@supacloud/lite 0.33.1 → 0.34.0

package/dist/index.js

@@ -88,7 +88,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.33.1",
+  version: "0.34.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -108,6 +108,7 @@ var package_default = {
     "dist",
     "!dist/standalone",
     "README.md",
+    "deploy",
     "CHANGELOG.md",
     "RELEASING.md",
     "THIRD_PARTY_NOTICES.md",
@@ -127,7 +128,7 @@ var package_default = {
     clean: "bun -e 'import { $ } from \"bun\"; await $`rm -rf dist`'",
     dev: "bun run src/cli.ts start",
     start: "bun run src/cli.ts start",
-    test: "bun test --timeout 20000",
+    test: "bun run scripts/run-tests.ts",
     "test:native": "SUPACLOUD_LITE_TEST_NATIVE=1 bun test test/native-engine.test.ts test/qauth-workflow-matrix.test.ts test/maker-checker-workflow.test.ts test/commands-artifacts.test.ts --timeout 180000",
     "test:graphql": "SUPACLOUD_LITE_TEST_GRAPHQL=1 bun test test/graphql-native.test.ts --timeout 180000",
     benchmark: "bun run scripts/benchmark.ts",
@@ -147,31 +148,31 @@ var package_default = {
     "@electric-sql/pglite-pgmq": "0.0.8",
     "@electric-sql/pglite-pgvector": "0.0.11",
     "@electric-sql/pglite-postgis": "0.2.10",
-    "@supacloud/db": "0.20.0",
+    "@supacloud/db": "0.20.1",
     "exact-mirror": "1.2.6",
     tar: "^7.5.22",
-    typebox: "1.3.37"
+    typebox: "1.4.2"
   },
   devDependencies: {
-    "@supacloud/app": "0.31.0",
-    "@supacloud/contracts": "0.13.0",
-    "@supacloud/compiler": "0.50.0",
-    "@supacloud/elysia": "0.35.1",
+    "@supacloud/app": "0.33.0",
+    "@supacloud/contracts": "0.15.1",
+    "@supacloud/compiler": "0.51.1",
+    "@supacloud/elysia": "0.36.1",
     "@supabase/supabase-js": "^2.118.0",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
-    elysia: "2.0.0-beta.32",
-    jose: "^6.2.12",
+    elysia: "2.0.0-rc.0",
+    jose: "^6.2.13",
     typescript: "^7.0.2"
   },
   overrides: {
-    "@supacloud/db": "0.20.0",
-    "@supacloud/app": "0.31.0",
-    "@supacloud/compiler": "0.50.0",
-    "@supacloud/elysia": "0.35.1",
-    "@supacloud/contracts": "0.13.0",
-    "@supacloud/commands": "0.11.0",
-    "@supacloud/delivery": "0.21.0",
+    "@supacloud/db": "0.20.1",
+    "@supacloud/app": "0.33.0",
+    "@supacloud/compiler": "0.51.1",
+    "@supacloud/elysia": "0.36.1",
+    "@supacloud/contracts": "0.15.1",
+    "@supacloud/commands": "0.11.1",
+    "@supacloud/delivery": "0.21.1",
     "@graphql-tools/utils": "^12.0.4"
   },
   engines: {
@@ -251,7 +252,7 @@ function isAllowedRedirect(requested, siteUrl, allowList = []) {
 var encoder2 = new TextEncoder;
 var decoder2 = new TextDecoder;
 var strictDecoder = new TextDecoder("utf-8", { fatal: true });
-var MAX_INT32 = 2 ** 32;
+var UINT32_RANGE = 2 ** 32;
 function concat(...buffers) {
   const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
   let i = 0;
@@ -410,23 +411,23 @@ function isDisjoint(...headers) {
 function decodeBase64url(value, label, ErrorClass) {
   try {
     return decode(value);
-  } catch {
-    throw new ErrorClass(`Failed to base64url decode the ${label}`);
+  } catch (cause) {
+    throw new ErrorClass(`Failed to base64url decode the ${label}`, { cause });
   }
 }
-function encodeBase64url(value, label, ErrorClass) {
+function encodeAsciiMember(value, label, ErrorClass) {
   try {
     return encode(value);
-  } catch {
-    throw new ErrorClass(`The ${label} is not a valid base64url string`);
+  } catch (cause) {
+    throw new ErrorClass(`The ${label} is not a valid base64url string`, { cause });
   }
 }
-function parseJoseHeader(b64, ErrorClass, message) {
+function parseJoseHeader(encodedProtectedHeader, ErrorClass, message) {
   let parsed;
   try {
-    parsed = JSON.parse(strictDecoder.decode(decode(b64)));
-  } catch {
-    throw new ErrorClass(message);
+    parsed = JSON.parse(strictDecoder.decode(decode(encodedProtectedHeader)));
+  } catch (cause) {
+    throw new ErrorClass(message, { cause });
   }
   if (!isObject(parsed))
     throw new ErrorClass(message);
@@ -484,15 +485,15 @@ var jwkMatchesOp = (entry, key, usage) => {
   }
 };
 async function prepareKey(entry, key, usage) {
-  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+  const { alg, secret } = entry, requiresPrivateKey = usage === "decrypt" || usage === "sign";
   if (secret && key instanceof Uint8Array)
     return key;
   let normalized, keyObject;
   if (isObject(key)) {
     if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
       throw invalidKeyType(alg, key, secret);
-    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === undefined && normalized.priv === undefined)))
-      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (requiresPrivateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === undefined && normalized.priv === undefined)))
+      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${requiresPrivateKey ? "private" : "public"} JWK`);
     if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
       return decode(normalized.k);
     if (!Object.isFrozen(key)) {
@@ -502,7 +503,7 @@ async function prepareKey(entry, key, usage) {
   } else {
     if (!isKeyLike(key))
       throw invalidKeyType(alg, key, secret);
-    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+    const expectedType = secret ? "secret" : requiresPrivateKey ? "private" : "public";
     if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
       throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
     if (isCryptoKey(key))
@@ -641,8 +642,8 @@ function eddsa() {
     usages: sig
   };
 }
-function mldsa(bits) {
-  const subtle = { name: `ML-DSA-${bits}` };
+function mldsa(parameterSet) {
+  const subtle = { name: `ML-DSA-${parameterSet}` };
   return {
     kty: ["AKP"],
     subtle,
@@ -680,21 +681,23 @@ function jwsAlgorithm(alg) {
 function prepareVerify(options) {
   return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
 }
-function parseProtectedHeader(encodedProtected) {
-  return encodedProtected === undefined ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+function parseProtectedHeader(encodedProtectedHeader) {
+  return encodedProtectedHeader === undefined ? {} : parseJoseHeader(encodedProtectedHeader, JWSInvalid, "JWS Protected Header is invalid");
 }
 function encodeCompactUnencodedPayload(payload) {
   try {
     return encode(payload);
-  } catch {
-    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
+  } catch (cause) {
+    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters", {
+      cause
+    });
   }
 }
 async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
-  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
-  if (!isDisjoint(parsedProt, header))
+  const { protected: encodedProtectedHeader, header, payload: inputPayload } = jws, protectedHeader = parsedProtected ?? parseProtectedHeader(encodedProtectedHeader);
+  if (!isDisjoint(protectedHeader, header))
     throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+  const joseHeader = { ...protectedHeader, ...header }, b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], protectedHeader, joseHeader)), { alg } = joseHeader;
   if (typeof alg != "string" || !alg)
     throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
   if (shared[0] && !shared[0].has(alg))
@@ -706,17 +709,19 @@ async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedP
     throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
   const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
   let resolvedKey = false;
-  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = true);
-  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== undefined ? encode(encodedProtected) : new Uint8Array, encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+  typeof key == "function" && (key = await key(protectedHeader, jws), resolvedKey = true);
+  const entry = jwsAlgorithm(alg), signingInput = concat(encodedProtectedHeader !== undefined ? encode(encodedProtectedHeader) : new Uint8Array, encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeAsciiMember(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), verificationKey = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(verificationKey, entry.subtle, "verify");
   entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
   let verified = false;
   try {
-    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
-  } catch {}
+    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, signingInput);
+  } catch (cause) {
+    throw new JWSSignatureVerificationFailed(undefined, { cause });
+  }
   if (!verified)
     throw new JWSSignatureVerificationFailed;
   const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
-  return encodedProtected !== undefined && (result.protectedHeader = parsedProt), header !== undefined && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];
+  return encodedProtectedHeader !== undefined && (result.protectedHeader = protectedHeader), header !== undefined && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: verificationKey }, b64] : [result, b64];
 }
 async function verifyCompact(jws, shared, key) {
   if (jws instanceof Uint8Array && (jws = decoder2.decode(jws)), typeof jws != "string")
@@ -746,8 +751,8 @@ function secs(str) {
   typeof str != "string" && invalidDuration();
   const matched = REGEX.exec(str);
   (!matched || matched[4] && matched[1]) && invalidDuration();
-  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
+  const value = parseFloat(matched[2]), durationSeconds = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(durationSeconds) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -durationSeconds : durationSeconds;
 }
 function validateInput(label, input) {
   if (!Number.isFinite(input))
@@ -759,33 +764,35 @@ var normalizeTyp = (value) => {
   return value.includes("/") ? normalized : `application/${normalized}`;
 };
 var checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : false;
-function validateNumericDate(payload, claim, required = false) {
-  const value = payload[claim];
+function validateNumericDate(claimsSet, claim, required = false) {
+  const value = claimsSet[claim];
   if (!(value === undefined && !required)) {
     if (typeof value != "number")
-      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, claimsSet, claim, "invalid");
     return value;
   }
 }
-function unexpectedClaim(payload, claim) {
-  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+function unexpectedClaim(claimsSet, claim) {
+  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, claimsSet, claim, checkFailed);
 }
-function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
-  let payload;
+function validateClaimsSet(protectedHeader, claimsSetBytes, options = {}) {
+  let claimsSet;
   try {
-    payload = JSON.parse(strictDecoder.decode(encodedPayload));
-  } catch {}
-  if (!isObject(payload))
+    claimsSet = JSON.parse(strictDecoder.decode(claimsSetBytes));
+  } catch (cause) {
+    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object", { cause });
+  }
+  if (!isObject(claimsSet))
     throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
   const { typ } = options;
   if (typ !== undefined && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
-    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', claimsSet, "typ", checkFailed);
   const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
   maxTokenAge !== undefined && presenceCheck.push("iat"), audience !== undefined && presenceCheck.push("aud"), subject !== undefined && presenceCheck.push("sub"), issuer !== undefined && presenceCheck.push("iss");
   for (const claim of new Set(presenceCheck.reverse()))
-    if (!Object.hasOwn(payload, claim))
-      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
-  issuer !== undefined && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== undefined && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== undefined && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+    if (!Object.hasOwn(claimsSet, claim))
+      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, claimsSet, claim, "missing");
+  issuer !== undefined && !(Array.isArray(issuer) ? issuer : [issuer]).includes(claimsSet.iss) && unexpectedClaim(claimsSet, "iss"), subject !== undefined && claimsSet.sub !== subject && unexpectedClaim(claimsSet, "sub"), audience !== undefined && !checkAudiencePresence(claimsSet.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(claimsSet, "aud");
   const { clockTolerance } = options;
   let tolerance = 0;
   if (typeof clockTolerance == "string")
@@ -796,20 +803,20 @@ function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
     tolerance = clockTolerance;
   }
   validateInput("clockTolerance option", tolerance);
-  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === undefined ? /* @__PURE__ */ new Date : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== undefined), nbf = validateNumericDate(payload, "nbf");
+  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === undefined ? /* @__PURE__ */ new Date : currentDate)), iat = validateNumericDate(claimsSet, "iat", maxTokenAge !== undefined), nbf = validateNumericDate(claimsSet, "nbf");
   if (nbf !== undefined && nbf > now + tolerance)
-    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
-  const exp = validateNumericDate(payload, "exp");
+    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', claimsSet, "nbf", checkFailed);
+  const exp = validateNumericDate(claimsSet, "exp");
   if (exp !== undefined && exp <= now - tolerance)
-    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
+    throw new JWTExpired('"exp" claim timestamp check failed', claimsSet, "exp", checkFailed);
   if (maxTokenAge !== undefined) {
     const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
     if (age - tolerance > max)
-      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', claimsSet, "iat", checkFailed);
     if (age < -tolerance)
-      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', claimsSet, "iat", checkFailed);
   }
-  return payload;
+  return claimsSet;
 }
 
 // node_modules/jose/dist/webapi/jwt/verify.js
@@ -844,7 +851,9 @@ function createLocalJWKSet(jwks) {
   let snapshot;
   try {
     snapshot = structuredClone(jwks);
-  } catch {}
+  } catch (cause) {
+    throw new JWKSInvalid("JSON Web Key Set malformed", { cause });
+  }
   if (!isJwkSet(snapshot))
     throw new JWKSInvalid("JSON Web Key Set malformed");
   const metadata = snapshot.keys.map((jwk) => {
@@ -878,7 +887,7 @@ function isCloudflareWorkers() {
   return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 var USER_AGENT;
-(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.12");
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.13");
 var customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
   const response = await fetchImpl(url, {
@@ -887,14 +896,14 @@ async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
     redirect: "manual",
     headers
   }).catch((err) => {
-    throw err.name === "TimeoutError" ? new JWKSTimeout : err;
+    throw err.name === "TimeoutError" ? new JWKSTimeout(undefined, { cause: err }) : err;
   });
   if (response.status !== 200)
     throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
   try {
     return await response.json();
-  } catch {
-    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
+  } catch (cause) {
+    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON", { cause });
   }
 }
 var jwksCache = /* @__PURE__ */ Symbol();
@@ -9516,10 +9525,21 @@ async function sha256Hex2(text) {
 }
 
 // src/runtime/realtime/engine.ts
+function normalizeBroadcastTopic(raw) {
+  const topic = raw.trim().replace(/^realtime:/, "");
+  if (!topic)
+    throw new Error("broadcast topic is required");
+  return topic;
+}
+
 class RealtimeEngine {
   db;
   jwtSecret;
   resolveExternalToken;
+  static MAX_HTTP_BROADCAST_MESSAGES = 100;
+  static MAX_HTTP_BROADCAST_TOPIC_BYTES = 256;
+  static MAX_HTTP_BROADCAST_EVENT_BYTES = 256;
+  static MAX_HTTP_BROADCAST_PAYLOAD_BYTES = 1024 * 1024;
   connections = new Set;
   bindingCounter = 1;
   phxRefCounter = 1;
@@ -9566,6 +9586,47 @@ class RealtimeEngine {
       return { read: false, write: false };
     }
   }
+  async broadcastHttp(messages, ctx) {
+    if (messages.length === 0)
+      throw new Error("messages must not be empty");
+    if (messages.length > RealtimeEngine.MAX_HTTP_BROADCAST_MESSAGES) {
+      throw new Error(`messages must contain at most ${RealtimeEngine.MAX_HTTP_BROADCAST_MESSAGES} items`);
+    }
+    const normalized = [];
+    for (const message of messages) {
+      if (typeof message.topic !== "string")
+        throw new Error("broadcast topic must be a string");
+      if (typeof message.event !== "string")
+        throw new Error("broadcast event must be a string");
+      const topic = normalizeBroadcastTopic(message.topic);
+      if (new TextEncoder().encode(topic).byteLength > RealtimeEngine.MAX_HTTP_BROADCAST_TOPIC_BYTES) {
+        throw new Error("broadcast topic is too large");
+      }
+      const event = message.event.trim();
+      if (!event)
+        throw new Error("broadcast event is required");
+      if (new TextEncoder().encode(event).byteLength > RealtimeEngine.MAX_HTTP_BROADCAST_EVENT_BYTES) {
+        throw new Error("broadcast event is too large");
+      }
+      let payloadText;
+      try {
+        payloadText = JSON.stringify(message.payload ?? null);
+      } catch {
+        throw new Error("broadcast payload must be JSON serializable");
+      }
+      if (new TextEncoder().encode(payloadText).byteLength > RealtimeEngine.MAX_HTTP_BROADCAST_PAYLOAD_BYTES) {
+        throw new Error("broadcast payload is too large");
+      }
+      if (message.private === true) {
+        const access = await this.authorizePrivate(topic, ctx);
+        if (!access.write)
+          throw new Error(`not authorized to broadcast on private topic: ${topic}`);
+      }
+      normalized.push({ topic, event, payload: message.payload ?? null });
+    }
+    for (const message of normalized)
+      this.dispatchDbBroadcast(message);
+  }
   dispatchDbBroadcast(msg) {
     const full = `realtime:${msg.topic}`;
     for (const conn of this.connections) {
@@ -9766,8 +9827,7 @@ class RealtimeEngine {
       private: isPrivate,
       canBroadcast
     };
-    if (this.resolveExternalToken)
-      this.leaveChannel(conn, msg.topic);
+    this.leaveChannel(conn, msg.topic);
     conn.channels.set(msg.topic, channel);
     this.scheduleExternalExpiry(conn, channel);
     this.reply(conn, msg, "ok", {
@@ -9807,21 +9867,32 @@ class RealtimeEngine {
     if (channel.expiryTimer)
       clearTimeout(channel.expiryTimer);
     conn.channels.delete(topic);
-    const state = this.presence.get(topic);
-    if (state?.has(channel.presenceKey)) {
-      const metas = state.get(channel.presenceKey);
-      if (!metas)
-        return;
+    this.removePresence(channel);
+  }
+  removePresence(channel) {
+    const presenceRef = channel.presenceRef;
+    if (!presenceRef)
+      return;
+    channel.presenceRef = undefined;
+    const state = this.presence.get(channel.topic);
+    const current = state?.get(channel.presenceKey);
+    const leaving = current?.metas.find((meta) => meta.phx_ref === presenceRef);
+    if (!state || !current || !leaving)
+      return;
+    const remaining = current.metas.filter((meta) => meta.phx_ref !== presenceRef);
+    if (remaining.length > 0) {
+      state.set(channel.presenceKey, { metas: remaining });
+    } else {
       state.delete(channel.presenceKey);
       if (state.size === 0)
-        this.presence.delete(topic);
-      this.broadcastToTopic(topic, {
-        topic,
-        event: "presence_diff",
-        payload: { joins: {}, leaves: { [channel.presenceKey]: metas } },
-        ref: null
-      });
+        this.presence.delete(channel.topic);
     }
+    this.broadcastToTopic(channel.topic, {
+      topic: channel.topic,
+      event: "presence_diff",
+      payload: { joins: {}, leaves: { [channel.presenceKey]: { metas: [leaving] } } },
+      ref: null
+    });
   }
   scheduleExternalExpiry(conn, channel) {
     if (channel.expiryTimer)
@@ -9901,23 +9972,30 @@ class RealtimeEngine {
       return;
     const event = String(msg.payload?.event ?? "").toLowerCase();
     if (event === "track") {
-      const meta = {
-        ...msg.payload?.payload ?? {},
-        phx_ref: `F${this.phxRefCounter++}`
-      };
+      const payload = { ...msg.payload?.payload ?? {} };
+      delete payload.phx_ref;
+      delete payload.phx_ref_prev;
       let state = this.presence.get(msg.topic);
       if (!state) {
         state = new Map;
         this.presence.set(msg.topic, state);
       }
-      const previous = state.get(channel.presenceKey);
-      state.set(channel.presenceKey, { metas: [meta] });
+      const current = state.get(channel.presenceKey);
+      const previous = current?.metas.find((meta) => meta.phx_ref === channel.presenceRef);
+      const meta = {
+        ...payload,
+        phx_ref: `F${this.phxRefCounter++}`,
+        ...previous ? { phx_ref_prev: previous.phx_ref } : {}
+      };
+      const others = current?.metas.filter((meta) => meta.phx_ref !== channel.presenceRef) ?? [];
+      state.set(channel.presenceKey, { metas: [...others, meta] });
+      channel.presenceRef = meta.phx_ref;
       this.broadcastToTopic(msg.topic, {
         topic: msg.topic,
         event: "presence_diff",
         payload: {
           joins: { [channel.presenceKey]: { metas: [meta] } },
-          leaves: previous ? { [channel.presenceKey]: previous } : {}
+          leaves: previous ? { [channel.presenceKey]: { metas: [previous] } } : {}
         },
         ref: null
       });
@@ -9926,19 +10004,7 @@ class RealtimeEngine {
       return;
     }
     if (event === "untrack") {
-      const state = this.presence.get(msg.topic);
-      const metas = state?.get(channel.presenceKey);
-      if (state && metas) {
-        state.delete(channel.presenceKey);
-        if (state.size === 0)
-          this.presence.delete(msg.topic);
-        this.broadcastToTopic(msg.topic, {
-          topic: msg.topic,
-          event: "presence_diff",
-          payload: { joins: {}, leaves: { [channel.presenceKey]: metas } },
-          ref: null
-        });
-      }
+      this.removePresence(channel);
       if (msg.ref)
         this.reply(conn, msg, "ok", {});
     }
@@ -11923,6 +11989,11 @@ class StorageHandler {
     const rest = url.pathname.replace(/^\/storage\/v1\/?/, "").replace(/\/+$/, "");
     const method = req.method.toUpperCase();
     try {
+      if (rest === "status" && method === "GET") {
+        return json3(200, { status: "ok", name: "supacloud-lite-storage", version: SUPACLOUD_LITE_VERSION });
+      }
+      if (rest === "metrics" && method === "GET")
+        return await this.metrics(ctx);
       if (rest === "bucket" && method === "POST")
         return await this.createBucket(req, ctx);
       if (rest === "bucket" && method === "GET")
@@ -12043,6 +12114,37 @@ class StorageHandler {
       release();
     }
   }
+  async metrics(ctx) {
+    const denied = this.requireService(ctx);
+    if (denied)
+      return denied;
+    const [buckets, objects] = await Promise.all([
+      this.db.query(`select count(*)::int as count from storage.buckets`),
+      this.db.query(`select count(*)::int as count,
+                coalesce(sum(case when metadata->>'size' ~ '^[0-9]+$' then (metadata->>'size')::bigint else 0 end), 0) as bytes
+         from storage.objects`)
+    ]);
+    const bucketCount = buckets.rows[0]?.count ?? 0;
+    const objectCount = objects.rows[0]?.count ?? 0;
+    const objectBytes = Number(objects.rows[0]?.bytes ?? 0);
+    const body = [
+      "# HELP storage_buckets_total Number of storage buckets.",
+      "# TYPE storage_buckets_total gauge",
+      `storage_buckets_total ${bucketCount}`,
+      "# HELP storage_objects_total Number of storage object metadata rows.",
+      "# TYPE storage_objects_total gauge",
+      `storage_objects_total ${objectCount}`,
+      "# HELP storage_object_bytes_total Sum of declared object sizes in bytes.",
+      "# TYPE storage_object_bytes_total gauge",
+      `storage_object_bytes_total ${Number.isFinite(objectBytes) ? objectBytes : 0}`,
+      ""
+    ].join(`
+`);
+    return new Response(body, {
+      status: 200,
+      headers: { "content-type": "text/plain; version=0.0.4; charset=utf-8" }
+    });
+  }
   requireService(ctx) {
     if (ctx.role !== "service_role") {
       return storageError(403, "Unauthorized", "Bucket management requires the service_role key");
@@ -14161,6 +14263,9 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     if (smsInbox && (path === "/sms-inbox" || path.startsWith("/sms-inbox/"))) {
       return withCors(smsInbox.serve(req, url));
     }
+    if (path === "/storage/v1/status" && req.method === "GET") {
+      return withCors(await storage.handle(req, { role: "anon", claims: null }, url));
+    }
     if (path.startsWith("/storage/v1/object/public/") || path.startsWith("/storage/v1/object/sign/") || path.startsWith("/storage/v1/render/image/public/") || path.startsWith("/storage/v1/render/image/sign/")) {
       if (req.method === "GET" || req.method === "HEAD") {
         return withCors(await storage.handle(req, { role: "anon", claims: null }, url));
@@ -14196,6 +14301,50 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     const ctx = await resolveContext(req, url);
     if (ctx instanceof Response)
       return ctx;
+    if (path === "/realtime/v1/api/broadcast" || path === "/realtime/v1/api/broadcast/") {
+      if (req.method !== "POST") {
+        return withCors(new Response(JSON.stringify({ message: "Method not allowed" }), {
+          status: 405,
+          headers: { "content-type": "application/json", allow: "POST" }
+        }));
+      }
+      const contentType = req.headers.get("content-type") ?? "";
+      if (contentType && !contentType.includes("application/json")) {
+        return withCors(new Response(JSON.stringify({ message: "Content-Type must be application/json" }), {
+          status: 415,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      let body;
+      try {
+        body = await req.json();
+      } catch {
+        return withCors(new Response(JSON.stringify({ message: "Invalid JSON body" }), {
+          status: 400,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      const messages = typeof body === "object" && body !== null && "messages" in body ? body.messages : undefined;
+      if (!Array.isArray(messages)) {
+        return withCors(new Response(JSON.stringify({ message: "messages must be an array" }), {
+          status: 400,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      try {
+        await realtime.broadcastHttp(messages, ctx);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Broadcast failed";
+        return withCors(new Response(JSON.stringify({ message }), {
+          status: message.startsWith("not authorized") ? 403 : 400,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      return withCors(new Response(JSON.stringify({ message: "Broadcast sent" }), {
+        status: 202,
+        headers: { "content-type": "application/json" }
+      }));
+    }
     if (path.startsWith("/rest/v1"))
       return withCors(await rest.handle(req, ctx, url));
     if (path === "/graphql/v1" || path === "/graphql/v1/")
@@ -14397,6 +14546,118 @@ class S3StorageDriver {
     return `${this.prefix}${normalizeKey(key)}`;
   }
 }
+// src/runtime/auth/proxy.ts
+var ALLOWED_ROUTES = {
+  "/auth/v1/oauth/token": new Set(["POST"]),
+  "/auth/v1/oauth/userinfo": new Set(["GET"]),
+  "/auth/v1/logout": new Set(["GET", "POST"])
+};
+var FORWARD_REQUEST_HEADERS = ["accept", "authorization", "content-type", "apikey"];
+var FORWARD_RESPONSE_HEADERS = [
+  "content-type",
+  "cache-control",
+  "retry-after",
+  "www-authenticate"
+];
+function proxyError(status, code, message, allow) {
+  const headers = new Headers({
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store"
+  });
+  if (allow)
+    headers.set("allow", allow);
+  return new Response(JSON.stringify({ code, message }), { status, headers });
+}
+function upstreamBase(issuer) {
+  let url;
+  try {
+    url = new URL(issuer);
+  } catch {
+    throw new TypeError("External auth issuer must be an absolute URL");
+  }
+  const loopback = url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]" || url.hostname === "::1";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new TypeError("External auth issuer must use HTTPS (HTTP is allowed only on loopback)");
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new TypeError("External auth issuer must not contain credentials, query or fragment");
+  }
+  if (url.pathname.replace(/\/+$/, "") !== "/auth/v1") {
+    throw new TypeError("External auth issuer must end with /auth/v1");
+  }
+  return url;
+}
+function redirectOrigins(base, extra = []) {
+  const origins = new Set([base.origin]);
+  for (const value of extra) {
+    let origin;
+    try {
+      origin = new URL(value);
+    } catch {
+      throw new TypeError("External auth redirect origin must be an absolute URL");
+    }
+    const loopback = origin.hostname === "127.0.0.1" || origin.hostname === "localhost" || origin.hostname === "[::1]" || origin.hostname === "::1";
+    if (origin.protocol !== "https:" && !(origin.protocol === "http:" && loopback)) {
+      throw new TypeError("External auth redirect origin must use HTTPS (HTTP is allowed only on loopback)");
+    }
+    if (origin.username || origin.password || origin.search || origin.hash) {
+      throw new TypeError("External auth redirect origin must not contain credentials, query or fragment");
+    }
+    origins.add(origin.origin);
+  }
+  return origins;
+}
+function createExternalAuthProxy(options) {
+  const base = upstreamBase(options.issuer);
+  const allowedRedirects = redirectOrigins(base, options.allowedRedirectOrigins);
+  const fetcher = options.fetch ?? globalThis.fetch;
+  if (typeof fetcher !== "function")
+    throw new TypeError("External auth proxy requires fetch");
+  return async (request) => {
+    const source = new URL(request.url);
+    const methods = ALLOWED_ROUTES[source.pathname];
+    if (!methods)
+      return null;
+    if (!methods.has(request.method)) {
+      return proxyError(405, "AUTH_PROXY_METHOD_NOT_ALLOWED", "Auth proxy method is not allowed", [...methods].join(", "));
+    }
+    const target = new URL(source.pathname + source.search, base.origin);
+    const headers = new Headers;
+    for (const name of FORWARD_REQUEST_HEADERS) {
+      const value = request.headers.get(name);
+      if (value !== null)
+        headers.set(name, value);
+    }
+    const body = request.method === "GET" || request.method === "HEAD" ? undefined : await request.arrayBuffer();
+    let upstream;
+    try {
+      upstream = await fetcher(target, {
+        method: request.method,
+        headers,
+        body,
+        redirect: "manual"
+      });
+    } catch {
+      return proxyError(503, "AUTH_PROXY_UNAVAILABLE", "Identity service is temporarily unavailable");
+    }
+    const responseHeaders = new Headers;
+    for (const name of FORWARD_RESPONSE_HEADERS) {
+      const value = upstream.headers.get(name);
+      if (value !== null)
+        responseHeaders.set(name, value);
+    }
+    const location = upstream.headers.get("location");
+    if (location !== null) {
+      const resolved = new URL(location, base.origin);
+      if (!allowedRedirects.has(resolved.origin)) {
+        return proxyError(502, "AUTH_PROXY_REDIRECT_REJECTED", "Identity service redirect was rejected");
+      }
+      responseHeaders.set("location", resolved.href);
+    }
+    responseHeaders.set("cache-control", "no-store");
+    return new Response(upstream.body, { status: upstream.status, headers: responseHeaders });
+  };
+}
 // src/runtime/node/fs-driver.ts
 import { mkdir as mkdir2, readFile as readFile2, rename, rm, writeFile } from "fs/promises";
 import { dirname as dirname2, isAbsolute, join, relative, resolve as resolvePath, sep } from "path";
@@ -14467,7 +14728,11 @@ async function serveBun(backend, opts = {}) {
       const ip = srv.requestIP(req)?.address;
       if (ip)
         headers.set("x-supacloud-lite-remote-addr", ip);
-      return backend.fetch(new Request(req, { headers }));
+      const request = new Request(req, { headers });
+      const hookResponse = await opts.beforeRequest?.(request);
+      if (hookResponse)
+        return hookResponse;
+      return backend.fetch(request);
     },
     websocket: {
       open(ws) {
@@ -15601,6 +15866,80 @@ function removeStalePidFile(pidPath) {
     }
   } catch {}
 }
+// src/runtime/node/production-readiness.ts
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve3 } from "path";
+var SNAPSHOT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+function within(parent, child) {
+  const rel = relative2(resolve3(parent), resolve3(child));
+  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
+}
+function loopback(host) {
+  return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]";
+}
+function absoluteHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return (url.protocol === "https:" || url.protocol === "http:" && loopback(url.hostname)) && !url.username && !url.password;
+  } catch {
+    return false;
+  }
+}
+function productionReadiness(input) {
+  const blockers = [];
+  const warnings = [];
+  const now = input.now ?? Date.now();
+  if (input.runtimeMode !== "strict") {
+    blockers.push("RUNTIME_MODE_NOT_STRICT: production functions require strict runtime mode");
+  }
+  if (input.storageBackend === "memory") {
+    blockers.push("MEMORY_STORAGE_NOT_DURABLE: memory storage loses objects on restart");
+  }
+  if (input.storageBackend === "fs") {
+    warnings.push("LOCAL_STORAGE_REQUIRES_DURABLE_VOLUME_AND_BACKUP");
+  }
+  if (input.storageBackend === "s3") {
+    warnings.push("S3_OBJECTS_NOT_INCLUDED_IN_SNAPSHOT: back up the bucket/prefix separately");
+  }
+  if (!loopback(input.host)) {
+    warnings.push("DIRECT_NETWORK_BIND_WITHOUT_LITE_TLS: terminate TLS in a trusted proxy or restrict the network boundary");
+  }
+  if (input.engine === "pglite") {
+    warnings.push("PGLITE_SINGLE_PROCESS_CAPACITY: validate the real schema, concurrency and Realtime load");
+  }
+  if (input.identityMode === "local") {
+    warnings.push("LOCAL_AUTH_IN_PRODUCTION: own account lifecycle, confirmation and password reset");
+  }
+  if (input.identityMode === "external" && !input.externalAuthProxyIssuer) {
+    warnings.push("EXTERNAL_AUTH_PROXY_NOT_CONFIGURED: cross-origin browser token/userinfo calls may fail CORS");
+  }
+  if (input.externalAuthProxyIssuer && !absoluteHttpUrl(input.externalAuthProxyIssuer)) {
+    blockers.push("EXTERNAL_AUTH_PROXY_ISSUER_INVALID: use an HTTPS issuer, or HTTP only on loopback");
+  }
+  if (!input.siteUrl) {
+    warnings.push("SITE_URL_NOT_CONFIGURED: set [auth].site_url for stable redirects");
+  } else if (!absoluteHttpUrl(input.siteUrl)) {
+    warnings.push("SITE_URL_NOT_HTTPS: production redirects should use HTTPS");
+  }
+  if (!input.apiUrl) {
+    warnings.push("API_URL_NOT_CONFIGURED: set the public API URL used by Auth and Functions");
+  } else if (!absoluteHttpUrl(input.apiUrl)) {
+    warnings.push("API_URL_NOT_HTTPS: production API URLs should use HTTPS");
+  }
+  if (within(input.projectDir, input.stateDir)) {
+    warnings.push("STATE_INSIDE_PROJECT: keep mutable state outside the reviewed project checkout");
+  }
+  if (input.dataDir && input.dataDir === input.storageDir) {
+    blockers.push("DATABASE_AND_STORAGE_PATH_OVERLAP: use separate directories");
+  } else if (input.dataDir && (within(input.dataDir, input.storageDir) || within(input.storageDir, input.dataDir))) {
+    warnings.push("DATABASE_AND_STORAGE_PATH_NESTED: keep database and storage trees independent");
+  }
+  if (input.latestSnapshotAt === undefined) {
+    warnings.push("NO_SNAPSHOT_FOUND: create and test a restore snapshot before promotion");
+  } else if (now - input.latestSnapshotAt > SNAPSHOT_MAX_AGE_MS) {
+    warnings.push("SNAPSHOT_STALE: newest snapshot is older than 7 days");
+  }
+  return { ready: blockers.length === 0, blockers, warnings };
+}
 // src/runtime/node/native/readiness.ts
 function liteCapabilities(engine, replicationProfile, authEnabled = true) {
   const extensionSource = engine === "native" ? "native-postgresql" : "pglite-bundled";
@@ -15889,7 +16228,7 @@ async function inspectPostgresExtensions(engine, source) {
 }
 // src/project-runtime.ts
 import { chmod, link, lstat as lstat2, mkdir as mkdir4, readFile as readFile6, realpath as realpath2, unlink as unlink2, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join7, parse, relative as relative2, resolve as resolve3 } from "path";
+import { dirname as dirname4, isAbsolute as isAbsolute3, join as join7, parse, relative as relative3, resolve as resolve4 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 
 // src/runtime/node/config-toml.ts
@@ -17080,7 +17419,7 @@ function isNotFound(error) {
 
 // src/project-runtime.ts
 function resolveProjectPaths(options = {}) {
-  const projectDir = resolve3(options.projectDir ?? process.cwd());
+  const projectDir = resolve4(options.projectDir ?? process.cwd());
   const stateDir = resolvePath2(projectDir, options.stateDir ?? process.env.SUPACLOUD_LITE_STATE_DIR ?? ".supacloud-lite");
   const databaseEngine = resolveDatabaseEngine(options.engine, options.memory);
   const dataDir = options.memory ? undefined : resolvePath2(projectDir, options.dataDir ?? process.env.SUPACLOUD_LITE_DATA_DIR ?? join7(stateDir, databaseEngine === "native" ? "pgdata" : "db"));
@@ -17250,7 +17589,7 @@ async function loadProjectBindings(projectDir, config) {
   const bindings = config.lite.migrationBindings;
   if (!bindings)
     return;
-  const manifest = JSON.parse(await readFile6(resolve3(projectDir, bindings.manifest), "utf8"));
+  const manifest = JSON.parse(await readFile6(resolve4(projectDir, bindings.manifest), "utf8"));
   return {
     manifest,
     target: { environment: bindings.environment, projectRef: bindings.projectRef },
@@ -17260,7 +17599,7 @@ async function loadProjectBindings(projectDir, config) {
 async function loadProjectIdentity(projectDir, module) {
   if (!module)
     return;
-  const imported = await import(pathToFileURL2(resolve3(projectDir, module)).href);
+  const imported = await import(pathToFileURL2(resolve4(projectDir, module)).href);
   if (!isRecord(imported) || typeof imported["default"] !== "function") {
     throw new Error("Lite identity module must default-export an external identity verifier");
   }
@@ -17326,7 +17665,11 @@ async function startProjectServer(options = {}) {
   const resolvedOptions = options.port === 0 ? { ...options, port: await findEphemeralPort(options.host) } : options;
   const project = await createProjectBackend({ ...resolvedOptions, startRuntimeServices: true });
   try {
-    const server = await serveBun(project.backend, { host: project.host, port: project.port });
+    const beforeRequest = options.externalAuthProxyIssuer ? createExternalAuthProxy({
+      issuer: options.externalAuthProxyIssuer,
+      allowedRedirectOrigins: options.externalAuthProxyRedirectOrigins
+    }) : undefined;
+    const server = await serveBun(project.backend, { host: project.host, port: project.port, beforeRequest });
     let closePromise = null;
     return {
       ...project,
@@ -17368,7 +17711,7 @@ async function loadWebhooks(projectDir) {
   }
 }
 function resolvePath2(projectDir, path) {
-  return isAbsolute2(path) ? path : resolve3(projectDir, path);
+  return isAbsolute3(path) ? path : resolve4(projectDir, path);
 }
 function randomHex(bytes) {
   const value = crypto.getRandomValues(new Uint8Array(bytes));
@@ -17413,7 +17756,7 @@ async function findEphemeralPort(host = "127.0.0.1") {
 }
 // src/snapshot.ts
 import { chmod as chmod2, copyFile, lstat as lstat3, mkdir as mkdir5, mkdtemp, readdir as readdir3, readFile as readFile7, rename as rename2, rm as rm4, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname5, join as join8, parse as parse2, relative as relative3, resolve as resolve4, sep as sep2 } from "path";
+import { dirname as dirname5, join as join8, parse as parse2, relative as relative4, resolve as resolve5, sep as sep2 } from "path";
 import { create as createTar, extract as extractTar2 } from "tar";
 var SNAPSHOT_FORMAT = "supacloud-lite-snapshot";
 var SNAPSHOT_VERSION = 1;
@@ -17437,7 +17780,7 @@ async function createSnapshot(options) {
       postgresMajor: await readPostgresMajor(paths.dataDir)
     } : {}
   };
-  const output = resolve4(options.output);
+  const output = resolve5(options.output);
   if (await existingInfo(output))
     throw new Error(`snapshot output already exists: ${output}`);
   await mkdir5(dirname5(output), { recursive: true });
@@ -17478,7 +17821,7 @@ async function restoreSnapshot(options) {
     await mkdir5(payloadRoot, { recursive: true });
     await extractTar2({
       cwd: payloadRoot,
-      file: resolve4(options.input),
+      file: resolve5(options.input),
       preserveOwner: false,
       preservePaths: false,
       strict: true,
@@ -17521,10 +17864,10 @@ async function restoreSnapshot(options) {
     await mkdir5(stateStage, { recursive: true });
     await copyEntry(join8(payloadRoot, "secrets.json"), join8(stateStage, "secrets.json"));
     if (paths.dataDir && isWithin(paths.stateDir, paths.dataDir)) {
-      await copyEntry(join8(payloadRoot, "database"), join8(stateStage, relative3(paths.stateDir, paths.dataDir)));
+      await copyEntry(join8(payloadRoot, "database"), join8(stateStage, relative4(paths.stateDir, paths.dataDir)));
     }
     if (options.storageBackend === "fs" && isWithin(paths.stateDir, paths.storageDir)) {
-      await copyEntry(join8(payloadRoot, "storage"), join8(stateStage, relative3(paths.stateDir, paths.storageDir)));
+      await copyEntry(join8(payloadRoot, "storage"), join8(stateStage, relative4(paths.stateDir, paths.storageDir)));
     }
     const swaps = [];
     try {
@@ -17558,11 +17901,11 @@ async function restoreSnapshot(options) {
 function normalizePaths(paths) {
   return {
     ...paths,
-    projectDir: resolve4(paths.projectDir),
-    stateDir: resolve4(paths.stateDir),
-    dataDir: paths.dataDir ? resolve4(paths.dataDir) : undefined,
-    storageDir: resolve4(paths.storageDir),
-    secretsFile: resolve4(paths.secretsFile)
+    projectDir: resolve5(paths.projectDir),
+    stateDir: resolve5(paths.stateDir),
+    dataDir: paths.dataDir ? resolve5(paths.dataDir) : undefined,
+    storageDir: resolve5(paths.storageDir),
+    secretsFile: resolve5(paths.secretsFile)
   };
 }
 async function assertSnapshotPaths(paths, options = {}) {
@@ -17592,7 +17935,7 @@ async function assertSnapshotPaths(paths, options = {}) {
 async function assertDirectoryOrMissing(path) {
   if (!path)
     return;
-  if (resolve4(path) === parse2(resolve4(path)).root)
+  if (resolve5(path) === parse2(resolve5(path)).root)
     throw new Error(`snapshot path must not be the filesystem root: ${path}`);
   try {
     const info = await lstat3(path);
@@ -17815,13 +18158,13 @@ async function assertNoSymlinks(root) {
   }
 }
 function isWithin(parent, child) {
-  const normalizedParent = resolve4(parent);
-  const normalizedChild = resolve4(child);
+  const normalizedParent = resolve5(parent);
+  const normalizedChild = resolve5(child);
   return normalizedChild !== normalizedParent && normalizedChild.startsWith(`${normalizedParent}${sep2}`);
 }
 function pathsOverlap(left, right) {
-  const normalizedLeft = resolve4(left);
-  const normalizedRight = resolve4(right);
+  const normalizedLeft = resolve5(left);
+  const normalizedRight = resolve5(right);
   return normalizedLeft === normalizedRight || isWithin(normalizedLeft, normalizedRight) || isWithin(normalizedRight, normalizedLeft);
 }
 export {
@@ -17832,6 +18175,7 @@ export {
   S3StorageDriver,
   SUPACLOUD_LITE_VERSION,
   buildPowerSyncPostgresArgs,
+  createExternalAuthProxy,
   createBackend as createLiteBackend,
   createNativeEngine,
   createPgliteEngine,
@@ -17850,6 +18194,7 @@ export {
   isNativeEngineSupported,
   liteCapabilities,
   mintProjectKeys,
+  productionReadiness,
   resolveDatabaseEngine,
   resolveNativeReplicationOptions,
   resolveProjectPaths,