@supacloud/lite 0.13.0 → 0.14.0

package/dist/cli.js

@@ -9,7 +9,7 @@ import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.13.0",
+  version: "0.14.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -48,6 +48,8 @@ var package_default = {
     start: "bun run src/cli.ts start",
     test: "bun test --timeout 20000",
     "test:native": "SUPACLOUD_LITE_TEST_NATIVE=1 bun test test/native-engine.test.ts test/qauth-workflow-matrix.test.ts test/maker-checker-workflow.test.ts test/commands-artifacts.test.ts --timeout 180000",
+    "test:graphql": "SUPACLOUD_LITE_TEST_GRAPHQL=1 bun test test/graphql-native.test.ts --timeout 180000",
+    benchmark: "bun run scripts/benchmark.ts",
     parity: "bun run parity/harness.ts",
     "parity:native": "SUPACLOUD_LITE_TEST_NATIVE=1 bun run parity/harness.ts --engine native",
     "check:native": "bun run test:native && bun run parity:native",
@@ -59,13 +61,17 @@ var package_default = {
   },
   dependencies: {
     "@electric-sql/pglite": "0.5.8",
-    "@supacloud/db": "^0.2.0",
+    "@supacloud/db": "^0.6.0",
     tar: "^7.5.22"
   },
   devDependencies: {
+    "@supacloud/app": "^0.11.0",
+    "@supacloud/compiler": "^0.13.1",
+    "@supacloud/elysia": "^0.10.0",
     "@supabase/supabase-js": "^2.115.0",
     "@types/bun": "^1.4.0",
     elysia: "^1.4.30",
+    jose: "^6.2.11",
     typescript: "^7.0.2"
   },
   engines: {
@@ -2784,6 +2790,38 @@ async function upsertWithoutTtl(query, key, serializedValue) {
      on conflict (namespace, key) do update set value = excluded.value, expires_at = null, updated_at = now()`, [CACHE_NAMESPACE, key, serializedValue]);
 }
 
+// src/runtime/functions/profile.ts
+function runtimeMode(value) {
+  if (value === undefined)
+    return "development";
+  if (value !== "development" && value !== "strict")
+    throw new Error("Lite runtime mode must be development or strict");
+  return value;
+}
+function strictFunction(entry) {
+  const limits = {
+    timeoutMs: 900000,
+    maxRequestBodyBytes: 30 * 1024 * 1024,
+    maxResponseBodyBytes: 30 * 1024 * 1024,
+    waitUntilTimeoutMs: 300000,
+    ...entry.limits
+  };
+  for (const [name, value] of Object.entries(limits)) {
+    const maximum = name.includes("Body") ? 30 * 1024 * 1024 : name === "waitUntilTimeoutMs" ? 300000 : 900000;
+    if (!Number.isSafeInteger(value) || value <= 0 || value > maximum) {
+      throw new Error(`invalid strict function limit: ${name}`);
+    }
+  }
+  if (entry.framework !== undefined && !["fetch", "elysia", "hono"].includes(entry.framework)) {
+    throw new Error("invalid strict function framework");
+  }
+  return {
+    ...entry,
+    limits,
+    capabilities: { background: false, ...entry.capabilities }
+  };
+}
+
 // src/runtime/functions/handler.ts
 var VERIFIED_JWT_SUBJECT_HEADER = "x-supacloud-jwt-sub";
 var UNSAFE_VERIFIED_JWT_SUBJECT = /[\u0000-\u001F\u007F-\u009F\u0100-\u{10FFFF}]/u;
@@ -2834,12 +2872,19 @@ class FunctionsHandler {
   functions;
   env;
   pgredis;
-  constructor(functions, env, pgredis) {
+  mode;
+  constructor(functions, env, pgredis, mode = "development") {
     this.functions = functions;
     this.env = env;
     this.pgredis = pgredis;
+    this.mode = mode;
+    if (mode === "strict")
+      for (const entry of functions.values())
+        strictFunction(normalizeEntry(entry));
   }
   register(name, fn) {
+    if (this.mode === "strict")
+      strictFunction(normalizeEntry(fn));
     this.functions.set(name, fn);
   }
   list() {
@@ -2854,7 +2899,7 @@ class FunctionsHandler {
     if (!value) {
       return json2(404, { error: `function "${name}" not found` });
     }
-    const entry = normalizeEntry(value);
+    const entry = this.mode === "strict" ? strictFunction(normalizeEntry(value)) : normalizeEntry(value);
     const limits = entry.limits;
     const capabilities = entry.capabilities;
     const maxBody = limits?.maxRequestBodyBytes;
@@ -3224,14 +3269,17 @@ alter role anon set search_path to "$user", public, extensions;
 alter role authenticated set search_path to "$user", public, extensions;
 alter role service_role set search_path to "$user", public, extensions;
 
-grant usage on schema public to anon, authenticated, service_role;
-grant all on all tables in schema public to anon, authenticated, service_role;
-grant all on all sequences in schema public to anon, authenticated, service_role;
-
-alter default privileges in schema public
-  grant all on tables to anon, authenticated, service_role;
-alter default privileges in schema public
-  grant all on sequences to anon, authenticated, service_role;
+-- Initialize defaults once. Restart/maintenance must not undo application ACLs.
+do $$
+begin
+  if to_regclass('supabase_migrations.schema_migrations') is null then
+    grant usage on schema public to anon, authenticated, service_role;
+    alter default privileges in schema public
+      grant all on tables to anon, authenticated, service_role;
+    alter default privileges in schema public
+      grant all on sequences to anon, authenticated, service_role;
+  end if;
+end $$;
 
 -- PostgreSQL already grants EXECUTE on new functions to PUBLIC. Keep that
 -- default so project migrations can revoke PUBLIC and grant only selected
@@ -5691,7 +5739,9 @@ grant execute on function vault.create_secret(text,text,text,uuid), vault.update
 `;
 
 // src/runtime/db/sql-compat.ts
-function rewriteMigrationSql(sql) {
+function rewriteMigrationSql(sql, strict = false) {
+  if (strict)
+    return sql;
   const out = [];
   const n = sql.length;
   let i = 0;
@@ -5765,6 +5815,8 @@ function rewriteStatement(stmt) {
   const trivia = LEADING_TRIVIA.exec(stmt)?.[0] ?? "";
   const rest = stmt.slice(trivia.length);
   if (/^(?:create|drop)\s+extension\b/i.test(rest)) {
+    if (extensionName(rest) === "pg_graphql")
+      return stmt;
     const semi = rest.lastIndexOf(";");
     const bare = (semi !== -1 && rest.slice(semi + 1).trim() === "" ? rest.slice(0, semi) : rest).trim();
     if (!bare)
@@ -5778,6 +5830,26 @@ function rewriteStatement(stmt) {
   }
   return stmt;
 }
+function extensionName(statement) {
+  let rest = statement;
+  const tokens = [];
+  while (tokens.length < 6) {
+    rest = rest.slice(LEADING_TRIVIA.exec(rest)?.[0].length ?? 0);
+    const token = /^(?:"((?:""|[^"])*)"|([A-Za-z_][A-Za-z_0-9]*))/.exec(rest);
+    if (!token)
+      break;
+    const quoted = token[1];
+    const bare = token[2];
+    if (quoted !== undefined)
+      tokens.push(quoted.replaceAll('""', '"'));
+    else if (bare !== undefined)
+      tokens.push(bare.toLowerCase());
+    else
+      throw new Error("invalid migration SQL token");
+    rest = rest.slice(token[0].length);
+  }
+  return tokens[2] === "if" ? tokens[tokens[3] === "not" ? 5 : 4] : tokens[2];
+}
 function pickTag(text, base) {
   let tag = `$${base}$`;
   let k = 0;
@@ -6051,19 +6123,51 @@ async function removePreparedBundles(cleanup) {
   }
 }
 
+// src/runtime/db/engine.ts
+class Mutex {
+  tail = Promise.resolve();
+  async lock() {
+    let release;
+    const next = new Promise((r) => release = r);
+    const prev = this.tail;
+    this.tail = this.tail.then(() => next);
+    await prev;
+    return release;
+  }
+  async run(fn) {
+    const release = await this.lock();
+    try {
+      return await fn();
+    } finally {
+      release();
+    }
+  }
+}
+
+// src/runtime/validation.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function errorProperty(error, key) {
+  return isRecord(error) ? error[key] : undefined;
+}
+
 // src/runtime/db/database.ts
 var DEFAULT_SEARCH_PATH_SQL = `set search_path to "$user", public, extensions`;
 
 class Database {
   engine;
+  strict;
+  migrationMutex = new Mutex;
   schemaCache = new Map;
   fnCache = new Map;
   cdcListeners = new Set;
   cdcStarting = null;
   cdcStopping = null;
   cdcUnsubscribe = null;
-  constructor(engine) {
+  constructor(engine, strict = false) {
     this.engine = engine;
+    this.strict = strict;
   }
   static async create(dataDirOrEngine, opts) {
     const engine = dataDirOrEngine && typeof dataDirOrEngine === "object" ? dataDirOrEngine : await createPgliteEngine(dataDirOrEngine);
@@ -6082,7 +6186,7 @@ class Database {
           await engine.query(`select set_config('app.settings.vault_key', $1, false)`, [opts.vaultKey]);
         }
       }
-      return new Database(engine);
+      return new Database(engine, opts?.strict);
     } catch (error) {
       try {
         await engine.close();
@@ -6109,16 +6213,48 @@ class Database {
     });
   }
   async runMigrations(migrations, seedSql) {
+    return this.migrationMutex.run(() => this.applyMigrations(migrations, seedSql));
+  }
+  async applyMigrations(migrations, seedSql) {
     const applied = [];
     const sorted = [...migrations].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    const versions = new Set;
+    const history = await this.engine.query("select version, statements from supabase_migrations.schema_migrations");
+    const recorded = new Map;
+    for (const row of history.rows) {
+      if (!isRecord(row) || typeof row["version"] !== "string")
+        throw new Error("invalid migration history record");
+      const statements = row["statements"];
+      if (statements !== null && (!Array.isArray(statements) || !statements.every((sql) => typeof sql === "string"))) {
+        throw new Error(`invalid migration history SQL: ${row["version"]}`);
+      }
+      recorded.set(row["version"], statements);
+    }
+    for (const migration of sorted) {
+      const version = migration.name.match(/^(\d+)/)?.[1] ?? migration.name;
+      if (versions.has(version))
+        throw new Error(`duplicate migration version: ${version}`);
+      versions.add(version);
+    }
+    for (const migration of sorted) {
+      const version = migration.name.match(/^(\d+)/)?.[1] ?? migration.name;
+      if (recorded.has(version)) {
+        const statements = recorded.get(version);
+        if (!statements?.length)
+          throw new Error(`migration history has no verifiable SQL: ${version}`);
+        if (statements.join(`
+`) !== migration.sql) {
+          throw new Error(`applied migration content mismatch: ${version}; add a forward migration instead`);
+        }
+      }
+    }
     for (const m of sorted) {
       const version = m.name.match(/^(\d+)/)?.[1] ?? m.name;
-      const seen = await this.engine.query(`select 1 from supabase_migrations.schema_migrations where version = $1`, [version]);
-      if (seen.rows.length > 0)
+      if (recorded.has(version))
         continue;
       const applyMigration = () => this.engine.transaction(async (tx) => {
         await tx.exec(DEFAULT_SEARCH_PATH_SQL);
-        await tx.exec(rewriteMigrationSql(m.sql));
+        await tx.exec(rewriteMigrationSql(m.sql, this.strict));
         await tx.query(`insert into supabase_migrations.schema_migrations (version, name, statements)
              values ($1, $2, $3)`, [version, m.name, [m.sql]]);
       });
@@ -6140,7 +6276,7 @@ class Database {
       if (seen.rows.length === 0) {
         await this.engine.transaction(async (tx) => {
           await tx.exec(DEFAULT_SEARCH_PATH_SQL);
-          await tx.exec(rewriteMigrationSql(seedSql));
+          await tx.exec(rewriteMigrationSql(seedSql, this.strict));
           await tx.query(`insert into supabase_migrations.seed_files (path, hash) values ('supabase/seed.sql', $1)
              on conflict (path) do update set hash = excluded.hash, applied_at = now()`, [hash]);
         });
@@ -6437,19 +6573,23 @@ async function sha256Hex2(text) {
 class RealtimeEngine {
   db;
   jwtSecret;
+  resolveExternalToken;
   connections = new Set;
   bindingCounter = 1;
   phxRefCounter = 1;
   presence = new Map;
   stopCdc = null;
   stopDbBroadcast = null;
-  constructor(db, jwtSecret) {
+  constructor(db, jwtSecret, resolveExternalToken) {
     this.db = db;
     this.jwtSecret = jwtSecret;
+    this.resolveExternalToken = resolveExternalToken;
   }
   async contextFromToken(token) {
     if (!token || !this.jwtSecret)
       return { role: "anon", claims: null };
+    if (this.resolveExternalToken)
+      return this.resolveExternalToken(token);
     const claims = await verifyJwt(token, this.jwtSecret);
     if (!claims)
       return { role: "anon", claims: null };
@@ -6509,8 +6649,11 @@ class RealtimeEngine {
     const stopDbBroadcast = this.stopDbBroadcast;
     this.stopCdc = null;
     this.stopDbBroadcast = null;
-    for (const conn of this.connections)
+    for (const conn of this.connections) {
+      for (const topic of conn.channels.keys())
+        this.leaveChannel(conn, topic);
       conn.socket.close(1001, "server shutting down");
+    }
     this.connections.clear();
     const [cdcStop, broadcastStop] = await Promise.allSettled([
       Promise.resolve().then(() => stopCdc?.()),
@@ -6588,13 +6731,29 @@ class RealtimeEngine {
           break;
         case "access_token":
           {
-            const ctx = await this.contextFromToken(msg.payload?.access_token);
-            const channel = conn.channels.get(msg.topic);
-            if (channel)
-              channel.ctx = ctx;
-            else
-              for (const c of conn.channels.values())
-                c.ctx = ctx;
+            const selected = conn.channels.get(msg.topic);
+            const channels = selected ? [selected] : [...conn.channels.values()];
+            try {
+              const token = msg.payload?.access_token;
+              if (token !== undefined && typeof token !== "string")
+                throw new Error("Invalid Realtime access token");
+              const ctx = await this.contextFromToken(token);
+              for (const channel of channels) {
+                if (this.resolveExternalToken && channel.private) {
+                  const access = await this.authorizePrivate(channel.topic.replace(/^realtime:/, ""), ctx);
+                  if (!access.read)
+                    throw new Error("Realtime authentication denied");
+                  channel.canBroadcast = access.write;
+                }
+                channel.ctx = ctx;
+                this.scheduleExternalExpiry(conn, channel);
+              }
+            } catch (error) {
+              if (this.resolveExternalToken)
+                for (const channel of channels)
+                  this.leaveChannel(conn, channel.topic);
+              throw error;
+            }
           }
           break;
         default:
@@ -6606,7 +6765,10 @@ class RealtimeEngine {
   }
   async handleJoin(conn, msg) {
     const config = msg.payload?.config ?? {};
-    const ctx = await this.contextFromToken(msg.payload?.access_token);
+    const token = msg.payload?.access_token;
+    if (token !== undefined && typeof token !== "string")
+      throw new Error("Invalid Realtime access token");
+    const ctx = await this.contextFromToken(token);
     const isPrivate = config.private === true;
     let canBroadcast = true;
     if (isPrivate && !this.db.engine.minimalBootstrap) {
@@ -6658,7 +6820,10 @@ class RealtimeEngine {
       private: isPrivate,
       canBroadcast
     };
+    if (this.resolveExternalToken)
+      this.leaveChannel(conn, msg.topic);
     conn.channels.set(msg.topic, channel);
+    this.scheduleExternalExpiry(conn, channel);
     this.reply(conn, msg, "ok", {
       postgres_changes: bindings.map((b) => ({
         id: b.id,
@@ -6693,6 +6858,8 @@ class RealtimeEngine {
     const channel = conn.channels.get(topic);
     if (!channel)
       return;
+    if (channel.expiryTimer)
+      clearTimeout(channel.expiryTimer);
     conn.channels.delete(topic);
     const state = this.presence.get(topic);
     if (state?.has(channel.presenceKey)) {
@@ -6708,6 +6875,20 @@ class RealtimeEngine {
       });
     }
   }
+  scheduleExternalExpiry(conn, channel) {
+    if (channel.expiryTimer)
+      clearTimeout(channel.expiryTimer);
+    const expires = channel.ctx.claims?.exp;
+    if (!this.resolveExternalToken || typeof expires !== "number")
+      return;
+    channel.expiryTimer = setTimeout(() => {
+      if (expires * 1000 > Date.now())
+        return this.scheduleExternalExpiry(conn, channel);
+      this.leaveChannel(conn, channel.topic);
+      this.send(conn, { topic: channel.topic, event: "phx_error", payload: { reason: "token expired" }, ref: null });
+    }, Math.max(0, Math.min(expires * 1000 - Date.now(), 2147483647)));
+    channel.expiryTimer.unref?.();
+  }
   handleBinary(conn, bytes) {
     if (bytes.length < 7 || bytes[0] !== 3)
       return;
@@ -10245,6 +10426,168 @@ function assertSecretsSafe(input) {
     warn("\u26A0 Vault key derived from the JWT secret - set an independent vaultKey before exposing this server.");
   }
 }
+
+// src/runtime/graphql.ts
+async function inspectGraphql(engine) {
+  const result = await engine.query(`
+    select e.extversion, exists (
+      select 1 from pg_proc p
+      join pg_namespace n on n.oid = p.pronamespace
+      join pg_depend d on d.classid = 'pg_proc'::regclass and d.objid = p.oid
+        and d.refclassid = 'pg_extension'::regclass and d.refobjid = e.oid and d.deptype = 'e'
+      where n.nspname = 'graphql' and p.proname = 'resolve' and not p.prosecdef
+        and p.oid = to_regprocedure('graphql.resolve(text,jsonb,text,jsonb)')
+    ) as resolver from pg_extension e where e.extname = 'pg_graphql'
+  `);
+  const row = result.rows[0];
+  if (row === undefined) {
+    return { status: "unsupported", extension: "pg_graphql", reason: "PG_GRAPHQL_NOT_INSTALLED" };
+  }
+  if (!isRecord(row) || typeof row["extversion"] !== "string" || !row["extversion"] || typeof row["resolver"] !== "boolean" || result.rows.length !== 1) {
+    return { status: "unsupported", extension: "pg_graphql", reason: "PG_GRAPHQL_INVALID_CATALOG" };
+  }
+  const version = row["extversion"];
+  if (row["resolver"]) {
+    try {
+      const probe = await engine.query(`select graphql.resolve('{ __typename }', '{}'::jsonb, null, '{}'::jsonb) as result`);
+      const probeRow = probe.rows[0];
+      if (probe.rows.length !== 1 || !isRecord(probeRow) || !isGraphqlEnvelope(probeRow["result"])) {
+        throw new Error("Invalid GraphQL probe response");
+      }
+    } catch {
+      return { status: "unsupported", extension: "pg_graphql", version, reason: "PG_GRAPHQL_RESOLVER_FAILED" };
+    }
+  }
+  return row["resolver"] ? { status: "supported", extension: "pg_graphql", version } : {
+    status: "unsupported",
+    extension: "pg_graphql",
+    reason: "PG_GRAPHQL_RESOLVER_UNAVAILABLE"
+  };
+}
+
+class GraphqlHandler {
+  db;
+  capability;
+  schemas;
+  maxBytes;
+  timeoutMs;
+  constructor(db, capability, options = {}, schemas = ["public"]) {
+    this.db = db;
+    this.capability = capability;
+    this.schemas = schemas;
+    this.maxBytes = positive(options.maxRequestBodyBytes ?? 1024 * 1024);
+    this.timeoutMs = positive(options.statementTimeoutMs ?? 30000);
+  }
+  async handle(request, context) {
+    if (this.capability.status !== "supported") {
+      return response(this.capability.status === "disabled" ? 404 : 501, {
+        errors: [{
+          message: "GraphQL requires the real pg_graphql extension and graphql.resolve.",
+          extensions: { code: this.capability.reason ?? "GRAPHQL_DISABLED" }
+        }]
+      });
+    }
+    if (request.method !== "POST")
+      return response(405, { errors: [{ message: "Use POST for GraphQL requests." }] }, { allow: "POST" });
+    try {
+      if (request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json") {
+        throw new ApiError(415, { message: "GraphQL requests require application/json" });
+      }
+      const body = JSON.parse(await boundedBody(request, this.maxBytes));
+      if (!isObject(body) || typeof body.query !== "string" || !body.query.trim() || body.variables != null && !isObject(body.variables) || body.extensions != null && !isObject(body.extensions) || body.operationName != null && typeof body.operationName !== "string") {
+        throw new ApiError(400, { message: "Invalid GraphQL request" });
+      }
+      const result = await this.db.withContext(context, async (query) => {
+        await query(`select set_config('statement_timeout', $1, true)`, [String(this.timeoutMs)]);
+        await query(`select set_config('search_path', $1, true)`, [
+          this.schemas.map((schema) => `"${schema.replaceAll('"', '""')}"`).join(",")
+        ]);
+        return query("select graphql.resolve($1::text, $2::jsonb, $3::text, $4::jsonb) as result", [body.query, JSON.stringify(body.variables ?? {}), body.operationName ?? null, JSON.stringify(body.extensions ?? {})]);
+      });
+      const row = result.rows[0];
+      if (result.rows.length !== 1 || !isRecord(row) || !isGraphqlEnvelope(row["result"])) {
+        throw new Error("Invalid GraphQL resolver response");
+      }
+      return response(200, row["result"]);
+    } catch (error) {
+      if (error instanceof ApiError)
+        return response(error.status, { errors: [{ message: error.message }] });
+      if (error instanceof SyntaxError)
+        return response(400, { errors: [{ message: "Invalid JSON request" }] });
+      const code = errorProperty(error, "errno") ?? errorProperty(error, "code");
+      const status = code === "42501" ? 403 : code === "57014" ? 504 : 500;
+      return response(status, { errors: [{
+        message: "GraphQL execution failed",
+        extensions: { code: status === 403 ? "GRAPHQL_ACCESS_DENIED" : status === 504 ? "GRAPHQL_TIMEOUT" : "GRAPHQL_EXECUTION_FAILED" }
+      }] });
+    }
+  }
+}
+async function boundedBody(request, limit) {
+  if (Number(request.headers.get("content-length")) > limit)
+    throw new ApiError(413, { message: "GraphQL request too large" });
+  const reader = request.body?.getReader();
+  if (!reader)
+    throw new ApiError(400, { message: "GraphQL request body required" });
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done)
+        break;
+      size += chunk.value.byteLength;
+      if (size > limit) {
+        await reader.cancel().catch(() => {});
+        throw new ApiError(413, { message: "GraphQL request too large" });
+      }
+      chunks.push(chunk.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isGraphqlEnvelope(value) {
+  if (!isRecord(value) || !("data" in value) && !("errors" in value))
+    return false;
+  if ("data" in value && value["data"] !== null && !isRecord(value["data"]))
+    return false;
+  if ("extensions" in value && !isRecord(value["extensions"]))
+    return false;
+  if ("errors" in value) {
+    const errors = value["errors"];
+    if (!Array.isArray(errors) || errors.length === 0 || !errors.every((error) => isRecord(error) && typeof error["message"] === "string"))
+      return false;
+  }
+  return true;
+}
+function positive(value) {
+  if (!Number.isSafeInteger(value) || value <= 0 || value > 2147483647)
+    throw new Error("GraphQL limits must be positive bounded integers");
+  return value;
+}
+function response(status, body, headers = {}) {
+  return Response.json(body, { status, headers: { "cache-control": "no-store", ...headers } });
+}
+
+// src/runtime/identity.ts
+function validateExternalIdentityClaims(value) {
+  if (!isRecord(value) || value["role"] !== "authenticated" || typeof value["sub"] !== "string" || !value["sub"] || typeof value["exp"] !== "number" || !Number.isSafeInteger(value["exp"]) || value["exp"] * 1000 <= Date.now()) {
+    throw new ApiError(401, { message: "Invalid external identity" });
+  }
+  for (const key of ["iss", "aud", "email"]) {
+    if (key in value && typeof value[key] !== "string")
+      throw new ApiError(401, { message: "Invalid external identity" });
+  }
+  if ("iat" in value && (typeof value["iat"] !== "number" || !Number.isSafeInteger(value["iat"])) || "aal" in value && value["aal"] !== "aal1" && value["aal"] !== "aal2" || "amr" in value && (!Array.isArray(value["amr"]) || !value["amr"].every((entry) => isRecord(entry) && typeof entry["method"] === "string" && typeof entry["timestamp"] === "number" && Number.isFinite(entry["timestamp"])))) {
+    throw new ApiError(401, { message: "Invalid external identity" });
+  }
+  return value;
+}
 // src/runtime/gen-types.ts
 var JSON_TYPE = "Json";
 async function generateTypes(db, schema = "public") {
@@ -10657,6 +11000,7 @@ var CORS_HEADERS = {
   "access-control-max-age": "86400"
 };
 async function createBackend(config = {}) {
+  const mode = runtimeMode(config.runtimeMode);
   const jwtSecret = config.jwtSecret ?? randomSecret();
   const apiUrl = config.apiUrl ?? "http://localhost:54321";
   const siteUrl = config.siteUrl ?? apiUrl;
@@ -10671,7 +11015,7 @@ async function createBackend(config = {}) {
   const vaultKey = config.vaultKey ?? `supacloud-lite-vault:${jwtSecret}`;
   assertSecretsSafe({ host: config.host, jwtSecret, vaultKeyDerived, warn: log });
   const engine = config.engine;
-  const db = await Database.create(engine ?? config.dataDir, { vaultKey });
+  const db = await Database.create(engine ?? config.dataDir, { vaultKey, strict: mode === "strict" });
   const cleanup = [];
   const failStartup = async (e) => {
     for (const fn of cleanup.reverse())
@@ -10688,6 +11032,11 @@ async function createBackend(config = {}) {
   } catch (e) {
     await failStartup(e);
   }
+  const graphqlCapability = config.graphql?.enabled === false ? { status: "disabled", extension: "pg_graphql" } : await inspectGraphql(db.engine).catch(failStartup);
+  if (config.graphql?.enabled === true && graphqlCapability.status !== "supported") {
+    await failStartup(new Error(`${graphqlCapability.reason}: GraphQL requires an installed pg_graphql extension with graphql.resolve; PGlite and stock native binaries do not bundle it`));
+  }
+  const graphql = await Promise.resolve().then(() => new GraphqlHandler(db, graphqlCapability, config.graphql, config.dbSchemas)).catch(failStartup);
   const pgredis = await PgredisCache.create(db).catch(failStartup);
   const { anonKey, serviceRoleKey } = await mintProjectApiKeys(jwtSecret);
   const exposedSchemas = [...new Set(config.dbSchemas ?? ["public", "pgmq_public"])];
@@ -10728,7 +11077,13 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     rateLimiter: new RateLimiter(config.authRateLimits)
   });
   cleanup.push(() => auth.stop());
-  const realtime = new RealtimeEngine(db, jwtSecret);
+  const realtime = new RealtimeEngine(db, jwtSecret, config.externalIdentity ? async (token) => {
+    const request = new Request(`${apiUrl}/realtime/v1`, { headers: { authorization: `Bearer ${token}` } });
+    const context = await resolveContext(request, new URL(request.url));
+    if (context instanceof Response)
+      throw new Error("Realtime authentication denied");
+    return context;
+  } : undefined);
   const webhooks = new WebhooksService(db, config.webhookFetch, (d) => log(`[webhook] ${d.event.type} ${d.event.schema}.${d.event.table} -> ${d.webhook.url} ${d.ok ? d.status : "FAILED " + (d.error ?? "")}`), isNetworkExposed(config.host));
   const cron = new CronService(db);
   const retention = new RetentionService(db, config.retention);
@@ -10763,7 +11118,7 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
   } catch (error) {
     await failStartup(error);
   }
-  const functions = new FunctionsHandler(fnMap, fnEnv, pgredis);
+  const functions = await Promise.resolve().then(() => new FunctionsHandler(fnMap, fnEnv, pgredis, mode)).catch(failStartup);
   async function resolveContext(req, url) {
     const authz = req.headers.get("authorization");
     const bearer = authz?.toLowerCase().startsWith("bearer ") ? authz.slice(7) : null;
@@ -10774,7 +11129,15 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
         headers: { "content-type": "application/json" }
       }));
     }
-    const claims = await verifyJwt(token, jwtSecret);
+    let claims = await verifyJwt(token, jwtSecret);
+    if (config.externalIdentity && token !== anonKey && token !== serviceRoleKey) {
+      try {
+        claims = validateExternalIdentityClaims(await config.externalIdentity(req));
+      } catch (error) {
+        const status = error instanceof ApiError && [401, 403, 503].includes(error.status) ? error.status : 503;
+        return withCors(Response.json({ message: status === 503 ? "Identity verification unavailable" : "External access denied" }, { status }));
+      }
+    }
     if (!claims) {
       return withCors(new Response(JSON.stringify({ message: "Invalid API key" }), {
         status: 401,
@@ -10816,7 +11179,7 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
         return withCors(await storage.handle(req, { role: "anon", claims: null }, url));
       }
     }
-    if (config.authEnabled === false && path.startsWith("/auth/v1")) {
+    if ((config.authEnabled === false || config.externalIdentity) && path.startsWith("/auth/v1")) {
       return withCors(new Response(JSON.stringify({ message: "Auth service is disabled" }), {
         status: 404,
         headers: { "content-type": "application/json" }
@@ -10848,6 +11211,8 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
       return ctx;
     if (path.startsWith("/rest/v1"))
       return withCors(await rest.handle(req, ctx, url));
+    if (path === "/graphql/v1" || path === "/graphql/v1/")
+      return withCors(await graphql.handle(req, ctx));
     if (path.startsWith("/functions/v1"))
       return withCors(await functions.handle(req, ctx, url));
     if (path.startsWith("/storage/v1"))
@@ -10892,6 +11257,7 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     return loggedFetch(request);
   }, { preconnect: fetch.preconnect });
   return {
+    graphql: graphqlCapability,
     fetch: publicFetch,
     db,
     realtime,
@@ -10906,7 +11272,16 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     logs,
     inbox,
     smsInbox,
-    migrate: (migrations, seedSql) => db.runMigrations(migrations, seedSql),
+    migrate: async (migrations, seedSql) => {
+      const applied = await db.runMigrations(migrations, seedSql);
+      if (config.graphql?.enabled !== false) {
+        const capability = await inspectGraphql(db.engine);
+        delete graphqlCapability.version;
+        delete graphqlCapability.reason;
+        Object.assign(graphqlCapability, capability);
+      }
+      return applied;
+    },
     close: () => {
       closePromise ??= (async () => {
         let firstError;
@@ -11233,12 +11608,19 @@ class PgWireClient {
   onNotification = null;
   static async connect(opts) {
     const client = new PgWireClient;
-    await client.open(opts);
+    try {
+      await client.open(opts);
+    } catch (error) {
+      client.socket.destroy();
+      throw error;
+    }
     return client;
   }
   open(opts) {
     return new Promise((resolve3, reject) => {
+      let startupComplete = false;
       this.socket = opts.socketPath ? createConnection(opts.socketPath) : createConnection(opts.port ?? 5432, opts.host ?? "127.0.0.1");
+      this.socket.setTimeout(1e4, () => this.socket.destroy(new Error("PostgreSQL handshake timed out")));
       this.socket.on("error", (e) => {
         if (this.pending)
           this.pending.reject(e);
@@ -11247,6 +11629,8 @@ class PgWireClient {
       this.socket.on("close", () => {
         this.closed = true;
         this.pending?.reject(new Error("connection closed"));
+        if (!startupComplete)
+          reject(new Error("connection closed during PostgreSQL handshake"));
       });
       this.socket.on("connect", () => {
         const params = `user\x00${opts.user}\x00database\x00${opts.database}\x00client_encoding\x00UTF8\x00\x00`;
@@ -11330,6 +11714,8 @@ class PgWireClient {
             reject(new PgWireError(parseErrorFields(payload)));
             return;
           } else if (type === 90) {
+            startupComplete = true;
+            this.socket.setTimeout(0);
             this.socket.off("data", startupHandler);
             this.socket.on("data", (c) => {
               this.buffer = Buffer.concat([this.buffer, c]);
@@ -11607,27 +11993,6 @@ function parsePgArray(text) {
   return out;
 }
 
-// src/runtime/db/engine.ts
-class Mutex {
-  tail = Promise.resolve();
-  async lock() {
-    let release;
-    const next = new Promise((r) => release = r);
-    const prev = this.tail;
-    this.tail = this.tail.then(() => next);
-    await prev;
-    return release;
-  }
-  async run(fn) {
-    const release = await this.lock();
-    try {
-      return await fn();
-    } finally {
-      release();
-    }
-  }
-}
-
 // src/runtime/node/native/wire-engine.ts
 async function buildWireEngine(options) {
   const queryClient = await options.connect();
@@ -11666,9 +12031,9 @@ async function buildWireEngine(options) {
       return queryMutex.run(async () => {
         await queryClient.exec("begin");
         try {
-          const response = await callback(transactionClient);
+          const response2 = await callback(transactionClient);
           await queryClient.exec("commit");
-          return response;
+          return response2;
         } catch (error) {
           await queryClient.exec("rollback").catch(() => {});
           throw error;
@@ -11740,6 +12105,14 @@ function toPgArrayLiteral(array) {
 var DEFAULT_PG_VERSION = "17.7.0";
 var POSTGRES_MIRROR_URL_ERROR = "SUPACLOUD_LITE_POSTGRES_MIRROR must be an absolute HTTPS URL or a loopback HTTP URL";
 var NATIVE_POSTGRES_MAJOR = DEFAULT_PG_VERSION.split(".")[0];
+function nativePostgresMajor(installDir = process.env.SUPACLOUD_LITE_POSTGRES_DIR) {
+  if (!installDir)
+    return NATIVE_POSTGRES_MAJOR;
+  const version = execFileSync(join(installDir, "bin", "postgres"), ["--version"], { encoding: "utf8", timeout: 1e4 }).match(/PostgreSQL\)\s+(\d+)/)?.[1];
+  if (!version)
+    throw new Error("unable to identify the PostgreSQL installation major version");
+  return version;
+}
 var GLIBC_DYNAMIC_LOADERS = {
   x64: [
     "/lib64/ld-linux-x86-64.so.2",
@@ -11889,10 +12262,10 @@ async function fetchRelease(url) {
   let lastError;
   for (let attempt = 1;attempt <= 3; attempt++) {
     try {
-      const response = await fetch(url);
-      if (response.ok || response.status < 500)
-        return response;
-      lastError = new Error(`failed to download ${url}: HTTP ${response.status}`);
+      const response2 = await fetch(url, { signal: AbortSignal.timeout(30000) });
+      if (response2.ok || response2.status < 500)
+        return response2;
+      lastError = new Error(`failed to download ${url}: HTTP ${response2.status}`);
     } catch (error) {
       lastError = error;
     }
@@ -11918,8 +12291,16 @@ async function createNativeEngine(opts) {
   let postgres;
   let removeExitHandler;
   try {
-    const installDir = await ensurePostgres(opts.version, opts.cacheDir, opts.log, opts.downloadMirror);
+    const installDir = opts.installDir ?? process.env.SUPACLOUD_LITE_POSTGRES_DIR ?? await ensurePostgres(opts.version, opts.cacheDir, opts.log, opts.downloadMirror);
     const bin = (name) => join(installDir, "bin", name);
+    if (!existsSync2(bin("postgres")) || !existsSync2(bin("initdb"))) {
+      throw new Error("PostgreSQL installation requires bin/postgres and bin/initdb");
+    }
+    const serverVersion = nativePostgresMajor(installDir);
+    const storedMajor = existsSync2(join(opts.dataDir, "PG_VERSION")) ? readFileSync(join(opts.dataDir, "PG_VERSION"), "utf8").trim() : undefined;
+    if (!serverVersion || storedMajor && storedMajor !== serverVersion) {
+      throw new Error("PostgreSQL installation major version does not match the data directory; use a logical migration");
+    }
     if (!existsSync2(join(opts.dataDir, "PG_VERSION"))) {
       mkdirSync(opts.dataDir, { recursive: true });
       try {
@@ -12047,6 +12428,7 @@ async function computeDbDiff(opts) {
   let operationFailed = false;
   try {
     shadow = await createBackend({
+      runtimeMode: opts.runtimeMode,
       engine: opts.makeShadowEngine ? await opts.makeShadowEngine() : undefined,
       migrations: opts.migrations,
       startRuntimeServices: false
@@ -12054,6 +12436,7 @@ async function computeDbDiff(opts) {
     const liveEngine = unclaimedLiveEngine;
     unclaimedLiveEngine = undefined;
     live = await createBackend({
+      runtimeMode: opts.runtimeMode,
       engine: liveEngine,
       dataDir: liveEngine ? undefined : opts.liveDataDir,
       migrations: opts.migrations,
@@ -12077,11 +12460,11 @@ async function computeDbDiff(opts) {
 function shadowNativeDataDir() {
   return join2(mkdtempSync2(join2(tmpdir2(), "supacloud-lite-shadow-")), "pg");
 }
-async function createTemporaryNativeEngine() {
+async function createTemporaryNativeEngine(installDir) {
   const dataDir = shadowNativeDataDir();
   let engine;
   try {
-    engine = await createNativeEngine({ dataDir });
+    engine = await createNativeEngine({ dataDir, installDir });
   } catch (error) {
     try {
       await rm(dirname2(dataDir), { recursive: true, force: true });
@@ -12109,6 +12492,7 @@ async function pullSchema(opts) {
   let operationFailed = false;
   try {
     shadow = await createBackend({
+      runtimeMode: opts.runtimeMode,
       engine: opts.makeShadowEngine ? await opts.makeShadowEngine() : undefined,
       migrations: opts.migrations,
       startRuntimeServices: false
@@ -12116,6 +12500,7 @@ async function pullSchema(opts) {
     const liveEngine = unclaimedLiveEngine;
     unclaimedLiveEngine = undefined;
     live = await createBackend({
+      runtimeMode: opts.runtimeMode,
       engine: liveEngine,
       dataDir: liveEngine ? undefined : opts.liveDataDir,
       migrations: opts.migrations,
@@ -12164,6 +12549,7 @@ import { dirname as dirname3, resolve as resolve3 } from "path";
 import { pathToFileURL } from "url";
 
 // node_modules/@supacloud/db/dist/index.js
+import { createHash as createHash3 } from "crypto";
 var TABLES_SQL = `
 SELECT n.nspname AS schema,
        c.relname AS name,
@@ -12490,6 +12876,150 @@ async function lintModule(module, readFile2) {
   }
   return issues;
 }
+var TOKEN = /__[A-Z][A-Z0-9_]*__/g;
+var RESERVED_TOKEN = /__SC_BINDING_[A-Z0-9_]+__/;
+var HASH = /^[a-f0-9]{64}$/;
+function migrationBindingSha256(value) {
+  return createHash3("sha256").update(value).digest("hex");
+}
+function record(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Invalid migration binding object");
+  }
+  return value;
+}
+function keys(row, expected) {
+  if (Object.keys(row).sort().join(",") !== expected.sort().join(",")) {
+    throw new Error("Unexpected migration binding fields");
+  }
+}
+function validTarget(value) {
+  const target2 = record(value);
+  keys(target2, ["environment", "projectRef"]);
+  if (typeof target2.environment !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(target2.environment) || typeof target2.projectRef !== "string" || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(target2.projectRef)) {
+    throw new Error("Invalid migration binding target");
+  }
+  return target2;
+}
+function validFile(file) {
+  return typeof file === "string" && /^[a-zA-Z0-9_./-]+\.sql$/.test(file) && !file.startsWith("/") && file.split("/").every((part) => part && part !== "." && part !== "..");
+}
+function parseMigrationBindingManifest(value) {
+  const manifest = record(value);
+  keys(manifest, ["schema", "targets", "templates"]);
+  if (manifest.schema !== "supacloud.migration-bindings.v1" || !Array.isArray(manifest.targets) || !manifest.targets.length || !Array.isArray(manifest.templates)) {
+    throw new Error("Invalid migration binding manifest");
+  }
+  const targets = manifest.targets.map(validTarget);
+  if (new Set(targets.map((target2) => target2.environment)).size !== targets.length) {
+    throw new Error("Duplicate migration binding environment");
+  }
+  const files = new Set;
+  const templates = manifest.templates.map((value2) => {
+    const template = record(value2);
+    keys(template, ["file", "templateSha256", "parameters"]);
+    if (!validFile(template.file) || files.has(template.file) || typeof template.templateSha256 !== "string" || !HASH.test(template.templateSha256) || !Array.isArray(template.parameters) || !template.parameters.length) {
+      throw new Error("Invalid or duplicate migration binding template");
+    }
+    files.add(template.file);
+    const placeholders = new Set;
+    const parameters = template.parameters.map((value3) => {
+      const parameter = record(value3);
+      keys(parameter, ["placeholder", "variable", "type", "occurrences"]);
+      if (typeof parameter.placeholder !== "string" || !/^__[A-Z][A-Z0-9_]*__$/.test(parameter.placeholder) || placeholders.has(parameter.placeholder) || typeof parameter.variable !== "string" || !/^[A-Z][A-Z0-9_]*$/.test(parameter.variable) || !["uuid", "https-url", "resource-name"].includes(String(parameter.type)) || !Number.isSafeInteger(parameter.occurrences) || Number(parameter.occurrences) < 1) {
+        throw new Error("Invalid or duplicate migration binding parameter");
+      }
+      placeholders.add(parameter.placeholder);
+      return parameter;
+    });
+    return { file: template.file, templateSha256: template.templateSha256, parameters };
+  });
+  return { schema: "supacloud.migration-bindings.v1", targets, templates };
+}
+function bindingValue(parameter, values) {
+  const value = Object.hasOwn(values, parameter.variable) ? values[parameter.variable] : undefined;
+  if (typeof value !== "string" || !value || value.trim() !== value) {
+    throw new Error(`Missing or invalid migration binding variable: ${parameter.variable}`);
+  }
+  let valid = false;
+  if (parameter.type === "uuid") {
+    valid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+  } else if (parameter.type === "resource-name") {
+    valid = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,254}$/.test(value);
+  } else if (/^https:\/\/[A-Za-z0-9._~:/?#[\]@!&()*+,;=%-]+$/.test(value)) {
+    try {
+      const url = new URL(value);
+      valid = url.protocol === "https:" && Boolean(url.hostname) && !url.username && !url.password;
+    } catch {}
+  }
+  if (!valid || value.includes("__"))
+    throw new Error(`Invalid ${parameter.type} migration binding: ${parameter.variable}`);
+  return value;
+}
+function renderMigrationBindings(options) {
+  const manifest = parseMigrationBindingManifest(options.manifest);
+  const target2 = validTarget(options.target);
+  if (!manifest.targets.some((candidate) => candidate.environment === target2.environment && candidate.projectRef === target2.projectRef)) {
+    throw new Error("Migration binding target is not registered in the manifest");
+  }
+  const sources = new Map;
+  for (const migration of options.migrations) {
+    if (!validFile(migration.file) || sources.has(migration.file) || typeof migration.sql !== "string" || !migration.sql.trim()) {
+      throw new Error("Invalid, empty, or duplicate migration binding source");
+    }
+    sources.set(migration.file, migration);
+  }
+  if (manifest.templates.some((template) => !sources.has(template.file))) {
+    throw new Error("Migration binding manifest references a missing source");
+  }
+  const templates = new Map(manifest.templates.map((template) => [template.file, template]));
+  const declaredTokens = new Set(manifest.templates.flatMap((template) => template.parameters.map((parameter) => parameter.placeholder)));
+  const files = [];
+  const migrations = options.migrations.map((migration) => {
+    const template = templates.get(migration.file);
+    const templateSha256 = migrationBindingSha256(migration.sql);
+    if (template && templateSha256 !== template.templateSha256) {
+      throw new Error(`Migration binding template checksum mismatch: ${migration.file}`);
+    }
+    const parameters = new Map(template?.parameters.map((parameter) => [parameter.placeholder, parameter]));
+    const counts = new Map;
+    const sql = migration.sql.replace(TOKEN, (token, offset) => {
+      const parameter = parameters.get(token);
+      if (!parameter) {
+        if (RESERVED_TOKEN.test(token) || declaredTokens.has(token)) {
+          throw new Error(`Undeclared migration binding placeholder: ${migration.file}`);
+        }
+        return token;
+      }
+      if (migration.sql[offset - 1] !== "'" || migration.sql[offset + token.length] !== "'") {
+        throw new Error(`Migration bindings must occupy a complete SQL string literal: ${migration.file}`);
+      }
+      counts.set(token, (counts.get(token) || 0) + 1);
+      return bindingValue(parameter, options.values);
+    });
+    for (const parameter of parameters.values()) {
+      if (counts.get(parameter.placeholder) !== parameter.occurrences) {
+        throw new Error(`Migration binding occurrence mismatch: ${migration.file}`);
+      }
+    }
+    files.push({
+      file: migration.file,
+      templateSha256,
+      renderedSqlSha256: migrationBindingSha256(sql),
+      parameters: [...parameters.values()].map(({ variable, type }) => ({ variable, type }))
+    });
+    return { file: migration.file, sql };
+  });
+  return {
+    migrations,
+    attestation: {
+      schema: "supacloud.migration-binding-attestation.v1",
+      ...target2,
+      manifestSha256: migrationBindingSha256(JSON.stringify(manifest)),
+      files: files.sort((left, right) => left.file.localeCompare(right.file))
+    }
+  };
+}
 
 // src/runtime/node/db-check.ts
 async function loadDatabaseModules(moduleFile) {
@@ -12547,8 +13077,16 @@ function formatDatabaseModuleCheck(result) {
 
 // src/runtime/node/native/readiness.ts
 function liteCapabilities(engine, replicationProfile) {
+  const common = {
+    graphql: { status: "unverified", extension: "pg_graphql", reason: "DATABASE_NOT_INSPECTED" },
+    runtime_mode: "development",
+    identity: { mode: "local", verification: "built-in" },
+    migrations: { formats: ["flat-sql", "timestamp-folder"], content_check: "supported", target_bindings: "supported" },
+    project_release_manifests: "unsupported"
+  };
   if (engine === "pglite") {
     return {
+      ...common,
       engine,
       state_machine_sql: "supported",
       durable_workflows: "supported",
@@ -12560,6 +13098,7 @@ function liteCapabilities(engine, replicationProfile) {
     };
   }
   return {
+    ...common,
     engine,
     state_machine_sql: "supported",
     durable_workflows: "supported",
@@ -12775,162 +13314,16 @@ function sameStrings(left, right) {
   return left.length === right.length && left.every((value, index) => value === right[index]);
 }
 
-// src/runtime/node/project.ts
-import { readdir, readFile as readFile3 } from "fs/promises";
-import { join as join3 } from "path";
-async function loadSupabaseProject(projectDir, seed = {}) {
-  const migrationsDir = join3(projectDir, "supabase", "migrations");
-  const migrations = [];
-  let entries = [];
-  try {
-    entries = await readdir(migrationsDir);
-  } catch (error) {
-    if (!isNotFound(error))
-      throw error;
-  }
-  for (const entry of entries.sort()) {
-    if (!entry.endsWith(".sql"))
-      continue;
-    const sql = await readFile3(join3(migrationsDir, entry), "utf8");
-    migrations.push({ name: entry.replace(/\.sql$/, ""), sql });
-  }
-  let seedSql;
-  if (seed.enabled !== false) {
-    const parts = [];
-    const supabaseDir = join3(projectDir, "supabase");
-    for (const configuredPath of seed.paths ?? ["seed.sql"]) {
-      const pattern = configuredPath.replace(/^\.\//, "");
-      const matches = /[*?[\]{}]/.test(pattern) ? [...new Bun.Glob(pattern).scanSync({ cwd: supabaseDir, onlyFiles: true })].sort() : [pattern];
-      for (const relativePath of matches) {
-        try {
-          parts.push(await readFile3(join3(supabaseDir, relativePath), "utf8"));
-        } catch (error) {
-          if (!isNotFound(error))
-            throw error;
-        }
-      }
-    }
-    if (parts.length)
-      seedSql = parts.join(`
-`);
-  }
-  return { migrations, seedSql };
-}
-function isNotFound(error) {
-  return error.code === "ENOENT";
-}
-
-// src/project-runtime.ts
-import { chmod, link, lstat, mkdir as mkdir5, readFile as readFile7, realpath as realpath2, unlink as unlink2, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname6, isAbsolute, join as join8, parse, relative, resolve as resolve4 } from "path";
-
-// src/runtime/node/bun-server.ts
-async function serveBun(backend, opts = {}) {
-  const host = opts.host ?? "127.0.0.1";
-  const server = Bun.serve({
-    port: opts.port ?? 54321,
-    hostname: host,
-    async fetch(req, srv) {
-      const url = new URL(req.url);
-      if (url.pathname.startsWith("/realtime/v1") && req.headers.get("upgrade")?.toLowerCase() === "websocket") {
-        const ok = srv.upgrade(req, { data: { vsn: url.searchParams.get("vsn") ?? "1.0.0" } });
-        if (ok)
-          return;
-        return new Response("upgrade failed", { status: 400 });
-      }
-      const headers = new Headers(req.headers);
-      headers.delete("x-supacloud-lite-remote-addr");
-      const ip = srv.requestIP(req)?.address;
-      if (ip)
-        headers.set("x-supacloud-lite-remote-addr", ip);
-      return backend.fetch(new Request(req, { headers }));
-    },
-    websocket: {
-      open(ws) {
-        const session = backend.realtime.connect({
-          send: (data) => ws.send(data),
-          close: (code, reason) => ws.close(code, reason)
-        }, { vsn: ws.data.vsn });
-        ws.data.session = session;
-      },
-      message(ws, message2) {
-        ws.data.session?.onMessage(typeof message2 === "string" ? message2 : new Uint8Array(message2));
-      },
-      close(ws) {
-        ws.data.session?.onClose();
-      }
-    }
-  });
-  return {
-    server,
-    port: server.port ?? opts.port ?? 54321,
-    url: `http://${host}:${server.port ?? opts.port ?? 54321}`,
-    close: async () => {
-      await server.stop(true);
-    }
-  };
-}
-
-// src/runtime/node/fs-driver.ts
-import { mkdir as mkdir3, readFile as readFile4, rename, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname4, join as join4, normalize, sep } from "path";
-
-class FsStorageDriver {
-  root;
-  constructor(root) {
-    this.root = root;
-  }
-  resolve(key) {
-    const path = normalize(join4(this.root, key));
-    if (!path.startsWith(normalize(this.root) + sep)) {
-      throw new Error(`invalid storage key: ${key}`);
-    }
-    return path;
-  }
-  async put(key, data) {
-    const path = this.resolve(key);
-    await mkdir3(dirname4(path), { recursive: true });
-    const temporaryPath = `${path}.${crypto.randomUUID()}.tmp`;
-    try {
-      await writeFile3(temporaryPath, data);
-      await rename(temporaryPath, path);
-    } catch (error) {
-      await rm2(temporaryPath, { force: true }).catch(() => {});
-      throw error;
-    }
-  }
-  async get(key) {
-    try {
-      return new Uint8Array(await readFile4(this.resolve(key)));
-    } catch (e) {
-      if (e.code === "ENOENT")
-        return null;
-      throw e;
-    }
-  }
-  async getBlob(key) {
-    const file = Bun.file(this.resolve(key));
-    return await file.exists() ? file : null;
-  }
-  async delete(key) {
-    await rm2(this.resolve(key), { force: true });
-  }
-  async deleteMany(keys) {
-    for (const k of keys)
-      await this.delete(k);
-  }
-}
-
 // src/runtime/node/config-toml.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { join as join5 } from "path";
+import { join as join3 } from "path";
 function emptyTable() {
   return { values: new Map, children: new Map };
 }
 function loadConfigToml(projectDir, env = process.env) {
   let text;
   try {
-    text = readFileSync2(join5(projectDir, "supabase", "config.toml"), "utf8");
+    text = readFileSync2(join3(projectDir, "supabase", "config.toml"), "utf8");
   } catch {
     return emptyTable();
   }
@@ -13068,15 +13461,50 @@ function getByteSize(table, key) {
 }
 
 // src/runtime/node/load-config.ts
-function loadProjectConfig(projectDir, env = process.env) {
+function loadProjectConfig(projectDir, env = process.env, modeOverride) {
   const root = loadConfigToml(projectDir, env);
+  const mode = runtimeMode(modeOverride ?? env.SUPACLOUD_LITE_RUNTIME_MODE ?? getString(tableAt(root, "lite"), "runtime_mode"));
   return {
+    lite: readLite(root, mode),
     auth: readAuth(root, env),
     api: readApi(root),
     storage: readStorage(root),
     seed: readSeed(root),
-    functions: readFunctions(root)
+    functions: readFunctions(root, mode)
+  };
+}
+function readLite(root, mode) {
+  const graphql = tableAt(root, "lite.graphql");
+  const bindings = tableAt(root, "lite.migration_bindings");
+  const out = {
+    runtimeMode: mode,
+    graphql: {
+      enabled: getBool(graphql, "enabled"),
+      maxRequestBodyBytes: getInt(graphql, "max_request_body_bytes"),
+      statementTimeoutMs: getInt(graphql, "statement_timeout_ms")
+    },
+    identityModule: getString(tableAt(root, "lite.identity"), "module")
   };
+  for (const key of ["max_request_body_bytes", "statement_timeout_ms"]) {
+    const value = graphql?.values.get(key);
+    if (value !== undefined && (typeof value !== "string" || !/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) <= 0)) {
+      throw new Error(`invalid GraphQL option: ${key}`);
+    }
+  }
+  if (graphql?.values.has("enabled") && getBool(graphql, "enabled") === undefined)
+    throw new Error("invalid GraphQL enabled option");
+  const identity = tableAt(root, "lite.identity");
+  if (identity && !out.identityModule)
+    throw new Error("Lite identity configuration requires a module");
+  if (bindings) {
+    const manifest = getString(bindings, "manifest");
+    const environment = getString(bindings, "environment");
+    const projectRef = getString(bindings, "project_ref");
+    if (!manifest || !environment || !projectRef)
+      throw new Error("Lite migration bindings require manifest, environment and project_ref");
+    out.migrationBindings = { manifest, environment, projectRef };
+  }
+  return out;
 }
 function readAuth(root, env) {
   const auth = tableAt(root, "auth");
@@ -13273,7 +13701,7 @@ function readSeed(root) {
     out.paths = paths;
   return out;
 }
-function readFunctions(root) {
+function readFunctions(root, mode) {
   const fns = tableAt(root, "functions");
   const out = {};
   if (!fns)
@@ -13294,9 +13722,29 @@ function readFunctions(root) {
       if (framework === "fetch" || framework === "elysia" || framework === "hono") {
         opts.framework = framework;
       } else {
+        if (mode === "strict")
+          throw new Error(`invalid framework for function "${name}"`);
         console.warn(`  warning: [functions.${name}] framework "${framework}" is not one of fetch/elysia/hono; falling back to fetch`);
       }
     }
+    if (mode === "strict") {
+      for (const key of ["timeout_ms", "max_request_body_bytes", "max_response_body_bytes", "wait_until_timeout_ms"]) {
+        if (t.values.has(key)) {
+          const value = t.values.get(key);
+          if (typeof value !== "string" || !/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) <= 0) {
+            throw new Error(`invalid strict function limit: ${name}.${key}`);
+          }
+        }
+      }
+      for (const key of ["background", "enabled", "verify_jwt"]) {
+        if (t.values.has(key) && getBool(t, key) === undefined)
+          throw new Error(`invalid strict function option: ${name}.${key}`);
+      }
+      for (const key of ["secrets", "outbound_hosts"]) {
+        if (t.values.has(key) && getStringArray(t, key) === undefined)
+          throw new Error(`invalid strict function option: ${name}.${key}`);
+      }
+    }
     const timeoutMs = getInt(t, "timeout_ms");
     if (timeoutMs !== undefined && timeoutMs > 0)
       opts.timeoutMs = timeoutMs;
@@ -13323,13 +13771,201 @@ function readFunctions(root) {
   return out;
 }
 
+// src/runtime/node/project.ts
+import { lstat, readdir, readFile as readFile3 } from "fs/promises";
+import { join as join4 } from "path";
+async function loadSupabaseProject(projectDir, seed = {}) {
+  const migrationsDir = join4(projectDir, "supabase", "migrations");
+  let migrations = [];
+  const sources = [];
+  let entries = [];
+  try {
+    entries = await readdir(migrationsDir);
+  } catch (error) {
+    if (!isNotFound(error))
+      throw error;
+  }
+  for (const entry of entries.sort()) {
+    const info = await lstat(join4(migrationsDir, entry));
+    if (info.isSymbolicLink())
+      throw new Error(`migration paths must not be symbolic links: ${entry}`);
+    let file;
+    let name;
+    if (info.isFile() && entry.endsWith(".sql")) {
+      file = entry;
+      name = entry.replace(/\.sql$/, "");
+    } else if (info.isDirectory() && /^\d/.test(entry)) {
+      file = `${entry}/migration.sql`;
+      name = entry;
+      const sqlInfo = await lstat(join4(migrationsDir, file)).catch((error) => {
+        if (isNotFound(error))
+          throw new Error(`migration folder is missing migration.sql: ${entry}`);
+        throw error;
+      });
+      if (!sqlInfo.isFile() || sqlInfo.isSymbolicLink())
+        throw new Error(`invalid migration file: ${file}`);
+    } else
+      continue;
+    const sql = await readFile3(join4(migrationsDir, file), "utf8");
+    sources.push({ file, sql });
+    migrations.push({ name, sql });
+  }
+  const versions = new Set;
+  for (const migration of migrations) {
+    const version = migration.name.match(/^(\d+)/)?.[1] ?? migration.name;
+    if (versions.has(version))
+      throw new Error(`duplicate migration version: ${version}`);
+    versions.add(version);
+  }
+  const rendered = seed.bindings ? renderMigrationBindings({
+    ...seed.bindings,
+    migrations: sources
+  }) : undefined;
+  if (rendered)
+    migrations = migrations.map((migration, index) => {
+      const bound = rendered.migrations[index];
+      if (!bound)
+        throw new Error(`missing rendered migration: ${migration.name}`);
+      return { ...migration, sql: bound.sql };
+    });
+  else if (sources.some(({ sql }) => /__SC_BINDING_[A-Z0-9_]+__/.test(sql))) {
+    throw new Error("migration binding placeholders require an explicit manifest and target");
+  }
+  let seedSql;
+  if (seed.enabled !== false) {
+    const parts = [];
+    const supabaseDir = join4(projectDir, "supabase");
+    for (const configuredPath of seed.paths ?? ["seed.sql"]) {
+      const pattern = configuredPath.replace(/^\.\//, "");
+      const matches = /[*?[\]{}]/.test(pattern) ? [...new Bun.Glob(pattern).scanSync({ cwd: supabaseDir, onlyFiles: true })].sort() : [pattern];
+      for (const relativePath of matches) {
+        try {
+          parts.push(await readFile3(join4(supabaseDir, relativePath), "utf8"));
+        } catch (error) {
+          if (!isNotFound(error))
+            throw error;
+        }
+      }
+    }
+    if (parts.length)
+      seedSql = parts.join(`
+`);
+  }
+  return { migrations, seedSql, ...rendered ? { bindingAttestation: rendered.attestation } : {} };
+}
+function isNotFound(error) {
+  return error.code === "ENOENT";
+}
+
+// src/project-runtime.ts
+import { chmod, link, lstat as lstat2, mkdir as mkdir5, readFile as readFile7, realpath as realpath2, unlink as unlink2, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname6, isAbsolute, join as join8, parse, relative, resolve as resolve4 } from "path";
+import { pathToFileURL as pathToFileURL3 } from "url";
+
+// src/runtime/node/bun-server.ts
+async function serveBun(backend, opts = {}) {
+  const host = opts.host ?? "127.0.0.1";
+  const server = Bun.serve({
+    port: opts.port ?? 54321,
+    hostname: host,
+    async fetch(req, srv) {
+      const url = new URL(req.url);
+      if (url.pathname.startsWith("/realtime/v1") && req.headers.get("upgrade")?.toLowerCase() === "websocket") {
+        const ok = srv.upgrade(req, { data: { vsn: url.searchParams.get("vsn") ?? "1.0.0" } });
+        if (ok)
+          return;
+        return new Response("upgrade failed", { status: 400 });
+      }
+      const headers = new Headers(req.headers);
+      headers.delete("x-supacloud-lite-remote-addr");
+      const ip = srv.requestIP(req)?.address;
+      if (ip)
+        headers.set("x-supacloud-lite-remote-addr", ip);
+      return backend.fetch(new Request(req, { headers }));
+    },
+    websocket: {
+      open(ws) {
+        const session = backend.realtime.connect({
+          send: (data) => ws.send(data),
+          close: (code, reason) => ws.close(code, reason)
+        }, { vsn: ws.data.vsn });
+        ws.data.session = session;
+      },
+      message(ws, message2) {
+        ws.data.session?.onMessage(typeof message2 === "string" ? message2 : new Uint8Array(message2));
+      },
+      close(ws) {
+        ws.data.session?.onClose();
+      }
+    }
+  });
+  return {
+    server,
+    port: server.port ?? opts.port ?? 54321,
+    url: `http://${host}:${server.port ?? opts.port ?? 54321}`,
+    close: async () => {
+      await server.stop(true);
+    }
+  };
+}
+
+// src/runtime/node/fs-driver.ts
+import { mkdir as mkdir3, readFile as readFile4, rename, rm as rm2, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname4, join as join5, normalize, sep } from "path";
+
+class FsStorageDriver {
+  root;
+  constructor(root) {
+    this.root = root;
+  }
+  resolve(key) {
+    const path = normalize(join5(this.root, key));
+    if (!path.startsWith(normalize(this.root) + sep)) {
+      throw new Error(`invalid storage key: ${key}`);
+    }
+    return path;
+  }
+  async put(key, data) {
+    const path = this.resolve(key);
+    await mkdir3(dirname4(path), { recursive: true });
+    const temporaryPath = `${path}.${crypto.randomUUID()}.tmp`;
+    try {
+      await writeFile3(temporaryPath, data);
+      await rename(temporaryPath, path);
+    } catch (error) {
+      await rm2(temporaryPath, { force: true }).catch(() => {});
+      throw error;
+    }
+  }
+  async get(key) {
+    try {
+      return new Uint8Array(await readFile4(this.resolve(key)));
+    } catch (e) {
+      if (e.code === "ENOENT")
+        return null;
+      throw e;
+    }
+  }
+  async getBlob(key) {
+    const file = Bun.file(this.resolve(key));
+    return await file.exists() ? file : null;
+  }
+  async delete(key) {
+    await rm2(this.resolve(key), { force: true });
+  }
+  async deleteMany(keys2) {
+    for (const k of keys2)
+      await this.delete(k);
+  }
+}
+
 // src/runtime/node/load-functions.ts
 import { readdir as readdir2, readFile as readFile6, realpath, rm as rm4, stat as stat2 } from "fs/promises";
 import { dirname as dirname5, join as join7 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 
 // src/runtime/node/bundle-function.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { mkdir as mkdir4, readFile as readFile5, rm as rm3, writeFile as writeFile4 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
@@ -13343,7 +13979,7 @@ function rewriteRemoteSpecifier(spec) {
 }
 var HTTP_CACHE = join6(tmpdir3(), "supacloud-lite-fn-http");
 async function fetchModule(url) {
-  const key = createHash3("sha256").update(url).digest("hex");
+  const key = createHash4("sha256").update(url).digest("hex");
   const cached = join6(HTTP_CACHE, key);
   if (existsSync3(cached))
     return readFile5(cached, "utf8");
@@ -13377,8 +14013,9 @@ function remotePlugin() {
 async function bundleFunction(entryPath, name) {
   const outDir = join6(tmpdir3(), "supacloud-lite-fn-bundle", name);
   await mkdir4(outDir, { recursive: true });
+  let buildOutput;
   try {
-    const buildOutput = await Bun.build({
+    buildOutput = await Bun.build({
       entrypoints: [entryPath],
       format: "esm",
       target: "bun",
@@ -13386,6 +14023,18 @@ async function bundleFunction(entryPath, name) {
       naming: `${name}-[hash].[ext]`,
       plugins: [remotePlugin()]
     });
+  } catch (buildThrow) {
+    const details = buildThrow instanceof AggregateError ? buildThrow.errors.map((item) => item?.message ?? String(item)).filter(Boolean).join(`
+`) : buildThrow instanceof Error ? buildThrow.message : String(buildThrow);
+    try {
+      await rm3(outDir, { recursive: true, force: true });
+    } catch (cleanupError) {
+      throw new AggregateError([buildThrow, cleanupError], `failed to clean function bundle directory ${outDir}`);
+    }
+    throw new Error(`failed to bundle ${entryPath}
+${details}`, { cause: buildThrow });
+  }
+  try {
     if (!buildOutput.success || buildOutput.outputs.length === 0) {
       throw new Error(buildOutput.logs.map((item) => item.message).join(`
 `) || `failed to bundle ${entryPath}`);
@@ -13429,16 +14078,18 @@ async function loadFunctionEnv(projectDir) {
   return env;
 }
 var FUNCTION_FRAMEWORKS = new Set(["fetch", "elysia", "hono"]);
-function resolveFramework(name, value) {
+function resolveFramework(name, value, mode) {
   if (value === undefined)
     return;
   if (FUNCTION_FRAMEWORKS.has(value))
     return value;
+  if (mode === "strict")
+    throw new Error(`invalid framework for function "${name}"`);
   console.warn(`  warning: function "${name}" has unsupported framework "${value}", expected one of fetch/elysia/hono; falling back to fetch`);
   return;
 }
 var loadQueue = Promise.resolve();
-async function loadFunctions2(projectDir, options = {}) {
+async function loadFunctions2(projectDir, options = {}, mode = "development") {
   let releaseQueue;
   const previous = loadQueue;
   loadQueue = new Promise((resolveQueue) => {
@@ -13446,18 +14097,23 @@ async function loadFunctions2(projectDir, options = {}) {
   });
   await previous;
   try {
-    return await loadFunctionsUnlocked(projectDir, options);
+    return await loadFunctionsUnlocked(projectDir, options, mode);
   } finally {
     releaseQueue();
   }
 }
-async function loadFunctionsUnlocked(projectDir, options) {
+async function loadFunctionsUnlocked(projectDir, options, mode) {
   const functions = new Map;
   const root = join7(projectDir, "supabase", "functions");
   let entries = [];
   try {
     entries = await readdir2(root);
-  } catch {
+  } catch (error) {
+    if (mode === "strict" && errorProperty(error, "code") !== "ENOENT")
+      throw error;
+    if (mode === "strict" && Object.values(options).some((option) => option.enabled !== false)) {
+      throw new Error("declared function directory is missing");
+    }
     return functions;
   }
   installDenoShim();
@@ -13507,14 +14163,18 @@ async function loadFunctionsUnlocked(projectDir, options) {
           } : undefined;
           functions.set(name, {
             handler,
-            framework: resolveFramework(name, opts?.framework),
+            framework: resolveFramework(name, opts?.framework, mode),
             ...limits ? { limits } : {},
             ...capabilities ? { capabilities } : {}
           });
         } else {
+          if (mode === "strict")
+            throw new Error(`function "${name}" has no handler`);
           console.warn(`  warning: function "${name}" has no default function, handle/fetch object, or Deno.serve() handler, skipped`);
         }
       } catch (e) {
+        if (mode === "strict")
+          throw new Error(`failed to load strict function "${name}"`, { cause: e });
         const msg = e instanceof Error ? e.message : String(e);
         if (/Unknown file extension|Cannot find module/.test(msg)) {
           console.warn(`  warning: function "${name}" could not be bundled by Bun: ${msg}`);
@@ -13527,6 +14187,14 @@ async function loadFunctionsUnlocked(projectDir, options) {
       }
       break;
     }
+    if (mode === "strict" && !functions.has(name))
+      throw new Error(`function "${name}" has no loadable entrypoint`);
+  }
+  if (mode === "strict") {
+    for (const [name, option] of Object.entries(options)) {
+      if (option.enabled !== false && !functions.has(name))
+        throw new Error(`declared function "${name}" was not loaded`);
+    }
   }
   return functions;
 }
@@ -13615,8 +14283,8 @@ class S3StorageDriver {
   async delete(key) {
     await this.client.file(this.objectKey(key)).delete();
   }
-  async deleteMany(keys) {
-    for (const key of keys) {
+  async deleteMany(keys2) {
+    for (const key of keys2) {
       await this.delete(key);
     }
   }
@@ -13676,7 +14344,7 @@ async function assertResetPathsSafe(paths) {
 }
 async function requiredResetEntry(path) {
   try {
-    return await lstat(path);
+    return await lstat2(path);
   } catch (error) {
     if (error.code === "ENOENT")
       throw new Error(RESET_INITIALIZATION_ERROR);
@@ -13702,7 +14370,7 @@ async function assertResetTargetCanonical(stateDir, canonicalStateDir, target2,
   let current = target2;
   while (current !== stateDir) {
     try {
-      if ((await lstat(current)).isSymbolicLink()) {
+      if ((await lstat2(current)).isSymbolicLink()) {
         throw new Error(`refusing to reset ${label} path through a symbolic link: ${current}`);
       }
     } catch (error) {
@@ -13725,7 +14393,7 @@ async function nearestExistingAncestor(target2) {
   let current = target2;
   while (true) {
     try {
-      await lstat(current);
+      await lstat2(current);
       return current;
     } catch (error) {
       if (error.code !== "ENOENT")
@@ -13787,12 +14455,15 @@ async function createProjectBackend(options = {}) {
   const host = options.host ?? process.env.SUPACLOUD_LITE_HOST ?? "127.0.0.1";
   const port = options.port ?? parsePort(process.env.SUPACLOUD_LITE_PORT ?? process.env.PORT, 54321);
   const url = options.apiUrl ?? process.env.SUPACLOUD_LITE_API_URL ?? `http://${displayHost(host)}:${port}`;
-  const config = loadProjectConfig(paths.projectDir);
+  const config = loadProjectConfig(paths.projectDir, process.env, options.runtimeMode);
+  const bindings = options.migrationBindings ?? await loadProjectBindings(paths.projectDir, config);
   const project = await loadSupabaseProject(paths.projectDir, {
     enabled: options.includeSeed === false ? false : config.seed.enabled,
-    paths: config.seed.paths
+    paths: config.seed.paths,
+    bindings
   });
-  const functions = options.includeFunctions === false ? new Map : await loadFunctions2(paths.projectDir, config.functions);
+  const externalIdentity = options.externalIdentity ?? (options.includeIdentity !== false ? await loadProjectIdentity(paths.projectDir, options.identityModule ?? config.lite.identityModule) : undefined);
+  const functions = options.includeFunctions === false ? new Map : await loadFunctions2(paths.projectDir, config.functions, config.lite.runtimeMode);
   const functionEnv = options.includeFunctions === false ? {} : await loadFunctionEnv(paths.projectDir);
   const secrets = await ensureProjectSecrets(paths);
   const webhooks = options.includeWebhooks === false ? [] : await loadWebhooks(paths.projectDir);
@@ -13807,11 +14478,20 @@ async function createProjectBackend(options = {}) {
   await mkdir5(paths.storageDir, { recursive: true, mode: 448 });
   await chmod(paths.storageDir, 448);
   const storageDriver = options.storageDriver ?? createStorageDriver(configuredStorageBackend, paths.storageDir, options.s3);
-  const engine = databaseEngine === "native" ? await createNativeEngine({ dataDir: paths.dataDir, log: options.log, replication }) : undefined;
+  let engine;
+  if (databaseEngine === "native") {
+    const dataDir = paths.dataDir;
+    if (dataDir === undefined)
+      throw new Error("native PostgreSQL requires a data directory");
+    engine = await createNativeEngine({ dataDir, installDir: options.postgresDir, log: options.log, replication });
+  }
   let backend;
   try {
     backend = await createBackend({
       engine,
+      runtimeMode: config.lite.runtimeMode,
+      graphql: options.graphql ?? config.lite.graphql,
+      externalIdentity,
       dataDir: databaseEngine === "pglite" ? paths.dataDir : undefined,
       jwtSecret: secrets.jwtSecret,
       vaultKey: secrets.vaultKey,
@@ -13861,6 +14541,7 @@ async function createProjectBackend(options = {}) {
     throw error;
   }
   return {
+    bindingAttestation: project.bindingAttestation,
     backend,
     config,
     paths,
@@ -13875,6 +14556,30 @@ async function createProjectBackend(options = {}) {
     replicationProfile: replication?.profile
   };
 }
+async function loadProjectBindings(projectDir, config) {
+  const bindings = config.lite.migrationBindings;
+  if (!bindings)
+    return;
+  const manifest = JSON.parse(await readFile7(resolve4(projectDir, bindings.manifest), "utf8"));
+  return {
+    manifest,
+    target: { environment: bindings.environment, projectRef: bindings.projectRef },
+    values: process.env
+  };
+}
+async function loadProjectIdentity(projectDir, module) {
+  if (!module)
+    return;
+  const imported = await import(pathToFileURL3(resolve4(projectDir, module)).href);
+  if (!isRecord(imported) || typeof imported["default"] !== "function") {
+    throw new Error("Lite identity module must default-export an external identity verifier");
+  }
+  const verify = imported["default"];
+  return async (request) => {
+    const claims = await verify(request);
+    return validateExternalIdentityClaims(claims);
+  };
+}
 function resolveNativeReplicationOptions(options, databaseEngine = resolveDatabaseEngine(options.engine, options.memory)) {
   const profile = options.replicationProfile ?? process.env.SUPACLOUD_LITE_REPLICATION_PROFILE;
   if (!profile)
@@ -13906,7 +14611,7 @@ function resolveDatabaseEngine(value, memory = false) {
   if (configured === "native" && memory)
     throw new Error("--memory is only supported by the pglite engine");
   if (configured === "native" && !isNativeEngineSupported()) {
-    throw new Error(`native PostgreSQL requires macOS or glibc Linux on x64/arm64; ` + `${process.platform}/${process.arch} must use --engine pglite`);
+    throw new Error(`native PostgreSQL requires macOS or glibc Linux on x64/arm64; ${process.platform}/${process.arch} must use --engine pglite`);
   }
   return configured;
 }
@@ -14018,7 +14723,7 @@ async function findEphemeralPort(host = "127.0.0.1") {
 }
 
 // src/snapshot.ts
-import { chmod as chmod2, copyFile, lstat as lstat2, mkdir as mkdir6, mkdtemp, readdir as readdir3, readFile as readFile8, rename as rename2, rm as rm5, writeFile as writeFile6 } from "fs/promises";
+import { chmod as chmod2, copyFile, lstat as lstat3, mkdir as mkdir6, mkdtemp, readdir as readdir3, readFile as readFile8, rename as rename2, rm as rm5, writeFile as writeFile6 } from "fs/promises";
 import { dirname as dirname7, join as join9, parse as parse2, relative as relative2, resolve as resolve5, sep as sep2 } from "path";
 import { create as createTar, extract as extractTar2 } from "tar";
 var SNAPSHOT_FORMAT = "supacloud-lite-snapshot";
@@ -14107,7 +14812,10 @@ async function restoreSnapshot(options) {
     if (manifest.storageBackend !== options.storageBackend) {
       throw new Error(`snapshot storage backend is ${manifest.storageBackend}, but the target uses ${options.storageBackend}; ` + "restore with the matching --storage-backend value");
     }
-    assertDatabaseSnapshotCompatible(manifest, paths);
+    assertDatabaseSnapshotCompatible(manifest, paths, options.postgresDir);
+    if (manifest.databaseEngine === "native" && await readPostgresMajor(join9(payloadRoot, "database")) !== manifest.postgresMajor) {
+      throw new Error("native PostgreSQL snapshot payload does not match its declared major version");
+    }
     if (manifest.includesDatabase !== Boolean(paths.dataDir)) {
       throw new Error("snapshot database mode does not match the target; do not restore a persistent snapshot into --memory");
     }
@@ -14174,7 +14882,7 @@ async function assertSnapshotPaths(paths, options = {}) {
       throw new Error("snapshot state directory must not be the filesystem root");
     if (paths.secretsFile !== join9(paths.stateDir, "secrets.json"))
       throw new Error("snapshot secrets path must be inside the state directory");
-    const stateInfo = await lstat2(paths.stateDir);
+    const stateInfo = await lstat3(paths.stateDir);
     if (!stateInfo.isDirectory() || stateInfo.isSymbolicLink())
       throw new Error(`state directory must be a real directory: ${paths.stateDir}`);
   } catch (error) {
@@ -14187,7 +14895,7 @@ async function assertSnapshotPaths(paths, options = {}) {
   await assertDirectoryOrMissing(paths.dataDir);
   await assertDirectoryOrMissing(paths.storageDir);
   if (options.requireSecrets !== false) {
-    const secretInfo = await lstat2(paths.secretsFile);
+    const secretInfo = await lstat3(paths.secretsFile);
     if (!secretInfo.isFile() || secretInfo.isSymbolicLink())
       throw new Error(`secrets file must be a regular file: ${paths.secretsFile}`);
   }
@@ -14198,7 +14906,7 @@ async function assertDirectoryOrMissing(path) {
   if (resolve5(path) === parse2(resolve5(path)).root)
     throw new Error(`snapshot path must not be the filesystem root: ${path}`);
   try {
-    const info = await lstat2(path);
+    const info = await lstat3(path);
     if (!info.isDirectory() || info.isSymbolicLink())
       throw new Error(`snapshot path must be a real directory: ${path}`);
   } catch (error) {
@@ -14219,7 +14927,7 @@ async function assertNoDataDirectoryLock(paths) {
 }
 async function stageDirectory(root, destination) {
   try {
-    const info = await lstat2(root);
+    const info = await lstat3(root);
     if (!info.isDirectory() || info.isSymbolicLink())
       throw new Error(`snapshot path must be a real directory: ${root}`);
   } catch (error) {
@@ -14269,7 +14977,7 @@ function isSnapshotManifest(value) {
   const candidate = value;
   return candidate.format === SNAPSHOT_FORMAT && candidate.version === SNAPSHOT_VERSION && typeof candidate.createdAt === "string" && typeof candidate.packageVersion === "string" && (candidate.storageBackend === "fs" || candidate.storageBackend === "s3" || candidate.storageBackend === "memory") && typeof candidate.includesDatabase === "boolean" && typeof candidate.includesLocalStorage === "boolean" && candidate.includesSecrets === true && (candidate.databaseEngine === undefined || candidate.databaseEngine === "pglite" || candidate.databaseEngine === "native") && (candidate.platform === undefined || typeof candidate.platform === "string") && (candidate.architecture === undefined || typeof candidate.architecture === "string") && (candidate.postgresMajor === undefined || typeof candidate.postgresMajor === "string");
 }
-function assertDatabaseSnapshotCompatible(manifest, paths) {
+function assertDatabaseSnapshotCompatible(manifest, paths, postgresDir) {
   const sourceEngine = manifest.databaseEngine ?? "pglite";
   if (sourceEngine !== paths.databaseEngine) {
     throw new Error(`snapshot database engine is ${sourceEngine}, but the target uses ${paths.databaseEngine}`);
@@ -14279,8 +14987,9 @@ function assertDatabaseSnapshotCompatible(manifest, paths) {
   if (manifest.platform !== process.platform || manifest.architecture !== process.arch) {
     throw new Error(`native PostgreSQL snapshots require the same platform and architecture; ` + `source is ${manifest.platform ?? "unknown"}/${manifest.architecture ?? "unknown"}, ` + `target is ${process.platform}/${process.arch}`);
   }
-  if (manifest.postgresMajor !== NATIVE_POSTGRES_MAJOR) {
-    throw new Error(`native PostgreSQL snapshot major is ${manifest.postgresMajor ?? "unknown"}, ` + `but this Lite build uses ${NATIVE_POSTGRES_MAJOR}`);
+  const expectedMajor = nativePostgresMajor(postgresDir);
+  if (manifest.postgresMajor !== expectedMajor) {
+    throw new Error(`native PostgreSQL snapshot major is ${manifest.postgresMajor ?? "unknown"}, ` + `but the selected PostgreSQL installation uses ${expectedMajor}`);
   }
 }
 async function readPostgresMajor(dataDir) {
@@ -14298,7 +15007,7 @@ async function assertSnapshotPayload(payloadRoot, manifest) {
   const required = ["manifest.json", "secrets.json"];
   for (const path of required) {
     try {
-      await lstat2(join9(payloadRoot, path));
+      await lstat3(join9(payloadRoot, path));
     } catch {
       throw new Error(`snapshot is missing required payload: ${path}`);
     }
@@ -14370,7 +15079,7 @@ async function rollbackDirectorySwaps(swaps) {
 }
 async function existingInfo(path) {
   try {
-    return await lstat2(path);
+    return await lstat3(path);
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
@@ -14378,7 +15087,7 @@ async function existingInfo(path) {
   }
 }
 async function copyEntry(source, target2) {
-  const info = await lstat2(source);
+  const info = await lstat3(source);
   if (info.isSymbolicLink())
     throw new Error(`snapshot refuses symbolic link: ${source}`);
   if (info.isDirectory()) {
@@ -14392,7 +15101,7 @@ async function copyEntry(source, target2) {
     throw new Error(`snapshot refuses unsupported filesystem entry: ${source}`);
 }
 async function hardenRestoredTree(root) {
-  const info = await lstat2(root);
+  const info = await lstat3(root);
   if (info.isSymbolicLink())
     throw new Error(`snapshot refuses symbolic link: ${root}`);
   if (info.isDirectory()) {
@@ -14485,6 +15194,12 @@ function parseArgs(argv) {
       options.s3 = { ...options.s3, prefix: next() };
     else if (argument === "--engine")
       options.engine = next();
+    else if (argument === "--runtime-mode")
+      options.runtimeMode = runtimeMode(next());
+    else if (argument === "--postgres-dir")
+      options.postgresDir = resolve6(next());
+    else if (argument === "--identity-module")
+      options.identityModule = resolve6(next());
     else if (argument === "--replication-profile") {
       options.replicationProfile = next();
     } else if (argument === "--replication-host")
@@ -14536,13 +15251,13 @@ async function main() {
   }
   if (options.command === "keys") {
     const secrets = await ensureProjectSecrets(paths);
-    const keys = await mintProjectKeys(secrets.jwtSecret);
+    const keys2 = await mintProjectKeys(secrets.jwtSecret);
     const privilegedKey = options.serviceRole ? `
 service_role key:
-${keys.serviceRoleKey}` : `
+${keys2.serviceRoleKey}` : `
 Use --service-role to print the privileged key.`;
     await writeStandardOutput(`anon key:
-${keys.anonKey}
+${keys2.anonKey}
 ${privilegedKey}
 `);
     return;
@@ -14568,6 +15283,8 @@ ${privilegedKey}
       applyMigrations: false,
       includeFunctions: false,
       includeWebhooks: false,
+      includeIdentity: false,
+      graphql: { enabled: false },
       startRuntimeServices: false,
       log: quietLog
     });
@@ -14591,6 +15308,8 @@ ${privilegedKey}
       applyMigrations: false,
       includeFunctions: false,
       includeWebhooks: false,
+      includeIdentity: false,
+      graphql: { enabled: false },
       startRuntimeServices: false,
       log: quietLog
     });
@@ -14602,24 +15321,36 @@ ${privilegedKey}
     return;
   }
   if (options.command === "doctor") {
+    const config = loadProjectConfig(paths.projectDir, process.env, options.runtimeMode);
     const replication = resolveNativeReplicationOptions(options, paths.databaseEngine);
     const report = liteCapabilities(paths.databaseEngine, replication?.profile);
-    if (paths.databaseEngine === "native" && replication) {
-      if (!paths.dataDir || !existsSync4(join10(paths.dataDir, "PG_VERSION"))) {
-        throw new Error("PowerSync readiness requires an initialized native database; run migrate first");
-      }
-      const engine = await createNativeEngine({ dataDir: paths.dataDir, log: quietLog, replication });
+    report.runtime_mode = config.lite.runtimeMode;
+    if (options.identityModule ?? config.lite.identityModule) {
+      report.identity = { mode: "external", verification: "unverified" };
+    }
+    if (paths.dataDir && existsSync4(join10(paths.dataDir, "PG_VERSION"))) {
+      const engine = paths.databaseEngine === "native" ? await createNativeEngine({ dataDir: paths.dataDir, installDir: options.postgresDir, log: quietLog, replication }) : await createPgliteEngine(paths.dataDir);
       try {
-        report.powersync_readiness = await inspectPowerSyncReadiness(engine, replication);
+        report.graphql = await inspectGraphql(engine);
+        if (replication)
+          report.powersync_readiness = await inspectPowerSyncReadiness(engine, replication);
       } finally {
         await engine.close();
       }
+    } else if (replication) {
+      throw new Error("PowerSync readiness requires an initialized native database; run migrate first");
     }
+    if (config.lite.graphql.enabled === false)
+      report.graphql = { status: "disabled", extension: "pg_graphql" };
     if (options.json)
       await writeStandardOutput(`${JSON.stringify(report, null, 2)}
 `);
     else
       await printDoctor(report);
+    if (config.lite.graphql.enabled === true && report.graphql.status !== "supported")
+      process.exitCode = 1;
+    if (report.powersync_readiness?.ready === false)
+      process.exitCode = 1;
     return;
   }
   if (options.command === "migrate" || options.command === "status") {
@@ -14629,11 +15360,23 @@ ${privilegedKey}
       includeFunctions: false,
       includeWebhooks: false,
       includeSeed: options.command === "migrate",
+      includeIdentity: false,
+      graphql: { enabled: false },
       startRuntimeServices: false,
       log: quietLog
     });
     try {
       const applied = await project2.backend.db.listAppliedMigrations();
+      if (options.json) {
+        await writeStandardOutput(`${JSON.stringify({
+          schema: "supacloud.lite-migrations.v1",
+          command: options.command,
+          applied,
+          binding_attestation: project2.bindingAttestation ?? null
+        }, null, 2)}
+`);
+        return;
+      }
       const output = options.command === "migrate" ? `${applied.length} migration(s) applied.` : applied.length === 0 ? "no migrations applied" : applied.map((migration) => `${migration.version}  ${migration.name ?? ""}`).join(`
 `);
       await writeStandardOutput(`${output}
@@ -14681,6 +15424,8 @@ async function runDbCommand(options) {
       ...options,
       includeFunctions: false,
       includeWebhooks: false,
+      includeIdentity: false,
+      graphql: { enabled: false },
       startRuntimeServices: false,
       log: quietLog
     });
@@ -14693,10 +15438,16 @@ async function runDbCommand(options) {
     }
     return;
   }
-  const project = await loadSupabaseProject(resolve6(options.projectDir ?? process.cwd()));
+  const projectDir = resolve6(options.projectDir ?? process.cwd());
+  const config = loadProjectConfig(projectDir, process.env, options.runtimeMode);
+  const project = await loadSupabaseProject(projectDir, {
+    enabled: false,
+    bindings: options.migrationBindings ?? await loadProjectBindings(projectDir, config)
+  });
   if (subcommand === "diff") {
     const liveEngine = paths.databaseEngine === "native" ? await createNativeEngine({
       dataDir: paths.dataDir,
+      installDir: options.postgresDir,
       log: quietLog,
       replication: resolveNativeReplicationOptions(options, paths.databaseEngine)
     }) : undefined;
@@ -14704,7 +15455,8 @@ async function runDbCommand(options) {
       liveDataDir: paths.databaseEngine === "pglite" ? paths.dataDir : undefined,
       liveEngine,
       migrations: project.migrations,
-      makeShadowEngine: paths.databaseEngine === "native" ? createTemporaryNativeEngine : undefined
+      makeShadowEngine: paths.databaseEngine === "native" ? () => createTemporaryNativeEngine(options.postgresDir) : undefined,
+      runtimeMode: config.lite.runtimeMode
     });
     if (ddl.length === 0) {
       await writeStandardError(`No schema changes found.
@@ -14729,6 +15481,7 @@ async function runDbCommand(options) {
   if (subcommand === "pull") {
     const liveEngine = paths.databaseEngine === "native" ? await createNativeEngine({
       dataDir: paths.dataDir,
+      installDir: options.postgresDir,
       log: quietLog,
       replication: resolveNativeReplicationOptions(options, paths.databaseEngine)
     }) : undefined;
@@ -14736,7 +15489,8 @@ async function runDbCommand(options) {
       liveDataDir: paths.databaseEngine === "pglite" ? paths.dataDir : undefined,
       liveEngine,
       migrations: project.migrations,
-      makeShadowEngine: paths.databaseEngine === "native" ? createTemporaryNativeEngine : undefined,
+      makeShadowEngine: paths.databaseEngine === "native" ? () => createTemporaryNativeEngine(options.postgresDir) : undefined,
+      runtimeMode: config.lite.runtimeMode,
       migrationsDir: join10(paths.projectDir, "supabase", "migrations"),
       name: options.positionals[1] ?? "remote_schema"
     });
@@ -14755,6 +15509,8 @@ async function runDbCommand(options) {
       applyMigrations: false,
       includeFunctions: false,
       includeWebhooks: false,
+      includeIdentity: false,
+      graphql: { enabled: false },
       startRuntimeServices: false,
       log: quietLog
     });
@@ -14795,7 +15551,7 @@ async function runSnapshotCommand(options) {
     const input = options.positionals[1];
     if (!input)
       throw new Error("snapshot restore requires a snapshot file");
-    const result = await restoreSnapshot({ paths, storageBackend, input, force: options.force });
+    const result = await restoreSnapshot({ paths, storageBackend, input, force: options.force, postgresDir: options.postgresDir });
     const rollbackLines = result.rollbackPaths.map((rollbackPath) => `Previous state retained at ${rollbackPath}`);
     const reconnectLine = result.manifest.storageBackend === "s3" ? ["Reconnect the original S3 bucket/prefix before starting Lite."] : [];
     await writeStandardOutput([
@@ -14826,6 +15582,8 @@ async function runUpgradeCommand(options) {
       includeFunctions: false,
       includeWebhooks: false,
       includeSeed: true,
+      includeIdentity: false,
+      graphql: { enabled: false },
       startRuntimeServices: false,
       log: quietLog
     });
@@ -14857,6 +15615,9 @@ async function printInspection(rows) {
 }
 async function printDoctor(report) {
   const output = Object.entries(report).filter(([, value]) => typeof value !== "object").map(([name, value]) => `${name}: ${value}`);
+  output.push(`graphql: ${report.graphql.status} (${report.graphql.version ?? report.graphql.reason ?? "pg_graphql"})`);
+  output.push(`identity: ${report.identity.mode} (${report.identity.verification})`);
+  output.push(`migration_formats: ${report.migrations.formats.join(", ")}`);
   if (report.powersync_readiness) {
     output.push(`powersync_ready: ${report.powersync_readiness.ready}`);
     for (const blocker of report.powersync_readiness.blockers)
@@ -14926,7 +15687,10 @@ Options:
       --replication-tls-cert <p> PostgreSQL TLS certificate
       --replication-tls-key <p> PostgreSQL TLS private key
       --memory            use an in-memory PGlite database
-      --json              emit machine-readable doctor output
+      --json              emit machine-readable doctor/migrate/status output
+      --runtime-mode      development (default) or strict
+      --postgres-dir      operator-managed PostgreSQL installation (native only)
+      --identity-module   trusted external identity bridge module
   -o, --output <p>        output file for gen types
   -f, --file <name>       migration suffix for db diff
       --module-file <p>   database module manifest for db check (default supabase/db/modules.ts)
@@ -14954,4 +15718,4 @@ try {
 `);
   exitCode = 1;
 }
-process.exit(exitCode);
+process.exit(exitCode || Number(process.exitCode ?? 0));