@supacloud/lite 0.24.0 → 0.25.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.25.0](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.24.0...supacloud-lite-v0.25.0) (2026-10-10)
+
+
+### Features
+
+* **governance:** enforce strict user and platform type contracts ([#1754](https://github.com/vibeunion/supacloud/issues/1754)) ([b22f889](https://github.com/vibeunion/supacloud/commit/b22f88919c349f088848028f13b15e44994e0d9c))
+
 ## [0.24.0](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.23.0...supacloud-lite-v0.24.0) (2026-10-10)
 
 

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.24.0",
+  version: "0.25.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -160,6 +160,8 @@ async function verifyJwt(token, secret) {
   if (parts.length !== 3)
     return null;
   const [header, payload, signature] = parts;
+  if (!header || !payload || !signature)
+    return null;
   try {
     const head = JSON.parse(decoder.decode(base64UrlToBytes(header)));
     if (head.alg !== "HS256")
@@ -189,7 +191,7 @@ var SUPACLOUD_LITE_VERSION = package_default.version;
 function globToRegExp(pattern) {
   let out = "";
   for (let i = 0;i < pattern.length; i++) {
-    const c = pattern[i];
+    const c = pattern.charAt(i);
     if (c === "*") {
       if (pattern[i + 1] === "*") {
         out += ".*";
@@ -242,11 +244,11 @@ var PRESETS = {
     userInfoUrl: "https://openidconnect.googleapis.com/v1/userinfo",
     scopes: "openid email profile",
     profileMap: (r) => ({
-      id: r.sub,
-      email: r.email,
-      emailVerified: r.email_verified === true,
-      name: r.name,
-      metadata: { avatar_url: r.picture, full_name: r.name }
+      id: typeof r["sub"] === "string" ? r["sub"] : "",
+      ...typeof r["email"] === "string" ? { email: r["email"] } : {},
+      emailVerified: r["email_verified"] === true,
+      ...typeof r["name"] === "string" ? { name: r["name"] } : {},
+      metadata: { avatar_url: r["picture"], full_name: r["name"] }
     })
   },
   github: {
@@ -254,7 +256,12 @@ var PRESETS = {
     tokenUrl: "https://github.com/login/oauth/access_token",
     userInfoUrl: "https://api.github.com/user",
     scopes: "read:user user:email",
-    profileMap: (r) => ({ id: String(r.id), email: r.email, name: r.name ?? r.login, metadata: { avatar_url: r.avatar_url, user_name: r.login } })
+    profileMap: (r) => ({
+      id: String(r["id"]),
+      ...typeof r["email"] === "string" ? { email: r["email"] } : {},
+      ...typeof r["name"] === "string" || typeof r["login"] === "string" ? { name: typeof r["name"] === "string" ? r["name"] : r["login"] } : {},
+      metadata: { avatar_url: r["avatar_url"], user_name: r["login"] }
+    })
   }
 };
 function resolveProvider(name, cfg) {
@@ -273,7 +280,11 @@ function resolveProvider(name, cfg) {
     tokenUrl,
     userInfoUrl,
     scopes: cfg.scopes ?? preset.scopes ?? "",
-    profileMap: cfg.profileMap ?? preset.profileMap ?? ((r) => ({ id: String(r.id ?? r.sub), email: r.email, name: r.name }))
+    profileMap: cfg.profileMap ?? preset.profileMap ?? ((r) => ({
+      id: String(r["id"] ?? r["sub"]),
+      ...typeof r["email"] === "string" ? { email: r["email"] } : {},
+      ...typeof r["name"] === "string" ? { name: r["name"] } : {}
+    }))
   };
 }
 
@@ -969,41 +980,41 @@ var DEFAULT_AUTH_SETTINGS = {
 };
 function sanitize(raw) {
   const s = { ...DEFAULT_AUTH_SETTINGS };
-  if (typeof raw.disableSignup === "boolean")
-    s.disableSignup = raw.disableSignup;
-  if (typeof raw.anonymousUsers === "boolean")
-    s.anonymousUsers = raw.anonymousUsers;
-  if (typeof raw.autoconfirm === "boolean")
-    s.autoconfirm = raw.autoconfirm;
-  if (typeof raw.minPasswordLength === "number" && Number.isFinite(raw.minPasswordLength)) {
-    s.minPasswordLength = Math.max(4, Math.min(72, Math.floor(raw.minPasswordLength)));
-  }
-  if (Array.isArray(raw.disabledProviders)) {
-    s.disabledProviders = raw.disabledProviders.filter((p) => typeof p === "string").slice(0, 50);
-  }
-  if (typeof raw.otpLength === "number" && Number.isFinite(raw.otpLength)) {
-    s.otpLength = Math.max(6, Math.min(10, Math.floor(raw.otpLength)));
-  }
-  if (typeof raw.otpExpirySeconds === "number" && Number.isFinite(raw.otpExpirySeconds) && raw.otpExpirySeconds > 0) {
-    s.otpExpirySeconds = Math.floor(raw.otpExpirySeconds);
-  }
-  if (typeof raw.smsEnabled === "boolean")
-    s.smsEnabled = raw.smsEnabled;
-  if (typeof raw.smsSignupEnabled === "boolean")
-    s.smsSignupEnabled = raw.smsSignupEnabled;
-  if (typeof raw.smsOtpCooldownSeconds === "number" && Number.isFinite(raw.smsOtpCooldownSeconds)) {
-    s.smsOtpCooldownSeconds = Math.max(0, Math.min(86400, Math.floor(raw.smsOtpCooldownSeconds)));
-  }
-  if (typeof raw.smsTemplate === "string" && raw.smsTemplate.length > 0 && raw.smsTemplate.length <= 1000 && /\{\{\s*\.Code\s*\}\}/.test(raw.smsTemplate)) {
-    s.smsTemplate = raw.smsTemplate;
-  }
-  if (typeof raw.maxEnrolledFactors === "number" && Number.isFinite(raw.maxEnrolledFactors) && raw.maxEnrolledFactors > 0) {
-    s.maxEnrolledFactors = Math.floor(raw.maxEnrolledFactors);
-  }
-  if (typeof raw.totpEnrollEnabled === "boolean")
-    s.totpEnrollEnabled = raw.totpEnrollEnabled;
-  if (typeof raw.totpVerifyEnabled === "boolean")
-    s.totpVerifyEnabled = raw.totpVerifyEnabled;
+  if (typeof raw["disableSignup"] === "boolean")
+    s.disableSignup = raw["disableSignup"];
+  if (typeof raw["anonymousUsers"] === "boolean")
+    s.anonymousUsers = raw["anonymousUsers"];
+  if (typeof raw["autoconfirm"] === "boolean")
+    s.autoconfirm = raw["autoconfirm"];
+  if (typeof raw["minPasswordLength"] === "number" && Number.isFinite(raw["minPasswordLength"])) {
+    s.minPasswordLength = Math.max(4, Math.min(72, Math.floor(raw["minPasswordLength"])));
+  }
+  if (Array.isArray(raw["disabledProviders"])) {
+    s.disabledProviders = raw["disabledProviders"].filter((p) => typeof p === "string").slice(0, 50);
+  }
+  if (typeof raw["otpLength"] === "number" && Number.isFinite(raw["otpLength"])) {
+    s.otpLength = Math.max(6, Math.min(10, Math.floor(raw["otpLength"])));
+  }
+  if (typeof raw["otpExpirySeconds"] === "number" && Number.isFinite(raw["otpExpirySeconds"]) && raw["otpExpirySeconds"] > 0) {
+    s.otpExpirySeconds = Math.floor(raw["otpExpirySeconds"]);
+  }
+  if (typeof raw["smsEnabled"] === "boolean")
+    s.smsEnabled = raw["smsEnabled"];
+  if (typeof raw["smsSignupEnabled"] === "boolean")
+    s.smsSignupEnabled = raw["smsSignupEnabled"];
+  if (typeof raw["smsOtpCooldownSeconds"] === "number" && Number.isFinite(raw["smsOtpCooldownSeconds"])) {
+    s.smsOtpCooldownSeconds = Math.max(0, Math.min(86400, Math.floor(raw["smsOtpCooldownSeconds"])));
+  }
+  if (typeof raw["smsTemplate"] === "string" && raw["smsTemplate"].length > 0 && raw["smsTemplate"].length <= 1000 && /\{\{\s*\.Code\s*\}\}/.test(raw["smsTemplate"])) {
+    s.smsTemplate = raw["smsTemplate"];
+  }
+  if (typeof raw["maxEnrolledFactors"] === "number" && Number.isFinite(raw["maxEnrolledFactors"]) && raw["maxEnrolledFactors"] > 0) {
+    s.maxEnrolledFactors = Math.floor(raw["maxEnrolledFactors"]);
+  }
+  if (typeof raw["totpEnrollEnabled"] === "boolean")
+    s.totpEnrollEnabled = raw["totpEnrollEnabled"];
+  if (typeof raw["totpVerifyEnabled"] === "boolean")
+    s.totpVerifyEnabled = raw["totpVerifyEnabled"];
   return s;
 }
 async function loadAuthSettings(db, defaults = {}) {
@@ -1044,7 +1055,7 @@ class RateLimiter {
     const cutoff = now - rule.windowMs;
     const recent = (this.hits.get(bucketKey) ?? []).filter((t) => t > cutoff);
     if (recent.length >= rule.limit) {
-      const retryMs = recent[0] + rule.windowMs - now;
+      const retryMs = (recent[0] ?? now) + rule.windowMs - now;
       return Math.max(1, Math.ceil(retryMs / 1000));
     }
     recent.push(now);
@@ -1876,13 +1887,14 @@ Or sign in with this link: ${link}`
       const body = await req.json().catch(() => ({}));
       if (!body.email)
         return authError(400, "validation_failed", "email is required");
+      const email = body.email;
       const hashed = body.password ? await hashPassword(body.password) : null;
       const created = await this.db.transaction(async (query) => {
         const res = await query(`insert into auth.users
              (aud, role, email, encrypted_password, email_confirmed_at, raw_app_meta_data, raw_user_meta_data)
            values ('authenticated', 'authenticated', $1, $2, case when $3 then now() else null end, $4, $5)
            returning *`, [
-          body.email.toLowerCase().trim(),
+          email.toLowerCase().trim(),
           hashed,
           body.email_confirm ?? true,
           JSON.stringify({ provider: "email", providers: ["email"], ...body.app_metadata ?? {} }),
@@ -2545,11 +2557,11 @@ function installDenoShim() {
 }
 function takeCapturedHandler() {
   const h = captured.handler;
-  captured.handler = undefined;
+  delete captured.handler;
   return h;
 }
 function resetCapturedHandler() {
-  captured.handler = undefined;
+  delete captured.handler;
 }
 
 // src/runtime/functions/edge-runtime-shim.ts
@@ -2573,7 +2585,7 @@ function installEdgeRuntimeShim() {
     }
   };
   installed = runtime;
-  globalThis.EdgeRuntime = runtime;
+  globalThis["EdgeRuntime"] = runtime;
 }
 function runWithBackgroundTasks(options, fn) {
   installEdgeRuntimeShim();
@@ -2945,9 +2957,13 @@ class FunctionsHandler {
       const env = capabilities?.secrets ? filterSecretsEnv(this.env, capabilities.secrets) : this.env;
       const invoke = () => this.invoke(entry.handler, request, ctx, env);
       const inner = () => runWithDenoEnv(env, () => runWithPgredisCache(this.pgredis, invoke));
-      const run = capabilities?.outboundHosts ? () => runWithFetchPolicy(capabilities.outboundHosts, inner) : inner;
-      const invokeWithBackground = () => runWithBackgroundTasks({ allowed: capabilities?.background !== false, timeoutMs: limits?.waitUntilTimeoutMs }, run);
-      const res = timeoutMs !== undefined ? await this.withTimeout(name, timeoutMs, invokeWithBackground, abort) : await invokeWithBackground();
+      const outboundHosts = capabilities?.outboundHosts;
+      const run = outboundHosts ? () => runWithFetchPolicy(outboundHosts, inner) : inner;
+      const invokeWithBackground = () => runWithBackgroundTasks({
+        allowed: capabilities?.background !== false,
+        ...limits?.waitUntilTimeoutMs === undefined ? {} : { timeoutMs: limits.waitUntilTimeoutMs }
+      }, run);
+      const res = timeoutMs !== undefined && abort !== undefined ? await this.withTimeout(name, timeoutMs, invokeWithBackground, abort) : await invokeWithBackground();
       if (!(res instanceof Response)) {
         return json2(500, { error: `function "${name}" did not return a Response` });
       }
@@ -3015,6 +3031,8 @@ function withCountedBody(req, limit) {
       controller.enqueue(chunk);
     }
   });
+  if (!req.body)
+    return new Request(req);
   return new Request(req, { body: req.body.pipeThrough(counter), duplex: "half" });
 }
 function withResponseLimit(name, res, limit) {
@@ -6362,7 +6380,7 @@ async function createPgliteEngine(dataDir, options = {}) {
   let pg;
   try {
     pg = new PGlite({
-      dataDir,
+      ...dataDir === undefined ? {} : { dataDir },
       extensions,
       ...standaloneAssets ? {
         pgliteWasmModule: standaloneAssets.pgliteWasmModule,
@@ -6391,7 +6409,7 @@ async function createPgliteEngine(dataDir, options = {}) {
   return {
     async query(sql, params) {
       const res = await pg.query(sql, params);
-      return { rows: res.rows, affectedRows: res.affectedRows };
+      return { rows: res.rows, ...res.affectedRows === undefined ? {} : { affectedRows: res.affectedRows } };
     },
     async exec(sql) {
       await pg.exec(sql);
@@ -6401,7 +6419,7 @@ async function createPgliteEngine(dataDir, options = {}) {
         return fn({
           async query(sql, params) {
             const res = await tx.query(sql, params);
-            return { rows: res.rows, affectedRows: res.affectedRows };
+            return { rows: res.rows, ...res.affectedRows === undefined ? {} : { affectedRows: res.affectedRows } };
           },
           async exec(sql) {
             await tx.exec(sql);
@@ -6430,8 +6448,8 @@ function getStandaloneAssets() {
 function withEmbeddedBundle(extension, bundlePath) {
   return {
     ...extension,
-    setup: async (pg, emscriptenOpts, clientOnly) => ({
-      ...await extension.setup(pg, emscriptenOpts, clientOnly),
+    setup: async (...args) => ({
+      ...await extension.setup(...args),
       bundlePath
     })
   };
@@ -6655,12 +6673,17 @@ class Database {
        order by kcu.constraint_name, kcu.ordinal_position`, [schema]);
     const uniqByTable = new Map;
     for (const u of uniq.rows) {
-      if (!uniqByTable.has(u.table_name))
-        uniqByTable.set(u.table_name, new Map);
-      const byConstraint = uniqByTable.get(u.table_name);
-      if (!byConstraint.has(u.constraint_name))
-        byConstraint.set(u.constraint_name, []);
-      byConstraint.get(u.constraint_name).push(u.column_name);
+      let byConstraint = uniqByTable.get(u.table_name);
+      if (!byConstraint) {
+        byConstraint = new Map;
+        uniqByTable.set(u.table_name, byConstraint);
+      }
+      let columns = byConstraint.get(u.constraint_name);
+      if (!columns) {
+        columns = [];
+        byConstraint.set(u.constraint_name, columns);
+      }
+      columns.push(u.column_name);
     }
     const fks = await this.engine.query(`select
          tc.constraint_name,
@@ -6681,22 +6704,27 @@ class Database {
        order by tc.constraint_name, kcu.ordinal_position`, [schema]);
     const pkSet = new Map;
     for (const pk of pks.rows) {
-      if (!pkSet.has(pk.table_name))
-        pkSet.set(pk.table_name, new Set);
-      pkSet.get(pk.table_name).add(pk.column_name);
+      let columns = pkSet.get(pk.table_name);
+      if (!columns) {
+        columns = new Set;
+        pkSet.set(pk.table_name, columns);
+      }
+      columns.add(pk.column_name);
     }
     const tables = new Map;
     for (const c of cols.rows) {
-      if (!tables.has(c.table_name)) {
-        tables.set(c.table_name, {
+      let table = tables.get(c.table_name);
+      if (!table) {
+        table = {
           schema,
           name: c.table_name,
           columns: [],
           primaryKey: [...pkSet.get(c.table_name) ?? []],
           uniqueKeys: [...uniqByTable.get(c.table_name)?.values() ?? []]
-        });
+        };
+        tables.set(c.table_name, table);
       }
-      tables.get(c.table_name).columns.push({
+      table.columns.push({
         name: c.column_name,
         udtName: c.udt_name,
         isNullable: c.is_nullable === "YES",
@@ -6868,12 +6896,15 @@ function parseIdentityArgs(identity) {
     parts.push(current);
   return parts.map((part) => {
     const tokens = part.trim().split(/\s+/);
-    while (tokens.length > 1 && ["IN", "OUT", "INOUT", "VARIADIC"].includes(tokens[0])) {
+    while (tokens.length > 1 && ["IN", "OUT", "INOUT", "VARIADIC"].includes(tokens[0] ?? "")) {
       tokens.shift();
     }
+    const first = tokens[0];
+    if (first === undefined || first === "")
+      throw new Error("invalid function identity argument");
     if (tokens.length === 1)
-      return { name: "", type: tokens[0] };
-    const name = tokens[0].replace(/^"|"$/g, "");
+      return { name: "", type: first };
+    const name = first.replace(/^"|"$/g, "");
     return { name, type: tokens.slice(1).join(" ") };
   });
 }
@@ -7185,6 +7216,8 @@ class RealtimeEngine {
     const state = this.presence.get(topic);
     if (state?.has(channel.presenceKey)) {
       const metas = state.get(channel.presenceKey);
+      if (!metas)
+        return;
       state.delete(channel.presenceKey);
       if (state.size === 0)
         this.presence.delete(topic);
@@ -7479,7 +7512,7 @@ class ApiError extends Error {
   status;
   body;
   constructor(status, body) {
-    super(typeof body.message === "string" ? body.message : JSON.stringify(body));
+    super(typeof body["message"] === "string" ? body["message"] : JSON.stringify(body));
     this.status = status;
     this.body = body;
   }
@@ -7857,6 +7890,8 @@ class QueryBuilder {
       const cells = columns.map((c) => {
         if (!(c in row)) {
           const col = tinfo.columns.find((x) => x.name === c);
+          if (!col)
+            throw new ApiError(400, { code: "PGRST204", message: `Column ${c} does not exist` });
           return opts.missingDefault && col.hasDefault ? "default" : "null";
         }
         return this.pushParam(params, tinfo, c, row[c]);
@@ -7976,6 +8011,8 @@ class QueryBuilder {
       });
     } else {
       const j = rel.junction;
+      if (!j)
+        throw new Error("many-to-many relationship is missing its junction table");
       const jAlias = this.nextAlias();
       const joinConds = j.fkToTarget.srcColumns.map((src, i) => `${quoteIdent(jAlias)}.${quoteIdent(src)} = ${quoteIdent(childAlias)}.${quoteIdent(j.fkToTarget.tgtColumns[i])}`);
       fromClause = `${this.qualify(rel.targetTable)} as ${quoteIdent(childAlias)} join ${this.qualify(j.table)} as ${quoteIdent(jAlias)} on ${joinConds.join(" and ")}`;
@@ -8241,6 +8278,8 @@ function renderFilter(f, alias) {
     case "phfts":
     case "wfts": {
       const fn = { fts: "to_tsquery", plfts: "plainto_tsquery", phfts: "phraseto_tsquery", wfts: "websearch_to_tsquery" }[f.op];
+      if (!fn)
+        throw new Error(`Unsupported full-text operator: ${f.op}`);
       expr = f.ftsConfig ? `${colExpr} @@ ${fn}(${quoteLiteral(f.ftsConfig)}, ${quoteLiteral(f.value)})` : `${colExpr} @@ ${fn}(${quoteLiteral(f.value)})`;
       break;
     }
@@ -8535,9 +8574,10 @@ class RestHandler {
     if (!opts.returning) {
       return new Response(null, { status: opts.status === 201 ? 201 : 204, headers: countHeader });
     }
-    return this.dataResponse(rows, {
+    const responseRows = rows ?? [];
+    return this.dataResponse(responseRows, {
       status: opts.status,
-      count: opts.prefer.count !== undefined ? rows.length : null,
+      count: opts.prefer.count !== undefined ? responseRows.length : null,
       offset: 0,
       wantsObject: opts.wantsObject,
       wantsCsv: opts.wantsCsv,
@@ -8648,7 +8688,7 @@ class RestHandler {
       if (item.name === "*") {
         exprs.push(`${quoteIdent(alias)}.*`);
       } else {
-        const out = item.alias ?? item.name.split(/->>|->/).pop().trim();
+        const out = item.alias ?? (item.name.split(/->>|->/).pop() ?? item.name).trim();
         const cast = item.cast ? `::${sanitizeCast(item.cast)}` : "";
         exprs.push(`${renderColumnExpr(alias, item.name)}${cast} as ${quoteIdent(out)}`);
       }
@@ -8902,7 +8942,10 @@ function applyResize(image, metadata, options) {
     image.resize(options.width);
     return;
   }
-  const proportionalWidth = Math.max(1, Math.round(metadata.width * options.height / metadata.height));
+  const height = options.height;
+  if (height === undefined)
+    return;
+  const proportionalWidth = Math.max(1, Math.round(metadata.width * height / metadata.height));
   image.resize(proportionalWidth);
 }
 async function transformImage(source, options, knownSourceSize) {
@@ -9059,6 +9102,8 @@ class ImageTransformCache {
       if (oldestKey === undefined)
         break;
       const oldest = this.entries.get(oldestKey);
+      if (!oldest)
+        break;
       this.entries.delete(oldestKey);
       this.cachedBytes -= oldest.size;
     }
@@ -9908,8 +9953,9 @@ class StorageHandler {
       ...[...folders].map((name) => ({ name, row: null })),
       ...Object.entries(files).map(([name, row]) => ({ name, row }))
     ];
-    if (body.search)
-      entries = entries.filter((e) => e.name.includes(body.search));
+    const search = body.search;
+    if (search)
+      entries = entries.filter((e) => e.name.includes(search));
     const column = body.sortBy?.column ?? "name";
     const asc = (body.sortBy?.order ?? "asc") === "asc";
     entries.sort((a, b) => {
@@ -10059,6 +10105,8 @@ function parseSizeLimit(v) {
   if (!m)
     throw new StorageValidationError(`invalid file_size_limit: ${v}`);
   const mult = { b: 1, kb: 1024, mb: 1024 ** 2, gb: 1024 ** 3 }[(m[2] ?? "b").toLowerCase()];
+  if (mult === undefined)
+    throw new StorageValidationError(`invalid file_size_limit: ${v}`);
   return Math.floor(parseFloat(m[1]) * mult);
 }
 function objectMetadata(size, contentType, cacheControl) {
@@ -10357,7 +10405,7 @@ class NetService {
       const res = await guardedFetch(this.fetchImpl, row.url, {
         method: row.method,
         headers,
-        body: hasBody ? row.body ?? undefined : undefined,
+        ...hasBody && row.body !== null ? { body: row.body } : {},
         signal: controller.signal
       });
       status = res.status;
@@ -10376,9 +10424,9 @@ class NetService {
       id: row.id,
       method: row.method,
       url: row.url,
-      status: status ?? undefined,
+      ...status === null ? {} : { status },
       timedOut,
-      error: errorMsg ?? undefined
+      ...errorMsg === null ? {} : { error: errorMsg }
     });
   }
   async record(id, status, contentType, respHeaders, content, timedOut, errorMsg) {
@@ -10831,16 +10879,16 @@ class GraphqlHandler {
         throw new ApiError(415, { message: "GraphQL requests require application/json" });
       }
       const body = JSON.parse(await boundedBody(request, this.maxBytes));
-      if (!isObject(body) || typeof body.query !== "string" || !body.query.trim() || body.variables != null && !isObject(body.variables) || body.extensions != null && !isObject(body.extensions) || body.operationName != null && typeof body.operationName !== "string") {
+      if (!isObject(body) || typeof body["query"] !== "string" || !body["query"].trim() || body["variables"] != null && !isObject(body["variables"]) || body["extensions"] != null && !isObject(body["extensions"]) || body["operationName"] != null && typeof body["operationName"] !== "string") {
         throw new ApiError(400, { message: "Invalid GraphQL request" });
       }
-      operationName = body.operationName ?? undefined;
+      operationName = body["operationName"] ?? undefined;
       const result = await this.db.withContext(context, async (query) => {
         await query(`select set_config('statement_timeout', $1, true)`, [String(this.timeoutMs)]);
         await query(`select set_config('search_path', $1, true)`, [
           this.schemas.map((schema) => `"${schema.replaceAll('"', '""')}"`).join(",")
         ]);
-        return query("select graphql.resolve($1::text, $2::jsonb, $3::text, $4::jsonb) as result", [body.query, JSON.stringify(body.variables ?? {}), body.operationName ?? null, JSON.stringify(body.extensions ?? {})]);
+        return query("select graphql.resolve($1::text, $2::jsonb, $3::text, $4::jsonb) as result", [body["query"], JSON.stringify(body["variables"] ?? {}), body["operationName"] ?? null, JSON.stringify(body["extensions"] ?? {})]);
       });
       const row = result.rows[0];
       if (result.rows.length !== 1 || !isRecord(row) || !isGraphqlEnvelope(row["result"])) {
@@ -10938,9 +10986,12 @@ async function generateTypes(db, schema = "public") {
   const views = new Map;
   for (const c of cols) {
     const target = c.table_kind === "r" ? tables : views;
-    if (!target.has(c.table_name))
-      target.set(c.table_name, []);
-    target.get(c.table_name).push(c);
+    let columns = target.get(c.table_name);
+    if (!columns) {
+      columns = [];
+      target.set(c.table_name, columns);
+    }
+    columns.push(c);
   }
   const tsType = (udt, nullable) => {
     const base = mapType(udt, enumNames, schema);
@@ -11182,9 +11233,12 @@ async function snapshotSchema(db, schema = "public") {
   const constraints = new Map;
   const constraintIndexOids = new Set;
   for (const c of cons.rows) {
-    if (!constraints.has(c.table))
-      constraints.set(c.table, new Map);
-    constraints.get(c.table).set(c.name, c.def);
+    let tableConstraints = constraints.get(c.table);
+    if (!tableConstraints) {
+      tableConstraints = new Map;
+      constraints.set(c.table, tableConstraints);
+    }
+    tableConstraints.set(c.name, c.def);
     if (c.conindid)
       constraintIndexOids.add(c.conindid);
   }
@@ -11198,9 +11252,12 @@ async function snapshotSchema(db, schema = "public") {
   for (const r of idx.rows) {
     if (constraintIndexOids.has(r.indexrelid))
       continue;
-    if (!indexes.has(r.table))
-      indexes.set(r.table, new Map);
-    indexes.get(r.table).set(r.name, r.def);
+    let tableIndexes = indexes.get(r.table);
+    if (!tableIndexes) {
+      tableIndexes = new Map;
+      indexes.set(r.table, tableIndexes);
+    }
+    tableIndexes.set(r.name, r.def);
   }
   const en = await db.query(`select t.typname as name, array_agg(e.enumlabel order by e.enumsortorder) as labels
      from pg_type t join pg_enum e on e.enumtypid = t.oid
@@ -11299,7 +11356,7 @@ function schemasEqual(left, right) {
     if (value instanceof Map)
       return [...value].sort(([a], [b]) => String(a).localeCompare(String(b))).map(([key, entry]) => [key, canonical(entry)]);
     if (Array.isArray(value))
-      return value.map(canonical);
+      return value.map((entry) => canonical(entry));
     if (value !== null && typeof value === "object")
       return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, entry]) => [key, canonical(entry)]));
     return value;
@@ -11911,7 +11968,11 @@ async function revokeReplicationGrants(tx) {
   }
 }
 async function grantReplicationAllowlist(tx, tables) {
-  const schemas = uniqueSorted(tables.map((table) => table.schema));
+  const schemas = uniqueSorted(tables.map((table) => {
+    if (!table.schema)
+      throw new Error(`publication table ${table.name} has no schema`);
+    return table.schema;
+  }));
   for (const schema of schemas) {
     await tx.exec(`GRANT USAGE ON SCHEMA ${quoteIdentifier(schema)} TO ${POWERSYNC_REPLICATION_ROLE}`);
   }
@@ -12015,6 +12076,8 @@ function normalizeCidr(cidr) {
   if (!match)
     throw new Error(`invalid PowerSync client CIDR: ${cidr}`);
   const address = match[1];
+  if (!address)
+    throw new Error(`invalid PowerSync client CIDR: ${cidr}`);
   const family = isIP(address);
   const prefix = Number(match[2]);
   if (family === 0 || prefix < 0 || prefix > (family === 4 ? 32 : 128)) {
@@ -12121,12 +12184,12 @@ class PgWireClient {
             if (code === 0) {} else if (code === 3) {
               if (!needPassword())
                 return;
-              this.socket.write(message(112, cstring(opts.password)));
+              this.socket.write(message(112, cstring(opts.password ?? "")));
             } else if (code === 5) {
               if (!needPassword())
                 return;
               const salt = payload.subarray(4, 8);
-              const inner = md5Hex(Buffer.from(opts.password + opts.user, "utf8"));
+              const inner = md5Hex(Buffer.from((opts.password ?? "") + opts.user, "utf8"));
               const token = "md5" + md5Hex(Buffer.concat([Buffer.from(inner, "utf8"), salt]));
               this.socket.write(message(112, cstring(token)));
             } else if (code === 10) {
@@ -12148,6 +12211,10 @@ class PgWireClient {
                 reject(new Error("SCRAM: server nonce does not extend client nonce"));
                 return;
               }
+              if (!attrs.s || !attrs.i || !opts.password) {
+                reject(new Error("SCRAM: incomplete server challenge"));
+                return;
+              }
               const salt = Buffer.from(attrs.s, "base64");
               const iterations = parseInt(attrs.i, 10);
               const saltedPassword = pbkdf2Sync(opts.password, salt, iterations, 32, "sha256");
@@ -12564,7 +12631,7 @@ function toPgArrayLiteral(array) {
 // src/runtime/node/native/engine.ts
 var DEFAULT_PG_VERSION = "17.7.0";
 var POSTGRES_MIRROR_URL_ERROR = "SUPACLOUD_LITE_POSTGRES_MIRROR must be an absolute HTTPS URL or a loopback HTTP URL";
-var NATIVE_POSTGRES_MAJOR = DEFAULT_PG_VERSION.split(".")[0];
+var NATIVE_POSTGRES_MAJOR = DEFAULT_PG_VERSION.split(".")[0] ?? "17";
 function nativePostgresMajor(installDir = process.env.SUPACLOUD_LITE_POSTGRES_DIR) {
   if (!installDir)
     return NATIVE_POSTGRES_MAJOR;
@@ -12831,15 +12898,18 @@ ${detail}` : " (no output)"}
       connect,
       onClose: async () => {
         removeExitHandler?.();
-        await stopPostgres(postgres, () => postgresExited);
-        rmSync(socketDirectory, { recursive: true, force: true });
+        if (postgres)
+          await stopPostgres(postgres, () => postgresExited);
+        if (socketDirectory)
+          rmSync(socketDirectory, { recursive: true, force: true });
         await releaseLock();
       }
     });
   } catch (error) {
     removeExitHandler?.();
-    if (postgres)
-      await stopPostgres(postgres, () => postgres.exitCode !== null);
+    const processToStop = postgres;
+    if (processToStop)
+      await stopPostgres(processToStop, () => processToStop.exitCode !== null);
     if (socketDirectory)
       rmSync(socketDirectory, { recursive: true, force: true });
     await releaseLock();
@@ -12923,6 +12993,8 @@ async function withDelta(opts, baseline, action) {
       const liveSnap = await snapshotSchema(tx, schema);
       const ddl = diffSchemas(shadowSnap, liveSnap, schema);
       try {
+        if (!shadow)
+          throw new Error("Shadow database was closed before schema replay");
         if (ddl.length)
           await shadow.db.exec(ddl.join(`
 `));
@@ -14526,7 +14598,10 @@ ${details}`, { cause: buildThrow });
       throw new Error(buildOutput.logs.map((item) => item.message).join(`
 `) || `failed to bundle ${entryPath}`);
     }
-    return buildOutput.outputs[0].path;
+    const output = buildOutput.outputs[0];
+    if (!output)
+      throw new Error(`bundle produced no output for ${entryPath}`);
+    return output.path;
   } catch (buildError) {
     try {
       await rm3(outDir, { recursive: true, force: true });
@@ -14612,7 +14687,8 @@ async function loadFunctionsUnlocked(projectDir, options, mode) {
     const dir = join7(root, name);
     if (!(await stat2(dir)).isDirectory())
       continue;
-    const candidates = options[name]?.entrypoint ? [join7(projectDir, options[name].entrypoint)] : ["index.ts", "index.tsx", "index.js", "index.mjs"].map((f) => join7(dir, f));
+    const entrypoint = options[name]?.entrypoint;
+    const candidates = entrypoint ? [join7(projectDir, entrypoint)] : ["index.ts", "index.tsx", "index.js", "index.mjs"].map((f) => join7(dir, f));
     for (const path of candidates) {
       try {
         await stat2(path);