@supacloud/lite 0.27.1 → 0.28.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.28.0](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.27.1...supacloud-lite-v0.28.0) (2026-10-14)
+
+
+### Features
+
+* **lite:** add offline auth user provisioning ([#1911](https://github.com/vibeunion/supacloud/issues/1911)) ([e9c8931](https://github.com/vibeunion/supacloud/commit/e9c89319cf39d9fe2d71ceac9ab76e6856bb5d84))
+
+
+### Bug Fixes
+
+* **lite:** normalize filesystem storage roots ([#1902](https://github.com/vibeunion/supacloud/issues/1902)) ([f1b5141](https://github.com/vibeunion/supacloud/commit/f1b5141c1e831e68aaf94b505909c9e4942a42df))
+* **lite:** report effective local auth configuration in doctor ([#1907](https://github.com/vibeunion/supacloud/issues/1907)) ([c167617](https://github.com/vibeunion/supacloud/commit/c1676176bdd5a2c057114474186570b7e6d5d0dd))
+
 ## [0.27.1](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.27.0...supacloud-lite-v0.27.1) (2026-10-14)
 
 

package/README.md

@@ -159,6 +159,7 @@ supacloud-lite start
 supacloud-lite migrate
 supacloud-lite status
 supacloud-lite keys [--service-role]
+supacloud-lite auth create-user --email <email> --password-stdin [--email-confirm] [--json]
 supacloud-lite gen types [-o database.types.ts]
 supacloud-lite db reset
 supacloud-lite db diff [-f migration_name]
@@ -174,6 +175,21 @@ supacloud-lite version
 
 首次初始化或 state 目录不存在/为空时，先运行 `supacloud-lite migrate`。`db reset` 只接受已经初始化且保留有效 `secrets.json` 标记的 state；它不会为 reset 创建或覆盖项目 secrets。
 
+#### 创建本地 Auth 账号
+
+先停止项目服务，再从受保护的文件或密码管理器管道提供密码：
+
+```sh
+supacloud-lite auth create-user --project-dir ./my-project \
+  --email operator@example.com --password-stdin --email-confirm --json < /secure/password.txt
+```
+
+不要将密码写进命令行参数或 shell 历史；文件应限制为当前用户可读，并按自己的凭据管理流程清理。命令只接受 stdin 的一行 UTF-8 密码（最多 4096 字节），移除末尾一个 LF/CRLF，保留空格。交互终端输入和 `--password` 参数会被拒绝。
+
+这是离线、本地账号创建操作，不连接远程 Auth API，不执行待应用的业务迁移、seed、函数或 webhook；请先用 `migrate` 初始化应用 schema。即使关闭公开注册，也可以由本机管理员创建账号。邮箱默认未确认；只有管理员已核实邮箱时才加 `--email-confirm`。未确认账号能否登录仍受项目的邮箱确认配置控制，命令不会发送确认邮件。
+
+命令遵守有效密码长度策略，拒绝重复邮箱（不覆盖密码）、`--memory`、禁用 Auth、外部身份模式及占用中的数据目录。输出仅含用户 ID、邮箱和确认状态，不含密码、项目密钥或登录 token。该账号使用普通 `authenticated` 角色；业务权限仍由应用自己的成员关系和 RLS 管理。
+
 `db diff` / `db pull` 只读检查现有数据库，不会初始化 live backend 或自动应用待执行迁移；已应用历史必须与本地迁移精确一致。生成的 DDL 先在不含 seed 的临时影子数据库中重放并核对受支持的 Catalog。检测到不能完整重建的 view/function/trigger/policy、权限、RLS 或非追加 enum 变更时拒绝生成，改用官方 Supabase pg-delta；这不是完整 PostgreSQL Catalog 覆盖。
 
 `db pull` 默认写入 `.supacloud-lite/schema-drafts`，不修改迁移账本。仅对已审核且已存在于数据库的变更使用 `--baseline`：它记录账本而不执行 DDL，提交确认后才发布到迁移目录，禁止覆盖已有文件。若失败后留下 `.sql.pending`，停止启动/迁移，保留文件并检查对应账本版本与 SQL；只有确认匹配提交后才能发布该文件。不要猜测提交结果或直接重放捕获的 DDL。库调用方在 `baseline: false` 时也应把 `migrationsDir` 指向草稿目录。恢复步骤及文件/数据库非原子边界见仓库 `docs/select-agent-backend.md`。
@@ -599,6 +615,7 @@ supacloud-lite start
 supacloud-lite migrate
 supacloud-lite status
 supacloud-lite keys [--service-role]
+supacloud-lite auth create-user --email <email> --password-stdin [--email-confirm] [--json]
 supacloud-lite gen types [-o database.types.ts]
 supacloud-lite db reset
 supacloud-lite db diff [-f migration_name]
@@ -614,6 +631,21 @@ supacloud-lite version
 
 Run `supacloud-lite migrate` first when initializing a project or when the state directory is missing or empty. `db reset` only accepts initialized state with a valid `secrets.json` marker; it never creates or replaces project secrets for a reset.
 
+#### Create a Local Auth User
+
+Stop the project server first, then supply the password through a protected file or password-manager pipe:
+
+```sh
+supacloud-lite auth create-user --project-dir ./my-project \
+  --email operator@example.com --password-stdin --email-confirm --json < /secure/password.txt
+```
+
+Keep passwords out of command arguments and shell history. Restrict the file to its owner and remove it according to your credential-handling policy. The command accepts one UTF-8 password line on stdin (at most 4096 bytes), removes one trailing LF/CRLF, and preserves spaces. Interactive terminal input and `--password` arguments are rejected.
+
+This is an offline, local operation: it does not contact a remote Auth API or run pending application migrations, seed, functions, or webhooks. Initialize application schemas with `migrate` first. Local administrators can provision accounts even when public signup is disabled. Email is unconfirmed by default; use `--email-confirm` only after verifying the address. Login eligibility for unconfirmed accounts still follows the project's email-confirmation settings; this command does not send confirmation mail.
+
+The command enforces the effective password-length policy and rejects duplicate emails without changing passwords, `--memory`, disabled Auth, external identity, and occupied data directories. Output contains only the user ID, email, and confirmation status, never passwords, project keys, or session tokens. Accounts have the ordinary `authenticated` role; application membership and RLS still govern business permissions.
+
 Common flags:
 
 - `--project-dir`: the project directory containing `supabase/`

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.27.1",
+  version: "0.28.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -13728,12 +13728,20 @@ async function inspectPostgresExtensions(engine, source) {
 }
 
 // src/runtime/node/native/readiness.ts
-function liteCapabilities(engine, replicationProfile) {
+function liteCapabilities(engine, replicationProfile, authEnabled = true) {
   const extensionSource = engine === "native" ? "native-postgresql" : "pglite-bundled";
   const common = {
     graphql: { status: "unverified", extension: "pg_graphql", reason: "DATABASE_NOT_INSPECTED" },
     runtime_mode: "development",
-    identity: { mode: "local", verification: "built-in" },
+    identity: {
+      mode: "local",
+      verification: "built-in",
+      local_auth: {
+        status: authEnabled ? "enabled" : "disabled",
+        reason: authEnabled ? "LOCAL_AUTH_ENABLED" : "AUTH_DISABLED",
+        verification: "configuration-only"
+      }
+    },
     migrations: { formats: ["flat-sql", "timestamp-folder"], content_check: "supported", target_bindings: "supported" },
     project_release_manifests: "unsupported",
     postgres_extensions: {
@@ -14521,7 +14529,7 @@ function isNotFound(error) {
 
 // src/project-runtime.ts
 import { chmod, link as link2, lstat as lstat2, mkdir as mkdir5, readFile as readFile7, realpath as realpath2, unlink as unlink2, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname6, isAbsolute, join as join8, parse, relative, resolve as resolve4 } from "path";
+import { dirname as dirname6, isAbsolute as isAbsolute2, join as join8, parse, relative as relative2, resolve as resolve4 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
 // src/runtime/node/bun-server.ts
@@ -14573,16 +14581,18 @@ async function serveBun(backend, opts = {}) {
 
 // src/runtime/node/fs-driver.ts
 import { mkdir as mkdir3, readFile as readFile4, rename, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname4, join as join5, normalize, sep } from "path";
+import { dirname as dirname4, isAbsolute, join as join5, relative, resolve as resolvePath, sep } from "path";
 
 class FsStorageDriver {
   root;
   constructor(root) {
     this.root = root;
+    this.root = resolvePath(root);
   }
   resolve(key) {
-    const path = normalize(join5(this.root, key));
-    if (!path.startsWith(normalize(this.root) + sep)) {
+    const path = join5(this.root, key);
+    const relativePath = relative(this.root, path);
+    if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)) {
       throw new Error(`invalid storage key: ${key}`);
     }
     return path;
@@ -14964,10 +14974,10 @@ var RESET_INITIALIZATION_ERROR = 'db reset requires initialized state; run "supa
 var RESET_INVALID_SECRETS_ERROR = "db reset requires a valid project secrets marker; restore the state before retrying";
 function resolveProjectPaths(options = {}) {
   const projectDir = resolve4(options.projectDir ?? process.cwd());
-  const stateDir = resolvePath(projectDir, options.stateDir ?? process.env.SUPACLOUD_LITE_STATE_DIR ?? ".supacloud-lite");
+  const stateDir = resolvePath2(projectDir, options.stateDir ?? process.env.SUPACLOUD_LITE_STATE_DIR ?? ".supacloud-lite");
   const databaseEngine = resolveDatabaseEngine(options.engine, options.memory);
-  const dataDir = options.memory ? undefined : resolvePath(projectDir, options.dataDir ?? process.env.SUPACLOUD_LITE_DATA_DIR ?? join8(stateDir, databaseEngine === "native" ? "pgdata" : "db"));
-  const storageDir = resolvePath(projectDir, options.storageDir ?? process.env.SUPACLOUD_LITE_STORAGE_DIR ?? join8(stateDir, "storage"));
+  const dataDir = options.memory ? undefined : resolvePath2(projectDir, options.dataDir ?? process.env.SUPACLOUD_LITE_DATA_DIR ?? join8(stateDir, databaseEngine === "native" ? "pgdata" : "db"));
+  const storageDir = resolvePath2(projectDir, options.storageDir ?? process.env.SUPACLOUD_LITE_STORAGE_DIR ?? join8(stateDir, "storage"));
   return {
     projectDir,
     stateDir,
@@ -15001,8 +15011,8 @@ async function assertResetPathsSafe(paths) {
   ];
   for (const [label, targetPath] of targets) {
     const target = resolve4(targetPath);
-    const relativePath = relative(stateDir, target);
-    if (!relativePath || relativePath.startsWith("..") || isAbsolute(relativePath)) {
+    const relativePath = relative2(stateDir, target);
+    if (!relativePath || relativePath.startsWith("..") || isAbsolute2(relativePath)) {
       throw new Error(`refusing to reset ${label} path outside the state directory: ${target}`);
     }
     await assertResetTargetCanonical(stateDir, canonicalStateDir, target, label);
@@ -15049,9 +15059,9 @@ async function assertResetTargetCanonical(stateDir, canonicalStateDir, target, l
     current = parent;
   }
   const existingAncestor = await nearestExistingAncestor(target);
-  const canonicalTarget = resolve4(await realpath2(existingAncestor), relative(existingAncestor, target));
-  const canonicalRelative = relative(canonicalStateDir, canonicalTarget);
-  if (!canonicalRelative || canonicalRelative.startsWith("..") || isAbsolute(canonicalRelative)) {
+  const canonicalTarget = resolve4(await realpath2(existingAncestor), relative2(existingAncestor, target));
+  const canonicalRelative = relative2(canonicalStateDir, canonicalTarget);
+  if (!canonicalRelative || canonicalRelative.startsWith("..") || isAbsolute2(canonicalRelative)) {
     throw new Error(`refusing to reset ${label} path outside the canonical state directory: ${target}`);
   }
 }
@@ -15343,8 +15353,8 @@ async function loadWebhooks(projectDir) {
     throw error;
   }
 }
-function resolvePath(projectDir, path) {
-  return isAbsolute(path) ? path : resolve4(projectDir, path);
+function resolvePath2(projectDir, path) {
+  return isAbsolute2(path) ? path : resolve4(projectDir, path);
 }
 function randomHex(bytes) {
   const value = crypto.getRandomValues(new Uint8Array(bytes));
@@ -15390,7 +15400,7 @@ async function findEphemeralPort(host = "127.0.0.1") {
 
 // src/snapshot.ts
 import { chmod as chmod2, copyFile, lstat as lstat3, mkdir as mkdir6, mkdtemp, readdir as readdir3, readFile as readFile8, rename as rename2, rm as rm5, writeFile as writeFile6 } from "fs/promises";
-import { dirname as dirname7, join as join9, parse as parse2, relative as relative2, resolve as resolve5, sep as sep2 } from "path";
+import { dirname as dirname7, join as join9, parse as parse2, relative as relative3, resolve as resolve5, sep as sep2 } from "path";
 import { create as createTar, extract as extractTar2 } from "tar";
 var SNAPSHOT_FORMAT = "supacloud-lite-snapshot";
 var SNAPSHOT_VERSION = 1;
@@ -15498,10 +15508,10 @@ async function restoreSnapshot(options) {
     await mkdir6(stateStage, { recursive: true });
     await copyEntry(join9(payloadRoot, "secrets.json"), join9(stateStage, "secrets.json"));
     if (paths.dataDir && isWithin(paths.stateDir, paths.dataDir)) {
-      await copyEntry(join9(payloadRoot, "database"), join9(stateStage, relative2(paths.stateDir, paths.dataDir)));
+      await copyEntry(join9(payloadRoot, "database"), join9(stateStage, relative3(paths.stateDir, paths.dataDir)));
     }
     if (options.storageBackend === "fs" && isWithin(paths.stateDir, paths.storageDir)) {
-      await copyEntry(join9(payloadRoot, "storage"), join9(stateStage, relative2(paths.stateDir, paths.storageDir)));
+      await copyEntry(join9(payloadRoot, "storage"), join9(stateStage, relative3(paths.stateDir, paths.storageDir)));
     }
     const swaps = [];
     try {
@@ -15816,6 +15826,89 @@ async function waitForShutdown(closeProject, signalSource = process) {
   await closeProject();
 }
 
+// src/auth-cli.ts
+async function createLocalAuthUser(options) {
+  if (options.memory)
+    throw new Error("auth create-user requires a persistent project; --memory is not supported");
+  const email = options.email?.trim().toLowerCase();
+  if (!email || email.length > 254 || !/^[^\s@\x00-\x1f\x7f]+@[^\s@\x00-\x1f\x7f]+\.[^\s@\x00-\x1f\x7f]+$/.test(email)) {
+    throw new Error("auth create-user requires a valid --email");
+  }
+  if (!options.passwordStdin)
+    throw new Error("auth create-user requires --password-stdin; passwords are not accepted as arguments");
+  if (process.stdin.isTTY)
+    throw new Error("--password-stdin requires piped or redirected input; terminal input is not accepted");
+  const paths = resolveProjectPaths(options);
+  const config = loadProjectConfig(paths.projectDir, process.env, options.runtimeMode);
+  if (config.auth.enabled === false)
+    throw new Error("cannot create a local user: Auth is disabled in config.toml");
+  if (options.externalIdentity || options.identityModule || config.lite.identityModule) {
+    throw new Error("cannot create a local user: the project uses external identity");
+  }
+  await assertDataDirUnlocked(paths.dataDir);
+  const password = await readPassword();
+  const project = await createProjectBackend({
+    ...options,
+    applyMigrations: false,
+    includeSeed: false,
+    includeFunctions: false,
+    includeWebhooks: false,
+    includeIdentity: false,
+    graphql: { enabled: false },
+    storageBackend: "memory",
+    startRuntimeServices: false,
+    log: () => {}
+  });
+  try {
+    const settings = await loadAuthSettings(project.backend.db, project.config.auth.settings);
+    if (password.length < settings.minPasswordLength) {
+      throw new Error(`password must be at least ${settings.minPasswordLength} characters`);
+    }
+    const existing = await project.backend.db.query("select id from auth.users where email = $1", [email]);
+    if (existing.rows.length > 0)
+      throw new Error("an Auth user with this email already exists; no changes made");
+    const response = await project.backend.fetch("http://local/auth/v1/admin/users", {
+      method: "POST",
+      headers: {
+        apikey: project.backend.serviceRoleKey,
+        authorization: `Bearer ${project.backend.serviceRoleKey}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({ email, password, email_confirm: options.emailConfirm === true })
+    });
+    if (!response.ok)
+      throw new Error(`local Auth user creation failed (HTTP ${response.status})`);
+    const user = await response.json();
+    if (!isRecord(user) || typeof user.id !== "string" || typeof user.email !== "string") {
+      throw new Error("local Auth returned an invalid user response");
+    }
+    return { id: user.id, email: user.email, email_confirmed: typeof user.email_confirmed_at === "string" };
+  } finally {
+    await project.backend.close();
+  }
+}
+async function readPassword() {
+  const chunks = [];
+  let length = 0;
+  for await (const chunk of Bun.stdin.stream()) {
+    length += chunk.byteLength;
+    if (length > 4098)
+      throw new Error("password input exceeds 4096 bytes");
+    chunks.push(chunk);
+  }
+  let password;
+  try {
+    password = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks)).replace(/\r?\n$/, "");
+  } catch {
+    throw new Error("password input must be valid UTF-8");
+  }
+  if (!password || /[\r\n\x00]/.test(password))
+    throw new Error("password input must contain one non-empty line");
+  if (Buffer.byteLength(password, "utf8") > 4096)
+    throw new Error("password input exceeds 4096 bytes");
+  return password;
+}
+
 // src/cli.ts
 function parseArgs(argv) {
   const args = [...argv];
@@ -15896,7 +15989,15 @@ function parseArgs(argv) {
       options.force = true;
     else if (argument === "--json")
       options.json = true;
-    else if (argument === "--version") {
+    else if (argument === "--email")
+      options.email = next();
+    else if (argument === "--password-stdin")
+      options.passwordStdin = true;
+    else if (argument === "--email-confirm")
+      options.emailConfirm = true;
+    else if (argument.startsWith("--password")) {
+      throw new Error("password arguments are not supported; use --password-stdin");
+    } else if (argument === "--version") {
       console.log(package_default.version);
       process.exit(0);
     } else if (argument === "--help" || argument === "-h") {
@@ -15911,7 +16012,20 @@ function parseArgs(argv) {
 }
 async function main() {
   const options = parseArgs(process.argv.slice(2));
+  if (options.command !== "auth" && (options.email !== undefined || options.passwordStdin || options.emailConfirm)) {
+    throw new Error("--email, --password-stdin and --email-confirm are only supported by auth create-user");
+  }
   const paths = resolveProjectPaths(options);
+  if (options.command === "auth") {
+    if (options.positionals.length !== 1 || options.positionals[0] !== "create-user") {
+      throw new Error("usage: auth create-user --email <email> --password-stdin [--email-confirm] [--json]");
+    }
+    const user = await createLocalAuthUser(options);
+    await writeStandardOutput(options.json ? `${JSON.stringify(user, null, 2)}
+` : `Created Auth user ${user.id} (${user.email}); email confirmed: ${user.email_confirmed ? "yes" : "no"}
+`);
+    return;
+  }
   if (options.command === "version" || options.command === "--version") {
     await writeStandardOutput(`${package_default.version}
 `);
@@ -15991,10 +16105,18 @@ ${privilegedKey}
   if (options.command === "doctor") {
     const config = loadProjectConfig(paths.projectDir, process.env, options.runtimeMode);
     const replication = resolveNativeReplicationOptions(options, paths.databaseEngine);
-    const report = liteCapabilities(paths.databaseEngine, replication?.profile);
+    const report = liteCapabilities(paths.databaseEngine, replication?.profile, config.auth.enabled !== false);
     report.runtime_mode = config.lite.runtimeMode;
     if (options.identityModule ?? config.lite.identityModule) {
-      report.identity = { mode: "external", verification: "unverified" };
+      report.identity = {
+        mode: "external",
+        verification: "unverified",
+        local_auth: {
+          status: "disabled",
+          reason: "EXTERNAL_IDENTITY_CONFIGURED",
+          verification: "configuration-only"
+        }
+      };
     }
     if (paths.dataDir && existsSync5(join10(paths.dataDir, "PG_VERSION"))) {
       const engine = paths.databaseEngine === "native" ? await createNativeEngine({ dataDir: paths.dataDir, installDir: options.postgresDir, log: quietLog, replication }) : await createPgliteEngine(paths.dataDir);
@@ -16294,6 +16416,7 @@ async function printDoctor(report) {
   output.push(`graphql: ${report.graphql.status} (${report.graphql.version ?? report.graphql.reason ?? "pg_graphql"})`);
   output.push(`postgres_extensions: ${report.postgres_extensions.status} ` + `(${report.postgres_extensions.source}, ${report.postgres_extensions.available.length} available, ` + `${report.postgres_extensions.installed.length} installed)`);
   output.push(`identity: ${report.identity.mode} (${report.identity.verification})`);
+  output.push(`local_auth: ${report.identity.local_auth.status} (${report.identity.local_auth.reason}, configuration-only)`);
   output.push(`migration_formats: ${report.migrations.formats.join(", ")}`);
   if (report.powersync_readiness) {
     output.push(`powersync_ready: ${report.powersync_readiness.ready}`);
@@ -16330,6 +16453,7 @@ Commands:
   status                list applied migrations
   keys                  print the anon key
   keys --service-role   also print the privileged service_role key
+  auth create-user      create a local Auth user while the project server is stopped
   gen types             emit Supabase-shaped TypeScript database types
   db reset              reset initialized database/storage and re-run migrations
   db diff               print schema changes outside migrations
@@ -16364,7 +16488,10 @@ Options:
       --replication-tls-cert <p> PostgreSQL TLS certificate
       --replication-tls-key <p> PostgreSQL TLS private key
       --memory            use an in-memory PGlite database
-      --json              emit machine-readable doctor/migrate/status output
+      --json              emit machine-readable doctor/migrate/status/auth output
+      --email <email>     auth create-user: account email
+      --password-stdin    auth create-user: read one password line from redirected stdin
+      --email-confirm     auth create-user: explicitly mark the email as confirmed
       --runtime-mode      development (default) or strict
       --postgres-dir      operator-managed PostgreSQL installation (native only)
       --identity-module   trusted external identity bridge module

package/dist/index.js

@@ -88,7 +88,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.27.1",
+  version: "0.28.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -11736,16 +11736,18 @@ class S3StorageDriver {
 }
 // src/runtime/node/fs-driver.ts
 import { mkdir as mkdir2, readFile as readFile2, rename, rm, writeFile } from "fs/promises";
-import { dirname as dirname2, join, normalize, sep } from "path";
+import { dirname as dirname2, isAbsolute, join, relative, resolve as resolvePath, sep } from "path";
 
 class FsStorageDriver {
   root;
   constructor(root) {
     this.root = root;
+    this.root = resolvePath(root);
   }
   resolve(key) {
-    const path = normalize(join(this.root, key));
-    if (!path.startsWith(normalize(this.root) + sep)) {
+    const path = join(this.root, key);
+    const relativePath = relative(this.root, path);
+    if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)) {
       throw new Error(`invalid storage key: ${key}`);
     }
     return path;
@@ -12937,12 +12939,20 @@ function removeStalePidFile(pidPath) {
   } catch {}
 }
 // src/runtime/node/native/readiness.ts
-function liteCapabilities(engine, replicationProfile) {
+function liteCapabilities(engine, replicationProfile, authEnabled = true) {
   const extensionSource = engine === "native" ? "native-postgresql" : "pglite-bundled";
   const common = {
     graphql: { status: "unverified", extension: "pg_graphql", reason: "DATABASE_NOT_INSPECTED" },
     runtime_mode: "development",
-    identity: { mode: "local", verification: "built-in" },
+    identity: {
+      mode: "local",
+      verification: "built-in",
+      local_auth: {
+        status: authEnabled ? "enabled" : "disabled",
+        reason: authEnabled ? "LOCAL_AUTH_ENABLED" : "AUTH_DISABLED",
+        verification: "configuration-only"
+      }
+    },
     migrations: { formats: ["flat-sql", "timestamp-folder"], content_check: "supported", target_bindings: "supported" },
     project_release_manifests: "unsupported",
     postgres_extensions: {
@@ -13216,7 +13226,7 @@ async function inspectPostgresExtensions(engine, source) {
 }
 // src/project-runtime.ts
 import { chmod, link, lstat as lstat2, mkdir as mkdir4, readFile as readFile6, realpath as realpath2, unlink as unlink2, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname4, isAbsolute, join as join7, parse, relative, resolve as resolve3 } from "path";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join7, parse, relative as relative2, resolve as resolve3 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 
 // src/runtime/node/config-toml.ts
@@ -14159,10 +14169,10 @@ function isNotFound(error) {
 // src/project-runtime.ts
 function resolveProjectPaths(options = {}) {
   const projectDir = resolve3(options.projectDir ?? process.cwd());
-  const stateDir = resolvePath(projectDir, options.stateDir ?? process.env.SUPACLOUD_LITE_STATE_DIR ?? ".supacloud-lite");
+  const stateDir = resolvePath2(projectDir, options.stateDir ?? process.env.SUPACLOUD_LITE_STATE_DIR ?? ".supacloud-lite");
   const databaseEngine = resolveDatabaseEngine(options.engine, options.memory);
-  const dataDir = options.memory ? undefined : resolvePath(projectDir, options.dataDir ?? process.env.SUPACLOUD_LITE_DATA_DIR ?? join7(stateDir, databaseEngine === "native" ? "pgdata" : "db"));
-  const storageDir = resolvePath(projectDir, options.storageDir ?? process.env.SUPACLOUD_LITE_STORAGE_DIR ?? join7(stateDir, "storage"));
+  const dataDir = options.memory ? undefined : resolvePath2(projectDir, options.dataDir ?? process.env.SUPACLOUD_LITE_DATA_DIR ?? join7(stateDir, databaseEngine === "native" ? "pgdata" : "db"));
+  const storageDir = resolvePath2(projectDir, options.storageDir ?? process.env.SUPACLOUD_LITE_STORAGE_DIR ?? join7(stateDir, "storage"));
   return {
     projectDir,
     stateDir,
@@ -14444,8 +14454,8 @@ async function loadWebhooks(projectDir) {
     throw error;
   }
 }
-function resolvePath(projectDir, path) {
-  return isAbsolute(path) ? path : resolve3(projectDir, path);
+function resolvePath2(projectDir, path) {
+  return isAbsolute2(path) ? path : resolve3(projectDir, path);
 }
 function randomHex(bytes) {
   const value = crypto.getRandomValues(new Uint8Array(bytes));
@@ -14490,7 +14500,7 @@ async function findEphemeralPort(host = "127.0.0.1") {
 }
 // src/snapshot.ts
 import { chmod as chmod2, copyFile, lstat as lstat3, mkdir as mkdir5, mkdtemp, readdir as readdir3, readFile as readFile7, rename as rename2, rm as rm4, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname5, join as join8, parse as parse2, relative as relative2, resolve as resolve4, sep as sep2 } from "path";
+import { dirname as dirname5, join as join8, parse as parse2, relative as relative3, resolve as resolve4, sep as sep2 } from "path";
 import { create as createTar, extract as extractTar2 } from "tar";
 var SNAPSHOT_FORMAT = "supacloud-lite-snapshot";
 var SNAPSHOT_VERSION = 1;
@@ -14598,10 +14608,10 @@ async function restoreSnapshot(options) {
     await mkdir5(stateStage, { recursive: true });
     await copyEntry(join8(payloadRoot, "secrets.json"), join8(stateStage, "secrets.json"));
     if (paths.dataDir && isWithin(paths.stateDir, paths.dataDir)) {
-      await copyEntry(join8(payloadRoot, "database"), join8(stateStage, relative2(paths.stateDir, paths.dataDir)));
+      await copyEntry(join8(payloadRoot, "database"), join8(stateStage, relative3(paths.stateDir, paths.dataDir)));
     }
     if (options.storageBackend === "fs" && isWithin(paths.stateDir, paths.storageDir)) {
-      await copyEntry(join8(payloadRoot, "storage"), join8(stateStage, relative2(paths.stateDir, paths.storageDir)));
+      await copyEntry(join8(payloadRoot, "storage"), join8(stateStage, relative3(paths.stateDir, paths.storageDir)));
     }
     const swaps = [];
     try {

package/dist/runtime/node/fs-driver.d.ts

@@ -9,8 +9,8 @@ export declare class FsStorageDriver implements StorageDriver {
     /**
      * Resolve a storage key to an absolute path inside the root.
      *
-     * SECURITY: rejects keys that escape the root (e.g. `../`); the normalized
-     * path must stay under `root` + separator or the key is refused.
+     * SECURITY: rejects keys that escape the root (e.g. `../`) or resolve to
+     * the root itself.
      *
      * @throws if the key would resolve outside the root directory.
      */

package/dist/runtime/node/fs-driver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs-driver.d.ts","sourceRoot":"","sources":["../../../src/runtime/node/fs-driver.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEhD;;;GAGG;AACH,qBAAa,eAAgB,YAAW,aAAa;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,MAAM;IAEhC;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO;IAQf,iEAAiE;IAC3D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAavD,4DAA4D;IACtD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IASlD,iFAAiF;IAC3E,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAKhD,uDAAuD;IACjD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,0CAA0C;IACpC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}
+{"version":3,"file":"fs-driver.d.ts","sourceRoot":"","sources":["../../../src/runtime/node/fs-driver.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEhD;;;GAGG;AACH,qBAAa,eAAgB,YAAW,aAAa;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,MAAM;IAIhC;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO;IASf,iEAAiE;IAC3D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAavD,4DAA4D;IACtD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IASlD,iFAAiF;IAC3E,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAKhD,uDAAuD;IACjD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,0CAA0C;IACpC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}

package/dist/runtime/node/native/readiness.d.ts

@@ -10,6 +10,11 @@ export interface LiteDoctorReport {
     identity: {
         mode: 'local' | 'external';
         verification: 'built-in' | 'unverified';
+        local_auth: {
+            status: 'enabled' | 'disabled';
+            reason: 'LOCAL_AUTH_ENABLED' | 'AUTH_DISABLED' | 'EXTERNAL_IDENTITY_CONFIGURED';
+            verification: 'configuration-only';
+        };
     };
     migrations: {
         formats: string[];
@@ -78,6 +83,6 @@ export interface PowerSyncReadiness {
         invalidation_reason: string | null;
     }>;
 }
-export declare function liteCapabilities(engine: 'pglite' | 'native', replicationProfile?: 'powersync'): LiteDoctorReport;
+export declare function liteCapabilities(engine: 'pglite' | 'native', replicationProfile?: 'powersync', authEnabled?: boolean): LiteDoctorReport;
 export declare function inspectPowerSyncReadiness(engine: DbEngine, options: PowerSyncReplicationOptions): Promise<PowerSyncReadiness>;
 //# sourceMappingURL=readiness.d.ts.map

package/dist/runtime/node/native/readiness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../../../../src/runtime/node/native/readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,EAGL,KAAK,2BAA2B,EACjC,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAA4B,0BAA0B,EAAE,MAAM,iBAAiB,CAAA;AAE3F,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,CAAA;AAEtF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,iBAAiB,CAAA;IAC1B,YAAY,EAAE,WAAW,CAAA;IACzB,QAAQ,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,UAAU,CAAC;QAAC,YAAY,EAAE,UAAU,GAAG,YAAY,CAAA;KAAE,CAAA;IACjF,UAAU,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,WAAW,CAAC;QAAC,eAAe,EAAE,WAAW,CAAA;KAAE,CAAA;IAC3F,yBAAyB,EAAE,aAAa,CAAA;IACxC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC3B,iBAAiB,EAAE,WAAW,CAAA;IAC9B,iBAAiB,EAAE,WAAW,CAAA;IAC9B,QAAQ,EAAE,WAAW,CAAA;IACrB,SAAS,EAAE,WAAW,CAAA;IACtB,uBAAuB,EAAE,QAAQ,CAAA;IACjC,mBAAmB,EAAE,0BAA0B,GAAG;QAChD,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAC5B,CAAA;IACD,mBAAmB,EAAE,oBAAoB,CAAA;IACzC,gBAAgB,EAAE,oBAAoB,CAAA;IACtC,mBAAmB,CAAC,EAAE,WAAW,CAAA;IACjC,mBAAmB,CAAC,EAAE,kBAAkB,CAAA;CACzC;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;QACZ,GAAG,EAAE,OAAO,CAAA;QACZ,aAAa,EAAE,MAAM,EAAE,CAAA;KACxB,CAAA;IACD,GAAG,EAAE;QACH,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,EAAE,MAAM,CAAA;QACnB,cAAc,EAAE,MAAM,CAAA;QACtB,qBAAqB,EAAE,MAAM,CAAA;QAC7B,sBAAsB,EAAE,MAAM,CAAA;QAC9B,sBAAsB,EAAE,MAAM,CAAA;KAC/B,CAAA;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,OAAO,CAAA;QAChB,KAAK,EAAE,OAAO,CAAA;QACd,WAAW,EAAE,OAAO,CAAA;QACpB,UAAU,EAAE,OAAO,CAAA;QACnB,4BAA4B,EAAE,MAAM,EAAE,CAAA;KACvC,CAAA;IACD,WAAW,EAAE;QACX,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,OAAO,CAAA;QACnB,MAAM,EAAE,MAAM,EAAE,CAAA;QAChB,eAAe,EAAE,MAAM,EAAE,CAAA;QACzB,gBAAgB,EAAE,OAAO,CAAA;QACzB,gBAAgB,EAAE,OAAO,CAAA;QACzB,gBAAgB,EAAE,OAAO,CAAA;QACzB,+BAA+B,EAAE,MAAM,EAAE,CAAA;KAC1C,CAAA;IACD,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,OAAO,CAAA;QACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,kBAAkB,EAAE,MAAM,CAAA;QAC1B,qBAAqB,EAAE,MAAM,CAAA;QAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;QAC5B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;KACnC,CAAC,CAAA;CACH;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAC3B,kBAAkB,CAAC,EAAE,WAAW,GAC/B,gBAAgB,CA4ClB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAE7B"}
+{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../../../../src/runtime/node/native/readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,EAGL,KAAK,2BAA2B,EACjC,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAA4B,0BAA0B,EAAE,MAAM,iBAAiB,CAAA;AAE3F,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,CAAA;AAEtF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,iBAAiB,CAAA;IAC1B,YAAY,EAAE,WAAW,CAAA;IACzB,QAAQ,EAAE;QACR,IAAI,EAAE,OAAO,GAAG,UAAU,CAAA;QAC1B,YAAY,EAAE,UAAU,GAAG,YAAY,CAAA;QACvC,UAAU,EAAE;YACV,MAAM,EAAE,SAAS,GAAG,UAAU,CAAA;YAC9B,MAAM,EAAE,oBAAoB,GAAG,eAAe,GAAG,8BAA8B,CAAA;YAC/E,YAAY,EAAE,oBAAoB,CAAA;SACnC,CAAA;KACF,CAAA;IACD,UAAU,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,WAAW,CAAC;QAAC,eAAe,EAAE,WAAW,CAAA;KAAE,CAAA;IAC3F,yBAAyB,EAAE,aAAa,CAAA;IACxC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC3B,iBAAiB,EAAE,WAAW,CAAA;IAC9B,iBAAiB,EAAE,WAAW,CAAA;IAC9B,QAAQ,EAAE,WAAW,CAAA;IACrB,SAAS,EAAE,WAAW,CAAA;IACtB,uBAAuB,EAAE,QAAQ,CAAA;IACjC,mBAAmB,EAAE,0BAA0B,GAAG;QAChD,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAC5B,CAAA;IACD,mBAAmB,EAAE,oBAAoB,CAAA;IACzC,gBAAgB,EAAE,oBAAoB,CAAA;IACtC,mBAAmB,CAAC,EAAE,WAAW,CAAA;IACjC,mBAAmB,CAAC,EAAE,kBAAkB,CAAA;CACzC;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;QACZ,GAAG,EAAE,OAAO,CAAA;QACZ,aAAa,EAAE,MAAM,EAAE,CAAA;KACxB,CAAA;IACD,GAAG,EAAE;QACH,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,EAAE,MAAM,CAAA;QACnB,cAAc,EAAE,MAAM,CAAA;QACtB,qBAAqB,EAAE,MAAM,CAAA;QAC7B,sBAAsB,EAAE,MAAM,CAAA;QAC9B,sBAAsB,EAAE,MAAM,CAAA;KAC/B,CAAA;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,OAAO,CAAA;QAChB,KAAK,EAAE,OAAO,CAAA;QACd,WAAW,EAAE,OAAO,CAAA;QACpB,UAAU,EAAE,OAAO,CAAA;QACnB,4BAA4B,EAAE,MAAM,EAAE,CAAA;KACvC,CAAA;IACD,WAAW,EAAE;QACX,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,OAAO,CAAA;QACnB,MAAM,EAAE,MAAM,EAAE,CAAA;QAChB,eAAe,EAAE,MAAM,EAAE,CAAA;QACzB,gBAAgB,EAAE,OAAO,CAAA;QACzB,gBAAgB,EAAE,OAAO,CAAA;QACzB,gBAAgB,EAAE,OAAO,CAAA;QACzB,+BAA+B,EAAE,MAAM,EAAE,CAAA;KAC1C,CAAA;IACD,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,OAAO,CAAA;QACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,kBAAkB,EAAE,MAAM,CAAA;QAC1B,qBAAqB,EAAE,MAAM,CAAA;QAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;QAC5B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;KACnC,CAAC,CAAA;CACH;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAC3B,kBAAkB,CAAC,EAAE,WAAW,EAChC,WAAW,UAAO,GACjB,gBAAgB,CAoDlB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAE7B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/lite",
-  "version": "0.27.1",
+  "version": "0.28.0",
   "description": "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   "type": "module",
   "license": "Apache-2.0",