tinbase 0.10.0 → 0.10.2

package/dist/types.d.ts

@@ -1,9 +1,22 @@
+/**
+ * Public configuration and shared types for the tinbase package. {@link BackendConfig}
+ * is the primary input to {@link import('./index.js').createBackend}; the rest are
+ * the small structural types that config and handlers exchange.
+ */
 import type { JwtClaims } from './jwt.js';
+/** A single SQL migration, in Supabase CLI form (one file under supabase/migrations). */
 export interface MigrationFile {
     /** e.g. "20240101120000_create_posts" (no extension) */
     name: string;
+    /** Raw SQL applied in one statement batch. */
     sql: string;
 }
+/**
+ * Configuration for {@link import('./index.js').createBackend}. Every field is
+ * optional; an empty config boots an in-memory PGlite backend on the Supabase
+ * local-dev defaults. The CLI derives this object from supabase/config.toml plus
+ * the project's migrations/functions/seed.
+ */
 export interface BackendConfig {
     /**
      * PGlite data directory. Node: a filesystem path. Browser: "idb://name" or
@@ -24,16 +37,43 @@ export interface BackendConfig {
     databaseUrl?: string;
     /** Secret used to sign/verify every JWT. Defaults to the Supabase local-dev secret. */
     jwtSecret?: string;
+    /**
+     * Schemas exposed through the Data API (/rest/v1) for anon/authenticated -
+     * PostgREST's db-schemas. Requests profiling into any other schema get a 406
+     * unless made with the service_role key. Default: ['public'].
+     */
+    dbSchemas?: string[];
+    /**
+     * Auth setting defaults (the committed baseline, e.g. read from
+     * supabase/config.toml's [auth] section). Live studio edits, persisted in the
+     * auth.config table, are layered on top. Any omitted key falls back to the
+     * built-in default.
+     */
+    authSettings?: Partial<import('./auth/settings.js').AuthSettings>;
     /**
      * Key used to encrypt Vault secrets at rest (pgcrypto). Held only in a session
      * GUC, never stored in the database. Defaults to a value derived from
-     * jwtSecret; set a dedicated key in production.
+     * jwtSecret. Required when binding to a network-exposed host (see `host`);
+     * always set a dedicated key in production.
      */
     vaultKey?: string;
     /** External URL of this backend, used as JWT issuer. */
     siteUrl?: string;
+    /**
+     * Host the server is bound to. Used only to decide whether the backend is
+     * network-exposed: a non-loopback host turns the default JWT secret and the
+     * derived vault key from warnings into hard startup errors. Default: treated
+     * as loopback (local dev) when omitted.
+     */
+    host?: string;
     /** Access token lifetime in seconds (default 3600). */
     jwtExpiry?: number;
+    /**
+     * Redirect targets allowed beyond the site URL's own origin (GoTrue's
+     * URI_ALLOW_LIST). Entries may use `*`/`**` globs. A `redirect_to` matching
+     * neither the site origin nor an entry falls back to the site URL.
+     */
+    uriAllowList?: string[];
     /** Migrations to apply on boot (Supabase CLI convention: sorted by name). */
     migrations?: MigrationFile[];
     /** SQL from supabase/seed.sql, applied once after the first migration run. */
@@ -66,17 +106,42 @@ export interface BackendConfig {
     logMailBody?: boolean;
     /** Data-retention windows for the background cleanup sweep. */
     retention?: import('./retention/service.js').RetentionConfig;
+    /** Max rows a single REST read returns (PostgREST db-max-rows; config.toml api.max_rows). Unlimited if unset. */
+    maxRows?: number;
+    /** Default per-bucket file size limit in bytes (config.toml storage.file_size_limit). */
+    storageFileSizeLimit?: number;
+    /** Buckets to create at boot if absent (config.toml storage.buckets.*). */
+    buckets?: BucketSeed[];
+    /** Force sign-out after this many seconds regardless of activity (config.toml auth.sessions.timebox). */
+    sessionTimeboxSeconds?: number;
+    /** Sign out after this many seconds of inactivity (config.toml auth.sessions.inactivity_timeout). */
+    sessionInactivitySeconds?: number;
+    /** Per-endpoint auth rate-limit rules (config.toml auth.rate_limit.*). Defaults applied when unset. */
+    authRateLimits?: Record<string, import('./auth/rate-limit.js').RateLimitRule>;
+    /** Mount the auth service. Default true; config.toml auth.enabled = false turns /auth/v1 off. */
+    authEnabled?: boolean;
 }
+/** A rendered outbound email (OTP code, magic link, recovery, etc.). */
 export interface MailMessage {
     to: string;
     subject: string;
+    /** Plain-text body. Carries OTP codes / magic links, so it is not logged by default. */
     text: string;
 }
 /** Pluggable mail transport. Default implementation logs to the console. */
 export interface Mailer {
     send(msg: MailMessage): Promise<void>;
 }
+/**
+ * The public Supabase local-dev JWT secret. Used when no `jwtSecret` is set so
+ * default keys match a stock `supabase start`.
+ *
+ * SECURITY: forgeable by anyone (it is public). Startup refuses to bind to a
+ * network-exposed host while still using it - see {@link import('./security.js').assertSecretsSafe}.
+ */
 export declare const DEFAULT_JWT_SECRET = "super-secret-jwt-token-with-at-least-32-characters-long";
+/** tinbase package version, surfaced in health/root responses. Keep in sync with package.json. */
+export declare const TINBASE_VERSION = "0.9.0";
 /** Per-request execution context derived from apikey/Authorization headers. */
 export interface RequestContext {
     /** Postgres role to SET LOCAL: anon | authenticated | service_role */
@@ -84,12 +149,23 @@ export interface RequestContext {
     /** Verified JWT claims (published to request.jwt.claims for RLS). */
     claims: JwtClaims | null;
 }
+/** A bucket to create at boot (from config.toml [storage.buckets.<id>]). */
+export interface BucketSeed {
+    id: string;
+    public: boolean;
+    /** Per-bucket byte limit, or null for none. */
+    fileSizeLimit: number | null;
+    /** Allowed MIME types, or null for any. */
+    allowedMimeTypes: string[] | null;
+}
+/** Pluggable object-storage backend for bucket bytes (in-memory, fs, etc.). */
 export interface StorageDriver {
     put(key: string, data: Uint8Array): Promise<void>;
     get(key: string): Promise<Uint8Array | null>;
     delete(key: string): Promise<void>;
     deleteMany(keys: string[]): Promise<void>;
 }
+/** Error carrying an HTTP status + JSON body, thrown by handlers and rendered as-is to the client. */
 export declare class ApiError extends Error {
     status: number;
     body: Record<string, unknown>;

package/dist/types.js

@@ -1,4 +1,14 @@
+/**
+ * The public Supabase local-dev JWT secret. Used when no `jwtSecret` is set so
+ * default keys match a stock `supabase start`.
+ *
+ * SECURITY: forgeable by anyone (it is public). Startup refuses to bind to a
+ * network-exposed host while still using it - see {@link import('./security.js').assertSecretsSafe}.
+ */
 export const DEFAULT_JWT_SECRET = 'super-secret-jwt-token-with-at-least-32-characters-long';
+/** tinbase package version, surfaced in health/root responses. Keep in sync with package.json. */
+export const TINBASE_VERSION = '0.9.0';
+/** Error carrying an HTTP status + JSON body, thrown by handlers and rendered as-is to the client. */
 export class ApiError extends Error {
     status;
     body;

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAmFA,MAAM,CAAC,MAAM,kBAAkB,GAAG,yDAAyD,CAAA;AAiB3F,MAAM,OAAO,QAAS,SAAQ,KAAK;IAExB;IACA;IAFT,YACS,MAAc,EACd,IAA6B;QAEpC,KAAK,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAHtE,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAyB;IAGtC,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AA2IA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,yDAAyD,CAAA;AAE3F,kGAAkG;AAClG,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAA;AA4BtC,sGAAsG;AACtG,MAAM,OAAO,QAAS,SAAQ,KAAK;IAExB;IACA;IAFT,YACS,MAAc,EACd,IAA6B;QAEpC,KAAK,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAHtE,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAyB;IAGtC,CAAC;CACF"}

package/dist/webhooks/service.d.ts

@@ -1,14 +1,16 @@
 /**
- * Database webhooks — fire an HTTP request when rows change, the tinbase
+ * Database webhooks - fire an HTTP request when rows change, the tinbase
  * equivalent of Supabase Database Webhooks (which use pg_net under the hood).
  * Built on the existing CDC pipeline (triggers + pg_notify), so it needs no C
  * extension and works on both engines. The POST body matches Supabase's
  * webhook payload exactly: { type, table, schema, record, old_record }.
  */
 import type { CdcEvent, Database } from '../db/database.js';
+/** A registered database webhook: which changes to watch and where to POST them. */
 export interface WebhookConfig {
     /** table to watch */
     table: string;
+    /** schema of the watched table; defaults to 'public' */
     schema?: string;
     /** which events fire the hook; default all */
     events?: ('INSERT' | 'UPDATE' | 'DELETE')[];
@@ -21,26 +23,47 @@ export interface WebhookConfig {
     /** request timeout ms (default 5000) */
     timeoutMs?: number;
 }
+/** Result of one webhook delivery attempt, passed to the optional `onDelivery` callback. */
 export interface WebhookDelivery {
     webhook: WebhookConfig;
+    /** the CDC event that triggered this delivery */
     event: CdcEvent;
+    /** HTTP response status; null when the request never got a reply (error/blocked) */
     status: number | null;
+    /** true when the response was 2xx */
     ok: boolean;
+    /** failure reason (network error, blocked SSRF target); undefined on success */
     error?: string;
 }
+/** Watches the CDC stream and POSTs matching row changes to registered webhooks. */
 export declare class WebhooksService {
     private db;
     private fetchImpl;
     private onDelivery?;
+    /**
+     * Block delivery to loopback/private/link-local targets (SSRF guard). Off by
+     * default so local dev can point a webhook at a local edge function, as
+     * `supabase start` does; the backend turns it on when network-exposed.
+     */
+    private restrictTargets;
     private hooks;
     private stop;
     private started;
-    constructor(db: Database, fetchImpl?: typeof fetch, onDelivery?: ((d: WebhookDelivery) => void) | undefined);
+    constructor(db: Database, fetchImpl?: typeof fetch, onDelivery?: ((d: WebhookDelivery) => void) | undefined, 
+    /**
+     * Block delivery to loopback/private/link-local targets (SSRF guard). Off by
+     * default so local dev can point a webhook at a local edge function, as
+     * `supabase start` does; the backend turns it on when network-exposed.
+     */
+    restrictTargets?: boolean);
+    /** All currently registered webhooks. */
     list(): WebhookConfig[];
     /** Register a webhook (ensures the CDC trigger + subscription are live). */
     register(hook: WebhookConfig): Promise<void>;
+    /** Register an initial set of webhooks and start dispatching if any exist. */
     start(initial?: WebhookConfig[]): Promise<void>;
     private ensureStarted;
+    /** Unsubscribe from the CDC stream; registered hooks are retained. */
     stopService(): void;
     private dispatch;
     private deliver;

package/dist/webhooks/service.js

@@ -1,15 +1,26 @@
+import { guardedFetch } from '../net/service.js';
+/** Watches the CDC stream and POSTs matching row changes to registered webhooks. */
 export class WebhooksService {
     db;
     fetchImpl;
     onDelivery;
+    restrictTargets;
     hooks = [];
     stop = null;
     started = false;
-    constructor(db, fetchImpl = fetch, onDelivery) {
+    constructor(db, fetchImpl = fetch, onDelivery, 
+    /**
+     * Block delivery to loopback/private/link-local targets (SSRF guard). Off by
+     * default so local dev can point a webhook at a local edge function, as
+     * `supabase start` does; the backend turns it on when network-exposed.
+     */
+    restrictTargets = false) {
         this.db = db;
         this.fetchImpl = fetchImpl;
         this.onDelivery = onDelivery;
+        this.restrictTargets = restrictTargets;
     }
+    /** All currently registered webhooks. */
     list() {
         return [...this.hooks];
     }
@@ -19,6 +30,7 @@ export class WebhooksService {
         await this.db.ensureCdcTrigger(hook.schema ?? 'public', hook.table).catch(() => { });
         await this.ensureStarted();
     }
+    /** Register an initial set of webhooks and start dispatching if any exist. */
     async start(initial = []) {
         for (const h of initial) {
             this.hooks.push(h);
@@ -33,6 +45,7 @@ export class WebhooksService {
         this.started = true;
         this.stop = await this.db.onCdcEvent((e) => this.dispatch(e));
     }
+    /** Unsubscribe from the CDC stream; registered hooks are retained. */
     stopService() {
         this.stop?.();
         this.stop = null;
@@ -61,12 +74,17 @@ export class WebhooksService {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), hook.timeoutMs ?? 5000);
         try {
-            const res = await this.fetchImpl(hook.url, {
+            const init = {
                 method: hook.method ?? 'POST',
                 headers: { 'content-type': 'application/json', ...(hook.headers ?? {}) },
                 body: JSON.stringify(payload),
                 signal: controller.signal,
-            });
+            };
+            // When network-exposed, apply the SSRF guard (incl. redirect re-validation);
+            // on loopback dev, deliver directly so localhost webhooks still work.
+            const res = this.restrictTargets
+                ? await guardedFetch(this.fetchImpl, hook.url, init)
+                : await this.fetchImpl(hook.url, init);
             this.onDelivery?.({ webhook: hook, event, status: res.status, ok: res.ok });
         }
         catch (e) {

package/dist/webhooks/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/webhooks/service.ts"],"names":[],"mappings":"AAiCA,MAAM,OAAO,eAAe;IAMhB;IACA;IACA;IAPF,KAAK,GAAoB,EAAE,CAAA;IAC3B,IAAI,GAAwB,IAAI,CAAA;IAChC,OAAO,GAAG,KAAK,CAAA;IAEvB,YACU,EAAY,EACZ,YAA0B,KAAK,EAC/B,UAAyC;QAFzC,OAAE,GAAF,EAAE,CAAU;QACZ,cAAS,GAAT,SAAS,CAAsB;QAC/B,eAAU,GAAV,UAAU,CAA+B;IAChD,CAAC;IAEJ,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,QAAQ,CAAC,IAAmB;QAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrB,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACnF,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;IAC5B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAA2B,EAAE;QACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAClB,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;IACvD,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAM;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED,WAAW;QACT,IAAI,CAAC,IAAI,EAAE,EAAE,CAAA;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;IACtB,CAAC;IAEO,QAAQ,CAAC,KAAe;QAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,MAAM;gBAAE,SAAQ;YACxD,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;gBAAE,SAAQ;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;YAC5D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAC1C,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAChC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAmB,EAAE,KAAe;QACxD,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;SACrC,CAAA;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAA;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE;gBACzC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM;gBAC7B,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;gBACxE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAA;YACF,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;QAC7E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,EAAE,IAAI;gBACb,KAAK;gBACL,MAAM,EAAE,IAAI;gBACZ,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;aAClD,CAAC,CAAA;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/webhooks/service.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAiChD,oFAAoF;AACpF,MAAM,OAAO,eAAe;IAMhB;IACA;IACA;IAMA;IAbF,KAAK,GAAoB,EAAE,CAAA;IAC3B,IAAI,GAAwB,IAAI,CAAA;IAChC,OAAO,GAAG,KAAK,CAAA;IAEvB,YACU,EAAY,EACZ,YAA0B,KAAK,EAC/B,UAAyC;IACjD;;;;OAIG;IACK,kBAAkB,KAAK;QARvB,OAAE,GAAF,EAAE,CAAU;QACZ,cAAS,GAAT,SAAS,CAAsB;QAC/B,eAAU,GAAV,UAAU,CAA+B;QAMzC,oBAAe,GAAf,eAAe,CAAQ;IAC9B,CAAC;IAEJ,yCAAyC;IACzC,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,QAAQ,CAAC,IAAmB;QAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrB,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACnF,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;IAC5B,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,KAAK,CAAC,UAA2B,EAAE;QACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAClB,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;IACvD,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAM;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED,sEAAsE;IACtE,WAAW;QACT,IAAI,CAAC,IAAI,EAAE,EAAE,CAAA;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;IACtB,CAAC;IAEO,QAAQ,CAAC,KAAe;QAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,MAAM;gBAAE,SAAQ;YACxD,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;gBAAE,SAAQ;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;YAC5D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAC1C,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAChC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAmB,EAAE,KAAe;QACxD,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;SACrC,CAAA;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAA;QAC1E,IAAI,CAAC;YACH,MAAM,IAAI,GAAgB;gBACxB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM;gBAC7B,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;gBACxE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAA;YACD,6EAA6E;YAC7E,sEAAsE;YACtE,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe;gBAC9B,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;gBACpD,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YACxC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;QAC7E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,EAAE,IAAI;gBACb,KAAK;gBACL,MAAM,EAAE,IAAI;gBACZ,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;aAClD,CAAC,CAAA;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tinbase",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "A Docker-free, Supabase-compatible local backend — real Postgres (embedded native or PGlite/WASM), wire-compatible with supabase-js.",
   "type": "module",
   "author": "Sanket Sahu",
@@ -22,11 +22,13 @@
   "scripts": {
     "build": "npm run build:admin && tsc -p tsconfig.json",
     "dev": "tsx src/cli.ts start",
+    "db:reset": "tsx src/cli.ts db reset",
     "test": "vitest run",
     "test:watch": "vitest",
     "build:binary": "npm run build && bun build --compile src/cli.ts --outfile dist-bin/tinbase --external @electric-sql/pglite --define 'process.env.TINBASE_SINGLE_BINARY=\"1\"'",
     "prepublishOnly": "npm run build && npm test",
-    "build:admin": "cd admin-ui && npm run build",
+    "install:admin": "npm --prefix admin-ui ci || npm --prefix admin-ui install",
+    "build:admin": "npm run install:admin && npm --prefix admin-ui run build",
     "parity": "tsx parity/harness.ts"
   },
   "engines": {
@@ -54,7 +56,7 @@
     "type": "git",
     "url": "git+https://github.com/tinbase/tinbase.git"
   },
-  "homepage": "https://tinbase.vercel.app",
+  "homepage": "https://tinbase.dev",
   "bugs": {
     "url": "https://github.com/tinbase/tinbase/issues"
   },