@supacloud/lite 0.28.1 → 0.28.3

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.28.3](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.28.2...supacloud-lite-v0.28.3) (2026-10-15)
+
+
+### Miscellaneous Chores
+
+* upgrade workspace dependencies ([#1940](https://github.com/vibeunion/supacloud/issues/1940)) ([77ad418](https://github.com/vibeunion/supacloud/commit/77ad418e0568ceeeea0b59a10a3bbc451a68a95f))
+
+## [0.28.2](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.28.1...supacloud-lite-v0.28.2) (2026-10-15)
+
+
+### Bug Fixes
+
+* **lite:** enforce RPC transaction access modes ([#1936](https://github.com/vibeunion/supacloud/issues/1936)) ([fb90dcc](https://github.com/vibeunion/supacloud/commit/fb90dcc43ed49a45656e1877493eaa641ef494da))
+
 ## [0.28.1](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.28.0...supacloud-lite-v0.28.1) (2026-10-15)
 
 

package/README.md

@@ -13,7 +13,7 @@ V1 的目标不是复刻完整 Supabase 平台控制面，而是让现有应用
 ### 状态
 
 - 运行时：npm 包需要 Bun 1.4.3+；单二进制发行版已内嵌 Bun 和 PGlite 资源
-- 数据库：PGlite 0.5.8，或 native PostgreSQL
+- 数据库：PGlite 0.5.10，或 native PostgreSQL
 - 项目模型：单进程、单项目，内部 project ref 固定为 `local`
 - 客户端：直接使用官方 `@supabase/supabase-js`
 - 数据目录：`.supacloud-lite/db`
@@ -530,7 +530,7 @@ The goal of V1 is not to replicate the full Supabase platform control plane, but
 ### Status
 
 - Runtime: the npm package requires Bun 1.4.3+; the single-binary release embeds Bun and PGlite assets
-- Database: PGlite 0.5.8, or native PostgreSQL
+- Database: PGlite 0.5.10, or native PostgreSQL
 - Project model: single process, single project, with an internal project ref fixed as `local`
 - Client: uses the official `@supabase/supabase-js` directly
 - Data directory: `.supacloud-lite/db`

package/THIRD_PARTY_NOTICES.md

@@ -20,10 +20,10 @@ SupaCloud Lite 使用 ElectricSQL PGlite 作为嵌入式 PostgreSQL 引擎。
 
 Lite also bundles the official PGlite extension packages:
 
-- `@electric-sql/pglite-pgvector` 0.0.9
-- `@electric-sql/pglite-postgis` 0.2.8
-- `@electric-sql/pglite-pg_textsearch` 0.0.10
-- `@electric-sql/pglite-pgmq` 0.0.6
+- `@electric-sql/pglite-pgvector` 0.0.11
+- `@electric-sql/pglite-postgis` 0.2.10
+- `@electric-sql/pglite-pg_textsearch` 0.0.12
+- `@electric-sql/pglite-pgmq` 0.0.8
 
 These packages are published by ElectricSQL under Apache-2.0 and their
 extension archives are embedded in the standalone binary.

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.28.1",
+  version: "0.28.3",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -62,36 +62,37 @@ var package_default = {
     typecheck: "bun x tsc --noEmit -p tsconfig.json"
   },
   dependencies: {
-    "@electric-sql/pglite": "0.5.8",
-    "@electric-sql/pglite-pg_textsearch": "0.0.10",
-    "@electric-sql/pglite-pgmq": "0.0.6",
-    "@electric-sql/pglite-pgvector": "0.0.9",
-    "@electric-sql/pglite-postgis": "0.2.8",
-    "@supacloud/db": "^0.6.0",
+    "@electric-sql/pglite": "0.5.10",
+    "@electric-sql/pglite-pg_textsearch": "0.0.12",
+    "@electric-sql/pglite-pgmq": "0.0.8",
+    "@electric-sql/pglite-pgvector": "0.0.11",
+    "@electric-sql/pglite-postgis": "0.2.10",
+    "@supacloud/db": "^0.17.0",
     "exact-mirror": "1.2.6",
     tar: "^7.5.22",
-    typebox: "1.3.36"
+    typebox: "1.3.37"
   },
   devDependencies: {
     "@supacloud/app": "file:../app",
+    "@supacloud/contracts": "file:../contracts",
     "@supacloud/compiler": "file:../compiler",
     "@supacloud/elysia": "file:../elysia",
     "@supabase/supabase-js": "^2.117.3",
     "@types/bun": "^1.4.3",
-    effect: "4.0.2",
-    elysia: "2.0.0-beta.21",
+    effect: "4.0.5",
+    elysia: "2.0.0-beta.32",
     jose: "^6.2.12",
     typescript: "^7.0.2"
   },
   overrides: {
-    "@supacloud/db": "^0.6.0",
+    "@supacloud/db": "^0.17.0",
     "@supacloud/app": "file:../app",
     "@supacloud/compiler": "file:../compiler",
     "@supacloud/elysia": "file:../elysia",
     "@supacloud/contracts": "file:../contracts",
     "@supacloud/commands": "file:../commands",
     "@supacloud/delivery": "file:../delivery",
-    "@graphql-tools/utils": "^12.0.3"
+    "@graphql-tools/utils": "^12.0.4"
   },
   engines: {
     bun: ">=1.4.3"
@@ -8368,6 +8369,8 @@ function statusForSqlState(code) {
   switch (code) {
     case "42501":
       return 403;
+    case "25006":
+      return 405;
     case "23503":
     case "23505":
       return 409;
@@ -8719,17 +8722,22 @@ class RestHandler {
     return await this.runRpc(ctx, fn, call, q, prefer, wantsObject, wantsCsv, schema, method);
   }
   async runRpc(ctx, fn, call, q, prefer, wantsObject, wantsCsv, schema, method) {
+    const withRpcContext = (run) => this.db.withContext(ctx, async (query) => {
+      if (method !== "POST" || fn.volatility !== "v")
+        await query("set transaction read only");
+      return run(query);
+    });
     if (fn.returnType === "void" && !fn.returnsSet) {
-      await this.db.withContext(ctx, (query) => query(`select ${call}`, []));
+      await withRpcContext((query) => query(`select ${call}`, []));
       return new Response(null, { status: 204 });
     }
     if (!fn.returnsSet && ["b", "d", "e"].includes(fn.returnTypType)) {
-      const res = await this.db.withContext(ctx, (query) => query(`select to_json(${call}) as result`, []));
+      const res = await withRpcContext((query) => query(`select to_json(${call}) as result`, []));
       const value = res.rows[0].result;
       return jsonResponse(200, value);
     }
     if (fn.returnsSet && ["b", "d", "e"].includes(fn.returnTypType)) {
-      const res = await this.db.withContext(ctx, (query) => query(`select coalesce(json_agg(_v), '[]'::json) as body from ${call} as _t(_v)`, []));
+      const res = await withRpcContext((query) => query(`select coalesce(json_agg(_v), '[]'::json) as body from ${call} as _t(_v)`, []));
       return jsonResponse(200, res.rows[0].body);
     }
     const alias = "_f";
@@ -8757,7 +8765,7 @@ class RestHandler {
     const core = `select ${exprs.join(", ")} from ${resultSource} as ${quoteIdent(alias)}${where}${order}${limitOffset}`;
     const bodySql = `select coalesce(json_agg(row_to_json(_r)), '[]'::json) as body from (${core}) _r`;
     const sql = wantsCount ? `with ${quoteIdent("_rpc_result")} as (select * from ${call}) select (${bodySql}) as body, (select count(*)::int from ${resultSource} as ${quoteIdent(alias)}${where}) as count` : bodySql;
-    const { rows, count } = await this.db.withContext(ctx, async (query) => {
+    const { rows, count } = await withRpcContext(async (query) => {
       const res = await query(sql, []);
       const rows = res.rows[0].body;
       if (wantsObject && !wantsCsv)
@@ -13208,6 +13216,7 @@ ORDER BY n.nspname, c.relname, p.polname
 var FUNCTIONS_SQL = `
 SELECT n.nspname AS schema,
        p.proname AS name,
+       pg_catalog.oidvectortypes(p.proargtypes) AS identity_arguments,
        p.prosecdef AS security_definer,
        p.proconfig AS config,
        l.lanname AS language
@@ -13281,12 +13290,13 @@ async function readCatalog(executor, schemas = ["public"]) {
       name: row.name,
       command: POLCMD_MAP[row.command] ?? "all",
       roles: row.roles ?? [],
-      usingExpr: row.using_expr ?? undefined,
-      checkExpr: row.check_expr ?? undefined
+      ...row.using_expr == null ? {} : { usingExpr: row.using_expr },
+      ...row.check_expr == null ? {} : { checkExpr: row.check_expr }
     })),
     functions: functionRows.map((row) => ({
       schema: row.schema,
       name: row.name,
+      identityArguments: row.identity_arguments,
       security: row.security_definer ? "definer" : "invoker",
       searchPath: extractSearchPath(row.config),
       language: row.language
@@ -13314,8 +13324,10 @@ function splitQualifiedName(name) {
 function isFixedSearchPath(searchPath) {
   if (searchPath === null)
     return false;
+  if (searchPath.trim() === "" || searchPath.trim() === '""')
+    return true;
   const parts = searchPath.split(",").map((part) => part.trim().replace(/^"|"$/g, ""));
-  return parts.every((part) => part !== "" && part.toLowerCase() !== "pg_temp");
+  return parts.every((part) => part !== "" && part.toLowerCase() !== "pg_temp" && part.toLowerCase() !== "$user");
 }
 function reconcileModule(module, catalog) {
   const issues = [];
@@ -13323,9 +13335,22 @@ function reconcileModule(module, catalog) {
   const push = (severity, code, object, message) => issues.push({ severity, code, object, message });
   for (const policy of module.policies) {
     const [schema, table] = splitQualifiedName(policy.table);
-    const found = catalog.policies.some((cp) => cp.schema === schema && cp.table === table && cp.name === policy.name);
+    const found = catalog.policies.find((cp) => cp.schema === schema && cp.table === table && cp.name === policy.name);
     if (!found) {
       push("error", "missing-policy", `${policy.table}.${policy.name}`, `\u58F0\u660E\u7684\u7B56\u7565 ${policy.name} \u5728\u8868 ${policy.table} \u7684 catalog \u4E2D\u4E0D\u5B58\u5728`);
+    } else {
+      if (found.command !== policy.operation) {
+        push("error", "policy-command-mismatch", `${policy.table}.${policy.name}`, `\u7B56\u7565 ${policy.name} \u58F0\u660E\u4E3A ${policy.operation}\uFF0Ccatalog \u5B9E\u9645\u4E3A ${found.command}`);
+      }
+      if (!sameRoles(policy.roles, found.roles)) {
+        push("error", "policy-roles-mismatch", `${policy.table}.${policy.name}`, `\u7B56\u7565 ${policy.name} \u58F0\u660E\u89D2\u8272\u4E0E catalog \u4E0D\u4E00\u81F4`);
+      }
+      if (policy.usingExpr !== undefined && policy.usingExpr !== (found.usingExpr ?? null)) {
+        push("error", "policy-using-mismatch", `${policy.table}.${policy.name}`, `\u7B56\u7565 ${policy.name} \u7684 USING \u8868\u8FBE\u5F0F\u4E0E catalog \u4E0D\u4E00\u81F4`);
+      }
+      if (policy.checkExpr !== undefined && policy.checkExpr !== (found.checkExpr ?? null)) {
+        push("error", "policy-check-mismatch", `${policy.table}.${policy.name}`, `\u7B56\u7565 ${policy.name} \u7684 WITH CHECK \u8868\u8FBE\u5F0F\u4E0E catalog \u4E0D\u4E00\u81F4`);
+      }
     }
   }
   const declaredPolicyKeys = new Set(module.policies.map((p) => `${p.table}::${p.name}`));
@@ -13337,11 +13362,16 @@ function reconcileModule(module, catalog) {
   }
   for (const fn of module.functions) {
     const [schema, name] = splitQualifiedName(fn.name);
-    const cf = catalog.functions.find((f) => f.schema === schema && f.name === name);
-    if (!cf) {
+    const candidates = catalog.functions.filter((f) => f.schema === schema && f.name === name);
+    if (candidates.length === 0) {
       push("error", "missing-function", fn.name, `\u58F0\u660E\u7684\u51FD\u6570 ${fn.name} \u5728 catalog \u4E2D\u4E0D\u5B58\u5728`);
       continue;
     }
+    const cf = fn.signature !== undefined ? candidates.find((candidate) => functionSignature(candidate) === fn.signature) : candidates.length === 1 ? candidates[0] : undefined;
+    if (!cf) {
+      push("error", fn.signature !== undefined ? "missing-function" : "ambiguous-function-overload", fn.name, fn.signature !== undefined ? `\u58F0\u660E\u7684\u51FD\u6570\u7B7E\u540D ${fn.signature} \u5728 catalog \u4E2D\u4E0D\u5B58\u5728\u6216\u7F3A\u5C11\u7B7E\u540D\u5143\u6570\u636E` : `\u51FD\u6570 ${fn.name} \u5B58\u5728\u591A\u4E2A\u91CD\u8F7D\uFF0C\u58F0\u660E\u5FC5\u987B\u5305\u542B\u5B8C\u6574 signature`);
+      continue;
+    }
     if (cf.security !== fn.security) {
       push("warn", "security-mismatch", fn.name, `\u51FD\u6570 ${fn.name} \u58F0\u660E\u4E3A security ${fn.security}\uFF0Ccatalog \u5B9E\u9645\u4E3A ${cf.security}`);
     }
@@ -13352,9 +13382,11 @@ function reconcileModule(module, catalog) {
   }
   for (const trigger of module.triggers) {
     const [schema, table] = splitQualifiedName(trigger.table);
-    const found = catalog.triggers.some((ct) => ct.schema === schema && ct.table === table && ct.name === trigger.name);
+    const found = catalog.triggers.find((ct) => ct.schema === schema && ct.table === table && ct.name === trigger.name);
     if (!found) {
       push("error", "missing-trigger", `${trigger.table}.${trigger.name}`, `\u58F0\u660E\u7684\u89E6\u53D1\u5668 ${trigger.name} \u5728\u8868 ${trigger.table} \u7684 catalog \u4E2D\u4E0D\u5B58\u5728`);
+    } else if (found.enabled !== (trigger.enabled ?? true)) {
+      push("error", found.enabled ? "trigger-enabled-mismatch" : "disabled-trigger", `${trigger.table}.${trigger.name}`, `\u58F0\u660E\u7684\u89E6\u53D1\u5668 ${trigger.name} \u7684\u542F\u7528\u72B6\u6001\u4E0E catalog \u4E0D\u4E00\u81F4`);
     }
   }
   const declaredTriggerKeys = new Set(module.triggers.map((t) => `${t.table}::${t.name}`));
@@ -13367,7 +13399,9 @@ function reconcileModule(module, catalog) {
   for (const table of module.tables) {
     const [schema, name] = splitQualifiedName(table);
     const ct = catalog.tables.find((t) => t.schema === schema && t.name === name);
-    if (ct && !ct.rlsEnabled) {
+    if (!ct) {
+      push("error", "missing-table", table, `\u58F0\u660E\u7684\u8868 ${table} \u5728 catalog \u4E2D\u4E0D\u5B58\u5728`);
+    } else if (!ct.rlsEnabled) {
       push("error", "rls-disabled", table, `\u5F52\u5C5E\u8868 ${table} \u672A\u5F00\u542F\u884C\u7EA7\u5B89\u5168\uFF08relrowsecurity = false\uFF09`);
     }
   }
@@ -13390,6 +13424,15 @@ function reconcileModule(module, catalog) {
     ok: !issues.some((issue) => issue.severity === "error")
   };
 }
+function sameRoles(expected, actual) {
+  const normalize = (roles) => [...new Set(roles)].sort();
+  return JSON.stringify(normalize(expected)) === JSON.stringify(normalize(actual));
+}
+function functionSignature(functionEntry) {
+  if (functionEntry.identityArguments === undefined)
+    return;
+  return `${functionEntry.schema}.${functionEntry.name}(${functionEntry.identityArguments})`;
+}
 var SECURITY_DEFINER_RE = /\bsecurity\s+definer\b/i;
 var SET_SEARCH_PATH_RE = /\bset\s+search_path\b/i;
 var GRANT_TO_PUBLIC_RE = /\bgrant\b[^;]*\bto\s+public\b/i;
@@ -13470,14 +13513,15 @@ async function lintModule(module, readFile) {
   for (const [file, sql] of contents) {
     issues.push(...lintSql(sql, file));
   }
-  if (module.policies.length > 0) {
+  const firstPolicy = module.policies[0];
+  if (firstPolicy) {
     const anyEnable = module.policies.some((policy) => ENABLE_RLS_RE.test(contents.get(policy.source) ?? ""));
     if (!anyEnable) {
       issues.push({
         severity: "warn",
         code: "missing-rls-enable",
         message: `\u6A21\u5757 ${module.name} \u58F0\u660E\u4E86 ${module.policies.length} \u6761\u7B56\u7565\uFF0C\u4F46\u6240\u6709\u7B56\u7565\u6E90\u6587\u4EF6\u90FD\u6CA1\u6709 enable row level security`,
-        file: module.policies[0].source
+        file: firstPolicy.source
       });
     }
   }
@@ -13523,10 +13567,10 @@ function keys(row, expected) {
 function validTarget(value) {
   const target = record(value);
   keys(target, ["environment", "projectRef"]);
-  if (typeof target.environment !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(target.environment) || typeof target.projectRef !== "string" || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(target.projectRef)) {
+  if (typeof target["environment"] !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(target["environment"]) || typeof target["projectRef"] !== "string" || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(target["projectRef"])) {
     throw new Error("Invalid migration binding target");
   }
-  return target;
+  return { environment: target["environment"], projectRef: target["projectRef"] };
 }
 function validFile(file) {
   return typeof file === "string" && /^[a-zA-Z0-9_./-]+\.sql$/.test(file) && !file.startsWith("/") && file.split("/").every((part) => part && part !== "." && part !== "..");
@@ -13534,32 +13578,37 @@ function validFile(file) {
 function parseMigrationBindingManifest(value) {
   const manifest = record(value);
   keys(manifest, ["schema", "targets", "templates"]);
-  if (manifest.schema !== "supacloud.migration-bindings.v1" || !Array.isArray(manifest.targets) || !manifest.targets.length || !Array.isArray(manifest.templates)) {
+  if (manifest["schema"] !== "supacloud.migration-bindings.v1" || !Array.isArray(manifest["targets"]) || !manifest["targets"].length || !Array.isArray(manifest["templates"])) {
     throw new Error("Invalid migration binding manifest");
   }
-  const targets = manifest.targets.map(validTarget);
+  const targets = manifest["targets"].map(validTarget);
   if (new Set(targets.map((target) => target.environment)).size !== targets.length) {
     throw new Error("Duplicate migration binding environment");
   }
   const files = new Set;
-  const templates = manifest.templates.map((value2) => {
-    const template = record(value2);
+  const templates = manifest["templates"].map((value) => {
+    const template = record(value);
     keys(template, ["file", "templateSha256", "parameters"]);
-    if (!validFile(template.file) || files.has(template.file) || typeof template.templateSha256 !== "string" || !HASH.test(template.templateSha256) || !Array.isArray(template.parameters) || !template.parameters.length) {
+    if (!validFile(template["file"]) || files.has(template["file"]) || typeof template["templateSha256"] !== "string" || !HASH.test(template["templateSha256"]) || !Array.isArray(template["parameters"]) || !template["parameters"].length) {
       throw new Error("Invalid or duplicate migration binding template");
     }
-    files.add(template.file);
+    files.add(template["file"]);
     const placeholders = new Set;
-    const parameters = template.parameters.map((value3) => {
-      const parameter = record(value3);
+    const parameters = template["parameters"].map((value) => {
+      const parameter = record(value);
       keys(parameter, ["placeholder", "variable", "type", "occurrences"]);
-      if (typeof parameter.placeholder !== "string" || !/^__[A-Z][A-Z0-9_]*__$/.test(parameter.placeholder) || placeholders.has(parameter.placeholder) || typeof parameter.variable !== "string" || !/^[A-Z][A-Z0-9_]*$/.test(parameter.variable) || !["uuid", "https-url", "resource-name"].includes(String(parameter.type)) || !Number.isSafeInteger(parameter.occurrences) || Number(parameter.occurrences) < 1) {
+      if (typeof parameter["placeholder"] !== "string" || !/^__[A-Z][A-Z0-9_]*__$/.test(parameter["placeholder"]) || placeholders.has(parameter["placeholder"]) || typeof parameter["variable"] !== "string" || !/^[A-Z][A-Z0-9_]*$/.test(parameter["variable"]) || parameter["type"] !== "uuid" && parameter["type"] !== "https-url" && parameter["type"] !== "resource-name" || typeof parameter["occurrences"] !== "number" || !Number.isSafeInteger(parameter["occurrences"]) || parameter["occurrences"] < 1) {
         throw new Error("Invalid or duplicate migration binding parameter");
       }
-      placeholders.add(parameter.placeholder);
-      return parameter;
+      placeholders.add(parameter["placeholder"]);
+      return {
+        placeholder: parameter["placeholder"],
+        variable: parameter["variable"],
+        type: parameter["type"],
+        occurrences: parameter["occurrences"]
+      };
     });
-    return { file: template.file, templateSha256: template.templateSha256, parameters };
+    return { file: template["file"], templateSha256: template["templateSha256"], parameters };
   });
   return { schema: "supacloud.migration-bindings.v1", targets, templates };
 }
@@ -13647,6 +13696,194 @@ function renderMigrationBindings(options) {
     }
   };
 }
+var COMMAND_PERSISTENCE_SQL = `
+DO $runtime$
+BEGIN
+  IF to_regprocedure('supacloud_workflows.start_run(uuid,text,text,text,jsonb,integer)') IS NULL
+    OR to_regprocedure('supacloud_commands.status(jsonb)') IS NULL THEN
+    RAISE EXCEPTION 'Install the SupaCloud Commands/Workflow/PGMQ runtime before command persistence';
+  END IF;
+END
+$runtime$;
+CREATE SCHEMA IF NOT EXISTS supacloud_commands;
+REVOKE ALL ON SCHEMA supacloud_commands FROM PUBLIC;
+CREATE TABLE IF NOT EXISTS supacloud_commands.execution_receipts (
+  tenant_id text NOT NULL,
+  actor_id text NOT NULL,
+  command text NOT NULL,
+  operation_key text NOT NULL,
+  kind text NOT NULL CHECK (kind IN ('transactional', 'external')),
+  input_fingerprint text NOT NULL CHECK (input_fingerprint ~ '^[a-f0-9]{64}$'),
+  input_payload text,
+  dispatch_key uuid NOT NULL DEFAULT gen_random_uuid() UNIQUE,
+  status text NOT NULL CHECK (status IN ('pending', 'unknown', 'confirmed', 'rejected')),
+  audit_state text NOT NULL CHECK (audit_state IN ('pending', 'complete')),
+  result jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, actor_id, command, operation_key),
+  CHECK ((status = 'confirmed') = (result IS NOT NULL)),
+  CONSTRAINT execution_receipts_audit_terminal_check CHECK (
+    (audit_state <> 'complete' OR status IN ('confirmed', 'rejected'))
+    AND (status <> 'rejected' OR audit_state = 'complete')),
+  CONSTRAINT execution_receipts_transactional_check CHECK (
+    kind <> 'transactional' OR (status = 'confirmed' AND audit_state = 'complete'))
+);
+CREATE TABLE IF NOT EXISTS supacloud_commands.execution_audit (
+  tenant_id text NOT NULL,
+  actor_id text NOT NULL,
+  command text NOT NULL,
+  operation_key text NOT NULL,
+  event text NOT NULL,
+  details jsonb NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, actor_id, command, operation_key),
+  FOREIGN KEY (tenant_id, actor_id, command, operation_key)
+    REFERENCES supacloud_commands.execution_receipts (tenant_id, actor_id, command, operation_key)
+);
+REVOKE ALL ON supacloud_commands.execution_receipts, supacloud_commands.execution_audit FROM PUBLIC;
+CREATE OR REPLACE FUNCTION supacloud_commands.protect_terminal_execution()
+RETURNS trigger LANGUAGE plpgsql SET search_path = '' AS $terminal$
+BEGIN
+  IF OLD.status IN ('confirmed','rejected') AND (
+    NEW.status IS DISTINCT FROM OLD.status OR NEW.result IS DISTINCT FROM OLD.result
+    OR (OLD.audit_state = 'complete' AND NEW.audit_state IS DISTINCT FROM OLD.audit_state)) THEN
+    RAISE EXCEPTION 'SUPACLOUD_COMMAND_TERMINAL_RECEIPT';
+  END IF;
+  RETURN NEW;
+END
+$terminal$;
+CREATE OR REPLACE TRIGGER execution_terminal_guard
+BEFORE UPDATE ON supacloud_commands.execution_receipts
+FOR EACH ROW EXECUTE FUNCTION supacloud_commands.protect_terminal_execution();
+
+CREATE OR REPLACE FUNCTION supacloud_commands.require_rejection_audit()
+RETURNS trigger LANGUAGE plpgsql SET search_path = '' AS $rejection$
+BEGIN
+  IF NEW.status = 'rejected' AND NOT EXISTS (
+    SELECT FROM supacloud_commands.execution_audit a
+    WHERE a.tenant_id=NEW.tenant_id AND a.actor_id=NEW.actor_id
+      AND a.command=NEW.command AND a.operation_key=NEW.operation_key
+  ) THEN
+    RAISE EXCEPTION 'SUPACLOUD_COMMAND_REJECTION_AUDIT_REQUIRED';
+  END IF;
+  RETURN NEW;
+END
+$rejection$;
+DROP TRIGGER IF EXISTS execution_rejection_audit ON supacloud_commands.execution_receipts;
+CREATE CONSTRAINT TRIGGER execution_rejection_audit
+AFTER INSERT OR UPDATE ON supacloud_commands.execution_receipts
+DEFERRABLE INITIALLY DEFERRED
+FOR EACH ROW WHEN (NEW.status = 'rejected')
+EXECUTE FUNCTION supacloud_commands.require_rejection_audit();
+CREATE OR REPLACE FUNCTION supacloud_commands.enqueue_execution_recovery()
+RETURNS trigger LANGUAGE plpgsql SET search_path = '' AS $recovery$
+DECLARE submission jsonb;
+BEGIN
+  PERFORM pg_advisory_xact_lock(hashtextextended(NEW.dispatch_key::text,0));
+  SELECT supacloud_commands.snapshot(NEW.dispatch_key,false) INTO submission;
+  IF submission IS NOT NULL THEN
+    IF submission->>'commandType' IS DISTINCT FROM NEW.command
+      OR submission->>'actorId' IS DISTINCT FROM NEW.actor_id
+      OR submission->>'tenantId' IS DISTINCT FROM NEW.tenant_id
+      OR NEW.operation_key <> NEW.dispatch_key::text THEN
+      RAISE EXCEPTION 'SUPACLOUD_COMMAND_IDENTITY_CONFLICT';
+    END IF;
+    RETURN NEW;
+  END IF;
+  IF NEW.kind = 'external' AND NEW.status <> 'rejected'
+    AND (NEW.status <> 'confirmed' OR NEW.audit_state <> 'complete') THEN
+    PERFORM supacloud_workflows.start_run(
+      NEW.dispatch_key, 'supacloud.command.reconcile', '1', 'reconcile',
+      jsonb_build_object('commandId', NEW.dispatch_key, 'tenantId', NEW.tenant_id,
+        'actorId', NEW.actor_id, 'command', NEW.command, 'operationId', NEW.operation_key),
+      20
+    );
+  END IF;
+  RETURN NEW;
+END
+$recovery$;
+CREATE OR REPLACE TRIGGER execution_recovery_enqueue
+AFTER INSERT ON supacloud_commands.execution_receipts
+FOR EACH ROW EXECUTE FUNCTION supacloud_commands.enqueue_execution_recovery();
+
+CREATE OR REPLACE FUNCTION supacloud_commands.execution_status(request jsonb)
+RETURNS jsonb LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $status$
+  SELECT jsonb_build_object('kind','execution','commandId',r.dispatch_key,
+    'execution',jsonb_build_object('tenantId',r.tenant_id,'actorId',r.actor_id,
+      'command',r.command,'operationId',r.operation_key,'dispatchKey',r.dispatch_key,
+      'status',r.status,'audit',r.audit_state)
+      || CASE WHEN r.status='confirmed' THEN jsonb_build_object('result',r.result) ELSE '{}'::jsonb END,
+    'workflow',CASE WHEN w.id IS NULL THEN NULL ELSE jsonb_build_object('runId',w.id,'status',w.status) END)
+  FROM supacloud_commands.execution_receipts r
+  LEFT JOIN supacloud_workflows.runs w ON w.id=r.dispatch_key
+  WHERE CASE WHEN request ? 'commandId' THEN r.dispatch_key::text=request->>'commandId'
+    ELSE r.tenant_id=request->>'tenantId' AND r.actor_id=request->>'actorId'
+      AND r.command=request->>'command' AND r.operation_key=request->>'operationId' END
+$status$;
+REVOKE ALL ON FUNCTION supacloud_commands.execution_status(jsonb) FROM PUBLIC;
+`;
+var COMMAND_PERSISTENCE_UPGRADE_SQL = `
+ALTER TABLE supacloud_commands.execution_receipts
+  ADD COLUMN IF NOT EXISTS input_fingerprint text,
+  ADD COLUMN IF NOT EXISTS input_payload text;
+DO $migration$
+BEGIN
+  IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema='supacloud_commands'
+    AND table_name='execution_receipts' AND column_name='input_key') THEN
+    EXECUTE 'UPDATE supacloud_commands.execution_receipts
+      SET input_fingerprint=encode(sha256(convert_to(input_key,''UTF8'')),''hex''),input_payload=input_key
+      WHERE input_fingerprint IS NULL';
+    ALTER TABLE supacloud_commands.execution_receipts DROP COLUMN input_key;
+  END IF;
+END
+$migration$;
+ALTER TABLE supacloud_commands.execution_receipts ALTER COLUMN input_fingerprint SET NOT NULL;
+ALTER TABLE supacloud_commands.execution_receipts
+  DROP CONSTRAINT IF EXISTS execution_receipts_status_check,
+  DROP CONSTRAINT IF EXISTS execution_receipts_check1,
+  DROP CONSTRAINT IF EXISTS execution_receipts_transactional_check,
+  DROP CONSTRAINT IF EXISTS execution_receipts_audit_terminal_check;
+ALTER TABLE supacloud_commands.execution_receipts
+  ADD CONSTRAINT execution_receipts_status_check CHECK (status IN ('pending','unknown','confirmed','rejected')),
+  ADD CONSTRAINT execution_receipts_transactional_check CHECK (
+    kind <> 'transactional' OR (status = 'confirmed' AND audit_state = 'complete')),
+  ADD CONSTRAINT execution_receipts_audit_terminal_check CHECK (
+    (audit_state <> 'complete' OR status IN ('confirmed','rejected'))
+    AND (status <> 'rejected' OR audit_state = 'complete'));
+DO $constraint$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint
+    WHERE conrelid='supacloud_commands.execution_receipts'::regclass
+      AND conname='execution_receipts_input_fingerprint_check') THEN
+    ALTER TABLE supacloud_commands.execution_receipts
+      ADD CONSTRAINT execution_receipts_input_fingerprint_check CHECK (input_fingerprint ~ '^[a-f0-9]{64}$');
+  END IF;
+END
+$constraint$;
+${COMMAND_PERSISTENCE_SQL}
+DO $backfill$
+DECLARE r record;
+BEGIN
+  FOR r IN SELECT * FROM supacloud_commands.execution_receipts
+    WHERE kind='external' AND status<>'rejected' AND (status<>'confirmed' OR audit_state<>'complete')
+      AND NOT EXISTS(SELECT FROM supacloud_workflows.runs w WHERE w.id=dispatch_key)
+  LOOP
+    PERFORM supacloud_workflows.start_run(
+      r.dispatch_key,'supacloud.command.reconcile','1','reconcile',
+      jsonb_build_object('commandId',r.dispatch_key,'tenantId',r.tenant_id,
+        'actorId',r.actor_id,'command',r.command,'operationId',r.operation_key),20
+    );
+  END LOOP;
+END
+$backfill$;
+DROP INDEX IF EXISTS supacloud_commands.execution_pending_recovery;
+ALTER TABLE supacloud_commands.execution_receipts
+  DROP COLUMN IF EXISTS lease_id,
+  DROP COLUMN IF EXISTS lease_until,
+  DROP COLUMN IF EXISTS next_attempt_at,
+  DROP COLUMN IF EXISTS recovery_attempts;
+`;
 
 // src/runtime/node/db-check.ts
 async function loadDatabaseModules(moduleFile) {

package/dist/index.js

@@ -88,7 +88,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.28.1",
+  version: "0.28.3",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -142,36 +142,37 @@ var package_default = {
     typecheck: "bun x tsc --noEmit -p tsconfig.json"
   },
   dependencies: {
-    "@electric-sql/pglite": "0.5.8",
-    "@electric-sql/pglite-pg_textsearch": "0.0.10",
-    "@electric-sql/pglite-pgmq": "0.0.6",
-    "@electric-sql/pglite-pgvector": "0.0.9",
-    "@electric-sql/pglite-postgis": "0.2.8",
-    "@supacloud/db": "^0.6.0",
+    "@electric-sql/pglite": "0.5.10",
+    "@electric-sql/pglite-pg_textsearch": "0.0.12",
+    "@electric-sql/pglite-pgmq": "0.0.8",
+    "@electric-sql/pglite-pgvector": "0.0.11",
+    "@electric-sql/pglite-postgis": "0.2.10",
+    "@supacloud/db": "^0.17.0",
     "exact-mirror": "1.2.6",
     tar: "^7.5.22",
-    typebox: "1.3.36"
+    typebox: "1.3.37"
   },
   devDependencies: {
     "@supacloud/app": "file:../app",
+    "@supacloud/contracts": "file:../contracts",
     "@supacloud/compiler": "file:../compiler",
     "@supacloud/elysia": "file:../elysia",
     "@supabase/supabase-js": "^2.117.3",
     "@types/bun": "^1.4.3",
-    effect: "4.0.2",
-    elysia: "2.0.0-beta.21",
+    effect: "4.0.5",
+    elysia: "2.0.0-beta.32",
     jose: "^6.2.12",
     typescript: "^7.0.2"
   },
   overrides: {
-    "@supacloud/db": "^0.6.0",
+    "@supacloud/db": "^0.17.0",
     "@supacloud/app": "file:../app",
     "@supacloud/compiler": "file:../compiler",
     "@supacloud/elysia": "file:../elysia",
     "@supacloud/contracts": "file:../contracts",
     "@supacloud/commands": "file:../commands",
     "@supacloud/delivery": "file:../delivery",
-    "@graphql-tools/utils": "^12.0.3"
+    "@graphql-tools/utils": "^12.0.4"
   },
   engines: {
     bun: ">=1.4.3"
@@ -8362,6 +8363,8 @@ function statusForSqlState(code) {
   switch (code) {
     case "42501":
       return 403;
+    case "25006":
+      return 405;
     case "23503":
     case "23505":
       return 409;
@@ -8713,17 +8716,22 @@ class RestHandler {
     return await this.runRpc(ctx, fn, call, q, prefer, wantsObject, wantsCsv, schema, method);
   }
   async runRpc(ctx, fn, call, q, prefer, wantsObject, wantsCsv, schema, method) {
+    const withRpcContext = (run) => this.db.withContext(ctx, async (query) => {
+      if (method !== "POST" || fn.volatility !== "v")
+        await query("set transaction read only");
+      return run(query);
+    });
     if (fn.returnType === "void" && !fn.returnsSet) {
-      await this.db.withContext(ctx, (query) => query(`select ${call}`, []));
+      await withRpcContext((query) => query(`select ${call}`, []));
       return new Response(null, { status: 204 });
     }
     if (!fn.returnsSet && ["b", "d", "e"].includes(fn.returnTypType)) {
-      const res = await this.db.withContext(ctx, (query) => query(`select to_json(${call}) as result`, []));
+      const res = await withRpcContext((query) => query(`select to_json(${call}) as result`, []));
       const value = res.rows[0].result;
       return jsonResponse(200, value);
     }
     if (fn.returnsSet && ["b", "d", "e"].includes(fn.returnTypType)) {
-      const res = await this.db.withContext(ctx, (query) => query(`select coalesce(json_agg(_v), '[]'::json) as body from ${call} as _t(_v)`, []));
+      const res = await withRpcContext((query) => query(`select coalesce(json_agg(_v), '[]'::json) as body from ${call} as _t(_v)`, []));
       return jsonResponse(200, res.rows[0].body);
     }
     const alias = "_f";
@@ -8751,7 +8759,7 @@ class RestHandler {
     const core = `select ${exprs.join(", ")} from ${resultSource} as ${quoteIdent(alias)}${where}${order}${limitOffset}`;
     const bodySql = `select coalesce(json_agg(row_to_json(_r)), '[]'::json) as body from (${core}) _r`;
     const sql = wantsCount ? `with ${quoteIdent("_rpc_result")} as (select * from ${call}) select (${bodySql}) as body, (select count(*)::int from ${resultSource} as ${quoteIdent(alias)}${where}) as count` : bodySql;
-    const { rows, count } = await this.db.withContext(ctx, async (query) => {
+    const { rows, count } = await withRpcContext(async (query) => {
       const res = await query(sql, []);
       const rows = res.rows[0].body;
       if (wantsObject && !wantsCsv)
@@ -13964,10 +13972,10 @@ function keys(row, expected) {
 function validTarget(value) {
   const target = record(value);
   keys(target, ["environment", "projectRef"]);
-  if (typeof target.environment !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(target.environment) || typeof target.projectRef !== "string" || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(target.projectRef)) {
+  if (typeof target["environment"] !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(target["environment"]) || typeof target["projectRef"] !== "string" || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(target["projectRef"])) {
     throw new Error("Invalid migration binding target");
   }
-  return target;
+  return { environment: target["environment"], projectRef: target["projectRef"] };
 }
 function validFile(file) {
   return typeof file === "string" && /^[a-zA-Z0-9_./-]+\.sql$/.test(file) && !file.startsWith("/") && file.split("/").every((part) => part && part !== "." && part !== "..");
@@ -13975,32 +13983,37 @@ function validFile(file) {
 function parseMigrationBindingManifest(value) {
   const manifest = record(value);
   keys(manifest, ["schema", "targets", "templates"]);
-  if (manifest.schema !== "supacloud.migration-bindings.v1" || !Array.isArray(manifest.targets) || !manifest.targets.length || !Array.isArray(manifest.templates)) {
+  if (manifest["schema"] !== "supacloud.migration-bindings.v1" || !Array.isArray(manifest["targets"]) || !manifest["targets"].length || !Array.isArray(manifest["templates"])) {
     throw new Error("Invalid migration binding manifest");
   }
-  const targets = manifest.targets.map(validTarget);
+  const targets = manifest["targets"].map(validTarget);
   if (new Set(targets.map((target) => target.environment)).size !== targets.length) {
     throw new Error("Duplicate migration binding environment");
   }
   const files = new Set;
-  const templates = manifest.templates.map((value2) => {
-    const template = record(value2);
+  const templates = manifest["templates"].map((value) => {
+    const template = record(value);
     keys(template, ["file", "templateSha256", "parameters"]);
-    if (!validFile(template.file) || files.has(template.file) || typeof template.templateSha256 !== "string" || !HASH.test(template.templateSha256) || !Array.isArray(template.parameters) || !template.parameters.length) {
+    if (!validFile(template["file"]) || files.has(template["file"]) || typeof template["templateSha256"] !== "string" || !HASH.test(template["templateSha256"]) || !Array.isArray(template["parameters"]) || !template["parameters"].length) {
       throw new Error("Invalid or duplicate migration binding template");
     }
-    files.add(template.file);
+    files.add(template["file"]);
     const placeholders = new Set;
-    const parameters = template.parameters.map((value3) => {
-      const parameter = record(value3);
+    const parameters = template["parameters"].map((value) => {
+      const parameter = record(value);
       keys(parameter, ["placeholder", "variable", "type", "occurrences"]);
-      if (typeof parameter.placeholder !== "string" || !/^__[A-Z][A-Z0-9_]*__$/.test(parameter.placeholder) || placeholders.has(parameter.placeholder) || typeof parameter.variable !== "string" || !/^[A-Z][A-Z0-9_]*$/.test(parameter.variable) || !["uuid", "https-url", "resource-name"].includes(String(parameter.type)) || !Number.isSafeInteger(parameter.occurrences) || Number(parameter.occurrences) < 1) {
+      if (typeof parameter["placeholder"] !== "string" || !/^__[A-Z][A-Z0-9_]*__$/.test(parameter["placeholder"]) || placeholders.has(parameter["placeholder"]) || typeof parameter["variable"] !== "string" || !/^[A-Z][A-Z0-9_]*$/.test(parameter["variable"]) || parameter["type"] !== "uuid" && parameter["type"] !== "https-url" && parameter["type"] !== "resource-name" || typeof parameter["occurrences"] !== "number" || !Number.isSafeInteger(parameter["occurrences"]) || parameter["occurrences"] < 1) {
         throw new Error("Invalid or duplicate migration binding parameter");
       }
-      placeholders.add(parameter.placeholder);
-      return parameter;
+      placeholders.add(parameter["placeholder"]);
+      return {
+        placeholder: parameter["placeholder"],
+        variable: parameter["variable"],
+        type: parameter["type"],
+        occurrences: parameter["occurrences"]
+      };
     });
-    return { file: template.file, templateSha256: template.templateSha256, parameters };
+    return { file: template["file"], templateSha256: template["templateSha256"], parameters };
   });
   return { schema: "supacloud.migration-bindings.v1", targets, templates };
 }
@@ -14088,6 +14101,194 @@ function renderMigrationBindings(options) {
     }
   };
 }
+var COMMAND_PERSISTENCE_SQL = `
+DO $runtime$
+BEGIN
+  IF to_regprocedure('supacloud_workflows.start_run(uuid,text,text,text,jsonb,integer)') IS NULL
+    OR to_regprocedure('supacloud_commands.status(jsonb)') IS NULL THEN
+    RAISE EXCEPTION 'Install the SupaCloud Commands/Workflow/PGMQ runtime before command persistence';
+  END IF;
+END
+$runtime$;
+CREATE SCHEMA IF NOT EXISTS supacloud_commands;
+REVOKE ALL ON SCHEMA supacloud_commands FROM PUBLIC;
+CREATE TABLE IF NOT EXISTS supacloud_commands.execution_receipts (
+  tenant_id text NOT NULL,
+  actor_id text NOT NULL,
+  command text NOT NULL,
+  operation_key text NOT NULL,
+  kind text NOT NULL CHECK (kind IN ('transactional', 'external')),
+  input_fingerprint text NOT NULL CHECK (input_fingerprint ~ '^[a-f0-9]{64}$'),
+  input_payload text,
+  dispatch_key uuid NOT NULL DEFAULT gen_random_uuid() UNIQUE,
+  status text NOT NULL CHECK (status IN ('pending', 'unknown', 'confirmed', 'rejected')),
+  audit_state text NOT NULL CHECK (audit_state IN ('pending', 'complete')),
+  result jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, actor_id, command, operation_key),
+  CHECK ((status = 'confirmed') = (result IS NOT NULL)),
+  CONSTRAINT execution_receipts_audit_terminal_check CHECK (
+    (audit_state <> 'complete' OR status IN ('confirmed', 'rejected'))
+    AND (status <> 'rejected' OR audit_state = 'complete')),
+  CONSTRAINT execution_receipts_transactional_check CHECK (
+    kind <> 'transactional' OR (status = 'confirmed' AND audit_state = 'complete'))
+);
+CREATE TABLE IF NOT EXISTS supacloud_commands.execution_audit (
+  tenant_id text NOT NULL,
+  actor_id text NOT NULL,
+  command text NOT NULL,
+  operation_key text NOT NULL,
+  event text NOT NULL,
+  details jsonb NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, actor_id, command, operation_key),
+  FOREIGN KEY (tenant_id, actor_id, command, operation_key)
+    REFERENCES supacloud_commands.execution_receipts (tenant_id, actor_id, command, operation_key)
+);
+REVOKE ALL ON supacloud_commands.execution_receipts, supacloud_commands.execution_audit FROM PUBLIC;
+CREATE OR REPLACE FUNCTION supacloud_commands.protect_terminal_execution()
+RETURNS trigger LANGUAGE plpgsql SET search_path = '' AS $terminal$
+BEGIN
+  IF OLD.status IN ('confirmed','rejected') AND (
+    NEW.status IS DISTINCT FROM OLD.status OR NEW.result IS DISTINCT FROM OLD.result
+    OR (OLD.audit_state = 'complete' AND NEW.audit_state IS DISTINCT FROM OLD.audit_state)) THEN
+    RAISE EXCEPTION 'SUPACLOUD_COMMAND_TERMINAL_RECEIPT';
+  END IF;
+  RETURN NEW;
+END
+$terminal$;
+CREATE OR REPLACE TRIGGER execution_terminal_guard
+BEFORE UPDATE ON supacloud_commands.execution_receipts
+FOR EACH ROW EXECUTE FUNCTION supacloud_commands.protect_terminal_execution();
+
+CREATE OR REPLACE FUNCTION supacloud_commands.require_rejection_audit()
+RETURNS trigger LANGUAGE plpgsql SET search_path = '' AS $rejection$
+BEGIN
+  IF NEW.status = 'rejected' AND NOT EXISTS (
+    SELECT FROM supacloud_commands.execution_audit a
+    WHERE a.tenant_id=NEW.tenant_id AND a.actor_id=NEW.actor_id
+      AND a.command=NEW.command AND a.operation_key=NEW.operation_key
+  ) THEN
+    RAISE EXCEPTION 'SUPACLOUD_COMMAND_REJECTION_AUDIT_REQUIRED';
+  END IF;
+  RETURN NEW;
+END
+$rejection$;
+DROP TRIGGER IF EXISTS execution_rejection_audit ON supacloud_commands.execution_receipts;
+CREATE CONSTRAINT TRIGGER execution_rejection_audit
+AFTER INSERT OR UPDATE ON supacloud_commands.execution_receipts
+DEFERRABLE INITIALLY DEFERRED
+FOR EACH ROW WHEN (NEW.status = 'rejected')
+EXECUTE FUNCTION supacloud_commands.require_rejection_audit();
+CREATE OR REPLACE FUNCTION supacloud_commands.enqueue_execution_recovery()
+RETURNS trigger LANGUAGE plpgsql SET search_path = '' AS $recovery$
+DECLARE submission jsonb;
+BEGIN
+  PERFORM pg_advisory_xact_lock(hashtextextended(NEW.dispatch_key::text,0));
+  SELECT supacloud_commands.snapshot(NEW.dispatch_key,false) INTO submission;
+  IF submission IS NOT NULL THEN
+    IF submission->>'commandType' IS DISTINCT FROM NEW.command
+      OR submission->>'actorId' IS DISTINCT FROM NEW.actor_id
+      OR submission->>'tenantId' IS DISTINCT FROM NEW.tenant_id
+      OR NEW.operation_key <> NEW.dispatch_key::text THEN
+      RAISE EXCEPTION 'SUPACLOUD_COMMAND_IDENTITY_CONFLICT';
+    END IF;
+    RETURN NEW;
+  END IF;
+  IF NEW.kind = 'external' AND NEW.status <> 'rejected'
+    AND (NEW.status <> 'confirmed' OR NEW.audit_state <> 'complete') THEN
+    PERFORM supacloud_workflows.start_run(
+      NEW.dispatch_key, 'supacloud.command.reconcile', '1', 'reconcile',
+      jsonb_build_object('commandId', NEW.dispatch_key, 'tenantId', NEW.tenant_id,
+        'actorId', NEW.actor_id, 'command', NEW.command, 'operationId', NEW.operation_key),
+      20
+    );
+  END IF;
+  RETURN NEW;
+END
+$recovery$;
+CREATE OR REPLACE TRIGGER execution_recovery_enqueue
+AFTER INSERT ON supacloud_commands.execution_receipts
+FOR EACH ROW EXECUTE FUNCTION supacloud_commands.enqueue_execution_recovery();
+
+CREATE OR REPLACE FUNCTION supacloud_commands.execution_status(request jsonb)
+RETURNS jsonb LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $status$
+  SELECT jsonb_build_object('kind','execution','commandId',r.dispatch_key,
+    'execution',jsonb_build_object('tenantId',r.tenant_id,'actorId',r.actor_id,
+      'command',r.command,'operationId',r.operation_key,'dispatchKey',r.dispatch_key,
+      'status',r.status,'audit',r.audit_state)
+      || CASE WHEN r.status='confirmed' THEN jsonb_build_object('result',r.result) ELSE '{}'::jsonb END,
+    'workflow',CASE WHEN w.id IS NULL THEN NULL ELSE jsonb_build_object('runId',w.id,'status',w.status) END)
+  FROM supacloud_commands.execution_receipts r
+  LEFT JOIN supacloud_workflows.runs w ON w.id=r.dispatch_key
+  WHERE CASE WHEN request ? 'commandId' THEN r.dispatch_key::text=request->>'commandId'
+    ELSE r.tenant_id=request->>'tenantId' AND r.actor_id=request->>'actorId'
+      AND r.command=request->>'command' AND r.operation_key=request->>'operationId' END
+$status$;
+REVOKE ALL ON FUNCTION supacloud_commands.execution_status(jsonb) FROM PUBLIC;
+`;
+var COMMAND_PERSISTENCE_UPGRADE_SQL = `
+ALTER TABLE supacloud_commands.execution_receipts
+  ADD COLUMN IF NOT EXISTS input_fingerprint text,
+  ADD COLUMN IF NOT EXISTS input_payload text;
+DO $migration$
+BEGIN
+  IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema='supacloud_commands'
+    AND table_name='execution_receipts' AND column_name='input_key') THEN
+    EXECUTE 'UPDATE supacloud_commands.execution_receipts
+      SET input_fingerprint=encode(sha256(convert_to(input_key,''UTF8'')),''hex''),input_payload=input_key
+      WHERE input_fingerprint IS NULL';
+    ALTER TABLE supacloud_commands.execution_receipts DROP COLUMN input_key;
+  END IF;
+END
+$migration$;
+ALTER TABLE supacloud_commands.execution_receipts ALTER COLUMN input_fingerprint SET NOT NULL;
+ALTER TABLE supacloud_commands.execution_receipts
+  DROP CONSTRAINT IF EXISTS execution_receipts_status_check,
+  DROP CONSTRAINT IF EXISTS execution_receipts_check1,
+  DROP CONSTRAINT IF EXISTS execution_receipts_transactional_check,
+  DROP CONSTRAINT IF EXISTS execution_receipts_audit_terminal_check;
+ALTER TABLE supacloud_commands.execution_receipts
+  ADD CONSTRAINT execution_receipts_status_check CHECK (status IN ('pending','unknown','confirmed','rejected')),
+  ADD CONSTRAINT execution_receipts_transactional_check CHECK (
+    kind <> 'transactional' OR (status = 'confirmed' AND audit_state = 'complete')),
+  ADD CONSTRAINT execution_receipts_audit_terminal_check CHECK (
+    (audit_state <> 'complete' OR status IN ('confirmed','rejected'))
+    AND (status <> 'rejected' OR audit_state = 'complete'));
+DO $constraint$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint
+    WHERE conrelid='supacloud_commands.execution_receipts'::regclass
+      AND conname='execution_receipts_input_fingerprint_check') THEN
+    ALTER TABLE supacloud_commands.execution_receipts
+      ADD CONSTRAINT execution_receipts_input_fingerprint_check CHECK (input_fingerprint ~ '^[a-f0-9]{64}$');
+  END IF;
+END
+$constraint$;
+${COMMAND_PERSISTENCE_SQL}
+DO $backfill$
+DECLARE r record;
+BEGIN
+  FOR r IN SELECT * FROM supacloud_commands.execution_receipts
+    WHERE kind='external' AND status<>'rejected' AND (status<>'confirmed' OR audit_state<>'complete')
+      AND NOT EXISTS(SELECT FROM supacloud_workflows.runs w WHERE w.id=dispatch_key)
+  LOOP
+    PERFORM supacloud_workflows.start_run(
+      r.dispatch_key,'supacloud.command.reconcile','1','reconcile',
+      jsonb_build_object('commandId',r.dispatch_key,'tenantId',r.tenant_id,
+        'actorId',r.actor_id,'command',r.command,'operationId',r.operation_key),20
+    );
+  END LOOP;
+END
+$backfill$;
+DROP INDEX IF EXISTS supacloud_commands.execution_pending_recovery;
+ALTER TABLE supacloud_commands.execution_receipts
+  DROP COLUMN IF EXISTS lease_id,
+  DROP COLUMN IF EXISTS lease_until,
+  DROP COLUMN IF EXISTS next_attempt_at,
+  DROP COLUMN IF EXISTS recovery_attempts;
+`;
 
 // src/runtime/node/project.ts
 async function loadSupabaseProject(projectDir, seed = {}) {

package/dist/runtime/rest/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/errors.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBtD;AAUD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAkBpD;AAED,sDAAsD;AACtD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,QAAQ,CAKV"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/errors.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBtD;AAUD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAkBpD;AAED,sDAAsD;AACtD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,QAAQ,CAKV"}

package/dist/runtime/rest/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAA4B,KAAK,QAAQ,EAAqB,MAAM,mBAAmB,CAAA;AAC9F,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AAyF3D,oFAAoF;AACpF,qBAAa,WAAW;IAOpB,OAAO,CAAC,EAAE;IANZ,8FAA8F;IAC9F,OAAO,CAAC,cAAc,CAAU;IAChC,8EAA8E;IAC9E,OAAO,CAAC,OAAO,CAAC,CAAQ;gBAGd,EAAE,EAAE,QAAQ,EACpB,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;IAMxD,4FAA4F;IACtF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YAmC9D,WAAW;YAsHX,WAAW;IAgDzB,OAAO,CAAC,YAAY;YAqCN,SAAS;YAqET,MAAM;CAqFrB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAA4B,KAAK,QAAQ,EAAmC,MAAM,mBAAmB,CAAA;AAC5G,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AAyF3D,oFAAoF;AACpF,qBAAa,WAAW;IAOpB,OAAO,CAAC,EAAE;IANZ,8FAA8F;IAC9F,OAAO,CAAC,cAAc,CAAU;IAChC,8EAA8E;IAC9E,OAAO,CAAC,OAAO,CAAC,CAAQ;gBAGd,EAAE,EAAE,QAAQ,EACpB,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;IAMxD,4FAA4F;IACtF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YAmC9D,WAAW;YAsHX,WAAW;IAgDzB,OAAO,CAAC,YAAY;YAqCN,SAAS;YAqET,MAAM;CA4FrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/lite",
-  "version": "0.28.1",
+  "version": "0.28.3",
   "description": "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   "type": "module",
   "license": "Apache-2.0",
@@ -54,36 +54,37 @@
     "typecheck": "bun x tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@electric-sql/pglite": "0.5.8",
-    "@electric-sql/pglite-pg_textsearch": "0.0.10",
-    "@electric-sql/pglite-pgmq": "0.0.6",
-    "@electric-sql/pglite-pgvector": "0.0.9",
-    "@electric-sql/pglite-postgis": "0.2.8",
-    "@supacloud/db": "^0.6.0",
+    "@electric-sql/pglite": "0.5.10",
+    "@electric-sql/pglite-pg_textsearch": "0.0.12",
+    "@electric-sql/pglite-pgmq": "0.0.8",
+    "@electric-sql/pglite-pgvector": "0.0.11",
+    "@electric-sql/pglite-postgis": "0.2.10",
+    "@supacloud/db": "^0.17.0",
     "exact-mirror": "1.2.6",
     "tar": "^7.5.22",
-    "typebox": "1.3.36"
+    "typebox": "1.3.37"
   },
   "devDependencies": {
     "@supacloud/app": "file:../app",
+    "@supacloud/contracts": "file:../contracts",
     "@supacloud/compiler": "file:../compiler",
     "@supacloud/elysia": "file:../elysia",
     "@supabase/supabase-js": "^2.117.3",
     "@types/bun": "^1.4.3",
-    "effect": "4.0.2",
-    "elysia": "2.0.0-beta.21",
+    "effect": "4.0.5",
+    "elysia": "2.0.0-beta.32",
     "jose": "^6.2.12",
     "typescript": "^7.0.2"
   },
   "overrides": {
-    "@supacloud/db": "^0.6.0",
+    "@supacloud/db": "^0.17.0",
     "@supacloud/app": "file:../app",
     "@supacloud/compiler": "file:../compiler",
     "@supacloud/elysia": "file:../elysia",
     "@supacloud/contracts": "file:../contracts",
     "@supacloud/commands": "file:../commands",
     "@supacloud/delivery": "file:../delivery",
-    "@graphql-tools/utils": "^12.0.3"
+    "@graphql-tools/utils": "^12.0.4"
   },
   "engines": {
     "bun": ">=1.4.3"