@supacloud/lite 0.13.0 → 0.14.0

package/dist/index.js

@@ -85,7 +85,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.13.0",
+  version: "0.14.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -124,6 +124,8 @@ var package_default = {
     start: "bun run src/cli.ts start",
     test: "bun test --timeout 20000",
     "test:native": "SUPACLOUD_LITE_TEST_NATIVE=1 bun test test/native-engine.test.ts test/qauth-workflow-matrix.test.ts test/maker-checker-workflow.test.ts test/commands-artifacts.test.ts --timeout 180000",
+    "test:graphql": "SUPACLOUD_LITE_TEST_GRAPHQL=1 bun test test/graphql-native.test.ts --timeout 180000",
+    benchmark: "bun run scripts/benchmark.ts",
     parity: "bun run parity/harness.ts",
     "parity:native": "SUPACLOUD_LITE_TEST_NATIVE=1 bun run parity/harness.ts --engine native",
     "check:native": "bun run test:native && bun run parity:native",
@@ -135,13 +137,17 @@ var package_default = {
   },
   dependencies: {
     "@electric-sql/pglite": "0.5.8",
-    "@supacloud/db": "^0.2.0",
+    "@supacloud/db": "^0.6.0",
     tar: "^7.5.22"
   },
   devDependencies: {
+    "@supacloud/app": "^0.11.0",
+    "@supacloud/compiler": "^0.13.1",
+    "@supacloud/elysia": "^0.10.0",
     "@supabase/supabase-js": "^2.115.0",
     "@types/bun": "^1.4.0",
     elysia: "^1.4.30",
+    jose: "^6.2.11",
     typescript: "^7.0.2"
   },
   engines: {
@@ -2788,6 +2794,38 @@ async function upsertWithoutTtl(query, key, serializedValue) {
      on conflict (namespace, key) do update set value = excluded.value, expires_at = null, updated_at = now()`, [CACHE_NAMESPACE, key, serializedValue]);
 }
 
+// src/runtime/functions/profile.ts
+function runtimeMode(value) {
+  if (value === undefined)
+    return "development";
+  if (value !== "development" && value !== "strict")
+    throw new Error("Lite runtime mode must be development or strict");
+  return value;
+}
+function strictFunction(entry) {
+  const limits = {
+    timeoutMs: 900000,
+    maxRequestBodyBytes: 30 * 1024 * 1024,
+    maxResponseBodyBytes: 30 * 1024 * 1024,
+    waitUntilTimeoutMs: 300000,
+    ...entry.limits
+  };
+  for (const [name, value] of Object.entries(limits)) {
+    const maximum = name.includes("Body") ? 30 * 1024 * 1024 : name === "waitUntilTimeoutMs" ? 300000 : 900000;
+    if (!Number.isSafeInteger(value) || value <= 0 || value > maximum) {
+      throw new Error(`invalid strict function limit: ${name}`);
+    }
+  }
+  if (entry.framework !== undefined && !["fetch", "elysia", "hono"].includes(entry.framework)) {
+    throw new Error("invalid strict function framework");
+  }
+  return {
+    ...entry,
+    limits,
+    capabilities: { background: false, ...entry.capabilities }
+  };
+}
+
 // src/runtime/functions/handler.ts
 var VERIFIED_JWT_SUBJECT_HEADER = "x-supacloud-jwt-sub";
 var UNSAFE_VERIFIED_JWT_SUBJECT = /[\u0000-\u001F\u007F-\u009F\u0100-\u{10FFFF}]/u;
@@ -2838,12 +2876,19 @@ class FunctionsHandler {
   functions;
   env;
   pgredis;
-  constructor(functions, env, pgredis) {
+  mode;
+  constructor(functions, env, pgredis, mode = "development") {
     this.functions = functions;
     this.env = env;
     this.pgredis = pgredis;
+    this.mode = mode;
+    if (mode === "strict")
+      for (const entry of functions.values())
+        strictFunction(normalizeEntry(entry));
   }
   register(name, fn) {
+    if (this.mode === "strict")
+      strictFunction(normalizeEntry(fn));
     this.functions.set(name, fn);
   }
   list() {
@@ -2858,7 +2903,7 @@ class FunctionsHandler {
     if (!value) {
       return json2(404, { error: `function "${name}" not found` });
     }
-    const entry = normalizeEntry(value);
+    const entry = this.mode === "strict" ? strictFunction(normalizeEntry(value)) : normalizeEntry(value);
     const limits = entry.limits;
     const capabilities = entry.capabilities;
     const maxBody = limits?.maxRequestBodyBytes;
@@ -3228,14 +3273,17 @@ alter role anon set search_path to "$user", public, extensions;
 alter role authenticated set search_path to "$user", public, extensions;
 alter role service_role set search_path to "$user", public, extensions;
 
-grant usage on schema public to anon, authenticated, service_role;
-grant all on all tables in schema public to anon, authenticated, service_role;
-grant all on all sequences in schema public to anon, authenticated, service_role;
-
-alter default privileges in schema public
-  grant all on tables to anon, authenticated, service_role;
-alter default privileges in schema public
-  grant all on sequences to anon, authenticated, service_role;
+-- Initialize defaults once. Restart/maintenance must not undo application ACLs.
+do $$
+begin
+  if to_regclass('supabase_migrations.schema_migrations') is null then
+    grant usage on schema public to anon, authenticated, service_role;
+    alter default privileges in schema public
+      grant all on tables to anon, authenticated, service_role;
+    alter default privileges in schema public
+      grant all on sequences to anon, authenticated, service_role;
+  end if;
+end $$;
 
 -- PostgreSQL already grants EXECUTE on new functions to PUBLIC. Keep that
 -- default so project migrations can revoke PUBLIC and grant only selected
@@ -5695,7 +5743,9 @@ grant execute on function vault.create_secret(text,text,text,uuid), vault.update
 `;
 
 // src/runtime/db/sql-compat.ts
-function rewriteMigrationSql(sql) {
+function rewriteMigrationSql(sql, strict = false) {
+  if (strict)
+    return sql;
   const out = [];
   const n = sql.length;
   let i = 0;
@@ -5769,6 +5819,8 @@ function rewriteStatement(stmt) {
   const trivia = LEADING_TRIVIA.exec(stmt)?.[0] ?? "";
   const rest = stmt.slice(trivia.length);
   if (/^(?:create|drop)\s+extension\b/i.test(rest)) {
+    if (extensionName(rest) === "pg_graphql")
+      return stmt;
     const semi = rest.lastIndexOf(";");
     const bare = (semi !== -1 && rest.slice(semi + 1).trim() === "" ? rest.slice(0, semi) : rest).trim();
     if (!bare)
@@ -5782,6 +5834,26 @@ function rewriteStatement(stmt) {
   }
   return stmt;
 }
+function extensionName(statement) {
+  let rest = statement;
+  const tokens = [];
+  while (tokens.length < 6) {
+    rest = rest.slice(LEADING_TRIVIA.exec(rest)?.[0].length ?? 0);
+    const token = /^(?:"((?:""|[^"])*)"|([A-Za-z_][A-Za-z_0-9]*))/.exec(rest);
+    if (!token)
+      break;
+    const quoted = token[1];
+    const bare = token[2];
+    if (quoted !== undefined)
+      tokens.push(quoted.replaceAll('""', '"'));
+    else if (bare !== undefined)
+      tokens.push(bare.toLowerCase());
+    else
+      throw new Error("invalid migration SQL token");
+    rest = rest.slice(token[0].length);
+  }
+  return tokens[2] === "if" ? tokens[tokens[3] === "not" ? 5 : 4] : tokens[2];
+}
 function pickTag(text, base) {
   let tag = `$${base}$`;
   let k = 0;
@@ -6043,19 +6115,51 @@ async function removePreparedBundles(cleanup) {
   }
 }
 
+// src/runtime/db/engine.ts
+class Mutex {
+  tail = Promise.resolve();
+  async lock() {
+    let release;
+    const next = new Promise((r) => release = r);
+    const prev = this.tail;
+    this.tail = this.tail.then(() => next);
+    await prev;
+    return release;
+  }
+  async run(fn) {
+    const release = await this.lock();
+    try {
+      return await fn();
+    } finally {
+      release();
+    }
+  }
+}
+
+// src/runtime/validation.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function errorProperty(error, key) {
+  return isRecord(error) ? error[key] : undefined;
+}
+
 // src/runtime/db/database.ts
 var DEFAULT_SEARCH_PATH_SQL = `set search_path to "$user", public, extensions`;
 
 class Database {
   engine;
+  strict;
+  migrationMutex = new Mutex;
   schemaCache = new Map;
   fnCache = new Map;
   cdcListeners = new Set;
   cdcStarting = null;
   cdcStopping = null;
   cdcUnsubscribe = null;
-  constructor(engine) {
+  constructor(engine, strict = false) {
     this.engine = engine;
+    this.strict = strict;
   }
   static async create(dataDirOrEngine, opts) {
     const engine = dataDirOrEngine && typeof dataDirOrEngine === "object" ? dataDirOrEngine : await createPgliteEngine(dataDirOrEngine);
@@ -6074,7 +6178,7 @@ class Database {
           await engine.query(`select set_config('app.settings.vault_key', $1, false)`, [opts.vaultKey]);
         }
       }
-      return new Database(engine);
+      return new Database(engine, opts?.strict);
     } catch (error) {
       try {
         await engine.close();
@@ -6101,16 +6205,48 @@ class Database {
     });
   }
   async runMigrations(migrations, seedSql) {
+    return this.migrationMutex.run(() => this.applyMigrations(migrations, seedSql));
+  }
+  async applyMigrations(migrations, seedSql) {
     const applied = [];
     const sorted = [...migrations].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    const versions = new Set;
+    const history = await this.engine.query("select version, statements from supabase_migrations.schema_migrations");
+    const recorded = new Map;
+    for (const row of history.rows) {
+      if (!isRecord(row) || typeof row["version"] !== "string")
+        throw new Error("invalid migration history record");
+      const statements = row["statements"];
+      if (statements !== null && (!Array.isArray(statements) || !statements.every((sql) => typeof sql === "string"))) {
+        throw new Error(`invalid migration history SQL: ${row["version"]}`);
+      }
+      recorded.set(row["version"], statements);
+    }
+    for (const migration of sorted) {
+      const version = migration.name.match(/^(\d+)/)?.[1] ?? migration.name;
+      if (versions.has(version))
+        throw new Error(`duplicate migration version: ${version}`);
+      versions.add(version);
+    }
+    for (const migration of sorted) {
+      const version = migration.name.match(/^(\d+)/)?.[1] ?? migration.name;
+      if (recorded.has(version)) {
+        const statements = recorded.get(version);
+        if (!statements?.length)
+          throw new Error(`migration history has no verifiable SQL: ${version}`);
+        if (statements.join(`
+`) !== migration.sql) {
+          throw new Error(`applied migration content mismatch: ${version}; add a forward migration instead`);
+        }
+      }
+    }
     for (const m of sorted) {
       const version = m.name.match(/^(\d+)/)?.[1] ?? m.name;
-      const seen = await this.engine.query(`select 1 from supabase_migrations.schema_migrations where version = $1`, [version]);
-      if (seen.rows.length > 0)
+      if (recorded.has(version))
         continue;
       const applyMigration = () => this.engine.transaction(async (tx) => {
         await tx.exec(DEFAULT_SEARCH_PATH_SQL);
-        await tx.exec(rewriteMigrationSql(m.sql));
+        await tx.exec(rewriteMigrationSql(m.sql, this.strict));
         await tx.query(`insert into supabase_migrations.schema_migrations (version, name, statements)
              values ($1, $2, $3)`, [version, m.name, [m.sql]]);
       });
@@ -6132,7 +6268,7 @@ class Database {
       if (seen.rows.length === 0) {
         await this.engine.transaction(async (tx) => {
           await tx.exec(DEFAULT_SEARCH_PATH_SQL);
-          await tx.exec(rewriteMigrationSql(seedSql));
+          await tx.exec(rewriteMigrationSql(seedSql, this.strict));
           await tx.query(`insert into supabase_migrations.seed_files (path, hash) values ('supabase/seed.sql', $1)
              on conflict (path) do update set hash = excluded.hash, applied_at = now()`, [hash]);
         });
@@ -6429,19 +6565,23 @@ async function sha256Hex2(text) {
 class RealtimeEngine {
   db;
   jwtSecret;
+  resolveExternalToken;
   connections = new Set;
   bindingCounter = 1;
   phxRefCounter = 1;
   presence = new Map;
   stopCdc = null;
   stopDbBroadcast = null;
-  constructor(db, jwtSecret) {
+  constructor(db, jwtSecret, resolveExternalToken) {
     this.db = db;
     this.jwtSecret = jwtSecret;
+    this.resolveExternalToken = resolveExternalToken;
   }
   async contextFromToken(token) {
     if (!token || !this.jwtSecret)
       return { role: "anon", claims: null };
+    if (this.resolveExternalToken)
+      return this.resolveExternalToken(token);
     const claims = await verifyJwt(token, this.jwtSecret);
     if (!claims)
       return { role: "anon", claims: null };
@@ -6501,8 +6641,11 @@ class RealtimeEngine {
     const stopDbBroadcast = this.stopDbBroadcast;
     this.stopCdc = null;
     this.stopDbBroadcast = null;
-    for (const conn of this.connections)
+    for (const conn of this.connections) {
+      for (const topic of conn.channels.keys())
+        this.leaveChannel(conn, topic);
       conn.socket.close(1001, "server shutting down");
+    }
     this.connections.clear();
     const [cdcStop, broadcastStop] = await Promise.allSettled([
       Promise.resolve().then(() => stopCdc?.()),
@@ -6580,13 +6723,29 @@ class RealtimeEngine {
           break;
         case "access_token":
           {
-            const ctx = await this.contextFromToken(msg.payload?.access_token);
-            const channel = conn.channels.get(msg.topic);
-            if (channel)
-              channel.ctx = ctx;
-            else
-              for (const c of conn.channels.values())
-                c.ctx = ctx;
+            const selected = conn.channels.get(msg.topic);
+            const channels = selected ? [selected] : [...conn.channels.values()];
+            try {
+              const token = msg.payload?.access_token;
+              if (token !== undefined && typeof token !== "string")
+                throw new Error("Invalid Realtime access token");
+              const ctx = await this.contextFromToken(token);
+              for (const channel of channels) {
+                if (this.resolveExternalToken && channel.private) {
+                  const access = await this.authorizePrivate(channel.topic.replace(/^realtime:/, ""), ctx);
+                  if (!access.read)
+                    throw new Error("Realtime authentication denied");
+                  channel.canBroadcast = access.write;
+                }
+                channel.ctx = ctx;
+                this.scheduleExternalExpiry(conn, channel);
+              }
+            } catch (error) {
+              if (this.resolveExternalToken)
+                for (const channel of channels)
+                  this.leaveChannel(conn, channel.topic);
+              throw error;
+            }
           }
           break;
         default:
@@ -6598,7 +6757,10 @@ class RealtimeEngine {
   }
   async handleJoin(conn, msg) {
     const config = msg.payload?.config ?? {};
-    const ctx = await this.contextFromToken(msg.payload?.access_token);
+    const token = msg.payload?.access_token;
+    if (token !== undefined && typeof token !== "string")
+      throw new Error("Invalid Realtime access token");
+    const ctx = await this.contextFromToken(token);
     const isPrivate = config.private === true;
     let canBroadcast = true;
     if (isPrivate && !this.db.engine.minimalBootstrap) {
@@ -6650,7 +6812,10 @@ class RealtimeEngine {
       private: isPrivate,
       canBroadcast
     };
+    if (this.resolveExternalToken)
+      this.leaveChannel(conn, msg.topic);
     conn.channels.set(msg.topic, channel);
+    this.scheduleExternalExpiry(conn, channel);
     this.reply(conn, msg, "ok", {
       postgres_changes: bindings.map((b) => ({
         id: b.id,
@@ -6685,6 +6850,8 @@ class RealtimeEngine {
     const channel = conn.channels.get(topic);
     if (!channel)
       return;
+    if (channel.expiryTimer)
+      clearTimeout(channel.expiryTimer);
     conn.channels.delete(topic);
     const state = this.presence.get(topic);
     if (state?.has(channel.presenceKey)) {
@@ -6700,6 +6867,20 @@ class RealtimeEngine {
       });
     }
   }
+  scheduleExternalExpiry(conn, channel) {
+    if (channel.expiryTimer)
+      clearTimeout(channel.expiryTimer);
+    const expires = channel.ctx.claims?.exp;
+    if (!this.resolveExternalToken || typeof expires !== "number")
+      return;
+    channel.expiryTimer = setTimeout(() => {
+      if (expires * 1000 > Date.now())
+        return this.scheduleExternalExpiry(conn, channel);
+      this.leaveChannel(conn, channel.topic);
+      this.send(conn, { topic: channel.topic, event: "phx_error", payload: { reason: "token expired" }, ref: null });
+    }, Math.max(0, Math.min(expires * 1000 - Date.now(), 2147483647)));
+    channel.expiryTimer.unref?.();
+  }
   handleBinary(conn, bytes) {
     if (bytes.length < 7 || bytes[0] !== 3)
       return;
@@ -10237,6 +10418,208 @@ function assertSecretsSafe(input) {
     warn("\u26A0 Vault key derived from the JWT secret - set an independent vaultKey before exposing this server.");
   }
 }
+
+// src/runtime/graphql.ts
+async function inspectGraphql(engine) {
+  const result = await engine.query(`
+    select e.extversion, exists (
+      select 1 from pg_proc p
+      join pg_namespace n on n.oid = p.pronamespace
+      join pg_depend d on d.classid = 'pg_proc'::regclass and d.objid = p.oid
+        and d.refclassid = 'pg_extension'::regclass and d.refobjid = e.oid and d.deptype = 'e'
+      where n.nspname = 'graphql' and p.proname = 'resolve' and not p.prosecdef
+        and p.oid = to_regprocedure('graphql.resolve(text,jsonb,text,jsonb)')
+    ) as resolver from pg_extension e where e.extname = 'pg_graphql'
+  `);
+  const row = result.rows[0];
+  if (row === undefined) {
+    return { status: "unsupported", extension: "pg_graphql", reason: "PG_GRAPHQL_NOT_INSTALLED" };
+  }
+  if (!isRecord(row) || typeof row["extversion"] !== "string" || !row["extversion"] || typeof row["resolver"] !== "boolean" || result.rows.length !== 1) {
+    return { status: "unsupported", extension: "pg_graphql", reason: "PG_GRAPHQL_INVALID_CATALOG" };
+  }
+  const version = row["extversion"];
+  if (row["resolver"]) {
+    try {
+      const probe = await engine.query(`select graphql.resolve('{ __typename }', '{}'::jsonb, null, '{}'::jsonb) as result`);
+      const probeRow = probe.rows[0];
+      if (probe.rows.length !== 1 || !isRecord(probeRow) || !isGraphqlEnvelope(probeRow["result"])) {
+        throw new Error("Invalid GraphQL probe response");
+      }
+    } catch {
+      return { status: "unsupported", extension: "pg_graphql", version, reason: "PG_GRAPHQL_RESOLVER_FAILED" };
+    }
+  }
+  return row["resolver"] ? { status: "supported", extension: "pg_graphql", version } : {
+    status: "unsupported",
+    extension: "pg_graphql",
+    reason: "PG_GRAPHQL_RESOLVER_UNAVAILABLE"
+  };
+}
+
+class GraphqlHandler {
+  db;
+  capability;
+  schemas;
+  maxBytes;
+  timeoutMs;
+  constructor(db, capability, options = {}, schemas = ["public"]) {
+    this.db = db;
+    this.capability = capability;
+    this.schemas = schemas;
+    this.maxBytes = positive(options.maxRequestBodyBytes ?? 1024 * 1024);
+    this.timeoutMs = positive(options.statementTimeoutMs ?? 30000);
+  }
+  async handle(request, context) {
+    if (this.capability.status !== "supported") {
+      return response(this.capability.status === "disabled" ? 404 : 501, {
+        errors: [{
+          message: "GraphQL requires the real pg_graphql extension and graphql.resolve.",
+          extensions: { code: this.capability.reason ?? "GRAPHQL_DISABLED" }
+        }]
+      });
+    }
+    if (request.method !== "POST")
+      return response(405, { errors: [{ message: "Use POST for GraphQL requests." }] }, { allow: "POST" });
+    try {
+      if (request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json") {
+        throw new ApiError(415, { message: "GraphQL requests require application/json" });
+      }
+      const body = JSON.parse(await boundedBody(request, this.maxBytes));
+      if (!isObject(body) || typeof body.query !== "string" || !body.query.trim() || body.variables != null && !isObject(body.variables) || body.extensions != null && !isObject(body.extensions) || body.operationName != null && typeof body.operationName !== "string") {
+        throw new ApiError(400, { message: "Invalid GraphQL request" });
+      }
+      const result = await this.db.withContext(context, async (query) => {
+        await query(`select set_config('statement_timeout', $1, true)`, [String(this.timeoutMs)]);
+        await query(`select set_config('search_path', $1, true)`, [
+          this.schemas.map((schema) => `"${schema.replaceAll('"', '""')}"`).join(",")
+        ]);
+        return query("select graphql.resolve($1::text, $2::jsonb, $3::text, $4::jsonb) as result", [body.query, JSON.stringify(body.variables ?? {}), body.operationName ?? null, JSON.stringify(body.extensions ?? {})]);
+      });
+      const row = result.rows[0];
+      if (result.rows.length !== 1 || !isRecord(row) || !isGraphqlEnvelope(row["result"])) {
+        throw new Error("Invalid GraphQL resolver response");
+      }
+      return response(200, row["result"]);
+    } catch (error) {
+      if (error instanceof ApiError)
+        return response(error.status, { errors: [{ message: error.message }] });
+      if (error instanceof SyntaxError)
+        return response(400, { errors: [{ message: "Invalid JSON request" }] });
+      const code = errorProperty(error, "errno") ?? errorProperty(error, "code");
+      const status = code === "42501" ? 403 : code === "57014" ? 504 : 500;
+      return response(status, { errors: [{
+        message: "GraphQL execution failed",
+        extensions: { code: status === 403 ? "GRAPHQL_ACCESS_DENIED" : status === 504 ? "GRAPHQL_TIMEOUT" : "GRAPHQL_EXECUTION_FAILED" }
+      }] });
+    }
+  }
+}
+async function boundedBody(request, limit) {
+  if (Number(request.headers.get("content-length")) > limit)
+    throw new ApiError(413, { message: "GraphQL request too large" });
+  const reader = request.body?.getReader();
+  if (!reader)
+    throw new ApiError(400, { message: "GraphQL request body required" });
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done)
+        break;
+      size += chunk.value.byteLength;
+      if (size > limit) {
+        await reader.cancel().catch(() => {});
+        throw new ApiError(413, { message: "GraphQL request too large" });
+      }
+      chunks.push(chunk.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isGraphqlEnvelope(value) {
+  if (!isRecord(value) || !("data" in value) && !("errors" in value))
+    return false;
+  if ("data" in value && value["data"] !== null && !isRecord(value["data"]))
+    return false;
+  if ("extensions" in value && !isRecord(value["extensions"]))
+    return false;
+  if ("errors" in value) {
+    const errors = value["errors"];
+    if (!Array.isArray(errors) || errors.length === 0 || !errors.every((error) => isRecord(error) && typeof error["message"] === "string"))
+      return false;
+  }
+  return true;
+}
+function positive(value) {
+  if (!Number.isSafeInteger(value) || value <= 0 || value > 2147483647)
+    throw new Error("GraphQL limits must be positive bounded integers");
+  return value;
+}
+function response(status, body, headers = {}) {
+  return Response.json(body, { status, headers: { "cache-control": "no-store", ...headers } });
+}
+
+// src/runtime/identity.ts
+function validateExternalIdentityClaims(value) {
+  if (!isRecord(value) || value["role"] !== "authenticated" || typeof value["sub"] !== "string" || !value["sub"] || typeof value["exp"] !== "number" || !Number.isSafeInteger(value["exp"]) || value["exp"] * 1000 <= Date.now()) {
+    throw new ApiError(401, { message: "Invalid external identity" });
+  }
+  for (const key of ["iss", "aud", "email"]) {
+    if (key in value && typeof value[key] !== "string")
+      throw new ApiError(401, { message: "Invalid external identity" });
+  }
+  if ("iat" in value && (typeof value["iat"] !== "number" || !Number.isSafeInteger(value["iat"])) || "aal" in value && value["aal"] !== "aal1" && value["aal"] !== "aal2" || "amr" in value && (!Array.isArray(value["amr"]) || !value["amr"].every((entry) => isRecord(entry) && typeof entry["method"] === "string" && typeof entry["timestamp"] === "number" && Number.isFinite(entry["timestamp"])))) {
+    throw new ApiError(401, { message: "Invalid external identity" });
+  }
+  return value;
+}
+function createSupAuthLiteIdentity(options) {
+  if (!options.projectId.trim())
+    throw new Error("SupAuth Lite projectId is required");
+  return async (request) => {
+    try {
+      const context = await options.context(request);
+      const { identity, access } = context;
+      if (identity.authenticated !== true || !identity.subject || !identity.clientId || new URL(identity.issuer).protocol !== "https:" || access.projectId !== options.projectId || !access.tenantId || !Array.isArray(access.permissions) || access.permissions.some((value) => typeof value !== "string" || !value.trim())) {
+        throw new ApiError(403, { message: "Application access denied" });
+      }
+      const subject = await options.resolveLocalSubject(identity);
+      if (!subject || !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(subject)) {
+        throw new ApiError(403, { message: "External identity has no local subject mapping" });
+      }
+      const bearer = request.headers.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1];
+      const payload = bearer ? decodeJwt(bearer) : null;
+      if (typeof payload?.exp !== "number" || !Number.isSafeInteger(payload.exp) || payload.exp * 1000 <= Date.now()) {
+        throw new ApiError(401, { message: "External identity expired" });
+      }
+      return {
+        role: "authenticated",
+        sub: subject,
+        external_sub: identity.subject,
+        iss: identity.issuer,
+        client_id: identity.clientId,
+        exp: payload.exp,
+        project_id: access.projectId,
+        tenant_id: access.tenantId,
+        permissions: [...new Set(access.permissions)]
+      };
+    } catch (error) {
+      if (error instanceof ApiError)
+        throw error;
+      const status = errorProperty(error, "status");
+      throw new ApiError(status === 401 || status === 403 ? status : 503, {
+        message: status === 401 ? "Authentication required" : status === 403 ? "Application access denied" : "Identity verification unavailable"
+      });
+    }
+  };
+}
 // src/runtime/gen-types.ts
 var JSON_TYPE = "Json";
 async function generateTypes(db, schema = "public") {
@@ -10488,6 +10871,7 @@ var CORS_HEADERS = {
   "access-control-max-age": "86400"
 };
 async function createBackend(config = {}) {
+  const mode = runtimeMode(config.runtimeMode);
   const jwtSecret = config.jwtSecret ?? randomSecret();
   const apiUrl = config.apiUrl ?? "http://localhost:54321";
   const siteUrl = config.siteUrl ?? apiUrl;
@@ -10502,7 +10886,7 @@ async function createBackend(config = {}) {
   const vaultKey = config.vaultKey ?? `supacloud-lite-vault:${jwtSecret}`;
   assertSecretsSafe({ host: config.host, jwtSecret, vaultKeyDerived, warn: log });
   const engine = config.engine;
-  const db = await Database.create(engine ?? config.dataDir, { vaultKey });
+  const db = await Database.create(engine ?? config.dataDir, { vaultKey, strict: mode === "strict" });
   const cleanup = [];
   const failStartup = async (e) => {
     for (const fn of cleanup.reverse())
@@ -10519,6 +10903,11 @@ async function createBackend(config = {}) {
   } catch (e) {
     await failStartup(e);
   }
+  const graphqlCapability = config.graphql?.enabled === false ? { status: "disabled", extension: "pg_graphql" } : await inspectGraphql(db.engine).catch(failStartup);
+  if (config.graphql?.enabled === true && graphqlCapability.status !== "supported") {
+    await failStartup(new Error(`${graphqlCapability.reason}: GraphQL requires an installed pg_graphql extension with graphql.resolve; PGlite and stock native binaries do not bundle it`));
+  }
+  const graphql = await Promise.resolve().then(() => new GraphqlHandler(db, graphqlCapability, config.graphql, config.dbSchemas)).catch(failStartup);
   const pgredis = await PgredisCache.create(db).catch(failStartup);
   const { anonKey, serviceRoleKey } = await mintProjectApiKeys(jwtSecret);
   const exposedSchemas = [...new Set(config.dbSchemas ?? ["public", "pgmq_public"])];
@@ -10559,7 +10948,13 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     rateLimiter: new RateLimiter(config.authRateLimits)
   });
   cleanup.push(() => auth.stop());
-  const realtime = new RealtimeEngine(db, jwtSecret);
+  const realtime = new RealtimeEngine(db, jwtSecret, config.externalIdentity ? async (token) => {
+    const request = new Request(`${apiUrl}/realtime/v1`, { headers: { authorization: `Bearer ${token}` } });
+    const context = await resolveContext(request, new URL(request.url));
+    if (context instanceof Response)
+      throw new Error("Realtime authentication denied");
+    return context;
+  } : undefined);
   const webhooks = new WebhooksService(db, config.webhookFetch, (d) => log(`[webhook] ${d.event.type} ${d.event.schema}.${d.event.table} -> ${d.webhook.url} ${d.ok ? d.status : "FAILED " + (d.error ?? "")}`), isNetworkExposed(config.host));
   const cron = new CronService(db);
   const retention = new RetentionService(db, config.retention);
@@ -10594,7 +10989,7 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
   } catch (error) {
     await failStartup(error);
   }
-  const functions = new FunctionsHandler(fnMap, fnEnv, pgredis);
+  const functions = await Promise.resolve().then(() => new FunctionsHandler(fnMap, fnEnv, pgredis, mode)).catch(failStartup);
   async function resolveContext(req, url) {
     const authz = req.headers.get("authorization");
     const bearer = authz?.toLowerCase().startsWith("bearer ") ? authz.slice(7) : null;
@@ -10605,7 +11000,15 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
         headers: { "content-type": "application/json" }
       }));
     }
-    const claims = await verifyJwt(token, jwtSecret);
+    let claims = await verifyJwt(token, jwtSecret);
+    if (config.externalIdentity && token !== anonKey && token !== serviceRoleKey) {
+      try {
+        claims = validateExternalIdentityClaims(await config.externalIdentity(req));
+      } catch (error) {
+        const status = error instanceof ApiError && [401, 403, 503].includes(error.status) ? error.status : 503;
+        return withCors(Response.json({ message: status === 503 ? "Identity verification unavailable" : "External access denied" }, { status }));
+      }
+    }
     if (!claims) {
       return withCors(new Response(JSON.stringify({ message: "Invalid API key" }), {
         status: 401,
@@ -10647,7 +11050,7 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
         return withCors(await storage.handle(req, { role: "anon", claims: null }, url));
       }
     }
-    if (config.authEnabled === false && path.startsWith("/auth/v1")) {
+    if ((config.authEnabled === false || config.externalIdentity) && path.startsWith("/auth/v1")) {
       return withCors(new Response(JSON.stringify({ message: "Auth service is disabled" }), {
         status: 404,
         headers: { "content-type": "application/json" }
@@ -10679,6 +11082,8 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
       return ctx;
     if (path.startsWith("/rest/v1"))
       return withCors(await rest.handle(req, ctx, url));
+    if (path === "/graphql/v1" || path === "/graphql/v1/")
+      return withCors(await graphql.handle(req, ctx));
     if (path.startsWith("/functions/v1"))
       return withCors(await functions.handle(req, ctx, url));
     if (path.startsWith("/storage/v1"))
@@ -10723,6 +11128,7 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     return loggedFetch(request);
   }, { preconnect: fetch.preconnect });
   return {
+    graphql: graphqlCapability,
     fetch: publicFetch,
     db,
     realtime,
@@ -10737,7 +11143,16 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     logs,
     inbox,
     smsInbox,
-    migrate: (migrations, seedSql) => db.runMigrations(migrations, seedSql),
+    migrate: async (migrations, seedSql) => {
+      const applied = await db.runMigrations(migrations, seedSql);
+      if (config.graphql?.enabled !== false) {
+        const capability = await inspectGraphql(db.engine);
+        delete graphqlCapability.version;
+        delete graphqlCapability.reason;
+        Object.assign(graphqlCapability, capability);
+      }
+      return applied;
+    },
     close: () => {
       closePromise ??= (async () => {
         let firstError;
@@ -11245,12 +11660,19 @@ class PgWireClient {
   onNotification = null;
   static async connect(opts) {
     const client = new PgWireClient;
-    await client.open(opts);
+    try {
+      await client.open(opts);
+    } catch (error) {
+      client.socket.destroy();
+      throw error;
+    }
     return client;
   }
   open(opts) {
     return new Promise((resolve3, reject) => {
+      let startupComplete = false;
       this.socket = opts.socketPath ? createConnection(opts.socketPath) : createConnection(opts.port ?? 5432, opts.host ?? "127.0.0.1");
+      this.socket.setTimeout(1e4, () => this.socket.destroy(new Error("PostgreSQL handshake timed out")));
       this.socket.on("error", (e) => {
         if (this.pending)
           this.pending.reject(e);
@@ -11259,6 +11681,8 @@ class PgWireClient {
       this.socket.on("close", () => {
         this.closed = true;
         this.pending?.reject(new Error("connection closed"));
+        if (!startupComplete)
+          reject(new Error("connection closed during PostgreSQL handshake"));
       });
       this.socket.on("connect", () => {
         const params = `user\x00${opts.user}\x00database\x00${opts.database}\x00client_encoding\x00UTF8\x00\x00`;
@@ -11342,6 +11766,8 @@ class PgWireClient {
             reject(new PgWireError(parseErrorFields(payload)));
             return;
           } else if (type === 90) {
+            startupComplete = true;
+            this.socket.setTimeout(0);
             this.socket.off("data", startupHandler);
             this.socket.on("data", (c) => {
               this.buffer = Buffer.concat([this.buffer, c]);
@@ -11619,27 +12045,6 @@ function parsePgArray(text) {
   return out;
 }
 
-// src/runtime/db/engine.ts
-class Mutex {
-  tail = Promise.resolve();
-  async lock() {
-    let release;
-    const next = new Promise((r) => release = r);
-    const prev = this.tail;
-    this.tail = this.tail.then(() => next);
-    await prev;
-    return release;
-  }
-  async run(fn) {
-    const release = await this.lock();
-    try {
-      return await fn();
-    } finally {
-      release();
-    }
-  }
-}
-
 // src/runtime/node/native/wire-engine.ts
 async function buildWireEngine(options) {
   const queryClient = await options.connect();
@@ -11678,9 +12083,9 @@ async function buildWireEngine(options) {
       return queryMutex.run(async () => {
         await queryClient.exec("begin");
         try {
-          const response = await callback(transactionClient);
+          const response2 = await callback(transactionClient);
           await queryClient.exec("commit");
-          return response;
+          return response2;
         } catch (error) {
           await queryClient.exec("rollback").catch(() => {});
           throw error;
@@ -11752,6 +12157,14 @@ function toPgArrayLiteral(array) {
 var DEFAULT_PG_VERSION = "17.7.0";
 var POSTGRES_MIRROR_URL_ERROR = "SUPACLOUD_LITE_POSTGRES_MIRROR must be an absolute HTTPS URL or a loopback HTTP URL";
 var NATIVE_POSTGRES_MAJOR = DEFAULT_PG_VERSION.split(".")[0];
+function nativePostgresMajor(installDir = process.env.SUPACLOUD_LITE_POSTGRES_DIR) {
+  if (!installDir)
+    return NATIVE_POSTGRES_MAJOR;
+  const version = execFileSync(join2(installDir, "bin", "postgres"), ["--version"], { encoding: "utf8", timeout: 1e4 }).match(/PostgreSQL\)\s+(\d+)/)?.[1];
+  if (!version)
+    throw new Error("unable to identify the PostgreSQL installation major version");
+  return version;
+}
 var GLIBC_DYNAMIC_LOADERS = {
   x64: [
     "/lib64/ld-linux-x86-64.so.2",
@@ -11901,10 +12314,10 @@ async function fetchRelease(url) {
   let lastError;
   for (let attempt = 1;attempt <= 3; attempt++) {
     try {
-      const response = await fetch(url);
-      if (response.ok || response.status < 500)
-        return response;
-      lastError = new Error(`failed to download ${url}: HTTP ${response.status}`);
+      const response2 = await fetch(url, { signal: AbortSignal.timeout(30000) });
+      if (response2.ok || response2.status < 500)
+        return response2;
+      lastError = new Error(`failed to download ${url}: HTTP ${response2.status}`);
     } catch (error) {
       lastError = error;
     }
@@ -11930,8 +12343,16 @@ async function createNativeEngine(opts) {
   let postgres;
   let removeExitHandler;
   try {
-    const installDir = await ensurePostgres(opts.version, opts.cacheDir, opts.log, opts.downloadMirror);
+    const installDir = opts.installDir ?? process.env.SUPACLOUD_LITE_POSTGRES_DIR ?? await ensurePostgres(opts.version, opts.cacheDir, opts.log, opts.downloadMirror);
     const bin = (name) => join2(installDir, "bin", name);
+    if (!existsSync2(bin("postgres")) || !existsSync2(bin("initdb"))) {
+      throw new Error("PostgreSQL installation requires bin/postgres and bin/initdb");
+    }
+    const serverVersion = nativePostgresMajor(installDir);
+    const storedMajor = existsSync2(join2(opts.dataDir, "PG_VERSION")) ? readFileSync(join2(opts.dataDir, "PG_VERSION"), "utf8").trim() : undefined;
+    if (!serverVersion || storedMajor && storedMajor !== serverVersion) {
+      throw new Error("PostgreSQL installation major version does not match the data directory; use a logical migration");
+    }
     if (!existsSync2(join2(opts.dataDir, "PG_VERSION"))) {
       mkdirSync(opts.dataDir, { recursive: true });
       try {
@@ -12051,8 +12472,16 @@ function removeStalePidFile(pidPath) {
 }
 // src/runtime/node/native/readiness.ts
 function liteCapabilities(engine, replicationProfile) {
+  const common = {
+    graphql: { status: "unverified", extension: "pg_graphql", reason: "DATABASE_NOT_INSPECTED" },
+    runtime_mode: "development",
+    identity: { mode: "local", verification: "built-in" },
+    migrations: { formats: ["flat-sql", "timestamp-folder"], content_check: "supported", target_bindings: "supported" },
+    project_release_manifests: "unsupported"
+  };
   if (engine === "pglite") {
     return {
+      ...common,
       engine,
       state_machine_sql: "supported",
       durable_workflows: "supported",
@@ -12064,6 +12493,7 @@ function liteCapabilities(engine, replicationProfile) {
     };
   }
   return {
+    ...common,
     engine,
     state_machine_sql: "supported",
     durable_workflows: "supported",
@@ -12279,8 +12709,9 @@ function sameStrings(left, right) {
   return left.length === right.length && left.every((value, index) => value === right[index]);
 }
 // src/project-runtime.ts
-import { chmod, link, lstat, mkdir as mkdir4, readFile as readFile6, realpath as realpath2, unlink as unlink2, writeFile as writeFile4 } from "fs/promises";
+import { chmod, link, lstat as lstat2, mkdir as mkdir4, readFile as readFile6, realpath as realpath2, unlink as unlink2, writeFile as writeFile4 } from "fs/promises";
 import { dirname as dirname4, isAbsolute, join as join7, parse, relative, resolve as resolve3 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
 
 // src/runtime/node/config-toml.ts
 import { readFileSync as readFileSync2 } from "fs";
@@ -12429,16 +12860,51 @@ function getByteSize(table, key) {
 }
 
 // src/runtime/node/load-config.ts
-function loadProjectConfig(projectDir, env = process.env) {
+function loadProjectConfig(projectDir, env = process.env, modeOverride) {
   const root = loadConfigToml(projectDir, env);
+  const mode = runtimeMode(modeOverride ?? env.SUPACLOUD_LITE_RUNTIME_MODE ?? getString(tableAt(root, "lite"), "runtime_mode"));
   return {
+    lite: readLite(root, mode),
     auth: readAuth(root, env),
     api: readApi(root),
     storage: readStorage(root),
     seed: readSeed(root),
-    functions: readFunctions(root)
+    functions: readFunctions(root, mode)
   };
 }
+function readLite(root, mode) {
+  const graphql = tableAt(root, "lite.graphql");
+  const bindings = tableAt(root, "lite.migration_bindings");
+  const out = {
+    runtimeMode: mode,
+    graphql: {
+      enabled: getBool(graphql, "enabled"),
+      maxRequestBodyBytes: getInt(graphql, "max_request_body_bytes"),
+      statementTimeoutMs: getInt(graphql, "statement_timeout_ms")
+    },
+    identityModule: getString(tableAt(root, "lite.identity"), "module")
+  };
+  for (const key of ["max_request_body_bytes", "statement_timeout_ms"]) {
+    const value = graphql?.values.get(key);
+    if (value !== undefined && (typeof value !== "string" || !/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) <= 0)) {
+      throw new Error(`invalid GraphQL option: ${key}`);
+    }
+  }
+  if (graphql?.values.has("enabled") && getBool(graphql, "enabled") === undefined)
+    throw new Error("invalid GraphQL enabled option");
+  const identity = tableAt(root, "lite.identity");
+  if (identity && !out.identityModule)
+    throw new Error("Lite identity configuration requires a module");
+  if (bindings) {
+    const manifest = getString(bindings, "manifest");
+    const environment = getString(bindings, "environment");
+    const projectRef = getString(bindings, "project_ref");
+    if (!manifest || !environment || !projectRef)
+      throw new Error("Lite migration bindings require manifest, environment and project_ref");
+    out.migrationBindings = { manifest, environment, projectRef };
+  }
+  return out;
+}
 function readAuth(root, env) {
   const auth = tableAt(root, "auth");
   const out = { settings: readAuthSettings(root), oauthProviders: readOAuthProviders(root, env) };
@@ -12634,7 +13100,7 @@ function readSeed(root) {
     out.paths = paths;
   return out;
 }
-function readFunctions(root) {
+function readFunctions(root, mode) {
   const fns = tableAt(root, "functions");
   const out = {};
   if (!fns)
@@ -12655,9 +13121,29 @@ function readFunctions(root) {
       if (framework === "fetch" || framework === "elysia" || framework === "hono") {
         opts.framework = framework;
       } else {
+        if (mode === "strict")
+          throw new Error(`invalid framework for function "${name}"`);
         console.warn(`  warning: [functions.${name}] framework "${framework}" is not one of fetch/elysia/hono; falling back to fetch`);
       }
     }
+    if (mode === "strict") {
+      for (const key of ["timeout_ms", "max_request_body_bytes", "max_response_body_bytes", "wait_until_timeout_ms"]) {
+        if (t.values.has(key)) {
+          const value = t.values.get(key);
+          if (typeof value !== "string" || !/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) <= 0) {
+            throw new Error(`invalid strict function limit: ${name}.${key}`);
+          }
+        }
+      }
+      for (const key of ["background", "enabled", "verify_jwt"]) {
+        if (t.values.has(key) && getBool(t, key) === undefined)
+          throw new Error(`invalid strict function option: ${name}.${key}`);
+      }
+      for (const key of ["secrets", "outbound_hosts"]) {
+        if (t.values.has(key) && getStringArray(t, key) === undefined)
+          throw new Error(`invalid strict function option: ${name}.${key}`);
+      }
+    }
     const timeoutMs = getInt(t, "timeout_ms");
     if (timeoutMs !== undefined && timeoutMs > 0)
       opts.timeoutMs = timeoutMs;
@@ -12738,8 +13224,9 @@ function remotePlugin() {
 async function bundleFunction(entryPath, name) {
   const outDir = join4(tmpdir2(), "supacloud-lite-fn-bundle", name);
   await mkdir3(outDir, { recursive: true });
+  let buildOutput;
   try {
-    const buildOutput = await Bun.build({
+    buildOutput = await Bun.build({
       entrypoints: [entryPath],
       format: "esm",
       target: "bun",
@@ -12747,6 +13234,18 @@ async function bundleFunction(entryPath, name) {
       naming: `${name}-[hash].[ext]`,
       plugins: [remotePlugin()]
     });
+  } catch (buildThrow) {
+    const details = buildThrow instanceof AggregateError ? buildThrow.errors.map((item) => item?.message ?? String(item)).filter(Boolean).join(`
+`) : buildThrow instanceof Error ? buildThrow.message : String(buildThrow);
+    try {
+      await rm2(outDir, { recursive: true, force: true });
+    } catch (cleanupError) {
+      throw new AggregateError([buildThrow, cleanupError], `failed to clean function bundle directory ${outDir}`);
+    }
+    throw new Error(`failed to bundle ${entryPath}
+${details}`, { cause: buildThrow });
+  }
+  try {
     if (!buildOutput.success || buildOutput.outputs.length === 0) {
       throw new Error(buildOutput.logs.map((item) => item.message).join(`
 `) || `failed to bundle ${entryPath}`);
@@ -12790,16 +13289,18 @@ async function loadFunctionEnv(projectDir) {
   return env;
 }
 var FUNCTION_FRAMEWORKS = new Set(["fetch", "elysia", "hono"]);
-function resolveFramework(name, value) {
+function resolveFramework(name, value, mode) {
   if (value === undefined)
     return;
   if (FUNCTION_FRAMEWORKS.has(value))
     return value;
+  if (mode === "strict")
+    throw new Error(`invalid framework for function "${name}"`);
   console.warn(`  warning: function "${name}" has unsupported framework "${value}", expected one of fetch/elysia/hono; falling back to fetch`);
   return;
 }
 var loadQueue = Promise.resolve();
-async function loadFunctions2(projectDir, options = {}) {
+async function loadFunctions2(projectDir, options = {}, mode = "development") {
   let releaseQueue;
   const previous = loadQueue;
   loadQueue = new Promise((resolveQueue) => {
@@ -12807,18 +13308,23 @@ async function loadFunctions2(projectDir, options = {}) {
   });
   await previous;
   try {
-    return await loadFunctionsUnlocked(projectDir, options);
+    return await loadFunctionsUnlocked(projectDir, options, mode);
   } finally {
     releaseQueue();
   }
 }
-async function loadFunctionsUnlocked(projectDir, options) {
+async function loadFunctionsUnlocked(projectDir, options, mode) {
   const functions = new Map;
   const root = join5(projectDir, "supabase", "functions");
   let entries = [];
   try {
     entries = await readdir(root);
-  } catch {
+  } catch (error) {
+    if (mode === "strict" && errorProperty(error, "code") !== "ENOENT")
+      throw error;
+    if (mode === "strict" && Object.values(options).some((option) => option.enabled !== false)) {
+      throw new Error("declared function directory is missing");
+    }
     return functions;
   }
   installDenoShim();
@@ -12868,14 +13374,18 @@ async function loadFunctionsUnlocked(projectDir, options) {
           } : undefined;
           functions.set(name, {
             handler,
-            framework: resolveFramework(name, opts?.framework),
+            framework: resolveFramework(name, opts?.framework, mode),
             ...limits ? { limits } : {},
             ...capabilities ? { capabilities } : {}
           });
         } else {
+          if (mode === "strict")
+            throw new Error(`function "${name}" has no handler`);
           console.warn(`  warning: function "${name}" has no default function, handle/fetch object, or Deno.serve() handler, skipped`);
         }
       } catch (e) {
+        if (mode === "strict")
+          throw new Error(`failed to load strict function "${name}"`, { cause: e });
         const msg = e instanceof Error ? e.message : String(e);
         if (/Unknown file extension|Cannot find module/.test(msg)) {
           console.warn(`  warning: function "${name}" could not be bundled by Bun: ${msg}`);
@@ -12888,16 +13398,174 @@ async function loadFunctionsUnlocked(projectDir, options) {
       }
       break;
     }
+    if (mode === "strict" && !functions.has(name))
+      throw new Error(`function "${name}" has no loadable entrypoint`);
+  }
+  if (mode === "strict") {
+    for (const [name, option] of Object.entries(options)) {
+      if (option.enabled !== false && !functions.has(name))
+        throw new Error(`declared function "${name}" was not loaded`);
+    }
   }
   return functions;
 }
 
 // src/runtime/node/project.ts
-import { readdir as readdir2, readFile as readFile5 } from "fs/promises";
+import { lstat, readdir as readdir2, readFile as readFile5 } from "fs/promises";
 import { join as join6 } from "path";
+
+// node_modules/@supacloud/db/dist/index.js
+import { createHash as createHash4 } from "crypto";
+var TOKEN = /__[A-Z][A-Z0-9_]*__/g;
+var RESERVED_TOKEN = /__SC_BINDING_[A-Z0-9_]+__/;
+var HASH = /^[a-f0-9]{64}$/;
+function migrationBindingSha256(value) {
+  return createHash4("sha256").update(value).digest("hex");
+}
+function record(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Invalid migration binding object");
+  }
+  return value;
+}
+function keys(row, expected) {
+  if (Object.keys(row).sort().join(",") !== expected.sort().join(",")) {
+    throw new Error("Unexpected migration binding fields");
+  }
+}
+function validTarget(value) {
+  const target2 = record(value);
+  keys(target2, ["environment", "projectRef"]);
+  if (typeof target2.environment !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(target2.environment) || typeof target2.projectRef !== "string" || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(target2.projectRef)) {
+    throw new Error("Invalid migration binding target");
+  }
+  return target2;
+}
+function validFile(file) {
+  return typeof file === "string" && /^[a-zA-Z0-9_./-]+\.sql$/.test(file) && !file.startsWith("/") && file.split("/").every((part) => part && part !== "." && part !== "..");
+}
+function parseMigrationBindingManifest(value) {
+  const manifest = record(value);
+  keys(manifest, ["schema", "targets", "templates"]);
+  if (manifest.schema !== "supacloud.migration-bindings.v1" || !Array.isArray(manifest.targets) || !manifest.targets.length || !Array.isArray(manifest.templates)) {
+    throw new Error("Invalid migration binding manifest");
+  }
+  const targets = manifest.targets.map(validTarget);
+  if (new Set(targets.map((target2) => target2.environment)).size !== targets.length) {
+    throw new Error("Duplicate migration binding environment");
+  }
+  const files = new Set;
+  const templates = manifest.templates.map((value2) => {
+    const template = record(value2);
+    keys(template, ["file", "templateSha256", "parameters"]);
+    if (!validFile(template.file) || files.has(template.file) || typeof template.templateSha256 !== "string" || !HASH.test(template.templateSha256) || !Array.isArray(template.parameters) || !template.parameters.length) {
+      throw new Error("Invalid or duplicate migration binding template");
+    }
+    files.add(template.file);
+    const placeholders = new Set;
+    const parameters = template.parameters.map((value3) => {
+      const parameter = record(value3);
+      keys(parameter, ["placeholder", "variable", "type", "occurrences"]);
+      if (typeof parameter.placeholder !== "string" || !/^__[A-Z][A-Z0-9_]*__$/.test(parameter.placeholder) || placeholders.has(parameter.placeholder) || typeof parameter.variable !== "string" || !/^[A-Z][A-Z0-9_]*$/.test(parameter.variable) || !["uuid", "https-url", "resource-name"].includes(String(parameter.type)) || !Number.isSafeInteger(parameter.occurrences) || Number(parameter.occurrences) < 1) {
+        throw new Error("Invalid or duplicate migration binding parameter");
+      }
+      placeholders.add(parameter.placeholder);
+      return parameter;
+    });
+    return { file: template.file, templateSha256: template.templateSha256, parameters };
+  });
+  return { schema: "supacloud.migration-bindings.v1", targets, templates };
+}
+function bindingValue(parameter, values) {
+  const value = Object.hasOwn(values, parameter.variable) ? values[parameter.variable] : undefined;
+  if (typeof value !== "string" || !value || value.trim() !== value) {
+    throw new Error(`Missing or invalid migration binding variable: ${parameter.variable}`);
+  }
+  let valid = false;
+  if (parameter.type === "uuid") {
+    valid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+  } else if (parameter.type === "resource-name") {
+    valid = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,254}$/.test(value);
+  } else if (/^https:\/\/[A-Za-z0-9._~:/?#[\]@!&()*+,;=%-]+$/.test(value)) {
+    try {
+      const url = new URL(value);
+      valid = url.protocol === "https:" && Boolean(url.hostname) && !url.username && !url.password;
+    } catch {}
+  }
+  if (!valid || value.includes("__"))
+    throw new Error(`Invalid ${parameter.type} migration binding: ${parameter.variable}`);
+  return value;
+}
+function renderMigrationBindings(options) {
+  const manifest = parseMigrationBindingManifest(options.manifest);
+  const target2 = validTarget(options.target);
+  if (!manifest.targets.some((candidate) => candidate.environment === target2.environment && candidate.projectRef === target2.projectRef)) {
+    throw new Error("Migration binding target is not registered in the manifest");
+  }
+  const sources = new Map;
+  for (const migration of options.migrations) {
+    if (!validFile(migration.file) || sources.has(migration.file) || typeof migration.sql !== "string" || !migration.sql.trim()) {
+      throw new Error("Invalid, empty, or duplicate migration binding source");
+    }
+    sources.set(migration.file, migration);
+  }
+  if (manifest.templates.some((template) => !sources.has(template.file))) {
+    throw new Error("Migration binding manifest references a missing source");
+  }
+  const templates = new Map(manifest.templates.map((template) => [template.file, template]));
+  const declaredTokens = new Set(manifest.templates.flatMap((template) => template.parameters.map((parameter) => parameter.placeholder)));
+  const files = [];
+  const migrations = options.migrations.map((migration) => {
+    const template = templates.get(migration.file);
+    const templateSha256 = migrationBindingSha256(migration.sql);
+    if (template && templateSha256 !== template.templateSha256) {
+      throw new Error(`Migration binding template checksum mismatch: ${migration.file}`);
+    }
+    const parameters = new Map(template?.parameters.map((parameter) => [parameter.placeholder, parameter]));
+    const counts = new Map;
+    const sql = migration.sql.replace(TOKEN, (token, offset) => {
+      const parameter = parameters.get(token);
+      if (!parameter) {
+        if (RESERVED_TOKEN.test(token) || declaredTokens.has(token)) {
+          throw new Error(`Undeclared migration binding placeholder: ${migration.file}`);
+        }
+        return token;
+      }
+      if (migration.sql[offset - 1] !== "'" || migration.sql[offset + token.length] !== "'") {
+        throw new Error(`Migration bindings must occupy a complete SQL string literal: ${migration.file}`);
+      }
+      counts.set(token, (counts.get(token) || 0) + 1);
+      return bindingValue(parameter, options.values);
+    });
+    for (const parameter of parameters.values()) {
+      if (counts.get(parameter.placeholder) !== parameter.occurrences) {
+        throw new Error(`Migration binding occurrence mismatch: ${migration.file}`);
+      }
+    }
+    files.push({
+      file: migration.file,
+      templateSha256,
+      renderedSqlSha256: migrationBindingSha256(sql),
+      parameters: [...parameters.values()].map(({ variable, type }) => ({ variable, type }))
+    });
+    return { file: migration.file, sql };
+  });
+  return {
+    migrations,
+    attestation: {
+      schema: "supacloud.migration-binding-attestation.v1",
+      ...target2,
+      manifestSha256: migrationBindingSha256(JSON.stringify(manifest)),
+      files: files.sort((left, right) => left.file.localeCompare(right.file))
+    }
+  };
+}
+
+// src/runtime/node/project.ts
 async function loadSupabaseProject(projectDir, seed = {}) {
   const migrationsDir = join6(projectDir, "supabase", "migrations");
-  const migrations = [];
+  let migrations = [];
+  const sources = [];
   let entries = [];
   try {
     entries = await readdir2(migrationsDir);
@@ -12906,10 +13574,50 @@ async function loadSupabaseProject(projectDir, seed = {}) {
       throw error;
   }
   for (const entry of entries.sort()) {
-    if (!entry.endsWith(".sql"))
+    const info = await lstat(join6(migrationsDir, entry));
+    if (info.isSymbolicLink())
+      throw new Error(`migration paths must not be symbolic links: ${entry}`);
+    let file;
+    let name;
+    if (info.isFile() && entry.endsWith(".sql")) {
+      file = entry;
+      name = entry.replace(/\.sql$/, "");
+    } else if (info.isDirectory() && /^\d/.test(entry)) {
+      file = `${entry}/migration.sql`;
+      name = entry;
+      const sqlInfo = await lstat(join6(migrationsDir, file)).catch((error) => {
+        if (isNotFound(error))
+          throw new Error(`migration folder is missing migration.sql: ${entry}`);
+        throw error;
+      });
+      if (!sqlInfo.isFile() || sqlInfo.isSymbolicLink())
+        throw new Error(`invalid migration file: ${file}`);
+    } else
       continue;
-    const sql = await readFile5(join6(migrationsDir, entry), "utf8");
-    migrations.push({ name: entry.replace(/\.sql$/, ""), sql });
+    const sql = await readFile5(join6(migrationsDir, file), "utf8");
+    sources.push({ file, sql });
+    migrations.push({ name, sql });
+  }
+  const versions = new Set;
+  for (const migration of migrations) {
+    const version = migration.name.match(/^(\d+)/)?.[1] ?? migration.name;
+    if (versions.has(version))
+      throw new Error(`duplicate migration version: ${version}`);
+    versions.add(version);
+  }
+  const rendered = seed.bindings ? renderMigrationBindings({
+    ...seed.bindings,
+    migrations: sources
+  }) : undefined;
+  if (rendered)
+    migrations = migrations.map((migration, index) => {
+      const bound = rendered.migrations[index];
+      if (!bound)
+        throw new Error(`missing rendered migration: ${migration.name}`);
+      return { ...migration, sql: bound.sql };
+    });
+  else if (sources.some(({ sql }) => /__SC_BINDING_[A-Z0-9_]+__/.test(sql))) {
+    throw new Error("migration binding placeholders require an explicit manifest and target");
   }
   let seedSql;
   if (seed.enabled !== false) {
@@ -12931,7 +13639,7 @@ async function loadSupabaseProject(projectDir, seed = {}) {
       seedSql = parts.join(`
 `);
   }
-  return { migrations, seedSql };
+  return { migrations, seedSql, ...rendered ? { bindingAttestation: rendered.attestation } : {} };
 }
 function isNotFound(error) {
   return error.code === "ENOENT";
@@ -13003,12 +13711,15 @@ async function createProjectBackend(options = {}) {
   const host = options.host ?? process.env.SUPACLOUD_LITE_HOST ?? "127.0.0.1";
   const port = options.port ?? parsePort(process.env.SUPACLOUD_LITE_PORT ?? process.env.PORT, 54321);
   const url = options.apiUrl ?? process.env.SUPACLOUD_LITE_API_URL ?? `http://${displayHost(host)}:${port}`;
-  const config = loadProjectConfig(paths.projectDir);
+  const config = loadProjectConfig(paths.projectDir, process.env, options.runtimeMode);
+  const bindings = options.migrationBindings ?? await loadProjectBindings(paths.projectDir, config);
   const project = await loadSupabaseProject(paths.projectDir, {
     enabled: options.includeSeed === false ? false : config.seed.enabled,
-    paths: config.seed.paths
+    paths: config.seed.paths,
+    bindings
   });
-  const functions = options.includeFunctions === false ? new Map : await loadFunctions2(paths.projectDir, config.functions);
+  const externalIdentity = options.externalIdentity ?? (options.includeIdentity !== false ? await loadProjectIdentity(paths.projectDir, options.identityModule ?? config.lite.identityModule) : undefined);
+  const functions = options.includeFunctions === false ? new Map : await loadFunctions2(paths.projectDir, config.functions, config.lite.runtimeMode);
   const functionEnv = options.includeFunctions === false ? {} : await loadFunctionEnv(paths.projectDir);
   const secrets = await ensureProjectSecrets(paths);
   const webhooks = options.includeWebhooks === false ? [] : await loadWebhooks(paths.projectDir);
@@ -13023,11 +13734,20 @@ async function createProjectBackend(options = {}) {
   await mkdir4(paths.storageDir, { recursive: true, mode: 448 });
   await chmod(paths.storageDir, 448);
   const storageDriver = options.storageDriver ?? createStorageDriver(configuredStorageBackend, paths.storageDir, options.s3);
-  const engine = databaseEngine === "native" ? await createNativeEngine({ dataDir: paths.dataDir, log: options.log, replication }) : undefined;
+  let engine;
+  if (databaseEngine === "native") {
+    const dataDir = paths.dataDir;
+    if (dataDir === undefined)
+      throw new Error("native PostgreSQL requires a data directory");
+    engine = await createNativeEngine({ dataDir, installDir: options.postgresDir, log: options.log, replication });
+  }
   let backend;
   try {
     backend = await createBackend({
       engine,
+      runtimeMode: config.lite.runtimeMode,
+      graphql: options.graphql ?? config.lite.graphql,
+      externalIdentity,
       dataDir: databaseEngine === "pglite" ? paths.dataDir : undefined,
       jwtSecret: secrets.jwtSecret,
       vaultKey: secrets.vaultKey,
@@ -13077,6 +13797,7 @@ async function createProjectBackend(options = {}) {
     throw error;
   }
   return {
+    bindingAttestation: project.bindingAttestation,
     backend,
     config,
     paths,
@@ -13091,6 +13812,30 @@ async function createProjectBackend(options = {}) {
     replicationProfile: replication?.profile
   };
 }
+async function loadProjectBindings(projectDir, config) {
+  const bindings = config.lite.migrationBindings;
+  if (!bindings)
+    return;
+  const manifest = JSON.parse(await readFile6(resolve3(projectDir, bindings.manifest), "utf8"));
+  return {
+    manifest,
+    target: { environment: bindings.environment, projectRef: bindings.projectRef },
+    values: process.env
+  };
+}
+async function loadProjectIdentity(projectDir, module) {
+  if (!module)
+    return;
+  const imported = await import(pathToFileURL2(resolve3(projectDir, module)).href);
+  if (!isRecord(imported) || typeof imported["default"] !== "function") {
+    throw new Error("Lite identity module must default-export an external identity verifier");
+  }
+  const verify = imported["default"];
+  return async (request) => {
+    const claims = await verify(request);
+    return validateExternalIdentityClaims(claims);
+  };
+}
 function resolveNativeReplicationOptions(options, databaseEngine = resolveDatabaseEngine(options.engine, options.memory)) {
   const profile = options.replicationProfile ?? process.env.SUPACLOUD_LITE_REPLICATION_PROFILE;
   if (!profile)
@@ -13122,7 +13867,7 @@ function resolveDatabaseEngine(value, memory = false) {
   if (configured === "native" && memory)
     throw new Error("--memory is only supported by the pglite engine");
   if (configured === "native" && !isNativeEngineSupported()) {
-    throw new Error(`native PostgreSQL requires macOS or glibc Linux on x64/arm64; ` + `${process.platform}/${process.arch} must use --engine pglite`);
+    throw new Error(`native PostgreSQL requires macOS or glibc Linux on x64/arm64; ${process.platform}/${process.arch} must use --engine pglite`);
   }
   return configured;
 }
@@ -13233,7 +13978,7 @@ async function findEphemeralPort(host = "127.0.0.1") {
   return port;
 }
 // src/snapshot.ts
-import { chmod as chmod2, copyFile, lstat as lstat2, mkdir as mkdir5, mkdtemp, readdir as readdir3, readFile as readFile7, rename as rename2, rm as rm4, writeFile as writeFile5 } from "fs/promises";
+import { chmod as chmod2, copyFile, lstat as lstat3, mkdir as mkdir5, mkdtemp, readdir as readdir3, readFile as readFile7, rename as rename2, rm as rm4, writeFile as writeFile5 } from "fs/promises";
 import { dirname as dirname5, join as join8, parse as parse2, relative as relative2, resolve as resolve4, sep as sep2 } from "path";
 import { create as createTar, extract as extractTar2 } from "tar";
 var SNAPSHOT_FORMAT = "supacloud-lite-snapshot";
@@ -13322,7 +14067,10 @@ async function restoreSnapshot(options) {
     if (manifest.storageBackend !== options.storageBackend) {
       throw new Error(`snapshot storage backend is ${manifest.storageBackend}, but the target uses ${options.storageBackend}; ` + "restore with the matching --storage-backend value");
     }
-    assertDatabaseSnapshotCompatible(manifest, paths);
+    assertDatabaseSnapshotCompatible(manifest, paths, options.postgresDir);
+    if (manifest.databaseEngine === "native" && await readPostgresMajor(join8(payloadRoot, "database")) !== manifest.postgresMajor) {
+      throw new Error("native PostgreSQL snapshot payload does not match its declared major version");
+    }
     if (manifest.includesDatabase !== Boolean(paths.dataDir)) {
       throw new Error("snapshot database mode does not match the target; do not restore a persistent snapshot into --memory");
     }
@@ -13389,7 +14137,7 @@ async function assertSnapshotPaths(paths, options = {}) {
       throw new Error("snapshot state directory must not be the filesystem root");
     if (paths.secretsFile !== join8(paths.stateDir, "secrets.json"))
       throw new Error("snapshot secrets path must be inside the state directory");
-    const stateInfo = await lstat2(paths.stateDir);
+    const stateInfo = await lstat3(paths.stateDir);
     if (!stateInfo.isDirectory() || stateInfo.isSymbolicLink())
       throw new Error(`state directory must be a real directory: ${paths.stateDir}`);
   } catch (error) {
@@ -13402,7 +14150,7 @@ async function assertSnapshotPaths(paths, options = {}) {
   await assertDirectoryOrMissing(paths.dataDir);
   await assertDirectoryOrMissing(paths.storageDir);
   if (options.requireSecrets !== false) {
-    const secretInfo = await lstat2(paths.secretsFile);
+    const secretInfo = await lstat3(paths.secretsFile);
     if (!secretInfo.isFile() || secretInfo.isSymbolicLink())
       throw new Error(`secrets file must be a regular file: ${paths.secretsFile}`);
   }
@@ -13413,7 +14161,7 @@ async function assertDirectoryOrMissing(path) {
   if (resolve4(path) === parse2(resolve4(path)).root)
     throw new Error(`snapshot path must not be the filesystem root: ${path}`);
   try {
-    const info = await lstat2(path);
+    const info = await lstat3(path);
     if (!info.isDirectory() || info.isSymbolicLink())
       throw new Error(`snapshot path must be a real directory: ${path}`);
   } catch (error) {
@@ -13434,7 +14182,7 @@ async function assertNoDataDirectoryLock(paths) {
 }
 async function stageDirectory(root, destination) {
   try {
-    const info = await lstat2(root);
+    const info = await lstat3(root);
     if (!info.isDirectory() || info.isSymbolicLink())
       throw new Error(`snapshot path must be a real directory: ${root}`);
   } catch (error) {
@@ -13484,7 +14232,7 @@ function isSnapshotManifest(value) {
   const candidate = value;
   return candidate.format === SNAPSHOT_FORMAT && candidate.version === SNAPSHOT_VERSION && typeof candidate.createdAt === "string" && typeof candidate.packageVersion === "string" && (candidate.storageBackend === "fs" || candidate.storageBackend === "s3" || candidate.storageBackend === "memory") && typeof candidate.includesDatabase === "boolean" && typeof candidate.includesLocalStorage === "boolean" && candidate.includesSecrets === true && (candidate.databaseEngine === undefined || candidate.databaseEngine === "pglite" || candidate.databaseEngine === "native") && (candidate.platform === undefined || typeof candidate.platform === "string") && (candidate.architecture === undefined || typeof candidate.architecture === "string") && (candidate.postgresMajor === undefined || typeof candidate.postgresMajor === "string");
 }
-function assertDatabaseSnapshotCompatible(manifest, paths) {
+function assertDatabaseSnapshotCompatible(manifest, paths, postgresDir) {
   const sourceEngine = manifest.databaseEngine ?? "pglite";
   if (sourceEngine !== paths.databaseEngine) {
     throw new Error(`snapshot database engine is ${sourceEngine}, but the target uses ${paths.databaseEngine}`);
@@ -13494,8 +14242,9 @@ function assertDatabaseSnapshotCompatible(manifest, paths) {
   if (manifest.platform !== process.platform || manifest.architecture !== process.arch) {
     throw new Error(`native PostgreSQL snapshots require the same platform and architecture; ` + `source is ${manifest.platform ?? "unknown"}/${manifest.architecture ?? "unknown"}, ` + `target is ${process.platform}/${process.arch}`);
   }
-  if (manifest.postgresMajor !== NATIVE_POSTGRES_MAJOR) {
-    throw new Error(`native PostgreSQL snapshot major is ${manifest.postgresMajor ?? "unknown"}, ` + `but this Lite build uses ${NATIVE_POSTGRES_MAJOR}`);
+  const expectedMajor = nativePostgresMajor(postgresDir);
+  if (manifest.postgresMajor !== expectedMajor) {
+    throw new Error(`native PostgreSQL snapshot major is ${manifest.postgresMajor ?? "unknown"}, ` + `but the selected PostgreSQL installation uses ${expectedMajor}`);
   }
 }
 async function readPostgresMajor(dataDir) {
@@ -13513,7 +14262,7 @@ async function assertSnapshotPayload(payloadRoot, manifest) {
   const required = ["manifest.json", "secrets.json"];
   for (const path of required) {
     try {
-      await lstat2(join8(payloadRoot, path));
+      await lstat3(join8(payloadRoot, path));
     } catch {
       throw new Error(`snapshot is missing required payload: ${path}`);
     }
@@ -13585,7 +14334,7 @@ async function rollbackDirectorySwaps(swaps) {
 }
 async function existingInfo(path) {
   try {
-    return await lstat2(path);
+    return await lstat3(path);
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
@@ -13593,7 +14342,7 @@ async function existingInfo(path) {
   }
 }
 async function copyEntry(source, target2) {
-  const info = await lstat2(source);
+  const info = await lstat3(source);
   if (info.isSymbolicLink())
     throw new Error(`snapshot refuses symbolic link: ${source}`);
   if (info.isDirectory()) {
@@ -13607,7 +14356,7 @@ async function copyEntry(source, target2) {
     throw new Error(`snapshot refuses unsupported filesystem entry: ${source}`);
 }
 async function hardenRestoredTree(root) {
-  const info = await lstat2(root);
+  const info = await lstat3(root);
   if (info.isSymbolicLink())
     throw new Error(`snapshot refuses symbolic link: ${root}`);
   if (info.isDirectory()) {
@@ -13654,12 +14403,14 @@ export {
   createPgliteEngine,
   createProjectBackend,
   createSnapshot,
+  createSupAuthLiteIdentity,
   decodeJwt,
   ensurePostgres,
   ensurePowerSyncReplicationCatalog,
   ensureProjectSecrets,
   generateTypes,
   inspectDb,
+  inspectGraphql,
   inspectPowerSyncReadiness,
   isNativeEngineSupported,
   liteCapabilities,