@supacloud/lite 0.33.1 → 0.34.0

package/dist/cli.js

@@ -2,13 +2,13 @@
 // @bun
 
 // src/cli.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync5, readdirSync, statSync as statSync2 } from "fs";
 import { mkdir as mkdir7, rm as rm6, writeFile as writeFile7 } from "fs/promises";
-import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
+import { dirname as dirname8, join as join10, resolve as resolve7 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.33.1",
+  version: "0.34.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -28,6 +28,7 @@ var package_default = {
     "dist",
     "!dist/standalone",
     "README.md",
+    "deploy",
     "CHANGELOG.md",
     "RELEASING.md",
     "THIRD_PARTY_NOTICES.md",
@@ -47,7 +48,7 @@ var package_default = {
     clean: "bun -e 'import { $ } from \"bun\"; await $`rm -rf dist`'",
     dev: "bun run src/cli.ts start",
     start: "bun run src/cli.ts start",
-    test: "bun test --timeout 20000",
+    test: "bun run scripts/run-tests.ts",
     "test:native": "SUPACLOUD_LITE_TEST_NATIVE=1 bun test test/native-engine.test.ts test/qauth-workflow-matrix.test.ts test/maker-checker-workflow.test.ts test/commands-artifacts.test.ts --timeout 180000",
     "test:graphql": "SUPACLOUD_LITE_TEST_GRAPHQL=1 bun test test/graphql-native.test.ts --timeout 180000",
     benchmark: "bun run scripts/benchmark.ts",
@@ -67,31 +68,31 @@ var package_default = {
     "@electric-sql/pglite-pgmq": "0.0.8",
     "@electric-sql/pglite-pgvector": "0.0.11",
     "@electric-sql/pglite-postgis": "0.2.10",
-    "@supacloud/db": "0.20.0",
+    "@supacloud/db": "0.20.1",
     "exact-mirror": "1.2.6",
     tar: "^7.5.22",
-    typebox: "1.3.37"
+    typebox: "1.4.2"
   },
   devDependencies: {
-    "@supacloud/app": "0.31.0",
-    "@supacloud/contracts": "0.13.0",
-    "@supacloud/compiler": "0.50.0",
-    "@supacloud/elysia": "0.35.1",
+    "@supacloud/app": "0.33.0",
+    "@supacloud/contracts": "0.15.1",
+    "@supacloud/compiler": "0.51.1",
+    "@supacloud/elysia": "0.36.1",
     "@supabase/supabase-js": "^2.118.0",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
-    elysia: "2.0.0-beta.32",
-    jose: "^6.2.12",
+    elysia: "2.0.0-rc.0",
+    jose: "^6.2.13",
     typescript: "^7.0.2"
   },
   overrides: {
-    "@supacloud/db": "0.20.0",
-    "@supacloud/app": "0.31.0",
-    "@supacloud/compiler": "0.50.0",
-    "@supacloud/elysia": "0.35.1",
-    "@supacloud/contracts": "0.13.0",
-    "@supacloud/commands": "0.11.0",
-    "@supacloud/delivery": "0.21.0",
+    "@supacloud/db": "0.20.1",
+    "@supacloud/app": "0.33.0",
+    "@supacloud/compiler": "0.51.1",
+    "@supacloud/elysia": "0.36.1",
+    "@supacloud/contracts": "0.15.1",
+    "@supacloud/commands": "0.11.1",
+    "@supacloud/delivery": "0.21.1",
     "@graphql-tools/utils": "^12.0.4"
   },
   engines: {
@@ -245,7 +246,7 @@ function isAllowedRedirect(requested, siteUrl, allowList = []) {
 var encoder2 = new TextEncoder;
 var decoder2 = new TextDecoder;
 var strictDecoder = new TextDecoder("utf-8", { fatal: true });
-var MAX_INT32 = 2 ** 32;
+var UINT32_RANGE = 2 ** 32;
 function concat(...buffers) {
   const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
   let i = 0;
@@ -404,23 +405,23 @@ function isDisjoint(...headers) {
 function decodeBase64url(value, label, ErrorClass) {
   try {
     return decode(value);
-  } catch {
-    throw new ErrorClass(`Failed to base64url decode the ${label}`);
+  } catch (cause) {
+    throw new ErrorClass(`Failed to base64url decode the ${label}`, { cause });
   }
 }
-function encodeBase64url(value, label, ErrorClass) {
+function encodeAsciiMember(value, label, ErrorClass) {
   try {
     return encode(value);
-  } catch {
-    throw new ErrorClass(`The ${label} is not a valid base64url string`);
+  } catch (cause) {
+    throw new ErrorClass(`The ${label} is not a valid base64url string`, { cause });
   }
 }
-function parseJoseHeader(b64, ErrorClass, message) {
+function parseJoseHeader(encodedProtectedHeader, ErrorClass, message) {
   let parsed;
   try {
-    parsed = JSON.parse(strictDecoder.decode(decode(b64)));
-  } catch {
-    throw new ErrorClass(message);
+    parsed = JSON.parse(strictDecoder.decode(decode(encodedProtectedHeader)));
+  } catch (cause) {
+    throw new ErrorClass(message, { cause });
   }
   if (!isObject(parsed))
     throw new ErrorClass(message);
@@ -478,15 +479,15 @@ var jwkMatchesOp = (entry, key, usage) => {
   }
 };
 async function prepareKey(entry, key, usage) {
-  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+  const { alg, secret } = entry, requiresPrivateKey = usage === "decrypt" || usage === "sign";
   if (secret && key instanceof Uint8Array)
     return key;
   let normalized, keyObject;
   if (isObject(key)) {
     if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
       throw invalidKeyType(alg, key, secret);
-    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === undefined && normalized.priv === undefined)))
-      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (requiresPrivateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === undefined && normalized.priv === undefined)))
+      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${requiresPrivateKey ? "private" : "public"} JWK`);
     if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
       return decode(normalized.k);
     if (!Object.isFrozen(key)) {
@@ -496,7 +497,7 @@ async function prepareKey(entry, key, usage) {
   } else {
     if (!isKeyLike(key))
       throw invalidKeyType(alg, key, secret);
-    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+    const expectedType = secret ? "secret" : requiresPrivateKey ? "private" : "public";
     if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
       throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
     if (isCryptoKey(key))
@@ -635,8 +636,8 @@ function eddsa() {
     usages: sig
   };
 }
-function mldsa(bits) {
-  const subtle = { name: `ML-DSA-${bits}` };
+function mldsa(parameterSet) {
+  const subtle = { name: `ML-DSA-${parameterSet}` };
   return {
     kty: ["AKP"],
     subtle,
@@ -674,21 +675,23 @@ function jwsAlgorithm(alg) {
 function prepareVerify(options) {
   return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
 }
-function parseProtectedHeader(encodedProtected) {
-  return encodedProtected === undefined ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+function parseProtectedHeader(encodedProtectedHeader) {
+  return encodedProtectedHeader === undefined ? {} : parseJoseHeader(encodedProtectedHeader, JWSInvalid, "JWS Protected Header is invalid");
 }
 function encodeCompactUnencodedPayload(payload) {
   try {
     return encode(payload);
-  } catch {
-    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
+  } catch (cause) {
+    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters", {
+      cause
+    });
   }
 }
 async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
-  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
-  if (!isDisjoint(parsedProt, header))
+  const { protected: encodedProtectedHeader, header, payload: inputPayload } = jws, protectedHeader = parsedProtected ?? parseProtectedHeader(encodedProtectedHeader);
+  if (!isDisjoint(protectedHeader, header))
     throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+  const joseHeader = { ...protectedHeader, ...header }, b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], protectedHeader, joseHeader)), { alg } = joseHeader;
   if (typeof alg != "string" || !alg)
     throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
   if (shared[0] && !shared[0].has(alg))
@@ -700,17 +703,19 @@ async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedP
     throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
   const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
   let resolvedKey = false;
-  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = true);
-  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== undefined ? encode(encodedProtected) : new Uint8Array, encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+  typeof key == "function" && (key = await key(protectedHeader, jws), resolvedKey = true);
+  const entry = jwsAlgorithm(alg), signingInput = concat(encodedProtectedHeader !== undefined ? encode(encodedProtectedHeader) : new Uint8Array, encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeAsciiMember(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), verificationKey = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(verificationKey, entry.subtle, "verify");
   entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
   let verified = false;
   try {
-    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
-  } catch {}
+    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, signingInput);
+  } catch (cause) {
+    throw new JWSSignatureVerificationFailed(undefined, { cause });
+  }
   if (!verified)
     throw new JWSSignatureVerificationFailed;
   const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
-  return encodedProtected !== undefined && (result.protectedHeader = parsedProt), header !== undefined && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];
+  return encodedProtectedHeader !== undefined && (result.protectedHeader = protectedHeader), header !== undefined && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: verificationKey }, b64] : [result, b64];
 }
 async function verifyCompact(jws, shared, key) {
   if (jws instanceof Uint8Array && (jws = decoder2.decode(jws)), typeof jws != "string")
@@ -740,8 +745,8 @@ function secs(str) {
   typeof str != "string" && invalidDuration();
   const matched = REGEX.exec(str);
   (!matched || matched[4] && matched[1]) && invalidDuration();
-  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
+  const value = parseFloat(matched[2]), durationSeconds = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(durationSeconds) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -durationSeconds : durationSeconds;
 }
 function validateInput(label, input) {
   if (!Number.isFinite(input))
@@ -753,33 +758,35 @@ var normalizeTyp = (value) => {
   return value.includes("/") ? normalized : `application/${normalized}`;
 };
 var checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : false;
-function validateNumericDate(payload, claim, required = false) {
-  const value = payload[claim];
+function validateNumericDate(claimsSet, claim, required = false) {
+  const value = claimsSet[claim];
   if (!(value === undefined && !required)) {
     if (typeof value != "number")
-      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, claimsSet, claim, "invalid");
     return value;
   }
 }
-function unexpectedClaim(payload, claim) {
-  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+function unexpectedClaim(claimsSet, claim) {
+  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, claimsSet, claim, checkFailed);
 }
-function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
-  let payload;
+function validateClaimsSet(protectedHeader, claimsSetBytes, options = {}) {
+  let claimsSet;
   try {
-    payload = JSON.parse(strictDecoder.decode(encodedPayload));
-  } catch {}
-  if (!isObject(payload))
+    claimsSet = JSON.parse(strictDecoder.decode(claimsSetBytes));
+  } catch (cause) {
+    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object", { cause });
+  }
+  if (!isObject(claimsSet))
     throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
   const { typ } = options;
   if (typ !== undefined && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
-    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', claimsSet, "typ", checkFailed);
   const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
   maxTokenAge !== undefined && presenceCheck.push("iat"), audience !== undefined && presenceCheck.push("aud"), subject !== undefined && presenceCheck.push("sub"), issuer !== undefined && presenceCheck.push("iss");
   for (const claim of new Set(presenceCheck.reverse()))
-    if (!Object.hasOwn(payload, claim))
-      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
-  issuer !== undefined && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== undefined && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== undefined && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+    if (!Object.hasOwn(claimsSet, claim))
+      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, claimsSet, claim, "missing");
+  issuer !== undefined && !(Array.isArray(issuer) ? issuer : [issuer]).includes(claimsSet.iss) && unexpectedClaim(claimsSet, "iss"), subject !== undefined && claimsSet.sub !== subject && unexpectedClaim(claimsSet, "sub"), audience !== undefined && !checkAudiencePresence(claimsSet.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(claimsSet, "aud");
   const { clockTolerance } = options;
   let tolerance = 0;
   if (typeof clockTolerance == "string")
@@ -790,20 +797,20 @@ function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
     tolerance = clockTolerance;
   }
   validateInput("clockTolerance option", tolerance);
-  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === undefined ? /* @__PURE__ */ new Date : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== undefined), nbf = validateNumericDate(payload, "nbf");
+  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === undefined ? /* @__PURE__ */ new Date : currentDate)), iat = validateNumericDate(claimsSet, "iat", maxTokenAge !== undefined), nbf = validateNumericDate(claimsSet, "nbf");
   if (nbf !== undefined && nbf > now + tolerance)
-    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
-  const exp = validateNumericDate(payload, "exp");
+    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', claimsSet, "nbf", checkFailed);
+  const exp = validateNumericDate(claimsSet, "exp");
   if (exp !== undefined && exp <= now - tolerance)
-    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
+    throw new JWTExpired('"exp" claim timestamp check failed', claimsSet, "exp", checkFailed);
   if (maxTokenAge !== undefined) {
     const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
     if (age - tolerance > max)
-      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', claimsSet, "iat", checkFailed);
     if (age < -tolerance)
-      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', claimsSet, "iat", checkFailed);
   }
-  return payload;
+  return claimsSet;
 }
 
 // node_modules/jose/dist/webapi/jwt/verify.js
@@ -838,7 +845,9 @@ function createLocalJWKSet(jwks) {
   let snapshot;
   try {
     snapshot = structuredClone(jwks);
-  } catch {}
+  } catch (cause) {
+    throw new JWKSInvalid("JSON Web Key Set malformed", { cause });
+  }
   if (!isJwkSet(snapshot))
     throw new JWKSInvalid("JSON Web Key Set malformed");
   const metadata = snapshot.keys.map((jwk) => {
@@ -872,7 +881,7 @@ function isCloudflareWorkers() {
   return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 var USER_AGENT;
-(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.12");
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.13");
 var customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
   const response = await fetchImpl(url, {
@@ -881,14 +890,14 @@ async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
     redirect: "manual",
     headers
   }).catch((err) => {
-    throw err.name === "TimeoutError" ? new JWKSTimeout : err;
+    throw err.name === "TimeoutError" ? new JWKSTimeout(undefined, { cause: err }) : err;
   });
   if (response.status !== 200)
     throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
   try {
     return await response.json();
-  } catch {
-    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
+  } catch (cause) {
+    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON", { cause });
   }
 }
 var jwksCache = /* @__PURE__ */ Symbol();
@@ -9522,10 +9531,21 @@ async function sha256Hex2(text) {
 }
 
 // src/runtime/realtime/engine.ts
+function normalizeBroadcastTopic(raw) {
+  const topic = raw.trim().replace(/^realtime:/, "");
+  if (!topic)
+    throw new Error("broadcast topic is required");
+  return topic;
+}
+
 class RealtimeEngine {
   db;
   jwtSecret;
   resolveExternalToken;
+  static MAX_HTTP_BROADCAST_MESSAGES = 100;
+  static MAX_HTTP_BROADCAST_TOPIC_BYTES = 256;
+  static MAX_HTTP_BROADCAST_EVENT_BYTES = 256;
+  static MAX_HTTP_BROADCAST_PAYLOAD_BYTES = 1024 * 1024;
   connections = new Set;
   bindingCounter = 1;
   phxRefCounter = 1;
@@ -9572,6 +9592,47 @@ class RealtimeEngine {
       return { read: false, write: false };
     }
   }
+  async broadcastHttp(messages, ctx) {
+    if (messages.length === 0)
+      throw new Error("messages must not be empty");
+    if (messages.length > RealtimeEngine.MAX_HTTP_BROADCAST_MESSAGES) {
+      throw new Error(`messages must contain at most ${RealtimeEngine.MAX_HTTP_BROADCAST_MESSAGES} items`);
+    }
+    const normalized = [];
+    for (const message of messages) {
+      if (typeof message.topic !== "string")
+        throw new Error("broadcast topic must be a string");
+      if (typeof message.event !== "string")
+        throw new Error("broadcast event must be a string");
+      const topic = normalizeBroadcastTopic(message.topic);
+      if (new TextEncoder().encode(topic).byteLength > RealtimeEngine.MAX_HTTP_BROADCAST_TOPIC_BYTES) {
+        throw new Error("broadcast topic is too large");
+      }
+      const event = message.event.trim();
+      if (!event)
+        throw new Error("broadcast event is required");
+      if (new TextEncoder().encode(event).byteLength > RealtimeEngine.MAX_HTTP_BROADCAST_EVENT_BYTES) {
+        throw new Error("broadcast event is too large");
+      }
+      let payloadText;
+      try {
+        payloadText = JSON.stringify(message.payload ?? null);
+      } catch {
+        throw new Error("broadcast payload must be JSON serializable");
+      }
+      if (new TextEncoder().encode(payloadText).byteLength > RealtimeEngine.MAX_HTTP_BROADCAST_PAYLOAD_BYTES) {
+        throw new Error("broadcast payload is too large");
+      }
+      if (message.private === true) {
+        const access = await this.authorizePrivate(topic, ctx);
+        if (!access.write)
+          throw new Error(`not authorized to broadcast on private topic: ${topic}`);
+      }
+      normalized.push({ topic, event, payload: message.payload ?? null });
+    }
+    for (const message of normalized)
+      this.dispatchDbBroadcast(message);
+  }
   dispatchDbBroadcast(msg) {
     const full = `realtime:${msg.topic}`;
     for (const conn of this.connections) {
@@ -9772,8 +9833,7 @@ class RealtimeEngine {
       private: isPrivate,
       canBroadcast
     };
-    if (this.resolveExternalToken)
-      this.leaveChannel(conn, msg.topic);
+    this.leaveChannel(conn, msg.topic);
     conn.channels.set(msg.topic, channel);
     this.scheduleExternalExpiry(conn, channel);
     this.reply(conn, msg, "ok", {
@@ -9813,21 +9873,32 @@ class RealtimeEngine {
     if (channel.expiryTimer)
       clearTimeout(channel.expiryTimer);
     conn.channels.delete(topic);
-    const state = this.presence.get(topic);
-    if (state?.has(channel.presenceKey)) {
-      const metas = state.get(channel.presenceKey);
-      if (!metas)
-        return;
+    this.removePresence(channel);
+  }
+  removePresence(channel) {
+    const presenceRef = channel.presenceRef;
+    if (!presenceRef)
+      return;
+    channel.presenceRef = undefined;
+    const state = this.presence.get(channel.topic);
+    const current = state?.get(channel.presenceKey);
+    const leaving = current?.metas.find((meta) => meta.phx_ref === presenceRef);
+    if (!state || !current || !leaving)
+      return;
+    const remaining = current.metas.filter((meta) => meta.phx_ref !== presenceRef);
+    if (remaining.length > 0) {
+      state.set(channel.presenceKey, { metas: remaining });
+    } else {
       state.delete(channel.presenceKey);
       if (state.size === 0)
-        this.presence.delete(topic);
-      this.broadcastToTopic(topic, {
-        topic,
-        event: "presence_diff",
-        payload: { joins: {}, leaves: { [channel.presenceKey]: metas } },
-        ref: null
-      });
+        this.presence.delete(channel.topic);
     }
+    this.broadcastToTopic(channel.topic, {
+      topic: channel.topic,
+      event: "presence_diff",
+      payload: { joins: {}, leaves: { [channel.presenceKey]: { metas: [leaving] } } },
+      ref: null
+    });
   }
   scheduleExternalExpiry(conn, channel) {
     if (channel.expiryTimer)
@@ -9907,23 +9978,30 @@ class RealtimeEngine {
       return;
     const event = String(msg.payload?.event ?? "").toLowerCase();
     if (event === "track") {
-      const meta = {
-        ...msg.payload?.payload ?? {},
-        phx_ref: `F${this.phxRefCounter++}`
-      };
+      const payload = { ...msg.payload?.payload ?? {} };
+      delete payload.phx_ref;
+      delete payload.phx_ref_prev;
       let state = this.presence.get(msg.topic);
       if (!state) {
         state = new Map;
         this.presence.set(msg.topic, state);
       }
-      const previous = state.get(channel.presenceKey);
-      state.set(channel.presenceKey, { metas: [meta] });
+      const current = state.get(channel.presenceKey);
+      const previous = current?.metas.find((meta) => meta.phx_ref === channel.presenceRef);
+      const meta = {
+        ...payload,
+        phx_ref: `F${this.phxRefCounter++}`,
+        ...previous ? { phx_ref_prev: previous.phx_ref } : {}
+      };
+      const others = current?.metas.filter((meta) => meta.phx_ref !== channel.presenceRef) ?? [];
+      state.set(channel.presenceKey, { metas: [...others, meta] });
+      channel.presenceRef = meta.phx_ref;
       this.broadcastToTopic(msg.topic, {
         topic: msg.topic,
         event: "presence_diff",
         payload: {
           joins: { [channel.presenceKey]: { metas: [meta] } },
-          leaves: previous ? { [channel.presenceKey]: previous } : {}
+          leaves: previous ? { [channel.presenceKey]: { metas: [previous] } } : {}
         },
         ref: null
       });
@@ -9932,19 +10010,7 @@ class RealtimeEngine {
       return;
     }
     if (event === "untrack") {
-      const state = this.presence.get(msg.topic);
-      const metas = state?.get(channel.presenceKey);
-      if (state && metas) {
-        state.delete(channel.presenceKey);
-        if (state.size === 0)
-          this.presence.delete(msg.topic);
-        this.broadcastToTopic(msg.topic, {
-          topic: msg.topic,
-          event: "presence_diff",
-          payload: { joins: {}, leaves: { [channel.presenceKey]: metas } },
-          ref: null
-        });
-      }
+      this.removePresence(channel);
       if (msg.ref)
         this.reply(conn, msg, "ok", {});
     }
@@ -11929,6 +11995,11 @@ class StorageHandler {
     const rest = url.pathname.replace(/^\/storage\/v1\/?/, "").replace(/\/+$/, "");
     const method = req.method.toUpperCase();
     try {
+      if (rest === "status" && method === "GET") {
+        return json3(200, { status: "ok", name: "supacloud-lite-storage", version: SUPACLOUD_LITE_VERSION });
+      }
+      if (rest === "metrics" && method === "GET")
+        return await this.metrics(ctx);
       if (rest === "bucket" && method === "POST")
         return await this.createBucket(req, ctx);
       if (rest === "bucket" && method === "GET")
@@ -12049,6 +12120,37 @@ class StorageHandler {
       release();
     }
   }
+  async metrics(ctx) {
+    const denied = this.requireService(ctx);
+    if (denied)
+      return denied;
+    const [buckets, objects] = await Promise.all([
+      this.db.query(`select count(*)::int as count from storage.buckets`),
+      this.db.query(`select count(*)::int as count,
+                coalesce(sum(case when metadata->>'size' ~ '^[0-9]+$' then (metadata->>'size')::bigint else 0 end), 0) as bytes
+         from storage.objects`)
+    ]);
+    const bucketCount = buckets.rows[0]?.count ?? 0;
+    const objectCount = objects.rows[0]?.count ?? 0;
+    const objectBytes = Number(objects.rows[0]?.bytes ?? 0);
+    const body = [
+      "# HELP storage_buckets_total Number of storage buckets.",
+      "# TYPE storage_buckets_total gauge",
+      `storage_buckets_total ${bucketCount}`,
+      "# HELP storage_objects_total Number of storage object metadata rows.",
+      "# TYPE storage_objects_total gauge",
+      `storage_objects_total ${objectCount}`,
+      "# HELP storage_object_bytes_total Sum of declared object sizes in bytes.",
+      "# TYPE storage_object_bytes_total gauge",
+      `storage_object_bytes_total ${Number.isFinite(objectBytes) ? objectBytes : 0}`,
+      ""
+    ].join(`
+`);
+    return new Response(body, {
+      status: 200,
+      headers: { "content-type": "text/plain; version=0.0.4; charset=utf-8" }
+    });
+  }
   requireService(ctx) {
     if (ctx.role !== "service_role") {
       return storageError(403, "Unauthorized", "Bucket management requires the service_role key");
@@ -14416,6 +14518,9 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     if (smsInbox && (path === "/sms-inbox" || path.startsWith("/sms-inbox/"))) {
       return withCors(smsInbox.serve(req, url));
     }
+    if (path === "/storage/v1/status" && req.method === "GET") {
+      return withCors(await storage.handle(req, { role: "anon", claims: null }, url));
+    }
     if (path.startsWith("/storage/v1/object/public/") || path.startsWith("/storage/v1/object/sign/") || path.startsWith("/storage/v1/render/image/public/") || path.startsWith("/storage/v1/render/image/sign/")) {
       if (req.method === "GET" || req.method === "HEAD") {
         return withCors(await storage.handle(req, { role: "anon", claims: null }, url));
@@ -14451,6 +14556,50 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     const ctx = await resolveContext(req, url);
     if (ctx instanceof Response)
       return ctx;
+    if (path === "/realtime/v1/api/broadcast" || path === "/realtime/v1/api/broadcast/") {
+      if (req.method !== "POST") {
+        return withCors(new Response(JSON.stringify({ message: "Method not allowed" }), {
+          status: 405,
+          headers: { "content-type": "application/json", allow: "POST" }
+        }));
+      }
+      const contentType = req.headers.get("content-type") ?? "";
+      if (contentType && !contentType.includes("application/json")) {
+        return withCors(new Response(JSON.stringify({ message: "Content-Type must be application/json" }), {
+          status: 415,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      let body;
+      try {
+        body = await req.json();
+      } catch {
+        return withCors(new Response(JSON.stringify({ message: "Invalid JSON body" }), {
+          status: 400,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      const messages = typeof body === "object" && body !== null && "messages" in body ? body.messages : undefined;
+      if (!Array.isArray(messages)) {
+        return withCors(new Response(JSON.stringify({ message: "messages must be an array" }), {
+          status: 400,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      try {
+        await realtime.broadcastHttp(messages, ctx);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Broadcast failed";
+        return withCors(new Response(JSON.stringify({ message }), {
+          status: message.startsWith("not authorized") ? 403 : 400,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      return withCors(new Response(JSON.stringify({ message: "Broadcast sent" }), {
+        status: 202,
+        headers: { "content-type": "application/json" }
+      }));
+    }
     if (path.startsWith("/rest/v1"))
       return withCors(await rest.handle(req, ctx, url));
     if (path === "/graphql/v1" || path === "/graphql/v1/")
@@ -16889,6 +17038,81 @@ function sameStrings(left, right) {
   return left.length === right.length && left.every((value, index) => value === right[index]);
 }
 
+// src/runtime/node/production-readiness.ts
+import { isAbsolute, relative, resolve as resolve4 } from "path";
+var SNAPSHOT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+function within(parent, child) {
+  const rel = relative(resolve4(parent), resolve4(child));
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function loopback(host) {
+  return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]";
+}
+function absoluteHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return (url.protocol === "https:" || url.protocol === "http:" && loopback(url.hostname)) && !url.username && !url.password;
+  } catch {
+    return false;
+  }
+}
+function productionReadiness(input) {
+  const blockers = [];
+  const warnings = [];
+  const now = input.now ?? Date.now();
+  if (input.runtimeMode !== "strict") {
+    blockers.push("RUNTIME_MODE_NOT_STRICT: production functions require strict runtime mode");
+  }
+  if (input.storageBackend === "memory") {
+    blockers.push("MEMORY_STORAGE_NOT_DURABLE: memory storage loses objects on restart");
+  }
+  if (input.storageBackend === "fs") {
+    warnings.push("LOCAL_STORAGE_REQUIRES_DURABLE_VOLUME_AND_BACKUP");
+  }
+  if (input.storageBackend === "s3") {
+    warnings.push("S3_OBJECTS_NOT_INCLUDED_IN_SNAPSHOT: back up the bucket/prefix separately");
+  }
+  if (!loopback(input.host)) {
+    warnings.push("DIRECT_NETWORK_BIND_WITHOUT_LITE_TLS: terminate TLS in a trusted proxy or restrict the network boundary");
+  }
+  if (input.engine === "pglite") {
+    warnings.push("PGLITE_SINGLE_PROCESS_CAPACITY: validate the real schema, concurrency and Realtime load");
+  }
+  if (input.identityMode === "local") {
+    warnings.push("LOCAL_AUTH_IN_PRODUCTION: own account lifecycle, confirmation and password reset");
+  }
+  if (input.identityMode === "external" && !input.externalAuthProxyIssuer) {
+    warnings.push("EXTERNAL_AUTH_PROXY_NOT_CONFIGURED: cross-origin browser token/userinfo calls may fail CORS");
+  }
+  if (input.externalAuthProxyIssuer && !absoluteHttpUrl(input.externalAuthProxyIssuer)) {
+    blockers.push("EXTERNAL_AUTH_PROXY_ISSUER_INVALID: use an HTTPS issuer, or HTTP only on loopback");
+  }
+  if (!input.siteUrl) {
+    warnings.push("SITE_URL_NOT_CONFIGURED: set [auth].site_url for stable redirects");
+  } else if (!absoluteHttpUrl(input.siteUrl)) {
+    warnings.push("SITE_URL_NOT_HTTPS: production redirects should use HTTPS");
+  }
+  if (!input.apiUrl) {
+    warnings.push("API_URL_NOT_CONFIGURED: set the public API URL used by Auth and Functions");
+  } else if (!absoluteHttpUrl(input.apiUrl)) {
+    warnings.push("API_URL_NOT_HTTPS: production API URLs should use HTTPS");
+  }
+  if (within(input.projectDir, input.stateDir)) {
+    warnings.push("STATE_INSIDE_PROJECT: keep mutable state outside the reviewed project checkout");
+  }
+  if (input.dataDir && input.dataDir === input.storageDir) {
+    blockers.push("DATABASE_AND_STORAGE_PATH_OVERLAP: use separate directories");
+  } else if (input.dataDir && (within(input.dataDir, input.storageDir) || within(input.storageDir, input.dataDir))) {
+    warnings.push("DATABASE_AND_STORAGE_PATH_NESTED: keep database and storage trees independent");
+  }
+  if (input.latestSnapshotAt === undefined) {
+    warnings.push("NO_SNAPSHOT_FOUND: create and test a restore snapshot before promotion");
+  } else if (now - input.latestSnapshotAt > SNAPSHOT_MAX_AGE_MS) {
+    warnings.push("SNAPSHOT_STALE: newest snapshot is older than 7 days");
+  }
+  return { ready: blockers.length === 0, blockers, warnings };
+}
+
 // src/runtime/node/config-toml.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { join as join3 } from "path";
@@ -17477,7 +17701,7 @@ function isNotFound(error) {
 
 // src/project-runtime.ts
 import { chmod, link as link2, lstat as lstat2, mkdir as mkdir5, readFile as readFile7, realpath as realpath2, unlink as unlink2, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute2, join as join8, parse, relative as relative2, resolve as resolve4 } from "path";
+import { dirname as dirname6, isAbsolute as isAbsolute3, join as join8, parse, relative as relative3, resolve as resolve5 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
 // src/runtime/node/bun-server.ts
@@ -17499,7 +17723,11 @@ async function serveBun(backend, opts = {}) {
       const ip = srv.requestIP(req)?.address;
       if (ip)
         headers.set("x-supacloud-lite-remote-addr", ip);
-      return backend.fetch(new Request(req, { headers }));
+      const request = new Request(req, { headers });
+      const hookResponse = await opts.beforeRequest?.(request);
+      if (hookResponse)
+        return hookResponse;
+      return backend.fetch(request);
     },
     websocket: {
       open(ws) {
@@ -17529,7 +17757,7 @@ async function serveBun(backend, opts = {}) {
 
 // src/runtime/node/fs-driver.ts
 import { mkdir as mkdir3, readFile as readFile4, rename, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname4, isAbsolute, join as join5, relative, resolve as resolvePath, sep } from "path";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join5, relative as relative2, resolve as resolvePath, sep } from "path";
 
 class FsStorageDriver {
   root;
@@ -17539,8 +17767,8 @@ class FsStorageDriver {
   }
   resolve(key) {
     const path = join5(this.root, key);
-    const relativePath = relative(this.root, path);
-    if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)) {
+    const relativePath = relative2(this.root, path);
+    if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute2(relativePath)) {
       throw new Error(`invalid storage key: ${key}`);
     }
     return path;
@@ -17917,11 +18145,124 @@ class S3StorageDriver {
   }
 }
 
+// src/runtime/auth/proxy.ts
+var ALLOWED_ROUTES = {
+  "/auth/v1/oauth/token": new Set(["POST"]),
+  "/auth/v1/oauth/userinfo": new Set(["GET"]),
+  "/auth/v1/logout": new Set(["GET", "POST"])
+};
+var FORWARD_REQUEST_HEADERS = ["accept", "authorization", "content-type", "apikey"];
+var FORWARD_RESPONSE_HEADERS = [
+  "content-type",
+  "cache-control",
+  "retry-after",
+  "www-authenticate"
+];
+function proxyError(status, code, message, allow) {
+  const headers = new Headers({
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store"
+  });
+  if (allow)
+    headers.set("allow", allow);
+  return new Response(JSON.stringify({ code, message }), { status, headers });
+}
+function upstreamBase(issuer) {
+  let url;
+  try {
+    url = new URL(issuer);
+  } catch {
+    throw new TypeError("External auth issuer must be an absolute URL");
+  }
+  const loopback = url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]" || url.hostname === "::1";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new TypeError("External auth issuer must use HTTPS (HTTP is allowed only on loopback)");
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new TypeError("External auth issuer must not contain credentials, query or fragment");
+  }
+  if (url.pathname.replace(/\/+$/, "") !== "/auth/v1") {
+    throw new TypeError("External auth issuer must end with /auth/v1");
+  }
+  return url;
+}
+function redirectOrigins(base, extra = []) {
+  const origins = new Set([base.origin]);
+  for (const value of extra) {
+    let origin;
+    try {
+      origin = new URL(value);
+    } catch {
+      throw new TypeError("External auth redirect origin must be an absolute URL");
+    }
+    const loopback = origin.hostname === "127.0.0.1" || origin.hostname === "localhost" || origin.hostname === "[::1]" || origin.hostname === "::1";
+    if (origin.protocol !== "https:" && !(origin.protocol === "http:" && loopback)) {
+      throw new TypeError("External auth redirect origin must use HTTPS (HTTP is allowed only on loopback)");
+    }
+    if (origin.username || origin.password || origin.search || origin.hash) {
+      throw new TypeError("External auth redirect origin must not contain credentials, query or fragment");
+    }
+    origins.add(origin.origin);
+  }
+  return origins;
+}
+function createExternalAuthProxy(options) {
+  const base = upstreamBase(options.issuer);
+  const allowedRedirects = redirectOrigins(base, options.allowedRedirectOrigins);
+  const fetcher = options.fetch ?? globalThis.fetch;
+  if (typeof fetcher !== "function")
+    throw new TypeError("External auth proxy requires fetch");
+  return async (request) => {
+    const source = new URL(request.url);
+    const methods = ALLOWED_ROUTES[source.pathname];
+    if (!methods)
+      return null;
+    if (!methods.has(request.method)) {
+      return proxyError(405, "AUTH_PROXY_METHOD_NOT_ALLOWED", "Auth proxy method is not allowed", [...methods].join(", "));
+    }
+    const target = new URL(source.pathname + source.search, base.origin);
+    const headers = new Headers;
+    for (const name of FORWARD_REQUEST_HEADERS) {
+      const value = request.headers.get(name);
+      if (value !== null)
+        headers.set(name, value);
+    }
+    const body = request.method === "GET" || request.method === "HEAD" ? undefined : await request.arrayBuffer();
+    let upstream;
+    try {
+      upstream = await fetcher(target, {
+        method: request.method,
+        headers,
+        body,
+        redirect: "manual"
+      });
+    } catch {
+      return proxyError(503, "AUTH_PROXY_UNAVAILABLE", "Identity service is temporarily unavailable");
+    }
+    const responseHeaders = new Headers;
+    for (const name of FORWARD_RESPONSE_HEADERS) {
+      const value = upstream.headers.get(name);
+      if (value !== null)
+        responseHeaders.set(name, value);
+    }
+    const location = upstream.headers.get("location");
+    if (location !== null) {
+      const resolved = new URL(location, base.origin);
+      if (!allowedRedirects.has(resolved.origin)) {
+        return proxyError(502, "AUTH_PROXY_REDIRECT_REJECTED", "Identity service redirect was rejected");
+      }
+      responseHeaders.set("location", resolved.href);
+    }
+    responseHeaders.set("cache-control", "no-store");
+    return new Response(upstream.body, { status: upstream.status, headers: responseHeaders });
+  };
+}
+
 // src/project-runtime.ts
 var RESET_INITIALIZATION_ERROR = 'db reset requires initialized state; run "supacloud-lite migrate" first';
 var RESET_INVALID_SECRETS_ERROR = "db reset requires a valid project secrets marker; restore the state before retrying";
 function resolveProjectPaths(options = {}) {
-  const projectDir = resolve4(options.projectDir ?? process.cwd());
+  const projectDir = resolve5(options.projectDir ?? process.cwd());
   const stateDir = resolvePath2(projectDir, options.stateDir ?? process.env.SUPACLOUD_LITE_STATE_DIR ?? ".supacloud-lite");
   const databaseEngine = resolveDatabaseEngine(options.engine, options.memory);
   const dataDir = options.memory ? undefined : resolvePath2(projectDir, options.dataDir ?? process.env.SUPACLOUD_LITE_DATA_DIR ?? join8(stateDir, databaseEngine === "native" ? "pgdata" : "db"));
@@ -17936,7 +18277,7 @@ function resolveProjectPaths(options = {}) {
   };
 }
 async function assertResetPathsSafe(paths) {
-  const stateDir = resolve4(paths.stateDir);
+  const stateDir = resolve5(paths.stateDir);
   if (stateDir === parse(stateDir).root)
     throw new Error("refusing to use the filesystem root as the state directory");
   const stateInfo = await requiredResetEntry(stateDir);
@@ -17944,7 +18285,7 @@ async function assertResetPathsSafe(paths) {
     throw new Error(`refusing to reset through an invalid state directory: ${stateDir}`);
   }
   const canonicalStateDir = await realpath2(stateDir);
-  const secretsFile = resolve4(paths.secretsFile);
+  const secretsFile = resolve5(paths.secretsFile);
   if (secretsFile !== join8(stateDir, "secrets.json")) {
     throw new Error(`refusing to reset a state directory with an invalid secrets marker path: ${secretsFile}`);
   }
@@ -17958,9 +18299,9 @@ async function assertResetPathsSafe(paths) {
     ["storage", paths.storageDir]
   ];
   for (const [label, targetPath] of targets) {
-    const target = resolve4(targetPath);
-    const relativePath = relative2(stateDir, target);
-    if (!relativePath || relativePath.startsWith("..") || isAbsolute2(relativePath)) {
+    const target = resolve5(targetPath);
+    const relativePath = relative3(stateDir, target);
+    if (!relativePath || relativePath.startsWith("..") || isAbsolute3(relativePath)) {
       throw new Error(`refusing to reset ${label} path outside the state directory: ${target}`);
     }
     await assertResetTargetCanonical(stateDir, canonicalStateDir, target, label);
@@ -18007,9 +18348,9 @@ async function assertResetTargetCanonical(stateDir, canonicalStateDir, target, l
     current = parent;
   }
   const existingAncestor = await nearestExistingAncestor(target);
-  const canonicalTarget = resolve4(await realpath2(existingAncestor), relative2(existingAncestor, target));
-  const canonicalRelative = relative2(canonicalStateDir, canonicalTarget);
-  if (!canonicalRelative || canonicalRelative.startsWith("..") || isAbsolute2(canonicalRelative)) {
+  const canonicalTarget = resolve5(await realpath2(existingAncestor), relative3(existingAncestor, target));
+  const canonicalRelative = relative3(canonicalStateDir, canonicalTarget);
+  if (!canonicalRelative || canonicalRelative.startsWith("..") || isAbsolute3(canonicalRelative)) {
     throw new Error(`refusing to reset ${label} path outside the canonical state directory: ${target}`);
   }
 }
@@ -18185,7 +18526,7 @@ async function loadProjectBindings(projectDir, config) {
   const bindings = config.lite.migrationBindings;
   if (!bindings)
     return;
-  const manifest = JSON.parse(await readFile7(resolve4(projectDir, bindings.manifest), "utf8"));
+  const manifest = JSON.parse(await readFile7(resolve5(projectDir, bindings.manifest), "utf8"));
   return {
     manifest,
     target: { environment: bindings.environment, projectRef: bindings.projectRef },
@@ -18195,7 +18536,7 @@ async function loadProjectBindings(projectDir, config) {
 async function loadProjectIdentity(projectDir, module) {
   if (!module)
     return;
-  const imported = await import(pathToFileURL3(resolve4(projectDir, module)).href);
+  const imported = await import(pathToFileURL3(resolve5(projectDir, module)).href);
   if (!isRecord(imported) || typeof imported["default"] !== "function") {
     throw new Error("Lite identity module must default-export an external identity verifier");
   }
@@ -18261,7 +18602,11 @@ async function startProjectServer(options = {}) {
   const resolvedOptions = options.port === 0 ? { ...options, port: await findEphemeralPort(options.host) } : options;
   const project = await createProjectBackend({ ...resolvedOptions, startRuntimeServices: true });
   try {
-    const server = await serveBun(project.backend, { host: project.host, port: project.port });
+    const beforeRequest = options.externalAuthProxyIssuer ? createExternalAuthProxy({
+      issuer: options.externalAuthProxyIssuer,
+      allowedRedirectOrigins: options.externalAuthProxyRedirectOrigins
+    }) : undefined;
+    const server = await serveBun(project.backend, { host: project.host, port: project.port, beforeRequest });
     let closePromise = null;
     return {
       ...project,
@@ -18303,7 +18648,7 @@ async function loadWebhooks(projectDir) {
   }
 }
 function resolvePath2(projectDir, path) {
-  return isAbsolute2(path) ? path : resolve4(projectDir, path);
+  return isAbsolute3(path) ? path : resolve5(projectDir, path);
 }
 function randomHex(bytes) {
   const value = crypto.getRandomValues(new Uint8Array(bytes));
@@ -18349,7 +18694,7 @@ async function findEphemeralPort(host = "127.0.0.1") {
 
 // src/snapshot.ts
 import { chmod as chmod2, copyFile, lstat as lstat3, mkdir as mkdir6, mkdtemp, readdir as readdir3, readFile as readFile8, rename as rename2, rm as rm5, writeFile as writeFile6 } from "fs/promises";
-import { dirname as dirname7, join as join9, parse as parse2, relative as relative3, resolve as resolve5, sep as sep2 } from "path";
+import { dirname as dirname7, join as join9, parse as parse2, relative as relative4, resolve as resolve6, sep as sep2 } from "path";
 import { create as createTar, extract as extractTar2 } from "tar";
 var SNAPSHOT_FORMAT = "supacloud-lite-snapshot";
 var SNAPSHOT_VERSION = 1;
@@ -18373,7 +18718,7 @@ async function createSnapshot(options) {
       postgresMajor: await readPostgresMajor(paths.dataDir)
     } : {}
   };
-  const output = resolve5(options.output);
+  const output = resolve6(options.output);
   if (await existingInfo(output))
     throw new Error(`snapshot output already exists: ${output}`);
   await mkdir6(dirname7(output), { recursive: true });
@@ -18414,7 +18759,7 @@ async function restoreSnapshot(options) {
     await mkdir6(payloadRoot, { recursive: true });
     await extractTar2({
       cwd: payloadRoot,
-      file: resolve5(options.input),
+      file: resolve6(options.input),
       preserveOwner: false,
       preservePaths: false,
       strict: true,
@@ -18457,10 +18802,10 @@ async function restoreSnapshot(options) {
     await mkdir6(stateStage, { recursive: true });
     await copyEntry(join9(payloadRoot, "secrets.json"), join9(stateStage, "secrets.json"));
     if (paths.dataDir && isWithin(paths.stateDir, paths.dataDir)) {
-      await copyEntry(join9(payloadRoot, "database"), join9(stateStage, relative3(paths.stateDir, paths.dataDir)));
+      await copyEntry(join9(payloadRoot, "database"), join9(stateStage, relative4(paths.stateDir, paths.dataDir)));
     }
     if (options.storageBackend === "fs" && isWithin(paths.stateDir, paths.storageDir)) {
-      await copyEntry(join9(payloadRoot, "storage"), join9(stateStage, relative3(paths.stateDir, paths.storageDir)));
+      await copyEntry(join9(payloadRoot, "storage"), join9(stateStage, relative4(paths.stateDir, paths.storageDir)));
     }
     const swaps = [];
     try {
@@ -18494,11 +18839,11 @@ async function restoreSnapshot(options) {
 function normalizePaths(paths) {
   return {
     ...paths,
-    projectDir: resolve5(paths.projectDir),
-    stateDir: resolve5(paths.stateDir),
-    dataDir: paths.dataDir ? resolve5(paths.dataDir) : undefined,
-    storageDir: resolve5(paths.storageDir),
-    secretsFile: resolve5(paths.secretsFile)
+    projectDir: resolve6(paths.projectDir),
+    stateDir: resolve6(paths.stateDir),
+    dataDir: paths.dataDir ? resolve6(paths.dataDir) : undefined,
+    storageDir: resolve6(paths.storageDir),
+    secretsFile: resolve6(paths.secretsFile)
   };
 }
 async function assertSnapshotPaths(paths, options = {}) {
@@ -18528,7 +18873,7 @@ async function assertSnapshotPaths(paths, options = {}) {
 async function assertDirectoryOrMissing(path) {
   if (!path)
     return;
-  if (resolve5(path) === parse2(resolve5(path)).root)
+  if (resolve6(path) === parse2(resolve6(path)).root)
     throw new Error(`snapshot path must not be the filesystem root: ${path}`);
   try {
     const info = await lstat3(path);
@@ -18751,13 +19096,13 @@ async function assertNoSymlinks(root) {
   }
 }
 function isWithin(parent, child) {
-  const normalizedParent = resolve5(parent);
-  const normalizedChild = resolve5(child);
+  const normalizedParent = resolve6(parent);
+  const normalizedChild = resolve6(child);
   return normalizedChild !== normalizedParent && normalizedChild.startsWith(`${normalizedParent}${sep2}`);
 }
 function pathsOverlap(left, right) {
-  const normalizedLeft = resolve5(left);
-  const normalizedRight = resolve5(right);
+  const normalizedLeft = resolve6(left);
+  const normalizedRight = resolve6(right);
   return normalizedLeft === normalizedRight || isWithin(normalizedLeft, normalizedRight) || isWithin(normalizedRight, normalizedLeft);
 }
 
@@ -18870,7 +19215,8 @@ function parseArgs(argv) {
     port: process.env.SUPACLOUD_LITE_PORT || process.env.PORT ? Number.parseInt(process.env.SUPACLOUD_LITE_PORT ?? process.env.PORT, 10) : 54321,
     serviceRole: false,
     force: false,
-    json: false
+    json: false,
+    production: false
   };
   for (let index = 0;index < args.length; index++) {
     const argument = args[index];
@@ -18889,13 +19235,13 @@ function parseArgs(argv) {
     else if (argument === "--site-url")
       options.siteUrl = next();
     else if (argument === "--project-dir" || argument === "--dir")
-      options.projectDir = resolve6(next());
+      options.projectDir = resolve7(next());
     else if (argument === "--state-dir")
-      options.stateDir = resolve6(next());
+      options.stateDir = resolve7(next());
     else if (argument === "--data-dir")
-      options.dataDir = resolve6(next());
+      options.dataDir = resolve7(next());
     else if (argument === "--storage-dir")
-      options.storageDir = resolve6(next());
+      options.storageDir = resolve7(next());
     else if (argument === "--storage-backend")
       options.storageBackend = next();
     else if (argument === "--s3-prefix")
@@ -18905,9 +19251,13 @@ function parseArgs(argv) {
     else if (argument === "--runtime-mode")
       options.runtimeMode = runtimeMode(next());
     else if (argument === "--postgres-dir")
-      options.postgresDir = resolve6(next());
+      options.postgresDir = resolve7(next());
     else if (argument === "--identity-module")
-      options.identityModule = resolve6(next());
+      options.identityModule = resolve7(next());
+    else if (argument === "--external-auth-proxy-issuer")
+      options.externalAuthProxyIssuer = next();
+    else if (argument === "--external-auth-proxy-redirect-origin")
+      options.externalAuthProxyRedirectOrigins = commaSeparated2(next());
     else if (argument === "--replication-profile") {
       options.replicationProfile = next();
     } else if (argument === "--replication-host")
@@ -18919,25 +19269,27 @@ function parseArgs(argv) {
     else if (argument === "--powersync-tables")
       options.powersyncPublicationTables = commaSeparated2(next());
     else if (argument === "--replication-tls-cert")
-      options.replicationTlsCertFile = resolve6(next());
+      options.replicationTlsCertFile = resolve7(next());
     else if (argument === "--replication-tls-key")
-      options.replicationTlsKeyFile = resolve6(next());
+      options.replicationTlsKeyFile = resolve7(next());
     else if (argument === "--memory")
       options.memory = true;
     else if (argument === "--output" || argument === "-o")
-      options.output = resolve6(next());
+      options.output = resolve7(next());
     else if (argument === "--file" || argument === "-f")
       options.diffFile = next();
     else if (argument === "--baseline")
       options.baseline = true;
     else if (argument === "--module-file")
-      options.moduleFile = resolve6(next());
+      options.moduleFile = resolve7(next());
     else if (argument === "--service-role")
       options.serviceRole = true;
     else if (argument === "--force")
       options.force = true;
     else if (argument === "--json")
       options.json = true;
+    else if (argument === "--production")
+      options.production = true;
     else if (argument === "--email")
       options.email = next();
     else if (argument === "--password-stdin")
@@ -19085,6 +19437,23 @@ ${privilegedKey}
     }
     if (config.lite.graphql.enabled === false)
       report.graphql = { status: "disabled", extension: "pg_graphql" };
+    if (options.production) {
+      report.production_readiness = productionReadiness({
+        engine: paths.databaseEngine,
+        runtimeMode: config.lite.runtimeMode,
+        storageBackend: resolveStorageBackend(options.storageBackend),
+        identityMode: options.identityModule ?? config.lite.identityModule ? "external" : "local",
+        host: options.host ?? "127.0.0.1",
+        projectDir: paths.projectDir,
+        stateDir: paths.stateDir,
+        storageDir: paths.storageDir,
+        dataDir: paths.dataDir,
+        apiUrl: options.apiUrl ?? process.env.SUPACLOUD_LITE_API_URL,
+        siteUrl: options.siteUrl ?? process.env.SUPACLOUD_LITE_SITE_URL,
+        externalAuthProxyIssuer: options.externalAuthProxyIssuer,
+        latestSnapshotAt: latestSnapshotTimestamp(paths.stateDir)
+      });
+    }
     if (options.json)
       await writeStandardOutput(`${JSON.stringify(report, null, 2)}
 `);
@@ -19094,6 +19463,8 @@ ${privilegedKey}
       process.exitCode = 1;
     if (report.powersync_readiness?.ready === false)
       process.exitCode = 1;
+    if (report.production_readiness?.ready === false)
+      process.exitCode = 1;
     return;
   }
   if (options.command === "migrate" || options.command === "status") {
@@ -19181,7 +19552,7 @@ async function runDbCommand(options) {
     }
     return;
   }
-  const projectDir = resolve6(options.projectDir ?? process.cwd());
+  const projectDir = resolve7(options.projectDir ?? process.cwd());
   const config = loadProjectConfig(projectDir, process.env, options.runtimeMode);
   const project = await loadSupabaseProject(projectDir, {
     enabled: false,
@@ -19302,7 +19673,7 @@ async function runSnapshotCommand(options) {
     const rollbackLines = result.rollbackPaths.map((rollbackPath) => `Previous state retained at ${rollbackPath}`);
     const reconnectLine = result.manifest.storageBackend === "s3" ? ["Reconnect the original S3 bucket/prefix before starting Lite."] : [];
     await writeStandardOutput([
-      `Snapshot restored from ${resolve6(input)}`,
+      `Snapshot restored from ${resolve7(input)}`,
       ...rollbackLines,
       ...reconnectLine
     ].join(`
@@ -19345,6 +19716,21 @@ async function runUpgradeCommand(options) {
     throw new Error(`upgrade failed; snapshot retained at ${output}. Restore it with ` + `"supacloud-lite snapshot restore ${output} --force". ${error instanceof Error ? error.message : String(error)}`);
   }
 }
+function latestSnapshotTimestamp(stateDir) {
+  let newest;
+  for (const directory of [stateDir, join10(stateDir, "backups")]) {
+    if (!existsSync5(directory))
+      continue;
+    for (const name of readdirSync(directory)) {
+      if (!name.endsWith(".tar.gz"))
+        continue;
+      const modified = statSync2(join10(directory, name)).mtimeMs;
+      if (newest === undefined || modified > newest)
+        newest = modified;
+    }
+  }
+  return newest;
+}
 async function printInspection(rows) {
   if (rows.length === 0) {
     await writeStandardOutput(`No tables in schema "public".
@@ -19374,6 +19760,13 @@ async function printDoctor(report) {
     for (const warning of report.powersync_readiness.warnings)
       output.push(`warning: ${warning}`);
   }
+  if (report.production_readiness) {
+    output.push(`production_ready: ${report.production_readiness.ready}`);
+    for (const blocker of report.production_readiness.blockers)
+      output.push(`production_blocker: ${blocker}`);
+    for (const warning of report.production_readiness.warnings)
+      output.push(`production_warning: ${warning}`);
+  }
   await writeStandardOutput(`${output.join(`
 `)}
 `);
@@ -19444,6 +19837,10 @@ Options:
       --runtime-mode      development (default) or strict
       --postgres-dir      operator-managed PostgreSQL installation (native only)
       --identity-module   trusted external identity bridge module
+      --external-auth-proxy-issuer <url>
+                           proxy OAuth token/userinfo/logout to this external issuer
+      --external-auth-proxy-redirect-origin <origin>
+                           allowed logout redirect origin (repeatable list via commas)
   -o, --output <p>        output file for gen types
   -f, --file <name>       migration suffix for db diff
   --baseline             db pull: write and record already-present schema as a migration