@supacloud/lite 0.10.0 → 0.12.0

package/dist/cli.js

@@ -5,11 +5,11 @@ var __require = import.meta.require;
 // src/cli.ts
 import { existsSync as existsSync4 } from "fs";
 import { mkdir as mkdir7, rm as rm6, writeFile as writeFile7 } from "fs/promises";
-import { dirname as dirname7, join as join10, resolve as resolve5 } from "path";
+import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.10.0",
+  version: "0.12.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -59,6 +59,7 @@ var package_default = {
   },
   dependencies: {
     "@electric-sql/pglite": "0.5.8",
+    "@supacloud/db": "^0.2.0",
     tar: "^7.5.22"
   },
   devDependencies: {
@@ -2525,8 +2526,99 @@ function resetCapturedHandler() {
   captured.handler = undefined;
 }
 
-// src/runtime/functions/pgredis.ts
+// src/runtime/functions/edge-runtime-shim.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var scopeStore = new AsyncLocalStorage2;
+var NOT_ENABLED_MESSAGE = "EdgeRuntime.waitUntil is not enabled by the Function capability policy";
+var installed;
+function installEdgeRuntimeShim() {
+  if (installed)
+    return;
+  const runtime = {
+    waitUntil(promise) {
+      const scope = scopeStore.getStore();
+      if (scope && !scope.allowed) {
+        throw new Error(NOT_ENABLED_MESSAGE);
+      }
+      const task = Promise.resolve(promise).catch((error) => {
+        console.error("[EdgeRuntime.waitUntil] background task failed", error);
+      });
+      scope?.tasks.push(task);
+    }
+  };
+  installed = runtime;
+  globalThis.EdgeRuntime = runtime;
+}
+function runWithBackgroundTasks(options, fn) {
+  installEdgeRuntimeShim();
+  const scope = { allowed: options.allowed, tasks: [] };
+  return scopeStore.run(scope, async () => {
+    try {
+      return await fn();
+    } finally {
+      flushBackgroundTasks(scope.tasks, options.timeoutMs);
+    }
+  });
+}
+async function flushBackgroundTasks(tasks, timeoutMs) {
+  if (tasks.length === 0)
+    return;
+  const drain = (async () => {
+    while (tasks.length > 0) {
+      const batch = tasks.splice(0);
+      await Promise.allSettled(batch);
+    }
+  })();
+  if (timeoutMs === undefined) {
+    await drain;
+    return;
+  }
+  const timedOut = await Promise.race([
+    drain.then(() => false),
+    new Promise((resolve) => setTimeout(() => resolve(true), timeoutMs))
+  ]);
+  if (timedOut) {
+    console.warn(`[EdgeRuntime.waitUntil] background tasks did not settle within ${timeoutMs}ms; no longer waiting`);
+  }
+}
+
+// src/runtime/functions/fetch-policy.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+var policyStore = new AsyncLocalStorage3;
+var LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]);
+var installed2 = false;
+function installFetchPolicyShim() {
+  if (installed2)
+    return;
+  installed2 = true;
+  const original = globalThis.fetch;
+  globalThis.fetch = async (input, init) => {
+    const allowed = policyStore.getStore();
+    if (!allowed)
+      return original(input, init);
+    const host = hostOf(input);
+    if (host !== undefined && !LOOPBACK_HOSTS.has(host) && !allowed.has(host)) {
+      throw new Error(`outbound host not allowed: ${host}`);
+    }
+    return original(input, init);
+  };
+}
+function runWithFetchPolicy(allowedHosts, fn) {
+  installFetchPolicyShim();
+  return policyStore.run(new Set(allowedHosts), fn);
+}
+function hostOf(input) {
+  try {
+    const raw = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+    const host = new URL(raw).hostname;
+    return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+  } catch {
+    return;
+  }
+}
+
+// src/runtime/functions/pgredis.ts
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
 var CACHE_NAMESPACE = "supacloud-edge-runtime";
 var CACHE_TABLE = "public.supacloud_pgredis_kv";
 var MAX_KEY_CHARACTERS = 512;
@@ -2619,7 +2711,7 @@ class PgredisCache {
     });
   }
 }
-var cacheContexts = new AsyncLocalStorage2;
+var cacheContexts = new AsyncLocalStorage4;
 var cacheFacade = Object.freeze({
   get: async (key) => activeCache().get(key),
   set: async (key, cacheValue, ttlMs) => activeCache().set(key, cacheValue, ttlMs),
@@ -2693,6 +2785,23 @@ async function upsertWithoutTtl(query, key, serializedValue) {
 }
 
 // src/runtime/functions/handler.ts
+var VERIFIED_JWT_SUBJECT_HEADER = "x-supacloud-jwt-sub";
+var UNSAFE_VERIFIED_JWT_SUBJECT = /[\u0000-\u001F\u007F-\u009F\u0100-\u{10FFFF}]/u;
+function verifiedSubject(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 1024)
+    return null;
+  if (value.trim() !== value || UNSAFE_VERIFIED_JWT_SUBJECT.test(value))
+    return null;
+  return value;
+}
+function withVerifiedJwtSubject(request, ctx) {
+  const trustedRequest = request.clone();
+  trustedRequest.headers.delete(VERIFIED_JWT_SUBJECT_HEADER);
+  const subject = verifiedSubject(ctx.claims?.sub);
+  if (subject !== null)
+    trustedRequest.headers.set(VERIFIED_JWT_SUBJECT_HEADER, subject);
+  return trustedRequest;
+}
 function isLoadedFunction(value) {
   return typeof value === "object" && value !== null && "handler" in value;
 }
@@ -2705,9 +2814,7 @@ function isFrameworkRouterHandler(handler) {
   const candidate = handler;
   if (candidate.__supacloud?.routeAware === true)
     return true;
-  if (typeof candidate.handle === "function")
-    return true;
-  return Array.isArray(candidate.routes) && typeof candidate.fetch === "function";
+  return Array.isArray(candidate.routes) && (typeof candidate.handle === "function" || typeof candidate.fetch === "function");
 }
 function toFunctionLocalUrl(requestUrl) {
   const url = new URL(requestUrl);
@@ -2748,23 +2855,68 @@ class FunctionsHandler {
       return json2(404, { error: `function "${name}" not found` });
     }
     const entry = normalizeEntry(value);
+    const limits = entry.limits;
+    const capabilities = entry.capabilities;
+    const maxBody = limits?.maxRequestBodyBytes;
+    let request = req;
+    if (maxBody !== undefined) {
+      const contentLength = req.headers.get("content-length");
+      if (contentLength !== null && Number(contentLength) > maxBody) {
+        return json2(413, { error: `function "${name}" request body exceeded ${maxBody} bytes` });
+      }
+      if (contentLength === null && req.body) {
+        request = withCountedBody(request, maxBody);
+      }
+    }
     const routeAware = entry.framework !== undefined && entry.framework !== "fetch" || isFrameworkRouterHandler(entry.handler);
-    const target = routeAware ? new Request(toFunctionLocalUrl(req.url), req) : req;
+    request = withVerifiedJwtSubject(request, ctx);
+    if (routeAware)
+      request = new Request(toFunctionLocalUrl(request.url), request);
+    const timeoutMs = limits?.timeoutMs;
+    const abort = timeoutMs !== undefined ? new AbortController : undefined;
+    if (abort)
+      request = withSignal(request, abort.signal);
     try {
-      const invoke = () => this.invoke(entry.handler, target, ctx);
-      const res = await runWithDenoEnv(this.env, () => runWithPgredisCache(this.pgredis, invoke));
+      const env = capabilities?.secrets ? filterSecretsEnv(this.env, capabilities.secrets) : this.env;
+      const invoke = () => this.invoke(entry.handler, request, ctx, env);
+      const inner = () => runWithDenoEnv(env, () => runWithPgredisCache(this.pgredis, invoke));
+      const run = capabilities?.outboundHosts ? () => runWithFetchPolicy(capabilities.outboundHosts, inner) : inner;
+      const invokeWithBackground = () => runWithBackgroundTasks({ allowed: capabilities?.background !== false, timeoutMs: limits?.waitUntilTimeoutMs }, run);
+      const res = timeoutMs !== undefined ? await this.withTimeout(name, timeoutMs, invokeWithBackground, abort) : await invokeWithBackground();
       if (!(res instanceof Response)) {
         return json2(500, { error: `function "${name}" did not return a Response` });
       }
-      return res;
+      const maxResponse = limits?.maxResponseBodyBytes;
+      return maxResponse !== undefined ? withResponseLimit(name, res, maxResponse) : res;
     } catch (e) {
       const message = e instanceof Error ? e.message : String(e);
       return json2(500, { error: message });
     }
   }
-  invoke(handler, req, ctx) {
+  async withTimeout(name, timeoutMs, run, abort) {
+    let timer;
+    const pending = run();
+    try {
+      const winner = await Promise.race([
+        pending.then((res) => ({ timedOut: false, res })),
+        new Promise((resolve) => {
+          timer = setTimeout(() => resolve({ timedOut: true }), timeoutMs);
+        })
+      ]);
+      if (winner.timedOut) {
+        abort.abort();
+        pending.then(() => {}, () => {});
+        return json2(504, { error: `function "${name}" timed out after ${timeoutMs}ms` });
+      }
+      return winner.res;
+    } finally {
+      if (timer)
+        clearTimeout(timer);
+    }
+  }
+  invoke(handler, req, ctx, env) {
     if (typeof handler === "function") {
-      return Promise.resolve(handler(req, { auth: ctx, env: this.env }));
+      return Promise.resolve(handler(req, { auth: ctx, env }));
     }
     if (typeof handler.handle === "function") {
       return Promise.resolve(handler.handle.call(handler, req));
@@ -2775,6 +2927,54 @@ class FunctionsHandler {
     throw new Error("function handler must be a function or an object with handle()/fetch()");
   }
 }
+var BASE_ENV_KEYS = ["SUPABASE_URL", "SUPABASE_ANON_KEY", "SUPABASE_SERVICE_ROLE_KEY"];
+function filterSecretsEnv(env, secrets) {
+  const out = {};
+  for (const key of BASE_ENV_KEYS)
+    out[key] = env[key];
+  for (const key of secrets) {
+    if (env[key] !== undefined)
+      out[key] = env[key];
+  }
+  return out;
+}
+function withCountedBody(req, limit) {
+  let seen = 0;
+  const counter = new TransformStream({
+    transform(chunk, controller) {
+      seen += chunk.byteLength;
+      if (seen > limit) {
+        controller.error(new Error(`request body exceeded ${limit} bytes`));
+        return;
+      }
+      controller.enqueue(chunk);
+    }
+  });
+  return new Request(req, { body: req.body.pipeThrough(counter), duplex: "half" });
+}
+function withResponseLimit(name, res, limit) {
+  const contentLength = res.headers.get("content-length");
+  if (contentLength !== null && Number(contentLength) > limit) {
+    return json2(502, { error: `function "${name}" response exceeded ${limit} bytes` });
+  }
+  if (!res.body)
+    return res;
+  let seen = 0;
+  const counter = new TransformStream({
+    transform(chunk, controller) {
+      seen += chunk.byteLength;
+      if (seen > limit) {
+        controller.error(new Error(`function "${name}" response exceeded ${limit} bytes`));
+        return;
+      }
+      controller.enqueue(chunk);
+    }
+  });
+  return new Response(res.body.pipeThrough(counter), res);
+}
+function withSignal(req, signal) {
+  return new Request(req, { signal, ...req.body ? { duplex: "half" } : {} });
+}
 function json2(status, body) {
   return new Response(JSON.stringify(body), {
     status,
@@ -10022,9 +10222,9 @@ class RetentionService {
 }
 
 // src/runtime/security.ts
-var LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1", "", undefined]);
+var LOOPBACK_HOSTS2 = new Set(["127.0.0.1", "localhost", "::1", "", undefined]);
 function isNetworkExposed(host) {
-  return !LOOPBACK_HOSTS.has(host);
+  return !LOOPBACK_HOSTS2.has(host);
 }
 function assertSecretsSafe(input) {
   const { host, jwtSecret, vaultKeyDerived, warn } = input;
@@ -11958,6 +12158,393 @@ async function closeResources(...resources) {
     throw failed.reason;
 }
 
+// src/runtime/node/db-check.ts
+import { readFile as readFile2, stat } from "fs/promises";
+import { dirname as dirname3, resolve as resolve3 } from "path";
+import { pathToFileURL } from "url";
+
+// node_modules/@supacloud/db/dist/index.js
+var TABLES_SQL = `
+SELECT n.nspname AS schema,
+       c.relname AS name,
+       c.relrowsecurity AS rls_enabled,
+       c.relforcerowsecurity AS rls_forced
+FROM pg_class c
+JOIN pg_namespace n ON n.oid = c.relnamespace
+WHERE c.relkind = 'r'
+  AND n.nspname = ANY($1)
+ORDER BY n.nspname, c.relname
+`;
+var POLICIES_SQL = `
+SELECT n.nspname AS schema,
+       c.relname AS table,
+       p.polname AS name,
+       p.polcmd AS command,
+       ARRAY(
+         SELECT CASE WHEN r = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(r) END
+         FROM unnest(p.polroles) AS r
+       ) AS roles,
+       pg_get_expr(p.polqual, p.polrelid) AS using_expr,
+       pg_get_expr(p.polwithcheck, p.polrelid) AS check_expr
+FROM pg_policy p
+JOIN pg_class c ON c.oid = p.polrelid
+JOIN pg_namespace n ON n.oid = c.relnamespace
+WHERE n.nspname = ANY($1)
+ORDER BY n.nspname, c.relname, p.polname
+`;
+var FUNCTIONS_SQL = `
+SELECT n.nspname AS schema,
+       p.proname AS name,
+       p.prosecdef AS security_definer,
+       p.proconfig AS config,
+       l.lanname AS language
+FROM pg_proc p
+JOIN pg_namespace n ON n.oid = p.pronamespace
+JOIN pg_language l ON l.oid = p.prolang
+WHERE n.nspname = ANY($1)
+ORDER BY n.nspname, p.proname
+`;
+var TRIGGERS_SQL = `
+SELECT n.nspname AS schema,
+       c.relname AS table,
+       t.tgname AS name,
+       t.tgenabled <> 'D' AS enabled
+FROM pg_trigger t
+JOIN pg_class c ON c.oid = t.tgrelid
+JOIN pg_namespace n ON n.oid = c.relnamespace
+WHERE NOT t.tgisinternal
+  AND n.nspname = ANY($1)
+ORDER BY n.nspname, c.relname, t.tgname
+`;
+var GRANTS_SQL = `
+SELECT table_schema AS object_schema,
+       table_name AS object_name,
+       privilege_type AS privilege,
+       grantee
+FROM information_schema.role_table_grants
+WHERE table_schema = ANY($1)
+UNION ALL
+SELECT routine_schema AS object_schema,
+       routine_name AS object_name,
+       privilege_type AS privilege,
+       grantee
+FROM information_schema.routine_privileges
+WHERE routine_schema = ANY($1)
+`;
+var POLCMD_MAP = {
+  r: "select",
+  a: "insert",
+  w: "update",
+  d: "delete",
+  "*": "all"
+};
+function extractSearchPath(config) {
+  if (!config)
+    return null;
+  const entry = config.find((item) => item.startsWith("search_path="));
+  if (!entry)
+    return null;
+  return entry.slice("search_path=".length);
+}
+async function readCatalog(executor, schemas = ["public"]) {
+  const params = [schemas];
+  const [tableRows, policyRows, functionRows, triggerRows, grantRows] = await Promise.all([
+    executor.query(TABLES_SQL, params),
+    executor.query(POLICIES_SQL, params),
+    executor.query(FUNCTIONS_SQL, params),
+    executor.query(TRIGGERS_SQL, params),
+    executor.query(GRANTS_SQL, params)
+  ]);
+  return {
+    tables: tableRows.map((row) => ({
+      schema: row.schema,
+      name: row.name,
+      rlsEnabled: row.rls_enabled,
+      rlsForced: row.rls_forced
+    })),
+    policies: policyRows.map((row) => ({
+      schema: row.schema,
+      table: row.table,
+      name: row.name,
+      command: POLCMD_MAP[row.command] ?? "all",
+      roles: row.roles ?? [],
+      usingExpr: row.using_expr ?? undefined,
+      checkExpr: row.check_expr ?? undefined
+    })),
+    functions: functionRows.map((row) => ({
+      schema: row.schema,
+      name: row.name,
+      security: row.security_definer ? "definer" : "invoker",
+      searchPath: extractSearchPath(row.config),
+      language: row.language
+    })),
+    triggers: triggerRows.map((row) => ({
+      schema: row.schema,
+      table: row.table,
+      name: row.name,
+      enabled: row.enabled
+    })),
+    grants: grantRows.map((row) => ({
+      objectSchema: row.object_schema,
+      objectName: row.object_name,
+      privilege: row.privilege,
+      grantee: row.grantee
+    }))
+  };
+}
+function splitQualifiedName(name) {
+  const dot = name.indexOf(".");
+  if (dot === -1)
+    return ["public", name];
+  return [name.slice(0, dot), name.slice(dot + 1)];
+}
+function isFixedSearchPath(searchPath) {
+  if (searchPath === null)
+    return false;
+  const parts = searchPath.split(",").map((part) => part.trim().replace(/^"|"$/g, ""));
+  return parts.every((part) => part !== "" && part.toLowerCase() !== "pg_temp");
+}
+function reconcileModule(module, catalog) {
+  const issues = [];
+  const ownedTables = new Set(module.tables);
+  const push = (severity, code, object, message2) => issues.push({ severity, code, object, message: message2 });
+  for (const policy of module.policies) {
+    const [schema, table] = splitQualifiedName(policy.table);
+    const found = catalog.policies.some((cp) => cp.schema === schema && cp.table === table && cp.name === policy.name);
+    if (!found) {
+      push("error", "missing-policy", `${policy.table}.${policy.name}`, `\u58F0\u660E\u7684\u7B56\u7565 ${policy.name} \u5728\u8868 ${policy.table} \u7684 catalog \u4E2D\u4E0D\u5B58\u5728`);
+    }
+  }
+  const declaredPolicyKeys = new Set(module.policies.map((p) => `${p.table}::${p.name}`));
+  for (const cp of catalog.policies) {
+    const qualified = `${cp.schema}.${cp.table}`;
+    if (ownedTables.has(qualified) && !declaredPolicyKeys.has(`${qualified}::${cp.name}`)) {
+      push("warn", "undeclared-policy", `${qualified}.${cp.name}`, `\u5F52\u5C5E\u8868 ${qualified} \u4E0A\u5B58\u5728\u672A\u58F0\u660E\u7684\u7B56\u7565 ${cp.name}\uFF0C\u53EF\u80FD\u53D1\u751F\u6F02\u79FB`);
+    }
+  }
+  for (const fn of module.functions) {
+    const [schema, name] = splitQualifiedName(fn.name);
+    const cf = catalog.functions.find((f) => f.schema === schema && f.name === name);
+    if (!cf) {
+      push("error", "missing-function", fn.name, `\u58F0\u660E\u7684\u51FD\u6570 ${fn.name} \u5728 catalog \u4E2D\u4E0D\u5B58\u5728`);
+      continue;
+    }
+    if (cf.security !== fn.security) {
+      push("warn", "security-mismatch", fn.name, `\u51FD\u6570 ${fn.name} \u58F0\u660E\u4E3A security ${fn.security}\uFF0Ccatalog \u5B9E\u9645\u4E3A ${cf.security}`);
+    }
+    const effectiveDefiner = fn.security === "definer" || cf.security === "definer";
+    if (effectiveDefiner && !isFixedSearchPath(cf.searchPath)) {
+      push("error", "definer-without-search-path", fn.name, `security definer \u51FD\u6570 ${fn.name} \u672A\u8BBE\u7F6E\u56FA\u5B9A search_path\uFF08\u5F53\u524D: ${cf.searchPath ?? "\u672A\u8BBE\u7F6E"}\uFF09`);
+    }
+  }
+  for (const trigger of module.triggers) {
+    const [schema, table] = splitQualifiedName(trigger.table);
+    const found = catalog.triggers.some((ct) => ct.schema === schema && ct.table === table && ct.name === trigger.name);
+    if (!found) {
+      push("error", "missing-trigger", `${trigger.table}.${trigger.name}`, `\u58F0\u660E\u7684\u89E6\u53D1\u5668 ${trigger.name} \u5728\u8868 ${trigger.table} \u7684 catalog \u4E2D\u4E0D\u5B58\u5728`);
+    }
+  }
+  const declaredTriggerKeys = new Set(module.triggers.map((t) => `${t.table}::${t.name}`));
+  for (const ct of catalog.triggers) {
+    const qualified = `${ct.schema}.${ct.table}`;
+    if (ownedTables.has(qualified) && !declaredTriggerKeys.has(`${qualified}::${ct.name}`)) {
+      push("warn", "undeclared-trigger", `${qualified}.${ct.name}`, `\u5F52\u5C5E\u8868 ${qualified} \u4E0A\u5B58\u5728\u672A\u58F0\u660E\u7684\u89E6\u53D1\u5668 ${ct.name}${ct.enabled ? "" : "\uFF08\u5DF2\u7981\u7528\uFF09"}\uFF0C\u53EF\u80FD\u53D1\u751F\u6F02\u79FB`);
+    }
+  }
+  for (const table of module.tables) {
+    const [schema, name] = splitQualifiedName(table);
+    const ct = catalog.tables.find((t) => t.schema === schema && t.name === name);
+    if (ct && !ct.rlsEnabled) {
+      push("error", "rls-disabled", table, `\u5F52\u5C5E\u8868 ${table} \u672A\u5F00\u542F\u884C\u7EA7\u5B89\u5168\uFF08relrowsecurity = false\uFF09`);
+    }
+  }
+  for (const grant of catalog.grants) {
+    const qualified = `${grant.objectSchema}.${grant.objectName}`;
+    if (ownedTables.has(qualified) && grant.grantee.toUpperCase() === "PUBLIC") {
+      push("error", "wildcard-grant", qualified, `\u5F52\u5C5E\u8868 ${qualified} \u5B58\u5728\u6388\u4E88 PUBLIC \u7684 ${grant.privilege} \u6743\u9650`);
+    }
+  }
+  for (const grant of module.grants) {
+    const [schema, name] = splitQualifiedName(grant.object);
+    const found = catalog.grants.some((cg) => cg.objectSchema === schema && cg.objectName === name && cg.privilege.toLowerCase() === grant.privilege.toLowerCase() && cg.grantee.toLowerCase() === grant.role.toLowerCase());
+    if (!found) {
+      push("warn", "grant-drift", grant.object, `\u58F0\u660E\u7684\u6388\u6743 ${grant.privilege} ON ${grant.object} TO ${grant.role} \u5728 catalog \u4E2D\u4E0D\u5B58\u5728`);
+    }
+  }
+  return {
+    module: module.name,
+    issues,
+    ok: !issues.some((issue) => issue.severity === "error")
+  };
+}
+var SECURITY_DEFINER_RE = /\bsecurity\s+definer\b/i;
+var SET_SEARCH_PATH_RE = /\bset\s+search_path\b/i;
+var GRANT_TO_PUBLIC_RE = /\bgrant\b[^;]*\bto\s+public\b/i;
+var DROP_WITHOUT_IF_EXISTS_RE = /\bdrop\s+(?:table|column)\s+(?!if\s+exists\b)/i;
+var ENABLE_RLS_RE = /\benable\s+row\s+level\s+security\b/i;
+var CREATE_POLICY_RE = /\bcreate\s+policy\b/i;
+var DROP_POLICY_IF_EXISTS_RE = /\bdrop\s+policy\s+if\s+exists\b/i;
+function lineOf(sql, index) {
+  let line = 1;
+  for (let i = 0;i < index; i += 1) {
+    if (sql.charCodeAt(i) === 10)
+      line += 1;
+  }
+  return line;
+}
+function lintSql(sql, file) {
+  const issues = [];
+  const definer = SECURITY_DEFINER_RE.exec(sql);
+  if (definer && !SET_SEARCH_PATH_RE.test(sql)) {
+    issues.push({
+      severity: "error",
+      code: "definer-no-search-path",
+      message: "security definer \u51FD\u6570\u5FC5\u987B\u663E\u5F0F set search_path\uFF0C\u907F\u514D search_path \u52AB\u6301",
+      file,
+      line: lineOf(sql, definer.index)
+    });
+  }
+  const grantPublic = GRANT_TO_PUBLIC_RE.exec(sql);
+  if (grantPublic) {
+    issues.push({
+      severity: "error",
+      code: "grant-to-public",
+      message: "\u7981\u6B62\u5C06\u6743\u9650\u6388\u4E88 PUBLIC \u89D2\u8272",
+      file,
+      line: lineOf(sql, grantPublic.index)
+    });
+  }
+  const drop = DROP_WITHOUT_IF_EXISTS_RE.exec(sql);
+  if (drop) {
+    issues.push({
+      severity: "warn",
+      code: "drop-without-if-exists",
+      message: "drop table/column \u5EFA\u8BAE\u4F7F\u7528 if exists\uFF0C\u4FDD\u8BC1\u8FC1\u79FB\u53EF\u91CD\u5165",
+      file,
+      line: lineOf(sql, drop.index)
+    });
+  }
+  const createPolicy = CREATE_POLICY_RE.exec(sql);
+  if (createPolicy) {
+    const dropPolicy = DROP_POLICY_IF_EXISTS_RE.exec(sql);
+    if (!dropPolicy || dropPolicy.index > createPolicy.index) {
+      issues.push({
+        severity: "warn",
+        code: "non-idempotent-policy",
+        message: "create policy \u524D\u7F3A\u5C11 drop policy if exists\uFF0C\u7B56\u7565\u4E0D\u53EF\u91CD\u590D\u6267\u884C",
+        file,
+        line: lineOf(sql, createPolicy.index)
+      });
+    }
+  }
+  return issues;
+}
+async function lintModule(module, readFile2) {
+  const issues = [];
+  const sources = new Set;
+  for (const decl of [
+    ...module.policies,
+    ...module.functions,
+    ...module.triggers,
+    ...module.grants
+  ]) {
+    sources.add(decl.source);
+  }
+  const contents = new Map;
+  await Promise.all([...sources].map(async (path) => {
+    contents.set(path, await readFile2(path));
+  }));
+  for (const [file, sql] of contents) {
+    issues.push(...lintSql(sql, file));
+  }
+  if (module.policies.length > 0) {
+    const anyEnable = module.policies.some((policy) => ENABLE_RLS_RE.test(contents.get(policy.source) ?? ""));
+    if (!anyEnable) {
+      issues.push({
+        severity: "warn",
+        code: "missing-rls-enable",
+        message: `\u6A21\u5757 ${module.name} \u58F0\u660E\u4E86 ${module.policies.length} \u6761\u7B56\u7565\uFF0C\u4F46\u6240\u6709\u7B56\u7565\u6E90\u6587\u4EF6\u90FD\u6CA1\u6709 enable row level security`,
+        file: module.policies[0].source
+      });
+    }
+  }
+  for (const policy of module.policies) {
+    if (!policy.tests || policy.tests.length === 0) {
+      issues.push({
+        severity: "warn",
+        code: "policy-without-test",
+        message: `\u7B56\u7565 ${policy.name} \u672A\u58F0\u660E\u6D4B\u8BD5\u6587\u4EF6`,
+        file: policy.source
+      });
+    }
+  }
+  for (const fn of module.functions) {
+    if (!fn.tests || fn.tests.length === 0) {
+      issues.push({
+        severity: "warn",
+        code: "policy-without-test",
+        message: `\u51FD\u6570 ${fn.name} \u672A\u58F0\u660E\u6D4B\u8BD5\u6587\u4EF6`,
+        file: fn.source
+      });
+    }
+  }
+  return issues;
+}
+
+// src/runtime/node/db-check.ts
+async function loadDatabaseModules(moduleFile) {
+  const absolute = resolve3(moduleFile);
+  try {
+    await stat(absolute);
+  } catch {
+    throw new Error(`database module manifest not found: ${absolute}`);
+  }
+  const mod = await import(pathToFileURL(absolute).href);
+  const candidate = mod.default ?? mod.modules;
+  const list = Array.isArray(candidate) ? candidate : candidate ? [candidate] : [];
+  if (list.length === 0) {
+    throw new Error(`database module manifest ${absolute} must export a default module or module array`);
+  }
+  for (const entry of list) {
+    if (!entry || typeof entry.name !== "string") {
+      throw new Error(`database module manifest ${absolute} contains an entry without a name`);
+    }
+  }
+  return list;
+}
+async function checkDatabaseModules(options) {
+  const modules = await loadDatabaseModules(options.moduleFile);
+  const baseDir = dirname3(resolve3(options.moduleFile));
+  const readSource = (path) => readFile2(resolve3(baseDir, path), "utf8");
+  const catalog = await readCatalog(options.executor, [options.schema ?? "public"]);
+  const reports = [];
+  for (const module of modules) {
+    const lintIssues = await lintModule(module, readSource);
+    const reconcile = reconcileModule(module, catalog);
+    reports.push({ module: module.name, lintIssues, reconcile });
+  }
+  const ok = reports.every((report) => report.reconcile.ok && !report.lintIssues.some((issue) => issue.severity === "error"));
+  return { ok, reports };
+}
+function formatDatabaseModuleCheck(result) {
+  const lines = [];
+  for (const report of result.reports) {
+    lines.push(`module ${report.module}:`);
+    for (const issue of report.lintIssues) {
+      lines.push(`  [lint ${issue.severity}] ${issue.code}: ${issue.message} (${issue.file})`);
+    }
+    for (const issue of report.reconcile.issues) {
+      lines.push(`  [catalog ${issue.severity}] ${issue.code}: ${issue.message} (${issue.object})`);
+    }
+    if (report.lintIssues.length === 0 && report.reconcile.issues.length === 0) {
+      lines.push("  ok");
+    }
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+
 // src/runtime/node/native/readiness.ts
 function liteCapabilities(engine, replicationProfile) {
   if (engine === "pglite") {
@@ -12189,7 +12776,7 @@ function sameStrings(left, right) {
 }
 
 // src/runtime/node/project.ts
-import { readdir, readFile as readFile2 } from "fs/promises";
+import { readdir, readFile as readFile3 } from "fs/promises";
 import { join as join3 } from "path";
 async function loadSupabaseProject(projectDir, seed = {}) {
   const migrationsDir = join3(projectDir, "supabase", "migrations");
@@ -12204,7 +12791,7 @@ async function loadSupabaseProject(projectDir, seed = {}) {
   for (const entry of entries.sort()) {
     if (!entry.endsWith(".sql"))
       continue;
-    const sql = await readFile2(join3(migrationsDir, entry), "utf8");
+    const sql = await readFile3(join3(migrationsDir, entry), "utf8");
     migrations.push({ name: entry.replace(/\.sql$/, ""), sql });
   }
   let seedSql;
@@ -12216,7 +12803,7 @@ async function loadSupabaseProject(projectDir, seed = {}) {
       const matches = /[*?[\]{}]/.test(pattern) ? [...new Bun.Glob(pattern).scanSync({ cwd: supabaseDir, onlyFiles: true })].sort() : [pattern];
       for (const relativePath of matches) {
         try {
-          parts.push(await readFile2(join3(supabaseDir, relativePath), "utf8"));
+          parts.push(await readFile3(join3(supabaseDir, relativePath), "utf8"));
         } catch (error) {
           if (!isNotFound(error))
             throw error;
@@ -12234,8 +12821,8 @@ function isNotFound(error) {
 }
 
 // src/project-runtime.ts
-import { chmod, link, lstat, mkdir as mkdir5, readFile as readFile6, realpath as realpath2, unlink as unlink2, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname5, isAbsolute, join as join8, parse, relative, resolve as resolve3 } from "path";
+import { chmod, link, lstat, mkdir as mkdir5, readFile as readFile7, realpath as realpath2, unlink as unlink2, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname6, isAbsolute, join as join8, parse, relative, resolve as resolve4 } from "path";
 
 // src/runtime/node/bun-server.ts
 async function serveBun(backend, opts = {}) {
@@ -12285,8 +12872,8 @@ async function serveBun(backend, opts = {}) {
 }
 
 // src/runtime/node/fs-driver.ts
-import { mkdir as mkdir3, readFile as readFile3, rename, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname3, join as join4, normalize, sep } from "path";
+import { mkdir as mkdir3, readFile as readFile4, rename, rm as rm2, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname4, join as join4, normalize, sep } from "path";
 
 class FsStorageDriver {
   root;
@@ -12302,7 +12889,7 @@ class FsStorageDriver {
   }
   async put(key, data) {
     const path = this.resolve(key);
-    await mkdir3(dirname3(path), { recursive: true });
+    await mkdir3(dirname4(path), { recursive: true });
     const temporaryPath = `${path}.${crypto.randomUUID()}.tmp`;
     try {
       await writeFile3(temporaryPath, data);
@@ -12314,7 +12901,7 @@ class FsStorageDriver {
   }
   async get(key) {
     try {
-      return new Uint8Array(await readFile3(this.resolve(key)));
+      return new Uint8Array(await readFile4(this.resolve(key)));
     } catch (e) {
       if (e.code === "ENOENT")
         return null;
@@ -12710,19 +13297,40 @@ function readFunctions(root) {
         console.warn(`  warning: [functions.${name}] framework "${framework}" is not one of fetch/elysia/hono; falling back to fetch`);
       }
     }
+    const timeoutMs = getInt(t, "timeout_ms");
+    if (timeoutMs !== undefined && timeoutMs > 0)
+      opts.timeoutMs = timeoutMs;
+    const maxRequestBodyBytes = getInt(t, "max_request_body_bytes");
+    if (maxRequestBodyBytes !== undefined && maxRequestBodyBytes > 0)
+      opts.maxRequestBodyBytes = maxRequestBodyBytes;
+    const maxResponseBodyBytes = getInt(t, "max_response_body_bytes");
+    if (maxResponseBodyBytes !== undefined && maxResponseBodyBytes > 0)
+      opts.maxResponseBodyBytes = maxResponseBodyBytes;
+    const waitUntilTimeoutMs = getInt(t, "wait_until_timeout_ms");
+    if (waitUntilTimeoutMs !== undefined && waitUntilTimeoutMs > 0)
+      opts.waitUntilTimeoutMs = waitUntilTimeoutMs;
+    const outboundHosts = getStringArray(t, "outbound_hosts");
+    if (outboundHosts !== undefined)
+      opts.outboundHosts = outboundHosts;
+    const secrets = getStringArray(t, "secrets");
+    if (secrets !== undefined)
+      opts.secrets = secrets;
+    const background = getBool(t, "background");
+    if (background !== undefined)
+      opts.background = background;
     out[name] = opts;
   }
   return out;
 }
 
 // src/runtime/node/load-functions.ts
-import { readdir as readdir2, readFile as readFile5, realpath, rm as rm4, stat } from "fs/promises";
-import { dirname as dirname4, join as join7 } from "path";
-import { pathToFileURL } from "url";
+import { readdir as readdir2, readFile as readFile6, realpath, rm as rm4, stat as stat2 } from "fs/promises";
+import { dirname as dirname5, join as join7 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
 
 // src/runtime/node/bundle-function.ts
 import { createHash as createHash3 } from "crypto";
-import { mkdir as mkdir4, readFile as readFile4, rm as rm3, writeFile as writeFile4 } from "fs/promises";
+import { mkdir as mkdir4, readFile as readFile5, rm as rm3, writeFile as writeFile4 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
 import { join as join6 } from "path";
@@ -12738,7 +13346,7 @@ async function fetchModule(url) {
   const key = createHash3("sha256").update(url).digest("hex");
   const cached = join6(HTTP_CACHE, key);
   if (existsSync3(cached))
-    return readFile4(cached, "utf8");
+    return readFile5(cached, "utf8");
   const res = await fetch(url, { redirect: "follow" });
   if (!res.ok)
     throw new Error(`failed to fetch ${url}: HTTP ${res.status}`);
@@ -12797,7 +13405,7 @@ async function bundleFunction(entryPath, name) {
 async function loadFunctionEnv(projectDir) {
   let text;
   try {
-    text = await readFile5(join7(projectDir, "supabase", "functions", ".env"), "utf8");
+    text = await readFile6(join7(projectDir, "supabase", "functions", ".env"), "utf8");
   } catch {
     return {};
   }
@@ -12859,12 +13467,12 @@ async function loadFunctionsUnlocked(projectDir, options) {
     if (options[name]?.enabled === false)
       continue;
     const dir = join7(root, name);
-    if (!(await stat(dir)).isDirectory())
+    if (!(await stat2(dir)).isDirectory())
       continue;
     const candidates = options[name]?.entrypoint ? [join7(projectDir, options[name].entrypoint)] : ["index.ts", "index.tsx", "index.js", "index.mjs"].map((f) => join7(dir, f));
     for (const path of candidates) {
       try {
-        await stat(path);
+        await stat2(path);
       } catch {
         continue;
       }
@@ -12873,11 +13481,11 @@ async function loadFunctionsUnlocked(projectDir, options) {
         let importUrl;
         try {
           bundledPath = await realpath(await bundleFunction(path, `${name}-${crypto.randomUUID()}`));
-          importUrl = pathToFileURL(bundledPath).href;
+          importUrl = pathToFileURL2(bundledPath).href;
         } catch (e) {
           if (e.message !== "esbuild-not-available")
             throw e;
-          importUrl = pathToFileURL(path).href;
+          importUrl = pathToFileURL2(path).href;
         }
         resetCapturedHandler();
         const mod = await import(importUrl);
@@ -12885,9 +13493,23 @@ async function loadFunctionsUnlocked(projectDir, options) {
         const defaultExport = mod.default;
         const handler = typeof defaultExport === "function" ? defaultExport : defaultExport && (typeof defaultExport.handle === "function" || typeof defaultExport.fetch === "function") ? defaultExport : denoHandler ? (req) => denoHandler(req) : undefined;
         if (handler) {
+          const opts = options[name];
+          const limits = opts && (opts.timeoutMs !== undefined || opts.maxRequestBodyBytes !== undefined || opts.maxResponseBodyBytes !== undefined || opts.waitUntilTimeoutMs !== undefined) ? {
+            ...opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {},
+            ...opts.maxRequestBodyBytes !== undefined ? { maxRequestBodyBytes: opts.maxRequestBodyBytes } : {},
+            ...opts.maxResponseBodyBytes !== undefined ? { maxResponseBodyBytes: opts.maxResponseBodyBytes } : {},
+            ...opts.waitUntilTimeoutMs !== undefined ? { waitUntilTimeoutMs: opts.waitUntilTimeoutMs } : {}
+          } : undefined;
+          const capabilities = opts && (opts.outboundHosts !== undefined || opts.secrets !== undefined || opts.background !== undefined) ? {
+            ...opts.outboundHosts !== undefined ? { outboundHosts: opts.outboundHosts } : {},
+            ...opts.secrets !== undefined ? { secrets: opts.secrets } : {},
+            ...opts.background !== undefined ? { background: opts.background } : {}
+          } : undefined;
           functions.set(name, {
             handler,
-            framework: resolveFramework(name, options[name]?.framework)
+            framework: resolveFramework(name, opts?.framework),
+            ...limits ? { limits } : {},
+            ...capabilities ? { capabilities } : {}
           });
         } else {
           console.warn(`  warning: function "${name}" has no default function, handle/fetch object, or Deno.serve() handler, skipped`);
@@ -12901,7 +13523,7 @@ async function loadFunctionsUnlocked(projectDir, options) {
         }
       } finally {
         if (bundledPath)
-          await rm4(dirname4(bundledPath), { recursive: true, force: true }).catch(() => {});
+          await rm4(dirname5(bundledPath), { recursive: true, force: true }).catch(() => {});
       }
       break;
     }
@@ -13007,7 +13629,7 @@ class S3StorageDriver {
 var RESET_INITIALIZATION_ERROR = 'db reset requires initialized state; run "supacloud-lite migrate" first';
 var RESET_INVALID_SECRETS_ERROR = "db reset requires a valid project secrets marker; restore the state before retrying";
 function resolveProjectPaths(options = {}) {
-  const projectDir = resolve3(options.projectDir ?? process.cwd());
+  const projectDir = resolve4(options.projectDir ?? process.cwd());
   const stateDir = resolvePath(projectDir, options.stateDir ?? process.env.SUPACLOUD_LITE_STATE_DIR ?? ".supacloud-lite");
   const databaseEngine = resolveDatabaseEngine(options.engine, options.memory);
   const dataDir = options.memory ? undefined : resolvePath(projectDir, options.dataDir ?? process.env.SUPACLOUD_LITE_DATA_DIR ?? join8(stateDir, databaseEngine === "native" ? "pgdata" : "db"));
@@ -13022,7 +13644,7 @@ function resolveProjectPaths(options = {}) {
   };
 }
 async function assertResetPathsSafe(paths) {
-  const stateDir = resolve3(paths.stateDir);
+  const stateDir = resolve4(paths.stateDir);
   if (stateDir === parse(stateDir).root)
     throw new Error("refusing to use the filesystem root as the state directory");
   const stateInfo = await requiredResetEntry(stateDir);
@@ -13030,7 +13652,7 @@ async function assertResetPathsSafe(paths) {
     throw new Error(`refusing to reset through an invalid state directory: ${stateDir}`);
   }
   const canonicalStateDir = await realpath2(stateDir);
-  const secretsFile = resolve3(paths.secretsFile);
+  const secretsFile = resolve4(paths.secretsFile);
   if (secretsFile !== join8(stateDir, "secrets.json")) {
     throw new Error(`refusing to reset a state directory with an invalid secrets marker path: ${secretsFile}`);
   }
@@ -13044,7 +13666,7 @@ async function assertResetPathsSafe(paths) {
     ["storage", paths.storageDir]
   ];
   for (const [label, targetPath] of targets) {
-    const target2 = resolve3(targetPath);
+    const target2 = resolve4(targetPath);
     const relativePath = relative(stateDir, target2);
     if (!relativePath || relativePath.startsWith("..") || isAbsolute(relativePath)) {
       throw new Error(`refusing to reset ${label} path outside the state directory: ${target2}`);
@@ -13064,7 +13686,7 @@ async function requiredResetEntry(path) {
 async function assertResetSecretsValid(path) {
   let serializedSecrets;
   try {
-    serializedSecrets = await readFile6(path, "utf8");
+    serializedSecrets = await readFile7(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       throw new Error(RESET_INITIALIZATION_ERROR);
@@ -13087,13 +13709,13 @@ async function assertResetTargetCanonical(stateDir, canonicalStateDir, target2,
       if (error.code !== "ENOENT")
         throw error;
     }
-    const parent = dirname5(current);
+    const parent = dirname6(current);
     if (parent === current)
       throw new Error(`refusing to reset ${label} path outside the state directory: ${target2}`);
     current = parent;
   }
   const existingAncestor = await nearestExistingAncestor(target2);
-  const canonicalTarget = resolve3(await realpath2(existingAncestor), relative(existingAncestor, target2));
+  const canonicalTarget = resolve4(await realpath2(existingAncestor), relative(existingAncestor, target2));
   const canonicalRelative = relative(canonicalStateDir, canonicalTarget);
   if (!canonicalRelative || canonicalRelative.startsWith("..") || isAbsolute(canonicalRelative)) {
     throw new Error(`refusing to reset ${label} path outside the canonical state directory: ${target2}`);
@@ -13109,7 +13731,7 @@ async function nearestExistingAncestor(target2) {
       if (error.code !== "ENOENT")
         throw error;
     }
-    const parent = dirname5(current);
+    const parent = dirname6(current);
     if (parent === current)
       throw new Error(`unable to resolve an existing ancestor for ${target2}`);
     current = parent;
@@ -13124,7 +13746,7 @@ async function ensureProjectSecrets(paths) {
   await chmod(paths.stateDir, 448);
   let stored;
   try {
-    stored = validateSecrets(JSON.parse(await readFile6(paths.secretsFile, "utf8")));
+    stored = validateSecrets(JSON.parse(await readFile7(paths.secretsFile, "utf8")));
   } catch (error) {
     if (error.code !== "ENOENT")
       throw error;
@@ -13142,7 +13764,7 @@ async function ensureProjectSecrets(paths) {
     } catch (error2) {
       if (error2.code !== "EEXIST")
         throw error2;
-      stored = validateSecrets(JSON.parse(await readFile6(paths.secretsFile, "utf8")));
+      stored = validateSecrets(JSON.parse(await readFile7(paths.secretsFile, "utf8")));
     } finally {
       await unlink2(temporaryFile).catch((error2) => {
         if (error2.code !== "ENOENT")
@@ -13342,7 +13964,7 @@ async function startProjectServer(options = {}) {
 }
 async function loadWebhooks(projectDir) {
   try {
-    const parsed = JSON.parse(await readFile6(join8(projectDir, "supabase", "webhooks.json"), "utf8"));
+    const parsed = JSON.parse(await readFile7(join8(projectDir, "supabase", "webhooks.json"), "utf8"));
     return Array.isArray(parsed) ? parsed : [];
   } catch (error) {
     if (error.code === "ENOENT")
@@ -13351,7 +13973,7 @@ async function loadWebhooks(projectDir) {
   }
 }
 function resolvePath(projectDir, path) {
-  return isAbsolute(path) ? path : resolve3(projectDir, path);
+  return isAbsolute(path) ? path : resolve4(projectDir, path);
 }
 function randomHex(bytes) {
   const value = crypto.getRandomValues(new Uint8Array(bytes));
@@ -13396,8 +14018,8 @@ async function findEphemeralPort(host = "127.0.0.1") {
 }
 
 // src/snapshot.ts
-import { chmod as chmod2, copyFile, lstat as lstat2, mkdir as mkdir6, mkdtemp, readdir as readdir3, readFile as readFile7, rename as rename2, rm as rm5, writeFile as writeFile6 } from "fs/promises";
-import { dirname as dirname6, join as join9, parse as parse2, relative as relative2, resolve as resolve4, sep as sep2 } from "path";
+import { chmod as chmod2, copyFile, lstat as lstat2, mkdir as mkdir6, mkdtemp, readdir as readdir3, readFile as readFile8, rename as rename2, rm as rm5, writeFile as writeFile6 } from "fs/promises";
+import { dirname as dirname7, join as join9, parse as parse2, relative as relative2, resolve as resolve5, sep as sep2 } from "path";
 import { create as createTar, extract as extractTar2 } from "tar";
 var SNAPSHOT_FORMAT = "supacloud-lite-snapshot";
 var SNAPSHOT_VERSION = 1;
@@ -13421,11 +14043,11 @@ async function createSnapshot(options) {
       postgresMajor: await readPostgresMajor(paths.dataDir)
     } : {}
   };
-  const output = resolve4(options.output);
+  const output = resolve5(options.output);
   if (await existingInfo(output))
     throw new Error(`snapshot output already exists: ${output}`);
-  await mkdir6(dirname6(output), { recursive: true });
-  const stagingRoot = await mkdtemp(join9(dirname6(output), ".supacloud-lite-snapshot-"));
+  await mkdir6(dirname7(output), { recursive: true });
+  const stagingRoot = await mkdtemp(join9(dirname7(output), ".supacloud-lite-snapshot-"));
   try {
     await writeFile6(join9(stagingRoot, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `);
@@ -13454,7 +14076,7 @@ async function restoreSnapshot(options) {
   const paths = normalizePaths(options.paths);
   await assertSnapshotPaths(paths, { requireSecrets: false, allowMissingState: true });
   await assertNoDataDirectoryLock(paths);
-  const stagingRoot = await mkdtemp(join9(dirname6(paths.stateDir), ".supacloud-lite-restore-"));
+  const stagingRoot = await mkdtemp(join9(dirname7(paths.stateDir), ".supacloud-lite-restore-"));
   const payloadRoot = join9(stagingRoot, "payload");
   const rollbackId = crypto.randomUUID();
   const rollbackPaths = [];
@@ -13462,7 +14084,7 @@ async function restoreSnapshot(options) {
     await mkdir6(payloadRoot, { recursive: true });
     await extractTar2({
       cwd: payloadRoot,
-      file: resolve4(options.input),
+      file: resolve5(options.input),
       preserveOwner: false,
       preservePaths: false,
       strict: true,
@@ -13539,11 +14161,11 @@ async function restoreSnapshot(options) {
 function normalizePaths(paths) {
   return {
     ...paths,
-    projectDir: resolve4(paths.projectDir),
-    stateDir: resolve4(paths.stateDir),
-    dataDir: paths.dataDir ? resolve4(paths.dataDir) : undefined,
-    storageDir: resolve4(paths.storageDir),
-    secretsFile: resolve4(paths.secretsFile)
+    projectDir: resolve5(paths.projectDir),
+    stateDir: resolve5(paths.stateDir),
+    dataDir: paths.dataDir ? resolve5(paths.dataDir) : undefined,
+    storageDir: resolve5(paths.storageDir),
+    secretsFile: resolve5(paths.secretsFile)
   };
 }
 async function assertSnapshotPaths(paths, options = {}) {
@@ -13573,7 +14195,7 @@ async function assertSnapshotPaths(paths, options = {}) {
 async function assertDirectoryOrMissing(path) {
   if (!path)
     return;
-  if (resolve4(path) === parse2(resolve4(path)).root)
+  if (resolve5(path) === parse2(resolve5(path)).root)
     throw new Error(`snapshot path must not be the filesystem root: ${path}`);
   try {
     const info = await lstat2(path);
@@ -13627,13 +14249,13 @@ async function stageDirectory(root, destination) {
   await walk(root, destination);
 }
 async function stageFile(source, target2) {
-  await mkdir6(dirname6(target2), { recursive: true });
+  await mkdir6(dirname7(target2), { recursive: true });
   await copyFile(source, target2);
 }
 async function readManifest(payloadRoot) {
   let parsed;
   try {
-    parsed = JSON.parse(await readFile7(join9(payloadRoot, "manifest.json"), "utf8"));
+    parsed = JSON.parse(await readFile8(join9(payloadRoot, "manifest.json"), "utf8"));
   } catch (error) {
     throw new Error(`invalid snapshot manifest: ${error instanceof Error ? error.message : String(error)}`);
   }
@@ -13665,7 +14287,7 @@ async function readPostgresMajor(dataDir) {
   if (!dataDir)
     return;
   try {
-    return (await readFile7(join9(dataDir, "PG_VERSION"), "utf8")).trim();
+    return (await readFile8(join9(dataDir, "PG_VERSION"), "utf8")).trim();
   } catch (error) {
     if (error.code === "ENOENT")
       return;
@@ -13725,12 +14347,12 @@ async function applyDirectorySwap(source, target2, force, rollbackId, swaps) {
         throw new Error(`restore target is not empty: ${target2}; pass --force to replace it`);
       await rm5(target2, { recursive: true, force: true });
     } else {
-      swap.rollbackPath = join9(dirname6(target2), `.${target2.split(sep2).pop() ?? "state"}.restore-${rollbackId}`);
+      swap.rollbackPath = join9(dirname7(target2), `.${target2.split(sep2).pop() ?? "state"}.restore-${rollbackId}`);
       await rename2(target2, swap.rollbackPath);
     }
   }
   try {
-    await mkdir6(dirname6(target2), { recursive: true });
+    await mkdir6(dirname7(target2), { recursive: true });
     await rename2(source, target2);
     swaps.push(swap);
   } catch (error) {
@@ -13764,7 +14386,7 @@ async function copyEntry(source, target2) {
     for (const entry of await readdir3(source))
       await copyEntry(join9(source, entry), join9(target2, entry));
   } else if (info.isFile()) {
-    await mkdir6(dirname6(target2), { recursive: true });
+    await mkdir6(dirname7(target2), { recursive: true });
     await Bun.write(target2, Bun.file(source));
   } else
     throw new Error(`snapshot refuses unsupported filesystem entry: ${source}`);
@@ -13795,13 +14417,13 @@ async function assertNoSymlinks(root) {
   }
 }
 function isWithin(parent, child) {
-  const normalizedParent = resolve4(parent);
-  const normalizedChild = resolve4(child);
+  const normalizedParent = resolve5(parent);
+  const normalizedChild = resolve5(child);
   return normalizedChild !== normalizedParent && normalizedChild.startsWith(`${normalizedParent}${sep2}`);
 }
 function pathsOverlap(left, right) {
-  const normalizedLeft = resolve4(left);
-  const normalizedRight = resolve4(right);
+  const normalizedLeft = resolve5(left);
+  const normalizedRight = resolve5(right);
   return normalizedLeft === normalizedRight || isWithin(normalizedLeft, normalizedRight) || isWithin(normalizedRight, normalizedLeft);
 }
 
@@ -13850,13 +14472,13 @@ function parseArgs(argv) {
     else if (argument === "--site-url")
       options.siteUrl = next();
     else if (argument === "--project-dir" || argument === "--dir")
-      options.projectDir = resolve5(next());
+      options.projectDir = resolve6(next());
     else if (argument === "--state-dir")
-      options.stateDir = resolve5(next());
+      options.stateDir = resolve6(next());
     else if (argument === "--data-dir")
-      options.dataDir = resolve5(next());
+      options.dataDir = resolve6(next());
     else if (argument === "--storage-dir")
-      options.storageDir = resolve5(next());
+      options.storageDir = resolve6(next());
     else if (argument === "--storage-backend")
       options.storageBackend = next();
     else if (argument === "--s3-prefix")
@@ -13874,15 +14496,17 @@ function parseArgs(argv) {
     else if (argument === "--powersync-tables")
       options.powersyncPublicationTables = commaSeparated2(next());
     else if (argument === "--replication-tls-cert")
-      options.replicationTlsCertFile = resolve5(next());
+      options.replicationTlsCertFile = resolve6(next());
     else if (argument === "--replication-tls-key")
-      options.replicationTlsKeyFile = resolve5(next());
+      options.replicationTlsKeyFile = resolve6(next());
     else if (argument === "--memory")
       options.memory = true;
     else if (argument === "--output" || argument === "-o")
-      options.output = resolve5(next());
+      options.output = resolve6(next());
     else if (argument === "--file" || argument === "-f")
       options.diffFile = next();
+    else if (argument === "--module-file")
+      options.moduleFile = resolve6(next());
     else if (argument === "--service-role")
       options.serviceRole = true;
     else if (argument === "--force")
@@ -13950,7 +14574,7 @@ ${privilegedKey}
     try {
       const source = await generateTypes(project2.backend.db, "public");
       if (options.output) {
-        await mkdir7(dirname7(options.output), { recursive: true });
+        await mkdir7(dirname8(options.output), { recursive: true });
         await writeFile7(options.output, source);
         await writeStandardOutput(`Wrote ${options.output}
 `);
@@ -14069,7 +14693,7 @@ async function runDbCommand(options) {
     }
     return;
   }
-  const project = await loadSupabaseProject(resolve5(options.projectDir ?? process.cwd()));
+  const project = await loadSupabaseProject(resolve6(options.projectDir ?? process.cwd()));
   if (subcommand === "diff") {
     const liveEngine = paths.databaseEngine === "native" ? await createNativeEngine({
       dataDir: paths.dataDir,
@@ -14124,6 +14748,29 @@ async function runDbCommand(options) {
 `);
     return;
   }
+  if (subcommand === "check") {
+    const moduleFile = options.moduleFile ?? join10(paths.projectDir, "supabase", "db", "modules.ts");
+    const project2 = await createProjectBackend({
+      ...options,
+      applyMigrations: false,
+      includeFunctions: false,
+      includeWebhooks: false,
+      startRuntimeServices: false,
+      log: quietLog
+    });
+    try {
+      const executor = {
+        query: async (sql, params) => (await project2.backend.db.query(sql, params)).rows
+      };
+      const result = await checkDatabaseModules({ moduleFile, executor });
+      await writeStandardOutput(formatDatabaseModuleCheck(result));
+      if (!result.ok)
+        throw new Error("db check found error-level issues");
+    } finally {
+      await project2.backend.close();
+    }
+    return;
+  }
   throw new Error(`unknown db subcommand: ${subcommand ?? "(none)"}`);
 }
 async function runSnapshotCommand(options) {
@@ -14152,7 +14799,7 @@ async function runSnapshotCommand(options) {
     const rollbackLines = result.rollbackPaths.map((rollbackPath) => `Previous state retained at ${rollbackPath}`);
     const reconnectLine = result.manifest.storageBackend === "s3" ? ["Reconnect the original S3 bucket/prefix before starting Lite."] : [];
     await writeStandardOutput([
-      `Snapshot restored from ${resolve5(input)}`,
+      `Snapshot restored from ${resolve6(input)}`,
       ...rollbackLines,
       ...reconnectLine
     ].join(`
@@ -14249,6 +14896,7 @@ Commands:
   db reset              reset initialized database/storage and re-run migrations
   db diff               print schema changes outside migrations
   db pull [name]        write live schema changes as an applied migration
+  db check              reconcile database module manifests (@supacloud/db) against the live catalog
   snapshot create       create a compressed database/storage/secrets snapshot
   snapshot restore <f>  restore a snapshot into an empty target
   upgrade               snapshot first, then apply pending migrations
@@ -14281,6 +14929,7 @@ Options:
       --json              emit machine-readable doctor output
   -o, --output <p>        output file for gen types
   -f, --file <name>       migration suffix for db diff
+      --module-file <p>   database module manifest for db check (default supabase/db/modules.ts)
       --force             replace non-empty restore targets and retain rollback copies
 `);
 }