@supacloud/lite 0.14.0 → 0.16.0

package/dist/index.js

@@ -1,6 +1,4 @@
 // @bun
-var __require = import.meta.require;
-
 // src/runtime/jwt.ts
 var encoder = new TextEncoder;
 var decoder = new TextDecoder;
@@ -85,7 +83,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.14.0",
+  version: "0.16.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -145,13 +143,13 @@ var package_default = {
     "@supacloud/compiler": "^0.13.1",
     "@supacloud/elysia": "^0.10.0",
     "@supabase/supabase-js": "^2.115.0",
-    "@types/bun": "^1.4.0",
+    "@types/bun": "^1.4.2",
     elysia: "^1.4.30",
     jose: "^6.2.11",
     typescript: "^7.0.2"
   },
   engines: {
-    bun: ">=1.4.0"
+    bun: ">=1.4.2"
   },
   publishConfig: {
     access: "public",
@@ -427,10 +425,15 @@ class OAuthService {
         JSON.stringify({ provider, providers: [provider] }),
         JSON.stringify({ sub: profile.id, email: profile.email, full_name: profile.name, ...profile.metadata })
       ]);
-      userId = created.rows[0].id;
+      const user = created.rows[0];
+      if (!user)
+        throw new Error("OAuth user creation returned no row");
+      userId = user.id;
     }
     await this.db.query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
        values ($1, $2, $3, $4::jsonb)`, [userId, provider, profile.id, JSON.stringify({ sub: profile.id, email: profile.email, ...profile.metadata })]);
+    if (!userId)
+      throw new Error("OAuth identity has no user ID");
     return userId;
   }
 }
@@ -643,10 +646,10 @@ class QrCode {
     const bytes = new TextEncoder().encode(text);
     let version = 1;
     for (;version <= 40; version++) {
-      const dataCapacityBits2 = getNumDataCodewords(version) * 8;
+      const dataCapacityBits = getNumDataCodewords(version) * 8;
       const ccBits = version < 10 ? 8 : 16;
       const usedBits = 4 + ccBits + bytes.length * 8;
-      if (usedBits <= dataCapacityBits2)
+      if (usedBits <= dataCapacityBits)
         break;
     }
     if (version > 40)
@@ -1338,10 +1341,10 @@ class AuthHandler {
       if (!this.settings.anonymousUsers) {
         return authError(422, "anonymous_provider_disabled", "Anonymous sign-ins are disabled");
       }
-      const res2 = await this.db.query(`insert into auth.users (aud, role, raw_app_meta_data, raw_user_meta_data, is_anonymous, last_sign_in_at)
+      const res = await this.db.query(`insert into auth.users (aud, role, raw_app_meta_data, raw_user_meta_data, is_anonymous, last_sign_in_at)
          values ('authenticated', 'authenticated', '{}', $1, true, now())
          returning *`, [JSON.stringify(body.data ?? {})]);
-      return json(200, await this.sessionFor(res2.rows[0]));
+      return json(200, await this.sessionFor(res.rows[0]));
     }
     if (this.settings.disableSignup) {
       return authError(422, "signup_disabled", "Signups not allowed for this instance");
@@ -3935,45 +3938,202 @@ AS $$
 DECLARE
   normalized_queue_name text := lower(btrim(queue_name));
 BEGIN
-  IF normalized_queue_name IS NULL
-     OR left(normalized_queue_name, char_length('supacloud_internal_')) = 'supacloud_internal_' THEN
+  IF left(normalized_queue_name, char_length('supacloud_internal_')) = 'supacloud_internal_' THEN
     RAISE EXCEPTION 'SUPACLOUD_QUEUE_NAME_RESERVED' USING ERRCODE = '42501';
   END IF;
-  RETURN normalized_queue_name;
+  IF queue_name IS NULL OR queue_name !~ '^[a-z0-9][a-z0-9_-]{0,127}$' THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_NAME_INVALID' USING ERRCODE = '22023';
+  END IF;
+  RETURN queue_name;
+END;
+$$;
+
+-- Return-type changes require replacement. Do not CASCADE through user dependencies.
+DO $pgmq_receipt_types$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_catalog.pg_proc
+    WHERE oid = to_regprocedure('pgmq_public.send(text,jsonb,integer)')
+      AND prorettype = 'bigint'::regtype
+  ) THEN
+    DROP FUNCTION pgmq_public.send(text,jsonb,integer);
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM pg_catalog.pg_proc
+    WHERE oid = to_regprocedure('pgmq_public.send_batch(text,jsonb[],integer)')
+      AND prorettype = 'bigint'::regtype
+  ) THEN
+    DROP FUNCTION pgmq_public.send_batch(text,jsonb[],integer);
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM pg_catalog.pg_proc
+    WHERE oid = to_regprocedure('pgmq_public.read(text,integer,integer)')
+      AND prorettype = 'pgmq.message_record'::regtype
+  ) THEN
+    DROP FUNCTION pgmq_public.read(text,integer,integer);
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM pg_catalog.pg_proc
+    WHERE oid = to_regprocedure('pgmq_public.pop(text)')
+      AND prorettype = 'pgmq.message_record'::regtype
+  ) THEN
+    DROP FUNCTION pgmq_public.pop(text);
+  END IF;
+END
+$pgmq_receipt_types$;
+
+CREATE OR REPLACE FUNCTION pgmq_public.require_seconds(value integer)
+RETURNS integer LANGUAGE plpgsql IMMUTABLE SET search_path = ''
+AS $$
+BEGIN
+  IF value IS NULL OR value < 0 THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_SECONDS_INVALID' USING ERRCODE = '22023';
+  END IF;
+  RETURN value;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION pgmq_public.require_read_count(value integer)
+RETURNS integer LANGUAGE plpgsql IMMUTABLE SET search_path = ''
+AS $$
+BEGIN
+  IF value IS NULL OR value < 1 OR value > 10000 THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_COUNT_INVALID' USING ERRCODE = '22023';
+  END IF;
+  RETURN value;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION pgmq_public.require_message_id(value bigint)
+RETURNS bigint LANGUAGE plpgsql IMMUTABLE SET search_path = ''
+AS $$
+BEGIN
+  IF value IS NULL OR value < 1 THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_MESSAGE_ID_INVALID' USING ERRCODE = '22023';
+  END IF;
+  RETURN value;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION pgmq_public.message_node_count(value jsonb)
+RETURNS integer LANGUAGE plpgsql IMMUTABLE SET search_path = ''
+AS $$
+DECLARE
+  node_count integer;
+  maximum_depth integer;
+BEGIN
+  IF value IS NULL THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_MESSAGE_INVALID' USING ERRCODE = '22023';
+  END IF;
+  IF octet_length(convert_to(value::text, 'UTF8')) > 1048576 THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_PAYLOAD_TOO_LARGE' USING ERRCODE = '22023';
+  END IF;
+  WITH RECURSIVE tree(item, depth) AS (
+    SELECT value, 0
+    UNION ALL
+    SELECT child.item, tree.depth + 1
+    FROM tree
+    CROSS JOIN LATERAL (
+      SELECT element AS item
+      FROM jsonb_array_elements(CASE WHEN jsonb_typeof(tree.item) = 'array' THEN tree.item ELSE '[]'::jsonb END) AS element
+      UNION ALL
+      SELECT entry.value AS item
+      FROM jsonb_each(CASE WHEN jsonb_typeof(tree.item) = 'object' THEN tree.item ELSE '{}'::jsonb END) AS entry
+    ) AS child
+    WHERE tree.depth < 65
+  )
+  SELECT count(*)::integer, max(depth) INTO node_count, maximum_depth
+  FROM (SELECT depth FROM tree LIMIT 10001) AS bounded;
+  IF node_count > 10000 OR maximum_depth > 64 THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_STRUCTURE_TOO_LARGE' USING ERRCODE = '22023';
+  END IF;
+  RETURN node_count;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION pgmq_public.require_message(value jsonb)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE SET search_path = ''
+AS $$
+BEGIN
+  PERFORM pgmq_public.message_node_count(value);
+  RETURN value;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION pgmq_public.require_messages(values_ jsonb[])
+RETURNS jsonb[] LANGUAGE plpgsql IMMUTABLE SET search_path = ''
+AS $$
+DECLARE
+  item jsonb;
+  total_bytes bigint := 0;
+  total_nodes integer := 0;
+BEGIN
+  IF values_ IS NULL OR cardinality(values_) < 1 OR cardinality(values_) > 10000
+     OR array_ndims(values_) <> 1 OR array_lower(values_, 1) <> 1 THEN
+    RAISE EXCEPTION 'SUPACLOUD_QUEUE_BATCH_INVALID' USING ERRCODE = '22023';
+  END IF;
+  FOREACH item IN ARRAY values_ LOOP
+    total_nodes := total_nodes + pgmq_public.message_node_count(item);
+    IF total_nodes > 100000 THEN
+      RAISE EXCEPTION 'SUPACLOUD_QUEUE_STRUCTURE_TOO_LARGE' USING ERRCODE = '22023';
+    END IF;
+    total_bytes := total_bytes + octet_length(convert_to(item::text, 'UTF8'));
+    IF total_bytes > 8388608 THEN
+      RAISE EXCEPTION 'SUPACLOUD_QUEUE_PAYLOAD_TOO_LARGE' USING ERRCODE = '22023';
+    END IF;
+  END LOOP;
+  RETURN values_;
 END;
 $$;
 
 CREATE OR REPLACE FUNCTION pgmq_public.send(queue_name text, message jsonb, sleep_seconds integer DEFAULT 0)
-RETURNS SETOF bigint
+RETURNS SETOF text
 LANGUAGE sql
 VOLATILE
 SECURITY DEFINER
 SET search_path = ''
-AS $$ SELECT * FROM pgmq.send(pgmq_public.require_public_queue(queue_name), message, sleep_seconds); $$;
+AS $$ SELECT receipt.msg_id::text FROM pgmq.send(pgmq_public.require_public_queue(queue_name), pgmq_public.require_message(message), pgmq_public.require_seconds(sleep_seconds)) AS receipt(msg_id); $$;
 
 CREATE OR REPLACE FUNCTION pgmq_public.send_batch(queue_name text, messages jsonb[], sleep_seconds integer DEFAULT 0)
-RETURNS SETOF bigint
+RETURNS SETOF text
 LANGUAGE sql
 VOLATILE
 SECURITY DEFINER
 SET search_path = ''
-AS $$ SELECT * FROM pgmq.send_batch(pgmq_public.require_public_queue(queue_name), messages, sleep_seconds); $$;
+AS $$ SELECT receipt.msg_id::text FROM pgmq.send_batch(pgmq_public.require_public_queue(queue_name), pgmq_public.require_messages(messages), pgmq_public.require_seconds(sleep_seconds)) AS receipt(msg_id); $$;
 
 CREATE OR REPLACE FUNCTION pgmq_public.read(queue_name text, sleep_seconds integer, n integer)
-RETURNS SETOF pgmq.message_record
+RETURNS TABLE (
+  msg_id text, read_ct integer, enqueued_at timestamptz,
+  last_read_at timestamptz, vt timestamptz, message jsonb, headers jsonb
+)
 LANGUAGE sql
 VOLATILE
 SECURITY DEFINER
 SET search_path = ''
-AS $$ SELECT * FROM pgmq.read(pgmq_public.require_public_queue(queue_name), sleep_seconds, n); $$;
+AS $$
+  SELECT receipt.msg_id::text, receipt.read_ct, receipt.enqueued_at,
+    (to_jsonb(receipt)->>'last_read_at')::timestamptz, receipt.vt,
+    receipt.message, to_jsonb(receipt)->'headers'
+  FROM pgmq.read(pgmq_public.require_public_queue(queue_name),
+    pgmq_public.require_seconds(sleep_seconds), pgmq_public.require_read_count(n)) AS receipt;
+$$;
 
 CREATE OR REPLACE FUNCTION pgmq_public.pop(queue_name text)
-RETURNS SETOF pgmq.message_record
+RETURNS TABLE (
+  msg_id text, read_ct integer, enqueued_at timestamptz,
+  last_read_at timestamptz, vt timestamptz, message jsonb, headers jsonb
+)
 LANGUAGE sql
 VOLATILE
 SECURITY DEFINER
 SET search_path = ''
-AS $$ SELECT * FROM pgmq.pop(pgmq_public.require_public_queue(queue_name)); $$;
+AS $$
+  SELECT receipt.msg_id::text, receipt.read_ct, receipt.enqueued_at,
+    (to_jsonb(receipt)->>'last_read_at')::timestamptz, receipt.vt,
+    receipt.message, to_jsonb(receipt)->'headers'
+  FROM pgmq.pop(pgmq_public.require_public_queue(queue_name)) AS receipt;
+$$;
 
 CREATE OR REPLACE FUNCTION pgmq_public.archive(queue_name text, message_id bigint)
 RETURNS boolean
@@ -3981,7 +4141,7 @@ LANGUAGE sql
 VOLATILE
 SECURITY DEFINER
 SET search_path = ''
-AS $$ SELECT pgmq.archive(pgmq_public.require_public_queue(queue_name), message_id); $$;
+AS $$ SELECT pgmq.archive(pgmq_public.require_public_queue(queue_name), pgmq_public.require_message_id(message_id)); $$;
 
 CREATE OR REPLACE FUNCTION pgmq_public."delete"(queue_name text, message_id bigint)
 RETURNS boolean
@@ -3989,10 +4149,12 @@ LANGUAGE sql
 VOLATILE
 SECURITY DEFINER
 SET search_path = ''
-AS $$ SELECT pgmq.delete(pgmq_public.require_public_queue(queue_name), message_id); $$;
+AS $$ SELECT pgmq.delete(pgmq_public.require_public_queue(queue_name), pgmq_public.require_message_id(message_id)); $$;
 
 REVOKE ALL ON ALL FUNCTIONS IN SCHEMA pgmq_public FROM PUBLIC;
 GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA pgmq_public TO anon, authenticated, service_role;
+
+NOTIFY pgrst, 'reload schema';
 -- supacloud:sql-module:pgmq-public:end
 `;
 var WORKFLOWS_SQL = `
@@ -4615,7 +4777,12 @@ BEGIN
        OR (retry_receipt ->> 'delaySeconds')::integer IS DISTINCT FROM p_delay_seconds THEN
       RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';
     END IF;
-    RETURN supacloud_workflows.snapshot(current_step.run_id, true);
+    retry_receipt := retry_receipt || jsonb_build_object(
+      'stepId', current_step.id,
+      'attempt', p_attempt
+    );
+    RETURN supacloud_workflows.snapshot(current_step.run_id, true)
+      || jsonb_build_object('retryReceipt', retry_receipt);
   END IF;
   IF normalized_worker_id IS NULL
      OR p_message_id IS NULL
@@ -4643,19 +4810,22 @@ BEGIN
     IF NOT FOUND THEN
       RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RUN_NOT_ACTIVE' USING ERRCODE = '55000';
     END IF;
+    retry_receipt := jsonb_build_object(
+      'operation', 'retry',
+      'stepId', current_step.id,
+      'messageId', p_message_id::text,
+      'attempt', p_attempt,
+      'workerId', normalized_worker_id,
+      'errorMessage', normalized_error,
+      'delaySeconds', p_delay_seconds
+    );
     INSERT INTO supacloud_workflows.events (
       run_id, step_id, event_type, attempt, details
     ) VALUES (
-      current_step.run_id, current_step.id, 'step_dead_lettered', p_attempt,
-      jsonb_build_object(
-        'operation', 'retry',
-        'messageId', p_message_id::text,
-        'workerId', normalized_worker_id,
-        'errorMessage', normalized_error,
-        'delaySeconds', p_delay_seconds
-      )
+      current_step.run_id, current_step.id, 'step_dead_lettered', p_attempt, retry_receipt
     );
-    RETURN supacloud_workflows.snapshot(current_step.run_id, false);
+    RETURN supacloud_workflows.snapshot(current_step.run_id, false)
+      || jsonb_build_object('retryReceipt', retry_receipt);
   END IF;
 
   SELECT EXISTS (
@@ -4668,19 +4838,22 @@ BEGIN
   SET status = 'queued', error_message = normalized_error,
       retry_delay_seconds = p_delay_seconds, updated_at = now()
   WHERE id = current_step.id;
+  retry_receipt := jsonb_build_object(
+    'operation', 'retry',
+    'stepId', current_step.id,
+    'messageId', p_message_id::text,
+    'attempt', p_attempt,
+    'workerId', normalized_worker_id,
+    'errorMessage', normalized_error,
+    'delaySeconds', p_delay_seconds
+  );
   INSERT INTO supacloud_workflows.events (
     run_id, step_id, event_type, attempt, details
   ) VALUES (
-    current_step.run_id, current_step.id, 'step_retried', p_attempt,
-    jsonb_build_object(
-      'operation', 'retry',
-      'messageId', p_message_id::text,
-      'workerId', normalized_worker_id,
-      'errorMessage', normalized_error,
-      'delaySeconds', p_delay_seconds
-    )
+    current_step.run_id, current_step.id, 'step_retried', p_attempt, retry_receipt
   );
-  RETURN supacloud_workflows.snapshot(current_step.run_id, false);
+  RETURN supacloud_workflows.snapshot(current_step.run_id, false)
+    || jsonb_build_object('retryReceipt', retry_receipt);
 END;
 $$;
 
@@ -5091,6 +5264,8 @@ CREATE TABLE IF NOT EXISTS supacloud_commands.receipts (
 CREATE INDEX IF NOT EXISTS supacloud_commands_target_idx
   ON supacloud_commands.receipts (target_type, target_id, created_at DESC, id);
 
+ALTER TABLE supacloud_commands.receipts ADD COLUMN IF NOT EXISTS tenant_id text;
+
 CREATE OR REPLACE FUNCTION supacloud_commands.snapshot(
   p_command_id uuid,
   p_idempotent boolean DEFAULT false
@@ -5102,6 +5277,7 @@ LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$
     'targetType', receipt.target_type,
     'targetId', receipt.target_id,
     'actorId', receipt.actor_id,
+    'tenantId', receipt.tenant_id,
     'payloadFingerprint', receipt.payload_fingerprint,
     'createdAt', receipt.created_at,
     'idempotent', p_idempotent,
@@ -5129,6 +5305,8 @@ DECLARE
   normalized_target_id text;
   fingerprint text;
   existing supacloud_commands.receipts%ROWTYPE;
+  tenant_id text;
+  existing_execution jsonb;
 BEGIN
   IF jsonb_typeof(request) IS DISTINCT FROM 'object' THEN
     RAISE EXCEPTION 'SUPACLOUD_COMMAND_INVALID' USING ERRCODE = '22023';
@@ -5139,6 +5317,11 @@ BEGIN
     RAISE EXCEPTION 'SUPACLOUD_COMMAND_INVALID' USING ERRCODE = '22023';
   END IF;
   command_id := command_id_text::uuid;
+  tenant_id := request->>'tenantId';
+  IF request ? 'tenantId' AND (jsonb_typeof(request->'tenantId') IS DISTINCT FROM 'string'
+    OR tenant_id !~ '^[A-Za-z0-9._:@|-]{1,200}$') THEN
+    RAISE EXCEPTION 'SUPACLOUD_COMMAND_INVALID' USING ERRCODE = '22023';
+  END IF;
   IF request ? 'actorId' AND request ->> 'actorId' IS NOT NULL THEN
     actor_id := (request ->> 'actorId')::uuid;
   END IF;
@@ -5166,12 +5349,20 @@ BEGIN
        OR existing.target_type <> normalized_target_type
        OR existing.target_id <> normalized_target_id
        OR existing.actor_id IS DISTINCT FROM actor_id
+       OR existing.tenant_id IS DISTINCT FROM tenant_id
        OR existing.payload <> payload
        OR existing.payload_fingerprint <> fingerprint THEN
       RAISE EXCEPTION 'SUPACLOUD_COMMAND_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';
     END IF;
     RETURN supacloud_commands.snapshot(command_id, true);
   END IF;
+  IF to_regprocedure('supacloud_commands.execution_status(jsonb)') IS NOT NULL THEN
+    EXECUTE 'SELECT supacloud_commands.execution_status($1)' INTO existing_execution
+      USING jsonb_build_object('commandId',command_id);
+    IF existing_execution IS NOT NULL THEN
+      RAISE EXCEPTION 'SUPACLOUD_COMMAND_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';
+    END IF;
+  END IF;
 
   PERFORM supacloud_workflows.start_run(
     command_id,
@@ -5192,10 +5383,10 @@ BEGIN
 
   INSERT INTO supacloud_commands.receipts (
     id, command_type, target_type, target_id, actor_id, payload,
-    payload_fingerprint, workflow_run_id
+    payload_fingerprint, workflow_run_id, tenant_id
   ) VALUES (
     command_id, normalized_command_type, normalized_target_type,
-    normalized_target_id, actor_id, payload, fingerprint, command_id
+    normalized_target_id, actor_id, payload, fingerprint, command_id, tenant_id
   );
   RETURN supacloud_commands.snapshot(command_id, false);
 EXCEPTION
@@ -5204,33 +5395,79 @@ EXCEPTION
 END;
 $$;
 
-CREATE OR REPLACE FUNCTION public.supacloud_command_submit(request jsonb)
-RETURNS jsonb
-LANGUAGE sql VOLATILE SECURITY DEFINER SET search_path = '' AS $$
-  SELECT supacloud_commands.submit(request)
-$$;
-
-CREATE OR REPLACE FUNCTION public.supacloud_command_get(request jsonb)
+CREATE OR REPLACE FUNCTION supacloud_commands.status(request jsonb)
 RETURNS jsonb
 LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = '' AS $$
 DECLARE
   command_id_text text;
+  execution jsonb;
+  submission jsonb;
+  field text;
 BEGIN
   IF jsonb_typeof(request) IS DISTINCT FROM 'object' THEN
     RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
   END IF;
+  IF request ? 'commandId' THEN
+    IF jsonb_typeof(request->'commandId') IS DISTINCT FROM 'string'
+      OR request->>'commandId' !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'
+      OR EXISTS(SELECT FROM jsonb_object_keys(request) AS k WHERE k <> 'commandId') THEN
+      RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
+    END IF;
+    request := jsonb_build_object('commandId',(request->>'commandId')::uuid::text);
+  ELSE
+    IF EXISTS(SELECT FROM jsonb_object_keys(request) AS k WHERE k NOT IN ('tenantId','actorId','command','operationId')) THEN
+      RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
+    END IF;
+    FOREACH field IN ARRAY ARRAY['tenantId','actorId','command','operationId'] LOOP
+      IF jsonb_typeof(request->field) IS DISTINCT FROM 'string' OR request->>field !~ '^[A-Za-z0-9._:@|-]{1,200}$' THEN
+        RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
+      END IF;
+    END LOOP;
+  END IF;
+  IF to_regprocedure('supacloud_commands.execution_status(jsonb)') IS NOT NULL THEN
+    EXECUTE 'SELECT supacloud_commands.execution_status($1)' INTO execution USING request;
+    IF execution IS NOT NULL THEN RETURN execution; END IF;
+  END IF;
+  IF NOT (request ? 'commandId') THEN
+    IF jsonb_typeof(request->'tenantId') IS DISTINCT FROM 'string'
+      OR jsonb_typeof(request->'actorId') IS DISTINCT FROM 'string'
+      OR jsonb_typeof(request->'command') IS DISTINCT FROM 'string'
+      OR jsonb_typeof(request->'operationId') IS DISTINCT FROM 'string' THEN
+      RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
+    END IF;
+    RETURN NULL;
+  END IF;
   command_id_text := request ->> 'commandId';
   IF command_id_text IS NULL
      OR command_id_text !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$' THEN
     RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
   END IF;
-  RETURN supacloud_commands.snapshot(command_id_text::uuid, false);
+  submission := supacloud_commands.snapshot(command_id_text::uuid, false);
+  IF submission IS NULL THEN RETURN NULL; END IF;
+  RETURN jsonb_build_object('kind','submission','commandId',command_id_text::uuid,
+    'execution',NULL,'workflow',jsonb_build_object(
+      'runId',submission->'workflow'->'runId','status',submission->'workflow'->'status'));
 EXCEPTION
   WHEN invalid_parameter_value OR invalid_text_representation THEN
     RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
 END;
 $$;
 
+CREATE OR REPLACE FUNCTION public.supacloud_command_submit(request jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$
+BEGIN
+  PERFORM supacloud_commands.submit(request);
+  RETURN supacloud_commands.status(jsonb_build_object('commandId',request->>'commandId'));
+END
+$$;
+
+CREATE OR REPLACE FUNCTION public.supacloud_command_get(request jsonb)
+RETURNS jsonb
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$
+  SELECT supacloud_commands.status(request)
+$$;
+
 REVOKE ALL ON ALL TABLES IN SCHEMA supacloud_commands
   FROM PUBLIC, anon, authenticated, service_role;
 REVOKE ALL ON ALL FUNCTIONS IN SCHEMA supacloud_commands
@@ -6886,9 +7123,9 @@ class RealtimeEngine {
       return;
     const [, joinRefLen, refLen, topicLen, eventLen, metaLen, encoding] = bytes;
     let offset = 7;
-    const decoder2 = new TextDecoder;
+    const decoder = new TextDecoder;
     const read = (len) => {
-      const out = decoder2.decode(bytes.subarray(offset, offset + len));
+      const out = decoder.decode(bytes.subarray(offset, offset + len));
       offset += len;
       return out;
     };
@@ -6901,7 +7138,7 @@ class RealtimeEngine {
     const payload = {
       type: "broadcast",
       event: userEvent,
-      payload: encoding === 1 ? safeJsonParse(decoder2.decode(payloadBytes)) : payloadBytes
+      payload: encoding === 1 ? safeJsonParse(decoder.decode(payloadBytes)) : payloadBytes
     };
     this.handleBroadcast(conn, {
       topic,
@@ -7212,24 +7449,24 @@ function parseQuery(searchParams) {
     const segments = key.split(".");
     const last = segments[segments.length - 1];
     if (last === "order") {
-      const path2 = segments.slice(0, -1);
+      const path = segments.slice(0, -1);
       for (const term of splitTopLevel(value, ",")) {
-        q.order.push(parseOrderTerm(term.trim(), path2));
+        q.order.push(parseOrderTerm(term.trim(), path));
       }
       continue;
     }
     if (last === "limit" || last === "offset") {
-      const path2 = segments.slice(0, -1).join(".");
+      const path = segments.slice(0, -1).join(".");
       const n = parseInt(value, 10);
       if (Number.isNaN(n) || n < 0)
         throw new ParseError(`invalid ${last}: ${value}`);
-      (last === "limit" ? q.limits : q.offsets).set(path2, n);
+      (last === "limit" ? q.limits : q.offsets).set(path, n);
       continue;
     }
     if (last === "or" || last === "and") {
       const negated = segments[segments.length - 2] === "not";
-      const path2 = segments.slice(0, negated ? -2 : -1);
-      q.conditions.push(parseLogicTree(last, value, path2, negated));
+      const path = segments.slice(0, negated ? -2 : -1);
+      q.conditions.push(parseLogicTree(last, value, path, negated));
       continue;
     }
     if (RESERVED.has(key))
@@ -7669,13 +7906,13 @@ class QueryBuilder {
         if (c.kind !== "column" || c.name === "*") {
           throw new ParseError("spread embeds support explicit columns only");
         }
-        const expr2 = renderColumnExpr(childAlias, c.name);
+        const expr = renderColumnExpr(childAlias, c.name);
         const cast = c.cast ? `::${sanitizeCast(c.cast)}` : "";
         const out = c.alias ?? defaultAliasFor(c.name);
-        return toOne ? `(select ${expr2}${cast} from ${fromClause}${where}) as ${quoteIdent(out)}` : `coalesce((select json_agg(${expr2}${cast}${order}) from ${fromClause}${where}), ${AGG_EMPTY}) as ${quoteIdent(out)}`;
+        return toOne ? `(select ${expr}${cast} from ${fromClause}${where}) as ${quoteIdent(out)}` : `coalesce((select json_agg(${expr}${cast}${order}) from ${fromClause}${where}), ${AGG_EMPTY}) as ${quoteIdent(out)}`;
       });
-      const innerCond2 = embed.inner ? `exists (select 1 from ${fromClause}${where})` : undefined;
-      return { exprs, innerCond: innerCond2 };
+      const innerCond = embed.inner ? `exists (select 1 from ${fromClause}${where})` : undefined;
+      return { exprs, innerCond };
     }
     const sub = `select ${childExprs.join(", ")} from ${fromClause}${where}${order}${limitOffset}`;
     const expr = rel.single === true ? `(select row_to_json(_sub) from (${sub}) _sub) as ${quoteIdent(outName)}` : `coalesce((select json_agg(row_to_json(_sub)) from (${sub}) _sub), ${AGG_EMPTY}) as ${quoteIdent(outName)}`;
@@ -8134,12 +8371,12 @@ class RestHandler {
         const built = builder.buildSelect(table, { count: prefer.count !== undefined });
         const { rows, count } = await this.db.withContext(ctx, async (query) => {
           const res = await query(built.sql, built.params);
-          let count2 = null;
+          let count = null;
           if (built.countSql) {
             const c = await query(built.countSql, []);
-            count2 = c.rows[0].count;
+            count = c.rows[0].count;
           }
-          return { rows: res.rows[0].body, count: count2 };
+          return { rows: res.rows[0].body, count };
         });
         const offset = q.offsets.get("") ?? 0;
         return this.dataResponse(rows, {
@@ -8335,12 +8572,12 @@ class RestHandler {
     const countSql = prefer.count !== undefined ? `select count(*)::int as count from ${call} as ${quoteIdent(alias)}${where}` : undefined;
     const { rows, count } = await this.db.withContext(ctx, async (query) => {
       const res = await query(sql, []);
-      let count2 = null;
+      let count = null;
       if (countSql) {
         const c = await query(countSql, []);
-        count2 = c.rows[0].count;
+        count = c.rows[0].count;
       }
-      return { rows: res.rows[0].body, count: count2 };
+      return { rows: res.rows[0].body, count };
     });
     return this.dataResponse(rows, {
       status: 200,
@@ -8656,7 +8893,7 @@ class Semaphore {
       this.active += 1;
       return;
     }
-    await new Promise((resolve2) => this.waiters.push(resolve2));
+    await new Promise((resolve) => this.waiters.push(resolve));
   }
   release() {
     const next = this.waiters.shift();
@@ -8862,22 +9099,22 @@ class StorageHandler {
       }
       if (parts[0] === "render" && parts[1] === "image" && parts.length >= 5) {
         const kind = parts[2];
-        const bucket2 = parts[3];
-        const key2 = parts.slice(4).join("/");
+        const bucket = parts[3];
+        const key = parts.slice(4).join("/");
         if (kind === "public" && (method === "GET" || method === "HEAD")) {
-          const source = await this.loadPublicObject(bucket2, key2);
+          const source = await this.loadPublicObject(bucket, key);
           if (source instanceof Response)
             return source;
           return await this.transformImageResponse(source, url, method === "HEAD");
         }
         if (kind === "authenticated" && (method === "GET" || method === "HEAD")) {
-          const source = await this.loadAuthenticatedObject(ctx, bucket2, key2);
+          const source = await this.loadAuthenticatedObject(ctx, bucket, key);
           if (source instanceof Response)
             return source;
           return await this.transformImageResponse(source, url, method === "HEAD");
         }
         if (kind === "sign" && method === "GET") {
-          const source = await this.loadSignedObject(url, bucket2, key2);
+          const source = await this.loadSignedObject(url, bucket, key);
           if (source instanceof Response)
             return source;
           return await this.transformImageResponse(source, url, false);
@@ -8911,12 +9148,12 @@ class StorageHandler {
         return await this.redeemSignedUrl(url, parts[2], parts.slice(3).join("/"));
       }
       if (parts[1] === "upload" && parts[2] === "sign" && parts.length >= 5) {
-        const bucket2 = parts[3];
-        const key2 = parts.slice(4).join("/");
+        const bucket = parts[3];
+        const key = parts.slice(4).join("/");
         if (method === "POST")
-          return await this.signUploadUrl(ctx, bucket2, key2);
+          return await this.signUploadUrl(ctx, bucket, key);
         if (method === "PUT")
-          return await this.redeemSignedUpload(req, url, bucket2, key2);
+          return await this.redeemSignedUpload(req, url, bucket, key);
       }
       if (parts[1] === "info" && parts.length >= 4 && method === "GET") {
         return await this.objectInfo(ctx, parts[2], parts.slice(3).join("/"));
@@ -8951,8 +9188,8 @@ class StorageHandler {
   async withMutation(operation) {
     const previous = this.mutationTail;
     let release;
-    this.mutationTail = new Promise((resolve2) => {
-      release = resolve2;
+    this.mutationTail = new Promise((resolve) => {
+      release = resolve;
     });
     await previous;
     try {
@@ -9204,8 +9441,8 @@ class StorageHandler {
             return storageError(409, "Duplicate", "The resource already exists");
           throw error;
         }
-        const uploadId2 = crypto.randomUUID();
-        this.tusUploads.set(uploadId2, {
+        const uploadId = crypto.randomUUID();
+        this.tusUploads.set(uploadId, {
           bucketId,
           key,
           contentType,
@@ -9221,13 +9458,13 @@ class StorageHandler {
         return new Response(null, {
           status: 201,
           headers: tus({
-            location: `${url.origin}/storage/v1/upload/resumable/${uploadId2}`,
+            location: `${url.origin}/storage/v1/upload/resumable/${uploadId}`,
             "upload-offset": "0",
             "upload-length": "0"
           })
         });
       }
-      const activeUploads = [...this.tusUploads.values()].filter((upload3) => upload3.completedAt === undefined).length;
+      const activeUploads = [...this.tusUploads.values()].filter((upload) => upload.completedAt === undefined).length;
       if (activeUploads >= MAX_CONCURRENT_TUS_UPLOADS) {
         return storageError(429, "too_many_requests", "Too many resumable uploads are active");
       }
@@ -9235,7 +9472,7 @@ class StorageHandler {
       if (preflightError)
         return preflightError;
       const uploadId = crypto.randomUUID();
-      const upload2 = {
+      const upload = {
         bucketId,
         key,
         contentType,
@@ -9246,7 +9483,7 @@ class StorageHandler {
         chunks: [],
         ctx
       };
-      this.tusUploads.set(uploadId, upload2);
+      this.tusUploads.set(uploadId, upload);
       if ((req.headers.get("content-type") ?? "").includes("application/offset+octet-stream")) {
         const chunk = await readLimitedBody(req, length);
         if (chunk === null) {
@@ -9254,7 +9491,7 @@ class StorageHandler {
           return storageError(400, "invalid_request", "chunk exceeds the declared Upload-Length");
         }
         if (chunk.length > 0) {
-          const err = await this.appendTus(uploadId, upload2, 0, chunk);
+          const err = await this.appendTus(uploadId, upload, 0, chunk);
           if (err)
             return err;
         }
@@ -9263,7 +9500,7 @@ class StorageHandler {
         status: 201,
         headers: tus({
           location: `${url.origin}/storage/v1/upload/resumable/${uploadId}`,
-          "upload-offset": String(upload2.offset)
+          "upload-offset": String(upload.offset)
         })
       });
     }
@@ -11068,8 +11305,8 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
           headers: { "content-type": "application/json" }
         }));
       }
-      const ctx2 = { role: String(keyClaims.role ?? "anon"), claims: keyClaims };
-      return withCors(await auth.handle(req, ctx2, url));
+      const ctx = { role: String(keyClaims.role ?? "anon"), claims: keyClaims };
+      return withCors(await auth.handle(req, ctx, url));
     }
     if (path.startsWith("/functions/v1/")) {
       const functionName = path.replace(/^\/functions\/v1\/?/, "").split("/")[0];
@@ -11459,9 +11696,9 @@ function validatePublicationTables(tables) {
   if (missing.length > 0) {
     throw new Error(`PowerSync publication tables do not exist: ${missing.join(", ")}`);
   }
-  const unsupported2 = tables.filter((table) => table.present && !["r", "p"].includes(table.relkind ?? ""));
-  if (unsupported2.length > 0) {
-    throw new Error(`PowerSync publication only accepts ordinary or partitioned tables: ${unsupported2.map((table) => table.name).join(", ")}`);
+  const unsupported = tables.filter((table) => table.present && !["r", "p"].includes(table.relkind ?? ""));
+  if (unsupported.length > 0) {
+    throw new Error(`PowerSync publication only accepts ordinary or partitioned tables: ${unsupported.map((table) => table.name).join(", ")}`);
   }
 }
 async function configureReplicationRole(tx, passwordValue) {
@@ -11669,7 +11906,7 @@ class PgWireClient {
     return client;
   }
   open(opts) {
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve, reject) => {
       let startupComplete = false;
       this.socket = opts.socketPath ? createConnection(opts.socketPath) : createConnection(opts.port ?? 5432, opts.host ?? "127.0.0.1");
       this.socket.setTimeout(1e4, () => this.socket.destroy(new Error("PostgreSQL handshake timed out")));
@@ -11773,7 +12010,7 @@ class PgWireClient {
               this.buffer = Buffer.concat([this.buffer, c]);
               this.processMessages();
             });
-            resolve3();
+            resolve();
             return;
           }
         }
@@ -11782,10 +12019,10 @@ class PgWireClient {
     });
   }
   run(send) {
-    const op = this.queue.then(() => new Promise((resolve3, reject) => {
+    const op = this.queue.then(() => new Promise((resolve, reject) => {
       if (this.closed)
         return reject(new Error("connection closed"));
-      this.pending = { resolve: resolve3, reject, results: [], columns: [], error: null };
+      this.pending = { resolve, reject, results: [], columns: [], error: null };
       send();
     }));
     this.queue = op.catch(() => {});
@@ -11816,11 +12053,11 @@ class PgWireClient {
     return results[0] ?? { rows: [] };
   }
   close() {
-    return new Promise((resolve3) => {
+    return new Promise((resolve) => {
       if (this.closed)
-        return resolve3();
+        return resolve();
       this.socket.write(message(88, Buffer.alloc(0)));
-      this.socket.end(() => resolve3());
+      this.socket.end(() => resolve());
     });
   }
   nextMessage() {
@@ -11991,10 +12228,10 @@ function decodeValue(text, oid) {
     case 1114:
       return new Date(text.replace(" ", "T") + "Z");
     case 1184: {
-      let iso3 = text.replace(" ", "T");
-      if (/[+-]\d\d$/.test(iso3))
-        iso3 += ":00";
-      return new Date(iso3);
+      let iso = text.replace(" ", "T");
+      if (/[+-]\d\d$/.test(iso))
+        iso += ":00";
+      return new Date(iso);
     }
     case 1000:
       return parsePgArray(text).map((v) => v === "t");
@@ -12083,9 +12320,9 @@ async function buildWireEngine(options) {
       return queryMutex.run(async () => {
         await queryClient.exec("begin");
         try {
-          const response2 = await callback(transactionClient);
+          const response = await callback(transactionClient);
           await queryClient.exec("commit");
-          return response2;
+          return response;
         } catch (error) {
           await queryClient.exec("rollback").catch(() => {});
           throw error;
@@ -12314,15 +12551,15 @@ async function fetchRelease(url) {
   let lastError;
   for (let attempt = 1;attempt <= 3; attempt++) {
     try {
-      const response2 = await fetch(url, { signal: AbortSignal.timeout(30000) });
-      if (response2.ok || response2.status < 500)
-        return response2;
-      lastError = new Error(`failed to download ${url}: HTTP ${response2.status}`);
+      const response = await fetch(url, { signal: AbortSignal.timeout(30000) });
+      if (response.ok || response.status < 500)
+        return response;
+      lastError = new Error(`failed to download ${url}: HTTP ${response.status}`);
     } catch (error) {
       lastError = error;
     }
     if (attempt < 3)
-      await new Promise((resolve3) => setTimeout(resolve3, attempt * 500));
+      await new Promise((resolve) => setTimeout(resolve, attempt * 500));
   }
   throw lastError instanceof Error ? lastError : new Error(`failed to download ${url}`);
 }
@@ -12414,7 +12651,7 @@ ${detail}` : " (no output)"}
 ` + `data dir: ${opts.dataDir}
 ` + "If a previous run is still holding it, stop it; or delete the data dir to start fresh.");
           }
-          await new Promise((resolve3) => setTimeout(resolve3, 150));
+          await new Promise((resolve) => setTimeout(resolve, 150));
         }
       }
       throw new Error(`timed out waiting for embedded postgres at ${socketPath}`);
@@ -12442,14 +12679,14 @@ async function stopPostgres(postgres, hasExited) {
   if (hasExited())
     return;
   postgres.kill("SIGINT");
-  await new Promise((resolve3) => {
+  await new Promise((resolve) => {
     const killTimeout = setTimeout(() => {
       postgres.kill("SIGKILL");
-      resolve3();
+      resolve();
     }, 5000);
     postgres.once("exit", () => {
       clearTimeout(killTimeout);
-      resolve3();
+      resolve();
     });
   });
 }
@@ -12831,8 +13068,8 @@ function getDurationSeconds(table, key) {
     return;
   const m = v.trim().match(/^(\d+)\s*(s|m|h)$/i);
   if (!m) {
-    const n2 = parseInt(v, 10);
-    return Number.isFinite(n2) ? n2 : undefined;
+    const n = parseInt(v, 10);
+    return Number.isFinite(n) ? n : undefined;
   }
   const n = parseInt(m[1], 10);
   const unit = m[2].toLowerCase();
@@ -13110,9 +13347,9 @@ function readFunctions(root, mode) {
     const enabled = getBool(t, "enabled");
     if (enabled !== undefined)
       opts.enabled = enabled;
-    const verifyJwt2 = getBool(t, "verify_jwt");
-    if (verifyJwt2 !== undefined)
-      opts.verifyJwt = verifyJwt2;
+    const verifyJwt = getBool(t, "verify_jwt");
+    if (verifyJwt !== undefined)
+      opts.verifyJwt = verifyJwt;
     const entrypoint = getString(t, "entrypoint");
     if (entrypoint !== undefined)
       opts.entrypoint = entrypoint;
@@ -13434,12 +13671,12 @@ function keys(row, expected) {
   }
 }
 function validTarget(value) {
-  const target2 = record(value);
-  keys(target2, ["environment", "projectRef"]);
-  if (typeof target2.environment !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(target2.environment) || typeof target2.projectRef !== "string" || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(target2.projectRef)) {
+  const target = record(value);
+  keys(target, ["environment", "projectRef"]);
+  if (typeof target.environment !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(target.environment) || typeof target.projectRef !== "string" || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(target.projectRef)) {
     throw new Error("Invalid migration binding target");
   }
-  return target2;
+  return target;
 }
 function validFile(file) {
   return typeof file === "string" && /^[a-zA-Z0-9_./-]+\.sql$/.test(file) && !file.startsWith("/") && file.split("/").every((part) => part && part !== "." && part !== "..");
@@ -13451,7 +13688,7 @@ function parseMigrationBindingManifest(value) {
     throw new Error("Invalid migration binding manifest");
   }
   const targets = manifest.targets.map(validTarget);
-  if (new Set(targets.map((target2) => target2.environment)).size !== targets.length) {
+  if (new Set(targets.map((target) => target.environment)).size !== targets.length) {
     throw new Error("Duplicate migration binding environment");
   }
   const files = new Set;
@@ -13498,8 +13735,8 @@ function bindingValue(parameter, values) {
 }
 function renderMigrationBindings(options) {
   const manifest = parseMigrationBindingManifest(options.manifest);
-  const target2 = validTarget(options.target);
-  if (!manifest.targets.some((candidate) => candidate.environment === target2.environment && candidate.projectRef === target2.projectRef)) {
+  const target = validTarget(options.target);
+  if (!manifest.targets.some((candidate) => candidate.environment === target.environment && candidate.projectRef === target.projectRef)) {
     throw new Error("Migration binding target is not registered in the manifest");
   }
   const sources = new Map;
@@ -13554,7 +13791,7 @@ function renderMigrationBindings(options) {
     migrations,
     attestation: {
       schema: "supacloud.migration-binding-attestation.v1",
-      ...target2,
+      ...target,
       manifestSha256: migrationBindingSha256(JSON.stringify(manifest)),
       files: files.sort((left, right) => left.file.localeCompare(right.file))
     }
@@ -13685,14 +13922,14 @@ async function ensureProjectSecrets(paths) {
 `, { mode: 384, flag: "wx" });
       await link(temporaryFile, paths.secretsFile);
       stored = candidate;
-    } catch (error2) {
-      if (error2.code !== "EEXIST")
-        throw error2;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
       stored = validateSecrets(JSON.parse(await readFile6(paths.secretsFile, "utf8")));
     } finally {
-      await unlink2(temporaryFile).catch((error2) => {
-        if (error2.code !== "ENOENT")
-          throw error2;
+      await unlink2(temporaryFile).catch((error) => {
+        if (error.code !== "ENOENT")
+          throw error;
       });
     }
   }
@@ -14193,10 +14430,10 @@ async function stageDirectory(root, destination) {
     throw error;
   }
   await mkdir5(destination, { recursive: true });
-  const walk = async (current, target2) => {
+  const walk = async (current, target) => {
     for (const entry of await readdir3(current, { withFileTypes: true })) {
       const fullPath = join8(current, entry.name);
-      const targetPath = join8(target2, entry.name);
+      const targetPath = join8(target, entry.name);
       if (entry.isSymbolicLink())
         throw new Error(`snapshot refuses symbolic link: ${fullPath}`);
       if (entry.isDirectory()) {
@@ -14211,9 +14448,9 @@ async function stageDirectory(root, destination) {
   };
   await walk(root, destination);
 }
-async function stageFile(source, target2) {
-  await mkdir5(dirname5(target2), { recursive: true });
-  await copyFile(source, target2);
+async function stageFile(source, target) {
+  await mkdir5(dirname5(target), { recursive: true });
+  await copyFile(source, target);
 }
 async function readManifest(payloadRoot) {
   let parsed;
@@ -14285,9 +14522,9 @@ async function assertRestoreTargets(paths, manifest, force) {
   if (manifest.includesLocalStorage && !isWithin(paths.stateDir, paths.storageDir))
     targets.push(paths.storageDir);
   if (!force) {
-    for (const target2 of targets) {
-      if (await directoryHasEntries(target2))
-        throw new Error(`restore target is not empty: ${target2}; pass --force to replace it`);
+    for (const target of targets) {
+      if (await directoryHasEntries(target))
+        throw new Error(`restore target is not empty: ${target}; pass --force to replace it`);
     }
   }
 }
@@ -14300,28 +14537,28 @@ async function directoryHasEntries(path) {
     throw error;
   }
 }
-async function applyDirectorySwap(source, target2, force, rollbackId, swaps) {
-  const targetInfo = await existingInfo(target2);
+async function applyDirectorySwap(source, target, force, rollbackId, swaps) {
+  const targetInfo = await existingInfo(target);
   if (targetInfo && !targetInfo.isDirectory())
-    throw new Error(`restore target is not a directory: ${target2}`);
-  const swap = { target: target2 };
+    throw new Error(`restore target is not a directory: ${target}`);
+  const swap = { target };
   if (targetInfo) {
     if (!force) {
-      if (await directoryHasEntries(target2))
-        throw new Error(`restore target is not empty: ${target2}; pass --force to replace it`);
-      await rm4(target2, { recursive: true, force: true });
+      if (await directoryHasEntries(target))
+        throw new Error(`restore target is not empty: ${target}; pass --force to replace it`);
+      await rm4(target, { recursive: true, force: true });
     } else {
-      swap.rollbackPath = join8(dirname5(target2), `.${target2.split(sep2).pop() ?? "state"}.restore-${rollbackId}`);
-      await rename2(target2, swap.rollbackPath);
+      swap.rollbackPath = join8(dirname5(target), `.${target.split(sep2).pop() ?? "state"}.restore-${rollbackId}`);
+      await rename2(target, swap.rollbackPath);
     }
   }
   try {
-    await mkdir5(dirname5(target2), { recursive: true });
-    await rename2(source, target2);
+    await mkdir5(dirname5(target), { recursive: true });
+    await rename2(source, target);
     swaps.push(swap);
   } catch (error) {
     if (swap.rollbackPath)
-      await rename2(swap.rollbackPath, target2).catch(() => {});
+      await rename2(swap.rollbackPath, target).catch(() => {});
     throw error;
   }
 }
@@ -14341,17 +14578,17 @@ async function existingInfo(path) {
     throw error;
   }
 }
-async function copyEntry(source, target2) {
+async function copyEntry(source, target) {
   const info = await lstat3(source);
   if (info.isSymbolicLink())
     throw new Error(`snapshot refuses symbolic link: ${source}`);
   if (info.isDirectory()) {
-    await mkdir5(target2, { recursive: true });
+    await mkdir5(target, { recursive: true });
     for (const entry of await readdir3(source))
-      await copyEntry(join8(source, entry), join8(target2, entry));
+      await copyEntry(join8(source, entry), join8(target, entry));
   } else if (info.isFile()) {
-    await mkdir5(dirname5(target2), { recursive: true });
-    await Bun.write(target2, Bun.file(source));
+    await mkdir5(dirname5(target), { recursive: true });
+    await Bun.write(target, Bun.file(source));
   } else
     throw new Error(`snapshot refuses unsupported filesystem entry: ${source}`);
 }