@supacloud/lite 0.28.1 → 0.28.2

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.28.2](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.28.1...supacloud-lite-v0.28.2) (2026-10-15)
+
+
+### Bug Fixes
+
+* **lite:** enforce RPC transaction access modes ([#1936](https://github.com/vibeunion/supacloud/issues/1936)) ([fb90dcc](https://github.com/vibeunion/supacloud/commit/fb90dcc43ed49a45656e1877493eaa641ef494da))
+
 ## [0.28.1](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.28.0...supacloud-lite-v0.28.1) (2026-10-15)
 
 

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.28.1",
+  version: "0.28.2",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -8368,6 +8368,8 @@ function statusForSqlState(code) {
   switch (code) {
     case "42501":
       return 403;
+    case "25006":
+      return 405;
     case "23503":
     case "23505":
       return 409;
@@ -8719,17 +8721,22 @@ class RestHandler {
     return await this.runRpc(ctx, fn, call, q, prefer, wantsObject, wantsCsv, schema, method);
   }
   async runRpc(ctx, fn, call, q, prefer, wantsObject, wantsCsv, schema, method) {
+    const withRpcContext = (run) => this.db.withContext(ctx, async (query) => {
+      if (method !== "POST" || fn.volatility !== "v")
+        await query("set transaction read only");
+      return run(query);
+    });
     if (fn.returnType === "void" && !fn.returnsSet) {
-      await this.db.withContext(ctx, (query) => query(`select ${call}`, []));
+      await withRpcContext((query) => query(`select ${call}`, []));
       return new Response(null, { status: 204 });
     }
     if (!fn.returnsSet && ["b", "d", "e"].includes(fn.returnTypType)) {
-      const res = await this.db.withContext(ctx, (query) => query(`select to_json(${call}) as result`, []));
+      const res = await withRpcContext((query) => query(`select to_json(${call}) as result`, []));
       const value = res.rows[0].result;
       return jsonResponse(200, value);
     }
     if (fn.returnsSet && ["b", "d", "e"].includes(fn.returnTypType)) {
-      const res = await this.db.withContext(ctx, (query) => query(`select coalesce(json_agg(_v), '[]'::json) as body from ${call} as _t(_v)`, []));
+      const res = await withRpcContext((query) => query(`select coalesce(json_agg(_v), '[]'::json) as body from ${call} as _t(_v)`, []));
       return jsonResponse(200, res.rows[0].body);
     }
     const alias = "_f";
@@ -8757,7 +8764,7 @@ class RestHandler {
     const core = `select ${exprs.join(", ")} from ${resultSource} as ${quoteIdent(alias)}${where}${order}${limitOffset}`;
     const bodySql = `select coalesce(json_agg(row_to_json(_r)), '[]'::json) as body from (${core}) _r`;
     const sql = wantsCount ? `with ${quoteIdent("_rpc_result")} as (select * from ${call}) select (${bodySql}) as body, (select count(*)::int from ${resultSource} as ${quoteIdent(alias)}${where}) as count` : bodySql;
-    const { rows, count } = await this.db.withContext(ctx, async (query) => {
+    const { rows, count } = await withRpcContext(async (query) => {
       const res = await query(sql, []);
       const rows = res.rows[0].body;
       if (wantsObject && !wantsCsv)

package/dist/index.js

@@ -88,7 +88,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.28.1",
+  version: "0.28.2",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -8362,6 +8362,8 @@ function statusForSqlState(code) {
   switch (code) {
     case "42501":
       return 403;
+    case "25006":
+      return 405;
     case "23503":
     case "23505":
       return 409;
@@ -8713,17 +8715,22 @@ class RestHandler {
     return await this.runRpc(ctx, fn, call, q, prefer, wantsObject, wantsCsv, schema, method);
   }
   async runRpc(ctx, fn, call, q, prefer, wantsObject, wantsCsv, schema, method) {
+    const withRpcContext = (run) => this.db.withContext(ctx, async (query) => {
+      if (method !== "POST" || fn.volatility !== "v")
+        await query("set transaction read only");
+      return run(query);
+    });
     if (fn.returnType === "void" && !fn.returnsSet) {
-      await this.db.withContext(ctx, (query) => query(`select ${call}`, []));
+      await withRpcContext((query) => query(`select ${call}`, []));
       return new Response(null, { status: 204 });
     }
     if (!fn.returnsSet && ["b", "d", "e"].includes(fn.returnTypType)) {
-      const res = await this.db.withContext(ctx, (query) => query(`select to_json(${call}) as result`, []));
+      const res = await withRpcContext((query) => query(`select to_json(${call}) as result`, []));
       const value = res.rows[0].result;
       return jsonResponse(200, value);
     }
     if (fn.returnsSet && ["b", "d", "e"].includes(fn.returnTypType)) {
-      const res = await this.db.withContext(ctx, (query) => query(`select coalesce(json_agg(_v), '[]'::json) as body from ${call} as _t(_v)`, []));
+      const res = await withRpcContext((query) => query(`select coalesce(json_agg(_v), '[]'::json) as body from ${call} as _t(_v)`, []));
       return jsonResponse(200, res.rows[0].body);
     }
     const alias = "_f";
@@ -8751,7 +8758,7 @@ class RestHandler {
     const core = `select ${exprs.join(", ")} from ${resultSource} as ${quoteIdent(alias)}${where}${order}${limitOffset}`;
     const bodySql = `select coalesce(json_agg(row_to_json(_r)), '[]'::json) as body from (${core}) _r`;
     const sql = wantsCount ? `with ${quoteIdent("_rpc_result")} as (select * from ${call}) select (${bodySql}) as body, (select count(*)::int from ${resultSource} as ${quoteIdent(alias)}${where}) as count` : bodySql;
-    const { rows, count } = await this.db.withContext(ctx, async (query) => {
+    const { rows, count } = await withRpcContext(async (query) => {
       const res = await query(sql, []);
       const rows = res.rows[0].body;
       if (wantsObject && !wantsCsv)

package/dist/runtime/rest/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/errors.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBtD;AAUD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAkBpD;AAED,sDAAsD;AACtD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,QAAQ,CAKV"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/errors.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBtD;AAUD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAkBpD;AAED,sDAAsD;AACtD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,QAAQ,CAKV"}

package/dist/runtime/rest/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAA4B,KAAK,QAAQ,EAAqB,MAAM,mBAAmB,CAAA;AAC9F,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AAyF3D,oFAAoF;AACpF,qBAAa,WAAW;IAOpB,OAAO,CAAC,EAAE;IANZ,8FAA8F;IAC9F,OAAO,CAAC,cAAc,CAAU;IAChC,8EAA8E;IAC9E,OAAO,CAAC,OAAO,CAAC,CAAQ;gBAGd,EAAE,EAAE,QAAQ,EACpB,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;IAMxD,4FAA4F;IACtF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YAmC9D,WAAW;YAsHX,WAAW;IAgDzB,OAAO,CAAC,YAAY;YAqCN,SAAS;YAqET,MAAM;CAqFrB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAA4B,KAAK,QAAQ,EAAmC,MAAM,mBAAmB,CAAA;AAC5G,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AAyF3D,oFAAoF;AACpF,qBAAa,WAAW;IAOpB,OAAO,CAAC,EAAE;IANZ,8FAA8F;IAC9F,OAAO,CAAC,cAAc,CAAU;IAChC,8EAA8E;IAC9E,OAAO,CAAC,OAAO,CAAC,CAAQ;gBAGd,EAAE,EAAE,QAAQ,EACpB,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;IAMxD,4FAA4F;IACtF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YAmC9D,WAAW;YAsHX,WAAW;IAgDzB,OAAO,CAAC,YAAY;YAqCN,SAAS;YAqET,MAAM;CA4FrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/lite",
-  "version": "0.28.1",
+  "version": "0.28.2",
   "description": "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   "type": "module",
   "license": "Apache-2.0",