@supacloud/lite 0.33.2 → 0.34.0

package/dist/cli.js

@@ -2,13 +2,13 @@
 // @bun
 
 // src/cli.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync5, readdirSync, statSync as statSync2 } from "fs";
 import { mkdir as mkdir7, rm as rm6, writeFile as writeFile7 } from "fs/promises";
-import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
+import { dirname as dirname8, join as join10, resolve as resolve7 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.33.2",
+  version: "0.34.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -28,6 +28,7 @@ var package_default = {
     "dist",
     "!dist/standalone",
     "README.md",
+    "deploy",
     "CHANGELOG.md",
     "RELEASING.md",
     "THIRD_PARTY_NOTICES.md",
@@ -9530,10 +9531,21 @@ async function sha256Hex2(text) {
 }
 
 // src/runtime/realtime/engine.ts
+function normalizeBroadcastTopic(raw) {
+  const topic = raw.trim().replace(/^realtime:/, "");
+  if (!topic)
+    throw new Error("broadcast topic is required");
+  return topic;
+}
+
 class RealtimeEngine {
   db;
   jwtSecret;
   resolveExternalToken;
+  static MAX_HTTP_BROADCAST_MESSAGES = 100;
+  static MAX_HTTP_BROADCAST_TOPIC_BYTES = 256;
+  static MAX_HTTP_BROADCAST_EVENT_BYTES = 256;
+  static MAX_HTTP_BROADCAST_PAYLOAD_BYTES = 1024 * 1024;
   connections = new Set;
   bindingCounter = 1;
   phxRefCounter = 1;
@@ -9580,6 +9592,47 @@ class RealtimeEngine {
       return { read: false, write: false };
     }
   }
+  async broadcastHttp(messages, ctx) {
+    if (messages.length === 0)
+      throw new Error("messages must not be empty");
+    if (messages.length > RealtimeEngine.MAX_HTTP_BROADCAST_MESSAGES) {
+      throw new Error(`messages must contain at most ${RealtimeEngine.MAX_HTTP_BROADCAST_MESSAGES} items`);
+    }
+    const normalized = [];
+    for (const message of messages) {
+      if (typeof message.topic !== "string")
+        throw new Error("broadcast topic must be a string");
+      if (typeof message.event !== "string")
+        throw new Error("broadcast event must be a string");
+      const topic = normalizeBroadcastTopic(message.topic);
+      if (new TextEncoder().encode(topic).byteLength > RealtimeEngine.MAX_HTTP_BROADCAST_TOPIC_BYTES) {
+        throw new Error("broadcast topic is too large");
+      }
+      const event = message.event.trim();
+      if (!event)
+        throw new Error("broadcast event is required");
+      if (new TextEncoder().encode(event).byteLength > RealtimeEngine.MAX_HTTP_BROADCAST_EVENT_BYTES) {
+        throw new Error("broadcast event is too large");
+      }
+      let payloadText;
+      try {
+        payloadText = JSON.stringify(message.payload ?? null);
+      } catch {
+        throw new Error("broadcast payload must be JSON serializable");
+      }
+      if (new TextEncoder().encode(payloadText).byteLength > RealtimeEngine.MAX_HTTP_BROADCAST_PAYLOAD_BYTES) {
+        throw new Error("broadcast payload is too large");
+      }
+      if (message.private === true) {
+        const access = await this.authorizePrivate(topic, ctx);
+        if (!access.write)
+          throw new Error(`not authorized to broadcast on private topic: ${topic}`);
+      }
+      normalized.push({ topic, event, payload: message.payload ?? null });
+    }
+    for (const message of normalized)
+      this.dispatchDbBroadcast(message);
+  }
   dispatchDbBroadcast(msg) {
     const full = `realtime:${msg.topic}`;
     for (const conn of this.connections) {
@@ -11942,6 +11995,11 @@ class StorageHandler {
     const rest = url.pathname.replace(/^\/storage\/v1\/?/, "").replace(/\/+$/, "");
     const method = req.method.toUpperCase();
     try {
+      if (rest === "status" && method === "GET") {
+        return json3(200, { status: "ok", name: "supacloud-lite-storage", version: SUPACLOUD_LITE_VERSION });
+      }
+      if (rest === "metrics" && method === "GET")
+        return await this.metrics(ctx);
       if (rest === "bucket" && method === "POST")
         return await this.createBucket(req, ctx);
       if (rest === "bucket" && method === "GET")
@@ -12062,6 +12120,37 @@ class StorageHandler {
       release();
     }
   }
+  async metrics(ctx) {
+    const denied = this.requireService(ctx);
+    if (denied)
+      return denied;
+    const [buckets, objects] = await Promise.all([
+      this.db.query(`select count(*)::int as count from storage.buckets`),
+      this.db.query(`select count(*)::int as count,
+                coalesce(sum(case when metadata->>'size' ~ '^[0-9]+$' then (metadata->>'size')::bigint else 0 end), 0) as bytes
+         from storage.objects`)
+    ]);
+    const bucketCount = buckets.rows[0]?.count ?? 0;
+    const objectCount = objects.rows[0]?.count ?? 0;
+    const objectBytes = Number(objects.rows[0]?.bytes ?? 0);
+    const body = [
+      "# HELP storage_buckets_total Number of storage buckets.",
+      "# TYPE storage_buckets_total gauge",
+      `storage_buckets_total ${bucketCount}`,
+      "# HELP storage_objects_total Number of storage object metadata rows.",
+      "# TYPE storage_objects_total gauge",
+      `storage_objects_total ${objectCount}`,
+      "# HELP storage_object_bytes_total Sum of declared object sizes in bytes.",
+      "# TYPE storage_object_bytes_total gauge",
+      `storage_object_bytes_total ${Number.isFinite(objectBytes) ? objectBytes : 0}`,
+      ""
+    ].join(`
+`);
+    return new Response(body, {
+      status: 200,
+      headers: { "content-type": "text/plain; version=0.0.4; charset=utf-8" }
+    });
+  }
   requireService(ctx) {
     if (ctx.role !== "service_role") {
       return storageError(403, "Unauthorized", "Bucket management requires the service_role key");
@@ -14429,6 +14518,9 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     if (smsInbox && (path === "/sms-inbox" || path.startsWith("/sms-inbox/"))) {
       return withCors(smsInbox.serve(req, url));
     }
+    if (path === "/storage/v1/status" && req.method === "GET") {
+      return withCors(await storage.handle(req, { role: "anon", claims: null }, url));
+    }
     if (path.startsWith("/storage/v1/object/public/") || path.startsWith("/storage/v1/object/sign/") || path.startsWith("/storage/v1/render/image/public/") || path.startsWith("/storage/v1/render/image/sign/")) {
       if (req.method === "GET" || req.method === "HEAD") {
         return withCors(await storage.handle(req, { role: "anon", claims: null }, url));
@@ -14464,6 +14556,50 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
     const ctx = await resolveContext(req, url);
     if (ctx instanceof Response)
       return ctx;
+    if (path === "/realtime/v1/api/broadcast" || path === "/realtime/v1/api/broadcast/") {
+      if (req.method !== "POST") {
+        return withCors(new Response(JSON.stringify({ message: "Method not allowed" }), {
+          status: 405,
+          headers: { "content-type": "application/json", allow: "POST" }
+        }));
+      }
+      const contentType = req.headers.get("content-type") ?? "";
+      if (contentType && !contentType.includes("application/json")) {
+        return withCors(new Response(JSON.stringify({ message: "Content-Type must be application/json" }), {
+          status: 415,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      let body;
+      try {
+        body = await req.json();
+      } catch {
+        return withCors(new Response(JSON.stringify({ message: "Invalid JSON body" }), {
+          status: 400,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      const messages = typeof body === "object" && body !== null && "messages" in body ? body.messages : undefined;
+      if (!Array.isArray(messages)) {
+        return withCors(new Response(JSON.stringify({ message: "messages must be an array" }), {
+          status: 400,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      try {
+        await realtime.broadcastHttp(messages, ctx);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Broadcast failed";
+        return withCors(new Response(JSON.stringify({ message }), {
+          status: message.startsWith("not authorized") ? 403 : 400,
+          headers: { "content-type": "application/json" }
+        }));
+      }
+      return withCors(new Response(JSON.stringify({ message: "Broadcast sent" }), {
+        status: 202,
+        headers: { "content-type": "application/json" }
+      }));
+    }
     if (path.startsWith("/rest/v1"))
       return withCors(await rest.handle(req, ctx, url));
     if (path === "/graphql/v1" || path === "/graphql/v1/")
@@ -16902,6 +17038,81 @@ function sameStrings(left, right) {
   return left.length === right.length && left.every((value, index) => value === right[index]);
 }
 
+// src/runtime/node/production-readiness.ts
+import { isAbsolute, relative, resolve as resolve4 } from "path";
+var SNAPSHOT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+function within(parent, child) {
+  const rel = relative(resolve4(parent), resolve4(child));
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function loopback(host) {
+  return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]";
+}
+function absoluteHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return (url.protocol === "https:" || url.protocol === "http:" && loopback(url.hostname)) && !url.username && !url.password;
+  } catch {
+    return false;
+  }
+}
+function productionReadiness(input) {
+  const blockers = [];
+  const warnings = [];
+  const now = input.now ?? Date.now();
+  if (input.runtimeMode !== "strict") {
+    blockers.push("RUNTIME_MODE_NOT_STRICT: production functions require strict runtime mode");
+  }
+  if (input.storageBackend === "memory") {
+    blockers.push("MEMORY_STORAGE_NOT_DURABLE: memory storage loses objects on restart");
+  }
+  if (input.storageBackend === "fs") {
+    warnings.push("LOCAL_STORAGE_REQUIRES_DURABLE_VOLUME_AND_BACKUP");
+  }
+  if (input.storageBackend === "s3") {
+    warnings.push("S3_OBJECTS_NOT_INCLUDED_IN_SNAPSHOT: back up the bucket/prefix separately");
+  }
+  if (!loopback(input.host)) {
+    warnings.push("DIRECT_NETWORK_BIND_WITHOUT_LITE_TLS: terminate TLS in a trusted proxy or restrict the network boundary");
+  }
+  if (input.engine === "pglite") {
+    warnings.push("PGLITE_SINGLE_PROCESS_CAPACITY: validate the real schema, concurrency and Realtime load");
+  }
+  if (input.identityMode === "local") {
+    warnings.push("LOCAL_AUTH_IN_PRODUCTION: own account lifecycle, confirmation and password reset");
+  }
+  if (input.identityMode === "external" && !input.externalAuthProxyIssuer) {
+    warnings.push("EXTERNAL_AUTH_PROXY_NOT_CONFIGURED: cross-origin browser token/userinfo calls may fail CORS");
+  }
+  if (input.externalAuthProxyIssuer && !absoluteHttpUrl(input.externalAuthProxyIssuer)) {
+    blockers.push("EXTERNAL_AUTH_PROXY_ISSUER_INVALID: use an HTTPS issuer, or HTTP only on loopback");
+  }
+  if (!input.siteUrl) {
+    warnings.push("SITE_URL_NOT_CONFIGURED: set [auth].site_url for stable redirects");
+  } else if (!absoluteHttpUrl(input.siteUrl)) {
+    warnings.push("SITE_URL_NOT_HTTPS: production redirects should use HTTPS");
+  }
+  if (!input.apiUrl) {
+    warnings.push("API_URL_NOT_CONFIGURED: set the public API URL used by Auth and Functions");
+  } else if (!absoluteHttpUrl(input.apiUrl)) {
+    warnings.push("API_URL_NOT_HTTPS: production API URLs should use HTTPS");
+  }
+  if (within(input.projectDir, input.stateDir)) {
+    warnings.push("STATE_INSIDE_PROJECT: keep mutable state outside the reviewed project checkout");
+  }
+  if (input.dataDir && input.dataDir === input.storageDir) {
+    blockers.push("DATABASE_AND_STORAGE_PATH_OVERLAP: use separate directories");
+  } else if (input.dataDir && (within(input.dataDir, input.storageDir) || within(input.storageDir, input.dataDir))) {
+    warnings.push("DATABASE_AND_STORAGE_PATH_NESTED: keep database and storage trees independent");
+  }
+  if (input.latestSnapshotAt === undefined) {
+    warnings.push("NO_SNAPSHOT_FOUND: create and test a restore snapshot before promotion");
+  } else if (now - input.latestSnapshotAt > SNAPSHOT_MAX_AGE_MS) {
+    warnings.push("SNAPSHOT_STALE: newest snapshot is older than 7 days");
+  }
+  return { ready: blockers.length === 0, blockers, warnings };
+}
+
 // src/runtime/node/config-toml.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { join as join3 } from "path";
@@ -17490,7 +17701,7 @@ function isNotFound(error) {
 
 // src/project-runtime.ts
 import { chmod, link as link2, lstat as lstat2, mkdir as mkdir5, readFile as readFile7, realpath as realpath2, unlink as unlink2, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute2, join as join8, parse, relative as relative2, resolve as resolve4 } from "path";
+import { dirname as dirname6, isAbsolute as isAbsolute3, join as join8, parse, relative as relative3, resolve as resolve5 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
 // src/runtime/node/bun-server.ts
@@ -17512,7 +17723,11 @@ async function serveBun(backend, opts = {}) {
       const ip = srv.requestIP(req)?.address;
       if (ip)
         headers.set("x-supacloud-lite-remote-addr", ip);
-      return backend.fetch(new Request(req, { headers }));
+      const request = new Request(req, { headers });
+      const hookResponse = await opts.beforeRequest?.(request);
+      if (hookResponse)
+        return hookResponse;
+      return backend.fetch(request);
     },
     websocket: {
       open(ws) {
@@ -17542,7 +17757,7 @@ async function serveBun(backend, opts = {}) {
 
 // src/runtime/node/fs-driver.ts
 import { mkdir as mkdir3, readFile as readFile4, rename, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname4, isAbsolute, join as join5, relative, resolve as resolvePath, sep } from "path";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join5, relative as relative2, resolve as resolvePath, sep } from "path";
 
 class FsStorageDriver {
   root;
@@ -17552,8 +17767,8 @@ class FsStorageDriver {
   }
   resolve(key) {
     const path = join5(this.root, key);
-    const relativePath = relative(this.root, path);
-    if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)) {
+    const relativePath = relative2(this.root, path);
+    if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute2(relativePath)) {
       throw new Error(`invalid storage key: ${key}`);
     }
     return path;
@@ -17930,11 +18145,124 @@ class S3StorageDriver {
   }
 }
 
+// src/runtime/auth/proxy.ts
+var ALLOWED_ROUTES = {
+  "/auth/v1/oauth/token": new Set(["POST"]),
+  "/auth/v1/oauth/userinfo": new Set(["GET"]),
+  "/auth/v1/logout": new Set(["GET", "POST"])
+};
+var FORWARD_REQUEST_HEADERS = ["accept", "authorization", "content-type", "apikey"];
+var FORWARD_RESPONSE_HEADERS = [
+  "content-type",
+  "cache-control",
+  "retry-after",
+  "www-authenticate"
+];
+function proxyError(status, code, message, allow) {
+  const headers = new Headers({
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store"
+  });
+  if (allow)
+    headers.set("allow", allow);
+  return new Response(JSON.stringify({ code, message }), { status, headers });
+}
+function upstreamBase(issuer) {
+  let url;
+  try {
+    url = new URL(issuer);
+  } catch {
+    throw new TypeError("External auth issuer must be an absolute URL");
+  }
+  const loopback = url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]" || url.hostname === "::1";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new TypeError("External auth issuer must use HTTPS (HTTP is allowed only on loopback)");
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new TypeError("External auth issuer must not contain credentials, query or fragment");
+  }
+  if (url.pathname.replace(/\/+$/, "") !== "/auth/v1") {
+    throw new TypeError("External auth issuer must end with /auth/v1");
+  }
+  return url;
+}
+function redirectOrigins(base, extra = []) {
+  const origins = new Set([base.origin]);
+  for (const value of extra) {
+    let origin;
+    try {
+      origin = new URL(value);
+    } catch {
+      throw new TypeError("External auth redirect origin must be an absolute URL");
+    }
+    const loopback = origin.hostname === "127.0.0.1" || origin.hostname === "localhost" || origin.hostname === "[::1]" || origin.hostname === "::1";
+    if (origin.protocol !== "https:" && !(origin.protocol === "http:" && loopback)) {
+      throw new TypeError("External auth redirect origin must use HTTPS (HTTP is allowed only on loopback)");
+    }
+    if (origin.username || origin.password || origin.search || origin.hash) {
+      throw new TypeError("External auth redirect origin must not contain credentials, query or fragment");
+    }
+    origins.add(origin.origin);
+  }
+  return origins;
+}
+function createExternalAuthProxy(options) {
+  const base = upstreamBase(options.issuer);
+  const allowedRedirects = redirectOrigins(base, options.allowedRedirectOrigins);
+  const fetcher = options.fetch ?? globalThis.fetch;
+  if (typeof fetcher !== "function")
+    throw new TypeError("External auth proxy requires fetch");
+  return async (request) => {
+    const source = new URL(request.url);
+    const methods = ALLOWED_ROUTES[source.pathname];
+    if (!methods)
+      return null;
+    if (!methods.has(request.method)) {
+      return proxyError(405, "AUTH_PROXY_METHOD_NOT_ALLOWED", "Auth proxy method is not allowed", [...methods].join(", "));
+    }
+    const target = new URL(source.pathname + source.search, base.origin);
+    const headers = new Headers;
+    for (const name of FORWARD_REQUEST_HEADERS) {
+      const value = request.headers.get(name);
+      if (value !== null)
+        headers.set(name, value);
+    }
+    const body = request.method === "GET" || request.method === "HEAD" ? undefined : await request.arrayBuffer();
+    let upstream;
+    try {
+      upstream = await fetcher(target, {
+        method: request.method,
+        headers,
+        body,
+        redirect: "manual"
+      });
+    } catch {
+      return proxyError(503, "AUTH_PROXY_UNAVAILABLE", "Identity service is temporarily unavailable");
+    }
+    const responseHeaders = new Headers;
+    for (const name of FORWARD_RESPONSE_HEADERS) {
+      const value = upstream.headers.get(name);
+      if (value !== null)
+        responseHeaders.set(name, value);
+    }
+    const location = upstream.headers.get("location");
+    if (location !== null) {
+      const resolved = new URL(location, base.origin);
+      if (!allowedRedirects.has(resolved.origin)) {
+        return proxyError(502, "AUTH_PROXY_REDIRECT_REJECTED", "Identity service redirect was rejected");
+      }
+      responseHeaders.set("location", resolved.href);
+    }
+    responseHeaders.set("cache-control", "no-store");
+    return new Response(upstream.body, { status: upstream.status, headers: responseHeaders });
+  };
+}
+
 // src/project-runtime.ts
 var RESET_INITIALIZATION_ERROR = 'db reset requires initialized state; run "supacloud-lite migrate" first';
 var RESET_INVALID_SECRETS_ERROR = "db reset requires a valid project secrets marker; restore the state before retrying";
 function resolveProjectPaths(options = {}) {
-  const projectDir = resolve4(options.projectDir ?? process.cwd());
+  const projectDir = resolve5(options.projectDir ?? process.cwd());
   const stateDir = resolvePath2(projectDir, options.stateDir ?? process.env.SUPACLOUD_LITE_STATE_DIR ?? ".supacloud-lite");
   const databaseEngine = resolveDatabaseEngine(options.engine, options.memory);
   const dataDir = options.memory ? undefined : resolvePath2(projectDir, options.dataDir ?? process.env.SUPACLOUD_LITE_DATA_DIR ?? join8(stateDir, databaseEngine === "native" ? "pgdata" : "db"));
@@ -17949,7 +18277,7 @@ function resolveProjectPaths(options = {}) {
   };
 }
 async function assertResetPathsSafe(paths) {
-  const stateDir = resolve4(paths.stateDir);
+  const stateDir = resolve5(paths.stateDir);
   if (stateDir === parse(stateDir).root)
     throw new Error("refusing to use the filesystem root as the state directory");
   const stateInfo = await requiredResetEntry(stateDir);
@@ -17957,7 +18285,7 @@ async function assertResetPathsSafe(paths) {
     throw new Error(`refusing to reset through an invalid state directory: ${stateDir}`);
   }
   const canonicalStateDir = await realpath2(stateDir);
-  const secretsFile = resolve4(paths.secretsFile);
+  const secretsFile = resolve5(paths.secretsFile);
   if (secretsFile !== join8(stateDir, "secrets.json")) {
     throw new Error(`refusing to reset a state directory with an invalid secrets marker path: ${secretsFile}`);
   }
@@ -17971,9 +18299,9 @@ async function assertResetPathsSafe(paths) {
     ["storage", paths.storageDir]
   ];
   for (const [label, targetPath] of targets) {
-    const target = resolve4(targetPath);
-    const relativePath = relative2(stateDir, target);
-    if (!relativePath || relativePath.startsWith("..") || isAbsolute2(relativePath)) {
+    const target = resolve5(targetPath);
+    const relativePath = relative3(stateDir, target);
+    if (!relativePath || relativePath.startsWith("..") || isAbsolute3(relativePath)) {
       throw new Error(`refusing to reset ${label} path outside the state directory: ${target}`);
     }
     await assertResetTargetCanonical(stateDir, canonicalStateDir, target, label);
@@ -18020,9 +18348,9 @@ async function assertResetTargetCanonical(stateDir, canonicalStateDir, target, l
     current = parent;
   }
   const existingAncestor = await nearestExistingAncestor(target);
-  const canonicalTarget = resolve4(await realpath2(existingAncestor), relative2(existingAncestor, target));
-  const canonicalRelative = relative2(canonicalStateDir, canonicalTarget);
-  if (!canonicalRelative || canonicalRelative.startsWith("..") || isAbsolute2(canonicalRelative)) {
+  const canonicalTarget = resolve5(await realpath2(existingAncestor), relative3(existingAncestor, target));
+  const canonicalRelative = relative3(canonicalStateDir, canonicalTarget);
+  if (!canonicalRelative || canonicalRelative.startsWith("..") || isAbsolute3(canonicalRelative)) {
     throw new Error(`refusing to reset ${label} path outside the canonical state directory: ${target}`);
   }
 }
@@ -18198,7 +18526,7 @@ async function loadProjectBindings(projectDir, config) {
   const bindings = config.lite.migrationBindings;
   if (!bindings)
     return;
-  const manifest = JSON.parse(await readFile7(resolve4(projectDir, bindings.manifest), "utf8"));
+  const manifest = JSON.parse(await readFile7(resolve5(projectDir, bindings.manifest), "utf8"));
   return {
     manifest,
     target: { environment: bindings.environment, projectRef: bindings.projectRef },
@@ -18208,7 +18536,7 @@ async function loadProjectBindings(projectDir, config) {
 async function loadProjectIdentity(projectDir, module) {
   if (!module)
     return;
-  const imported = await import(pathToFileURL3(resolve4(projectDir, module)).href);
+  const imported = await import(pathToFileURL3(resolve5(projectDir, module)).href);
   if (!isRecord(imported) || typeof imported["default"] !== "function") {
     throw new Error("Lite identity module must default-export an external identity verifier");
   }
@@ -18274,7 +18602,11 @@ async function startProjectServer(options = {}) {
   const resolvedOptions = options.port === 0 ? { ...options, port: await findEphemeralPort(options.host) } : options;
   const project = await createProjectBackend({ ...resolvedOptions, startRuntimeServices: true });
   try {
-    const server = await serveBun(project.backend, { host: project.host, port: project.port });
+    const beforeRequest = options.externalAuthProxyIssuer ? createExternalAuthProxy({
+      issuer: options.externalAuthProxyIssuer,
+      allowedRedirectOrigins: options.externalAuthProxyRedirectOrigins
+    }) : undefined;
+    const server = await serveBun(project.backend, { host: project.host, port: project.port, beforeRequest });
     let closePromise = null;
     return {
       ...project,
@@ -18316,7 +18648,7 @@ async function loadWebhooks(projectDir) {
   }
 }
 function resolvePath2(projectDir, path) {
-  return isAbsolute2(path) ? path : resolve4(projectDir, path);
+  return isAbsolute3(path) ? path : resolve5(projectDir, path);
 }
 function randomHex(bytes) {
   const value = crypto.getRandomValues(new Uint8Array(bytes));
@@ -18362,7 +18694,7 @@ async function findEphemeralPort(host = "127.0.0.1") {
 
 // src/snapshot.ts
 import { chmod as chmod2, copyFile, lstat as lstat3, mkdir as mkdir6, mkdtemp, readdir as readdir3, readFile as readFile8, rename as rename2, rm as rm5, writeFile as writeFile6 } from "fs/promises";
-import { dirname as dirname7, join as join9, parse as parse2, relative as relative3, resolve as resolve5, sep as sep2 } from "path";
+import { dirname as dirname7, join as join9, parse as parse2, relative as relative4, resolve as resolve6, sep as sep2 } from "path";
 import { create as createTar, extract as extractTar2 } from "tar";
 var SNAPSHOT_FORMAT = "supacloud-lite-snapshot";
 var SNAPSHOT_VERSION = 1;
@@ -18386,7 +18718,7 @@ async function createSnapshot(options) {
       postgresMajor: await readPostgresMajor(paths.dataDir)
     } : {}
   };
-  const output = resolve5(options.output);
+  const output = resolve6(options.output);
   if (await existingInfo(output))
     throw new Error(`snapshot output already exists: ${output}`);
   await mkdir6(dirname7(output), { recursive: true });
@@ -18427,7 +18759,7 @@ async function restoreSnapshot(options) {
     await mkdir6(payloadRoot, { recursive: true });
     await extractTar2({
       cwd: payloadRoot,
-      file: resolve5(options.input),
+      file: resolve6(options.input),
       preserveOwner: false,
       preservePaths: false,
       strict: true,
@@ -18470,10 +18802,10 @@ async function restoreSnapshot(options) {
     await mkdir6(stateStage, { recursive: true });
     await copyEntry(join9(payloadRoot, "secrets.json"), join9(stateStage, "secrets.json"));
     if (paths.dataDir && isWithin(paths.stateDir, paths.dataDir)) {
-      await copyEntry(join9(payloadRoot, "database"), join9(stateStage, relative3(paths.stateDir, paths.dataDir)));
+      await copyEntry(join9(payloadRoot, "database"), join9(stateStage, relative4(paths.stateDir, paths.dataDir)));
     }
     if (options.storageBackend === "fs" && isWithin(paths.stateDir, paths.storageDir)) {
-      await copyEntry(join9(payloadRoot, "storage"), join9(stateStage, relative3(paths.stateDir, paths.storageDir)));
+      await copyEntry(join9(payloadRoot, "storage"), join9(stateStage, relative4(paths.stateDir, paths.storageDir)));
     }
     const swaps = [];
     try {
@@ -18507,11 +18839,11 @@ async function restoreSnapshot(options) {
 function normalizePaths(paths) {
   return {
     ...paths,
-    projectDir: resolve5(paths.projectDir),
-    stateDir: resolve5(paths.stateDir),
-    dataDir: paths.dataDir ? resolve5(paths.dataDir) : undefined,
-    storageDir: resolve5(paths.storageDir),
-    secretsFile: resolve5(paths.secretsFile)
+    projectDir: resolve6(paths.projectDir),
+    stateDir: resolve6(paths.stateDir),
+    dataDir: paths.dataDir ? resolve6(paths.dataDir) : undefined,
+    storageDir: resolve6(paths.storageDir),
+    secretsFile: resolve6(paths.secretsFile)
   };
 }
 async function assertSnapshotPaths(paths, options = {}) {
@@ -18541,7 +18873,7 @@ async function assertSnapshotPaths(paths, options = {}) {
 async function assertDirectoryOrMissing(path) {
   if (!path)
     return;
-  if (resolve5(path) === parse2(resolve5(path)).root)
+  if (resolve6(path) === parse2(resolve6(path)).root)
     throw new Error(`snapshot path must not be the filesystem root: ${path}`);
   try {
     const info = await lstat3(path);
@@ -18764,13 +19096,13 @@ async function assertNoSymlinks(root) {
   }
 }
 function isWithin(parent, child) {
-  const normalizedParent = resolve5(parent);
-  const normalizedChild = resolve5(child);
+  const normalizedParent = resolve6(parent);
+  const normalizedChild = resolve6(child);
   return normalizedChild !== normalizedParent && normalizedChild.startsWith(`${normalizedParent}${sep2}`);
 }
 function pathsOverlap(left, right) {
-  const normalizedLeft = resolve5(left);
-  const normalizedRight = resolve5(right);
+  const normalizedLeft = resolve6(left);
+  const normalizedRight = resolve6(right);
   return normalizedLeft === normalizedRight || isWithin(normalizedLeft, normalizedRight) || isWithin(normalizedRight, normalizedLeft);
 }
 
@@ -18883,7 +19215,8 @@ function parseArgs(argv) {
     port: process.env.SUPACLOUD_LITE_PORT || process.env.PORT ? Number.parseInt(process.env.SUPACLOUD_LITE_PORT ?? process.env.PORT, 10) : 54321,
     serviceRole: false,
     force: false,
-    json: false
+    json: false,
+    production: false
   };
   for (let index = 0;index < args.length; index++) {
     const argument = args[index];
@@ -18902,13 +19235,13 @@ function parseArgs(argv) {
     else if (argument === "--site-url")
       options.siteUrl = next();
     else if (argument === "--project-dir" || argument === "--dir")
-      options.projectDir = resolve6(next());
+      options.projectDir = resolve7(next());
     else if (argument === "--state-dir")
-      options.stateDir = resolve6(next());
+      options.stateDir = resolve7(next());
     else if (argument === "--data-dir")
-      options.dataDir = resolve6(next());
+      options.dataDir = resolve7(next());
     else if (argument === "--storage-dir")
-      options.storageDir = resolve6(next());
+      options.storageDir = resolve7(next());
     else if (argument === "--storage-backend")
       options.storageBackend = next();
     else if (argument === "--s3-prefix")
@@ -18918,9 +19251,13 @@ function parseArgs(argv) {
     else if (argument === "--runtime-mode")
       options.runtimeMode = runtimeMode(next());
     else if (argument === "--postgres-dir")
-      options.postgresDir = resolve6(next());
+      options.postgresDir = resolve7(next());
     else if (argument === "--identity-module")
-      options.identityModule = resolve6(next());
+      options.identityModule = resolve7(next());
+    else if (argument === "--external-auth-proxy-issuer")
+      options.externalAuthProxyIssuer = next();
+    else if (argument === "--external-auth-proxy-redirect-origin")
+      options.externalAuthProxyRedirectOrigins = commaSeparated2(next());
     else if (argument === "--replication-profile") {
       options.replicationProfile = next();
     } else if (argument === "--replication-host")
@@ -18932,25 +19269,27 @@ function parseArgs(argv) {
     else if (argument === "--powersync-tables")
       options.powersyncPublicationTables = commaSeparated2(next());
     else if (argument === "--replication-tls-cert")
-      options.replicationTlsCertFile = resolve6(next());
+      options.replicationTlsCertFile = resolve7(next());
     else if (argument === "--replication-tls-key")
-      options.replicationTlsKeyFile = resolve6(next());
+      options.replicationTlsKeyFile = resolve7(next());
     else if (argument === "--memory")
       options.memory = true;
     else if (argument === "--output" || argument === "-o")
-      options.output = resolve6(next());
+      options.output = resolve7(next());
     else if (argument === "--file" || argument === "-f")
       options.diffFile = next();
     else if (argument === "--baseline")
       options.baseline = true;
     else if (argument === "--module-file")
-      options.moduleFile = resolve6(next());
+      options.moduleFile = resolve7(next());
     else if (argument === "--service-role")
       options.serviceRole = true;
     else if (argument === "--force")
       options.force = true;
     else if (argument === "--json")
       options.json = true;
+    else if (argument === "--production")
+      options.production = true;
     else if (argument === "--email")
       options.email = next();
     else if (argument === "--password-stdin")
@@ -19098,6 +19437,23 @@ ${privilegedKey}
     }
     if (config.lite.graphql.enabled === false)
       report.graphql = { status: "disabled", extension: "pg_graphql" };
+    if (options.production) {
+      report.production_readiness = productionReadiness({
+        engine: paths.databaseEngine,
+        runtimeMode: config.lite.runtimeMode,
+        storageBackend: resolveStorageBackend(options.storageBackend),
+        identityMode: options.identityModule ?? config.lite.identityModule ? "external" : "local",
+        host: options.host ?? "127.0.0.1",
+        projectDir: paths.projectDir,
+        stateDir: paths.stateDir,
+        storageDir: paths.storageDir,
+        dataDir: paths.dataDir,
+        apiUrl: options.apiUrl ?? process.env.SUPACLOUD_LITE_API_URL,
+        siteUrl: options.siteUrl ?? process.env.SUPACLOUD_LITE_SITE_URL,
+        externalAuthProxyIssuer: options.externalAuthProxyIssuer,
+        latestSnapshotAt: latestSnapshotTimestamp(paths.stateDir)
+      });
+    }
     if (options.json)
       await writeStandardOutput(`${JSON.stringify(report, null, 2)}
 `);
@@ -19107,6 +19463,8 @@ ${privilegedKey}
       process.exitCode = 1;
     if (report.powersync_readiness?.ready === false)
       process.exitCode = 1;
+    if (report.production_readiness?.ready === false)
+      process.exitCode = 1;
     return;
   }
   if (options.command === "migrate" || options.command === "status") {
@@ -19194,7 +19552,7 @@ async function runDbCommand(options) {
     }
     return;
   }
-  const projectDir = resolve6(options.projectDir ?? process.cwd());
+  const projectDir = resolve7(options.projectDir ?? process.cwd());
   const config = loadProjectConfig(projectDir, process.env, options.runtimeMode);
   const project = await loadSupabaseProject(projectDir, {
     enabled: false,
@@ -19315,7 +19673,7 @@ async function runSnapshotCommand(options) {
     const rollbackLines = result.rollbackPaths.map((rollbackPath) => `Previous state retained at ${rollbackPath}`);
     const reconnectLine = result.manifest.storageBackend === "s3" ? ["Reconnect the original S3 bucket/prefix before starting Lite."] : [];
     await writeStandardOutput([
-      `Snapshot restored from ${resolve6(input)}`,
+      `Snapshot restored from ${resolve7(input)}`,
       ...rollbackLines,
       ...reconnectLine
     ].join(`
@@ -19358,6 +19716,21 @@ async function runUpgradeCommand(options) {
     throw new Error(`upgrade failed; snapshot retained at ${output}. Restore it with ` + `"supacloud-lite snapshot restore ${output} --force". ${error instanceof Error ? error.message : String(error)}`);
   }
 }
+function latestSnapshotTimestamp(stateDir) {
+  let newest;
+  for (const directory of [stateDir, join10(stateDir, "backups")]) {
+    if (!existsSync5(directory))
+      continue;
+    for (const name of readdirSync(directory)) {
+      if (!name.endsWith(".tar.gz"))
+        continue;
+      const modified = statSync2(join10(directory, name)).mtimeMs;
+      if (newest === undefined || modified > newest)
+        newest = modified;
+    }
+  }
+  return newest;
+}
 async function printInspection(rows) {
   if (rows.length === 0) {
     await writeStandardOutput(`No tables in schema "public".
@@ -19387,6 +19760,13 @@ async function printDoctor(report) {
     for (const warning of report.powersync_readiness.warnings)
       output.push(`warning: ${warning}`);
   }
+  if (report.production_readiness) {
+    output.push(`production_ready: ${report.production_readiness.ready}`);
+    for (const blocker of report.production_readiness.blockers)
+      output.push(`production_blocker: ${blocker}`);
+    for (const warning of report.production_readiness.warnings)
+      output.push(`production_warning: ${warning}`);
+  }
   await writeStandardOutput(`${output.join(`
 `)}
 `);
@@ -19457,6 +19837,10 @@ Options:
       --runtime-mode      development (default) or strict
       --postgres-dir      operator-managed PostgreSQL installation (native only)
       --identity-module   trusted external identity bridge module
+      --external-auth-proxy-issuer <url>
+                           proxy OAuth token/userinfo/logout to this external issuer
+      --external-auth-proxy-redirect-origin <origin>
+                           allowed logout redirect origin (repeatable list via commas)
   -o, --output <p>        output file for gen types
   -f, --file <name>       migration suffix for db diff
   --baseline             db pull: write and record already-present schema as a migration