@supacloud/lite 0.8.4 → 0.9.0

package/dist/project-runtime.d.ts

@@ -1,6 +1,7 @@
 import { type SupaCloudLiteBackend } from './runtime/index.js';
 import { type RunningServer } from './runtime/node/bun-server.js';
 import { type ProjectConfig } from './runtime/node/load-config.js';
+import { type NativeReplicationOptions } from './runtime/node/native/replication.js';
 import { type S3StorageDriverOptions } from './runtime/storage/s3-driver.js';
 import type { SmsSender, StorageDriver } from './runtime/types.js';
 export interface ProjectSecrets {
@@ -31,6 +32,14 @@ export interface ProjectRuntimeOptions {
     siteUrl?: string;
     memory?: boolean;
     engine?: DatabaseEngine;
+    replicationProfile?: ReplicationProfile;
+    replicationHost?: string;
+    replicationPort?: number;
+    replicationAllowCidrs?: string[];
+    powersyncPublicationTables?: string[];
+    powersyncPassword?: string;
+    replicationTlsCertFile?: string;
+    replicationTlsKeyFile?: string;
     applyMigrations?: boolean;
     includeFunctions?: boolean;
     includeWebhooks?: boolean;
@@ -50,8 +59,10 @@ export interface ProjectBackend {
     webhookCount: number;
     storageBackend: StorageBackend;
     databaseEngine: DatabaseEngine;
+    replicationProfile?: ReplicationProfile;
 }
 export type DatabaseEngine = 'pglite' | 'native';
+export type ReplicationProfile = 'powersync';
 export type StorageBackend = 'fs' | 'memory' | 's3' | 'custom';
 export type ConfiguredStorageBackend = Exclude<StorageBackend, 'custom'>;
 export interface RunningProjectServer extends ProjectBackend {
@@ -66,6 +77,7 @@ export declare function mintProjectKeys(jwtSecret: string): Promise<{
     serviceRoleKey: string;
 }>;
 export declare function createProjectBackend(options?: ProjectRuntimeOptions): Promise<ProjectBackend>;
+export declare function resolveNativeReplicationOptions(options: ProjectRuntimeOptions, databaseEngine?: DatabaseEngine): NativeReplicationOptions | undefined;
 export declare function resolveDatabaseEngine(value?: DatabaseEngine, memory?: boolean): DatabaseEngine;
 export declare function resolveStorageBackend(value?: ConfiguredStorageBackend): ConfiguredStorageBackend;
 export declare function startProjectServer(options?: ProjectRuntimeOptions): Promise<RunningProjectServer>;

package/dist/project-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-runtime.d.ts","sourceRoot":"","sources":["../src/project-runtime.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAG7E,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAE3E,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAKrF,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AAC7F,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAKlE,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,EAAE,CAAC,EAAE,sBAAsB,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,oBAAoB,CAAA;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,YAAY,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,cAAc,CAAA;IAC9B,cAAc,EAAE,cAAc,CAAA;CAC/B;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAChD,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAA;AAC9D,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;AAExE,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,qBAA0B,GAAG,YAAY,CAsBrF;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B7E;AAqED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAqCvF;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAE7G;AAED,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,cAAc,CAAC,CAwFvG;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,MAAM,UAAQ,GAAG,cAAc,CAa5F;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,CAIhG;AAiBD,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiC3G"}
+{"version":3,"file":"project-runtime.d.ts","sourceRoot":"","sources":["../src/project-runtime.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAG7E,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAE3E,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAGrF,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,sCAAsC,CAAA;AAG7C,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AAC7F,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAKlE,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,EAAE,CAAC,EAAE,sBAAsB,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAA;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,oBAAoB,CAAA;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,YAAY,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,cAAc,CAAA;IAC9B,cAAc,EAAE,cAAc,CAAA;IAC9B,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CACxC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAChD,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAC5C,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAA;AAC9D,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;AAExE,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,qBAA0B,GAAG,YAAY,CAsBrF;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B7E;AAqED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAqCvF;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAE7G;AAED,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,cAAc,CAAC,CAmGvG;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,qBAAqB,EAC9B,cAAc,iBAAwD,GACrE,wBAAwB,GAAG,SAAS,CAyBtC;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,MAAM,UAAQ,GAAG,cAAc,CAa5F;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,CAIhG;AAiBD,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiC3G"}

package/dist/runtime/auth/password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/password.ts"],"names":[],"mappings":"AAAA,2FAA2F;AA0B3F,8FAA8F;AAC9F,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA6BvF"}
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/password.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAwB3F,8FAA8F;AAC9F,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA6BvF"}

package/dist/runtime/db/emulated.d.ts

@@ -14,7 +14,7 @@
  * matching pgmq's signatures. No C extension, no background worker needed.
  */
 export declare const PGMQ_SQL = "\ncreate schema if not exists pgmq;\nrevoke all on schema pgmq from public, anon, authenticated;\ngrant usage on schema pgmq to service_role;\n\ncreate table if not exists pgmq.meta (\n  queue_name text primary key,\n  physical_name text not null unique,\n  is_partitioned boolean not null default false,\n  is_unlogged boolean not null default false,\n  created_at timestamptz not null default now()\n);\n\n-- Preserve queues created by older Lite versions. Their physical names were\n-- the queue names, so only the already-truncated identifier can be recovered.\ninsert into pgmq.meta (queue_name, physical_name)\nselect substring(tablename from 3), substring(tablename from 3)\nfrom pg_tables\nwhere schemaname = 'pgmq' and left(tablename, 2) = 'q_'\non conflict do nothing;\n\ndo $$ begin\n  if not exists (select 1 from pg_type t join pg_namespace n on n.oid = t.typnamespace\n                 where t.typname = 'message_record' and n.nspname = 'pgmq') then\n    create type pgmq.message_record as (\n      msg_id bigint, read_ct integer, enqueued_at timestamptz, vt timestamptz, message jsonb\n    );\n  end if;\nend $$;\n\ncreate or replace function pgmq._normalize_queue_name(queue_name text)\nreturns text language plpgsql immutable set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare normalized text := btrim(queue_name);\nbegin\n  if normalized is null or normalized !~ '^[a-z0-9][a-z0-9_-]{0,127}$' then\n    raise exception 'invalid queue name: must match ^[a-z0-9][a-z0-9_-]{0,127}$'\n      using errcode = '22023';\n  end if;\n  return normalized;\nend $pgmq$;\n\n-- PostgreSQL identifiers are limited to 63 bytes. Keep the conventional table\n-- name for short queues and add a deterministic hash for valid 62-128 byte\n-- public names so truncation can never merge two queues.\ncreate or replace function pgmq._physical_queue_name(queue_name text)\nreturns text language sql immutable set search_path = pgmq, pg_catalog, public as $pgmq$\n  select case when length(normalized) <= 61 then normalized\n    else left(normalized, 28) || '_' || md5(normalized) end\n  from (select pgmq._normalize_queue_name(queue_name) as normalized) names;\n$pgmq$;\n\ncreate or replace function pgmq._resolve_queue(queue_name text)\nreturns text language plpgsql stable security definer set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare normalized text := pgmq._normalize_queue_name(queue_name); physical text;\nbegin\n  select physical_name into physical from pgmq.meta where pgmq.meta.queue_name = normalized;\n  if physical is null then\n    raise exception 'queue \"%\" does not exist', normalized using errcode = '42P01';\n  end if;\n  return physical;\nend $pgmq$;\n\ncreate or replace function pgmq.create(queue_name text) returns void language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare normalized text := pgmq._normalize_queue_name(queue_name); physical text := pgmq._physical_queue_name(queue_name);\nbegin\n  insert into pgmq.meta (queue_name, physical_name) values (normalized, physical)\n  on conflict do nothing;\n  select physical_name into physical from pgmq.meta where pgmq.meta.queue_name = normalized;\n  execute format('create table if not exists pgmq.%I (\n    msg_id bigint generated always as identity primary key,\n    read_ct integer not null default 0,\n    enqueued_at timestamptz not null default now(),\n    vt timestamptz not null default now(),\n    message jsonb)', 'q_' || physical);\n  execute format('create table if not exists pgmq.%I (\n    msg_id bigint primary key, read_ct integer not null default 0,\n    enqueued_at timestamptz not null, archived_at timestamptz not null default now(),\n    vt timestamptz, message jsonb)', 'a_' || physical);\nend $pgmq$;\n\ncreate or replace function pgmq.send(queue_name text, msg jsonb, delay integer default 0)\nreturns bigint language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare id bigint; physical text := pgmq._resolve_queue(queue_name);\nbegin\n  execute format('insert into pgmq.%I (vt, message) values (now() + make_interval(secs => $1), $2) returning msg_id', 'q_' || physical)\n    into id using delay, msg;\n  return id;\nend $pgmq$;\n\ncreate or replace function pgmq.send_batch(queue_name text, msgs jsonb[], delay integer default 0)\nreturns setof bigint language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare queue_message jsonb;\nbegin\n  perform pgmq._resolve_queue(queue_name);\n  foreach queue_message in array msgs loop\n    return next pgmq.send(queue_name, queue_message, delay);\n  end loop;\nend $pgmq$;\n\ncreate or replace function pgmq.read(queue_name text, vt integer, qty integer)\nreturns setof pgmq.message_record language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare physical text := pgmq._resolve_queue(queue_name);\nbegin\n  return query execute format($fmt$\n    with cte as (\n      select msg_id from pgmq.%I where vt <= now() order by msg_id limit $1 for update skip locked\n    )\n    update pgmq.%I m set vt = now() + make_interval(secs => $2), read_ct = read_ct + 1\n    from cte where m.msg_id = cte.msg_id\n    returning m.msg_id, m.read_ct, m.enqueued_at, m.vt, m.message\n  $fmt$, 'q_' || physical, 'q_' || physical) using qty, vt;\nend $pgmq$;\n\ncreate or replace function pgmq.pop(queue_name text)\nreturns setof pgmq.message_record language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare physical text := pgmq._resolve_queue(queue_name);\nbegin\n  return query execute format($fmt$\n    with cte as (select msg_id from pgmq.%I where vt <= now() order by msg_id limit 1 for update skip locked)\n    delete from pgmq.%I m using cte where m.msg_id = cte.msg_id\n    returning m.msg_id, m.read_ct, m.enqueued_at, m.vt, m.message\n  $fmt$, 'q_' || physical, 'q_' || physical);\nend $pgmq$;\n\ncreate or replace function pgmq.set_vt(queue_name text, msg_id bigint, vt_offset integer)\nreturns setof pgmq.message_record language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare physical text := pgmq._resolve_queue(queue_name);\nbegin\n  return query execute format($fmt$\n    update pgmq.%I m set vt = now() + make_interval(secs => $1)\n    where m.msg_id = $2\n    returning m.msg_id, m.read_ct, m.enqueued_at, m.vt, m.message\n  $fmt$, 'q_' || physical) using vt_offset, msg_id;\nend $pgmq$;\n\ncreate or replace function pgmq.delete(queue_name text, msg_id bigint)\nreturns boolean language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare n integer; physical text := pgmq._resolve_queue(queue_name);\nbegin\n  execute format('delete from pgmq.%I where msg_id = $1', 'q_' || physical) using msg_id;\n  get diagnostics n = row_count;\n  return n > 0;\nend $pgmq$;\n\ncreate or replace function pgmq.archive(queue_name text, msg_id bigint)\nreturns boolean language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare n integer; physical text := pgmq._resolve_queue(queue_name);\nbegin\n  execute format($fmt$\n    with del as (delete from pgmq.%I where msg_id = $1 returning *)\n    insert into pgmq.%I (msg_id, read_ct, enqueued_at, vt, message)\n    select msg_id, read_ct, enqueued_at, vt, message from del\n  $fmt$, 'q_' || physical, 'a_' || physical) using msg_id;\n  get diagnostics n = row_count;\n  return n > 0;\nend $pgmq$;\n\ncreate or replace function pgmq.drop_queue(queue_name text) returns boolean language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare normalized text := pgmq._normalize_queue_name(queue_name); physical text;\nbegin\n  select physical_name into physical from pgmq.meta where pgmq.meta.queue_name = normalized;\n  if physical is null then return false; end if;\n  execute format('drop table if exists pgmq.%I', 'q_' || physical);\n  execute format('drop table if exists pgmq.%I', 'a_' || physical);\n  delete from pgmq.meta where pgmq.meta.queue_name = normalized;\n  return true;\nend $pgmq$;\n\ncreate or replace function pgmq.purge_queue(queue_name text) returns bigint language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare n bigint; physical text := pgmq._resolve_queue(queue_name);\nbegin\n  execute format('delete from pgmq.%I', 'q_' || physical);\n  get diagnostics n = row_count;\n  return n;\nend $pgmq$;\n\ncreate or replace function pgmq.list_queues()\nreturns table(queue_name text, is_partitioned boolean, is_unlogged boolean, created_at timestamptz)\nlanguage sql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\n  select queue_name, is_partitioned, is_unlogged, created_at from pgmq.meta;\n$pgmq$;\n\nrevoke all on all functions in schema pgmq from public, anon, authenticated;\ngrant execute on all functions in schema pgmq to service_role;\n\n-- supacloud:sql-module:pgmq-public:start\nDO $pgmq_extension$\nBEGIN\n  IF to_regprocedure('pgmq.send(text,jsonb,integer)') IS NULL THEN\n    EXECUTE 'CREATE EXTENSION IF NOT EXISTS pgmq';\n  END IF;\nEND\n$pgmq_extension$;\n\nCREATE SCHEMA IF NOT EXISTS pgmq_public;\nGRANT USAGE ON SCHEMA pgmq_public TO anon, authenticated, service_role;\n\nCREATE OR REPLACE FUNCTION pgmq_public.require_public_queue(queue_name text)\nRETURNS text\nLANGUAGE plpgsql\nIMMUTABLE\nSET search_path = ''\nAS $$\nDECLARE\n  normalized_queue_name text := lower(btrim(queue_name));\nBEGIN\n  IF normalized_queue_name IS NULL\n     OR left(normalized_queue_name, char_length('supacloud_internal_')) = 'supacloud_internal_' THEN\n    RAISE EXCEPTION 'SUPACLOUD_QUEUE_NAME_RESERVED' USING ERRCODE = '42501';\n  END IF;\n  RETURN normalized_queue_name;\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION pgmq_public.send(queue_name text, message jsonb, sleep_seconds integer DEFAULT 0)\nRETURNS SETOF bigint\nLANGUAGE sql\nVOLATILE\nSECURITY DEFINER\nSET search_path = ''\nAS $$ SELECT * FROM pgmq.send(pgmq_public.require_public_queue(queue_name), message, sleep_seconds); $$;\n\nCREATE OR REPLACE FUNCTION pgmq_public.send_batch(queue_name text, messages jsonb[], sleep_seconds integer DEFAULT 0)\nRETURNS SETOF bigint\nLANGUAGE sql\nVOLATILE\nSECURITY DEFINER\nSET search_path = ''\nAS $$ SELECT * FROM pgmq.send_batch(pgmq_public.require_public_queue(queue_name), messages, sleep_seconds); $$;\n\nCREATE OR REPLACE FUNCTION pgmq_public.read(queue_name text, sleep_seconds integer, n integer)\nRETURNS SETOF pgmq.message_record\nLANGUAGE sql\nVOLATILE\nSECURITY DEFINER\nSET search_path = ''\nAS $$ SELECT * FROM pgmq.read(pgmq_public.require_public_queue(queue_name), sleep_seconds, n); $$;\n\nCREATE OR REPLACE FUNCTION pgmq_public.pop(queue_name text)\nRETURNS SETOF pgmq.message_record\nLANGUAGE sql\nVOLATILE\nSECURITY DEFINER\nSET search_path = ''\nAS $$ SELECT * FROM pgmq.pop(pgmq_public.require_public_queue(queue_name)); $$;\n\nCREATE OR REPLACE FUNCTION pgmq_public.archive(queue_name text, message_id bigint)\nRETURNS boolean\nLANGUAGE sql\nVOLATILE\nSECURITY DEFINER\nSET search_path = ''\nAS $$ SELECT pgmq.archive(pgmq_public.require_public_queue(queue_name), message_id); $$;\n\nCREATE OR REPLACE FUNCTION pgmq_public.\"delete\"(queue_name text, message_id bigint)\nRETURNS boolean\nLANGUAGE sql\nVOLATILE\nSECURITY DEFINER\nSET search_path = ''\nAS $$ SELECT pgmq.delete(pgmq_public.require_public_queue(queue_name), message_id); $$;\n\nREVOKE ALL ON ALL FUNCTIONS IN SCHEMA pgmq_public FROM PUBLIC;\nGRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA pgmq_public TO anon, authenticated, service_role;\n-- supacloud:sql-module:pgmq-public:end\n";
-export declare const WORKFLOWS_SQL = "\n-- supacloud:sql-module:workflows-public:start\nDO $pgmq_extension$\nBEGIN\n  IF to_regprocedure('pgmq.send(text,jsonb,integer)') IS NULL THEN\n    EXECUTE 'CREATE EXTENSION IF NOT EXISTS pgmq';\n  END IF;\nEND\n$pgmq_extension$;\nCREATE SCHEMA IF NOT EXISTS supacloud_workflows;\nREVOKE ALL ON SCHEMA supacloud_workflows FROM PUBLIC, anon, authenticated;\nGRANT USAGE ON SCHEMA supacloud_workflows TO service_role;\n\nSELECT pgmq.create('supacloud_internal_workflows');\n\nCREATE TABLE IF NOT EXISTS supacloud_workflows.runs (\n  id uuid PRIMARY KEY,\n  workflow_name text NOT NULL\n    CHECK (workflow_name ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'),\n  workflow_version text NOT NULL\n    CHECK (char_length(workflow_version) BETWEEN 1 AND 80),\n  status text NOT NULL DEFAULT 'queued'\n    CHECK (status IN ('queued', 'running', 'completed', 'failed', 'cancelled')),\n  input jsonb NOT NULL DEFAULT '{}'::jsonb\n    CHECK (jsonb_typeof(input) = 'object'),\n  output jsonb NOT NULL DEFAULT '{}'::jsonb\n    CHECK (jsonb_typeof(output) = 'object'),\n  error_message text NOT NULL DEFAULT ''\n    CHECK (char_length(error_message) <= 4000),\n  row_version bigint NOT NULL DEFAULT 1 CHECK (row_version > 0),\n  created_at timestamptz NOT NULL DEFAULT now(),\n  started_at timestamptz,\n  completed_at timestamptz,\n  updated_at timestamptz NOT NULL DEFAULT now()\n);\n\nCREATE TABLE IF NOT EXISTS supacloud_workflows.steps (\n  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n  run_id uuid NOT NULL REFERENCES supacloud_workflows.runs(id) ON DELETE CASCADE,\n  step_key text NOT NULL\n    CHECK (step_key ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'),\n  status text NOT NULL DEFAULT 'queued'\n    CHECK (status IN ('queued', 'running', 'completed', 'failed', 'dead_lettered', 'cancelled')),\n  input jsonb NOT NULL DEFAULT '{}'::jsonb\n    CHECK (jsonb_typeof(input) = 'object'),\n  output jsonb NOT NULL DEFAULT '{}'::jsonb\n    CHECK (jsonb_typeof(output) = 'object'),\n  error_message text NOT NULL DEFAULT ''\n    CHECK (char_length(error_message) <= 4000),\n  attempts integer NOT NULL DEFAULT 0 CHECK (attempts >= 0),\n  max_attempts integer NOT NULL DEFAULT 3 CHECK (max_attempts BETWEEN 1 AND 100),\n  retry_delay_seconds integer NOT NULL DEFAULT 0\n    CHECK (retry_delay_seconds BETWEEN 0 AND 86400),\n  queue_message_id bigint NOT NULL UNIQUE,\n  claimed_by text,\n  claimed_at timestamptz,\n  completed_at timestamptz,\n  next_step_key text,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  updated_at timestamptz NOT NULL DEFAULT now(),\n  UNIQUE (run_id, step_key)\n);\n\nALTER TABLE supacloud_workflows.steps\n  ADD COLUMN IF NOT EXISTS retry_delay_seconds integer NOT NULL DEFAULT 0\n    CHECK (retry_delay_seconds BETWEEN 0 AND 86400);\n\nCREATE UNIQUE INDEX IF NOT EXISTS supacloud_workflows_one_active_step_idx\n  ON supacloud_workflows.steps (run_id)\n  WHERE status IN ('queued', 'running');\n\nCREATE INDEX IF NOT EXISTS supacloud_workflows_runs_status_idx\n  ON supacloud_workflows.runs (status, updated_at DESC, id);\n\nCREATE INDEX IF NOT EXISTS supacloud_workflows_steps_run_idx\n  ON supacloud_workflows.steps (run_id, created_at, id);\n\nCREATE TABLE IF NOT EXISTS supacloud_workflows.events (\n  id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,\n  run_id uuid NOT NULL REFERENCES supacloud_workflows.runs(id) ON DELETE CASCADE,\n  step_id uuid REFERENCES supacloud_workflows.steps(id) ON DELETE CASCADE,\n  event_type text NOT NULL\n    CHECK (event_type IN (\n      'run_started', 'step_claimed', 'step_retried', 'step_completed',\n      'step_failed', 'step_dead_lettered', 'run_completed', 'run_cancelled'\n    )),\n  attempt integer CHECK (attempt IS NULL OR attempt > 0),\n  details jsonb NOT NULL DEFAULT '{}'::jsonb\n    CHECK (jsonb_typeof(details) = 'object'),\n  created_at timestamptz NOT NULL DEFAULT now()\n);\n\nCREATE INDEX IF NOT EXISTS supacloud_workflows_events_run_idx\n  ON supacloud_workflows.events (run_id, id);\n\nCREATE UNIQUE INDEX IF NOT EXISTS supacloud_workflows_retry_receipt_idx\n  ON supacloud_workflows.events (step_id, attempt)\n  WHERE event_type IN ('step_retried', 'step_dead_lettered')\n    AND details ->> 'operation' = 'retry';\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.snapshot(\n  p_run_id uuid,\n  p_idempotent boolean DEFAULT false\n) RETURNS jsonb\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT jsonb_build_object(\n    'runId', run.id,\n    'workflowName', run.workflow_name,\n    'workflowVersion', run.workflow_version,\n    'status', run.status,\n    'input', run.input,\n    'output', run.output,\n    'errorMessage', run.error_message,\n    'rowVersion', run.row_version::text,\n    'createdAt', run.created_at,\n    'startedAt', run.started_at,\n    'completedAt', run.completed_at,\n    'updatedAt', run.updated_at,\n    'idempotent', p_idempotent,\n    'steps', coalesce((\n      SELECT jsonb_agg(jsonb_build_object(\n        'stepId', step.id,\n        'stepKey', step.step_key,\n        'status', step.status,\n        'input', step.input,\n        'output', step.output,\n        'errorMessage', step.error_message,\n        'attempts', step.attempts,\n        'maxAttempts', step.max_attempts,\n        'retryDelaySeconds', step.retry_delay_seconds,\n        'queueMessageId', step.queue_message_id::text,\n        'claimedBy', step.claimed_by,\n        'claimedAt', step.claimed_at,\n        'completedAt', step.completed_at,\n        'nextStepKey', step.next_step_key,\n        'createdAt', step.created_at,\n        'updatedAt', step.updated_at\n      ) ORDER BY step.created_at, step.id)\n      FROM supacloud_workflows.steps step\n      WHERE step.run_id = run.id\n    ), '[]'::jsonb)\n  )\n  FROM supacloud_workflows.runs run\n  WHERE run.id = p_run_id\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.enqueue_step(\n  p_run_id uuid,\n  p_step_key text,\n  p_input jsonb,\n  p_max_attempts integer\n) RETURNS supacloud_workflows.steps\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  normalized_step_key text := nullif(btrim(p_step_key), '');\n  step_id uuid := gen_random_uuid();\n  message_id bigint;\n  created_step supacloud_workflows.steps%ROWTYPE;\nBEGIN\n  IF normalized_step_key IS NULL\n     OR normalized_step_key !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'\n     OR jsonb_typeof(p_input) IS DISTINCT FROM 'object'\n     OR p_max_attempts NOT BETWEEN 1 AND 100 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STEP_INVALID' USING ERRCODE = '22023';\n  END IF;\n\n  IF NOT EXISTS (\n    SELECT 1 FROM supacloud_workflows.runs run\n    WHERE run.id = p_run_id AND run.status IN ('queued', 'running')\n  ) THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RUN_NOT_ACTIVE' USING ERRCODE = '55000';\n  END IF;\n\n  SELECT queued_id INTO message_id\n  FROM pgmq.send(\n    'supacloud_internal_workflows',\n    jsonb_build_object('run_id', p_run_id, 'step_id', step_id),\n    0\n  ) AS queued_id;\n\n  INSERT INTO supacloud_workflows.steps (\n    id, run_id, step_key, input, max_attempts, queue_message_id\n  ) VALUES (\n    step_id, p_run_id, normalized_step_key, p_input, p_max_attempts, message_id\n  ) RETURNING * INTO created_step;\n\n  RETURN created_step;\nEND;\n$$;\n\n-- Clean-code exception: private transitions keep typed PostgreSQL arguments and\n-- the complete lock/queue/ledger/event mutation in one transaction. The public\n-- contract already uses one JSON request; revisit if a private routine gains a\n-- second caller or any transition can be decomposed without weakening atomicity.\nCREATE OR REPLACE FUNCTION supacloud_workflows.start_run(\n  p_run_id uuid,\n  p_workflow_name text,\n  p_workflow_version text,\n  p_first_step_key text,\n  p_input jsonb,\n  p_max_attempts integer\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  normalized_name text := nullif(btrim(p_workflow_name), '');\n  normalized_version text := nullif(btrim(p_workflow_version), '');\n  normalized_first_step_key text := nullif(btrim(p_first_step_key), '');\n  existing_run supacloud_workflows.runs%ROWTYPE;\n  existing_step supacloud_workflows.steps%ROWTYPE;\n  first_step supacloud_workflows.steps%ROWTYPE;\nBEGIN\n  IF p_run_id IS NULL\n     OR normalized_name IS NULL\n     OR normalized_name !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'\n     OR normalized_version IS NULL\n     OR char_length(normalized_version) > 80\n     OR normalized_first_step_key IS NULL\n     OR normalized_first_step_key !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'\n     OR jsonb_typeof(p_input) IS DISTINCT FROM 'object'\n     OR p_max_attempts NOT BETWEEN 1 AND 100 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_START_INVALID' USING ERRCODE = '22023';\n  END IF;\n\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_run_id::text, 0));\n  SELECT * INTO existing_run FROM supacloud_workflows.runs WHERE id = p_run_id;\n  IF FOUND THEN\n    SELECT * INTO existing_step\n    FROM supacloud_workflows.steps\n    WHERE run_id = p_run_id\n    ORDER BY created_at, id\n    LIMIT 1;\n    IF NOT FOUND THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    IF existing_run.workflow_name <> normalized_name\n       OR existing_run.workflow_version <> normalized_version\n       OR existing_run.input <> p_input\n       OR existing_step.step_key <> normalized_first_step_key\n       OR existing_step.input <> p_input\n       OR existing_step.max_attempts <> p_max_attempts THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    RETURN supacloud_workflows.snapshot(p_run_id, true);\n  END IF;\n\n  INSERT INTO supacloud_workflows.runs (\n    id, workflow_name, workflow_version, input\n  ) VALUES (\n    p_run_id, normalized_name, normalized_version, p_input\n  );\n  first_step := supacloud_workflows.enqueue_step(\n    p_run_id, normalized_first_step_key, p_input, p_max_attempts\n  );\n  INSERT INTO supacloud_workflows.events (run_id, step_id, event_type)\n  VALUES (p_run_id, first_step.id, 'run_started');\n  RETURN supacloud_workflows.snapshot(p_run_id, false);\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.claim_step(\n  p_worker_id text,\n  p_visibility_timeout_seconds integer\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  normalized_worker_id text := nullif(btrim(p_worker_id), '');\n  queued_message pgmq.message_record;\n  message_run_id text;\n  message_step_id text;\n  candidate_run_id uuid;\n  claimed_step supacloud_workflows.steps%ROWTYPE;\n  claimed_run supacloud_workflows.runs%ROWTYPE;\nBEGIN\n  IF normalized_worker_id IS NULL\n     OR char_length(normalized_worker_id) > 200\n     OR p_visibility_timeout_seconds NOT BETWEEN 15 AND 3600 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_CLAIM_INVALID' USING ERRCODE = '22023';\n  END IF;\n\n  SELECT * INTO queued_message\n  FROM pgmq.read('supacloud_internal_workflows', p_visibility_timeout_seconds, 1)\n  LIMIT 1;\n  IF NOT FOUND THEN RETURN NULL; END IF;\n\n  message_run_id := queued_message.message ->> 'run_id';\n  message_step_id := queued_message.message ->> 'step_id';\n  IF jsonb_typeof(queued_message.message) IS DISTINCT FROM 'object'\n     OR message_run_id IS NULL\n     OR message_step_id IS NULL\n     OR message_run_id !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'\n     OR message_step_id !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$' THEN\n    PERFORM pgmq.archive('supacloud_internal_workflows', queued_message.msg_id);\n    RETURN jsonb_build_object(\n      'status', 'discarded',\n      'reason', 'invalid_message',\n      'messageId', queued_message.msg_id::text\n    );\n  END IF;\n\n  SELECT step.run_id INTO candidate_run_id\n  FROM supacloud_workflows.steps step\n  WHERE step.id::text = lower(message_step_id)\n    AND step.run_id::text = lower(message_run_id)\n    AND step.queue_message_id = queued_message.msg_id;\n  IF NOT FOUND THEN\n    PERFORM pgmq.archive('supacloud_internal_workflows', queued_message.msg_id);\n    RETURN jsonb_build_object(\n      'status', 'discarded',\n      'reason', 'orphaned_message',\n      'messageId', queued_message.msg_id::text\n    );\n  END IF;\n\n  IF NOT pg_try_advisory_xact_lock(hashtextextended(candidate_run_id::text, 0)) THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_CLAIM_RETRY' USING ERRCODE = '40001';\n  END IF;\n  SELECT * INTO claimed_step\n  FROM supacloud_workflows.steps\n  WHERE id::text = lower(message_step_id)\n    AND run_id = candidate_run_id\n    AND queue_message_id = queued_message.msg_id\n  FOR UPDATE;\n  IF NOT FOUND THEN\n    PERFORM pgmq.archive('supacloud_internal_workflows', queued_message.msg_id);\n    RETURN jsonb_build_object(\n      'status', 'discarded',\n      'reason', 'orphaned_message',\n      'messageId', queued_message.msg_id::text\n    );\n  END IF;\n\n  SELECT * INTO claimed_run\n  FROM supacloud_workflows.runs\n  WHERE id = claimed_step.run_id\n  FOR UPDATE;\n  IF claimed_run.status NOT IN ('queued', 'running')\n     OR claimed_step.status NOT IN ('queued', 'running') THEN\n    PERFORM pgmq.archive('supacloud_internal_workflows', queued_message.msg_id);\n    RETURN jsonb_build_object(\n      'status', 'discarded',\n      'reason', 'step_not_claimable',\n      'runId', claimed_step.run_id,\n      'stepId', claimed_step.id,\n      'messageId', queued_message.msg_id::text\n    );\n  END IF;\n\n  IF queued_message.read_ct > claimed_step.max_attempts THEN\n    UPDATE supacloud_workflows.steps\n    SET status = 'dead_lettered', attempts = queued_message.read_ct,\n        error_message = 'maximum attempts exceeded', completed_at = now(), updated_at = now()\n    WHERE id = claimed_step.id;\n    UPDATE supacloud_workflows.runs\n    SET status = 'failed', error_message = 'maximum attempts exceeded',\n        completed_at = now(), updated_at = now(), row_version = row_version + 1\n    WHERE id = claimed_step.run_id;\n    PERFORM pgmq.archive('supacloud_internal_workflows', queued_message.msg_id);\n    INSERT INTO supacloud_workflows.events (\n      run_id, step_id, event_type, attempt, details\n    ) VALUES (\n      claimed_step.run_id, claimed_step.id, 'step_dead_lettered', queued_message.read_ct,\n      jsonb_build_object('errorMessage', 'maximum attempts exceeded')\n    );\n    RETURN jsonb_build_object(\n      'status', 'dead_lettered',\n      'runId', claimed_step.run_id,\n      'stepId', claimed_step.id,\n      'stepKey', claimed_step.step_key,\n      'messageId', queued_message.msg_id::text,\n      'attempt', queued_message.read_ct,\n      'maxAttempts', claimed_step.max_attempts\n    );\n  END IF;\n\n  UPDATE supacloud_workflows.steps\n  SET status = 'running', attempts = queued_message.read_ct,\n      retry_delay_seconds = 0, claimed_by = normalized_worker_id,\n      claimed_at = now(), updated_at = now()\n  WHERE id = claimed_step.id;\n  UPDATE supacloud_workflows.runs\n  SET status = 'running', started_at = coalesce(started_at, now()),\n      updated_at = now(), row_version = row_version + 1\n  WHERE id = claimed_step.run_id;\n  INSERT INTO supacloud_workflows.events (run_id, step_id, event_type, attempt, details)\n  VALUES (\n    claimed_step.run_id, claimed_step.id, 'step_claimed', queued_message.read_ct,\n    jsonb_build_object('workerId', normalized_worker_id)\n  );\n\n  RETURN jsonb_build_object(\n    'status', 'claimed',\n    'runId', claimed_step.run_id,\n    'workflowName', claimed_run.workflow_name,\n    'workflowVersion', claimed_run.workflow_version,\n    'stepId', claimed_step.id,\n    'stepKey', claimed_step.step_key,\n    'input', claimed_step.input,\n    'messageId', queued_message.msg_id::text,\n    'attempt', queued_message.read_ct,\n    'maxAttempts', claimed_step.max_attempts,\n    'workerId', normalized_worker_id\n  );\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.lock_step(\n  p_step_id uuid\n) RETURNS supacloud_workflows.steps\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  candidate_run_id uuid;\n  active_step supacloud_workflows.steps%ROWTYPE;\nBEGIN\n  SELECT step.run_id INTO candidate_run_id\n  FROM supacloud_workflows.steps step\n  WHERE step.id = p_step_id;\n  IF NOT FOUND THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STEP_NOT_FOUND' USING ERRCODE = 'P0002';\n  END IF;\n  PERFORM pg_advisory_xact_lock(hashtextextended(candidate_run_id::text, 0));\n  SELECT * INTO active_step\n  FROM supacloud_workflows.steps\n  WHERE id = p_step_id\n  FOR UPDATE;\n  IF NOT FOUND THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STEP_NOT_FOUND' USING ERRCODE = 'P0002';\n  END IF;\n  RETURN active_step;\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.lock_step_attempt(\n  p_step_id uuid,\n  p_message_id bigint,\n  p_attempt integer,\n  p_worker_id text\n) RETURNS supacloud_workflows.steps\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  active_step supacloud_workflows.steps%ROWTYPE;\n  normalized_worker_id text := nullif(btrim(p_worker_id), '');\nBEGIN\n  active_step := supacloud_workflows.lock_step(p_step_id);\n  IF normalized_worker_id IS NULL\n     OR p_message_id IS NULL\n     OR p_attempt IS NULL\n     OR active_step.queue_message_id IS DISTINCT FROM p_message_id\n     OR active_step.attempts IS DISTINCT FROM p_attempt\n     OR active_step.claimed_by IS DISTINCT FROM normalized_worker_id THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STALE_ATTEMPT' USING ERRCODE = '40001';\n  END IF;\n  RETURN active_step;\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.advance_step(\n  p_step_id uuid,\n  p_message_id bigint,\n  p_attempt integer,\n  p_worker_id text,\n  p_output jsonb,\n  p_next_step_key text,\n  p_next_input jsonb,\n  p_next_max_attempts integer\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  current_step supacloud_workflows.steps%ROWTYPE;\n  next_step supacloud_workflows.steps%ROWTYPE;\n  normalized_next_step_key text := nullif(btrim(p_next_step_key), '');\n  archived boolean;\nBEGIN\n  IF jsonb_typeof(p_output) IS DISTINCT FROM 'object'\n     OR jsonb_typeof(p_next_input) IS DISTINCT FROM 'object'\n     OR normalized_next_step_key IS NULL\n     OR normalized_next_step_key !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'\n     OR p_next_max_attempts NOT BETWEEN 1 AND 100 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_ADVANCE_INVALID' USING ERRCODE = '22023';\n  END IF;\n  current_step := supacloud_workflows.lock_step_attempt(\n    p_step_id, p_message_id, p_attempt, p_worker_id\n  );\n\n  IF current_step.status = 'completed' THEN\n    SELECT * INTO next_step\n    FROM supacloud_workflows.steps\n    WHERE run_id = current_step.run_id AND step_key = normalized_next_step_key;\n    IF NOT FOUND\n       OR current_step.output IS DISTINCT FROM p_output\n       OR current_step.next_step_key IS DISTINCT FROM normalized_next_step_key\n       OR next_step.input IS DISTINCT FROM p_next_input\n       OR next_step.max_attempts IS DISTINCT FROM p_next_max_attempts THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    RETURN supacloud_workflows.snapshot(current_step.run_id, true);\n  END IF;\n  IF current_step.status <> 'running' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STALE_ATTEMPT' USING ERRCODE = '40001';\n  END IF;\n\n  SELECT pgmq.archive('supacloud_internal_workflows', p_message_id) INTO archived;\n  IF archived IS DISTINCT FROM true THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_QUEUE_MESSAGE_MISSING' USING ERRCODE = '55000';\n  END IF;\n  UPDATE supacloud_workflows.steps\n  SET status = 'completed', output = p_output, error_message = '',\n      completed_at = now(), next_step_key = normalized_next_step_key, updated_at = now()\n  WHERE id = current_step.id;\n  INSERT INTO supacloud_workflows.events (\n    run_id, step_id, event_type, attempt, details\n  ) VALUES (\n    current_step.run_id, current_step.id, 'step_completed', p_attempt,\n    jsonb_build_object('nextStepKey', normalized_next_step_key)\n  );\n  next_step := supacloud_workflows.enqueue_step(\n    current_step.run_id, normalized_next_step_key, p_next_input, p_next_max_attempts\n  );\n  RETURN supacloud_workflows.snapshot(current_step.run_id, false);\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.complete_run(\n  p_step_id uuid,\n  p_message_id bigint,\n  p_attempt integer,\n  p_worker_id text,\n  p_step_output jsonb,\n  p_run_output jsonb\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  current_step supacloud_workflows.steps%ROWTYPE;\n  current_run supacloud_workflows.runs%ROWTYPE;\n  archived boolean;\nBEGIN\n  IF jsonb_typeof(p_step_output) IS DISTINCT FROM 'object'\n     OR jsonb_typeof(p_run_output) IS DISTINCT FROM 'object' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_COMPLETION_INVALID' USING ERRCODE = '22023';\n  END IF;\n  current_step := supacloud_workflows.lock_step_attempt(\n    p_step_id, p_message_id, p_attempt, p_worker_id\n  );\n  SELECT * INTO current_run\n  FROM supacloud_workflows.runs\n  WHERE id = current_step.run_id\n  FOR UPDATE;\n\n  IF current_step.status = 'completed' THEN\n    IF current_step.next_step_key IS NOT NULL\n       OR current_step.output IS DISTINCT FROM p_step_output\n       OR current_run.status IS DISTINCT FROM 'completed'\n       OR current_run.output IS DISTINCT FROM p_run_output THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    RETURN supacloud_workflows.snapshot(current_step.run_id, true);\n  END IF;\n  IF current_step.status <> 'running' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STALE_ATTEMPT' USING ERRCODE = '40001';\n  END IF;\n  IF current_run.status <> 'running' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RUN_NOT_ACTIVE' USING ERRCODE = '55000';\n  END IF;\n\n  SELECT pgmq.archive('supacloud_internal_workflows', p_message_id) INTO archived;\n  IF archived IS DISTINCT FROM true THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_QUEUE_MESSAGE_MISSING' USING ERRCODE = '55000';\n  END IF;\n  UPDATE supacloud_workflows.steps\n  SET status = 'completed', output = p_step_output, error_message = '',\n      completed_at = now(), updated_at = now()\n  WHERE id = current_step.id;\n  UPDATE supacloud_workflows.runs\n  SET status = 'completed', output = p_run_output, error_message = '',\n      completed_at = now(), updated_at = now(), row_version = row_version + 1\n  WHERE id = current_step.run_id AND status = 'running';\n  INSERT INTO supacloud_workflows.events (run_id, step_id, event_type, attempt)\n  VALUES (current_step.run_id, current_step.id, 'step_completed', p_attempt);\n  INSERT INTO supacloud_workflows.events (run_id, step_id, event_type, attempt)\n  VALUES (current_step.run_id, current_step.id, 'run_completed', p_attempt);\n  RETURN supacloud_workflows.snapshot(current_step.run_id, false);\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.retry_step(\n  p_step_id uuid,\n  p_message_id bigint,\n  p_attempt integer,\n  p_worker_id text,\n  p_error_message text,\n  p_delay_seconds integer\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  current_step supacloud_workflows.steps%ROWTYPE;\n  normalized_error text := nullif(btrim(p_error_message), '');\n  normalized_worker_id text := nullif(btrim(p_worker_id), '');\n  retry_receipt jsonb;\n  queue_message_updated boolean;\n  archived boolean;\nBEGIN\n  IF normalized_error IS NULL OR char_length(normalized_error) > 4000\n     OR p_delay_seconds NOT BETWEEN 0 AND 86400 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RETRY_INVALID' USING ERRCODE = '22023';\n  END IF;\n  current_step := supacloud_workflows.lock_step(p_step_id);\n  SELECT event.details INTO retry_receipt\n  FROM supacloud_workflows.events event\n  WHERE event.step_id = current_step.id\n    AND event.attempt = p_attempt\n    AND event.event_type IN ('step_retried', 'step_dead_lettered')\n    AND event.details ->> 'operation' = 'retry'\n  ORDER BY event.id DESC\n  LIMIT 1;\n  IF FOUND THEN\n    IF retry_receipt ->> 'messageId' IS DISTINCT FROM p_message_id::text\n       OR retry_receipt ->> 'workerId' IS DISTINCT FROM normalized_worker_id\n       OR retry_receipt ->> 'errorMessage' IS DISTINCT FROM normalized_error\n       OR (retry_receipt ->> 'delaySeconds')::integer IS DISTINCT FROM p_delay_seconds THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    RETURN supacloud_workflows.snapshot(current_step.run_id, true);\n  END IF;\n  IF normalized_worker_id IS NULL\n     OR p_message_id IS NULL\n     OR p_attempt IS NULL\n     OR current_step.queue_message_id IS DISTINCT FROM p_message_id\n     OR current_step.attempts IS DISTINCT FROM p_attempt\n     OR current_step.claimed_by IS DISTINCT FROM normalized_worker_id\n     OR current_step.status <> 'running' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STALE_ATTEMPT' USING ERRCODE = '40001';\n  END IF;\n\n  IF current_step.attempts >= current_step.max_attempts THEN\n    SELECT pgmq.archive('supacloud_internal_workflows', p_message_id) INTO archived;\n    IF archived IS DISTINCT FROM true THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_QUEUE_MESSAGE_MISSING' USING ERRCODE = '55000';\n    END IF;\n    UPDATE supacloud_workflows.steps\n    SET status = 'dead_lettered', error_message = normalized_error,\n        completed_at = now(), updated_at = now()\n    WHERE id = current_step.id;\n    UPDATE supacloud_workflows.runs\n    SET status = 'failed', error_message = normalized_error,\n        completed_at = now(), updated_at = now(), row_version = row_version + 1\n    WHERE id = current_step.run_id AND status = 'running';\n    IF NOT FOUND THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RUN_NOT_ACTIVE' USING ERRCODE = '55000';\n    END IF;\n    INSERT INTO supacloud_workflows.events (\n      run_id, step_id, event_type, attempt, details\n    ) VALUES (\n      current_step.run_id, current_step.id, 'step_dead_lettered', p_attempt,\n      jsonb_build_object(\n        'operation', 'retry',\n        'messageId', p_message_id::text,\n        'workerId', normalized_worker_id,\n        'errorMessage', normalized_error,\n        'delaySeconds', p_delay_seconds\n      )\n    );\n    RETURN supacloud_workflows.snapshot(current_step.run_id, false);\n  END IF;\n\n  SELECT EXISTS (\n    SELECT 1 FROM pgmq.set_vt('supacloud_internal_workflows', p_message_id, p_delay_seconds)\n  ) INTO queue_message_updated;\n  IF queue_message_updated IS DISTINCT FROM true THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_QUEUE_MESSAGE_MISSING' USING ERRCODE = '55000';\n  END IF;\n  UPDATE supacloud_workflows.steps\n  SET status = 'queued', error_message = normalized_error,\n      retry_delay_seconds = p_delay_seconds, updated_at = now()\n  WHERE id = current_step.id;\n  INSERT INTO supacloud_workflows.events (\n    run_id, step_id, event_type, attempt, details\n  ) VALUES (\n    current_step.run_id, current_step.id, 'step_retried', p_attempt,\n    jsonb_build_object(\n      'operation', 'retry',\n      'messageId', p_message_id::text,\n      'workerId', normalized_worker_id,\n      'errorMessage', normalized_error,\n      'delaySeconds', p_delay_seconds\n    )\n  );\n  RETURN supacloud_workflows.snapshot(current_step.run_id, false);\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.fail_step(\n  p_step_id uuid,\n  p_message_id bigint,\n  p_attempt integer,\n  p_worker_id text,\n  p_error_message text\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  current_step supacloud_workflows.steps%ROWTYPE;\n  current_run supacloud_workflows.runs%ROWTYPE;\n  normalized_error text := nullif(btrim(p_error_message), '');\n  archived boolean;\nBEGIN\n  IF normalized_error IS NULL OR char_length(normalized_error) > 4000 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_FAILURE_INVALID' USING ERRCODE = '22023';\n  END IF;\n  current_step := supacloud_workflows.lock_step_attempt(\n    p_step_id, p_message_id, p_attempt, p_worker_id\n  );\n  SELECT * INTO current_run\n  FROM supacloud_workflows.runs\n  WHERE id = current_step.run_id\n  FOR UPDATE;\n\n  IF current_step.status = 'failed' THEN\n    IF current_step.error_message IS DISTINCT FROM normalized_error\n       OR current_run.status IS DISTINCT FROM 'failed'\n       OR current_run.error_message IS DISTINCT FROM normalized_error THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    RETURN supacloud_workflows.snapshot(current_step.run_id, true);\n  END IF;\n  IF current_step.status <> 'running' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STALE_ATTEMPT' USING ERRCODE = '40001';\n  END IF;\n  IF current_run.status <> 'running' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RUN_NOT_ACTIVE' USING ERRCODE = '55000';\n  END IF;\n\n  SELECT pgmq.archive('supacloud_internal_workflows', p_message_id) INTO archived;\n  IF archived IS DISTINCT FROM true THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_QUEUE_MESSAGE_MISSING' USING ERRCODE = '55000';\n  END IF;\n  UPDATE supacloud_workflows.steps\n  SET status = 'failed', error_message = normalized_error,\n      completed_at = now(), updated_at = now()\n  WHERE id = current_step.id;\n  UPDATE supacloud_workflows.runs\n  SET status = 'failed', error_message = normalized_error,\n      completed_at = now(), updated_at = now(), row_version = row_version + 1\n  WHERE id = current_step.run_id AND status = 'running';\n  INSERT INTO supacloud_workflows.events (\n    run_id, step_id, event_type, attempt, details\n  ) VALUES (\n    current_step.run_id, current_step.id, 'step_failed', p_attempt,\n    jsonb_build_object('errorMessage', normalized_error)\n  );\n  RETURN supacloud_workflows.snapshot(current_step.run_id, false);\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.cancel_run(\n  p_run_id uuid,\n  p_reason text\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  normalized_reason text := nullif(btrim(p_reason), '');\n  locked_run supacloud_workflows.runs%ROWTYPE;\n  active_step supacloud_workflows.steps%ROWTYPE;\nBEGIN\n  IF p_run_id IS NULL OR normalized_reason IS NULL OR char_length(normalized_reason) > 4000 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_CANCEL_INVALID' USING ERRCODE = '22023';\n  END IF;\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_run_id::text, 0));\n  SELECT * INTO locked_run FROM supacloud_workflows.runs WHERE id = p_run_id FOR UPDATE;\n  IF NOT FOUND THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RUN_NOT_FOUND' USING ERRCODE = 'P0002';\n  END IF;\n  IF locked_run.status = 'cancelled' THEN\n    IF locked_run.error_message IS DISTINCT FROM normalized_reason THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    RETURN supacloud_workflows.snapshot(p_run_id, true);\n  END IF;\n  IF locked_run.status NOT IN ('queued', 'running') THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RUN_NOT_ACTIVE' USING ERRCODE = '55000';\n  END IF;\n  SELECT * INTO active_step\n  FROM supacloud_workflows.steps\n  WHERE run_id = p_run_id AND status IN ('queued', 'running')\n  FOR UPDATE;\n  IF FOUND THEN\n    PERFORM pgmq.archive('supacloud_internal_workflows', active_step.queue_message_id);\n    UPDATE supacloud_workflows.steps\n    SET status = 'cancelled', error_message = normalized_reason,\n        completed_at = now(), updated_at = now()\n    WHERE id = active_step.id;\n  END IF;\n  UPDATE supacloud_workflows.runs\n  SET status = 'cancelled', error_message = normalized_reason,\n      completed_at = now(), updated_at = now(), row_version = row_version + 1\n  WHERE id = p_run_id;\n  INSERT INTO supacloud_workflows.events (\n    run_id, step_id, event_type, details\n  ) VALUES (\n    p_run_id, active_step.id, 'run_cancelled',\n    jsonb_build_object('reason', normalized_reason)\n  );\n  RETURN supacloud_workflows.snapshot(p_run_id, false);\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.run_events(\n  p_run_id uuid,\n  p_after_event_id bigint,\n  p_limit integer\n) RETURNS jsonb\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT coalesce(jsonb_agg(jsonb_build_object(\n    'eventId', page.id::text,\n    'runId', page.run_id,\n    'stepId', page.step_id,\n    'eventType', page.event_type,\n    'attempt', page.attempt,\n    'details', page.details,\n    'createdAt', page.created_at\n  ) ORDER BY page.id), '[]'::jsonb)\n  FROM (\n    SELECT event.*\n    FROM supacloud_workflows.events event\n    WHERE event.run_id = p_run_id AND event.id > p_after_event_id\n    ORDER BY event.id\n    LIMIT p_limit\n  ) page\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.request_uuid(\n  request jsonb,\n  key text\n) RETURNS uuid\nLANGUAGE plpgsql IMMUTABLE SET search_path = '' AS $$\nDECLARE\n  uuid_text text;\nBEGIN\n  IF jsonb_typeof(request) IS DISTINCT FROM 'object' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_REQUEST_INVALID' USING ERRCODE = '22023';\n  END IF;\n  uuid_text := request ->> key;\n  IF uuid_text IS NULL\n     OR uuid_text !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_REQUEST_INVALID' USING ERRCODE = '22023';\n  END IF;\n  RETURN uuid_text::uuid;\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_start(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  max_attempts integer;\nBEGIN\n  max_attempts := coalesce((request ->> 'maxAttempts')::integer, 3);\n  RETURN supacloud_workflows.start_run(\n    supacloud_workflows.request_uuid(request, 'runId'),\n    request ->> 'workflowName',\n    request ->> 'workflowVersion',\n    request ->> 'firstStepKey',\n    coalesce(request -> 'input', '{}'::jsonb),\n    max_attempts\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_START_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_claim(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  visibility_timeout_seconds integer;\nBEGIN\n  IF jsonb_typeof(request) IS DISTINCT FROM 'object' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_CLAIM_INVALID' USING ERRCODE = '22023';\n  END IF;\n  visibility_timeout_seconds := coalesce((request ->> 'visibilityTimeoutSeconds')::integer, 300);\n  RETURN supacloud_workflows.claim_step(\n    request ->> 'workerId', visibility_timeout_seconds\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_CLAIM_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_advance(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  message_id bigint;\n  attempt integer;\n  next_max_attempts integer;\nBEGIN\n  message_id := (request ->> 'messageId')::bigint;\n  attempt := (request ->> 'attempt')::integer;\n  next_max_attempts := coalesce((request ->> 'nextMaxAttempts')::integer, 3);\n  IF message_id <= 0 OR attempt <= 0 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_ADVANCE_INVALID' USING ERRCODE = '22023';\n  END IF;\n  RETURN supacloud_workflows.advance_step(\n    supacloud_workflows.request_uuid(request, 'stepId'),\n    message_id,\n    attempt,\n    request ->> 'workerId',\n    coalesce(request -> 'output', '{}'::jsonb),\n    request ->> 'nextStepKey',\n    coalesce(request -> 'nextInput', '{}'::jsonb),\n    next_max_attempts\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_ADVANCE_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_complete(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  message_id bigint;\n  attempt integer;\nBEGIN\n  message_id := (request ->> 'messageId')::bigint;\n  attempt := (request ->> 'attempt')::integer;\n  IF message_id <= 0 OR attempt <= 0 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_COMPLETION_INVALID' USING ERRCODE = '22023';\n  END IF;\n  RETURN supacloud_workflows.complete_run(\n    supacloud_workflows.request_uuid(request, 'stepId'),\n    message_id,\n    attempt,\n    request ->> 'workerId',\n    coalesce(request -> 'stepOutput', '{}'::jsonb),\n    coalesce(request -> 'runOutput', '{}'::jsonb)\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_COMPLETION_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_retry(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  message_id bigint;\n  attempt integer;\n  delay_seconds integer;\nBEGIN\n  message_id := (request ->> 'messageId')::bigint;\n  attempt := (request ->> 'attempt')::integer;\n  delay_seconds := coalesce((request ->> 'delaySeconds')::integer, 0);\n  IF message_id <= 0 OR attempt <= 0 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RETRY_INVALID' USING ERRCODE = '22023';\n  END IF;\n  RETURN supacloud_workflows.retry_step(\n    supacloud_workflows.request_uuid(request, 'stepId'),\n    message_id,\n    attempt,\n    request ->> 'workerId',\n    request ->> 'errorMessage',\n    delay_seconds\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RETRY_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_fail(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  message_id bigint;\n  attempt integer;\nBEGIN\n  message_id := (request ->> 'messageId')::bigint;\n  attempt := (request ->> 'attempt')::integer;\n  IF message_id <= 0 OR attempt <= 0 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_FAILURE_INVALID' USING ERRCODE = '22023';\n  END IF;\n  RETURN supacloud_workflows.fail_step(\n    supacloud_workflows.request_uuid(request, 'stepId'),\n    message_id,\n    attempt,\n    request ->> 'workerId',\n    request ->> 'errorMessage'\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_FAILURE_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_cancel(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nBEGIN\n  RETURN supacloud_workflows.cancel_run(\n    supacloud_workflows.request_uuid(request, 'runId'),\n    request ->> 'reason'\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_CANCEL_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_get(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = '' AS $$\nBEGIN\n  RETURN supacloud_workflows.snapshot(\n    supacloud_workflows.request_uuid(request, 'runId'), false\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_GET_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_events(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  after_event_id bigint;\n  event_limit integer;\nBEGIN\n  after_event_id := coalesce((request ->> 'afterEventId')::bigint, 0);\n  event_limit := coalesce((request ->> 'limit')::integer, 100);\n  IF after_event_id < 0 OR event_limit NOT BETWEEN 1 AND 500 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_EVENTS_INVALID' USING ERRCODE = '22023';\n  END IF;\n  RETURN supacloud_workflows.run_events(\n    supacloud_workflows.request_uuid(request, 'runId'), after_event_id, event_limit\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_EVENTS_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nREVOKE ALL ON ALL TABLES IN SCHEMA supacloud_workflows\n  FROM PUBLIC, anon, authenticated, service_role;\nREVOKE ALL ON ALL SEQUENCES IN SCHEMA supacloud_workflows\n  FROM PUBLIC, anon, authenticated, service_role;\nREVOKE ALL ON ALL FUNCTIONS IN SCHEMA supacloud_workflows\n  FROM PUBLIC, anon, authenticated, service_role;\n\nREVOKE ALL ON FUNCTION public.supacloud_workflow_start(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_claim(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_advance(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_complete(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_retry(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_fail(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_cancel(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_get(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_events(jsonb) FROM PUBLIC, anon, authenticated;\n\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_start(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_claim(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_advance(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_complete(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_retry(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_fail(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_cancel(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_get(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_events(jsonb) TO service_role;\n-- supacloud:sql-module:workflows-public:end\n";
+export declare const WORKFLOWS_SQL = "\n-- supacloud:sql-module:workflows-public:start\nDO $pgmq_extension$\nBEGIN\n  IF to_regprocedure('pgmq.send(text,jsonb,integer)') IS NULL THEN\n    EXECUTE 'CREATE EXTENSION IF NOT EXISTS pgmq';\n  END IF;\nEND\n$pgmq_extension$;\nCREATE SCHEMA IF NOT EXISTS supacloud_workflows;\nREVOKE ALL ON SCHEMA supacloud_workflows FROM PUBLIC, anon, authenticated;\nGRANT USAGE ON SCHEMA supacloud_workflows TO service_role;\n\nSELECT pgmq.create('supacloud_internal_workflows');\n\nCREATE TABLE IF NOT EXISTS supacloud_workflows.runs (\n  id uuid PRIMARY KEY,\n  workflow_name text NOT NULL\n    CHECK (workflow_name ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'),\n  workflow_version text NOT NULL\n    CHECK (char_length(workflow_version) BETWEEN 1 AND 80),\n  status text NOT NULL DEFAULT 'queued'\n    CHECK (status IN ('queued', 'running', 'completed', 'failed', 'cancelled')),\n  input jsonb NOT NULL DEFAULT '{}'::jsonb\n    CHECK (jsonb_typeof(input) = 'object'),\n  output jsonb NOT NULL DEFAULT '{}'::jsonb\n    CHECK (jsonb_typeof(output) = 'object'),\n  error_message text NOT NULL DEFAULT ''\n    CHECK (char_length(error_message) <= 4000),\n  row_version bigint NOT NULL DEFAULT 1 CHECK (row_version > 0),\n  created_at timestamptz NOT NULL DEFAULT now(),\n  started_at timestamptz,\n  completed_at timestamptz,\n  updated_at timestamptz NOT NULL DEFAULT now()\n);\n\nCREATE TABLE IF NOT EXISTS supacloud_workflows.steps (\n  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n  run_id uuid NOT NULL REFERENCES supacloud_workflows.runs(id) ON DELETE CASCADE,\n  step_key text NOT NULL\n    CHECK (step_key ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'),\n  status text NOT NULL DEFAULT 'queued'\n    CHECK (status IN ('queued', 'running', 'completed', 'failed', 'dead_lettered', 'cancelled')),\n  input jsonb NOT NULL DEFAULT '{}'::jsonb\n    CHECK (jsonb_typeof(input) = 'object'),\n  output jsonb NOT NULL DEFAULT '{}'::jsonb\n    CHECK (jsonb_typeof(output) = 'object'),\n  error_message text NOT NULL DEFAULT ''\n    CHECK (char_length(error_message) <= 4000),\n  attempts integer NOT NULL DEFAULT 0 CHECK (attempts >= 0),\n  max_attempts integer NOT NULL DEFAULT 3 CHECK (max_attempts BETWEEN 1 AND 100),\n  retry_delay_seconds integer NOT NULL DEFAULT 0\n    CHECK (retry_delay_seconds BETWEEN 0 AND 86400),\n  queue_message_id bigint NOT NULL UNIQUE,\n  claimed_by text,\n  claimed_at timestamptz,\n  completed_at timestamptz,\n  next_step_key text,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  updated_at timestamptz NOT NULL DEFAULT now(),\n  UNIQUE (run_id, step_key)\n);\n\nALTER TABLE supacloud_workflows.steps\n  ADD COLUMN IF NOT EXISTS retry_delay_seconds integer NOT NULL DEFAULT 0\n    CHECK (retry_delay_seconds BETWEEN 0 AND 86400);\n\nCREATE UNIQUE INDEX IF NOT EXISTS supacloud_workflows_one_active_step_idx\n  ON supacloud_workflows.steps (run_id)\n  WHERE status IN ('queued', 'running');\n\nCREATE INDEX IF NOT EXISTS supacloud_workflows_runs_status_idx\n  ON supacloud_workflows.runs (status, updated_at DESC, id);\n\nCREATE INDEX IF NOT EXISTS supacloud_workflows_steps_run_idx\n  ON supacloud_workflows.steps (run_id, created_at, id);\n\nCREATE TABLE IF NOT EXISTS supacloud_workflows.events (\n  id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,\n  run_id uuid NOT NULL REFERENCES supacloud_workflows.runs(id) ON DELETE CASCADE,\n  step_id uuid REFERENCES supacloud_workflows.steps(id) ON DELETE CASCADE,\n  event_type text NOT NULL\n    CHECK (event_type IN (\n      'run_started', 'step_claimed', 'step_retried', 'step_completed',\n      'step_failed', 'step_dead_lettered', 'run_completed', 'run_cancelled'\n    )),\n  attempt integer CHECK (attempt IS NULL OR attempt > 0),\n  details jsonb NOT NULL DEFAULT '{}'::jsonb\n    CHECK (jsonb_typeof(details) = 'object'),\n  created_at timestamptz NOT NULL DEFAULT now()\n);\n\nCREATE INDEX IF NOT EXISTS supacloud_workflows_events_run_idx\n  ON supacloud_workflows.events (run_id, id);\n\nCREATE UNIQUE INDEX IF NOT EXISTS supacloud_workflows_retry_receipt_idx\n  ON supacloud_workflows.events (step_id, attempt)\n  WHERE event_type IN ('step_retried', 'step_dead_lettered')\n    AND details ->> 'operation' = 'retry';\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.snapshot(\n  p_run_id uuid,\n  p_idempotent boolean DEFAULT false\n) RETURNS jsonb\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT jsonb_build_object(\n    'runId', run.id,\n    'workflowName', run.workflow_name,\n    'workflowVersion', run.workflow_version,\n    'status', run.status,\n    'input', run.input,\n    'output', run.output,\n    'errorMessage', run.error_message,\n    'rowVersion', run.row_version::text,\n    'createdAt', run.created_at,\n    'startedAt', run.started_at,\n    'completedAt', run.completed_at,\n    'updatedAt', run.updated_at,\n    'idempotent', p_idempotent,\n    'steps', coalesce((\n      SELECT jsonb_agg(jsonb_build_object(\n        'stepId', step.id,\n        'stepKey', step.step_key,\n        'status', step.status,\n        'input', step.input,\n        'output', step.output,\n        'errorMessage', step.error_message,\n        'attempts', step.attempts,\n        'maxAttempts', step.max_attempts,\n        'retryDelaySeconds', step.retry_delay_seconds,\n        'queueMessageId', step.queue_message_id::text,\n        'claimedBy', step.claimed_by,\n        'claimedAt', step.claimed_at,\n        'completedAt', step.completed_at,\n        'nextStepKey', step.next_step_key,\n        'createdAt', step.created_at,\n        'updatedAt', step.updated_at\n      ) ORDER BY step.created_at, step.id)\n      FROM supacloud_workflows.steps step\n      WHERE step.run_id = run.id\n    ), '[]'::jsonb)\n  )\n  FROM supacloud_workflows.runs run\n  WHERE run.id = p_run_id\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.enqueue_step(\n  p_run_id uuid,\n  p_step_key text,\n  p_input jsonb,\n  p_max_attempts integer\n) RETURNS supacloud_workflows.steps\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  normalized_step_key text := nullif(btrim(p_step_key), '');\n  step_id uuid := gen_random_uuid();\n  message_id bigint;\n  created_step supacloud_workflows.steps%ROWTYPE;\nBEGIN\n  IF normalized_step_key IS NULL\n     OR normalized_step_key !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'\n     OR jsonb_typeof(p_input) IS DISTINCT FROM 'object'\n     OR p_max_attempts NOT BETWEEN 1 AND 100 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STEP_INVALID' USING ERRCODE = '22023';\n  END IF;\n\n  IF NOT EXISTS (\n    SELECT 1 FROM supacloud_workflows.runs run\n    WHERE run.id = p_run_id AND run.status IN ('queued', 'running')\n  ) THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RUN_NOT_ACTIVE' USING ERRCODE = '55000';\n  END IF;\n\n  SELECT queued_id INTO message_id\n  FROM pgmq.send(\n    'supacloud_internal_workflows',\n    jsonb_build_object('run_id', p_run_id, 'step_id', step_id),\n    0\n  ) AS queued_id;\n\n  INSERT INTO supacloud_workflows.steps (\n    id, run_id, step_key, input, max_attempts, queue_message_id\n  ) VALUES (\n    step_id, p_run_id, normalized_step_key, p_input, p_max_attempts, message_id\n  ) RETURNING * INTO created_step;\n\n  RETURN created_step;\nEND;\n$$;\n\n-- Clean-code exception: private transitions keep typed PostgreSQL arguments and\n-- the complete lock/queue/ledger/event mutation in one transaction. The public\n-- contract already uses one JSON request; revisit if a private routine gains a\n-- second caller or any transition can be decomposed without weakening atomicity.\nCREATE OR REPLACE FUNCTION supacloud_workflows.start_run(\n  p_run_id uuid,\n  p_workflow_name text,\n  p_workflow_version text,\n  p_first_step_key text,\n  p_input jsonb,\n  p_max_attempts integer\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  normalized_name text := nullif(btrim(p_workflow_name), '');\n  normalized_version text := nullif(btrim(p_workflow_version), '');\n  normalized_first_step_key text := nullif(btrim(p_first_step_key), '');\n  existing_run supacloud_workflows.runs%ROWTYPE;\n  existing_step supacloud_workflows.steps%ROWTYPE;\n  first_step supacloud_workflows.steps%ROWTYPE;\nBEGIN\n  IF p_run_id IS NULL\n     OR normalized_name IS NULL\n     OR normalized_name !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'\n     OR normalized_version IS NULL\n     OR char_length(normalized_version) > 80\n     OR normalized_first_step_key IS NULL\n     OR normalized_first_step_key !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'\n     OR jsonb_typeof(p_input) IS DISTINCT FROM 'object'\n     OR p_max_attempts NOT BETWEEN 1 AND 100 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_START_INVALID' USING ERRCODE = '22023';\n  END IF;\n\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_run_id::text, 0));\n  SELECT * INTO existing_run FROM supacloud_workflows.runs WHERE id = p_run_id;\n  IF FOUND THEN\n    SELECT * INTO existing_step\n    FROM supacloud_workflows.steps\n    WHERE run_id = p_run_id\n    ORDER BY created_at, id\n    LIMIT 1;\n    IF NOT FOUND THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    IF existing_run.workflow_name <> normalized_name\n       OR existing_run.workflow_version <> normalized_version\n       OR existing_run.input <> p_input\n       OR existing_step.step_key <> normalized_first_step_key\n       OR existing_step.input <> p_input\n       OR existing_step.max_attempts <> p_max_attempts THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    RETURN supacloud_workflows.snapshot(p_run_id, true);\n  END IF;\n\n  INSERT INTO supacloud_workflows.runs (\n    id, workflow_name, workflow_version, input\n  ) VALUES (\n    p_run_id, normalized_name, normalized_version, p_input\n  );\n  first_step := supacloud_workflows.enqueue_step(\n    p_run_id, normalized_first_step_key, p_input, p_max_attempts\n  );\n  INSERT INTO supacloud_workflows.events (run_id, step_id, event_type)\n  VALUES (p_run_id, first_step.id, 'run_started');\n  RETURN supacloud_workflows.snapshot(p_run_id, false);\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.claim_step(\n  p_worker_id text,\n  p_visibility_timeout_seconds integer\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  normalized_worker_id text := nullif(btrim(p_worker_id), '');\n  queued_message pgmq.message_record;\n  message_run_id text;\n  message_step_id text;\n  candidate_run_id uuid;\n  claimed_step supacloud_workflows.steps%ROWTYPE;\n  claimed_run supacloud_workflows.runs%ROWTYPE;\nBEGIN\n  IF normalized_worker_id IS NULL\n     OR char_length(normalized_worker_id) > 200\n     OR p_visibility_timeout_seconds NOT BETWEEN 15 AND 3600 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_CLAIM_INVALID' USING ERRCODE = '22023';\n  END IF;\n\n  SELECT * INTO queued_message\n  FROM pgmq.read('supacloud_internal_workflows', p_visibility_timeout_seconds, 1)\n  LIMIT 1;\n  IF NOT FOUND THEN RETURN NULL; END IF;\n\n  message_run_id := queued_message.message ->> 'run_id';\n  message_step_id := queued_message.message ->> 'step_id';\n  IF jsonb_typeof(queued_message.message) IS DISTINCT FROM 'object'\n     OR message_run_id IS NULL\n     OR message_step_id IS NULL\n     OR message_run_id !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'\n     OR message_step_id !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$' THEN\n    PERFORM pgmq.archive('supacloud_internal_workflows', queued_message.msg_id);\n    RETURN jsonb_build_object(\n      'status', 'discarded',\n      'reason', 'invalid_message',\n      'messageId', queued_message.msg_id::text\n    );\n  END IF;\n\n  SELECT step.run_id INTO candidate_run_id\n  FROM supacloud_workflows.steps step\n  WHERE step.id::text = lower(message_step_id)\n    AND step.run_id::text = lower(message_run_id)\n    AND step.queue_message_id = queued_message.msg_id;\n  IF NOT FOUND THEN\n    PERFORM pgmq.archive('supacloud_internal_workflows', queued_message.msg_id);\n    RETURN jsonb_build_object(\n      'status', 'discarded',\n      'reason', 'orphaned_message',\n      'messageId', queued_message.msg_id::text\n    );\n  END IF;\n\n  IF NOT pg_try_advisory_xact_lock(hashtextextended(candidate_run_id::text, 0)) THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_CLAIM_RETRY' USING ERRCODE = '40001';\n  END IF;\n  SELECT * INTO claimed_step\n  FROM supacloud_workflows.steps\n  WHERE id::text = lower(message_step_id)\n    AND run_id = candidate_run_id\n    AND queue_message_id = queued_message.msg_id\n  FOR UPDATE;\n  IF NOT FOUND THEN\n    PERFORM pgmq.archive('supacloud_internal_workflows', queued_message.msg_id);\n    RETURN jsonb_build_object(\n      'status', 'discarded',\n      'reason', 'orphaned_message',\n      'messageId', queued_message.msg_id::text\n    );\n  END IF;\n\n  SELECT * INTO claimed_run\n  FROM supacloud_workflows.runs\n  WHERE id = claimed_step.run_id\n  FOR UPDATE;\n  IF claimed_run.status NOT IN ('queued', 'running')\n     OR claimed_step.status NOT IN ('queued', 'running') THEN\n    PERFORM pgmq.archive('supacloud_internal_workflows', queued_message.msg_id);\n    RETURN jsonb_build_object(\n      'status', 'discarded',\n      'reason', 'step_not_claimable',\n      'runId', claimed_step.run_id,\n      'stepId', claimed_step.id,\n      'messageId', queued_message.msg_id::text\n    );\n  END IF;\n\n  IF queued_message.read_ct > claimed_step.max_attempts THEN\n    UPDATE supacloud_workflows.steps\n    SET status = 'dead_lettered', attempts = queued_message.read_ct,\n        error_message = 'maximum attempts exceeded', completed_at = now(), updated_at = now()\n    WHERE id = claimed_step.id;\n    UPDATE supacloud_workflows.runs\n    SET status = 'failed', error_message = 'maximum attempts exceeded',\n        completed_at = now(), updated_at = now(), row_version = row_version + 1\n    WHERE id = claimed_step.run_id;\n    PERFORM pgmq.archive('supacloud_internal_workflows', queued_message.msg_id);\n    INSERT INTO supacloud_workflows.events (\n      run_id, step_id, event_type, attempt, details\n    ) VALUES (\n      claimed_step.run_id, claimed_step.id, 'step_dead_lettered', queued_message.read_ct,\n      jsonb_build_object('errorMessage', 'maximum attempts exceeded')\n    );\n    RETURN jsonb_build_object(\n      'status', 'dead_lettered',\n      'runId', claimed_step.run_id,\n      'stepId', claimed_step.id,\n      'stepKey', claimed_step.step_key,\n      'messageId', queued_message.msg_id::text,\n      'attempt', queued_message.read_ct,\n      'maxAttempts', claimed_step.max_attempts\n    );\n  END IF;\n\n  UPDATE supacloud_workflows.steps\n  SET status = 'running', attempts = queued_message.read_ct,\n      retry_delay_seconds = 0, claimed_by = normalized_worker_id,\n      claimed_at = now(), updated_at = now()\n  WHERE id = claimed_step.id;\n  UPDATE supacloud_workflows.runs\n  SET status = 'running', started_at = coalesce(started_at, now()),\n      updated_at = now(), row_version = row_version + 1\n  WHERE id = claimed_step.run_id;\n  INSERT INTO supacloud_workflows.events (run_id, step_id, event_type, attempt, details)\n  VALUES (\n    claimed_step.run_id, claimed_step.id, 'step_claimed', queued_message.read_ct,\n    jsonb_build_object('workerId', normalized_worker_id)\n  );\n\n  RETURN jsonb_build_object(\n    'status', 'claimed',\n    'runId', claimed_step.run_id,\n    'workflowName', claimed_run.workflow_name,\n    'workflowVersion', claimed_run.workflow_version,\n    'stepId', claimed_step.id,\n    'stepKey', claimed_step.step_key,\n    'input', claimed_step.input,\n    'messageId', queued_message.msg_id::text,\n    'attempt', queued_message.read_ct,\n    'maxAttempts', claimed_step.max_attempts,\n    'workerId', normalized_worker_id\n  );\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.lock_step(\n  p_step_id uuid\n) RETURNS supacloud_workflows.steps\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  candidate_run_id uuid;\n  active_step supacloud_workflows.steps%ROWTYPE;\nBEGIN\n  SELECT step.run_id INTO candidate_run_id\n  FROM supacloud_workflows.steps step\n  WHERE step.id = p_step_id;\n  IF NOT FOUND THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STEP_NOT_FOUND' USING ERRCODE = 'P0002';\n  END IF;\n  PERFORM pg_advisory_xact_lock(hashtextextended(candidate_run_id::text, 0));\n  SELECT * INTO active_step\n  FROM supacloud_workflows.steps\n  WHERE id = p_step_id\n  FOR UPDATE;\n  IF NOT FOUND THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STEP_NOT_FOUND' USING ERRCODE = 'P0002';\n  END IF;\n  RETURN active_step;\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.lock_step_attempt(\n  p_step_id uuid,\n  p_message_id bigint,\n  p_attempt integer,\n  p_worker_id text\n) RETURNS supacloud_workflows.steps\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  active_step supacloud_workflows.steps%ROWTYPE;\n  normalized_worker_id text := nullif(btrim(p_worker_id), '');\nBEGIN\n  active_step := supacloud_workflows.lock_step(p_step_id);\n  IF normalized_worker_id IS NULL\n     OR p_message_id IS NULL\n     OR p_attempt IS NULL\n     OR active_step.queue_message_id IS DISTINCT FROM p_message_id\n     OR active_step.attempts IS DISTINCT FROM p_attempt\n     OR active_step.claimed_by IS DISTINCT FROM normalized_worker_id THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STALE_ATTEMPT' USING ERRCODE = '40001';\n  END IF;\n  RETURN active_step;\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.advance_step(\n  p_step_id uuid,\n  p_message_id bigint,\n  p_attempt integer,\n  p_worker_id text,\n  p_output jsonb,\n  p_next_step_key text,\n  p_next_input jsonb,\n  p_next_max_attempts integer\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  current_step supacloud_workflows.steps%ROWTYPE;\n  next_step supacloud_workflows.steps%ROWTYPE;\n  normalized_next_step_key text := nullif(btrim(p_next_step_key), '');\n  archived boolean;\nBEGIN\n  IF jsonb_typeof(p_output) IS DISTINCT FROM 'object'\n     OR jsonb_typeof(p_next_input) IS DISTINCT FROM 'object'\n     OR normalized_next_step_key IS NULL\n     OR normalized_next_step_key !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'\n     OR p_next_max_attempts NOT BETWEEN 1 AND 100 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_ADVANCE_INVALID' USING ERRCODE = '22023';\n  END IF;\n  current_step := supacloud_workflows.lock_step_attempt(\n    p_step_id, p_message_id, p_attempt, p_worker_id\n  );\n\n  IF current_step.status = 'completed' THEN\n    SELECT * INTO next_step\n    FROM supacloud_workflows.steps\n    WHERE run_id = current_step.run_id AND step_key = normalized_next_step_key;\n    IF NOT FOUND\n       OR current_step.output IS DISTINCT FROM p_output\n       OR current_step.next_step_key IS DISTINCT FROM normalized_next_step_key\n       OR next_step.input IS DISTINCT FROM p_next_input\n       OR next_step.max_attempts IS DISTINCT FROM p_next_max_attempts THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    RETURN supacloud_workflows.snapshot(current_step.run_id, true);\n  END IF;\n  IF current_step.status <> 'running' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STALE_ATTEMPT' USING ERRCODE = '40001';\n  END IF;\n\n  SELECT pgmq.archive('supacloud_internal_workflows', p_message_id) INTO archived;\n  IF archived IS DISTINCT FROM true THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_QUEUE_MESSAGE_MISSING' USING ERRCODE = '55000';\n  END IF;\n  UPDATE supacloud_workflows.steps\n  SET status = 'completed', output = p_output, error_message = '',\n      completed_at = now(), next_step_key = normalized_next_step_key, updated_at = now()\n  WHERE id = current_step.id;\n  INSERT INTO supacloud_workflows.events (\n    run_id, step_id, event_type, attempt, details\n  ) VALUES (\n    current_step.run_id, current_step.id, 'step_completed', p_attempt,\n    jsonb_build_object('nextStepKey', normalized_next_step_key)\n  );\n  next_step := supacloud_workflows.enqueue_step(\n    current_step.run_id, normalized_next_step_key, p_next_input, p_next_max_attempts\n  );\n  RETURN supacloud_workflows.snapshot(current_step.run_id, false);\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.complete_run(\n  p_step_id uuid,\n  p_message_id bigint,\n  p_attempt integer,\n  p_worker_id text,\n  p_step_output jsonb,\n  p_run_output jsonb\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  current_step supacloud_workflows.steps%ROWTYPE;\n  current_run supacloud_workflows.runs%ROWTYPE;\n  archived boolean;\nBEGIN\n  IF jsonb_typeof(p_step_output) IS DISTINCT FROM 'object'\n     OR jsonb_typeof(p_run_output) IS DISTINCT FROM 'object' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_COMPLETION_INVALID' USING ERRCODE = '22023';\n  END IF;\n  current_step := supacloud_workflows.lock_step_attempt(\n    p_step_id, p_message_id, p_attempt, p_worker_id\n  );\n  SELECT * INTO current_run\n  FROM supacloud_workflows.runs\n  WHERE id = current_step.run_id\n  FOR UPDATE;\n\n  IF current_step.status = 'completed' THEN\n    IF current_step.next_step_key IS NOT NULL\n       OR current_step.output IS DISTINCT FROM p_step_output\n       OR current_run.status IS DISTINCT FROM 'completed'\n       OR current_run.output IS DISTINCT FROM p_run_output THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    RETURN supacloud_workflows.snapshot(current_step.run_id, true);\n  END IF;\n  IF current_step.status <> 'running' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STALE_ATTEMPT' USING ERRCODE = '40001';\n  END IF;\n  IF current_run.status <> 'running' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RUN_NOT_ACTIVE' USING ERRCODE = '55000';\n  END IF;\n\n  SELECT pgmq.archive('supacloud_internal_workflows', p_message_id) INTO archived;\n  IF archived IS DISTINCT FROM true THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_QUEUE_MESSAGE_MISSING' USING ERRCODE = '55000';\n  END IF;\n  UPDATE supacloud_workflows.steps\n  SET status = 'completed', output = p_step_output, error_message = '',\n      completed_at = now(), updated_at = now()\n  WHERE id = current_step.id;\n  UPDATE supacloud_workflows.runs\n  SET status = 'completed', output = p_run_output, error_message = '',\n      completed_at = now(), updated_at = now(), row_version = row_version + 1\n  WHERE id = current_step.run_id AND status = 'running';\n  INSERT INTO supacloud_workflows.events (run_id, step_id, event_type, attempt)\n  VALUES (current_step.run_id, current_step.id, 'step_completed', p_attempt);\n  INSERT INTO supacloud_workflows.events (run_id, step_id, event_type, attempt)\n  VALUES (current_step.run_id, current_step.id, 'run_completed', p_attempt);\n  RETURN supacloud_workflows.snapshot(current_step.run_id, false);\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.retry_step(\n  p_step_id uuid,\n  p_message_id bigint,\n  p_attempt integer,\n  p_worker_id text,\n  p_error_message text,\n  p_delay_seconds integer\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  current_step supacloud_workflows.steps%ROWTYPE;\n  normalized_error text := nullif(btrim(p_error_message), '');\n  normalized_worker_id text := nullif(btrim(p_worker_id), '');\n  retry_receipt jsonb;\n  queue_message_updated boolean;\n  archived boolean;\nBEGIN\n  IF normalized_error IS NULL OR char_length(normalized_error) > 4000\n     OR p_delay_seconds NOT BETWEEN 0 AND 86400 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RETRY_INVALID' USING ERRCODE = '22023';\n  END IF;\n  current_step := supacloud_workflows.lock_step(p_step_id);\n  SELECT event.details INTO retry_receipt\n  FROM supacloud_workflows.events event\n  WHERE event.step_id = current_step.id\n    AND event.attempt = p_attempt\n    AND event.event_type IN ('step_retried', 'step_dead_lettered')\n    AND event.details ->> 'operation' = 'retry'\n  ORDER BY event.id DESC\n  LIMIT 1;\n  IF FOUND THEN\n    IF retry_receipt ->> 'messageId' IS DISTINCT FROM p_message_id::text\n       OR retry_receipt ->> 'workerId' IS DISTINCT FROM normalized_worker_id\n       OR retry_receipt ->> 'errorMessage' IS DISTINCT FROM normalized_error\n       OR (retry_receipt ->> 'delaySeconds')::integer IS DISTINCT FROM p_delay_seconds THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    RETURN supacloud_workflows.snapshot(current_step.run_id, true);\n  END IF;\n  IF normalized_worker_id IS NULL\n     OR p_message_id IS NULL\n     OR p_attempt IS NULL\n     OR current_step.queue_message_id IS DISTINCT FROM p_message_id\n     OR current_step.attempts IS DISTINCT FROM p_attempt\n     OR current_step.claimed_by IS DISTINCT FROM normalized_worker_id\n     OR current_step.status <> 'running' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STALE_ATTEMPT' USING ERRCODE = '40001';\n  END IF;\n\n  IF current_step.attempts >= current_step.max_attempts THEN\n    SELECT pgmq.archive('supacloud_internal_workflows', p_message_id) INTO archived;\n    IF archived IS DISTINCT FROM true THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_QUEUE_MESSAGE_MISSING' USING ERRCODE = '55000';\n    END IF;\n    UPDATE supacloud_workflows.steps\n    SET status = 'dead_lettered', error_message = normalized_error,\n        completed_at = now(), updated_at = now()\n    WHERE id = current_step.id;\n    UPDATE supacloud_workflows.runs\n    SET status = 'failed', error_message = normalized_error,\n        completed_at = now(), updated_at = now(), row_version = row_version + 1\n    WHERE id = current_step.run_id AND status = 'running';\n    IF NOT FOUND THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RUN_NOT_ACTIVE' USING ERRCODE = '55000';\n    END IF;\n    INSERT INTO supacloud_workflows.events (\n      run_id, step_id, event_type, attempt, details\n    ) VALUES (\n      current_step.run_id, current_step.id, 'step_dead_lettered', p_attempt,\n      jsonb_build_object(\n        'operation', 'retry',\n        'messageId', p_message_id::text,\n        'workerId', normalized_worker_id,\n        'errorMessage', normalized_error,\n        'delaySeconds', p_delay_seconds\n      )\n    );\n    RETURN supacloud_workflows.snapshot(current_step.run_id, false);\n  END IF;\n\n  SELECT EXISTS (\n    SELECT 1 FROM pgmq.set_vt('supacloud_internal_workflows', p_message_id, p_delay_seconds)\n  ) INTO queue_message_updated;\n  IF queue_message_updated IS DISTINCT FROM true THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_QUEUE_MESSAGE_MISSING' USING ERRCODE = '55000';\n  END IF;\n  UPDATE supacloud_workflows.steps\n  SET status = 'queued', error_message = normalized_error,\n      retry_delay_seconds = p_delay_seconds, updated_at = now()\n  WHERE id = current_step.id;\n  INSERT INTO supacloud_workflows.events (\n    run_id, step_id, event_type, attempt, details\n  ) VALUES (\n    current_step.run_id, current_step.id, 'step_retried', p_attempt,\n    jsonb_build_object(\n      'operation', 'retry',\n      'messageId', p_message_id::text,\n      'workerId', normalized_worker_id,\n      'errorMessage', normalized_error,\n      'delaySeconds', p_delay_seconds\n    )\n  );\n  RETURN supacloud_workflows.snapshot(current_step.run_id, false);\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.fail_step(\n  p_step_id uuid,\n  p_message_id bigint,\n  p_attempt integer,\n  p_worker_id text,\n  p_error_message text\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  current_step supacloud_workflows.steps%ROWTYPE;\n  current_run supacloud_workflows.runs%ROWTYPE;\n  normalized_error text := nullif(btrim(p_error_message), '');\n  archived boolean;\nBEGIN\n  IF normalized_error IS NULL OR char_length(normalized_error) > 4000 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_FAILURE_INVALID' USING ERRCODE = '22023';\n  END IF;\n  current_step := supacloud_workflows.lock_step_attempt(\n    p_step_id, p_message_id, p_attempt, p_worker_id\n  );\n  SELECT * INTO current_run\n  FROM supacloud_workflows.runs\n  WHERE id = current_step.run_id\n  FOR UPDATE;\n\n  IF current_step.status = 'failed' THEN\n    IF current_step.error_message IS DISTINCT FROM normalized_error\n       OR current_run.status IS DISTINCT FROM 'failed'\n       OR current_run.error_message IS DISTINCT FROM normalized_error THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    RETURN supacloud_workflows.snapshot(current_step.run_id, true);\n  END IF;\n  IF current_step.status <> 'running' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_STALE_ATTEMPT' USING ERRCODE = '40001';\n  END IF;\n  IF current_run.status <> 'running' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RUN_NOT_ACTIVE' USING ERRCODE = '55000';\n  END IF;\n\n  SELECT pgmq.archive('supacloud_internal_workflows', p_message_id) INTO archived;\n  IF archived IS DISTINCT FROM true THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_QUEUE_MESSAGE_MISSING' USING ERRCODE = '55000';\n  END IF;\n  UPDATE supacloud_workflows.steps\n  SET status = 'failed', error_message = normalized_error,\n      completed_at = now(), updated_at = now()\n  WHERE id = current_step.id;\n  UPDATE supacloud_workflows.runs\n  SET status = 'failed', error_message = normalized_error,\n      completed_at = now(), updated_at = now(), row_version = row_version + 1\n  WHERE id = current_step.run_id AND status = 'running';\n  INSERT INTO supacloud_workflows.events (\n    run_id, step_id, event_type, attempt, details\n  ) VALUES (\n    current_step.run_id, current_step.id, 'step_failed', p_attempt,\n    jsonb_build_object('errorMessage', normalized_error)\n  );\n  RETURN supacloud_workflows.snapshot(current_step.run_id, false);\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.cancel_run(\n  p_run_id uuid,\n  p_reason text\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  normalized_reason text := nullif(btrim(p_reason), '');\n  locked_run supacloud_workflows.runs%ROWTYPE;\n  active_step supacloud_workflows.steps%ROWTYPE;\nBEGIN\n  IF p_run_id IS NULL OR normalized_reason IS NULL OR char_length(normalized_reason) > 4000 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_CANCEL_INVALID' USING ERRCODE = '22023';\n  END IF;\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_run_id::text, 0));\n  SELECT * INTO locked_run FROM supacloud_workflows.runs WHERE id = p_run_id FOR UPDATE;\n  IF NOT FOUND THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RUN_NOT_FOUND' USING ERRCODE = 'P0002';\n  END IF;\n  IF locked_run.status = 'cancelled' THEN\n    IF locked_run.error_message IS DISTINCT FROM normalized_reason THEN\n      RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    RETURN supacloud_workflows.snapshot(p_run_id, true);\n  END IF;\n  IF locked_run.status NOT IN ('queued', 'running') THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RUN_NOT_ACTIVE' USING ERRCODE = '55000';\n  END IF;\n  SELECT * INTO active_step\n  FROM supacloud_workflows.steps\n  WHERE run_id = p_run_id AND status IN ('queued', 'running')\n  FOR UPDATE;\n  IF FOUND THEN\n    PERFORM pgmq.archive('supacloud_internal_workflows', active_step.queue_message_id);\n    UPDATE supacloud_workflows.steps\n    SET status = 'cancelled', error_message = normalized_reason,\n        completed_at = now(), updated_at = now()\n    WHERE id = active_step.id;\n  END IF;\n  UPDATE supacloud_workflows.runs\n  SET status = 'cancelled', error_message = normalized_reason,\n      completed_at = now(), updated_at = now(), row_version = row_version + 1\n  WHERE id = p_run_id;\n  INSERT INTO supacloud_workflows.events (\n    run_id, step_id, event_type, details\n  ) VALUES (\n    p_run_id, active_step.id, 'run_cancelled',\n    jsonb_build_object('reason', normalized_reason)\n  );\n  RETURN supacloud_workflows.snapshot(p_run_id, false);\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.run_events(\n  p_run_id uuid,\n  p_after_event_id bigint,\n  p_limit integer\n) RETURNS jsonb\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT coalesce(jsonb_agg(jsonb_build_object(\n    'eventId', page.id::text,\n    'runId', page.run_id,\n    'stepId', page.step_id,\n    'eventType', page.event_type,\n    'attempt', page.attempt,\n    'details', page.details,\n    'createdAt', page.created_at\n  ) ORDER BY page.id), '[]'::jsonb)\n  FROM (\n    SELECT event.*\n    FROM supacloud_workflows.events event\n    WHERE event.run_id = p_run_id AND event.id > p_after_event_id\n    ORDER BY event.id\n    LIMIT p_limit\n  ) page\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_workflows.request_uuid(\n  request jsonb,\n  key text\n) RETURNS uuid\nLANGUAGE plpgsql IMMUTABLE SET search_path = '' AS $$\nDECLARE\n  uuid_text text;\nBEGIN\n  IF jsonb_typeof(request) IS DISTINCT FROM 'object' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_REQUEST_INVALID' USING ERRCODE = '22023';\n  END IF;\n  uuid_text := request ->> key;\n  IF uuid_text IS NULL\n     OR uuid_text !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_REQUEST_INVALID' USING ERRCODE = '22023';\n  END IF;\n  RETURN uuid_text::uuid;\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_start(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  max_attempts integer;\nBEGIN\n  max_attempts := coalesce((request ->> 'maxAttempts')::integer, 3);\n  RETURN supacloud_workflows.start_run(\n    supacloud_workflows.request_uuid(request, 'runId'),\n    request ->> 'workflowName',\n    request ->> 'workflowVersion',\n    request ->> 'firstStepKey',\n    coalesce(request -> 'input', '{}'::jsonb),\n    max_attempts\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_START_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_claim(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  visibility_timeout_seconds integer;\nBEGIN\n  IF jsonb_typeof(request) IS DISTINCT FROM 'object' THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_CLAIM_INVALID' USING ERRCODE = '22023';\n  END IF;\n  visibility_timeout_seconds := coalesce((request ->> 'visibilityTimeoutSeconds')::integer, 300);\n  RETURN supacloud_workflows.claim_step(\n    request ->> 'workerId', visibility_timeout_seconds\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_CLAIM_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_advance(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  message_id bigint;\n  attempt integer;\n  next_max_attempts integer;\nBEGIN\n  message_id := (request ->> 'messageId')::bigint;\n  attempt := (request ->> 'attempt')::integer;\n  next_max_attempts := coalesce((request ->> 'nextMaxAttempts')::integer, 3);\n  IF message_id <= 0 OR attempt <= 0 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_ADVANCE_INVALID' USING ERRCODE = '22023';\n  END IF;\n  RETURN supacloud_workflows.advance_step(\n    supacloud_workflows.request_uuid(request, 'stepId'),\n    message_id,\n    attempt,\n    request ->> 'workerId',\n    coalesce(request -> 'output', '{}'::jsonb),\n    request ->> 'nextStepKey',\n    coalesce(request -> 'nextInput', '{}'::jsonb),\n    next_max_attempts\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_ADVANCE_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_complete(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  message_id bigint;\n  attempt integer;\nBEGIN\n  message_id := (request ->> 'messageId')::bigint;\n  attempt := (request ->> 'attempt')::integer;\n  IF message_id <= 0 OR attempt <= 0 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_COMPLETION_INVALID' USING ERRCODE = '22023';\n  END IF;\n  RETURN supacloud_workflows.complete_run(\n    supacloud_workflows.request_uuid(request, 'stepId'),\n    message_id,\n    attempt,\n    request ->> 'workerId',\n    coalesce(request -> 'stepOutput', '{}'::jsonb),\n    coalesce(request -> 'runOutput', '{}'::jsonb)\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_COMPLETION_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_retry(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  message_id bigint;\n  attempt integer;\n  delay_seconds integer;\nBEGIN\n  message_id := (request ->> 'messageId')::bigint;\n  attempt := (request ->> 'attempt')::integer;\n  delay_seconds := coalesce((request ->> 'delaySeconds')::integer, 0);\n  IF message_id <= 0 OR attempt <= 0 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RETRY_INVALID' USING ERRCODE = '22023';\n  END IF;\n  RETURN supacloud_workflows.retry_step(\n    supacloud_workflows.request_uuid(request, 'stepId'),\n    message_id,\n    attempt,\n    request ->> 'workerId',\n    request ->> 'errorMessage',\n    delay_seconds\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_RETRY_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_fail(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  message_id bigint;\n  attempt integer;\nBEGIN\n  message_id := (request ->> 'messageId')::bigint;\n  attempt := (request ->> 'attempt')::integer;\n  IF message_id <= 0 OR attempt <= 0 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_FAILURE_INVALID' USING ERRCODE = '22023';\n  END IF;\n  RETURN supacloud_workflows.fail_step(\n    supacloud_workflows.request_uuid(request, 'stepId'),\n    message_id,\n    attempt,\n    request ->> 'workerId',\n    request ->> 'errorMessage'\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_FAILURE_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_cancel(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nBEGIN\n  RETURN supacloud_workflows.cancel_run(\n    supacloud_workflows.request_uuid(request, 'runId'),\n    request ->> 'reason'\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_CANCEL_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_get(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = '' AS $$\nBEGIN\n  RETURN supacloud_workflows.snapshot(\n    supacloud_workflows.request_uuid(request, 'runId'), false\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_GET_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_workflow_events(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  after_event_id bigint;\n  event_limit integer;\nBEGIN\n  after_event_id := coalesce((request ->> 'afterEventId')::bigint, 0);\n  event_limit := coalesce((request ->> 'limit')::integer, 100);\n  IF after_event_id < 0 OR event_limit NOT BETWEEN 1 AND 500 THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_EVENTS_INVALID' USING ERRCODE = '22023';\n  END IF;\n  RETURN supacloud_workflows.run_events(\n    supacloud_workflows.request_uuid(request, 'runId'), after_event_id, event_limit\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_WORKFLOW_EVENTS_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nREVOKE ALL ON ALL TABLES IN SCHEMA supacloud_workflows\n  FROM PUBLIC, anon, authenticated, service_role;\nREVOKE ALL ON ALL SEQUENCES IN SCHEMA supacloud_workflows\n  FROM PUBLIC, anon, authenticated, service_role;\nREVOKE ALL ON ALL FUNCTIONS IN SCHEMA supacloud_workflows\n  FROM PUBLIC, anon, authenticated, service_role;\n\nREVOKE ALL ON FUNCTION public.supacloud_workflow_start(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_claim(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_advance(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_complete(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_retry(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_fail(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_cancel(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_get(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_workflow_events(jsonb) FROM PUBLIC, anon, authenticated;\n\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_start(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_claim(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_advance(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_complete(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_retry(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_fail(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_cancel(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_get(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_workflow_events(jsonb) TO service_role;\n-- supacloud:sql-module:workflows-public:end\n\n-- supacloud:sql-module:commands-public:start\nCREATE SCHEMA IF NOT EXISTS supacloud_commands;\nREVOKE ALL ON SCHEMA supacloud_commands FROM PUBLIC, anon, authenticated;\nGRANT USAGE ON SCHEMA supacloud_commands TO service_role;\n\nCREATE TABLE IF NOT EXISTS supacloud_commands.receipts (\n  id uuid PRIMARY KEY,\n  command_type text NOT NULL\n    CHECK (command_type ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'),\n  target_type text NOT NULL\n    CHECK (target_type ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'),\n  target_id text NOT NULL CHECK (char_length(target_id) BETWEEN 1 AND 500),\n  actor_id uuid,\n  payload jsonb NOT NULL DEFAULT '{}'::jsonb\n    CHECK (jsonb_typeof(payload) = 'object'),\n  payload_fingerprint text NOT NULL CHECK (char_length(payload_fingerprint) = 36),\n  workflow_run_id uuid NOT NULL UNIQUE\n    REFERENCES supacloud_workflows.runs(id) ON DELETE RESTRICT,\n  created_at timestamptz NOT NULL DEFAULT now()\n);\n\nCREATE INDEX IF NOT EXISTS supacloud_commands_target_idx\n  ON supacloud_commands.receipts (target_type, target_id, created_at DESC, id);\n\nCREATE OR REPLACE FUNCTION supacloud_commands.snapshot(\n  p_command_id uuid,\n  p_idempotent boolean DEFAULT false\n) RETURNS jsonb\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT jsonb_build_object(\n    'commandId', receipt.id,\n    'commandType', receipt.command_type,\n    'targetType', receipt.target_type,\n    'targetId', receipt.target_id,\n    'actorId', receipt.actor_id,\n    'payloadFingerprint', receipt.payload_fingerprint,\n    'createdAt', receipt.created_at,\n    'idempotent', p_idempotent,\n    'workflow', supacloud_workflows.snapshot(receipt.workflow_run_id, false)\n  )\n  FROM supacloud_commands.receipts receipt\n  WHERE receipt.id = p_command_id\n$$;\n\n-- Application-owned SECURITY DEFINER RPCs may call this after their domain\n-- mutation. PostgreSQL commits the domain write, receipt, and workflow enqueue\n-- together, so a lost response can be replayed with the same command ID.\nDROP FUNCTION IF EXISTS supacloud_commands.submit(uuid, text, text, text, uuid, jsonb, integer);\nCREATE OR REPLACE FUNCTION supacloud_commands.submit(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  command_id_text text;\n  command_id uuid;\n  actor_id uuid;\n  max_attempts integer;\n  payload jsonb;\n  normalized_command_type text;\n  normalized_target_type text;\n  normalized_target_id text;\n  fingerprint text;\n  existing supacloud_commands.receipts%ROWTYPE;\nBEGIN\n  IF jsonb_typeof(request) IS DISTINCT FROM 'object' THEN\n    RAISE EXCEPTION 'SUPACLOUD_COMMAND_INVALID' USING ERRCODE = '22023';\n  END IF;\n  command_id_text := request ->> 'commandId';\n  IF command_id_text IS NULL\n     OR command_id_text !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$' THEN\n    RAISE EXCEPTION 'SUPACLOUD_COMMAND_INVALID' USING ERRCODE = '22023';\n  END IF;\n  command_id := command_id_text::uuid;\n  IF request ? 'actorId' AND request ->> 'actorId' IS NOT NULL THEN\n    actor_id := (request ->> 'actorId')::uuid;\n  END IF;\n  max_attempts := coalesce((request ->> 'maxAttempts')::integer, 3);\n  payload := coalesce(request -> 'payload', '{}'::jsonb);\n  normalized_command_type := nullif(btrim(request ->> 'commandType'), '');\n  normalized_target_type := nullif(btrim(request ->> 'targetType'), '');\n  normalized_target_id := nullif(btrim(request ->> 'targetId'), '');\n  IF normalized_command_type IS NULL\n     OR normalized_command_type !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'\n     OR normalized_target_type IS NULL\n     OR normalized_target_type !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'\n     OR normalized_target_id IS NULL\n     OR char_length(normalized_target_id) > 500\n     OR jsonb_typeof(payload) IS DISTINCT FROM 'object'\n     OR max_attempts NOT BETWEEN 1 AND 100 THEN\n    RAISE EXCEPTION 'SUPACLOUD_COMMAND_INVALID' USING ERRCODE = '22023';\n  END IF;\n\n  fingerprint := 'md5:' || md5(payload::text);\n  PERFORM pg_advisory_xact_lock(hashtextextended(command_id::text, 0));\n  SELECT * INTO existing FROM supacloud_commands.receipts WHERE id = command_id;\n  IF FOUND THEN\n    IF existing.command_type <> normalized_command_type\n       OR existing.target_type <> normalized_target_type\n       OR existing.target_id <> normalized_target_id\n       OR existing.actor_id IS DISTINCT FROM actor_id\n       OR existing.payload <> payload\n       OR existing.payload_fingerprint <> fingerprint THEN\n      RAISE EXCEPTION 'SUPACLOUD_COMMAND_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    RETURN supacloud_commands.snapshot(command_id, true);\n  END IF;\n\n  PERFORM supacloud_workflows.start_run(\n    command_id,\n    'command.' || normalized_command_type,\n    '1',\n    'execute',\n    jsonb_build_object(\n      'commandId', command_id,\n      'commandType', normalized_command_type,\n      'targetType', normalized_target_type,\n      'targetId', normalized_target_id,\n      'actorId', actor_id,\n      'payload', payload,\n      'payloadFingerprint', fingerprint\n    ),\n    max_attempts\n  );\n\n  INSERT INTO supacloud_commands.receipts (\n    id, command_type, target_type, target_id, actor_id, payload,\n    payload_fingerprint, workflow_run_id\n  ) VALUES (\n    command_id, normalized_command_type, normalized_target_type,\n    normalized_target_id, actor_id, payload, fingerprint, command_id\n  );\n  RETURN supacloud_commands.snapshot(command_id, false);\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_COMMAND_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_command_submit(request jsonb)\nRETURNS jsonb\nLANGUAGE sql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT supacloud_commands.submit(request)\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_command_get(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  command_id_text text;\nBEGIN\n  IF jsonb_typeof(request) IS DISTINCT FROM 'object' THEN\n    RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';\n  END IF;\n  command_id_text := request ->> 'commandId';\n  IF command_id_text IS NULL\n     OR command_id_text !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$' THEN\n    RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';\n  END IF;\n  RETURN supacloud_commands.snapshot(command_id_text::uuid, false);\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation THEN\n    RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nREVOKE ALL ON ALL TABLES IN SCHEMA supacloud_commands\n  FROM PUBLIC, anon, authenticated, service_role;\nREVOKE ALL ON ALL FUNCTIONS IN SCHEMA supacloud_commands\n  FROM PUBLIC, anon, authenticated, service_role;\nREVOKE ALL ON FUNCTION public.supacloud_command_submit(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_command_get(jsonb) FROM PUBLIC, anon, authenticated;\nGRANT EXECUTE ON FUNCTION public.supacloud_command_submit(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_command_get(jsonb) TO service_role;\n-- supacloud:sql-module:commands-public:end\n\n-- supacloud:sql-module:artifacts-public:start\nCREATE SCHEMA IF NOT EXISTS supacloud_artifacts;\nREVOKE ALL ON SCHEMA supacloud_artifacts FROM PUBLIC, anon, authenticated;\nGRANT USAGE ON SCHEMA supacloud_artifacts TO service_role;\n\nCREATE TABLE IF NOT EXISTS supacloud_artifacts.artifacts (\n  id uuid PRIMARY KEY,\n  storage_object_id uuid NOT NULL UNIQUE REFERENCES storage.objects(id) ON DELETE RESTRICT,\n  bucket_id text NOT NULL,\n  object_path text NOT NULL,\n  object_version text NOT NULL,\n  artifact_type text NOT NULL\n    CHECK (artifact_type ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'),\n  sha256 text NOT NULL CHECK (sha256 ~ '^[0-9a-f]{64}$'),\n  size_bytes bigint NOT NULL CHECK (size_bytes >= 0),\n  mime_type text NOT NULL CHECK (char_length(mime_type) BETWEEN 1 AND 255),\n  metadata jsonb NOT NULL DEFAULT '{}'::jsonb CHECK (jsonb_typeof(metadata) = 'object'),\n  retention_until timestamptz,\n  created_by uuid,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  CHECK (retention_until IS NULL OR retention_until >= created_at),\n  UNIQUE (bucket_id, object_path, object_version)\n);\n\nCREATE INDEX IF NOT EXISTS supacloud_artifacts_lookup_idx\n  ON supacloud_artifacts.artifacts (artifact_type, created_at DESC, id);\n\nCREATE TABLE IF NOT EXISTS supacloud_artifacts.lineage (\n  parent_artifact_id uuid NOT NULL REFERENCES supacloud_artifacts.artifacts(id) ON DELETE RESTRICT,\n  child_artifact_id uuid NOT NULL REFERENCES supacloud_artifacts.artifacts(id) ON DELETE RESTRICT,\n  relation_type text NOT NULL\n    CHECK (relation_type ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'),\n  metadata jsonb NOT NULL DEFAULT '{}'::jsonb CHECK (jsonb_typeof(metadata) = 'object'),\n  created_at timestamptz NOT NULL DEFAULT now(),\n  PRIMARY KEY (parent_artifact_id, child_artifact_id, relation_type),\n  CHECK (parent_artifact_id <> child_artifact_id)\n);\n\nCREATE INDEX IF NOT EXISTS supacloud_artifacts_lineage_child_idx\n  ON supacloud_artifacts.lineage (child_artifact_id, created_at, parent_artifact_id);\n\nCREATE OR REPLACE FUNCTION supacloud_artifacts.guard_storage_object()\nRETURNS trigger\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nBEGIN\n  IF EXISTS (\n    SELECT 1 FROM supacloud_artifacts.artifacts artifact\n    WHERE artifact.storage_object_id = OLD.id\n  ) THEN\n    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_IMMUTABLE' USING ERRCODE = '55000';\n  END IF;\n  RETURN CASE WHEN TG_OP = 'DELETE' THEN OLD ELSE NEW END;\nEND;\n$$;\n\nDROP TRIGGER IF EXISTS supacloud_artifact_storage_fence ON storage.objects;\nCREATE TRIGGER supacloud_artifact_storage_fence\nBEFORE UPDATE OR DELETE ON storage.objects\nFOR EACH ROW EXECUTE FUNCTION supacloud_artifacts.guard_storage_object();\n\nCREATE OR REPLACE FUNCTION supacloud_artifacts.snapshot(\n  p_artifact_id uuid,\n  p_idempotent boolean DEFAULT false\n) RETURNS jsonb\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT jsonb_build_object(\n    'artifactId', artifact.id,\n    'bucketId', artifact.bucket_id,\n    'objectPath', artifact.object_path,\n    'objectVersion', artifact.object_version,\n    'artifactType', artifact.artifact_type,\n    'sha256', artifact.sha256,\n    'sizeBytes', artifact.size_bytes::text,\n    'mimeType', artifact.mime_type,\n    'metadata', artifact.metadata,\n    'retentionUntil', artifact.retention_until,\n    'createdBy', artifact.created_by,\n    'createdAt', artifact.created_at,\n    'idempotent', p_idempotent,\n    'parents', coalesce((\n      SELECT jsonb_agg(jsonb_build_object(\n        'artifactId', edge.parent_artifact_id,\n        'relationType', edge.relation_type,\n        'metadata', edge.metadata,\n        'createdAt', edge.created_at\n      ) ORDER BY edge.created_at, edge.parent_artifact_id)\n      FROM supacloud_artifacts.lineage edge\n      WHERE edge.child_artifact_id = artifact.id\n    ), '[]'::jsonb)\n  )\n  FROM supacloud_artifacts.artifacts artifact\n  WHERE artifact.id = p_artifact_id\n$$;\n\nDROP FUNCTION IF EXISTS supacloud_artifacts.register(uuid, text, text, text, text, bigint, text, jsonb, timestamptz, uuid);\nCREATE OR REPLACE FUNCTION supacloud_artifacts.register(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  artifact_id uuid;\n  size_bytes bigint;\n  metadata jsonb;\n  retention_until timestamptz;\n  created_by uuid;\n  normalized_bucket text;\n  normalized_path text;\n  normalized_type text;\n  normalized_sha256 text;\n  normalized_mime text;\n  object_row storage.objects%ROWTYPE;\n  existing supacloud_artifacts.artifacts%ROWTYPE;\nBEGIN\n  IF jsonb_typeof(request) IS DISTINCT FROM 'object' THEN\n    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_INVALID' USING ERRCODE = '22023';\n  END IF;\n  artifact_id := (request ->> 'artifactId')::uuid;\n  size_bytes := (request ->> 'sizeBytes')::bigint;\n  metadata := coalesce(request -> 'metadata', '{}'::jsonb);\n  retention_until := (request ->> 'retentionUntil')::timestamptz;\n  created_by := (request ->> 'createdBy')::uuid;\n  normalized_bucket := nullif(btrim(request ->> 'bucketId'), '');\n  normalized_path := nullif(btrim(request ->> 'objectPath'), '');\n  normalized_type := nullif(btrim(request ->> 'artifactType'), '');\n  normalized_sha256 := lower(nullif(btrim(request ->> 'sha256'), ''));\n  normalized_mime := lower(nullif(btrim(request ->> 'mimeType'), ''));\n  IF artifact_id IS NULL OR normalized_bucket IS NULL OR normalized_path IS NULL\n     OR normalized_path LIKE '/%' OR normalized_path LIKE '%\\%'\n     OR normalized_path ~ '(^|/)(.|..)(/|$)'\n     OR normalized_type IS NULL\n     OR normalized_type !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'\n     OR normalized_sha256 IS NULL OR normalized_sha256 !~ '^[0-9a-f]{64}$'\n     OR size_bytes IS NULL OR size_bytes < 0\n     OR normalized_mime IS NULL OR char_length(normalized_mime) > 255\n     OR jsonb_typeof(metadata) IS DISTINCT FROM 'object'\n     OR (retention_until IS NOT NULL AND retention_until < now()) THEN\n    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_INVALID' USING ERRCODE = '22023';\n  END IF;\n\n  SELECT * INTO object_row FROM storage.objects\n  WHERE bucket_id = normalized_bucket AND name = normalized_path;\n  IF NOT FOUND THEN\n    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_OBJECT_NOT_FOUND' USING ERRCODE = 'P0002';\n  END IF;\n\n  PERFORM pg_advisory_xact_lock(hashtextextended(artifact_id::text, 0));\n  SELECT * INTO existing FROM supacloud_artifacts.artifacts WHERE id = artifact_id;\n  IF FOUND THEN\n    IF existing.storage_object_id <> object_row.id\n       OR existing.artifact_type <> normalized_type\n       OR existing.sha256 <> normalized_sha256\n       OR existing.size_bytes <> size_bytes\n       OR existing.mime_type <> normalized_mime\n       OR existing.metadata <> metadata\n       OR existing.retention_until IS DISTINCT FROM retention_until\n       OR existing.created_by IS DISTINCT FROM created_by THEN\n      RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n    END IF;\n    RETURN supacloud_artifacts.snapshot(artifact_id, true);\n  END IF;\n\n  INSERT INTO supacloud_artifacts.artifacts (\n    id, storage_object_id, bucket_id, object_path, object_version,\n    artifact_type, sha256, size_bytes, mime_type, metadata,\n    retention_until, created_by\n  ) VALUES (\n    artifact_id, object_row.id, normalized_bucket, normalized_path,\n    object_row.version::text, normalized_type, normalized_sha256,\n    size_bytes, normalized_mime, metadata, retention_until, created_by\n  );\n  RETURN supacloud_artifacts.snapshot(artifact_id, false);\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN\n    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION supacloud_artifacts.link(\n  p_parent_artifact_id uuid,\n  p_child_artifact_id uuid,\n  p_relation_type text,\n  p_metadata jsonb\n) RETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE\n  normalized_relation text := nullif(btrim(p_relation_type), '');\n  inserted_count integer;\nBEGIN\n  IF p_parent_artifact_id IS NULL OR p_child_artifact_id IS NULL\n     OR p_parent_artifact_id = p_child_artifact_id\n     OR normalized_relation IS NULL\n     OR normalized_relation !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'\n     OR jsonb_typeof(p_metadata) IS DISTINCT FROM 'object' THEN\n    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_LINEAGE_INVALID' USING ERRCODE = '22023';\n  END IF;\n  IF EXISTS (\n    WITH RECURSIVE descendants(artifact_id) AS (\n      SELECT edge.child_artifact_id\n      FROM supacloud_artifacts.lineage edge\n      WHERE edge.parent_artifact_id = p_child_artifact_id\n      UNION\n      SELECT edge.child_artifact_id\n      FROM supacloud_artifacts.lineage edge\n      JOIN descendants current ON edge.parent_artifact_id = current.artifact_id\n    )\n    SELECT 1 FROM descendants WHERE artifact_id = p_parent_artifact_id\n  ) THEN\n    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_LINEAGE_CYCLE' USING ERRCODE = '23514';\n  END IF;\n  INSERT INTO supacloud_artifacts.lineage (\n    parent_artifact_id, child_artifact_id, relation_type, metadata\n  ) VALUES (\n    p_parent_artifact_id, p_child_artifact_id, normalized_relation, p_metadata\n  ) ON CONFLICT DO NOTHING;\n  GET DIAGNOSTICS inserted_count = ROW_COUNT;\n  IF inserted_count = 0 AND NOT EXISTS (\n    SELECT 1 FROM supacloud_artifacts.lineage\n    WHERE parent_artifact_id = p_parent_artifact_id\n      AND child_artifact_id = p_child_artifact_id\n      AND relation_type = normalized_relation\n      AND metadata = p_metadata\n  ) THEN\n    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';\n  END IF;\n  RETURN supacloud_artifacts.snapshot(p_child_artifact_id, inserted_count = 0);\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_artifact_register(request jsonb)\nRETURNS jsonb\nLANGUAGE sql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\n  SELECT supacloud_artifacts.register(request)\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_artifact_get(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = '' AS $$\nBEGIN\n  RETURN supacloud_artifacts.snapshot((request ->> 'artifactId')::uuid, false);\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation THEN\n    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_GET_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nCREATE OR REPLACE FUNCTION public.supacloud_artifact_link(request jsonb)\nRETURNS jsonb\nLANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nBEGIN\n  RETURN supacloud_artifacts.link(\n    (request ->> 'parentArtifactId')::uuid,\n    (request ->> 'childArtifactId')::uuid,\n    request ->> 'relationType',\n    coalesce(request -> 'metadata', '{}'::jsonb)\n  );\nEXCEPTION\n  WHEN invalid_parameter_value OR invalid_text_representation THEN\n    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_LINEAGE_INVALID' USING ERRCODE = '22023';\nEND;\n$$;\n\nREVOKE ALL ON ALL TABLES IN SCHEMA supacloud_artifacts\n  FROM PUBLIC, anon, authenticated, service_role;\nREVOKE ALL ON ALL FUNCTIONS IN SCHEMA supacloud_artifacts\n  FROM PUBLIC, anon, authenticated, service_role;\nREVOKE ALL ON FUNCTION public.supacloud_artifact_register(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_artifact_get(jsonb) FROM PUBLIC, anon, authenticated;\nREVOKE ALL ON FUNCTION public.supacloud_artifact_link(jsonb) FROM PUBLIC, anon, authenticated;\nGRANT EXECUTE ON FUNCTION public.supacloud_artifact_register(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_artifact_get(jsonb) TO service_role;\nGRANT EXECUTE ON FUNCTION public.supacloud_artifact_link(jsonb) TO service_role;\n-- supacloud:sql-module:artifacts-public:end\n";
 /**
  * pg_cron emulation: the `cron.job` / `cron.job_run_details` tables and
  * schedule/unschedule functions. This only records jobs; the in-process

package/dist/runtime/db/emulated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emulated.d.ts","sourceRoot":"","sources":["../../../src/runtime/db/emulated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH;;;;GAIG;AACH,eAAO,MAAM,QAAQ,u6WAyQpB,CAAA;AAED,eAAO,MAAM,aAAa,2pzCA+iCzB,CAAA;AAID;;;;GAIG;AACH,eAAO,MAAM,QAAQ,uyEA6DpB,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,82GA0EnB,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,ulBAqB1B,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,m/FAoErB,CAAA"}
+{"version":3,"file":"emulated.d.ts","sourceRoot":"","sources":["../../../src/runtime/db/emulated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH;;;;GAIG;AACH,eAAO,MAAM,QAAQ,u6WAyQpB,CAAA;AAED,eAAO,MAAM,aAAa,s84DA6+CzB,CAAA;AAID;;;;GAIG;AACH,eAAO,MAAM,QAAQ,uyEA6DpB,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,82GA0EnB,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,ulBAqB1B,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,m/FAoErB,CAAA"}

package/dist/runtime/node/native/engine.d.ts

@@ -1,4 +1,5 @@
 import type { DbEngine } from '../../db/engine.js';
+import { type NativeReplicationOptions } from './replication.js';
 export declare const NATIVE_POSTGRES_MAJOR: string;
 export interface GlibcRuntimeEvidence {
     runtimeVersion?: string;
@@ -17,6 +18,8 @@ export interface NativeEngineOptions {
     log?: (msg: string) => void;
     /** Optional HTTPS or loopback HTTP prefix for proxying the PostgreSQL release download. */
     downloadMirror?: string;
+    /** Optional externally reachable logical-replication profile. Disabled by default. */
+    replication?: NativeReplicationOptions;
 }
 export declare function isNativeEngineSupported(): boolean;
 export declare function isGlibcRuntime(evidence: GlibcRuntimeEvidence): boolean;

package/dist/runtime/node/native/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../../src/runtime/node/native/engine.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAOlD,eAAO,MAAM,qBAAqB,QAAoC,CAAA;AActE,MAAM,WAAW,oBAAoB;IACnC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oBAAoB,EAAE,OAAO,CAAA;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3B,2FAA2F;IAC3F,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,wBAAgB,uBAAuB,IAAI,OAAO,CAIjD;AAUD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAItE;AAuED,6GAA6G;AAC7G,wBAAsB,cAAc,CAClC,OAAO,SAAqB,EAC5B,QAAQ,CAAC,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,EACzB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAG/F;AAkDD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiFrF"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../../src/runtime/node/native/engine.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,kBAAkB,CAAA;AAOzB,eAAO,MAAM,qBAAqB,QAAoC,CAAA;AActE,MAAM,WAAW,oBAAoB;IACnC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oBAAoB,EAAE,OAAO,CAAA;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3B,2FAA2F;IAC3F,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,sFAAsF;IACtF,WAAW,CAAC,EAAE,wBAAwB,CAAA;CACvC;AAED,wBAAgB,uBAAuB,IAAI,OAAO,CAIjD;AAUD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAItE;AAuED,6GAA6G;AAC7G,wBAAsB,cAAc,CAClC,OAAO,SAAqB,EAC5B,QAAQ,CAAC,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,EACzB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAG/F;AAmDD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgGrF"}

package/dist/runtime/node/native/readiness.d.ts

@@ -0,0 +1,65 @@
+import type { DbEngine } from '../../db/engine.js';
+import { type PowerSyncReplicationOptions } from './replication.js';
+export type LiteCapabilityStatus = 'supported' | 'static' | 'disabled' | 'unsupported';
+export interface LiteDoctorReport {
+    engine: 'pglite' | 'native';
+    state_machine_sql: 'supported';
+    durable_workflows: 'supported';
+    commands: 'supported';
+    artifacts: 'supported';
+    postgrest_schema_config: 'static';
+    logical_replication: LiteCapabilityStatus;
+    powersync_source: LiteCapabilityStatus;
+    replication_profile?: 'powersync';
+    powersync_readiness?: PowerSyncReadiness;
+}
+export interface PowerSyncReadiness {
+    ready: boolean;
+    blockers: string[];
+    warnings: string[];
+    connection: {
+        host: string;
+        port: number;
+        tls: boolean;
+        allowed_cidrs: string[];
+    };
+    wal: {
+        level: string;
+        max_senders: number;
+        active_senders: number;
+        max_replication_slots: number;
+        used_replication_slots: number;
+        max_slot_wal_keep_size: string;
+    };
+    role: {
+        name: string;
+        present: boolean;
+        login: boolean;
+        replication: boolean;
+        bypass_rls: boolean;
+        unexpected_selectable_tables: string[];
+    };
+    publication: {
+        name: string;
+        present: boolean;
+        all_tables: boolean;
+        tables: string[];
+        expected_tables: string[];
+        publishes_insert: boolean;
+        publishes_update: boolean;
+        publishes_delete: boolean;
+        replica_identity_missing_tables: string[];
+    };
+    slots: Array<{
+        name: string;
+        active: boolean;
+        wal_status: string | null;
+        retained_wal_bytes: string;
+        unconfirmed_wal_bytes: string;
+        safe_wal_size: string | null;
+        invalidation_reason: string | null;
+    }>;
+}
+export declare function liteCapabilities(engine: 'pglite' | 'native', replicationProfile?: 'powersync'): LiteDoctorReport;
+export declare function inspectPowerSyncReadiness(engine: DbEngine, options: PowerSyncReplicationOptions): Promise<PowerSyncReadiness>;
+//# sourceMappingURL=readiness.d.ts.map

package/dist/runtime/node/native/readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../../../../src/runtime/node/native/readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAGL,KAAK,2BAA2B,EACjC,MAAM,kBAAkB,CAAA;AAEzB,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,CAAA;AAEtF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC3B,iBAAiB,EAAE,WAAW,CAAA;IAC9B,iBAAiB,EAAE,WAAW,CAAA;IAC9B,QAAQ,EAAE,WAAW,CAAA;IACrB,SAAS,EAAE,WAAW,CAAA;IACtB,uBAAuB,EAAE,QAAQ,CAAA;IACjC,mBAAmB,EAAE,oBAAoB,CAAA;IACzC,gBAAgB,EAAE,oBAAoB,CAAA;IACtC,mBAAmB,CAAC,EAAE,WAAW,CAAA;IACjC,mBAAmB,CAAC,EAAE,kBAAkB,CAAA;CACzC;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;QACZ,GAAG,EAAE,OAAO,CAAA;QACZ,aAAa,EAAE,MAAM,EAAE,CAAA;KACxB,CAAA;IACD,GAAG,EAAE;QACH,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,EAAE,MAAM,CAAA;QACnB,cAAc,EAAE,MAAM,CAAA;QACtB,qBAAqB,EAAE,MAAM,CAAA;QAC7B,sBAAsB,EAAE,MAAM,CAAA;QAC9B,sBAAsB,EAAE,MAAM,CAAA;KAC/B,CAAA;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,OAAO,CAAA;QAChB,KAAK,EAAE,OAAO,CAAA;QACd,WAAW,EAAE,OAAO,CAAA;QACpB,UAAU,EAAE,OAAO,CAAA;QACnB,4BAA4B,EAAE,MAAM,EAAE,CAAA;KACvC,CAAA;IACD,WAAW,EAAE;QACX,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,OAAO,CAAA;QACnB,MAAM,EAAE,MAAM,EAAE,CAAA;QAChB,eAAe,EAAE,MAAM,EAAE,CAAA;QACzB,gBAAgB,EAAE,OAAO,CAAA;QACzB,gBAAgB,EAAE,OAAO,CAAA;QACzB,gBAAgB,EAAE,OAAO,CAAA;QACzB,+BAA+B,EAAE,MAAM,EAAE,CAAA;KAC1C,CAAA;IACD,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,OAAO,CAAA;QACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,kBAAkB,EAAE,MAAM,CAAA;QAC1B,qBAAqB,EAAE,MAAM,CAAA;QAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;QAC5B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;KACnC,CAAC,CAAA;CACH;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAC3B,kBAAkB,CAAC,EAAE,WAAW,GAC/B,gBAAgB,CAwBlB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAE7B"}

package/dist/runtime/node/native/replication.d.ts

@@ -0,0 +1,22 @@
+import type { DbEngine } from '../../db/engine.js';
+export declare const POWERSYNC_REPLICATION_ROLE = "supacloud_powersync";
+export declare const POWERSYNC_PUBLICATION = "powersync";
+export interface NativeReplicationTlsOptions {
+    certFile: string;
+    keyFile: string;
+}
+export interface PowerSyncReplicationOptions {
+    profile: 'powersync';
+    host: string;
+    port: number;
+    allowCidrs: string[];
+    publicationTables: string[];
+    password: string;
+    tls?: NativeReplicationTlsOptions;
+}
+export type NativeReplicationOptions = PowerSyncReplicationOptions;
+export declare function validatePowerSyncReplicationOptions(options: PowerSyncReplicationOptions): PowerSyncReplicationOptions;
+export declare function buildPowerSyncPostgresArgs(options: PowerSyncReplicationOptions, hbaFile: string): string[];
+export declare function writePowerSyncHba(path: string, options: PowerSyncReplicationOptions): void;
+export declare function ensurePowerSyncReplicationCatalog(engine: DbEngine, options: PowerSyncReplicationOptions): Promise<void>;
+//# sourceMappingURL=replication.d.ts.map

package/dist/runtime/node/native/replication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replication.d.ts","sourceRoot":"","sources":["../../../../src/runtime/node/native/replication.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAY,MAAM,oBAAoB,CAAA;AAE5D,eAAO,MAAM,0BAA0B,wBAAwB,CAAA;AAC/D,eAAO,MAAM,qBAAqB,cAAc,CAAA;AAEhD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,WAAW,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,CAAC,EAAE,2BAA2B,CAAA;CAClC;AAED,MAAM,MAAM,wBAAwB,GAAG,2BAA2B,CAAA;AAElE,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,2BAA2B,GACnC,2BAA2B,CAS7B;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAmB1G;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,IAAI,CAe1F;AAED,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/lite",
-  "version": "0.8.4",
+  "version": "0.9.0",
   "description": "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   "type": "module",
   "license": "Apache-2.0",
@@ -38,7 +38,7 @@
     "dev": "bun run src/cli.ts start",
     "start": "bun run src/cli.ts start",
     "test": "bun test --timeout 20000",
-    "test:native": "SUPACLOUD_LITE_TEST_NATIVE=1 bun test test/native-engine.test.ts test/qauth-workflow-matrix.test.ts --timeout 180000",
+    "test:native": "SUPACLOUD_LITE_TEST_NATIVE=1 bun test test/native-engine.test.ts test/qauth-workflow-matrix.test.ts test/maker-checker-workflow.test.ts test/commands-artifacts.test.ts --timeout 180000",
     "parity": "bun run parity/harness.ts",
     "parity:native": "SUPACLOUD_LITE_TEST_NATIVE=1 bun run parity/harness.ts --engine native",
     "check:native": "bun run test:native && bun run parity:native",