@supacloud/lite 0.28.0 → 0.28.2

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.28.2](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.28.1...supacloud-lite-v0.28.2) (2026-10-15)
+
+
+### Bug Fixes
+
+* **lite:** enforce RPC transaction access modes ([#1936](https://github.com/vibeunion/supacloud/issues/1936)) ([fb90dcc](https://github.com/vibeunion/supacloud/commit/fb90dcc43ed49a45656e1877493eaa641ef494da))
+
+## [0.28.1](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.28.0...supacloud-lite-v0.28.1) (2026-10-15)
+
+
+### Bug Fixes
+
+* **lite:** roll back rejected singular REST writes ([#1925](https://github.com/vibeunion/supacloud/issues/1925)) ([0af235d](https://github.com/vibeunion/supacloud/commit/0af235d55a3619ffd150e4b16751a27a32d1f2e0))
+
 ## [0.28.0](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.27.1...supacloud-lite-v0.28.0) (2026-10-14)
 
 

package/RELEASING.md

@@ -30,6 +30,15 @@ bun run build:standalone:host
 bun run test:standalone
 ```
 
+针对本地 Auth 的聚焦回归，只构建 host 产物并运行单个脚本的 Auth 入口：
+
+```bash
+bun run build:standalone:host
+bun run scripts/standalone-smoke.ts --auth-only
+```
+
+该入口在不含 Bun/Node/npm 的子进程 `PATH` 下启动二进制，通过真实 HTTP 和 `supabase-js` 验证注册、密码登录、刷新轮换、退出撤销，以及进程重启后的会话恢复、刷新与撤销保留。成功标记为 `standalone-auth-smoke-ok`。可用 `SUPACLOUD_LITE_STANDALONE_BINARY` 指定待验收产物。它不执行 Functions、扩展、升级、快照或恢复，不能替代完整发布验收；默认完整 smoke 也会在升级和快照恢复阶段验证同一 Auth 状态。
+
 Release workflow 为 Linux x64 baseline/arm64、macOS x64/arm64 和 Windows x64 baseline 构建独立产物。Linux x64 产物必须在发布 runner 上完成真实黑盒测试；其他交叉编译产物在具备对应原生 runner 前只视为已构建，不能替代平台验收。
 
 Lite release 会同时上传 `SHA256SUMS`、项目自身的 `SUPACLOUD-LITE-APACHE-2.0.txt`、`NOTICE`、`THIRD_PARTY_NOTICES.md` 和 `LICENSES/*.txt`，并为发布资产生成 provenance。正式对外分发 macOS 或 Windows 产物前，还应按项目发布策略完成代码签名；构建成功不代表已经签名或公证。

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.28.0",
+  version: "0.28.2",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -8368,6 +8368,8 @@ function statusForSqlState(code) {
   switch (code) {
     case "42501":
       return 403;
+    case "25006":
+      return 405;
     case "23503":
     case "23505":
       return 409;
@@ -8620,7 +8622,10 @@ class RestHandler {
     const { rows, affected } = await this.db.withContext(ctx, async (query) => {
       const res = await query(built.sql, built.params);
       if (opts.queryReturning) {
-        return { rows: res.rows[0].body, affected: null };
+        const rows = res.rows[0].body;
+        if (opts.wantsObject && !opts.wantsCsv)
+          assertObjectCardinality(rows);
+        return { rows, affected: null };
       }
       return { rows: null, affected: res.affectedRows ?? 0 };
     });
@@ -8652,14 +8657,7 @@ class RestHandler {
       return new Response(opts.head ? null : rowsToCsv(rows), { status: opts.status, headers });
     }
     if (opts.wantsObject) {
-      if (rows.length !== 1) {
-        return jsonResponse(406, {
-          code: "PGRST116",
-          message: "JSON object requested, multiple (or no) rows returned",
-          details: `The result contains ${rows.length} rows`,
-          hint: null
-        });
-      }
+      assertObjectCardinality(rows);
       headers["content-type"] = `${OBJECT_MEDIA}; charset=utf-8`;
       return new Response(opts.head ? null : JSON.stringify(rows[0]), {
         status: opts.status,
@@ -8723,17 +8721,22 @@ class RestHandler {
     return await this.runRpc(ctx, fn, call, q, prefer, wantsObject, wantsCsv, schema, method);
   }
   async runRpc(ctx, fn, call, q, prefer, wantsObject, wantsCsv, schema, method) {
+    const withRpcContext = (run) => this.db.withContext(ctx, async (query) => {
+      if (method !== "POST" || fn.volatility !== "v")
+        await query("set transaction read only");
+      return run(query);
+    });
     if (fn.returnType === "void" && !fn.returnsSet) {
-      await this.db.withContext(ctx, (query) => query(`select ${call}`, []));
+      await withRpcContext((query) => query(`select ${call}`, []));
       return new Response(null, { status: 204 });
     }
     if (!fn.returnsSet && ["b", "d", "e"].includes(fn.returnTypType)) {
-      const res = await this.db.withContext(ctx, (query) => query(`select to_json(${call}) as result`, []));
+      const res = await withRpcContext((query) => query(`select to_json(${call}) as result`, []));
       const value = res.rows[0].result;
       return jsonResponse(200, value);
     }
     if (fn.returnsSet && ["b", "d", "e"].includes(fn.returnTypType)) {
-      const res = await this.db.withContext(ctx, (query) => query(`select coalesce(json_agg(_v), '[]'::json) as body from ${call} as _t(_v)`, []));
+      const res = await withRpcContext((query) => query(`select coalesce(json_agg(_v), '[]'::json) as body from ${call} as _t(_v)`, []));
       return jsonResponse(200, res.rows[0].body);
     }
     const alias = "_f";
@@ -8756,17 +8759,18 @@ class RestHandler {
     const where = conds.length > 0 ? ` where ${conds.join(" and ")}` : "";
     const order = builder.renderOrder([], alias);
     const limitOffset = builder.renderLimitOffset("");
-    const core = `select ${exprs.join(", ")} from ${call} as ${quoteIdent(alias)}${where}${order}${limitOffset}`;
-    const sql = `select coalesce(json_agg(row_to_json(_r)), '[]'::json) as body from (${core}) _r`;
-    const countSql = prefer.count !== undefined ? `select count(*)::int as count from ${call} as ${quoteIdent(alias)}${where}` : undefined;
-    const { rows, count } = await this.db.withContext(ctx, async (query) => {
+    const wantsCount = prefer.count !== undefined;
+    const resultSource = wantsCount ? quoteIdent("_rpc_result") : call;
+    const core = `select ${exprs.join(", ")} from ${resultSource} as ${quoteIdent(alias)}${where}${order}${limitOffset}`;
+    const bodySql = `select coalesce(json_agg(row_to_json(_r)), '[]'::json) as body from (${core}) _r`;
+    const sql = wantsCount ? `with ${quoteIdent("_rpc_result")} as (select * from ${call}) select (${bodySql}) as body, (select count(*)::int from ${resultSource} as ${quoteIdent(alias)}${where}) as count` : bodySql;
+    const { rows, count } = await withRpcContext(async (query) => {
       const res = await query(sql, []);
-      let count = null;
-      if (countSql) {
-        const c = await query(countSql, []);
-        count = c.rows[0].count;
-      }
-      return { rows: res.rows[0].body, count };
+      const rows = res.rows[0].body;
+      if (wantsObject && !wantsCsv)
+        assertObjectCardinality(rows);
+      const count = wantsCount ? res.rows[0].count : null;
+      return { rows, count };
     });
     return this.dataResponse(rows, {
       status: 200,
@@ -8778,6 +8782,16 @@ class RestHandler {
     });
   }
 }
+function assertObjectCardinality(rows) {
+  if (rows.length !== 1) {
+    throw new ApiError(406, {
+      code: "PGRST116",
+      message: "JSON object requested, multiple (or no) rows returned",
+      details: `The result contains ${rows.length} rows`,
+      hint: null
+    });
+  }
+}
 function pickOverload(fns, providedNames) {
   const provided = new Set(providedNames);
   let best = null;

package/dist/index.js

@@ -88,7 +88,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.28.0",
+  version: "0.28.2",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -8362,6 +8362,8 @@ function statusForSqlState(code) {
   switch (code) {
     case "42501":
       return 403;
+    case "25006":
+      return 405;
     case "23503":
     case "23505":
       return 409;
@@ -8614,7 +8616,10 @@ class RestHandler {
     const { rows, affected } = await this.db.withContext(ctx, async (query) => {
       const res = await query(built.sql, built.params);
       if (opts.queryReturning) {
-        return { rows: res.rows[0].body, affected: null };
+        const rows = res.rows[0].body;
+        if (opts.wantsObject && !opts.wantsCsv)
+          assertObjectCardinality(rows);
+        return { rows, affected: null };
       }
       return { rows: null, affected: res.affectedRows ?? 0 };
     });
@@ -8646,14 +8651,7 @@ class RestHandler {
       return new Response(opts.head ? null : rowsToCsv(rows), { status: opts.status, headers });
     }
     if (opts.wantsObject) {
-      if (rows.length !== 1) {
-        return jsonResponse(406, {
-          code: "PGRST116",
-          message: "JSON object requested, multiple (or no) rows returned",
-          details: `The result contains ${rows.length} rows`,
-          hint: null
-        });
-      }
+      assertObjectCardinality(rows);
       headers["content-type"] = `${OBJECT_MEDIA}; charset=utf-8`;
       return new Response(opts.head ? null : JSON.stringify(rows[0]), {
         status: opts.status,
@@ -8717,17 +8715,22 @@ class RestHandler {
     return await this.runRpc(ctx, fn, call, q, prefer, wantsObject, wantsCsv, schema, method);
   }
   async runRpc(ctx, fn, call, q, prefer, wantsObject, wantsCsv, schema, method) {
+    const withRpcContext = (run) => this.db.withContext(ctx, async (query) => {
+      if (method !== "POST" || fn.volatility !== "v")
+        await query("set transaction read only");
+      return run(query);
+    });
     if (fn.returnType === "void" && !fn.returnsSet) {
-      await this.db.withContext(ctx, (query) => query(`select ${call}`, []));
+      await withRpcContext((query) => query(`select ${call}`, []));
       return new Response(null, { status: 204 });
     }
     if (!fn.returnsSet && ["b", "d", "e"].includes(fn.returnTypType)) {
-      const res = await this.db.withContext(ctx, (query) => query(`select to_json(${call}) as result`, []));
+      const res = await withRpcContext((query) => query(`select to_json(${call}) as result`, []));
       const value = res.rows[0].result;
       return jsonResponse(200, value);
     }
     if (fn.returnsSet && ["b", "d", "e"].includes(fn.returnTypType)) {
-      const res = await this.db.withContext(ctx, (query) => query(`select coalesce(json_agg(_v), '[]'::json) as body from ${call} as _t(_v)`, []));
+      const res = await withRpcContext((query) => query(`select coalesce(json_agg(_v), '[]'::json) as body from ${call} as _t(_v)`, []));
       return jsonResponse(200, res.rows[0].body);
     }
     const alias = "_f";
@@ -8750,17 +8753,18 @@ class RestHandler {
     const where = conds.length > 0 ? ` where ${conds.join(" and ")}` : "";
     const order = builder.renderOrder([], alias);
     const limitOffset = builder.renderLimitOffset("");
-    const core = `select ${exprs.join(", ")} from ${call} as ${quoteIdent(alias)}${where}${order}${limitOffset}`;
-    const sql = `select coalesce(json_agg(row_to_json(_r)), '[]'::json) as body from (${core}) _r`;
-    const countSql = prefer.count !== undefined ? `select count(*)::int as count from ${call} as ${quoteIdent(alias)}${where}` : undefined;
-    const { rows, count } = await this.db.withContext(ctx, async (query) => {
+    const wantsCount = prefer.count !== undefined;
+    const resultSource = wantsCount ? quoteIdent("_rpc_result") : call;
+    const core = `select ${exprs.join(", ")} from ${resultSource} as ${quoteIdent(alias)}${where}${order}${limitOffset}`;
+    const bodySql = `select coalesce(json_agg(row_to_json(_r)), '[]'::json) as body from (${core}) _r`;
+    const sql = wantsCount ? `with ${quoteIdent("_rpc_result")} as (select * from ${call}) select (${bodySql}) as body, (select count(*)::int from ${resultSource} as ${quoteIdent(alias)}${where}) as count` : bodySql;
+    const { rows, count } = await withRpcContext(async (query) => {
       const res = await query(sql, []);
-      let count = null;
-      if (countSql) {
-        const c = await query(countSql, []);
-        count = c.rows[0].count;
-      }
-      return { rows: res.rows[0].body, count };
+      const rows = res.rows[0].body;
+      if (wantsObject && !wantsCsv)
+        assertObjectCardinality(rows);
+      const count = wantsCount ? res.rows[0].count : null;
+      return { rows, count };
     });
     return this.dataResponse(rows, {
       status: 200,
@@ -8772,6 +8776,16 @@ class RestHandler {
     });
   }
 }
+function assertObjectCardinality(rows) {
+  if (rows.length !== 1) {
+    throw new ApiError(406, {
+      code: "PGRST116",
+      message: "JSON object requested, multiple (or no) rows returned",
+      details: `The result contains ${rows.length} rows`,
+      hint: null
+    });
+  }
+}
 function pickOverload(fns, providedNames) {
   const provided = new Set(providedNames);
   let best = null;

package/dist/runtime/rest/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/errors.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBtD;AAUD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAkBpD;AAED,sDAAsD;AACtD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,QAAQ,CAKV"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/errors.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBtD;AAUD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAkBpD;AAED,sDAAsD;AACtD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,QAAQ,CAKV"}

package/dist/runtime/rest/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAA4B,KAAK,QAAQ,EAAqB,MAAM,mBAAmB,CAAA;AAC9F,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AAyF3D,oFAAoF;AACpF,qBAAa,WAAW;IAOpB,OAAO,CAAC,EAAE;IANZ,8FAA8F;IAC9F,OAAO,CAAC,cAAc,CAAU;IAChC,8EAA8E;IAC9E,OAAO,CAAC,OAAO,CAAC,CAAQ;gBAGd,EAAE,EAAE,QAAQ,EACpB,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;IAMxD,4FAA4F;IACtF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YAmC9D,WAAW;YAsHX,WAAW;IA6CzB,OAAO,CAAC,YAAY;YA4CN,SAAS;YAqET,MAAM;CAmFrB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAA4B,KAAK,QAAQ,EAAmC,MAAM,mBAAmB,CAAA;AAC5G,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AAyF3D,oFAAoF;AACpF,qBAAa,WAAW;IAOpB,OAAO,CAAC,EAAE;IANZ,8FAA8F;IAC9F,OAAO,CAAC,cAAc,CAAU;IAChC,8EAA8E;IAC9E,OAAO,CAAC,OAAO,CAAC,CAAQ;gBAGd,EAAE,EAAE,QAAQ,EACpB,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;IAMxD,4FAA4F;IACtF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YAmC9D,WAAW;YAsHX,WAAW;IAgDzB,OAAO,CAAC,YAAY;YAqCN,SAAS;YAqET,MAAM;CA4FrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/lite",
-  "version": "0.28.0",
+  "version": "0.28.2",
   "description": "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   "type": "module",
   "license": "Apache-2.0",