@supacloud/lite 0.14.0 → 0.16.0

package/dist/cli.js

@@ -1,6 +1,5 @@
 #!/usr/bin/env bun
 // @bun
-var __require = import.meta.require;
 
 // src/cli.ts
 import { existsSync as existsSync4 } from "fs";
@@ -9,7 +8,7 @@ import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.14.0",
+  version: "0.16.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -69,13 +68,13 @@ var package_default = {
     "@supacloud/compiler": "^0.13.1",
     "@supacloud/elysia": "^0.10.0",
     "@supabase/supabase-js": "^2.115.0",
-    "@types/bun": "^1.4.0",
+    "@types/bun": "^1.4.2",
     elysia: "^1.4.30",
     jose: "^6.2.11",
     typescript: "^7.0.2"
   },
   engines: {
-    bun: ">=1.4.0"
+    bun: ">=1.4.2"
   },
   publishConfig: {
     access: "public",
@@ -423,10 +422,15 @@ class OAuthService {
         JSON.stringify({ provider, providers: [provider] }),
         JSON.stringify({ sub: profile.id, email: profile.email, full_name: profile.name, ...profile.metadata })
       ]);
-      userId = created.rows[0].id;
+      const user = created.rows[0];
+      if (!user)
+        throw new Error("OAuth user creation returned no row");
+      userId = user.id;
     }
     await this.db.query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
        values ($1, $2, $3, $4::jsonb)`, [userId, provider, profile.id, JSON.stringify({ sub: profile.id, email: profile.email, ...profile.metadata })]);
+    if (!userId)
+      throw new Error("OAuth identity has no user ID");
     return userId;
   }
 }
@@ -639,10 +643,10 @@ class QrCode {
     const bytes = new TextEncoder().encode(text);
     let version = 1;
     for (;version <= 40; version++) {
-      const dataCapacityBits2 = getNumDataCodewords(version) * 8;
+      const dataCapacityBits = getNumDataCodewords(version) * 8;
       const ccBits = version < 10 ? 8 : 16;
       const usedBits = 4 + ccBits + bytes.length * 8;
-      if (usedBits <= dataCapacityBits2)
+      if (usedBits <= dataCapacityBits)
         break;
     }
     if (version > 40)
@@ -1334,10 +1338,10 @@ class AuthHandler {
       if (!this.settings.anonymousUsers) {
         return authError(422, "anonymous_provider_disabled", "Anonymous sign-ins are disabled");
       }
-      const res2 = await this.db.query(`insert into auth.users (aud, role, raw_app_meta_data, raw_user_meta_data, is_anonymous, last_sign_in_at)
+      const res = await this.db.query(`insert into auth.users (aud, role, raw_app_meta_data, raw_user_meta_data, is_anonymous, last_sign_in_at)
          values ('authenticated', 'authenticated', '{}', $1, true, now())
          returning *`, [JSON.stringify(body.data ?? {})]);
-      return json(200, await this.sessionFor(res2.rows[0]));
+      return json(200, await this.sessionFor(res.rows[0]));
     }
     if (this.settings.disableSignup) {
       return authError(422, "signup_disabled", "Signups not allowed for this instance");
@@ -3931,45 +3935,202 @@ AS $$
 DECLARE
   normalized_queue_name text := lower(btrim(queue_name));
 BEGIN
-  IF normalized_queue_name IS NULL
-     OR left(normalized_queue_name, char_length('supacloud_internal_')) = 'supacloud_internal_' THEN
+  IF left(normalized_queue_name, char_length('supacloud_internal_')) = 'supacloud_internal_' THEN
     RAISE EXCEPTION 'SUPACLOUD_QUEUE_NAME_RESERVED' USING ERRCODE = '42501';
   END IF;
-  RETURN normalized_queue_name;
+  IF queue_name IS NULL OR queue_name !~ '^[a-z0-9][a-z0-9_-]{0,127}$' THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_NAME_INVALID' USING ERRCODE = '22023';
+  END IF;
+  RETURN queue_name;
+END;
+$$;
+
+-- Return-type changes require replacement. Do not CASCADE through user dependencies.
+DO $pgmq_receipt_types$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_catalog.pg_proc
+    WHERE oid = to_regprocedure('pgmq_public.send(text,jsonb,integer)')
+      AND prorettype = 'bigint'::regtype
+  ) THEN
+    DROP FUNCTION pgmq_public.send(text,jsonb,integer);
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM pg_catalog.pg_proc
+    WHERE oid = to_regprocedure('pgmq_public.send_batch(text,jsonb[],integer)')
+      AND prorettype = 'bigint'::regtype
+  ) THEN
+    DROP FUNCTION pgmq_public.send_batch(text,jsonb[],integer);
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM pg_catalog.pg_proc
+    WHERE oid = to_regprocedure('pgmq_public.read(text,integer,integer)')
+      AND prorettype = 'pgmq.message_record'::regtype
+  ) THEN
+    DROP FUNCTION pgmq_public.read(text,integer,integer);
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM pg_catalog.pg_proc
+    WHERE oid = to_regprocedure('pgmq_public.pop(text)')
+      AND prorettype = 'pgmq.message_record'::regtype
+  ) THEN
+    DROP FUNCTION pgmq_public.pop(text);
+  END IF;
+END
+$pgmq_receipt_types$;
+
+CREATE OR REPLACE FUNCTION pgmq_public.require_seconds(value integer)
+RETURNS integer LANGUAGE plpgsql IMMUTABLE SET search_path = ''
+AS $$
+BEGIN
+  IF value IS NULL OR value < 0 THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_SECONDS_INVALID' USING ERRCODE = '22023';
+  END IF;
+  RETURN value;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION pgmq_public.require_read_count(value integer)
+RETURNS integer LANGUAGE plpgsql IMMUTABLE SET search_path = ''
+AS $$
+BEGIN
+  IF value IS NULL OR value < 1 OR value > 10000 THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_COUNT_INVALID' USING ERRCODE = '22023';
+  END IF;
+  RETURN value;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION pgmq_public.require_message_id(value bigint)
+RETURNS bigint LANGUAGE plpgsql IMMUTABLE SET search_path = ''
+AS $$
+BEGIN
+  IF value IS NULL OR value < 1 THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_MESSAGE_ID_INVALID' USING ERRCODE = '22023';
+  END IF;
+  RETURN value;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION pgmq_public.message_node_count(value jsonb)
+RETURNS integer LANGUAGE plpgsql IMMUTABLE SET search_path = ''
+AS $$
+DECLARE
+  node_count integer;
+  maximum_depth integer;
+BEGIN
+  IF value IS NULL THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_MESSAGE_INVALID' USING ERRCODE = '22023';
+  END IF;
+  IF octet_length(convert_to(value::text, 'UTF8')) > 1048576 THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_PAYLOAD_TOO_LARGE' USING ERRCODE = '22023';
+  END IF;
+  WITH RECURSIVE tree(item, depth) AS (
+    SELECT value, 0
+    UNION ALL
+    SELECT child.item, tree.depth + 1
+    FROM tree
+    CROSS JOIN LATERAL (
+      SELECT element AS item
+      FROM jsonb_array_elements(CASE WHEN jsonb_typeof(tree.item) = 'array' THEN tree.item ELSE '[]'::jsonb END) AS element
+      UNION ALL
+      SELECT entry.value AS item
+      FROM jsonb_each(CASE WHEN jsonb_typeof(tree.item) = 'object' THEN tree.item ELSE '{}'::jsonb END) AS entry
+    ) AS child
+    WHERE tree.depth < 65
+  )
+  SELECT count(*)::integer, max(depth) INTO node_count, maximum_depth
+  FROM (SELECT depth FROM tree LIMIT 10001) AS bounded;
+  IF node_count > 10000 OR maximum_depth > 64 THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_STRUCTURE_TOO_LARGE' USING ERRCODE = '22023';
+  END IF;
+  RETURN node_count;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION pgmq_public.require_message(value jsonb)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE SET search_path = ''
+AS $$
+BEGIN
+  PERFORM pgmq_public.message_node_count(value);
+  RETURN value;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION pgmq_public.require_messages(values_ jsonb[])
+RETURNS jsonb[] LANGUAGE plpgsql IMMUTABLE SET search_path = ''
+AS $$
+DECLARE
+  item jsonb;
+  total_bytes bigint := 0;
+  total_nodes integer := 0;
+BEGIN
+  IF values_ IS NULL OR cardinality(values_) < 1 OR cardinality(values_) > 10000
+     OR array_ndims(values_) <> 1 OR array_lower(values_, 1) <> 1 THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_BATCH_INVALID' USING ERRCODE = '22023';
+  END IF;
+  FOREACH item IN ARRAY values_ LOOP
+    total_nodes := total_nodes + pgmq_public.message_node_count(item);
+    IF total_nodes > 100000 THEN
+      RAISE EXCEPTION 'SUPACLOUD_QUEUE_STRUCTURE_TOO_LARGE' USING ERRCODE = '22023';
+    END IF;
+    total_bytes := total_bytes + octet_length(convert_to(item::text, 'UTF8'));
+    IF total_bytes > 8388608 THEN
+      RAISE EXCEPTION 'SUPACLOUD_QUEUE_PAYLOAD_TOO_LARGE' USING ERRCODE = '22023';
+    END IF;
+  END LOOP;
+  RETURN values_;
 END;
 $$;
 
 CREATE OR REPLACE FUNCTION pgmq_public.send(queue_name text, message jsonb, sleep_seconds integer DEFAULT 0)
-RETURNS SETOF bigint
+RETURNS SETOF text
 LANGUAGE sql
 VOLATILE
 SECURITY DEFINER
 SET search_path = ''
-AS $$ SELECT * FROM pgmq.send(pgmq_public.require_public_queue(queue_name), message, sleep_seconds); $$;
+AS $$ SELECT receipt.msg_id::text FROM pgmq.send(pgmq_public.require_public_queue(queue_name), pgmq_public.require_message(message), pgmq_public.require_seconds(sleep_seconds)) AS receipt(msg_id); $$;
 
 CREATE OR REPLACE FUNCTION pgmq_public.send_batch(queue_name text, messages jsonb[], sleep_seconds integer DEFAULT 0)
-RETURNS SETOF bigint
+RETURNS SETOF text
 LANGUAGE sql
 VOLATILE
 SECURITY DEFINER
 SET search_path = ''
-AS $$ SELECT * FROM pgmq.send_batch(pgmq_public.require_public_queue(queue_name), messages, sleep_seconds); $$;
+AS $$ SELECT receipt.msg_id::text FROM pgmq.send_batch(pgmq_public.require_public_queue(queue_name), pgmq_public.require_messages(messages), pgmq_public.require_seconds(sleep_seconds)) AS receipt(msg_id); $$;
 
 CREATE OR REPLACE FUNCTION pgmq_public.read(queue_name text, sleep_seconds integer, n integer)
-RETURNS SETOF pgmq.message_record
+RETURNS TABLE (
+  msg_id text, read_ct integer, enqueued_at timestamptz,
+  last_read_at timestamptz, vt timestamptz, message jsonb, headers jsonb
+)
 LANGUAGE sql
 VOLATILE
 SECURITY DEFINER
 SET search_path = ''
-AS $$ SELECT * FROM pgmq.read(pgmq_public.require_public_queue(queue_name), sleep_seconds, n); $$;
+AS $$
+  SELECT receipt.msg_id::text, receipt.read_ct, receipt.enqueued_at,
+    (to_jsonb(receipt)->>'last_read_at')::timestamptz, receipt.vt,
+    receipt.message, to_jsonb(receipt)->'headers'
+  FROM pgmq.read(pgmq_public.require_public_queue(queue_name),
+    pgmq_public.require_seconds(sleep_seconds), pgmq_public.require_read_count(n)) AS receipt;
+$$;
 
 CREATE OR REPLACE FUNCTION pgmq_public.pop(queue_name text)
-RETURNS SETOF pgmq.message_record
+RETURNS TABLE (
+  msg_id text, read_ct integer, enqueued_at timestamptz,
+  last_read_at timestamptz, vt timestamptz, message jsonb, headers jsonb
+)
 LANGUAGE sql
 VOLATILE
 SECURITY DEFINER
 SET search_path = ''
-AS $$ SELECT * FROM pgmq.pop(pgmq_public.require_public_queue(queue_name)); $$;
+AS $$
+  SELECT receipt.msg_id::text, receipt.read_ct, receipt.enqueued_at,
+    (to_jsonb(receipt)->>'last_read_at')::timestamptz, receipt.vt,
+    receipt.message, to_jsonb(receipt)->'headers'
+  FROM pgmq.pop(pgmq_public.require_public_queue(queue_name)) AS receipt;
+$$;
 
 CREATE OR REPLACE FUNCTION pgmq_public.archive(queue_name text, message_id bigint)
 RETURNS boolean
@@ -3977,7 +4138,7 @@ LANGUAGE sql
 VOLATILE
 SECURITY DEFINER
 SET search_path = ''
-AS $$ SELECT pgmq.archive(pgmq_public.require_public_queue(queue_name), message_id); $$;
+AS $$ SELECT pgmq.archive(pgmq_public.require_public_queue(queue_name), pgmq_public.require_message_id(message_id)); $$;
 
 CREATE OR REPLACE FUNCTION pgmq_public."delete"(queue_name text, message_id bigint)
 RETURNS boolean
@@ -3985,10 +4146,12 @@ LANGUAGE sql
 VOLATILE
 SECURITY DEFINER
 SET search_path = ''
-AS $$ SELECT pgmq.delete(pgmq_public.require_public_queue(queue_name), message_id); $$;
+AS $$ SELECT pgmq.delete(pgmq_public.require_public_queue(queue_name), pgmq_public.require_message_id(message_id)); $$;
 
 REVOKE ALL ON ALL FUNCTIONS IN SCHEMA pgmq_public FROM PUBLIC;
 GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA pgmq_public TO anon, authenticated, service_role;
+
+NOTIFY pgrst, 'reload schema';
 -- supacloud:sql-module:pgmq-public:end
 `;
 var WORKFLOWS_SQL = `
@@ -4611,7 +4774,12 @@ BEGIN
        OR (retry_receipt ->> 'delaySeconds')::integer IS DISTINCT FROM p_delay_seconds THEN
       RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';
     END IF;
-    RETURN supacloud_workflows.snapshot(current_step.run_id, true);
+    retry_receipt := retry_receipt || jsonb_build_object(
+      'stepId', current_step.id,
+      'attempt', p_attempt
+    );
+    RETURN supacloud_workflows.snapshot(current_step.run_id, true)
+      || jsonb_build_object('retryReceipt', retry_receipt);
   END IF;
   IF normalized_worker_id IS NULL
      OR p_message_id IS NULL
@@ -4639,19 +4807,22 @@ BEGIN
     IF NOT FOUND THEN
       RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RUN_NOT_ACTIVE' USING ERRCODE = '55000';
     END IF;
+    retry_receipt := jsonb_build_object(
+      'operation', 'retry',
+      'stepId', current_step.id,
+      'messageId', p_message_id::text,
+      'attempt', p_attempt,
+      'workerId', normalized_worker_id,
+      'errorMessage', normalized_error,
+      'delaySeconds', p_delay_seconds
+    );
     INSERT INTO supacloud_workflows.events (
       run_id, step_id, event_type, attempt, details
     ) VALUES (
-      current_step.run_id, current_step.id, 'step_dead_lettered', p_attempt,
-      jsonb_build_object(
-        'operation', 'retry',
-        'messageId', p_message_id::text,
-        'workerId', normalized_worker_id,
-        'errorMessage', normalized_error,
-        'delaySeconds', p_delay_seconds
-      )
+      current_step.run_id, current_step.id, 'step_dead_lettered', p_attempt, retry_receipt
     );
-    RETURN supacloud_workflows.snapshot(current_step.run_id, false);
+    RETURN supacloud_workflows.snapshot(current_step.run_id, false)
+      || jsonb_build_object('retryReceipt', retry_receipt);
   END IF;
 
   SELECT EXISTS (
@@ -4664,19 +4835,22 @@ BEGIN
   SET status = 'queued', error_message = normalized_error,
       retry_delay_seconds = p_delay_seconds, updated_at = now()
   WHERE id = current_step.id;
+  retry_receipt := jsonb_build_object(
+    'operation', 'retry',
+    'stepId', current_step.id,
+    'messageId', p_message_id::text,
+    'attempt', p_attempt,
+    'workerId', normalized_worker_id,
+    'errorMessage', normalized_error,
+    'delaySeconds', p_delay_seconds
+  );
   INSERT INTO supacloud_workflows.events (
     run_id, step_id, event_type, attempt, details
   ) VALUES (
-    current_step.run_id, current_step.id, 'step_retried', p_attempt,
-    jsonb_build_object(
-      'operation', 'retry',
-      'messageId', p_message_id::text,
-      'workerId', normalized_worker_id,
-      'errorMessage', normalized_error,
-      'delaySeconds', p_delay_seconds
-    )
+    current_step.run_id, current_step.id, 'step_retried', p_attempt, retry_receipt
   );
-  RETURN supacloud_workflows.snapshot(current_step.run_id, false);
+  RETURN supacloud_workflows.snapshot(current_step.run_id, false)
+    || jsonb_build_object('retryReceipt', retry_receipt);
 END;
 $$;
 
@@ -5087,6 +5261,8 @@ CREATE TABLE IF NOT EXISTS supacloud_commands.receipts (
 CREATE INDEX IF NOT EXISTS supacloud_commands_target_idx
   ON supacloud_commands.receipts (target_type, target_id, created_at DESC, id);
 
+ALTER TABLE supacloud_commands.receipts ADD COLUMN IF NOT EXISTS tenant_id text;
+
 CREATE OR REPLACE FUNCTION supacloud_commands.snapshot(
   p_command_id uuid,
   p_idempotent boolean DEFAULT false
@@ -5098,6 +5274,7 @@ LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$
     'targetType', receipt.target_type,
     'targetId', receipt.target_id,
     'actorId', receipt.actor_id,
+    'tenantId', receipt.tenant_id,
     'payloadFingerprint', receipt.payload_fingerprint,
     'createdAt', receipt.created_at,
     'idempotent', p_idempotent,
@@ -5125,6 +5302,8 @@ DECLARE
   normalized_target_id text;
   fingerprint text;
   existing supacloud_commands.receipts%ROWTYPE;
+  tenant_id text;
+  existing_execution jsonb;
 BEGIN
   IF jsonb_typeof(request) IS DISTINCT FROM 'object' THEN
     RAISE EXCEPTION 'SUPACLOUD_COMMAND_INVALID' USING ERRCODE = '22023';
@@ -5135,6 +5314,11 @@ BEGIN
     RAISE EXCEPTION 'SUPACLOUD_COMMAND_INVALID' USING ERRCODE = '22023';
   END IF;
   command_id := command_id_text::uuid;
+  tenant_id := request->>'tenantId';
+  IF request ? 'tenantId' AND (jsonb_typeof(request->'tenantId') IS DISTINCT FROM 'string'
+    OR tenant_id !~ '^[A-Za-z0-9._:@|-]{1,200}$') THEN
+    RAISE EXCEPTION 'SUPACLOUD_COMMAND_INVALID' USING ERRCODE = '22023';
+  END IF;
   IF request ? 'actorId' AND request ->> 'actorId' IS NOT NULL THEN
     actor_id := (request ->> 'actorId')::uuid;
   END IF;
@@ -5162,12 +5346,20 @@ BEGIN
        OR existing.target_type <> normalized_target_type
        OR existing.target_id <> normalized_target_id
        OR existing.actor_id IS DISTINCT FROM actor_id
+       OR existing.tenant_id IS DISTINCT FROM tenant_id
        OR existing.payload <> payload
        OR existing.payload_fingerprint <> fingerprint THEN
       RAISE EXCEPTION 'SUPACLOUD_COMMAND_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';
     END IF;
     RETURN supacloud_commands.snapshot(command_id, true);
   END IF;
+  IF to_regprocedure('supacloud_commands.execution_status(jsonb)') IS NOT NULL THEN
+    EXECUTE 'SELECT supacloud_commands.execution_status($1)' INTO existing_execution
+      USING jsonb_build_object('commandId',command_id);
+    IF existing_execution IS NOT NULL THEN
+      RAISE EXCEPTION 'SUPACLOUD_COMMAND_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';
+    END IF;
+  END IF;
 
   PERFORM supacloud_workflows.start_run(
     command_id,
@@ -5188,10 +5380,10 @@ BEGIN
 
   INSERT INTO supacloud_commands.receipts (
     id, command_type, target_type, target_id, actor_id, payload,
-    payload_fingerprint, workflow_run_id
+    payload_fingerprint, workflow_run_id, tenant_id
   ) VALUES (
     command_id, normalized_command_type, normalized_target_type,
-    normalized_target_id, actor_id, payload, fingerprint, command_id
+    normalized_target_id, actor_id, payload, fingerprint, command_id, tenant_id
   );
   RETURN supacloud_commands.snapshot(command_id, false);
 EXCEPTION
@@ -5200,33 +5392,79 @@ EXCEPTION
 END;
 $$;
 
-CREATE OR REPLACE FUNCTION public.supacloud_command_submit(request jsonb)
-RETURNS jsonb
-LANGUAGE sql VOLATILE SECURITY DEFINER SET search_path = '' AS $$
-  SELECT supacloud_commands.submit(request)
-$$;
-
-CREATE OR REPLACE FUNCTION public.supacloud_command_get(request jsonb)
+CREATE OR REPLACE FUNCTION supacloud_commands.status(request jsonb)
 RETURNS jsonb
 LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = '' AS $$
 DECLARE
   command_id_text text;
+  execution jsonb;
+  submission jsonb;
+  field text;
 BEGIN
   IF jsonb_typeof(request) IS DISTINCT FROM 'object' THEN
     RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
   END IF;
+  IF request ? 'commandId' THEN
+    IF jsonb_typeof(request->'commandId') IS DISTINCT FROM 'string'
+      OR request->>'commandId' !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'
+      OR EXISTS(SELECT FROM jsonb_object_keys(request) AS k WHERE k <> 'commandId') THEN
+      RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
+    END IF;
+    request := jsonb_build_object('commandId',(request->>'commandId')::uuid::text);
+  ELSE
+    IF EXISTS(SELECT FROM jsonb_object_keys(request) AS k WHERE k NOT IN ('tenantId','actorId','command','operationId')) THEN
+      RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
+    END IF;
+    FOREACH field IN ARRAY ARRAY['tenantId','actorId','command','operationId'] LOOP
+      IF jsonb_typeof(request->field) IS DISTINCT FROM 'string' OR request->>field !~ '^[A-Za-z0-9._:@|-]{1,200}$' THEN
+        RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
+      END IF;
+    END LOOP;
+  END IF;
+  IF to_regprocedure('supacloud_commands.execution_status(jsonb)') IS NOT NULL THEN
+    EXECUTE 'SELECT supacloud_commands.execution_status($1)' INTO execution USING request;
+    IF execution IS NOT NULL THEN RETURN execution; END IF;
+  END IF;
+  IF NOT (request ? 'commandId') THEN
+    IF jsonb_typeof(request->'tenantId') IS DISTINCT FROM 'string'
+      OR jsonb_typeof(request->'actorId') IS DISTINCT FROM 'string'
+      OR jsonb_typeof(request->'command') IS DISTINCT FROM 'string'
+      OR jsonb_typeof(request->'operationId') IS DISTINCT FROM 'string' THEN
+      RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
+    END IF;
+    RETURN NULL;
+  END IF;
   command_id_text := request ->> 'commandId';
   IF command_id_text IS NULL
      OR command_id_text !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$' THEN
     RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
   END IF;
-  RETURN supacloud_commands.snapshot(command_id_text::uuid, false);
+  submission := supacloud_commands.snapshot(command_id_text::uuid, false);
+  IF submission IS NULL THEN RETURN NULL; END IF;
+  RETURN jsonb_build_object('kind','submission','commandId',command_id_text::uuid,
+    'execution',NULL,'workflow',jsonb_build_object(
+      'runId',submission->'workflow'->'runId','status',submission->'workflow'->'status'));
 EXCEPTION
   WHEN invalid_parameter_value OR invalid_text_representation THEN
     RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
 END;
 $$;
 
+CREATE OR REPLACE FUNCTION public.supacloud_command_submit(request jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$
+BEGIN
+  PERFORM supacloud_commands.submit(request);
+  RETURN supacloud_commands.status(jsonb_build_object('commandId',request->>'commandId'));
+END
+$$;
+
+CREATE OR REPLACE FUNCTION public.supacloud_command_get(request jsonb)
+RETURNS jsonb
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$
+  SELECT supacloud_commands.status(request)
+$$;
+
 REVOKE ALL ON ALL TABLES IN SCHEMA supacloud_commands
   FROM PUBLIC, anon, authenticated, service_role;
 REVOKE ALL ON ALL FUNCTIONS IN SCHEMA supacloud_commands
@@ -6894,9 +7132,9 @@ class RealtimeEngine {
       return;
     const [, joinRefLen, refLen, topicLen, eventLen, metaLen, encoding] = bytes;
     let offset = 7;
-    const decoder2 = new TextDecoder;
+    const decoder = new TextDecoder;
     const read = (len) => {
-      const out = decoder2.decode(bytes.subarray(offset, offset + len));
+      const out = decoder.decode(bytes.subarray(offset, offset + len));
       offset += len;
       return out;
     };
@@ -6909,7 +7147,7 @@ class RealtimeEngine {
     const payload = {
       type: "broadcast",
       event: userEvent,
-      payload: encoding === 1 ? safeJsonParse(decoder2.decode(payloadBytes)) : payloadBytes
+      payload: encoding === 1 ? safeJsonParse(decoder.decode(payloadBytes)) : payloadBytes
     };
     this.handleBroadcast(conn, {
       topic,
@@ -7220,24 +7458,24 @@ function parseQuery(searchParams) {
     const segments = key.split(".");
     const last = segments[segments.length - 1];
     if (last === "order") {
-      const path2 = segments.slice(0, -1);
+      const path = segments.slice(0, -1);
       for (const term of splitTopLevel(value, ",")) {
-        q.order.push(parseOrderTerm(term.trim(), path2));
+        q.order.push(parseOrderTerm(term.trim(), path));
       }
       continue;
     }
     if (last === "limit" || last === "offset") {
-      const path2 = segments.slice(0, -1).join(".");
+      const path = segments.slice(0, -1).join(".");
       const n = parseInt(value, 10);
       if (Number.isNaN(n) || n < 0)
         throw new ParseError(`invalid ${last}: ${value}`);
-      (last === "limit" ? q.limits : q.offsets).set(path2, n);
+      (last === "limit" ? q.limits : q.offsets).set(path, n);
       continue;
     }
     if (last === "or" || last === "and") {
       const negated = segments[segments.length - 2] === "not";
-      const path2 = segments.slice(0, negated ? -2 : -1);
-      q.conditions.push(parseLogicTree(last, value, path2, negated));
+      const path = segments.slice(0, negated ? -2 : -1);
+      q.conditions.push(parseLogicTree(last, value, path, negated));
       continue;
     }
     if (RESERVED.has(key))
@@ -7677,13 +7915,13 @@ class QueryBuilder {
         if (c.kind !== "column" || c.name === "*") {
           throw new ParseError("spread embeds support explicit columns only");
         }
-        const expr2 = renderColumnExpr(childAlias, c.name);
+        const expr = renderColumnExpr(childAlias, c.name);
         const cast = c.cast ? `::${sanitizeCast(c.cast)}` : "";
         const out = c.alias ?? defaultAliasFor(c.name);
-        return toOne ? `(select ${expr2}${cast} from ${fromClause}${where}) as ${quoteIdent(out)}` : `coalesce((select json_agg(${expr2}${cast}${order}) from ${fromClause}${where}), ${AGG_EMPTY}) as ${quoteIdent(out)}`;
+        return toOne ? `(select ${expr}${cast} from ${fromClause}${where}) as ${quoteIdent(out)}` : `coalesce((select json_agg(${expr}${cast}${order}) from ${fromClause}${where}), ${AGG_EMPTY}) as ${quoteIdent(out)}`;
       });
-      const innerCond2 = embed.inner ? `exists (select 1 from ${fromClause}${where})` : undefined;
-      return { exprs, innerCond: innerCond2 };
+      const innerCond = embed.inner ? `exists (select 1 from ${fromClause}${where})` : undefined;
+      return { exprs, innerCond };
     }
     const sub = `select ${childExprs.join(", ")} from ${fromClause}${where}${order}${limitOffset}`;
     const expr = rel.single === true ? `(select row_to_json(_sub) from (${sub}) _sub) as ${quoteIdent(outName)}` : `coalesce((select json_agg(row_to_json(_sub)) from (${sub}) _sub), ${AGG_EMPTY}) as ${quoteIdent(outName)}`;
@@ -8142,12 +8380,12 @@ class RestHandler {
         const built = builder.buildSelect(table, { count: prefer.count !== undefined });
         const { rows, count } = await this.db.withContext(ctx, async (query) => {
           const res = await query(built.sql, built.params);
-          let count2 = null;
+          let count = null;
           if (built.countSql) {
             const c = await query(built.countSql, []);
-            count2 = c.rows[0].count;
+            count = c.rows[0].count;
           }
-          return { rows: res.rows[0].body, count: count2 };
+          return { rows: res.rows[0].body, count };
         });
         const offset = q.offsets.get("") ?? 0;
         return this.dataResponse(rows, {
@@ -8343,12 +8581,12 @@ class RestHandler {
     const countSql = prefer.count !== undefined ? `select count(*)::int as count from ${call} as ${quoteIdent(alias)}${where}` : undefined;
     const { rows, count } = await this.db.withContext(ctx, async (query) => {
       const res = await query(sql, []);
-      let count2 = null;
+      let count = null;
       if (countSql) {
         const c = await query(countSql, []);
-        count2 = c.rows[0].count;
+        count = c.rows[0].count;
       }
-      return { rows: res.rows[0].body, count: count2 };
+      return { rows: res.rows[0].body, count };
     });
     return this.dataResponse(rows, {
       status: 200,
@@ -8664,7 +8902,7 @@ class Semaphore {
       this.active += 1;
       return;
     }
-    await new Promise((resolve2) => this.waiters.push(resolve2));
+    await new Promise((resolve) => this.waiters.push(resolve));
   }
   release() {
     const next = this.waiters.shift();
@@ -8870,22 +9108,22 @@ class StorageHandler {
       }
       if (parts[0] === "render" && parts[1] === "image" && parts.length >= 5) {
         const kind = parts[2];
-        const bucket2 = parts[3];
-        const key2 = parts.slice(4).join("/");
+        const bucket = parts[3];
+        const key = parts.slice(4).join("/");
         if (kind === "public" && (method === "GET" || method === "HEAD")) {
-          const source = await this.loadPublicObject(bucket2, key2);
+          const source = await this.loadPublicObject(bucket, key);
           if (source instanceof Response)
             return source;
           return await this.transformImageResponse(source, url, method === "HEAD");
         }
         if (kind === "authenticated" && (method === "GET" || method === "HEAD")) {
-          const source = await this.loadAuthenticatedObject(ctx, bucket2, key2);
+          const source = await this.loadAuthenticatedObject(ctx, bucket, key);
           if (source instanceof Response)
             return source;
           return await this.transformImageResponse(source, url, method === "HEAD");
         }
         if (kind === "sign" && method === "GET") {
-          const source = await this.loadSignedObject(url, bucket2, key2);
+          const source = await this.loadSignedObject(url, bucket, key);
           if (source instanceof Response)
             return source;
           return await this.transformImageResponse(source, url, false);
@@ -8919,12 +9157,12 @@ class StorageHandler {
         return await this.redeemSignedUrl(url, parts[2], parts.slice(3).join("/"));
       }
       if (parts[1] === "upload" && parts[2] === "sign" && parts.length >= 5) {
-        const bucket2 = parts[3];
-        const key2 = parts.slice(4).join("/");
+        const bucket = parts[3];
+        const key = parts.slice(4).join("/");
         if (method === "POST")
-          return await this.signUploadUrl(ctx, bucket2, key2);
+          return await this.signUploadUrl(ctx, bucket, key);
         if (method === "PUT")
-          return await this.redeemSignedUpload(req, url, bucket2, key2);
+          return await this.redeemSignedUpload(req, url, bucket, key);
       }
       if (parts[1] === "info" && parts.length >= 4 && method === "GET") {
         return await this.objectInfo(ctx, parts[2], parts.slice(3).join("/"));
@@ -8959,8 +9197,8 @@ class StorageHandler {
   async withMutation(operation) {
     const previous = this.mutationTail;
     let release;
-    this.mutationTail = new Promise((resolve2) => {
-      release = resolve2;
+    this.mutationTail = new Promise((resolve) => {
+      release = resolve;
     });
     await previous;
     try {
@@ -9212,8 +9450,8 @@ class StorageHandler {
             return storageError(409, "Duplicate", "The resource already exists");
           throw error;
         }
-        const uploadId2 = crypto.randomUUID();
-        this.tusUploads.set(uploadId2, {
+        const uploadId = crypto.randomUUID();
+        this.tusUploads.set(uploadId, {
           bucketId,
           key,
           contentType,
@@ -9229,13 +9467,13 @@ class StorageHandler {
         return new Response(null, {
           status: 201,
           headers: tus({
-            location: `${url.origin}/storage/v1/upload/resumable/${uploadId2}`,
+            location: `${url.origin}/storage/v1/upload/resumable/${uploadId}`,
             "upload-offset": "0",
             "upload-length": "0"
           })
         });
       }
-      const activeUploads = [...this.tusUploads.values()].filter((upload3) => upload3.completedAt === undefined).length;
+      const activeUploads = [...this.tusUploads.values()].filter((upload) => upload.completedAt === undefined).length;
       if (activeUploads >= MAX_CONCURRENT_TUS_UPLOADS) {
         return storageError(429, "too_many_requests", "Too many resumable uploads are active");
       }
@@ -9243,7 +9481,7 @@ class StorageHandler {
       if (preflightError)
         return preflightError;
       const uploadId = crypto.randomUUID();
-      const upload2 = {
+      const upload = {
         bucketId,
         key,
         contentType,
@@ -9254,7 +9492,7 @@ class StorageHandler {
         chunks: [],
         ctx
       };
-      this.tusUploads.set(uploadId, upload2);
+      this.tusUploads.set(uploadId, upload);
       if ((req.headers.get("content-type") ?? "").includes("application/offset+octet-stream")) {
         const chunk = await readLimitedBody(req, length);
         if (chunk === null) {
@@ -9262,7 +9500,7 @@ class StorageHandler {
           return storageError(400, "invalid_request", "chunk exceeds the declared Upload-Length");
         }
         if (chunk.length > 0) {
-          const err = await this.appendTus(uploadId, upload2, 0, chunk);
+          const err = await this.appendTus(uploadId, upload, 0, chunk);
           if (err)
             return err;
         }
@@ -9271,7 +9509,7 @@ class StorageHandler {
         status: 201,
         headers: tus({
           location: `${url.origin}/storage/v1/upload/resumable/${uploadId}`,
-          "upload-offset": String(upload2.offset)
+          "upload-offset": String(upload.offset)
         })
       });
     }
@@ -11197,8 +11435,8 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
           headers: { "content-type": "application/json" }
         }));
       }
-      const ctx2 = { role: String(keyClaims.role ?? "anon"), claims: keyClaims };
-      return withCors(await auth.handle(req, ctx2, url));
+      const ctx = { role: String(keyClaims.role ?? "anon"), claims: keyClaims };
+      return withCors(await auth.handle(req, ctx, url));
     }
     if (path.startsWith("/functions/v1/")) {
       const functionName = path.replace(/^\/functions\/v1\/?/, "").split("/")[0];
@@ -11407,9 +11645,9 @@ function validatePublicationTables(tables) {
   if (missing.length > 0) {
     throw new Error(`PowerSync publication tables do not exist: ${missing.join(", ")}`);
   }
-  const unsupported2 = tables.filter((table) => table.present && !["r", "p"].includes(table.relkind ?? ""));
-  if (unsupported2.length > 0) {
-    throw new Error(`PowerSync publication only accepts ordinary or partitioned tables: ${unsupported2.map((table) => table.name).join(", ")}`);
+  const unsupported = tables.filter((table) => table.present && !["r", "p"].includes(table.relkind ?? ""));
+  if (unsupported.length > 0) {
+    throw new Error(`PowerSync publication only accepts ordinary or partitioned tables: ${unsupported.map((table) => table.name).join(", ")}`);
   }
 }
 async function configureReplicationRole(tx, passwordValue) {
@@ -11617,7 +11855,7 @@ class PgWireClient {
     return client;
   }
   open(opts) {
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve, reject) => {
       let startupComplete = false;
       this.socket = opts.socketPath ? createConnection(opts.socketPath) : createConnection(opts.port ?? 5432, opts.host ?? "127.0.0.1");
       this.socket.setTimeout(1e4, () => this.socket.destroy(new Error("PostgreSQL handshake timed out")));
@@ -11721,7 +11959,7 @@ class PgWireClient {
               this.buffer = Buffer.concat([this.buffer, c]);
               this.processMessages();
             });
-            resolve3();
+            resolve();
             return;
           }
         }
@@ -11730,10 +11968,10 @@ class PgWireClient {
     });
   }
   run(send) {
-    const op = this.queue.then(() => new Promise((resolve3, reject) => {
+    const op = this.queue.then(() => new Promise((resolve, reject) => {
       if (this.closed)
         return reject(new Error("connection closed"));
-      this.pending = { resolve: resolve3, reject, results: [], columns: [], error: null };
+      this.pending = { resolve, reject, results: [], columns: [], error: null };
       send();
     }));
     this.queue = op.catch(() => {});
@@ -11764,11 +12002,11 @@ class PgWireClient {
     return results[0] ?? { rows: [] };
   }
   close() {
-    return new Promise((resolve3) => {
+    return new Promise((resolve) => {
       if (this.closed)
-        return resolve3();
+        return resolve();
       this.socket.write(message(88, Buffer.alloc(0)));
-      this.socket.end(() => resolve3());
+      this.socket.end(() => resolve());
     });
   }
   nextMessage() {
@@ -11939,10 +12177,10 @@ function decodeValue(text, oid) {
     case 1114:
       return new Date(text.replace(" ", "T") + "Z");
     case 1184: {
-      let iso3 = text.replace(" ", "T");
-      if (/[+-]\d\d$/.test(iso3))
-        iso3 += ":00";
-      return new Date(iso3);
+      let iso = text.replace(" ", "T");
+      if (/[+-]\d\d$/.test(iso))
+        iso += ":00";
+      return new Date(iso);
     }
     case 1000:
       return parsePgArray(text).map((v) => v === "t");
@@ -12031,9 +12269,9 @@ async function buildWireEngine(options) {
       return queryMutex.run(async () => {
         await queryClient.exec("begin");
         try {
-          const response2 = await callback(transactionClient);
+          const response = await callback(transactionClient);
           await queryClient.exec("commit");
-          return response2;
+          return response;
         } catch (error) {
           await queryClient.exec("rollback").catch(() => {});
           throw error;
@@ -12262,15 +12500,15 @@ async function fetchRelease(url) {
   let lastError;
   for (let attempt = 1;attempt <= 3; attempt++) {
     try {
-      const response2 = await fetch(url, { signal: AbortSignal.timeout(30000) });
-      if (response2.ok || response2.status < 500)
-        return response2;
-      lastError = new Error(`failed to download ${url}: HTTP ${response2.status}`);
+      const response = await fetch(url, { signal: AbortSignal.timeout(30000) });
+      if (response.ok || response.status < 500)
+        return response;
+      lastError = new Error(`failed to download ${url}: HTTP ${response.status}`);
     } catch (error) {
       lastError = error;
     }
     if (attempt < 3)
-      await new Promise((resolve3) => setTimeout(resolve3, attempt * 500));
+      await new Promise((resolve) => setTimeout(resolve, attempt * 500));
   }
   throw lastError instanceof Error ? lastError : new Error(`failed to download ${url}`);
 }
@@ -12362,7 +12600,7 @@ ${detail}` : " (no output)"}
 ` + `data dir: ${opts.dataDir}
 ` + "If a previous run is still holding it, stop it; or delete the data dir to start fresh.");
           }
-          await new Promise((resolve3) => setTimeout(resolve3, 150));
+          await new Promise((resolve) => setTimeout(resolve, 150));
         }
       }
       throw new Error(`timed out waiting for embedded postgres at ${socketPath}`);
@@ -12390,14 +12628,14 @@ async function stopPostgres(postgres, hasExited) {
   if (hasExited())
     return;
   postgres.kill("SIGINT");
-  await new Promise((resolve3) => {
+  await new Promise((resolve) => {
     const killTimeout = setTimeout(() => {
       postgres.kill("SIGKILL");
-      resolve3();
+      resolve();
     }, 5000);
     postgres.once("exit", () => {
       clearTimeout(killTimeout);
-      resolve3();
+      resolve();
     });
   });
 }
@@ -12693,7 +12931,7 @@ function isFixedSearchPath(searchPath) {
 function reconcileModule(module, catalog) {
   const issues = [];
   const ownedTables = new Set(module.tables);
-  const push = (severity, code, object, message2) => issues.push({ severity, code, object, message: message2 });
+  const push = (severity, code, object, message) => issues.push({ severity, code, object, message });
   for (const policy of module.policies) {
     const [schema, table] = splitQualifiedName(policy.table);
     const found = catalog.policies.some((cp) => cp.schema === schema && cp.table === table && cp.name === policy.name);
@@ -12825,7 +13063,7 @@ function lintSql(sql, file) {
   }
   return issues;
 }
-async function lintModule(module, readFile2) {
+async function lintModule(module, readFile) {
   const issues = [];
   const sources = new Set;
   for (const decl of [
@@ -12838,7 +13076,7 @@ async function lintModule(module, readFile2) {
   }
   const contents = new Map;
   await Promise.all([...sources].map(async (path) => {
-    contents.set(path, await readFile2(path));
+    contents.set(path, await readFile(path));
   }));
   for (const [file, sql] of contents) {
     issues.push(...lintSql(sql, file));
@@ -12894,12 +13132,12 @@ function keys(row, expected) {
   }
 }
 function validTarget(value) {
-  const target2 = record(value);
-  keys(target2, ["environment", "projectRef"]);
-  if (typeof target2.environment !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(target2.environment) || typeof target2.projectRef !== "string" || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(target2.projectRef)) {
+  const target = record(value);
+  keys(target, ["environment", "projectRef"]);
+  if (typeof target.environment !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(target.environment) || typeof target.projectRef !== "string" || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(target.projectRef)) {
     throw new Error("Invalid migration binding target");
   }
-  return target2;
+  return target;
 }
 function validFile(file) {
   return typeof file === "string" && /^[a-zA-Z0-9_./-]+\.sql$/.test(file) && !file.startsWith("/") && file.split("/").every((part) => part && part !== "." && part !== "..");
@@ -12911,7 +13149,7 @@ function parseMigrationBindingManifest(value) {
     throw new Error("Invalid migration binding manifest");
   }
   const targets = manifest.targets.map(validTarget);
-  if (new Set(targets.map((target2) => target2.environment)).size !== targets.length) {
+  if (new Set(targets.map((target) => target.environment)).size !== targets.length) {
     throw new Error("Duplicate migration binding environment");
   }
   const files = new Set;
@@ -12958,8 +13196,8 @@ function bindingValue(parameter, values) {
 }
 function renderMigrationBindings(options) {
   const manifest = parseMigrationBindingManifest(options.manifest);
-  const target2 = validTarget(options.target);
-  if (!manifest.targets.some((candidate) => candidate.environment === target2.environment && candidate.projectRef === target2.projectRef)) {
+  const target = validTarget(options.target);
+  if (!manifest.targets.some((candidate) => candidate.environment === target.environment && candidate.projectRef === target.projectRef)) {
     throw new Error("Migration binding target is not registered in the manifest");
   }
   const sources = new Map;
@@ -13014,7 +13252,7 @@ function renderMigrationBindings(options) {
     migrations,
     attestation: {
       schema: "supacloud.migration-binding-attestation.v1",
-      ...target2,
+      ...target,
       manifestSha256: migrationBindingSha256(JSON.stringify(manifest)),
       files: files.sort((left, right) => left.file.localeCompare(right.file))
     }
@@ -13432,8 +13670,8 @@ function getDurationSeconds(table, key) {
     return;
   const m = v.trim().match(/^(\d+)\s*(s|m|h)$/i);
   if (!m) {
-    const n2 = parseInt(v, 10);
-    return Number.isFinite(n2) ? n2 : undefined;
+    const n = parseInt(v, 10);
+    return Number.isFinite(n) ? n : undefined;
   }
   const n = parseInt(m[1], 10);
   const unit = m[2].toLowerCase();
@@ -13711,9 +13949,9 @@ function readFunctions(root, mode) {
     const enabled = getBool(t, "enabled");
     if (enabled !== undefined)
       opts.enabled = enabled;
-    const verifyJwt2 = getBool(t, "verify_jwt");
-    if (verifyJwt2 !== undefined)
-      opts.verifyJwt = verifyJwt2;
+    const verifyJwt = getBool(t, "verify_jwt");
+    if (verifyJwt !== undefined)
+      opts.verifyJwt = verifyJwt;
     const entrypoint = getString(t, "entrypoint");
     if (entrypoint !== undefined)
       opts.entrypoint = entrypoint;
@@ -13891,8 +14129,8 @@ async function serveBun(backend, opts = {}) {
         }, { vsn: ws.data.vsn });
         ws.data.session = session;
       },
-      message(ws, message2) {
-        ws.data.session?.onMessage(typeof message2 === "string" ? message2 : new Uint8Array(message2));
+      message(ws, message) {
+        ws.data.session?.onMessage(typeof message === "string" ? message : new Uint8Array(message));
       },
       close(ws) {
         ws.data.session?.onClose();
@@ -13953,8 +14191,8 @@ class FsStorageDriver {
   async delete(key) {
     await rm2(this.resolve(key), { force: true });
   }
-  async deleteMany(keys2) {
-    for (const k of keys2)
+  async deleteMany(keys) {
+    for (const k of keys)
       await this.delete(k);
   }
 }
@@ -14283,8 +14521,8 @@ class S3StorageDriver {
   async delete(key) {
     await this.client.file(this.objectKey(key)).delete();
   }
-  async deleteMany(keys2) {
-    for (const key of keys2) {
+  async deleteMany(keys) {
+    for (const key of keys) {
       await this.delete(key);
     }
   }
@@ -14334,12 +14572,12 @@ async function assertResetPathsSafe(paths) {
     ["storage", paths.storageDir]
   ];
   for (const [label, targetPath] of targets) {
-    const target2 = resolve4(targetPath);
-    const relativePath = relative(stateDir, target2);
+    const target = resolve4(targetPath);
+    const relativePath = relative(stateDir, target);
     if (!relativePath || relativePath.startsWith("..") || isAbsolute(relativePath)) {
-      throw new Error(`refusing to reset ${label} path outside the state directory: ${target2}`);
+      throw new Error(`refusing to reset ${label} path outside the state directory: ${target}`);
     }
-    await assertResetTargetCanonical(stateDir, canonicalStateDir, target2, label);
+    await assertResetTargetCanonical(stateDir, canonicalStateDir, target, label);
   }
 }
 async function requiredResetEntry(path) {
@@ -14366,8 +14604,8 @@ async function assertResetSecretsValid(path) {
     throw new Error(RESET_INVALID_SECRETS_ERROR);
   }
 }
-async function assertResetTargetCanonical(stateDir, canonicalStateDir, target2, label) {
-  let current = target2;
+async function assertResetTargetCanonical(stateDir, canonicalStateDir, target, label) {
+  let current = target;
   while (current !== stateDir) {
     try {
       if ((await lstat2(current)).isSymbolicLink()) {
@@ -14379,18 +14617,18 @@ async function assertResetTargetCanonical(stateDir, canonicalStateDir, target2,
     }
     const parent = dirname6(current);
     if (parent === current)
-      throw new Error(`refusing to reset ${label} path outside the state directory: ${target2}`);
+      throw new Error(`refusing to reset ${label} path outside the state directory: ${target}`);
     current = parent;
   }
-  const existingAncestor = await nearestExistingAncestor(target2);
-  const canonicalTarget = resolve4(await realpath2(existingAncestor), relative(existingAncestor, target2));
+  const existingAncestor = await nearestExistingAncestor(target);
+  const canonicalTarget = resolve4(await realpath2(existingAncestor), relative(existingAncestor, target));
   const canonicalRelative = relative(canonicalStateDir, canonicalTarget);
   if (!canonicalRelative || canonicalRelative.startsWith("..") || isAbsolute(canonicalRelative)) {
-    throw new Error(`refusing to reset ${label} path outside the canonical state directory: ${target2}`);
+    throw new Error(`refusing to reset ${label} path outside the canonical state directory: ${target}`);
   }
 }
-async function nearestExistingAncestor(target2) {
-  let current = target2;
+async function nearestExistingAncestor(target) {
+  let current = target;
   while (true) {
     try {
       await lstat2(current);
@@ -14401,7 +14639,7 @@ async function nearestExistingAncestor(target2) {
     }
     const parent = dirname6(current);
     if (parent === current)
-      throw new Error(`unable to resolve an existing ancestor for ${target2}`);
+      throw new Error(`unable to resolve an existing ancestor for ${target}`);
     current = parent;
   }
 }
@@ -14429,14 +14667,14 @@ async function ensureProjectSecrets(paths) {
 `, { mode: 384, flag: "wx" });
       await link(temporaryFile, paths.secretsFile);
       stored = candidate;
-    } catch (error2) {
-      if (error2.code !== "EEXIST")
-        throw error2;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
       stored = validateSecrets(JSON.parse(await readFile7(paths.secretsFile, "utf8")));
     } finally {
-      await unlink2(temporaryFile).catch((error2) => {
-        if (error2.code !== "ENOENT")
-          throw error2;
+      await unlink2(temporaryFile).catch((error) => {
+        if (error.code !== "ENOENT")
+          throw error;
       });
     }
   }
@@ -14938,10 +15176,10 @@ async function stageDirectory(root, destination) {
     throw error;
   }
   await mkdir6(destination, { recursive: true });
-  const walk = async (current, target2) => {
+  const walk = async (current, target) => {
     for (const entry of await readdir3(current, { withFileTypes: true })) {
       const fullPath = join9(current, entry.name);
-      const targetPath = join9(target2, entry.name);
+      const targetPath = join9(target, entry.name);
       if (entry.isSymbolicLink())
         throw new Error(`snapshot refuses symbolic link: ${fullPath}`);
       if (entry.isDirectory()) {
@@ -14956,9 +15194,9 @@ async function stageDirectory(root, destination) {
   };
   await walk(root, destination);
 }
-async function stageFile(source, target2) {
-  await mkdir6(dirname7(target2), { recursive: true });
-  await copyFile(source, target2);
+async function stageFile(source, target) {
+  await mkdir6(dirname7(target), { recursive: true });
+  await copyFile(source, target);
 }
 async function readManifest(payloadRoot) {
   let parsed;
@@ -15030,9 +15268,9 @@ async function assertRestoreTargets(paths, manifest, force) {
   if (manifest.includesLocalStorage && !isWithin(paths.stateDir, paths.storageDir))
     targets.push(paths.storageDir);
   if (!force) {
-    for (const target2 of targets) {
-      if (await directoryHasEntries(target2))
-        throw new Error(`restore target is not empty: ${target2}; pass --force to replace it`);
+    for (const target of targets) {
+      if (await directoryHasEntries(target))
+        throw new Error(`restore target is not empty: ${target}; pass --force to replace it`);
     }
   }
 }
@@ -15045,28 +15283,28 @@ async function directoryHasEntries(path) {
     throw error;
   }
 }
-async function applyDirectorySwap(source, target2, force, rollbackId, swaps) {
-  const targetInfo = await existingInfo(target2);
+async function applyDirectorySwap(source, target, force, rollbackId, swaps) {
+  const targetInfo = await existingInfo(target);
   if (targetInfo && !targetInfo.isDirectory())
-    throw new Error(`restore target is not a directory: ${target2}`);
-  const swap = { target: target2 };
+    throw new Error(`restore target is not a directory: ${target}`);
+  const swap = { target };
   if (targetInfo) {
     if (!force) {
-      if (await directoryHasEntries(target2))
-        throw new Error(`restore target is not empty: ${target2}; pass --force to replace it`);
-      await rm5(target2, { recursive: true, force: true });
+      if (await directoryHasEntries(target))
+        throw new Error(`restore target is not empty: ${target}; pass --force to replace it`);
+      await rm5(target, { recursive: true, force: true });
     } else {
-      swap.rollbackPath = join9(dirname7(target2), `.${target2.split(sep2).pop() ?? "state"}.restore-${rollbackId}`);
-      await rename2(target2, swap.rollbackPath);
+      swap.rollbackPath = join9(dirname7(target), `.${target.split(sep2).pop() ?? "state"}.restore-${rollbackId}`);
+      await rename2(target, swap.rollbackPath);
     }
   }
   try {
-    await mkdir6(dirname7(target2), { recursive: true });
-    await rename2(source, target2);
+    await mkdir6(dirname7(target), { recursive: true });
+    await rename2(source, target);
     swaps.push(swap);
   } catch (error) {
     if (swap.rollbackPath)
-      await rename2(swap.rollbackPath, target2).catch(() => {});
+      await rename2(swap.rollbackPath, target).catch(() => {});
     throw error;
   }
 }
@@ -15086,17 +15324,17 @@ async function existingInfo(path) {
     throw error;
   }
 }
-async function copyEntry(source, target2) {
+async function copyEntry(source, target) {
   const info = await lstat3(source);
   if (info.isSymbolicLink())
     throw new Error(`snapshot refuses symbolic link: ${source}`);
   if (info.isDirectory()) {
-    await mkdir6(target2, { recursive: true });
+    await mkdir6(target, { recursive: true });
     for (const entry of await readdir3(source))
-      await copyEntry(join9(source, entry), join9(target2, entry));
+      await copyEntry(join9(source, entry), join9(target, entry));
   } else if (info.isFile()) {
-    await mkdir6(dirname7(target2), { recursive: true });
-    await Bun.write(target2, Bun.file(source));
+    await mkdir6(dirname7(target), { recursive: true });
+    await Bun.write(target, Bun.file(source));
   } else
     throw new Error(`snapshot refuses unsupported filesystem entry: ${source}`);
 }
@@ -15251,13 +15489,13 @@ async function main() {
   }
   if (options.command === "keys") {
     const secrets = await ensureProjectSecrets(paths);
-    const keys2 = await mintProjectKeys(secrets.jwtSecret);
+    const keys = await mintProjectKeys(secrets.jwtSecret);
     const privilegedKey = options.serviceRole ? `
 service_role key:
-${keys2.serviceRoleKey}` : `
+${keys.serviceRoleKey}` : `
 Use --service-role to print the privileged key.`;
     await writeStandardOutput(`anon key:
-${keys2.anonKey}
+${keys.anonKey}
 ${privilegedKey}
 `);
     return;
@@ -15278,7 +15516,7 @@ ${privilegedKey}
     if (options.positionals[0] && options.positionals[0] !== "types" && options.positionals[0] !== "typescript") {
       throw new Error(`unknown gen subcommand: ${options.positionals[0]}`);
     }
-    const project2 = await createProjectBackend({
+    const project = await createProjectBackend({
       ...options,
       applyMigrations: false,
       includeFunctions: false,
@@ -15289,7 +15527,7 @@ ${privilegedKey}
       log: quietLog
     });
     try {
-      const source = await generateTypes(project2.backend.db, "public");
+      const source = await generateTypes(project.backend.db, "public");
       if (options.output) {
         await mkdir7(dirname8(options.output), { recursive: true });
         await writeFile7(options.output, source);
@@ -15298,12 +15536,12 @@ ${privilegedKey}
       } else
         await writeStandardOutput(source);
     } finally {
-      await project2.backend.close();
+      await project.backend.close();
     }
     return;
   }
   if (options.command === "inspect") {
-    const project2 = await createProjectBackend({
+    const project = await createProjectBackend({
       ...options,
       applyMigrations: false,
       includeFunctions: false,
@@ -15314,9 +15552,9 @@ ${privilegedKey}
       log: quietLog
     });
     try {
-      await printInspection(await inspectDb(project2.backend.db, "public"));
+      await printInspection(await inspectDb(project.backend.db, "public"));
     } finally {
-      await project2.backend.close();
+      await project.backend.close();
     }
     return;
   }
@@ -15354,7 +15592,7 @@ ${privilegedKey}
     return;
   }
   if (options.command === "migrate" || options.command === "status") {
-    const project2 = await createProjectBackend({
+    const project = await createProjectBackend({
       ...options,
       applyMigrations: options.command === "migrate",
       includeFunctions: false,
@@ -15366,13 +15604,13 @@ ${privilegedKey}
       log: quietLog
     });
     try {
-      const applied = await project2.backend.db.listAppliedMigrations();
+      const applied = await project.backend.db.listAppliedMigrations();
       if (options.json) {
         await writeStandardOutput(`${JSON.stringify({
           schema: "supacloud.lite-migrations.v1",
           command: options.command,
           applied,
-          binding_attestation: project2.bindingAttestation ?? null
+          binding_attestation: project.bindingAttestation ?? null
         }, null, 2)}
 `);
         return;
@@ -15382,13 +15620,13 @@ ${privilegedKey}
       await writeStandardOutput(`${output}
 `);
     } finally {
-      await project2.backend.close();
+      await project.backend.close();
     }
     return;
   }
   if (options.command !== "start")
     throw new Error(`unknown command: ${options.command}`);
-  const project = await startProjectServer({ ...options, log: (message2) => console.log(`  ${message2}`) });
+  const project = await startProjectServer({ ...options, log: (message) => console.log(`  ${message}`) });
   const shutdown = waitForShutdown(() => project.close());
   await writeStandardOutput(`
   SupaCloud Lite running
@@ -15420,7 +15658,7 @@ async function runDbCommand(options) {
     if (paths.dataDir)
       await rm6(paths.dataDir, { recursive: true, force: true });
     await rm6(paths.storageDir, { recursive: true, force: true });
-    const project2 = await createProjectBackend({
+    const project = await createProjectBackend({
       ...options,
       includeFunctions: false,
       includeWebhooks: false,
@@ -15430,11 +15668,11 @@ async function runDbCommand(options) {
       log: quietLog
     });
     try {
-      const applied = await project2.backend.db.listAppliedMigrations();
+      const applied = await project.backend.db.listAppliedMigrations();
       await writeStandardOutput(`reset complete: ${applied.length} migration(s) applied
 `);
     } finally {
-      await project2.backend.close();
+      await project.backend.close();
     }
     return;
   }
@@ -15504,7 +15742,7 @@ async function runDbCommand(options) {
   }
   if (subcommand === "check") {
     const moduleFile = options.moduleFile ?? join10(paths.projectDir, "supabase", "db", "modules.ts");
-    const project2 = await createProjectBackend({
+    const project = await createProjectBackend({
       ...options,
       applyMigrations: false,
       includeFunctions: false,
@@ -15516,14 +15754,14 @@ async function runDbCommand(options) {
     });
     try {
       const executor = {
-        query: async (sql, params) => (await project2.backend.db.query(sql, params)).rows
+        query: async (sql, params) => (await project.backend.db.query(sql, params)).rows
       };
       const result = await checkDatabaseModules({ moduleFile, executor });
       await writeStandardOutput(formatDatabaseModuleCheck(result));
       if (!result.ok)
         throw new Error("db check found error-level issues");
     } finally {
-      await project2.backend.close();
+      await project.backend.close();
     }
     return;
   }