@supabase/lite 0.4.0 → 0.4.1-next.2

package/LIMITATIONS.md

@@ -45,5 +45,4 @@ Common ways code goes wrong against supalite. The fix for each is the correspond
 - Don't use embedded dotted-path filters (`.eq('rel.col', v)`) on SQLite. Filter the FK column on the parent, or fetch matching ids first.
 - Don't run `lite dev` or `lite start` next to the Vite plugin — port collision.
 - Don't assume `vite preview` mounts the API. It doesn't. Use `lite start` or a real backend for non-dev environments.
-- Don't write `.env` files with `VITE_SUPABASE_URL` for an in-Vite plugin app until [#27](https://github.com/supabase-community/lite/issues/27) ships — use `window.location.origin` + any non-empty anon string.
 - Don't reach for `trim` / `length` / `lower` inside `CHECK` constraints on SQLite — use literal/operator comparisons.

package/README.md

@@ -14,7 +14,7 @@ Supalite targets AI builders who want quick, cheap prototypes today with a clear
 
 **Scope:** Both declarative schema (`supabase/schemas/*.sql`) and imperative Postgres migrations (`supabase/migrations/*.sql`, Supabase-CLI compatible) are supported. See [Migrations](#migrations). Advanced Postgres-specific column types (ranges, arrays of composites, and similar) are not available.
 
-Validated against the upstream PostgREST and GoTrue test suites: 1,803 tests passing.
+Validated against the upstream PostgREST and GoTrue spec suites: 1,918 cases passing on SQLite (1,677 Data API + 241 Auth), zero failing. See [Testing](https://github.com/supabase-community/lite/blob/HEAD/STATUS.md#testing) for per-backend pass rates.
 
 ---
 
@@ -43,10 +43,12 @@ The skill itself points at the installed docs (not their content), so updates la
 
 Compatibility is measured from the `@supabase/supabase-js` surface. The goal is that code written against Supabase keeps working when pointed at @supabase/lite. Direct database access (raw SQL clients, Postgres wire protocol, `psql`) is **not** a target; everything below is scoped to what supabase-js exercises.
 
+For a per-capability parity view with effort estimates and feasibility notes for unsupported features, see [FEATURES.md](https://github.com/supabase-community/lite/blob/HEAD/FEATURES.md).
+
 | Service                 | Status | Notes                                                              |
 |-------------------------|--------|--------------------------------------------------------------------|
 | [Databases](https://github.com/supabase-community/lite/blob/HEAD/STATUS.md#database-support)               | ✅     | `bun:sqlite`, `node:sqlite`, sqlite-wasm, Cloudflare D1 + DO, PGlite, PostgreSQL |
-| [Data API (PostgREST)](https://github.com/supabase-community/lite/blob/HEAD/STATUS.md#database-api-postgrest-compatible)    | ✅     | 47/74 supabase-js methods on SQLite: `from`, `select`, `insert`, `update`, `delete`, `upsert`, `eq`, `neq`, `gt`, `gte`, `lt`, `lte`, `in`, `notIn`, `is`, `isDistinct`, `like`, `ilike`, `likeAllOf`, `likeAnyOf`, `ilikeAllOf`, `ilikeAnyOf`, `match`, `or`, `not`, `filter`, `order`, `limit`, `range`, `single`, `maybeSingle`, `csv`, `abortSignal`, `setHeader`, `throwOnError`, `maxAffected`, `returns`, `overrideTypes`, plus full resource embedding (FK joins, `!inner`, spreads, nested, aggregates). Partial: `contains`, `containedBy`, `overlaps`. `rpc` not supported on SQLite. 72/74 on Postgres. |
+| [Data API (PostgREST)](https://github.com/supabase-community/lite/blob/HEAD/STATUS.md#database-api-postgrest-compatible)    | ✅     | 53/74 supabase-js methods on SQLite: `from`, `select`, `insert`, `update`, `delete`, `upsert`, `eq`, `neq`, `gt`, `gte`, `lt`, `lte`, `in`, `notIn`, `is`, `isDistinct`, `like`, `ilike`, `likeAllOf`, `likeAnyOf`, `ilikeAllOf`, `ilikeAnyOf`, `match`, `or`, `not`, `filter`, `order`, `limit`, `range`, `single`, `maybeSingle`, `csv`, `abortSignal`, `setHeader`, `throwOnError`, `maxAffected`, `returns`, `overrideTypes`, plus full resource embedding (FK joins, `!inner`, spreads, nested, aggregates). Partial: `contains`, `containedBy`, `overlaps`, `textSearch` (LIKE-based lexeme approximation), `regexMatch`/`regexIMatch` (simple anchored patterns). `rpc` not supported on SQLite. 72/74 on Postgres. |
 | [Auth API (GoTrue)](https://github.com/supabase-community/lite/blob/HEAD/STATUS.md#auth-api-gotrue-compatible)       | ✅     | 21/63 supabase-js methods (11 backend + 10 client-side helpers): `signUp`, `signInWithPassword`, `signInWithOtp`, `verifyOtp`, `refreshSession`, `signOut`, `getUser`, `updateUser`, `resetPasswordForEmail`, `resend`, `reauthenticate`. OAuth, anonymous, identity linking, admin API, and MFA planned. |
 | [Storage API](https://github.com/supabase-community/lite/blob/HEAD/STATUS.md#storage-api-compatible)             | 🧪     | 20/20 supabase-js methods: `upload`, `download`, `list`, `remove`, `move`, `copy`, `info`, `exists`, `update`, `getPublicUrl`, `createSignedUrl`, `createSignedUrls`, `createSignedUploadUrl`, `uploadToSignedUrl`, `listBuckets`, `getBucket`, `createBucket`, `updateBucket`, `deleteBucket`, `emptyBucket`. Role-based access + RLS pending. <br />⚠️ Gated behind `EXPERIMENTAL_STORAGE`. |
 | Realtime                | 🔄     | Coming soon                                                        |
@@ -114,9 +116,15 @@ lite <command> [options]
 | `dev`            | Start server + watch `schemas/*.sql`, auto-apply on change    |
 | `start`          | Start server (no watch, no auto-migrate)                      |
 | `db schema`      | Print current DB schema; `--diff` compares vs `schemas/*.sql` |
-| `migration diff` | Generate/apply migrations from schema diff                    |
-| `repl`           | Interactive REPL with `app`, `client`, `conn` in scope        |
+| `db diff`        | Emit a new pg-DDL migration from the declarative schema diff  |
 | `db query`       | Run a SQL statement against the local DB                      |
+| `db reset`       | Drop everything, replay migrations, run seed                  |
+| `migration new`  | Create an empty migration file in `supabase/migrations/`      |
+| `migration up`   | Apply pending migrations (`--dry-run` to preview)             |
+| `migration list` | Show applied vs pending migrations                           |
+| `migration diff` | Diff DB state against `schemas/*.sql`                         |
+| `repl`           | Interactive REPL with `app`, `client`, `conn` in scope        |
+| `upgrade`        | Migrate the project to hosted or local Supabase (see [UPGRADE.md](https://github.com/supabase-community/lite/blob/HEAD/UPGRADE.md)) |
 | `debug`          | Show runtime/config info                                      |
 
 Common flags:
@@ -171,18 +179,21 @@ export default defineConfig({
 });
 ```
 
-Then from your frontend. Because the plugin mounts the API on the Vite dev
-server itself, the simplest dev setup is to point supabase-js at the current
-origin and pass any non-empty string as the anon key:
+Then from your frontend, the canonical snippet works with no setup. The plugin
+injects `VITE_SUPABASE_URL` (the current origin, since the API rides on the Vite
+server) and a dev `VITE_SUPABASE_ANON_KEY`:
 
 ```ts
 import { createClient } from "@supabase/supabase-js";
 
-const client = createClient(window.location.origin, "any-string-works-for-now");
+const client = createClient(
+   import.meta.env.VITE_SUPABASE_URL,
+   import.meta.env.VITE_SUPABASE_ANON_KEY,
+);
 ```
 
-The plugin does **not** currently inject `VITE_SUPABASE_URL` or
-`VITE_SUPABASE_ANON_KEY` — env injection is tracked in [#27](https://github.com/supabase-community/lite/issues/27). Until that lands, prefer `window.location.origin` over an env-driven URL for the in-Vite path.
+Set either var in a `.env` file to override the injected defaults — your values
+always win.
 
 The plugin auto-resolves `./supabase/config.toml`, applies the schema on boot,
 watches `schemas/*.sql` for hot-reload, and mounts `/auth/v1`, `/rest/v1`, and

package/STATUS.md

@@ -335,10 +335,10 @@ All operators are parsed into the AST. The "Status" column reflects whether a wo
 
 | Method                 | SQLite | Postgres | Notes                                        |
 |------------------------|--------|----------|----------------------------------------------|
-| `textSearch()` (fts)   | ❌     | ✅        | Not implemented on SQLite; FTS5 candidate (backlog) |
-| `textSearch()` (plfts) | ❌     | ✅        | Not implemented on SQLite                    |
-| `textSearch()` (phfts) | ❌     | ✅        | Not implemented on SQLite                    |
-| `textSearch()` (wfts)  | ❌     | ✅        | Not implemented on SQLite                    |
+| `textSearch()` (fts)   | ⚠️     | ✅        | SQLite: LIKE-based tsvector-lexeme approximation, not FTS5 ranking. Language/dictionary variants and computed-column FTS are limited. |
+| `textSearch()` (plfts) | ⚠️     | ✅        | SQLite: phrase query split into per-lexeme `AND` over the approximation |
+| `textSearch()` (phfts) | ⚠️     | ✅        | SQLite: same lexeme approximation; dictionary/stemming differences not modeled |
+| `textSearch()` (wfts)  | ⚠️     | ✅        | SQLite: websearch query parsed to lexemes over the approximation |
 
 ### Advanced Filters
 
@@ -353,8 +353,8 @@ All operators are parsed into the AST. The "Status" column reflects whether a wo
 
 | Method          | SQLite | Postgres | Notes                                            |
 |-----------------|--------|----------|--------------------------------------------------|
-| `regexMatch()`  | ❌     | ✅        | Not implemented on SQLite; would require `regexp` extension  |
-| `regexIMatch()` | ❌     | ✅        | Not implemented on SQLite; would require `regexp` extension  |
+| `regexMatch()`  | ⚠️     | ✅        | SQLite: simple anchored/literal patterns (`^foo`, `bar$`, `^exact$`, substrings) translated to `GLOB`; complex regex (classes, quantifiers, alternation) unsupported |
+| `regexIMatch()` | ⚠️     | ✅        | SQLite: case-insensitive variant of the above via `LIKE`; complex regex unsupported |
 
 ### Range Operators
 
@@ -446,18 +446,18 @@ Supported natively on the Postgres / PGlite path.
 | Comparison (10) | ✅ 10 ⚠️ 0  ❌ 0          | ✅ 10 ⚠️ 0  ❌ 0          |
 | Pattern (6)     | ✅ 6  ⚠️ 0  ❌ 0          | ✅ 6  ⚠️ 0  ❌ 0          |
 | Array/JSON (3)  | ✅ 0  ⚠️ 3  ❌ 0          | ✅ 3  ⚠️ 0  ❌ 0          |
-| Full-Text (4)   | ✅ 0  ⚠️ 0  ❌ 4          | ✅ 4  ⚠️ 0  ❌ 0          |
+| Full-Text (4)   | ✅ 0  ⚠️ 4  ❌ 0          | ✅ 4  ⚠️ 0  ❌ 0          |
 | Advanced (4)    | ✅ 4  ⚠️ 0  ❌ 0          | ✅ 4  ⚠️ 0  ❌ 0          |
-| Regex (2)       | ✅ 0  ⚠️ 0  ❌ 2          | ✅ 2  ⚠️ 0  ❌ 0          |
+| Regex (2)       | ✅ 0  ⚠️ 2  ❌ 0          | ✅ 2  ⚠️ 0  ❌ 0          |
 | Range (5)       | ✅ 0  ⚠️ 0  ❌ 5          | ✅ 5  ⚠️ 0  ❌ 0          |
 | Quantified (12) | ✅ 0  ⚠️ 0  ❌ 12         | ✅ 12 ⚠️ 0  ❌ 0          |
 | Transforms (5)  | ✅ 5  ⚠️ 0  ❌ 0          | ✅ 5  ⚠️ 0  ❌ 0          |
 | Embedding (5)   | ✅ 5  ⚠️ 0  ❌ 0          | ✅ 5  ⚠️ 0  ❌ 0          |
 | Response (7)    | ✅ 5  ⚠️ 1  ❌ 1          | ✅ 5  ⚠️ 1  ❌ 1          |
 | Control (5)     | ✅ 0  ⚠️ 0  ❌ 3  ⚫ 2     | ✅ 2  ⚠️ 0  ❌ 1  ⚫ 2     |
-| **Total (74)**  | **✅ 41 ⚠️ 4  ❌ 27 ⚫ 2** | **✅ 69 ⚠️ 1  ❌ 2  ⚫ 2** |
+| **Total (74)**  | **✅ 41 ⚠️ 10 ❌ 21 ⚫ 2** | **✅ 69 ⚠️ 1  ❌ 2  ⚫ 2** |
 
-> Counting effective availability (✅ + ⚠️ + ⚫): **47/74 on SQLite**, **72/74 on Postgres** (`geojson()` and `rollback()` are the only gaps on Postgres). The 2 ⚫ methods (`returns`, `overrideTypes`) are TypeScript-only and need no backend.
+> Counting effective availability (✅ + ⚠️ + ⚫): **53/74 on SQLite**, **72/74 on Postgres** (`geojson()` and `rollback()` are the only gaps on Postgres). The 2 ⚫ methods (`returns`, `overrideTypes`) are TypeScript-only and need no backend.
 
 ### PostgREST spec: SQLite skip breakdown
 
@@ -734,7 +734,10 @@ Help groups match upstream: **Local Development** (commands you run from a proje
 | Command             | Status | Notes                                                  |
 |---------------------|--------|--------------------------------------------------------|
 | `migration diff`    | ✅      | `[lite]`: diff DB state against `schemas/*.sql`       |
-| `migration new`, `migration list`, `migration up`, `migration down`, `migration repair`, `migration squash`, `migration fetch` | 🔄 | Not registered |
+| `migration new`     | ✅      | Create an empty migration file in `supabase/migrations/` |
+| `migration up`      | ✅      | Apply pending migrations; `--dry-run` lists without applying |
+| `migration list`    | ✅      | Show applied vs pending migrations                    |
+| `migration down`, `migration repair`, `migration squash`, `migration fetch` | 🔄 | Not registered |
 
 ### `cloud` group `[lite]` `[experimental]`
 
@@ -783,8 +786,8 @@ Mirrors upstream behavior documented in [`internal/docs/cli/environment.md`](htt
 
 | Status                      | Count |
 |-----------------------------|-------|
-| ✅ Implemented               | 22    |
-| 🔄 Planned (not registered) | 17    |
+| ✅ Implemented               | 25    |
+| 🔄 Planned (not registered) | 14    |
 | 🚫 Not Applicable           | 7     |
 
 > Counts include only commands tracked in this file (excludes management-API groups represented as a single row each).
@@ -803,9 +806,9 @@ Mirrors upstream behavior documented in [`internal/docs/cli/environment.md`](htt
 
 ### Vite plugin scope
 
-- **Active only during `vite` / `vite dev`.** `vite preview`, `vite build`, and any production server do **not** mount the API. Use a real backend (`lite start`, hosted Supabase, or equivalent) for non-dev environments.
+- **Active during `vite` / `vite dev` and `vite preview`.** `vite dev` watches `schemas/*.sql` for hot-reload; `vite preview` mounts the API and runs boot migrations but does **not** watch schemas (it simulates production). `vite build` and any standalone production server do **not** mount the API — use a real backend (`lite start`, hosted Supabase, or equivalent) there.
 - **Same-process by design.** The plugin mounts `/auth/v1`, `/rest/v1`, and `/_system` on the Vite dev server. Do not run `lite dev` or `lite start` alongside — both bind the API and will collide on port.
-- **No env-var injection (yet).** The plugin does not currently set `VITE_SUPABASE_URL` / `VITE_SUPABASE_ANON_KEY`. Tracked in [#27](https://github.com/supabase-community/lite/issues/27). For now pass `window.location.origin` + any non-empty anon string to `createClient`.
+- **Env-var injection.** The plugin's `config()` hook injects `VITE_SUPABASE_URL` (the current origin) and a dev `VITE_SUPABASE_ANON_KEY`, so `createClient(import.meta.env.VITE_SUPABASE_URL, import.meta.env.VITE_SUPABASE_ANON_KEY)` works with no `.env`. A user-provided `.env` overrides either value.
 
 ---
 
@@ -827,9 +830,9 @@ See [UPGRADE.md](https://github.com/supabase-community/lite/blob/HEAD/UPGRADE.md
 
 | Test Suite | Passing           | Skipped     | Failed          | Assertions        | Files          |
 |------------|-------------------|-------------|-----------------|-------------------|----------------|
-| App        | **2,221 passing** | 486 skipped | 0 failed        | 17,186 assertions | 150 test files |
-| App (vitest: node + D1 + DO + KV) | **34 passing** | 0 skipped | 0 failed | 80 assertions | 4 test files |
-| Repo       | **3,248 passing** | 540 skipped | 0 failed | 30,961 assertions | 155 test files |
+| App        | **2,376 passing** | 486 skipped | 0 failed        | 17,538 assertions | 168 test files |
+| App (vitest: node + browser + D1 + DO + KV) | **47 passing** | 0 skipped | 0 failed | — | 5 test files |
+| Repo       | **3,404 passing** | 540 skipped | 0 failed | 31,320 assertions | 173 test files |
 
 Latest `cd app && bun test`, `cd app && bun run vitest`, and root `bun test --recursive` completed with zero failures.
 

package/UPGRADE.md

@@ -54,13 +54,19 @@ Only `--mode user` is currently supported. `--mode platform` is reserved for fut
 
 ### Local Supabase
 
-`--target local` upgrades into a local Supabase CLI workdir. By default, the workdir is the current directory, so the command initializes or updates `./supabase/config.toml` in the project being upgraded:
+`--target local` upgrades into a local Supabase CLI workdir. By default, the workdir is the current directory, so the command rewrites `./supabase/config.toml` in place: it strips the Supalite-only `[db].driver`/`[db].url` keys and repoints the file at the Supabase CLI stack. This breaks `bun run dev` (the Supalite Vite plugin) until the config is restored.
+
+To prevent data loss, the original Supalite config is first backed up to `./supabase/config.toml.bak`, and the upgrade report prints how to restore it. Restore supalite dev with:
+
+```bash
+cp supabase/config.toml.bak supabase/config.toml   # or: git checkout supabase/config.toml
+```
 
 ```bash
 lite upgrade --target local --force --no-migrate-sessions
 ```
 
-Use `--local-dir` to put the Supabase CLI workdir somewhere else:
+Use `--local-dir` to put the Supabase CLI workdir somewhere else and avoid touching the project's `supabase/config.toml` entirely:
 
 ```bash
 lite upgrade \
@@ -98,6 +104,8 @@ rm -rf supabase/.branches supabase/.temp
 lite upgrade --target local --force --no-migrate-sessions
 ```
 
+The `supabase/config.toml.bak` created on the first in-place run is preserved across reruns (it is never overwritten by the already-sanitized config), so the original Supalite config stays recoverable.
+
 If the local target uses a separate directory, clean that directory instead:
 
 ```bash