tinbase 0.9.0 → 0.10.1

package/dist/jwt.d.ts

@@ -1,7 +1,8 @@
 /**
  * Minimal HS256 JWT implementation on WebCrypto.
- * Works in Node (>=18) and browsers — no dependencies.
+ * Works in Node (>=18) and browsers - no dependencies.
  */
+/** Standard + Supabase/GoTrue claims carried in an access token. Open-ended: any extra claims are preserved. */
 export interface JwtClaims {
     [key: string]: unknown;
     sub?: string;
@@ -19,9 +20,11 @@ export interface JwtClaims {
         timestamp: number;
     }[];
 }
+/** Sign claims as an HS256 JWT. */
 export declare function signJwt(claims: JwtClaims, secret: string): Promise<string>;
 /** Verifies signature and expiry. Returns claims, or null when invalid. */
 export declare function verifyJwt(token: string, secret: string): Promise<JwtClaims | null>;
 /** Decode without verification (for introspection/debugging only). */
 export declare function decodeJwt(token: string): JwtClaims | null;
+/** A URL-safe random token (base64url of `bytes` CSPRNG bytes). Used for refresh/one-time/link tokens. */
 export declare function randomToken(bytes?: number): string;

package/dist/jwt.js

@@ -1,6 +1,6 @@
 /**
  * Minimal HS256 JWT implementation on WebCrypto.
- * Works in Node (>=18) and browsers — no dependencies.
+ * Works in Node (>=18) and browsers - no dependencies.
  */
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
@@ -24,6 +24,7 @@ function base64UrlToBytes(str) {
 async function hmacKey(secret, usage) {
     return crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, [usage]);
 }
+/** Sign claims as an HS256 JWT. */
 export async function signJwt(claims, secret) {
     const header = bytesToBase64Url(encoder.encode(JSON.stringify({ alg: 'HS256', typ: 'JWT' })));
     const payload = bytesToBase64Url(encoder.encode(JSON.stringify(claims)));
@@ -39,7 +40,7 @@ export async function verifyJwt(token, secret) {
         return null;
     const [header, payload, signature] = parts;
     try {
-        // Pin the algorithm to HS256 — reject alg:"none" and any alg-swap attempt
+        // Pin the algorithm to HS256 - reject alg:"none" and any alg-swap attempt
         // rather than relying on the HMAC verify to fail.
         const head = JSON.parse(decoder.decode(base64UrlToBytes(header)));
         if (head.alg !== 'HS256')
@@ -69,6 +70,7 @@ export function decodeJwt(token) {
         return null;
     }
 }
+/** A URL-safe random token (base64url of `bytes` CSPRNG bytes). Used for refresh/one-time/link tokens. */
 export function randomToken(bytes = 32) {
     const buf = new Uint8Array(bytes);
     crypto.getRandomValues(buf);

package/dist/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AACjC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,SAAS,gBAAgB,CAAC,KAAiB;IACzC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,MAAM,KAAK,GAAG,MAAM,CAAA;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QAC7C,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAChF,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACvE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,KAAe;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,KAAK,CAAC,CACR,CAAA;AACH,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAiB,EAAE,MAAc;IAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7F,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACxE,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAA;IACnC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACvE,OAAO,GAAG,IAAI,IAAI,gBAAgB,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAA;AAC3D,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,MAAc;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAA;IAC1C,IAAI,CAAC;QACH,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAmC,CAAA;QACnG,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;QACrC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC3C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACtC,MAAM,EACN,GAAG,EACH,gBAAgB,CAAC,SAAS,CAAiB,EAC3C,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CACvC,CAAA;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAc,CAAA;QACjF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAA;QACjF,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAK,GAAG,EAAE;IACpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;IAC3B,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAA;AAC9B,CAAC"}
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AACjC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,SAAS,gBAAgB,CAAC,KAAiB;IACzC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,MAAM,KAAK,GAAG,MAAM,CAAA;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QAC7C,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAChF,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACvE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,KAAe;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,KAAK,CAAC,CACR,CAAA;AACH,CAAC;AAkBD,mCAAmC;AACnC,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAiB,EAAE,MAAc;IAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7F,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACxE,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAA;IACnC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACvE,OAAO,GAAG,IAAI,IAAI,gBAAgB,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAA;AAC3D,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,MAAc;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAA;IAC1C,IAAI,CAAC;QACH,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAmC,CAAA;QACnG,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;QACrC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC3C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACtC,MAAM,EACN,GAAG,EACH,gBAAgB,CAAC,SAAS,CAAiB,EAC3C,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CACvC,CAAA;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAc,CAAA;QACjF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAA;QACjF,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,WAAW,CAAC,KAAK,GAAG,EAAE;IACpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;IAC3B,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAA;AAC9B,CAAC"}

package/dist/log-buffer.d.ts

@@ -1,21 +1,27 @@
 /**
  * In-memory ring buffer of recent server log lines, surfaced in the Studio
  * "Logs" pane (and available as backend.logs). Captures request lines and the
- * internal log() output (migrations, mail, webhooks, cron). Dev convenience —
+ * internal log() output (migrations, mail, webhooks, cron). Dev convenience -
  * bounded, never persisted.
  */
+/** Severity derived from response status (or passed explicitly by internal log calls). */
 export type LogLevel = 'info' | 'warn' | 'error';
+/** One buffered log line. */
 export interface LogEntry {
+    /** ISO timestamp when pushed. */
     ts: string;
     level: LogLevel;
     msg: string;
 }
+/** Bounded FIFO of the most recent {@link LogEntry} lines; oldest are dropped past `cap`. */
 export declare class LogBuffer {
     private cap;
     private entries;
     constructor(cap?: number);
+    /** Append a line, evicting the oldest once over capacity. */
     push(msg: string, level?: LogLevel): void;
     /** Most recent first. */
     list(limit?: number): LogEntry[];
+    /** Drop all buffered lines. */
     clear(): void;
 }

package/dist/log-buffer.js

@@ -1,9 +1,11 @@
+/** Bounded FIFO of the most recent {@link LogEntry} lines; oldest are dropped past `cap`. */
 export class LogBuffer {
     cap;
     entries = [];
     constructor(cap = 500) {
         this.cap = cap;
     }
+    /** Append a line, evicting the oldest once over capacity. */
     push(msg, level = 'info') {
         this.entries.push({ ts: new Date().toISOString(), level, msg });
         if (this.entries.length > this.cap)
@@ -13,6 +15,7 @@ export class LogBuffer {
     list(limit = 200) {
         return this.entries.slice(-limit).reverse();
     }
+    /** Drop all buffered lines. */
     clear() {
         this.entries = [];
     }

package/dist/log-buffer.js.map

@@ -1 +1 @@
-{"version":3,"file":"log-buffer.js","sourceRoot":"","sources":["../src/log-buffer.ts"],"names":[],"mappings":"AAcA,MAAM,OAAO,SAAS;IAEA;IADZ,OAAO,GAAe,EAAE,CAAA;IAChC,YAAoB,MAAM,GAAG;QAAT,QAAG,GAAH,GAAG,CAAM;IAAG,CAAC;IAEjC,IAAI,CAAC,GAAW,EAAE,QAAkB,MAAM;QACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC/D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5F,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,KAAK,GAAG,GAAG;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAA;IAC7C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,EAAE,CAAA;IACnB,CAAC;CACF"}
+{"version":3,"file":"log-buffer.js","sourceRoot":"","sources":["../src/log-buffer.ts"],"names":[],"mappings":"AAiBA,6FAA6F;AAC7F,MAAM,OAAO,SAAS;IAEA;IADZ,OAAO,GAAe,EAAE,CAAA;IAChC,YAAoB,MAAM,GAAG;QAAT,QAAG,GAAH,GAAG,CAAM;IAAG,CAAC;IAEjC,6DAA6D;IAC7D,IAAI,CAAC,GAAW,EAAE,QAAkB,MAAM;QACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC/D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5F,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,KAAK,GAAG,GAAG;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAA;IAC7C,CAAC;IAED,+BAA+B;IAC/B,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,EAAE,CAAA;IACnB,CAAC;CACF"}

package/dist/net/service.d.ts

@@ -1,5 +1,5 @@
 /**
- * In-process HTTP sender for the pg_net emulation — the execution half of the
+ * In-process HTTP sender for the pg_net emulation - the execution half of the
  * net.* surface (the net.http_get/post/delete SQL functions live in
  * db/emulated.ts). It drains net.http_request_queue, performs each request with
  * fetch, and records the reply in net._http_response, mirroring pg_net's
@@ -7,20 +7,41 @@
  */
 import type { Database } from '../db/database.js';
 /**
- * Reject requests to non-public destinations. This is a literal-host guard
- * (loopback / private / link-local / cloud-metadata), which blocks the common
- * SSRF vectors without an async DNS lookup. Returns an error string, or null
- * when the URL is allowed.
+ * Reject requests to non-public destinations. A synchronous literal-host guard
+ * (loopback / private / link-local / cloud-metadata) that also rejects
+ * alternate numeric IP encodings which would slip past the literal checks but
+ * still connect to a real address. No DNS lookup - a public hostname that
+ * *resolves* to private space (DNS rebinding) is a residual this doesn't cover;
+ * doing so would add a per-request lookup that can hang for 30s on an
+ * unresolvable host. Returns an error string, or null when the URL is allowed.
  */
 export declare function blockedNetTarget(rawUrl: string): string | null;
+/**
+ * fetch with an SSRF guard that re-validates every redirect hop. Default fetch
+ * follows redirects without re-checking, so a public URL could 3xx into private
+ * space; this follows manually (capped at {@link MAX_REDIRECTS}) and runs
+ * {@link blockedNetTarget} on each target. Throws with the block reason on a
+ * rejected hop.
+ */
+export declare function guardedFetch(fetchImpl: typeof fetch, url: string, init?: RequestInit): Promise<Response>;
+/** Outcome of one drained request, passed to the optional `onDeliver` callback. */
 export interface NetDelivery {
+    /** net.http_request_queue row id */
     id: number;
     method: string;
     url: string;
+    /** response status; undefined when the request failed before a reply */
     status?: number;
+    /** true if the request aborted on its timeout */
     timedOut: boolean;
+    /** failure reason (network error, blocked target, etc.); undefined on success */
     error?: string;
 }
+/**
+ * Drains net.http_request_queue on an interval, performs each request, and
+ * records the reply in net._http_response - the pg_net background worker,
+ * in-process.
+ */
 export declare class NetService {
     private db;
     private fetchImpl;
@@ -29,11 +50,19 @@ export declare class NetService {
     private onDeliver?;
     private timer;
     private draining;
+    /** The in-flight tick, tracked so stop() can drain it before db.close(). */
+    private inFlight;
     constructor(db: Database, fetchImpl?: typeof fetch, 
     /** how often to drain the queue (ms) */
     tickMs?: number, onDeliver?: ((d: NetDelivery) => void) | undefined);
+    /** Begin draining the queue on the tick interval; no-op if already running. */
     start(): void;
-    stop(): void;
+    /**
+     * Stop the drain loop and wait for any in-flight tick to finish before the
+     * caller closes the database - the single connection busy-loops if closed
+     * while a query is still queued.
+     */
+    stop(): Promise<void>;
     /** Drain any queued requests once (also callable directly in tests). */
     tick(): Promise<void>;
     private deliver;

package/dist/net/service.js

@@ -1,10 +1,15 @@
 /** Cap on the response body we buffer into net._http_response (bytes). */
 const MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
+/** Max redirect hops guardedFetch will follow, re-validating each target. */
+const MAX_REDIRECTS = 5;
 /**
- * Reject requests to non-public destinations. This is a literal-host guard
- * (loopback / private / link-local / cloud-metadata), which blocks the common
- * SSRF vectors without an async DNS lookup. Returns an error string, or null
- * when the URL is allowed.
+ * Reject requests to non-public destinations. A synchronous literal-host guard
+ * (loopback / private / link-local / cloud-metadata) that also rejects
+ * alternate numeric IP encodings which would slip past the literal checks but
+ * still connect to a real address. No DNS lookup - a public hostname that
+ * *resolves* to private space (DNS rebinding) is a residual this doesn't cover;
+ * doing so would add a per-request lookup that can hang for 30s on an
+ * unresolvable host. Returns an error string, or null when the URL is allowed.
  */
 export function blockedNetTarget(rawUrl) {
     let u;
@@ -21,6 +26,13 @@ export function blockedNetTarget(rawUrl) {
         return 'blocked host: localhost';
     if (isPrivateIp(host))
         return `blocked host: ${host}`;
+    // Reject alternate numeric encodings of an IP that pass the literal checks but
+    // still reach a real address - http://2130706433 and http://0x7f000001 both
+    // connect to 127.0.0.1. A genuine DNS name contains a letter and is not
+    // 0x-prefixed; dotted-IPv4 and IPv6 literals were already checked above.
+    if (!host.includes(':') && !/^\d{1,3}(\.\d{1,3}){3}$/.test(host) && (host.startsWith('0x') || !/[a-z]/i.test(host))) {
+        return `blocked host: ${host} (non-DNS address encoding)`;
+    }
     return null;
 }
 function isPrivateIp(host) {
@@ -49,6 +61,32 @@ function isPrivateIp(host) {
         return isPrivateIp(host.slice(7)); // IPv4-mapped
     return false;
 }
+/**
+ * fetch with an SSRF guard that re-validates every redirect hop. Default fetch
+ * follows redirects without re-checking, so a public URL could 3xx into private
+ * space; this follows manually (capped at {@link MAX_REDIRECTS}) and runs
+ * {@link blockedNetTarget} on each target. Throws with the block reason on a
+ * rejected hop.
+ */
+export async function guardedFetch(fetchImpl, url, init = {}) {
+    let current = url;
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+        const blocked = blockedNetTarget(current);
+        if (blocked)
+            throw new Error(blocked);
+        const res = await fetchImpl(current, { ...init, redirect: 'manual' });
+        const location = res.status >= 300 && res.status < 400 ? res.headers.get('location') : null;
+        if (!location)
+            return res;
+        current = new URL(location, current).toString();
+    }
+    throw new Error(`too many redirects (>${MAX_REDIRECTS})`);
+}
+/**
+ * Drains net.http_request_queue on an interval, performs each request, and
+ * records the reply in net._http_response - the pg_net background worker,
+ * in-process.
+ */
 export class NetService {
     db;
     fetchImpl;
@@ -56,6 +94,8 @@ export class NetService {
     onDeliver;
     timer = null;
     draining = false;
+    /** The in-flight tick, tracked so stop() can drain it before db.close(). */
+    inFlight = null;
     constructor(db, fetchImpl = fetch, 
     /** how often to drain the queue (ms) */
     tickMs = 500, onDeliver) {
@@ -64,22 +104,32 @@ export class NetService {
         this.tickMs = tickMs;
         this.onDeliver = onDeliver;
     }
+    /** Begin draining the queue on the tick interval; no-op if already running. */
     start() {
         if (this.timer)
             return;
-        this.timer = setInterval(() => void this.tick(), this.tickMs);
+        this.timer = setInterval(() => {
+            this.inFlight = this.tick();
+        }, this.tickMs);
         if (typeof this.timer === 'object' && 'unref' in this.timer)
             this.timer.unref();
     }
-    stop() {
+    /**
+     * Stop the drain loop and wait for any in-flight tick to finish before the
+     * caller closes the database - the single connection busy-loops if closed
+     * while a query is still queued.
+     */
+    async stop() {
         if (this.timer)
             clearInterval(this.timer);
         this.timer = null;
+        await this.inFlight?.catch(() => { });
+        this.inFlight = null;
     }
     /** Drain any queued requests once (also callable directly in tests). */
     async tick() {
         if (this.draining)
-            return; // never overlap drains — one writer at a time
+            return; // never overlap drains - one writer at a time
         this.draining = true;
         try {
             let rows;
@@ -89,8 +139,18 @@ export class NetService {
             catch {
                 return; // net.* not present (e.g. the pg-mem subset engine)
             }
-            for (const row of rows)
-                await this.deliver(row);
+            for (const row of rows) {
+                try {
+                    await this.deliver(row);
+                }
+                catch (e) {
+                    // A malformed row must never poison the loop or reject out of the
+                    // setInterval callback - dequeue it with the error recorded instead.
+                    const msg = e instanceof Error ? e.message : String(e);
+                    await this.record(row.id, null, null, null, null, false, msg);
+                    this.onDeliver?.({ id: row.id, method: row.method, url: row.url, timedOut: false, error: msg });
+                }
+            }
         }
         finally {
             this.draining = false;
@@ -106,16 +166,11 @@ export class NetService {
         let respHeaders = null;
         let timedOut = false;
         let errorMsg = null;
-        const blocked = blockedNetTarget(row.url);
-        if (blocked) {
-            clearTimeout(timer);
-            await this.record(row.id, null, null, null, content, false, blocked);
-            this.onDeliver?.({ id: row.id, method: row.method, url: row.url, timedOut: false, error: blocked });
-            return;
-        }
         try {
             const hasBody = row.method !== 'GET' && row.method !== 'HEAD';
-            const res = await this.fetchImpl(row.url, {
+            // guardedFetch enforces the SSRF policy on the initial URL and every
+            // redirect hop (a plain fetch would follow a 3xx into private space).
+            const res = await guardedFetch(this.fetchImpl, row.url, {
                 method: row.method,
                 headers,
                 body: hasBody ? row.body ?? undefined : undefined,

package/dist/net/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/net/service.ts"],"names":[],"mappings":"AASA,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAE3C;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,CAAM,CAAA;IACV,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,uBAAuB,CAAC,CAAC,QAAQ,EAAE,CAAA;IACjG,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC7D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,yBAAyB,CAAA;IACzF,IAAI,WAAW,CAAC,IAAI,CAAC;QAAE,OAAO,iBAAiB,IAAI,EAAE,CAAA;IACrD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO;IACP,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACpE,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA,CAAC,+BAA+B;QACjF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA,CAAC,8CAA8C;QACtF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAA,CAAC,UAAU;QAC3D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA,CAAC,UAAU;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,IAAI,CAAA,CAAC,oBAAoB;QACtE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO;IACP,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA,CAAC,yBAAyB;IAC1E,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,mBAAmB;IAC9G,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,cAAc;IAChF,OAAO,KAAK,CAAA;AACd,CAAC;AAoBD,MAAM,OAAO,UAAU;IAKX;IACA;IAEA;IACA;IARF,KAAK,GAA0C,IAAI,CAAA;IACnD,QAAQ,GAAG,KAAK,CAAA;IAExB,YACU,EAAY,EACZ,YAA0B,KAAK;IACvC,wCAAwC;IAChC,SAAS,GAAG,EACZ,SAAoC;QAJpC,OAAE,GAAF,EAAE,CAAU;QACZ,cAAS,GAAT,SAAS,CAAsB;QAE/B,WAAM,GAAN,MAAM,CAAM;QACZ,cAAS,GAAT,SAAS,CAA2B;IAC3C,CAAC;IAEJ,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAM;QACtB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC7D,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;YAAG,IAAI,CAAC,KAA+B,CAAC,KAAK,EAAE,CAAA;IAC5G,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;IACnB,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAM,CAAC,8CAA8C;QACxE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,IAAI,CAAC;YACH,IAAI,IAAkB,CAAA;YACtB,IAAI,CAAC;gBACH,IAAI,GAAG,CACL,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB,8GAA8G,CAC/G,CACF,CAAC,IAAI,CAAA;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,OAAM,CAAC,oDAAoD;YAC7D,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAA;QACvB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAe;QACnC,MAAM,OAAO,GACX,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAA;QAC3G,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,CAAA;QAEpF,IAAI,MAAM,GAAkB,IAAI,CAAA;QAChC,IAAI,WAAW,GAAkB,IAAI,CAAA;QACrC,IAAI,OAAO,GAAkB,IAAI,CAAA;QACjC,IAAI,WAAW,GAAkC,IAAI,CAAA;QACrD,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,QAAQ,GAAkB,IAAI,CAAA;QAElC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;YACpE,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACnG,OAAM;QACR,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAA;YAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE;gBACxC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO;gBACP,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS;gBACjD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAA;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;YACnB,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;YAC7C,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;YACvD,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QACrD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,QAAQ,GAAG,IAAI,CAAA;YAC9C,QAAQ,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACvD,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;QACxF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,MAAM,IAAI,SAAS;YAC3B,QAAQ;YACR,KAAK,EAAE,QAAQ,IAAI,SAAS;SAC7B,CAAC,CAAA;IACJ,CAAC;IAED,+EAA+E;IACvE,KAAK,CAAC,MAAM,CAClB,EAAU,EACV,MAAqB,EACrB,WAA0B,EAC1B,WAA0C,EAC1C,OAAsB,EACtB,QAAiB,EACjB,QAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB;gFACwE,EACxE,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CACzG,CAAA;YACD,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,kDAAkD,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,KAAK,UAAU,UAAU,CAAC,GAAa,EAAE,QAAgB;IACvD,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IACtC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;IACnC,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,OAAO,KAAK,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,IAAI;YAAE,MAAK;QACf,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAA;IACvB,CAAC;IACD,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACrC,IAAI,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAA;IACtD,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;QACvD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,MAAM,IAAI,IAAI,CAAA;QACd,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM;YAAE,MAAK;IACpC,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AACzC,CAAC"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/net/service.ts"],"names":[],"mappings":"AASA,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAE3C,6EAA6E;AAC7E,MAAM,aAAa,GAAG,CAAC,CAAA;AAEvB;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,CAAM,CAAA;IACV,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,uBAAuB,CAAC,CAAC,QAAQ,EAAE,CAAA;IACjG,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC7D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,yBAAyB,CAAA;IACzF,IAAI,WAAW,CAAC,IAAI,CAAC;QAAE,OAAO,iBAAiB,IAAI,EAAE,CAAA;IACrD,+EAA+E;IAC/E,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpH,OAAO,iBAAiB,IAAI,6BAA6B,CAAA;IAC3D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO;IACP,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACpE,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA,CAAC,+BAA+B;QACjF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA,CAAC,8CAA8C;QACtF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAA,CAAC,UAAU;QAC3D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA,CAAC,UAAU;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,IAAI,CAAA,CAAC,oBAAoB;QACtE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO;IACP,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA,CAAC,yBAAyB;IAC1E,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,mBAAmB;IAC9G,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,cAAc;IAChF,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAuB,EAAE,GAAW,EAAE,OAAoB,EAAE;IAC7F,IAAI,OAAO,GAAG,GAAG,CAAA;IACjB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;QACrE,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC3F,IAAI,CAAC,QAAQ;YAAE,OAAO,GAAG,CAAA;QACzB,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;IACjD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,aAAa,GAAG,CAAC,CAAA;AAC3D,CAAC;AAyBD;;;;GAIG;AACH,MAAM,OAAO,UAAU;IAOX;IACA;IAEA;IACA;IAVF,KAAK,GAA0C,IAAI,CAAA;IACnD,QAAQ,GAAG,KAAK,CAAA;IACxB,4EAA4E;IACpE,QAAQ,GAAyB,IAAI,CAAA;IAE7C,YACU,EAAY,EACZ,YAA0B,KAAK;IACvC,wCAAwC;IAChC,SAAS,GAAG,EACZ,SAAoC;QAJpC,OAAE,GAAF,EAAE,CAAU;QACZ,cAAS,GAAT,SAAS,CAAsB;QAE/B,WAAM,GAAN,MAAM,CAAM;QACZ,cAAS,GAAT,SAAS,CAA2B;IAC3C,CAAC;IAEJ,+EAA+E;IAC/E,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAM;QACtB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC7B,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACf,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;YAAG,IAAI,CAAC,KAA+B,CAAC,KAAK,EAAE,CAAA;IAC5G,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACjB,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACpC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;IACtB,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAM,CAAC,8CAA8C;QACxE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,IAAI,CAAC;YACH,IAAI,IAAkB,CAAA;YACtB,IAAI,CAAC;gBACH,IAAI,GAAG,CACL,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB,8GAA8G,CAC/G,CACF,CAAC,IAAI,CAAA;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,OAAM,CAAC,oDAAoD;YAC7D,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACzB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,kEAAkE;oBAClE,qEAAqE;oBACrE,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;oBACtD,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;oBAC7D,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;gBACjG,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAA;QACvB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAe;QACnC,MAAM,OAAO,GACX,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAA;QAC3G,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,CAAA;QAEpF,IAAI,MAAM,GAAkB,IAAI,CAAA;QAChC,IAAI,WAAW,GAAkB,IAAI,CAAA;QACrC,IAAI,OAAO,GAAkB,IAAI,CAAA;QACjC,IAAI,WAAW,GAAkC,IAAI,CAAA;QACrD,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,QAAQ,GAAkB,IAAI,CAAA;QAElC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAA;YAC7D,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE;gBACtD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO;gBACP,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS;gBACjD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAA;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;YACnB,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;YAC7C,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;YACvD,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QACrD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,QAAQ,GAAG,IAAI,CAAA;YAC9C,QAAQ,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACvD,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;QACxF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,MAAM,IAAI,SAAS;YAC3B,QAAQ;YACR,KAAK,EAAE,QAAQ,IAAI,SAAS;SAC7B,CAAC,CAAA;IACJ,CAAC;IAED,+EAA+E;IACvE,KAAK,CAAC,MAAM,CAClB,EAAU,EACV,MAAqB,EACrB,WAA0B,EAC1B,WAA0C,EAC1C,OAAsB,EACtB,QAAiB,EACjB,QAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB;gFACwE,EACxE,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CACzG,CAAA;YACD,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,kDAAkD,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,KAAK,UAAU,UAAU,CAAC,GAAa,EAAE,QAAgB;IACvD,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IACtC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;IACnC,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,OAAO,KAAK,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,IAAI;YAAE,MAAK;QACf,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAA;IACvB,CAAC;IACD,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACrC,IAAI,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAA;IACtD,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;QACvD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,MAAM,IAAI,IAAI,CAAA;QACd,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM;YAAE,MAAK;IACpC,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AACzC,CAAC"}

package/dist/node/bun-server.d.ts

@@ -1,8 +1,9 @@
 /**
  * Bun-native server: Bun.serve with first-class WebSockets. Used automatically
- * when the CLI runs under Bun (including single-binary builds) — same backend,
+ * when the CLI runs under Bun (including single-binary builds) - same backend,
  * same RealtimeSocketLike contract as the node:http path.
  */
 import type { SupaliteBackendShape } from './server-shared.js';
 import type { RunningServer, ServeOptions } from './server.js';
+/** Bun equivalent of {@link import('./server.js').serve}; same backend contract. */
 export declare function serveBun(backend: SupaliteBackendShape, opts?: ServeOptions): Promise<RunningServer>;

package/dist/node/bun-server.js

@@ -1,3 +1,4 @@
+/** Bun equivalent of {@link import('./server.js').serve}; same backend contract. */
 export async function serveBun(backend, opts = {}) {
     const host = opts.host ?? '127.0.0.1';
     const server = Bun.serve({
@@ -11,7 +12,16 @@ export async function serveBun(backend, opts = {}) {
                     return undefined;
                 return new Response('upgrade failed', { status: 400 });
             }
-            return backend.fetch(req);
+            // Expose the connecting client's address for rate limiting, stripping any
+            // client-supplied value first so the header can't be forged - the node:http
+            // server does the same from req.socket.remoteAddress. Without this, a
+            // spoofed x-tinbase-remote-addr rotated per request defeats the limiter.
+            const headers = new Headers(req.headers);
+            headers.delete('x-tinbase-remote-addr');
+            const ip = srv.requestIP(req)?.address;
+            if (ip)
+                headers.set('x-tinbase-remote-addr', ip);
+            return backend.fetch(new Request(req, { headers }));
         },
         websocket: {
             open(ws) {

package/dist/node/bun-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"bun-server.js","sourceRoot":"","sources":["../../src/node/bun-server.ts"],"names":[],"mappings":"AAeA,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAA6B,EAAE,OAAqB,EAAE;IACnF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAA;IAErC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;QACxB,QAAQ,EAAE,IAAI;QACd,KAAK,CAAC,KAAK,CAAC,GAAY,EAAE,GAAQ;YAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;gBACzG,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE,EAAE,CAAC,CAAA;gBACtF,IAAI,EAAE;oBAAE,OAAO,SAAS,CAAA;gBACxB,OAAO,IAAI,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACxD,CAAC;YACD,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC;QACD,SAAS,EAAE;YACT,IAAI,CAAC,EAA6F;gBAChG,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CACtC;oBACE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC7B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;iBAChD,EACD,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CACrB,CAAA;gBACD,EAAE,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;YAC3B,CAAC;YACD,OAAO,CAAC,EAAoB,EAAE,OAA4B;gBACxD,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;YAC7F,CAAC;YACD,KAAK,CAAC,EAAoB;gBACxB,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAA;YAC5B,CAAC;SACF;KACF,CAAC,CAAA;IAEF,OAAO;QACL,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,UAAU,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;QACpC,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"bun-server.js","sourceRoot":"","sources":["../../src/node/bun-server.ts"],"names":[],"mappings":"AAiBA,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAA6B,EAAE,OAAqB,EAAE;IACnF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAA;IAErC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;QACxB,QAAQ,EAAE,IAAI;QACd,KAAK,CAAC,KAAK,CAAC,GAAY,EAAE,GAAQ;YAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;gBACzG,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE,EAAE,CAAC,CAAA;gBACtF,IAAI,EAAE;oBAAE,OAAO,SAAS,CAAA;gBACxB,OAAO,IAAI,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACxD,CAAC;YACD,0EAA0E;YAC1E,4EAA4E;YAC5E,sEAAsE;YACtE,yEAAyE;YACzE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxC,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAA;YACvC,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;YACtC,IAAI,EAAE;gBAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAA;YAChD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;QACrD,CAAC;QACD,SAAS,EAAE;YACT,IAAI,CAAC,EAA6F;gBAChG,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CACtC;oBACE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC7B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;iBAChD,EACD,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CACrB,CAAA;gBACD,EAAE,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;YAC3B,CAAC;YACD,OAAO,CAAC,EAAoB,EAAE,OAA4B;gBACxD,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;YAC7F,CAAC;YACD,KAAK,CAAC,EAAoB;gBACxB,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAA;YAC5B,CAAC;SACF;KACF,CAAC,CAAA;IAEF,OAAO;QACL,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,UAAU,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;QACpC,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/node/bundle-function.d.ts

@@ -1,4 +1,4 @@
-/** Map a Deno-style specifier to a fetchable URL. Pure — unit tested. */
+/** Map a Deno-style specifier to a fetchable URL. Pure - unit tested. */
 export declare function rewriteRemoteSpecifier(spec: string): string;
 /**
  * Bundle `entryPath` to a single ESM file and return its path (written under

package/dist/node/bundle-function.js

@@ -15,7 +15,7 @@ import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-/** Map a Deno-style specifier to a fetchable URL. Pure — unit tested. */
+/** Map a Deno-style specifier to a fetchable URL. Pure - unit tested. */
 export function rewriteRemoteSpecifier(spec) {
     if (spec.startsWith('npm:'))
         return `https://esm.sh/${spec.slice(4)}`;

package/dist/node/config-toml.d.ts

@@ -0,0 +1,31 @@
+/** A parsed table: its scalar/array values plus nested child tables. */
+export interface ConfigTable {
+    /** scalar and single-line-array values declared directly under this table, by key */
+    values: Map<string, string | string[]>;
+    /** nested child tables, by their (single, undotted) segment name */
+    children: Map<string, ConfigTable>;
+}
+/** Parse config.toml at `projectDir/supabase/config.toml`; empty root if absent/unreadable. */
+export declare function loadConfigToml(projectDir: string, env?: NodeJS.ProcessEnv): ConfigTable;
+/** Parse TOML `text` into a table tree, resolving `env(VAR)` references. */
+export declare function parseConfigToml(text: string, env?: NodeJS.ProcessEnv): ConfigTable;
+/** Child table at a dotted path, or undefined if any segment is missing. */
+export declare function tableAt(root: ConfigTable, path: string): ConfigTable | undefined;
+/** String value at `key`, or undefined if absent, empty, or an array. */
+export declare function getString(table: ConfigTable | undefined, key: string): string | undefined;
+/** Boolean value at `key`, or undefined if absent or not exactly true/false. */
+export declare function getBool(table: ConfigTable | undefined, key: string): boolean | undefined;
+/** Integer value at `key` (base 10), or undefined if absent or unparseable. */
+export declare function getInt(table: ConfigTable | undefined, key: string): number | undefined;
+/** String-array value at `key`, or undefined if absent or a scalar. */
+export declare function getStringArray(table: ConfigTable | undefined, key: string): string[] | undefined;
+/**
+ * Parse a Supabase duration string ("1m", "24h", "10s", "50m") to seconds.
+ * Returns undefined if absent or malformed.
+ */
+export declare function getDurationSeconds(table: ConfigTable | undefined, key: string): number | undefined;
+/**
+ * Parse a Supabase byte-size string ("50MiB", "5MB", "500KB") to bytes.
+ * Returns undefined if absent or malformed.
+ */
+export declare function getByteSize(table: ConfigTable | undefined, key: string): number | undefined;