@supacloud/lite 0.35.2 → 0.37.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [0.37.0](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.36.0...supacloud-lite-v0.37.0) (2026-11-01)
+
+
+### Features
+
+* **lite:** add a local Supabase import and compatibility lab ([#2325](https://github.com/vibeunion/supacloud/issues/2325)) ([aa739cb](https://github.com/vibeunion/supacloud/commit/aa739cb0fe47811833294bcfbcb90fded4116b83))
+
+## [0.36.0](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.35.2...supacloud-lite-v0.36.0) (2026-10-31)
+
+
+### ⚠ BREAKING CHANGES
+
+* **lite:** new native databases and default physical snapshot restores target PostgreSQL 18. Existing PostgreSQL 17 state requires an explicitly selected PostgreSQL 17 installation until logical migration.
+
+### Features
+
+* **lite:** upgrade default native PostgreSQL to 18 ([#2313](https://github.com/vibeunion/supacloud/issues/2313)) ([325ff75](https://github.com/vibeunion/supacloud/commit/325ff75bbc81249bc5fb4c1e8cf249185f1e6065))
+* **web-console:** migrate applications page to svadmin ([#2320](https://github.com/vibeunion/supacloud/issues/2320)) ([b643a27](https://github.com/vibeunion/supacloud/commit/b643a279debe862c3feb71e4da10c7d65bdb8769))
+
+
+### Miscellaneous Chores
+
+* **workspace:** replace Nx scheduling with Bun ([#2321](https://github.com/vibeunion/supacloud/issues/2321)) ([c2d5b27](https://github.com/vibeunion/supacloud/commit/c2d5b270ca0d0d8e04e4547f270c9750b44a0096))
+
 ## [0.35.2](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.35.1...supacloud-lite-v0.35.2) (2026-10-31)
 
 

package/LICENSES/{POSTGRESQL-17-COPYRIGHT.txt → POSTGRESQL-18-COPYRIGHT.txt}

@@ -1,7 +1,7 @@
 PostgreSQL Database Management System
 (also known as Postgres, formerly known as Postgres95)
 
-Portions Copyright (c) 1996-2025, PostgreSQL Global Development Group
+Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
 
 Portions Copyright (c) 1994, The Regents of the University of California
 

package/README.md

@@ -13,7 +13,7 @@ V1 的目标不是复刻完整 Supabase 平台控制面，而是让现有应用
 ### 状态
 
 - 运行时：npm 包需要 Bun 1.4.4+；单二进制发行版已内嵌 Bun 和 PGlite 资源
-- 数据库：PGlite 0.5.10，或 native PostgreSQL
+- 数据库：PGlite 0.5.10，或 native PostgreSQL 18（默认下载 Theseus 18.6.1）
 - 项目模型：单进程、单项目，内部 project ref 固定为 `local`
 - 客户端：直接使用官方 `@supabase/supabase-js`
 - 数据目录：`.supacloud-lite/db`
@@ -106,6 +106,7 @@ timeout_ms = 15000                        # limits.timeout_ms
 max_request_body_bytes = 1048576          # limits.max_request_body_bytes
 max_response_body_bytes = 524288          # limits.max_response_body_bytes
 wait_until_timeout_ms = 2000              # limits.wait_until_timeout_ms
+max_heap_bytes = 134217728                # limits.max_heap_bytes（校验，不强制隔离）
 outbound_hosts = ["api.example.com"]      # capabilities.outbound_hosts
 secrets = ["OPENAI_API_KEY"]              # capabilities.secrets
 background = true                         # capabilities.background
@@ -117,6 +118,7 @@ background = true                         # capabilities.background
 | `max_request_body_bytes` | integer | 请求体上限；content-length 超限返回 413，无长度声明的流式 body 超限则中断读取 | `limits.max_request_body_bytes` |
 | `max_response_body_bytes` | integer | 响应体上限；content-length 超限直接替换为 502，流式 body 超限则在传输中截断（状态行已提交，客户端看到流中断） | `limits.max_response_body_bytes` |
 | `wait_until_timeout_ms` | integer | 响应返回后等待 `EdgeRuntime.waitUntil` 后台任务的最长时间；超时不再等待（任务继续运行，记录警告） | `limits.wait_until_timeout_ms` |
+| `max_heap_bytes` | integer | 1 字节到 512 MiB。strict 模式拒绝非法值。Lite 没有 Worker 隔离，不会按该值采样堆或回收进程 | `limits.max_heap_bytes` |
 | `outbound_hosts` | string[] | `fetch` 出站 host 白名单（精确匹配，不含端口）；loopback（localhost/127.0.0.1/::1）始终放行，未声明的 host 直接抛错 | `capabilities.outbound_hosts` |
 | `secrets` | string[] | 函数可见的环境变量白名单：基础三键（`SUPABASE_URL`/`SUPABASE_ANON_KEY`/`SUPABASE_SERVICE_ROLE_KEY`）+ 声明的 key，同时约束 `Deno.env` 与 `ctx.env` | `capabilities.secrets` |
 | `background` | boolean | 是否允许 `EdgeRuntime.waitUntil`；设为 `false` 时调用抛出与生产一致的错误 | `capabilities.background` |
@@ -162,7 +164,7 @@ sso_domains = ["acme.example"]
 
 ### 新版应用兼容
 
-Lite 支持平铺 SQL 与 `时间戳目录/migration.sql`，执行前检查重复版本和已应用 SQL 的内容漂移；目标绑定复用 `@supacloud/db`，`migrate --json` 可输出不含参数值的校验记录。`--runtime-mode strict` 对齐函数默认限制并拒绝无效配置、缺失函数和未声明的后台任务。
+Lite 支持平铺 SQL 与 `时间戳目录/migration.sql`，执行前检查重复版本和已应用 SQL 的内容漂移；目标绑定复用 `@supacloud/db`，`migrate --json` 可输出不含参数值的校验记录。`--runtime-mode strict` 对齐函数默认限制并拒绝无效配置、缺失函数和未声明的后台任务。`max_heap_bytes` 接受与生产 Edge Runtime 相同的 1 字节到 512 MiB 声明；strict 模式拒绝非法值。Lite 在进程内执行函数，不按该预算采样堆或回收进程。
 
 `/graphql/v1` 使用真正的 `pg_graphql` 扩展和调用者的数据库角色/RLS，不模拟扩展。默认 PGlite 和标准 native 下载包均不包含该扩展；native 可通过 `--postgres-dir` 选择已经安装匹配扩展的 PostgreSQL。配置 `[lite.graphql] enabled = true` 会在运行时启动前验证扩展，`doctor --json` 区分已支持、缺失与尚未验证。
 
@@ -203,9 +205,13 @@ supacloud-lite snapshot restore <backup.tar.gz> [--force]
 supacloud-lite upgrade [-o pre-upgrade.tar.gz]
 supacloud-lite inspect
 supacloud-lite doctor [--json] [--production]
+supacloud-lite import --from <supabase-project> [--json]
+supacloud-lite compat [--json]
 supacloud-lite version
 ```
 
+`import` 把本地 Supabase 项目的 config、migrations、seed / `import/data.sql`、Auth 用户、Storage 对象和 Functions 导入 Lite，并打印验收清单。无法在本机核对的行保持未勾选并写明原因。这不是部署。详见 `docs/supabase-import-lab.md`。
+
 首次初始化或 state 目录不存在/为空时，先运行 `supacloud-lite migrate`。`db reset` 只接受已经初始化且保留有效 `secrets.json` 标记的 state；它不会为 reset 创建或覆盖项目 secrets。
 
 #### 创建本地 Auth 账号
@@ -437,6 +443,9 @@ supacloud-lite doctor --json
 
 ### PostgreSQL 扩展生态
 
+默认 native 下载包使用 PostgreSQL 18。已有 PostgreSQL 17 数据目录和物理快照须继续通过 `--postgres-dir` 选择原 17 安装，完成逻辑迁移后才能使用 18；不能直接替换二进制打开旧数据。
+完整步骤见 [PostgreSQL 17 → 18 迁移方案](../../docs/lite-postgres17-to18-migration.md)。
+
 Lite 默认把一组常用扩展打进 PGlite：`uuid-ossp`、`pgcrypto`、`citext`、
 `pg_trgm`、`ltree`、`hstore`、`fuzzystrmatch`、`pgvector`、
 `pg_textsearch`、PostGIS 和官方 `pgmq`。其中 PostGIS 是上游实验性包，
@@ -447,11 +456,11 @@ PostgreSQL 主版本、操作系统、CPU 架构和 ABI 匹配的 PostgreSQL 安
 ```bash
 supacloud-lite migrate \
   --engine native \
-  --postgres-dir /opt/postgresql/17
+  --postgres-dir /opt/postgresql/18
 
 supacloud-lite doctor \
   --engine native \
-  --postgres-dir /opt/postgresql/17 \
+  --postgres-dir /opt/postgresql/18 \
   --json
 ```
 
@@ -607,7 +616,7 @@ The goal of V1 is not to replicate the full Supabase platform control plane, but
 ### Status
 
 - Runtime: the npm package requires Bun 1.4.4+; the single-binary release embeds Bun and PGlite assets
-- Database: PGlite 0.5.10, or native PostgreSQL
+- Database: PGlite 0.5.10, or native PostgreSQL 18 (Theseus 18.6.1 by default)
 - Project model: single process, single project, with an internal project ref fixed as `local`
 - Client: uses the official `@supabase/supabase-js` directly
 - Data directory: `.supacloud-lite/db`
@@ -722,9 +731,13 @@ supacloud-lite snapshot restore <backup.tar.gz> [--force]
 supacloud-lite upgrade [-o pre-upgrade.tar.gz]
 supacloud-lite inspect
 supacloud-lite doctor [--json] [--production]
+supacloud-lite import --from <supabase-project> [--json]
+supacloud-lite compat [--json]
 supacloud-lite version
 ```
 
+`import` loads a local Supabase project's config, migrations, seed or `import/data.sql`, Auth users, Storage objects, and Functions into Lite, then prints a verify checklist. Rows that this machine cannot check stay unchecked with a blocker. This is not a deployment. See `docs/supabase-import-lab.md`.
+
 Run `supacloud-lite migrate` first when initializing a project or when the state directory is missing or empty. `db reset` only accepts initialized state with a valid `secrets.json` marker; it never creates or replaces project secrets for a reset.
 
 #### Create a Local Auth User
@@ -907,6 +920,9 @@ duplicate versions and applied SQL drift before pending migrations, and reuses
 `@supacloud/db` for reviewed target bindings. `migrate --json` emits a hash-only
 binding attestation. Strict mode enforces bounded function defaults and rejects
 invalid declarations, missing functions and undeclared background work.
+`max_heap_bytes` accepts the production range of 1 byte through 512 MiB and
+is rejected when invalid in strict mode. Lite does not sample or retire on
+that budget, because functions run in-process.
 
 `/graphql/v1` requires real `pg_graphql` and uses the caller's role/RLS. Neither
 bundled PGlite nor stock native downloads include the extension. Native can use
@@ -1007,6 +1023,12 @@ It uses Realtime's `messages` envelope: at most 100 messages per request, each `
 
 ### PostgreSQL extension ecosystem
 
+The default native download uses PostgreSQL 18. Keep selecting the original
+PostgreSQL 17 installation with `--postgres-dir` for existing major 17 data
+directories and physical snapshots until a logical migration to 18 is complete.
+Replacing binaries cannot upgrade an existing data directory.
+See the [PostgreSQL 17 to 18 migration runbook (中文)](../../docs/lite-postgres17-to18-migration.md).
+
 Lite ships a PostgreSQL-shaped default extension set in PGlite. New databases
 install `uuid-ossp`, `pgcrypto`, `citext`, `pg_trgm`, `ltree`, `hstore`,
 `fuzzystrmatch`, `pgvector`, `pg_textsearch`, PostGIS, and the official PGMQ
@@ -1022,11 +1044,11 @@ match the Lite process:
 ```bash
 supacloud-lite migrate \
   --engine native \
-  --postgres-dir /opt/postgresql/17
+  --postgres-dir /opt/postgresql/18
 
 supacloud-lite doctor \
   --engine native \
-  --postgres-dir /opt/postgresql/17 \
+  --postgres-dir /opt/postgresql/18 \
   --json
 ```
 

package/THIRD_PARTY_NOTICES.md

@@ -30,11 +30,11 @@ extension archives are embedded in the standalone binary.
 
 ## Native PostgreSQL binaries
 
-Linux/macOS 上的可选 native 引擎会按需下载 Theseus 发布的 PostgreSQL 17.7.0 预编译包；该二进制不会内嵌到 npm 包或 Lite 单文件发布物中。
+Linux/macOS 上的可选 native 引擎会按需下载 Theseus 发布的 PostgreSQL 18.6.1 预编译包（PostgreSQL 18.6 的打包修订，包含传递运行库）；该二进制不会内嵌到 npm 包或 Lite 单文件发布物中。
 
 - PostgreSQL license: PostgreSQL License
 - Binary source: `https://github.com/theseus-rs/postgresql-binaries`
-- PostgreSQL copyright copy: `LICENSES/POSTGRESQL-17-COPYRIGHT.txt`
+- PostgreSQL copyright copy: `LICENSES/POSTGRESQL-18-COPYRIGHT.txt`
 - Theseus distribution license copy: `LICENSES/THESEUS-POSTGRESQL-LICENSE.txt`
 - Integrity: Lite 对默认版本的四个平台归档使用内置 SHA-256 固定校验和