonb, text, text, boolean) to anon, authenticated, service_role;\n";
+export declare const MINIMAL_BOOTSTRAP_SQL = "\ncreate schema if not exists auth;\ncreate schema if not exists storage;\ncreate schema if not exists supabase_migrations;\n\ncreate table if not exists auth.users (\n  id uuid primary key default gen_random_uuid(),\n  aud text default 'authenticated',\n  role text default 'authenticated',\n  email text unique,\n  encrypted_password text,\n  email_confirmed_at timestamptz,\n  last_sign_in_at timestamptz,\n  raw_app_meta_data jsonb default '{}'::jsonb,\n  raw_user_meta_data jsonb default '{}'::jsonb,\n  is_super_admin boolean default false,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  phone text unique,\n  phone_confirmed_at timestamptz,\n  banned_until timestamptz,\n  deleted_at timestamptz,\n  is_anonymous boolean default false\n);\n\ncreate table if not exists auth.refresh_tokens (\n  id bigserial primary key,\n  token text unique not null,\n  user_id uuid not null,\n  parent text,\n  session_id uuid,\n  revoked boolean default false,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists auth.one_time_tokens (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid,\n  email text not null,\n  token_type text not null,\n  token text not null,\n  attempts int not null default 0,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\ncreate table if not exists auth.identities (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid not null,\n  provider text not null,\n  provider_id text not null,\n  identity_data jsonb default '{}'::jsonb,\n  last_sign_in_at timestamptz default now(),\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  unique (provider, provider_id)\n);\n\ncreate table if not exists auth.flow_state (\n  id uuid primary key default gen_random_uuid(),\n  provider text not null,\n  provider_state text not null unique,\n  redirect_to text,\n  code_challenge text,\n  code_challenge_method text,\n  auth_code text unique,\n  user_id uuid,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\ncreate table if not exists auth.mfa_factors (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid not null,\n  friendly_name text,\n  factor_type text not null default 'totp',\n  status text not null default 'unverified',\n  secret text,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists auth.mfa_challenges (\n  id uuid primary key default gen_random_uuid(),\n  factor_id uuid not null,\n  verified_at timestamptz,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\ncreate table if not exists auth.audit_log_entries (\n  id uuid primary key default gen_random_uuid(),\n  payload jsonb,\n  created_at timestamptz default now(),\n  ip_address varchar(64) not null default ''\n);\n\n-- runtime-mutable instance settings (Studio auth toggles)\ncreate table if not exists auth.config (\n  key text primary key,\n  value jsonb not null,\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists storage.buckets (\n  id text primary key,\n  name text not null unique,\n  owner uuid,\n  public boolean default false,\n  file_size_limit bigint,\n  allowed_mime_types text[],\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists storage.objects (\n  id uuid primary key default gen_random_uuid(),\n  bucket_id text not null,\n  name text not null,\n  owner uuid,\n  version text,\n  metadata jsonb default '{}'::jsonb,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  last_accessed_at timestamptz default now(),\n  unique (bucket_id, name)\n);\n\ncreate table if not exists supabase_migrations.schema_migrations (\n  version text primary key,\n  name text,\n  statements text[],\n  applied_at timestamptz default now()\n);\n\ncreate table if not exists supabase_migrations.seed_files (\n  path text primary key,\n  hash text,\n  applied_at timestamptz default now()\n);\n";
+/**
+ * Full bootstrap for the real engines (PGlite / native embedded Postgres):
+ * extensions, the anon/authenticated/service_role roles, GoTrue-compatible auth
+ * schema, storage schema with default RLS policies, migration bookkeeping, and
+ * the realtime CDC + broadcast plumbing.
+ */
+export declare const BOOTSTRAP_SQL = "\n-- \u2500\u2500 Extensions \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n-- Supabase enables these by default and migrations lean on them\n-- (uuid_generate_v4(), crypt(), citext, pg_trgm, \u2026). Each is created into the\n-- 'extensions' schema like hosted Supabase; any not available in this engine\n-- build is skipped rather than aborting the whole bootstrap.\ncreate schema if not exists extensions;\ndo $$\ndeclare ext text;\nbegin\n  foreach ext in array array['uuid-ossp','pgcrypto','citext','pg_trgm','ltree','hstore','fuzzystrmatch'] loop\n    begin\n      execute format('create extension if not exists %I with schema extensions', ext);\n    exception when others then\n      -- extension not bundled in this engine build; continue\n    end;\n  end loop;\nend $$;\n\n-- uuid-ossp isn't in every Postgres build (it needs an external UUID lib at\n-- build time - e.g. the theseus Linux binaries omit it). uuid_generate_v4() is\n-- the single most-used function from it, so shim it onto core gen_random_uuid()\n-- (also a v4 UUID) whenever the real extension isn't present, so migrations\n-- that call it work identically on every engine and platform.\ndo $$\nbegin\n  if not exists (\n    select 1 from pg_proc p join pg_namespace n on n.oid = p.pronamespace\n    where p.proname = 'uuid_generate_v4' and n.nspname in ('public', 'extensions')\n  ) then\n    create function extensions.uuid_generate_v4() returns uuid\n      language sql volatile as 'select gen_random_uuid()';\n  end if;\nend $$;\n\n-- Make extension functions resolvable unqualified (uuid_generate_v4(), \u2026) on\n-- the current session (migrations run here) and for future connections.\ndo $$\nbegin\n  execute 'alter database ' || quote_ident(current_database()) ||\n          ' set search_path to \"$user\", public, extensions';\nexception when others then\n  -- some engines disallow altering the current database; session SET below still applies\nend $$;\nset search_path to \"$user\", public, extensions;\n\n-- \u2500\u2500 Roles \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ndo $$\nbegin\n  if not exists (select from pg_roles where rolname = 'anon') then\n    create role anon nologin noinherit;\n  end if;\n  if not exists (select from pg_roles where rolname = 'authenticated') then\n    create role authenticated nologin noinherit;\n  end if;\n  if not exists (select from pg_roles where rolname = 'service_role') then\n    create role service_role nologin noinherit bypassrls;\n  end if;\nend $$;\n\ngrant usage on schema extensions to anon, authenticated, service_role;\nalter role anon set search_path to \"$user\", public, extensions;\nalter role authenticated set search_path to \"$user\", public, extensions;\nalter role service_role set search_path to \"$user\", public, extensions;\n\ngrant usage on schema public to anon, authenticated, service_role;\ngrant all on all tables in schema public to anon, authenticated, service_role;\ngrant all on all sequences in schema public to anon, authenticated, service_role;\ngrant execute on all functions in schema public to anon, authenticated, service_role;\n\nalter default privileges in schema public\n  grant all on tables to anon, authenticated, service_role;\nalter default privileges in schema public\n  grant all on sequences to anon, authenticated, service_role;\nalter default privileges in schema public\n  grant execute on functions to anon, authenticated, service_role;\n\n-- \u2500\u2500 Auth schema (GoTrue-compatible subset) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists auth;\n\ncreate table if not exists auth.users (\n  instance_id uuid default '00000000-0000-0000-0000-000000000000',\n  id uuid primary key default gen_random_uuid(),\n  aud text default 'authenticated',\n  role text default 'authenticated',\n  email text unique,\n  encrypted_password text,\n  email_confirmed_at timestamptz,\n  invited_at timestamptz,\n  confirmation_token text default '',\n  confirmation_sent_at timestamptz,\n  recovery_token text default '',\n  recovery_sent_at timestamptz,\n  email_change_token_new text default '',\n  email_change text default '',\n  email_change_sent_at timestamptz,\n  email_change_token_current text default '',\n  email_change_confirm_status smallint default 0,\n  last_sign_in_at timestamptz,\n  raw_app_meta_data jsonb default '{}'::jsonb,\n  raw_user_meta_data jsonb default '{}'::jsonb,\n  is_super_admin boolean default false,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  phone text unique,\n  phone_confirmed_at timestamptz,\n  phone_change text default '',\n  phone_change_token text default '',\n  phone_change_sent_at timestamptz,\n  reauthentication_token text default '',\n  reauthentication_sent_at timestamptz,\n  banned_until timestamptz,\n  deleted_at timestamptz,\n  is_anonymous boolean default false\n);\n\ncreate table if not exists auth.refresh_tokens (\n  id bigint generated by default as identity primary key,\n  token text unique not null,\n  user_id uuid not null references auth.users(id) on delete cascade,\n  parent text,\n  session_id uuid,\n  revoked boolean default false,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate index if not exists refresh_tokens_user_id_idx on auth.refresh_tokens(user_id);\n\ncreate table if not exists auth.one_time_tokens (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid references auth.users(id) on delete cascade,\n  email text not null,\n  token_type text not null, -- otp | magiclink | recovery\n  token text not null,\n  attempts int not null default 0,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\ncreate table if not exists auth.identities (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid not null references auth.users(id) on delete cascade,\n  provider text not null,\n  provider_id text not null,\n  identity_data jsonb default '{}'::jsonb,\n  last_sign_in_at timestamptz default now(),\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  unique (provider, provider_id)\n);\n\n-- OAuth / PKCE flow state, bridging /authorize \u2192 provider \u2192 /callback \u2192 exchange\ncreate table if not exists auth.flow_state (\n  id uuid primary key default gen_random_uuid(),\n  provider text not null,\n  provider_state text not null unique,\n  redirect_to text,\n  code_challenge text,\n  code_challenge_method text,\n  auth_code text unique,\n  user_id uuid references auth.users(id) on delete cascade,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\ncreate table if not exists auth.mfa_factors (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid not null references auth.users(id) on delete cascade,\n  friendly_name text,\n  factor_type text not null default 'totp',\n  status text not null default 'unverified', -- unverified | verified\n  secret text,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists auth.mfa_challenges (\n  id uuid primary key default gen_random_uuid(),\n  factor_id uuid not null references auth.mfa_factors(id) on delete cascade,\n  verified_at timestamptz,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\n-- append-only security audit trail (GoTrue-compatible shape)\ncreate table if not exists auth.audit_log_entries (\n  instance_id uuid default '00000000-0000-0000-0000-000000000000',\n  id uuid primary key default gen_random_uuid(),\n  payload jsonb,\n  created_at timestamptz default now(),\n  ip_address varchar(64) not null default ''\n);\ncreate index if not exists audit_logs_instance_id_idx on auth.audit_log_entries(created_at);\n\n-- runtime-mutable instance settings (Studio auth toggles)\ncreate table if not exists auth.config (\n  key text primary key,\n  value jsonb not null,\n  updated_at timestamptz default now()\n);\n\ngrant usage on schema auth to anon, authenticated, service_role;\n\ncreate or replace function auth.jwt() returns jsonb\nlanguage sql stable as $$\n  select coalesce(\n    nullif(current_setting('request.jwt.claims', true), ''),\n    '{}'\n  )::jsonb\n$$;\n\ncreate or replace function auth.uid() returns uuid\nlanguage sql stable as $$\n  select nullif(auth.jwt() ->> 'sub', '')::uuid\n$$;\n\ncreate or replace function auth.role() returns text\nlanguage sql stable as $$\n  select coalesce(auth.jwt() ->> 'role', 'anon')\n$$;\n\ncreate or replace function auth.email() returns text\nlanguage sql stable as $$\n  select auth.jwt() ->> 'email'\n$$;\n\ngrant execute on function auth.jwt(), auth.uid(), auth.role(), auth.email()\n  to anon, authenticated, service_role;\n\n-- \u2500\u2500 Storage schema (storage-api-compatible subset) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists storage;\n\ncreate table if not exists storage.buckets (\n  id text primary key,\n  name text not null unique,\n  owner uuid,\n  public boolean default false,\n  file_size_limit bigint,\n  allowed_mime_types text[],\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists storage.objects (\n  id uuid primary key default gen_random_uuid(),\n  bucket_id text not null references storage.buckets(id),\n  name text not null,\n  owner uuid,\n  version text,\n  metadata jsonb default '{}'::jsonb,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  last_accessed_at timestamptz default now(),\n  unique (bucket_id, name)\n);\n\ncreate index if not exists objects_bucket_name_idx on storage.objects(bucket_id, name);\n\ngrant usage on schema storage to anon, authenticated, service_role;\ngrant select on storage.buckets to anon, authenticated, service_role;\ngrant all on storage.buckets to service_role;\ngrant all on storage.objects to anon, authenticated, service_role;\n\ncreate or replace function storage.foldername(name text) returns text[]\nlanguage sql immutable as $$\n  select (string_to_array(name, '/'))[1 : array_length(string_to_array(name, '/'), 1) - 1]\n$$;\n\ncreate or replace function storage.filename(name text) returns text\nlanguage sql immutable as $$\n  select (string_to_array(name, '/'))[array_length(string_to_array(name, '/'), 1)]\n$$;\n\ncreate or replace function storage.extension(name text) returns text\nlanguage sql immutable as $$\n  select reverse(split_part(reverse(storage.filename(name)), '.', 1))\n$$;\n\nalter table storage.objects enable row level security;\n\n-- Dev-friendly default policies. Replace them in your migrations to lock down.\ndo $$\nbegin\n  if not exists (select from pg_policies where schemaname = 'storage' and tablename = 'objects' and policyname = 'tinbase_authenticated_all') then\n    create policy tinbase_authenticated_all on storage.objects\n      for all to authenticated using (true) with check (true);\n  end if;\n  if not exists (select from pg_policies where schemaname = 'storage' and tablename = 'objects' and policyname = 'tinbase_public_read') then\n    create policy tinbase_public_read on storage.objects\n      for select to anon\n      using (bucket_id in (select id from storage.buckets where public));\n  end if;\nend $$;\n\n-- \u2500\u2500 Migration bookkeeping (same table the Supabase CLI uses) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists supabase_migrations;\n\ncreate table if not exists supabase_migrations.schema_migrations (\n  version text primary key,\n  name text,\n  statements text[],\n  applied_at timestamptz default now()\n);\n\ncreate table if not exists supabase_migrations.seed_files (\n  path text primary key,\n  hash text,\n  applied_at timestamptz default now()\n);\n\n-- \u2500\u2500 Realtime CDC plumbing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists tinbase;\n\ncreate or replace function tinbase.cdc_notify() returns trigger\nlanguage plpgsql security definer as $$\ndeclare\n  payload text;\nbegin\n  payload := json_build_object(\n    'schema', TG_TABLE_SCHEMA,\n    'table', TG_TABLE_NAME,\n    'type', TG_OP,\n    'commit_timestamp', to_char(now() at time zone 'utc', 'YYYY-MM-DD\"T\"HH24:MI:SS.MS\"Z\"'),\n    'record', case when TG_OP in ('INSERT', 'UPDATE') then row_to_json(NEW) else null end,\n    'old_record', case when TG_OP in ('UPDATE', 'DELETE') then row_to_json(OLD) else null end\n  )::text;\n  -- pg_notify payloads are capped at ~8kB; degrade like Supabase does.\n  if octet_length(payload) > 7500 then\n    payload := json_build_object(\n      'schema', TG_TABLE_SCHEMA,\n      'table', TG_TABLE_NAME,\n      'type', TG_OP,\n      'commit_timestamp', to_char(now() at time zone 'utc', 'YYYY-MM-DD\"T\"HH24:MI:SS.MS\"Z\"'),\n      'record', null,\n      'old_record', null,\n      'errors', json_build_array('Payload too large')\n    )::text;\n  end if;\n  perform pg_notify('tinbase_cdc', payload);\n  return coalesce(NEW, OLD);\nend $$;\n\n-- \u2500\u2500 Realtime Authorization + broadcast-from-database \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n-- Mirrors Supabase Realtime: developers write RLS policies on\n-- realtime.messages using realtime.topic(); a SELECT policy grants a private\n-- channel's subscribers the right to *receive*, an INSERT policy the right to\n-- *broadcast*. realtime.send() lets the database push a broadcast to a topic.\ncreate schema if not exists realtime;\n\ncreate table if not exists realtime.messages (\n  id uuid not null default gen_random_uuid(),\n  topic text not null,\n  extension text not null,\n  event text,\n  payload jsonb,\n  private boolean default false,\n  inserted_at timestamptz not null default now(),\n  updated_at timestamptz not null default now(),\n  primary key (id)\n);\nalter table realtime.messages enable row level security;\n\ngrant usage on schema realtime to anon, authenticated, service_role;\ngrant all on realtime.messages to anon, authenticated, service_role;\n\n-- the topic currently being authorized/broadcast (set per operation)\ncreate or replace function realtime.topic() returns text\n  language sql stable as $$ select nullif(current_setting('realtime.topic', true), '') $$;\n\n-- push a broadcast message to all subscribers of <topic> from SQL / triggers.\n-- Delivered over the websocket by the in-process realtime engine, which listens\n-- on the 'tinbase_realtime_broadcast' channel.\ncreate or replace function realtime.send(payload jsonb, event text, topic text, private boolean default true)\n  returns void language plpgsql security definer as $$\nbegin\n  perform pg_notify(\n    'tinbase_realtime_broadcast',\n    json_build_object('topic', topic, 'event', event, 'payload', payload, 'private', private)::text\n  );\nexception when others then\n  -- never let a notify failure abort the caller's transaction\n  null;\nend $$;\n\ngrant execute on function realtime.topic() to anon, authenticated, service_role;\ngrant execute on function realtime.send(jsonb, text, text, boolean) to anon, authenticated, service_role;\n";

package/dist/db/bootstrap.js

@@ -1,13 +1,14 @@
 /**
- * Idempotent bootstrap SQL that shapes a fresh PGlite database like a
- * Supabase project: roles, auth schema, storage schema, helper functions,
- * migration bookkeeping, and the realtime CDC plumbing.
+ * Idempotent bootstrap SQL that shapes a fresh database like a Supabase
+ * project. Two variants: the full {@link BOOTSTRAP_SQL} for the real engines,
+ * and the reduced {@link MINIMAL_BOOTSTRAP_SQL} below for the pg-mem subset.
+ * Both are safe to re-run (create ... if not exists / create or replace).
  */
 /**
  * Reduced bootstrap for subset engines (pg-mem) that can't run plpgsql, RLS
  * policies, extensions, or LISTEN/NOTIFY. Just the schemas, core tables, and
  * SQL-language auth helpers needed for the REST + auth CRUD surface. No RLS is
- * enforced here — this path is for local-dev/preview only.
+ * enforced here - this path is for local-dev/preview only.
  */
 export const MINIMAL_BOOTSTRAP_SQL = `
 create schema if not exists auth;
@@ -107,6 +108,13 @@ create table if not exists auth.audit_log_entries (
   ip_address varchar(64) not null default ''
 );
 
+-- runtime-mutable instance settings (Studio auth toggles)
+create table if not exists auth.config (
+  key text primary key,
+  value jsonb not null,
+  updated_at timestamptz default now()
+);
+
 create table if not exists storage.buckets (
   id text primary key,
   name text not null unique,
@@ -144,6 +152,12 @@ create table if not exists supabase_migrations.seed_files (
   applied_at timestamptz default now()
 );
 `;
+/**
+ * Full bootstrap for the real engines (PGlite / native embedded Postgres):
+ * extensions, the anon/authenticated/service_role roles, GoTrue-compatible auth
+ * schema, storage schema with default RLS policies, migration bookkeeping, and
+ * the realtime CDC + broadcast plumbing.
+ */
 export const BOOTSTRAP_SQL = `
 -- ── Extensions ─────────────────────────────────────────────────────────────
 -- Supabase enables these by default and migrations lean on them
@@ -164,7 +178,7 @@ begin
 end $$;
 
 -- uuid-ossp isn't in every Postgres build (it needs an external UUID lib at
--- build time — e.g. the theseus Linux binaries omit it). uuid_generate_v4() is
+-- build time - e.g. the theseus Linux binaries omit it). uuid_generate_v4() is
 -- the single most-used function from it, so shim it onto core gen_random_uuid()
 -- (also a v4 UUID) whenever the real extension isn't present, so migrations
 -- that call it work identically on every engine and platform.
@@ -339,6 +353,13 @@ create table if not exists auth.audit_log_entries (
 );
 create index if not exists audit_logs_instance_id_idx on auth.audit_log_entries(created_at);
 
+-- runtime-mutable instance settings (Studio auth toggles)
+create table if not exists auth.config (
+  key text primary key,
+  value jsonb not null,
+  updated_at timestamptz default now()
+);
+
 grant usage on schema auth to anon, authenticated, service_role;
 
 create or replace function auth.jwt() returns jsonb

package/dist/db/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/db/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsIpC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4X5B,CAAA"}
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/db/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6IpC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmY5B,CAAA"}

package/dist/db/database.d.ts

@@ -1,12 +1,15 @@
 import type { DbEngine, EngineResults } from './engine.js';
 import type { MigrationFile, RequestContext } from '../types.js';
+/** One column of an introspected table. */
 export interface ColumnInfo {
     name: string;
+    /** underlying pg type name (pg_type.typname / information_schema.udt_name). */
     udtName: string;
     isNullable: boolean;
     hasDefault: boolean;
     isPrimaryKey: boolean;
 }
+/** A foreign-key constraint, with source and target columns paired by position. */
 export interface ForeignKey {
     constraintName: string;
     srcSchema: string;
@@ -16,16 +19,26 @@ export interface ForeignKey {
     tgtTable: string;
     tgtColumns: string[];
 }
+/** An introspected table: its columns and primary-key column names. */
 export interface TableInfo {
     schema: string;
     name: string;
     columns: ColumnInfo[];
     primaryKey: string[];
+    /**
+     * Column-sets with a uniqueness guarantee (each PRIMARY KEY / UNIQUE
+     * constraint, columns in definition order). Used to decide embed cardinality:
+     * a foreign key whose columns are a unique key on the referencing side is a
+     * one-to-one relationship (PostgREST serializes it as an object, not array).
+     */
+    uniqueKeys: string[][];
 }
+/** One argument of a database function. */
 export interface FunctionArg {
     name: string;
     type: string;
 }
+/** An introspected database function (used to route RPC calls). */
 export interface FunctionInfo {
     schema: string;
     name: string;
@@ -33,22 +46,38 @@ export interface FunctionInfo {
     returnType: string;
     /** pg_type.typtype: b=base, c=composite, p=pseudo, d=domain, e=enum */
     returnTypType: string;
+    /** pg_proc.provolatile: v=volatile, s=stable, i=immutable. Volatile calls may run DDL. */
+    volatility: string;
     args: FunctionArg[];
 }
+/** Introspected shape of one schema: tables keyed by name, plus its foreign keys. */
 export interface SchemaInfo {
     tables: Map<string, TableInfo>;
     foreignKeys: ForeignKey[];
 }
+/** A function that runs a parameterized query, e.g. one bound to a transaction. */
 export type Querier = (sql: string, params?: unknown[]) => Promise<EngineResults>;
+/**
+ * A change-data-capture event for one row, shaped like Supabase Realtime's
+ * `postgres_changes` payload. Emitted by the SQL trigger on the real engines
+ * and synthesized in JS on pg-mem (see {@link Database.emitCdc}).
+ */
 export interface CdcEvent {
     schema: string;
     table: string;
     type: 'INSERT' | 'UPDATE' | 'DELETE';
     commit_timestamp: string;
+    /** post-image; null on DELETE (and on a payload that was too large). */
     record: Record<string, unknown> | null;
+    /** pre-image; null on INSERT (and on a payload that was too large). */
     old_record: Record<string, unknown> | null;
+    /** set when the row was dropped from the payload, e.g. 'Payload too large'. */
     errors?: string[];
 }
+/**
+ * The database facade: wraps a {@link DbEngine} with bootstrap, migration
+ * application, schema introspection (cached), and the realtime CDC pipeline.
+ */
 export declare class Database {
     engine: DbEngine;
     private schemaCache;
@@ -60,27 +89,48 @@ export declare class Database {
     static create(dataDirOrEngine?: string | DbEngine, opts?: {
         vaultKey?: string;
     }): Promise<Database>;
-    /** Superuser query — used by auth/storage internals and introspection. */
+    /** Superuser query - used by auth/storage internals and introspection. */
     query<T = any>(sql: string, params?: unknown[]): Promise<EngineResults<T>>;
+    /** Run one or more SQL statements with no params (superuser). */
     exec(sql: string): Promise<unknown>;
     /**
      * Run `fn` inside a transaction with the request's Postgres role and JWT
-     * claims applied via SET LOCAL — this is what makes RLS behave exactly
+     * claims applied via SET LOCAL - this is what makes RLS behave exactly
      * like hosted Supabase.
      */
     withContext<T>(ctx: RequestContext, fn: (q: Querier) => Promise<T>): Promise<T>;
+    /**
+     * Apply any not-yet-recorded migrations (in lexicographic version order) and
+     * an optional seed, each in its own transaction, then invalidate the schema
+     * cache. Returns the names of what was applied this run.
+     *
+     * @throws whatever a migration throws, except on the pg-mem engine where an
+     *   unsupported migration is skipped with a warning instead of aborting.
+     */
     runMigrations(migrations: MigrationFile[], seedSql?: string): Promise<string[]>;
+    /** Every migration recorded as applied, oldest version first. */
     listAppliedMigrations(): Promise<{
         version: string;
         name: string | null;
     }[]>;
+    /** Drop all cached introspection; call after any DDL changes the schema. */
     invalidateSchemaCache(): void;
     private rlsCache;
     /** Names of tables in `schema` that have row-level security enabled. */
     getRlsTables(schema: string): Promise<Set<string>>;
+    /** Introspect a schema's tables, columns, PKs, and FKs. Cached per schema. */
     getSchemaInfo(schema: string): Promise<SchemaInfo>;
+    /**
+     * All overloads of a function by schema + name (cached). Multiple rows mean
+     * the name is overloaded on argument types.
+     */
     getFunctions(schema: string, name: string): Promise<FunctionInfo[]>;
+    /** Idempotently attach the CDC notify trigger to a table (real engines only). */
     ensureCdcTrigger(schema: string, table: string): Promise<void>;
+    /**
+     * Register a CDC listener; the first call starts the single LISTEN on the
+     * shared `tinbase_cdc` channel. Returns an unsubscribe fn.
+     */
     onCdcEvent(cb: (e: CdcEvent) => void): Promise<() => void>;
     /**
      * True when the engine can't run the trigger + `pg_notify` CDC pipeline
@@ -95,7 +145,7 @@ export declare class Database {
      * triggers/NOTIFY (pg-mem). Called by the REST handler after a committed
      * mutation, one event per affected row.
      *
-     * NOTE: these engines have no RLS, so events are delivered unfiltered — the
+     * NOTE: these engines have no RLS, so events are delivered unfiltered - the
      * per-subscriber row check in the realtime layer is a no-op here.
      */
     emitCdc(meta: {
@@ -103,7 +153,15 @@ export declare class Database {
         table: string;
         type: CdcEvent['type'];
     }, rows: Record<string, unknown>[]): void;
+    /** Close the underlying engine and its connection. */
     close(): Promise<void>;
 }
+/** Parse pg_get_function_identity_arguments output: "a integer, b text[]". */
+export declare function parseIdentityArgs(identity: string): FunctionArg[];
+/**
+ * Double-quote an identifier for safe interpolation into SQL.
+ * @throws if the name contains a NUL, which Postgres identifiers can't hold.
+ */
 export declare function quoteIdent(name: string): string;
+/** Single-quote a string literal for safe interpolation into SQL. */
 export declare function quoteLiteral(value: string): string;

package/dist/db/database.js

@@ -1,3 +1,10 @@
+/**
+ * The Database facade over a DbEngine: bootstraps a fresh database into a
+ * Supabase-shaped project, applies migrations/seeds the way the Supabase CLI
+ * does, introspects schema/functions (with caching), and drives the realtime
+ * CDC pipeline. Everything above the engine (REST, auth, storage, realtime)
+ * goes through this class.
+ */
 import { BOOTSTRAP_SQL, MINIMAL_BOOTSTRAP_SQL } from './bootstrap.js';
 import { PGMQ_SQL, CRON_SQL, NET_SQL, EXT_COMPAT_SQL, VAULT_SQL } from './emulated.js';
 import { rewriteMigrationSql } from './sql-compat.js';
@@ -6,6 +13,10 @@ import { rewriteMigrationSql } from './sql-compat.js';
 // migration's own `SET search_path` can't leak across our single connection.
 const DEFAULT_SEARCH_PATH_SQL = `set search_path to "$user", public, extensions`;
 import { createPgliteEngine } from './pglite-engine.js';
+/**
+ * The database facade: wraps a {@link DbEngine} with bootstrap, migration
+ * application, schema introspection (cached), and the realtime CDC pipeline.
+ */
 export class Database {
     engine;
     schemaCache = new Map();
@@ -26,7 +37,7 @@ export class Database {
         }
         else {
             await engine.exec(BOOTSTRAP_SQL);
-            // emulated extensions (pgmq queues, cron, pg_net) — pure SQL, so
+            // emulated extensions (pgmq queues, cron, pg_net) - pure SQL, so
             // pgmq.*/cron.*/net.* work with no C extension on either engine
             await engine.exec(PGMQ_SQL);
             await engine.exec(CRON_SQL);
@@ -41,16 +52,17 @@ export class Database {
         }
         return new Database(engine);
     }
-    /** Superuser query — used by auth/storage internals and introspection. */
+    /** Superuser query - used by auth/storage internals and introspection. */
     query(sql, params) {
         return this.engine.query(sql, params);
     }
+    /** Run one or more SQL statements with no params (superuser). */
     exec(sql) {
         return this.engine.exec(sql);
     }
     /**
      * Run `fn` inside a transaction with the request's Postgres role and JWT
-     * claims applied via SET LOCAL — this is what makes RLS behave exactly
+     * claims applied via SET LOCAL - this is what makes RLS behave exactly
      * like hosted Supabase.
      */
     async withContext(ctx, fn) {
@@ -61,9 +73,20 @@ export class Database {
         });
     }
     // ── Migrations (Supabase CLI conventions) ────────────────────────────
+    /**
+     * Apply any not-yet-recorded migrations (in lexicographic version order) and
+     * an optional seed, each in its own transaction, then invalidate the schema
+     * cache. Returns the names of what was applied this run.
+     *
+     * @throws whatever a migration throws, except on the pg-mem engine where an
+     *   unsupported migration is skipped with a warning instead of aborting.
+     */
     async runMigrations(migrations, seedSql) {
         const applied = [];
-        const sorted = [...migrations].sort((a, b) => a.name.localeCompare(b.name));
+        // Plain code-unit comparison (not localeCompare, which is locale-dependent
+        // and can reorder `_`/digits) so migrations apply in the same order on every
+        // machine, matching the Supabase CLI's lexicographic version ordering.
+        const sorted = [...migrations].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
         for (const m of sorted) {
             const version = m.name.match(/^(\d+)/)?.[1] ?? m.name;
             const seen = await this.engine.query(`select 1 from supabase_migrations.schema_migrations where version = $1`, [version]);
@@ -73,7 +96,7 @@ export class Database {
                 // The Supabase CLI applies each migration on a fresh connection, so a
                 // top-level `SET search_path TO ''` in one file never leaks to the next.
                 // tinbase runs every migration on one connection, so reset to the
-                // default first — otherwise a hardened migration's search_path change
+                // default first - otherwise a hardened migration's search_path change
                 // breaks unqualified calls (e.g. gen_random_bytes) in later files.
                 await tx.exec(DEFAULT_SEARCH_PATH_SQL);
                 await tx.exec(rewriteMigrationSql(m.sql));
@@ -109,18 +132,20 @@ export class Database {
             }
         }
         if (applied.length > 0) {
-            // a migration/seed may have left the session search_path at '' — restore
+            // a migration/seed may have left the session search_path at '' - restore
             // the default so runtime queries resolve extension functions unqualified
             await this.engine.exec(DEFAULT_SEARCH_PATH_SQL);
             this.invalidateSchemaCache();
         }
         return applied;
     }
+    /** Every migration recorded as applied, oldest version first. */
     async listAppliedMigrations() {
         const res = await this.engine.query(`select version, name from supabase_migrations.schema_migrations order by version`);
         return res.rows;
     }
     // ── Introspection ────────────────────────────────────────────────────
+    /** Drop all cached introspection; call after any DDL changes the schema. */
     invalidateSchemaCache() {
         this.schemaCache.clear();
         this.fnCache.clear();
@@ -139,6 +164,7 @@ export class Database {
         this.rlsCache.set(schema, set);
         return set;
     }
+    /** Introspect a schema's tables, columns, PKs, and FKs. Cached per schema. */
     async getSchemaInfo(schema) {
         const cached = this.schemaCache.get(schema);
         if (cached)
@@ -154,6 +180,25 @@ export class Database {
          on kcu.constraint_name = tc.constraint_name
         and kcu.constraint_schema = tc.constraint_schema
        where tc.constraint_type = 'PRIMARY KEY' and tc.table_schema = $1`, [schema]);
+        // PRIMARY KEY + UNIQUE constraints, grouped per constraint (in column order)
+        // so embed cardinality can tell one-to-one from one-to-many.
+        const uniq = await this.engine.query(`select kcu.table_name, kcu.constraint_name, kcu.column_name, kcu.ordinal_position as ordinal
+       from information_schema.table_constraints tc
+       join information_schema.key_column_usage kcu
+         on kcu.constraint_name = tc.constraint_name
+        and kcu.constraint_schema = tc.constraint_schema
+       where tc.constraint_type in ('PRIMARY KEY', 'UNIQUE') and tc.table_schema = $1
+       order by kcu.constraint_name, kcu.ordinal_position`, [schema]);
+        // table -> constraint -> ordered column list
+        const uniqByTable = new Map();
+        for (const u of uniq.rows) {
+            if (!uniqByTable.has(u.table_name))
+                uniqByTable.set(u.table_name, new Map());
+            const byConstraint = uniqByTable.get(u.table_name);
+            if (!byConstraint.has(u.constraint_name))
+                byConstraint.set(u.constraint_name, []);
+            byConstraint.get(u.constraint_name).push(u.column_name);
+        }
         const fks = await this.engine.query(`select
          tc.constraint_name,
          tc.table_schema as src_schema, tc.table_name as src_table,
@@ -185,6 +230,7 @@ export class Database {
                     name: c.table_name,
                     columns: [],
                     primaryKey: [...(pkSet.get(c.table_name) ?? [])],
+                    uniqueKeys: [...(uniqByTable.get(c.table_name)?.values() ?? [])],
                 });
             }
             tables.get(c.table_name).columns.push({
@@ -219,6 +265,10 @@ export class Database {
         this.schemaCache.set(schema, info);
         return info;
     }
+    /**
+     * All overloads of a function by schema + name (cached). Multiple rows mean
+     * the name is overloaded on argument types.
+     */
     async getFunctions(schema, name) {
         const key = `${schema}.${name}`;
         const cached = this.fnCache.get(key);
@@ -226,6 +276,7 @@ export class Database {
             return cached;
         const res = await this.engine.query(`select p.proname as name, p.proretset as returns_set,
               t.typname as return_type, t.typtype as return_typtype,
+              p.provolatile as volatility,
               pg_get_function_identity_arguments(p.oid) as identity_args
        from pg_proc p
        join pg_namespace n on n.oid = p.pronamespace
@@ -237,12 +288,14 @@ export class Database {
             returnsSet: r.returns_set,
             returnType: r.return_type,
             returnTypType: r.return_typtype,
+            volatility: r.volatility,
             args: parseIdentityArgs(r.identity_args),
         }));
         this.fnCache.set(key, fns);
         return fns;
     }
     // ── Realtime CDC ─────────────────────────────────────────────────────
+    /** Idempotently attach the CDC notify trigger to a table (real engines only). */
     async ensureCdcTrigger(schema, table) {
         const s = quoteIdent(schema);
         const t = quoteIdent(table);
@@ -263,6 +316,10 @@ export class Database {
       end $$;
     `);
     }
+    /**
+     * Register a CDC listener; the first call starts the single LISTEN on the
+     * shared `tinbase_cdc` channel. Returns an unsubscribe fn.
+     */
     async onCdcEvent(cb) {
         this.cdcListeners.add(cb);
         if (!this.cdcStarted) {
@@ -274,7 +331,7 @@ export class Database {
                         listener(event);
                 }
                 catch {
-                    // malformed payload — drop
+                    // malformed payload - drop
                 }
             });
         }
@@ -295,7 +352,7 @@ export class Database {
      * triggers/NOTIFY (pg-mem). Called by the REST handler after a committed
      * mutation, one event per affected row.
      *
-     * NOTE: these engines have no RLS, so events are delivered unfiltered — the
+     * NOTE: these engines have no RLS, so events are delivered unfiltered - the
      * per-subscriber row check in the realtime layer is a no-op here.
      */
     emitCdc(meta, rows) {
@@ -314,12 +371,13 @@ export class Database {
                 listener(event);
         }
     }
+    /** Close the underlying engine and its connection. */
     async close() {
         await this.engine.close();
     }
 }
 /** Parse pg_get_function_identity_arguments output: "a integer, b text[]". */
-function parseIdentityArgs(identity) {
+export function parseIdentityArgs(identity) {
     if (!identity.trim())
         return [];
     const parts = [];
@@ -351,11 +409,16 @@ function parseIdentityArgs(identity) {
         return { name, type: tokens.slice(1).join(' ') };
     });
 }
+/**
+ * Double-quote an identifier for safe interpolation into SQL.
+ * @throws if the name contains a NUL, which Postgres identifiers can't hold.
+ */
 export function quoteIdent(name) {
     if (name.includes('\0'))
         throw new Error('invalid identifier');
     return `"${name.replaceAll('"', '""')}"`;
 }
+/** Single-quote a string literal for safe interpolation into SQL. */
 export function quoteLiteral(value) {
     return `'${value.replaceAll("'", "''")}'`;
 }