tinbase 0.5.0 → 0.6.1

package/dist/node/bundle-function.js

@@ -0,0 +1,90 @@
+/**
+ * Bundle an edge function with esbuild so it runs under Node like it would on
+ * Supabase's Deno edge runtime. This resolves what a plain `import()` can't:
+ *   - TypeScript and multi-file functions (relative imports)
+ *   - `npm:` / `jsr:` specifiers  → rewritten to esm.sh and fetched
+ *   - `https://` URL imports       → fetched (and their transitive deps)
+ *
+ * Remote modules are fetched at bundle time (first run) and disk-cached, the
+ * same trade Deno makes. esbuild is an optional dependency; when it's missing
+ * the loader falls back to a plain import (Web-API/Deno.serve functions still
+ * work, just not remote/TS imports).
+ */
+import { createHash } from 'node:crypto';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+/** Map a Deno-style specifier to a fetchable URL. Pure — unit tested. */
+export function rewriteRemoteSpecifier(spec) {
+    if (spec.startsWith('npm:'))
+        return `https://esm.sh/${spec.slice(4)}`;
+    if (spec.startsWith('jsr:'))
+        return `https://esm.sh/jsr/${spec.slice(4)}`;
+    return spec; // already an http(s) URL
+}
+const HTTP_CACHE = join(tmpdir(), 'tinbase-fn-http');
+async function fetchModule(url) {
+    const key = createHash('sha256').update(url).digest('hex');
+    const cached = join(HTTP_CACHE, key);
+    if (existsSync(cached))
+        return readFile(cached, 'utf8');
+    const res = await fetch(url, { redirect: 'follow' });
+    if (!res.ok)
+        throw new Error(`failed to fetch ${url}: HTTP ${res.status}`);
+    const body = await res.text();
+    await mkdir(HTTP_CACHE, { recursive: true });
+    await writeFile(cached, body);
+    return body;
+}
+/** esbuild plugin: resolve npm:/jsr:/https imports by fetching from esm.sh. */
+function remotePlugin() {
+    return {
+        name: 'tinbase-remote',
+        setup(build) {
+            build.onResolve({ filter: /^(npm:|jsr:|https?:\/\/)/ }, (args) => ({
+                path: rewriteRemoteSpecifier(args.path),
+                namespace: 'http-url',
+            }));
+            // imports *inside* a fetched module resolve relative to its URL
+            build.onResolve({ filter: /.*/, namespace: 'http-url' }, (args) => ({
+                path: new URL(args.path, args.importer).href,
+                namespace: 'http-url',
+            }));
+            build.onLoad({ filter: /.*/, namespace: 'http-url' }, async (args) => ({
+                contents: await fetchModule(args.path),
+                loader: 'js',
+            }));
+        },
+    };
+}
+/**
+ * Bundle `entryPath` to a single ESM file and return its path (written under
+ * the OS temp dir). Throws if esbuild is not installed.
+ */
+export async function bundleFunction(entryPath, name) {
+    let esbuild;
+    try {
+        esbuild = await import('esbuild');
+    }
+    catch {
+        throw new Error('esbuild-not-available');
+    }
+    const outDir = join(tmpdir(), 'tinbase-fn-bundle');
+    await mkdir(outDir, { recursive: true });
+    const result = await esbuild.build({
+        entryPoints: [entryPath],
+        bundle: true,
+        format: 'esm',
+        platform: 'node',
+        target: 'node18',
+        write: false,
+        logLevel: 'silent',
+        plugins: [remotePlugin()],
+    });
+    const code = result.outputFiles[0].text;
+    const out = join(outDir, `${name}-${createHash('sha256').update(entryPath).digest('hex').slice(0, 8)}.mjs`);
+    await writeFile(out, code);
+    return out;
+}
+//# sourceMappingURL=bundle-function.js.map

package/dist/node/bundle-function.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-function.js","sourceRoot":"","sources":["../../src/node/bundle-function.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,yEAAyE;AACzE,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,kBAAkB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IACrE,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,sBAAsB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,OAAO,IAAI,CAAA,CAAC,yBAAyB;AACvC,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAA;AAEpD,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IACpC,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IACpD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC7B,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5C,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC7B,OAAO,IAAI,CAAA;AACb,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY;IACnB,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,KAAU;YACd,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC,IAAsB,EAAE,EAAE,CAAC,CAAC;gBACnF,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;gBACvC,SAAS,EAAE,UAAU;aACtB,CAAC,CAAC,CAAA;YACH,gEAAgE;YAChE,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,IAAwC,EAAE,EAAE,CAAC,CAAC;gBACtG,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI;gBAC5C,SAAS,EAAE,UAAU;aACtB,CAAC,CAAC,CAAA;YACH,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,IAAsB,EAAE,EAAE,CAAC,CAAC;gBACvF,QAAQ,EAAE,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;gBACtC,MAAM,EAAE,IAAI;aACb,CAAC,CAAC,CAAA;QACL,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAiB,EAAE,IAAY;IAClE,IAAI,OAAiC,CAAA;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAA;IAClD,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;QACjC,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,CAAC,YAAY,EAAE,CAAC;KAC1B,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;IAC3G,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC1B,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/node/db-diff.d.ts

@@ -11,3 +11,24 @@ export interface DbDiffOptions {
 }
 export declare function computeDbDiff(opts: DbDiffOptions): Promise<string[]>;
 export declare function shadowNativeDataDir(): string;
+export interface DbPullOptions extends DbDiffOptions {
+    /** directory to write the migration into (usually supabase/migrations); omit to skip writing */
+    migrationsDir?: string;
+    /** migration name suffix (default 'remote_schema') */
+    name?: string;
+    /** timestamp version prefix; pass for determinism (default: now as YYYYMMDDHHMMSS) */
+    stamp?: string;
+}
+export interface DbPullResult {
+    ddl: string[];
+    version: string | null;
+    path: string | null;
+}
+/**
+ * `tinbase db pull` core: like `db diff`, but writes the delta as a migration
+ * AND records it as already-applied on the live database — the schema is
+ * already there, so a subsequent `tinbase start` must not re-run it. This is
+ * how you bring an out-of-migration (or externally-created) schema under
+ * version control.
+ */
+export declare function pullSchema(opts: DbPullOptions): Promise<DbPullResult>;

package/dist/node/db-diff.js

@@ -5,6 +5,7 @@
  * new migration.
  */
 import { mkdtempSync } from 'node:fs';
+import { mkdir, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createBackend } from '../index.js';
@@ -37,4 +38,45 @@ export async function computeDbDiff(opts) {
 export function shadowNativeDataDir() {
     return join(mkdtempSync(join(tmpdir(), 'tinbase-shadow-')), 'pg');
 }
+/**
+ * `tinbase db pull` core: like `db diff`, but writes the delta as a migration
+ * AND records it as already-applied on the live database — the schema is
+ * already there, so a subsequent `tinbase start` must not re-run it. This is
+ * how you bring an out-of-migration (or externally-created) schema under
+ * version control.
+ */
+export async function pullSchema(opts) {
+    const schema = opts.schema ?? 'public';
+    const shadow = await createBackend({
+        engine: opts.makeShadowEngine ? await opts.makeShadowEngine() : undefined,
+        migrations: opts.migrations,
+    });
+    const live = await createBackend({
+        engine: opts.liveEngine,
+        dataDir: opts.liveEngine ? undefined : opts.liveDataDir,
+        migrations: opts.migrations,
+    });
+    try {
+        const ddl = diffSchemas(await snapshotSchema(shadow.db, schema), await snapshotSchema(live.db, schema), schema);
+        if (ddl.length === 0)
+            return { ddl, version: null, path: null };
+        const stamp = opts.stamp ?? new Date().toISOString().replace(/[-:T]/g, '').slice(0, 14);
+        const name = opts.name ?? 'remote_schema';
+        const body = ddl.join('\n\n') + '\n';
+        let path = null;
+        if (opts.migrationsDir) {
+            await mkdir(opts.migrationsDir, { recursive: true });
+            path = join(opts.migrationsDir, `${stamp}_${name}.sql`);
+            await writeFile(path, body);
+        }
+        // record as already applied on the live DB so `start` won't re-run it
+        await live.db.query(`insert into supabase_migrations.schema_migrations (version, name, statements)
+       values ($1, $2, $3) on conflict (version) do nothing`, [stamp, `${stamp}_${name}`, [body]]);
+        return { ddl, version: stamp, path };
+    }
+    finally {
+        await shadow.close();
+        await live.close();
+    }
+}
 //# sourceMappingURL=db-diff.js.map

package/dist/node/db-diff.js.map

@@ -1 +1 @@
-{"version":3,"file":"db-diff.js","sourceRoot":"","sources":["../../src/node/db-diff.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAuB,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAclE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAA;IAEtC,kCAAkC;IAClC,MAAM,MAAM,GAAmB,MAAM,aAAa,CAAC;QACjD,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS;QACzE,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,oCAAoC;KACrC,CAAC,CAAA;IACF,iFAAiF;IACjF,8EAA8E;IAC9E,MAAM,IAAI,GAAmB,MAAM,aAAa,CAAC;QAC/C,MAAM,EAAE,IAAI,CAAC,UAAU;QACvB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW;QACvD,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC1D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACtD,OAAO,WAAW,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;QACpB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;AACnE,CAAC"}
+{"version":3,"file":"db-diff.js","sourceRoot":"","sources":["../../src/node/db-diff.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACrC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAuB,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAclE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAA;IAEtC,kCAAkC;IAClC,MAAM,MAAM,GAAmB,MAAM,aAAa,CAAC;QACjD,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS;QACzE,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,oCAAoC;KACrC,CAAC,CAAA;IACF,iFAAiF;IACjF,8EAA8E;IAC9E,MAAM,IAAI,GAAmB,MAAM,aAAa,CAAC;QAC/C,MAAM,EAAE,IAAI,CAAC,UAAU;QACvB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW;QACvD,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC1D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACtD,OAAO,WAAW,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;QACpB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;AACnE,CAAC;AAiBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAmB;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAA;IACtC,MAAM,MAAM,GAAmB,MAAM,aAAa,CAAC;QACjD,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS;QACzE,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,MAAM,IAAI,GAAmB,MAAM,aAAa,CAAC;QAC/C,MAAM,EAAE,IAAI,CAAC,UAAU;QACvB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW;QACvD,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;QAC/G,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAE/D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACvF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,eAAe,CAAA;QACzC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;QACpC,IAAI,IAAI,GAAkB,IAAI,CAAA;QAC9B,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACpD,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,CAAA;YACvD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC7B,CAAC;QACD,sEAAsE;QACtE,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB;4DACsD,EACtD,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CACpC,CAAA;QACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACtC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;QACpB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;AACH,CAAC"}

package/dist/node/index.d.ts

@@ -1,10 +1,11 @@
 /** Node-only entrypoints (HTTP server, fs storage, project loading). */
-export { serve, type ServeOptions, type RunningServer } from './server.js';
+export { serve, findAvailablePort, type ServeOptions, type RunningServer } from './server.js';
 export { FsStorageDriver } from './fs-driver.js';
 export { loadSupabaseProject, type SupabaseProject } from './project.js';
 export { acceptWebSocket, type WsConnection } from './ws.js';
 export { createNativeEngine, ensurePostgres, type NativeEngineOptions } from './native/engine.js';
 export { PgWireClient, PgWireError } from './native/wire.js';
-export { loadFunctions } from './load-functions.js';
+export { loadFunctions, loadFunctionEnv } from './load-functions.js';
+export { bundleFunction, rewriteRemoteSpecifier } from './bundle-function.js';
 export { loadOAuthProviders } from './load-oauth.js';
-export { computeDbDiff, shadowNativeDataDir, type DbDiffOptions } from './db-diff.js';
+export { computeDbDiff, pullSchema, shadowNativeDataDir, type DbDiffOptions, type DbPullOptions, type DbPullResult } from './db-diff.js';

package/dist/node/index.js

@@ -1,11 +1,12 @@
 /** Node-only entrypoints (HTTP server, fs storage, project loading). */
-export { serve } from './server.js';
+export { serve, findAvailablePort } from './server.js';
 export { FsStorageDriver } from './fs-driver.js';
 export { loadSupabaseProject } from './project.js';
 export { acceptWebSocket } from './ws.js';
 export { createNativeEngine, ensurePostgres } from './native/engine.js';
 export { PgWireClient, PgWireError } from './native/wire.js';
-export { loadFunctions } from './load-functions.js';
+export { loadFunctions, loadFunctionEnv } from './load-functions.js';
+export { bundleFunction, rewriteRemoteSpecifier } from './bundle-function.js';
 export { loadOAuthProviders } from './load-oauth.js';
-export { computeDbDiff, shadowNativeDataDir } from './db-diff.js';
+export { computeDbDiff, pullSchema, shadowNativeDataDir } from './db-diff.js';
 //# sourceMappingURL=index.js.map

package/dist/node/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,OAAO,EAAE,KAAK,EAAyC,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,mBAAmB,EAAwB,MAAM,cAAc,CAAA;AACxE,OAAO,EAAE,eAAe,EAAqB,MAAM,SAAS,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA4B,MAAM,oBAAoB,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAsB,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAyC,MAAM,aAAa,CAAA;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,mBAAmB,EAAwB,MAAM,cAAc,CAAA;AACxE,OAAO,EAAE,eAAe,EAAqB,MAAM,SAAS,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA4B,MAAM,oBAAoB,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,mBAAmB,EAA6D,MAAM,cAAc,CAAA"}

package/dist/node/load-functions.d.ts

@@ -1,2 +1,8 @@
 import type { EdgeFunction } from '../functions/handler.js';
+/**
+ * Load edge-function secrets from supabase/functions/.env (KEY=VALUE lines,
+ * `#` comments). These are exposed to functions via Deno.env and ctx.env —
+ * the local equivalent of `supabase functions serve --env-file`.
+ */
+export declare function loadFunctionEnv(projectDir: string): Promise<Record<string, string>>;
 export declare function loadFunctions(projectDir: string): Promise<Map<string, EdgeFunction>>;

package/dist/node/load-functions.js

@@ -1,8 +1,40 @@
 /** Loads edge functions from supabase/functions/<name>/index.{ts,js,mjs} (Node only). */
-import { readdir, stat } from 'node:fs/promises';
+import { readdir, readFile, stat } from 'node:fs/promises';
 import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { installDenoShim, resetCapturedHandler, takeCapturedHandler } from '../functions/deno-shim.js';
+import { bundleFunction } from './bundle-function.js';
+/**
+ * Load edge-function secrets from supabase/functions/.env (KEY=VALUE lines,
+ * `#` comments). These are exposed to functions via Deno.env and ctx.env —
+ * the local equivalent of `supabase functions serve --env-file`.
+ */
+export async function loadFunctionEnv(projectDir) {
+    let text;
+    try {
+        text = await readFile(join(projectDir, 'supabase', 'functions', '.env'), 'utf8');
+    }
+    catch {
+        return {};
+    }
+    const env = {};
+    for (const raw of text.split('\n')) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const eq = line.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = line.slice(0, eq).trim();
+        let val = line.slice(eq + 1).trim();
+        if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
+            val = val.slice(1, -1);
+        }
+        if (key)
+            env[key] = val;
+    }
+    return env;
+}
 export async function loadFunctions(projectDir) {
     const functions = new Map();
     const root = join(projectDir, 'supabase', 'functions');
@@ -21,7 +53,7 @@ export async function loadFunctions(projectDir) {
         const dir = join(root, name);
         if (!(await stat(dir)).isDirectory())
             continue;
-        for (const file of ['index.ts', 'index.js', 'index.mjs']) {
+        for (const file of ['index.ts', 'index.tsx', 'index.js', 'index.mjs']) {
             const path = join(dir, file);
             try {
                 await stat(path);
@@ -30,8 +62,20 @@ export async function loadFunctions(projectDir) {
                 continue;
             }
             try {
+                // Bundle with esbuild so TS, relative imports, and npm:/jsr:/URL
+                // specifiers resolve. If esbuild isn't installed, import the file
+                // directly (Web-API / Deno.serve functions still work).
+                let importUrl;
+                try {
+                    importUrl = pathToFileURL(await bundleFunction(path, name)).href;
+                }
+                catch (e) {
+                    if (e.message !== 'esbuild-not-available')
+                        throw e;
+                    importUrl = pathToFileURL(path).href;
+                }
                 resetCapturedHandler();
-                const mod = (await import(pathToFileURL(path).href));
+                const mod = (await import(importUrl));
                 // prefer an explicit default export; otherwise use the handler a
                 // Deno.serve() call captured during import
                 const denoHandler = takeCapturedHandler();
@@ -45,8 +89,8 @@ export async function loadFunctions(projectDir) {
             }
             catch (e) {
                 const msg = e instanceof Error ? e.message : String(e);
-                if (file === 'index.ts' && /Unknown file extension|Cannot find module/.test(msg)) {
-                    console.warn(`  warning: function "${name}" is TypeScript — run tinbase with tsx or bun, or compile it to .js`);
+                if (/Unknown file extension|Cannot find module/.test(msg)) {
+                    console.warn(`  warning: function "${name}" needs bundling — install esbuild, or run tinbase with tsx/bun`);
                 }
                 else {
                     console.warn(`  warning: failed to load function "${name}": ${msg}`);

package/dist/node/load-functions.js.map

@@ -1 +1 @@
-{"version":3,"file":"load-functions.js","sourceRoot":"","sources":["../../src/node/load-functions.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAEtG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAA;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;IAEtD,IAAI,OAAO,GAAa,EAAE,CAAA;IAC1B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,kEAAkE;IAClE,eAAe,EAAE,CAAA;IAEjB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC5B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,SAAQ;QAC9C,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC5B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YACD,IAAI,CAAC;gBACH,oBAAoB,EAAE,CAAA;gBACtB,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAA+B,CAAA;gBAClF,iEAAiE;gBACjE,2CAA2C;gBAC3C,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAA;gBACzC,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC9H,IAAI,OAAO,EAAE,CAAC;oBACZ,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAuB,CAAC,CAAA;gBAC9C,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,wBAAwB,IAAI,0DAA0D,CAAC,CAAA;gBACtG,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBACtD,IAAI,IAAI,KAAK,UAAU,IAAI,2CAA2C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjF,OAAO,CAAC,IAAI,CAAC,wBAAwB,IAAI,qEAAqE,CAAC,CAAA;gBACjH,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,uCAAuC,IAAI,MAAM,GAAG,EAAE,CAAC,CAAA;gBACtE,CAAC;YACH,CAAC;YACD,MAAK;QACP,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}
+{"version":3,"file":"load-functions.js","sourceRoot":"","sources":["../../src/node/load-functions.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AACtG,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAkB;IACtD,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAQ;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QACpC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACxB,CAAC;QACD,IAAI,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;IACzB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAA;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;IAEtD,IAAI,OAAO,GAAa,EAAE,CAAA;IAC1B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,kEAAkE;IAClE,eAAe,EAAE,CAAA;IAEjB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC5B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,SAAQ;QAC9C,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC5B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YACD,IAAI,CAAC;gBACH,iEAAiE;gBACjE,kEAAkE;gBAClE,wDAAwD;gBACxD,IAAI,SAAiB,CAAA;gBACrB,IAAI,CAAC;oBACH,SAAS,GAAG,aAAa,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;gBAClE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAK,CAAW,CAAC,OAAO,KAAK,uBAAuB;wBAAE,MAAM,CAAC,CAAA;oBAC7D,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;gBACtC,CAAC;gBACD,oBAAoB,EAAE,CAAA;gBACtB,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAA+B,CAAA;gBACnE,iEAAiE;gBACjE,2CAA2C;gBAC3C,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAA;gBACzC,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC9H,IAAI,OAAO,EAAE,CAAC;oBACZ,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAuB,CAAC,CAAA;gBAC9C,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,wBAAwB,IAAI,0DAA0D,CAAC,CAAA;gBACtG,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBACtD,IAAI,2CAA2C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1D,OAAO,CAAC,IAAI,CAAC,wBAAwB,IAAI,iEAAiE,CAAC,CAAA;gBAC7G,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,uCAAuC,IAAI,MAAM,GAAG,EAAE,CAAC,CAAA;gBACtE,CAAC;YACH,CAAC;YACD,MAAK;QACP,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/node/server.d.ts

@@ -1,6 +1,12 @@
 /** Node HTTP wrapper: serves the backend's fetch handler and upgrades /realtime/v1 WebSockets. */
 import { type Server } from 'node:http';
 import type { TinbaseBackend } from '../index.js';
+/**
+ * First free port at or after `startPort` (scanning up to `maxTries`), or null
+ * if none. Used so `tinbase start` skips a port that's already in use (e.g. a
+ * tinbase instance already running) instead of crashing with EADDRINUSE.
+ */
+export declare function findAvailablePort(startPort: number, host?: string, maxTries?: number): Promise<number | null>;
 export interface ServeOptions {
     port?: number;
     host?: string;

package/dist/node/server.js

@@ -1,6 +1,28 @@
 /** Node HTTP wrapper: serves the backend's fetch handler and upgrades /realtime/v1 WebSockets. */
 import { createServer } from 'node:http';
+import { createServer as createNetServer } from 'node:net';
 import { acceptWebSocket } from './ws.js';
+/** Resolve whether a port is free to bind on `host`. */
+function portIsFree(port, host) {
+    return new Promise((resolve) => {
+        const tester = createNetServer();
+        tester.once('error', () => resolve(false));
+        tester.once('listening', () => tester.close(() => resolve(true)));
+        tester.listen(port, host);
+    });
+}
+/**
+ * First free port at or after `startPort` (scanning up to `maxTries`), or null
+ * if none. Used so `tinbase start` skips a port that's already in use (e.g. a
+ * tinbase instance already running) instead of crashing with EADDRINUSE.
+ */
+export async function findAvailablePort(startPort, host = '127.0.0.1', maxTries = 20) {
+    for (let p = startPort; p < startPort + maxTries; p++) {
+        if (await portIsFree(p, host))
+            return p;
+    }
+    return null;
+}
 export async function serve(backend, opts = {}) {
     const host = opts.host ?? '127.0.0.1';
     const server = createServer(async (req, res) => {
@@ -29,7 +51,11 @@ export async function serve(backend, opts = {}) {
         ws.onClose = session.onClose;
     });
     await new Promise((resolve, reject) => {
-        server.once('error', reject);
+        server.once('error', (err) => {
+            reject(err.code === 'EADDRINUSE'
+                ? new Error(`port ${opts.port ?? 54321} is already in use — pass --port <n> to choose another`)
+                : err);
+        });
         server.listen(opts.port ?? 54321, host, () => resolve());
     });
     const address = server.address();

package/dist/node/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/node/server.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAA;AAEhG,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAczC,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAuB,EAAE,OAAqB,EAAE;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAA;IAErC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC7C,MAAM,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAClF,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;QACzE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAA;YAC9C,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAM;QACR,CAAC;QACD,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAc,CAAC,CAAA;QACvD,IAAI,CAAC,EAAE;YAAE,OAAM;QACf,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC,CAAA;QAC7F,EAAE,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;QAChC,EAAE,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAA;IAEzF,OAAO;QACL,MAAM;QACN,IAAI;QACJ,GAAG,EAAE,UAAU,IAAI,IAAI,IAAI,EAAE;QAC7B,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAA;YAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QACxD,CAAC,CAAC;KACL,CAAA;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAoB,EAAE,YAAoB;IACjE,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,YAAY,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,CAAA;IACzE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAA;IAClC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;;YAClE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC;IACD,IAAI,IAAwB,CAAA;IAC5B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAA;QAC3D,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAA4B,EAAE,CAAC,CAAA;AAClF,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAkB,EAAE,GAAmB;IAClE,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACtB,CAAC,CAAC,CAAA;IACF,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACvC,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;QACrD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACd,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC;AACH,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/node/server.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAA;AAChG,OAAO,EAAE,YAAY,IAAI,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAEzC,wDAAwD;AACxD,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,eAAe,EAAE,CAAA;QAChC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;QAC1C,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,IAAI,GAAG,WAAW,EAAE,QAAQ,GAAG,EAAE;IAC1F,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,SAAS,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,IAAI,MAAM,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC;YAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAuB,EAAE,OAAqB,EAAE;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAA;IAErC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC7C,MAAM,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAClF,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;QACzE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAA;YAC9C,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAM;QACR,CAAC;QACD,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAc,CAAC,CAAA;QACvD,IAAI,CAAC,EAAE;YAAE,OAAM;QACf,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC,CAAA;QAC7F,EAAE,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;QAChC,EAAE,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAClD,MAAM,CACJ,GAAG,CAAC,IAAI,KAAK,YAAY;gBACvB,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,KAAK,wDAAwD,CAAC;gBAC/F,CAAC,CAAC,GAAG,CACR,CAAA;QACH,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAA;IAEzF,OAAO;QACL,MAAM;QACN,IAAI;QACJ,GAAG,EAAE,UAAU,IAAI,IAAI,IAAI,EAAE;QAC7B,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAA;YAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QACxD,CAAC,CAAC;KACL,CAAA;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAoB,EAAE,YAAoB;IACjE,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,YAAY,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,CAAA;IACzE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAA;IAClC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;;YAClE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC;IACD,IAAI,IAAwB,CAAA;IAC5B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAA;QAC3D,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAA4B,EAAE,CAAC,CAAA;AAClF,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAkB,EAAE,GAAmB;IAClE,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACtB,CAAC,CAAC,CAAA;IACF,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACvC,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;QACrD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACd,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/realtime/engine.d.ts

@@ -22,9 +22,19 @@ export declare class RealtimeEngine {
     /** topic → key → metas */
     private presence;
     private stopCdc;
+    private stopDbBroadcast;
     constructor(db: Database, jwtSecret?: string | undefined);
     /** Resolve a subscriber's access token to a role/claims context. */
     private contextFromToken;
+    /**
+     * Authorize a private channel against RLS on realtime.messages, as the
+     * subscriber. read = a SELECT policy lets them receive; write = an INSERT
+     * policy lets them broadcast. Runs in a transaction that always rolls back so
+     * the probe rows never persist.
+     */
+    private authorizePrivate;
+    /** Fan a realtime.send() database broadcast out to a topic's subscribers. */
+    private dispatchDbBroadcast;
     start(): Promise<void>;
     stop(): void;
     /** Attach a socket. Returns callbacks the transport must wire up. */

package/dist/realtime/engine.js

@@ -9,6 +9,7 @@ export class RealtimeEngine {
     /** topic → key → metas */
     presence = new Map();
     stopCdc = null;
+    stopDbBroadcast = null;
     constructor(db, jwtSecret) {
         this.db = db;
         this.jwtSecret = jwtSecret;
@@ -23,14 +24,78 @@ export class RealtimeEngine {
         const role = typeof claims.role === 'string' ? claims.role : 'authenticated';
         return { role, claims };
     }
+    /**
+     * Authorize a private channel against RLS on realtime.messages, as the
+     * subscriber. read = a SELECT policy lets them receive; write = an INSERT
+     * policy lets them broadcast. Runs in a transaction that always rolls back so
+     * the probe rows never persist.
+     */
+    async authorizePrivate(subTopic, ctx) {
+        const claims = ctx.claims ? JSON.stringify(ctx.claims) : '';
+        try {
+            return await this.db.engine.transaction(async (tx) => {
+                // seed a probe row for the topic with RLS bypassed (service_role)
+                await tx.query(`select set_config('role', 'service_role', true)`);
+                await tx.query(`insert into realtime.messages (topic, extension, event, payload, private) values ($1, 'broadcast', 'authz', '{}'::jsonb, true)`, [subTopic]);
+                // become the subscriber and set the topic being authorized
+                await tx.query(`select set_config('role', $1, true), set_config('request.jwt.claims', $2, true), set_config('realtime.topic', $3, true)`, [ctx.role, claims, subTopic]);
+                // read: does a SELECT policy let them see the probe row for this topic?
+                const rd = await tx.query(`select count(*)::int as n from realtime.messages where topic = $1`, [subTopic]);
+                const read = (rd.rows[0]?.n ?? 0) > 0;
+                // write: does an INSERT policy let them broadcast? (last query — a
+                // failure aborts the tx, which we roll back anyway)
+                let write = true;
+                try {
+                    await tx.query(`insert into realtime.messages (topic, extension, event, payload, private) values ($1, 'broadcast', 'authz-w', '{}'::jsonb, true)`, [subTopic]);
+                }
+                catch {
+                    write = false;
+                }
+                throw { __authz: { read, write } };
+            });
+        }
+        catch (e) {
+            const authz = e.__authz;
+            if (authz)
+                return authz;
+            // realtime schema missing / unexpected error → deny (safe default)
+            return { read: false, write: false };
+        }
+    }
+    /** Fan a realtime.send() database broadcast out to a topic's subscribers. */
+    dispatchDbBroadcast(msg) {
+        const full = `realtime:${msg.topic}`;
+        for (const conn of this.connections) {
+            const channel = conn.channels.get(full) ?? conn.channels.get(msg.topic);
+            if (!channel)
+                continue;
+            this.send(conn, {
+                topic: channel.topic,
+                event: 'broadcast',
+                payload: { type: 'broadcast', event: msg.event, payload: msg.payload },
+                ref: null,
+            });
+        }
+    }
     async start() {
         if (this.stopCdc)
             return;
         this.stopCdc = await this.db.onCdcEvent((e) => this.dispatchCdc(e));
+        // broadcast-from-database: realtime.send() → pg_notify → fan out to topic
+        this.stopDbBroadcast = await this.db.engine.listen('tinbase_realtime_broadcast', (payload) => {
+            try {
+                this.dispatchDbBroadcast(JSON.parse(payload));
+            }
+            catch {
+                // malformed payload — drop
+            }
+        });
     }
     stop() {
         this.stopCdc?.();
         this.stopCdc = null;
+        this.stopDbBroadcast?.();
+        this.stopDbBroadcast = null;
         for (const conn of this.connections)
             conn.socket.close(1001, 'server shutting down');
         this.connections.clear();
@@ -126,6 +191,22 @@ export class RealtimeEngine {
     }
     async handleJoin(conn, msg) {
         const config = (msg.payload?.config ?? {});
+        const ctx = await this.contextFromToken(msg.payload?.access_token);
+        const isPrivate = config.private === true;
+        let canBroadcast = true;
+        // Private channels are RLS-authorized against realtime.messages (skipped on
+        // subset engines with no RLS). No read policy → join is rejected.
+        if (isPrivate && !this.db.engine.minimalBootstrap) {
+            const sub = msg.topic.replace(/^realtime:/, '');
+            const authz = await this.authorizePrivate(sub, ctx);
+            if (!authz.read) {
+                this.reply(conn, msg, 'error', {
+                    reason: `You do not have permissions to read from this Channel topic: ${sub}`,
+                });
+                return;
+            }
+            canBroadcast = authz.write;
+        }
         const bindings = [];
         for (const spec of config.postgres_changes ?? []) {
             const binding = {
@@ -163,7 +244,9 @@ export class RealtimeEngine {
             broadcastAck: config.broadcast?.ack ?? false,
             presenceKey: config.presence?.key || crypto.randomUUID(),
             presenceEnabled: config.presence?.enabled ?? true,
-            ctx: await this.contextFromToken(msg.payload?.access_token),
+            ctx,
+            private: isPrivate,
+            canBroadcast,
         };
         conn.channels.set(msg.topic, channel);
         this.reply(conn, msg, 'ok', {
@@ -258,6 +341,12 @@ export class RealtimeEngine {
         const sender = conn.channels.get(msg.topic);
         if (!sender)
             return;
+        // private channels require INSERT (write) authorization to broadcast
+        if (sender.private && !sender.canBroadcast) {
+            if (sender.broadcastAck && msg.ref)
+                this.reply(conn, msg, 'error', { reason: 'unauthorized' });
+            return;
+        }
         const userPayload = msg.payload.payload;
         const binaryFrame = userPayload instanceof Uint8Array
             ? encodeUserBroadcast(msg.topic, String(msg.payload.event ?? ''), userPayload)