@supacloud/lite 0.8.5 → 0.9.0

package/dist/index.js

@@ -85,7 +85,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.8.5",
+  version: "0.9.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -123,7 +123,7 @@ var package_default = {
     dev: "bun run src/cli.ts start",
     start: "bun run src/cli.ts start",
     test: "bun test --timeout 20000",
-    "test:native": "SUPACLOUD_LITE_TEST_NATIVE=1 bun test test/native-engine.test.ts test/qauth-workflow-matrix.test.ts --timeout 180000",
+    "test:native": "SUPACLOUD_LITE_TEST_NATIVE=1 bun test test/native-engine.test.ts test/qauth-workflow-matrix.test.ts test/maker-checker-workflow.test.ts test/commands-artifacts.test.ts --timeout 180000",
     parity: "bun run parity/harness.ts",
     "parity:native": "SUPACLOUD_LITE_TEST_NATIVE=1 bun run parity/harness.ts --engine native",
     "check:native": "bun run test:native && bun run parity:native",
@@ -4772,6 +4772,452 @@ GRANT EXECUTE ON FUNCTION public.supacloud_workflow_cancel(jsonb) TO service_rol
 GRANT EXECUTE ON FUNCTION public.supacloud_workflow_get(jsonb) TO service_role;
 GRANT EXECUTE ON FUNCTION public.supacloud_workflow_events(jsonb) TO service_role;
 -- supacloud:sql-module:workflows-public:end
+
+-- supacloud:sql-module:commands-public:start
+CREATE SCHEMA IF NOT EXISTS supacloud_commands;
+REVOKE ALL ON SCHEMA supacloud_commands FROM PUBLIC, anon, authenticated;
+GRANT USAGE ON SCHEMA supacloud_commands TO service_role;
+
+CREATE TABLE IF NOT EXISTS supacloud_commands.receipts (
+  id uuid PRIMARY KEY,
+  command_type text NOT NULL
+    CHECK (command_type ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'),
+  target_type text NOT NULL
+    CHECK (target_type ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'),
+  target_id text NOT NULL CHECK (char_length(target_id) BETWEEN 1 AND 500),
+  actor_id uuid,
+  payload jsonb NOT NULL DEFAULT '{}'::jsonb
+    CHECK (jsonb_typeof(payload) = 'object'),
+  payload_fingerprint text NOT NULL CHECK (char_length(payload_fingerprint) = 36),
+  workflow_run_id uuid NOT NULL UNIQUE
+    REFERENCES supacloud_workflows.runs(id) ON DELETE RESTRICT,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS supacloud_commands_target_idx
+  ON supacloud_commands.receipts (target_type, target_id, created_at DESC, id);
+
+CREATE OR REPLACE FUNCTION supacloud_commands.snapshot(
+  p_command_id uuid,
+  p_idempotent boolean DEFAULT false
+) RETURNS jsonb
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$
+  SELECT jsonb_build_object(
+    'commandId', receipt.id,
+    'commandType', receipt.command_type,
+    'targetType', receipt.target_type,
+    'targetId', receipt.target_id,
+    'actorId', receipt.actor_id,
+    'payloadFingerprint', receipt.payload_fingerprint,
+    'createdAt', receipt.created_at,
+    'idempotent', p_idempotent,
+    'workflow', supacloud_workflows.snapshot(receipt.workflow_run_id, false)
+  )
+  FROM supacloud_commands.receipts receipt
+  WHERE receipt.id = p_command_id
+$$;
+
+-- Application-owned SECURITY DEFINER RPCs may call this after their domain
+-- mutation. PostgreSQL commits the domain write, receipt, and workflow enqueue
+-- together, so a lost response can be replayed with the same command ID.
+DROP FUNCTION IF EXISTS supacloud_commands.submit(uuid, text, text, text, uuid, jsonb, integer);
+CREATE OR REPLACE FUNCTION supacloud_commands.submit(request jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  command_id_text text;
+  command_id uuid;
+  actor_id uuid;
+  max_attempts integer;
+  payload jsonb;
+  normalized_command_type text;
+  normalized_target_type text;
+  normalized_target_id text;
+  fingerprint text;
+  existing supacloud_commands.receipts%ROWTYPE;
+BEGIN
+  IF jsonb_typeof(request) IS DISTINCT FROM 'object' THEN
+    RAISE EXCEPTION 'SUPACLOUD_COMMAND_INVALID' USING ERRCODE = '22023';
+  END IF;
+  command_id_text := request ->> 'commandId';
+  IF command_id_text IS NULL
+     OR command_id_text !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$' THEN
+    RAISE EXCEPTION 'SUPACLOUD_COMMAND_INVALID' USING ERRCODE = '22023';
+  END IF;
+  command_id := command_id_text::uuid;
+  IF request ? 'actorId' AND request ->> 'actorId' IS NOT NULL THEN
+    actor_id := (request ->> 'actorId')::uuid;
+  END IF;
+  max_attempts := coalesce((request ->> 'maxAttempts')::integer, 3);
+  payload := coalesce(request -> 'payload', '{}'::jsonb);
+  normalized_command_type := nullif(btrim(request ->> 'commandType'), '');
+  normalized_target_type := nullif(btrim(request ->> 'targetType'), '');
+  normalized_target_id := nullif(btrim(request ->> 'targetId'), '');
+  IF normalized_command_type IS NULL
+     OR normalized_command_type !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'
+     OR normalized_target_type IS NULL
+     OR normalized_target_type !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'
+     OR normalized_target_id IS NULL
+     OR char_length(normalized_target_id) > 500
+     OR jsonb_typeof(payload) IS DISTINCT FROM 'object'
+     OR max_attempts NOT BETWEEN 1 AND 100 THEN
+    RAISE EXCEPTION 'SUPACLOUD_COMMAND_INVALID' USING ERRCODE = '22023';
+  END IF;
+
+  fingerprint := 'md5:' || md5(payload::text);
+  PERFORM pg_advisory_xact_lock(hashtextextended(command_id::text, 0));
+  SELECT * INTO existing FROM supacloud_commands.receipts WHERE id = command_id;
+  IF FOUND THEN
+    IF existing.command_type <> normalized_command_type
+       OR existing.target_type <> normalized_target_type
+       OR existing.target_id <> normalized_target_id
+       OR existing.actor_id IS DISTINCT FROM actor_id
+       OR existing.payload <> payload
+       OR existing.payload_fingerprint <> fingerprint THEN
+      RAISE EXCEPTION 'SUPACLOUD_COMMAND_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';
+    END IF;
+    RETURN supacloud_commands.snapshot(command_id, true);
+  END IF;
+
+  PERFORM supacloud_workflows.start_run(
+    command_id,
+    'command.' || normalized_command_type,
+    '1',
+    'execute',
+    jsonb_build_object(
+      'commandId', command_id,
+      'commandType', normalized_command_type,
+      'targetType', normalized_target_type,
+      'targetId', normalized_target_id,
+      'actorId', actor_id,
+      'payload', payload,
+      'payloadFingerprint', fingerprint
+    ),
+    max_attempts
+  );
+
+  INSERT INTO supacloud_commands.receipts (
+    id, command_type, target_type, target_id, actor_id, payload,
+    payload_fingerprint, workflow_run_id
+  ) VALUES (
+    command_id, normalized_command_type, normalized_target_type,
+    normalized_target_id, actor_id, payload, fingerprint, command_id
+  );
+  RETURN supacloud_commands.snapshot(command_id, false);
+EXCEPTION
+  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN
+    RAISE EXCEPTION 'SUPACLOUD_COMMAND_INVALID' USING ERRCODE = '22023';
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION public.supacloud_command_submit(request jsonb)
+RETURNS jsonb
+LANGUAGE sql VOLATILE SECURITY DEFINER SET search_path = '' AS $$
+  SELECT supacloud_commands.submit(request)
+$$;
+
+CREATE OR REPLACE FUNCTION public.supacloud_command_get(request jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  command_id_text text;
+BEGIN
+  IF jsonb_typeof(request) IS DISTINCT FROM 'object' THEN
+    RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
+  END IF;
+  command_id_text := request ->> 'commandId';
+  IF command_id_text IS NULL
+     OR command_id_text !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$' THEN
+    RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
+  END IF;
+  RETURN supacloud_commands.snapshot(command_id_text::uuid, false);
+EXCEPTION
+  WHEN invalid_parameter_value OR invalid_text_representation THEN
+    RAISE EXCEPTION 'SUPACLOUD_COMMAND_GET_INVALID' USING ERRCODE = '22023';
+END;
+$$;
+
+REVOKE ALL ON ALL TABLES IN SCHEMA supacloud_commands
+  FROM PUBLIC, anon, authenticated, service_role;
+REVOKE ALL ON ALL FUNCTIONS IN SCHEMA supacloud_commands
+  FROM PUBLIC, anon, authenticated, service_role;
+REVOKE ALL ON FUNCTION public.supacloud_command_submit(jsonb) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.supacloud_command_get(jsonb) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.supacloud_command_submit(jsonb) TO service_role;
+GRANT EXECUTE ON FUNCTION public.supacloud_command_get(jsonb) TO service_role;
+-- supacloud:sql-module:commands-public:end
+
+-- supacloud:sql-module:artifacts-public:start
+CREATE SCHEMA IF NOT EXISTS supacloud_artifacts;
+REVOKE ALL ON SCHEMA supacloud_artifacts FROM PUBLIC, anon, authenticated;
+GRANT USAGE ON SCHEMA supacloud_artifacts TO service_role;
+
+CREATE TABLE IF NOT EXISTS supacloud_artifacts.artifacts (
+  id uuid PRIMARY KEY,
+  storage_object_id uuid NOT NULL UNIQUE REFERENCES storage.objects(id) ON DELETE RESTRICT,
+  bucket_id text NOT NULL,
+  object_path text NOT NULL,
+  object_version text NOT NULL,
+  artifact_type text NOT NULL
+    CHECK (artifact_type ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'),
+  sha256 text NOT NULL CHECK (sha256 ~ '^[0-9a-f]{64}$'),
+  size_bytes bigint NOT NULL CHECK (size_bytes >= 0),
+  mime_type text NOT NULL CHECK (char_length(mime_type) BETWEEN 1 AND 255),
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb CHECK (jsonb_typeof(metadata) = 'object'),
+  retention_until timestamptz,
+  created_by uuid,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CHECK (retention_until IS NULL OR retention_until >= created_at),
+  UNIQUE (bucket_id, object_path, object_version)
+);
+
+CREATE INDEX IF NOT EXISTS supacloud_artifacts_lookup_idx
+  ON supacloud_artifacts.artifacts (artifact_type, created_at DESC, id);
+
+CREATE TABLE IF NOT EXISTS supacloud_artifacts.lineage (
+  parent_artifact_id uuid NOT NULL REFERENCES supacloud_artifacts.artifacts(id) ON DELETE RESTRICT,
+  child_artifact_id uuid NOT NULL REFERENCES supacloud_artifacts.artifacts(id) ON DELETE RESTRICT,
+  relation_type text NOT NULL
+    CHECK (relation_type ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'),
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb CHECK (jsonb_typeof(metadata) = 'object'),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (parent_artifact_id, child_artifact_id, relation_type),
+  CHECK (parent_artifact_id <> child_artifact_id)
+);
+
+CREATE INDEX IF NOT EXISTS supacloud_artifacts_lineage_child_idx
+  ON supacloud_artifacts.lineage (child_artifact_id, created_at, parent_artifact_id);
+
+CREATE OR REPLACE FUNCTION supacloud_artifacts.guard_storage_object()
+RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM supacloud_artifacts.artifacts artifact
+    WHERE artifact.storage_object_id = OLD.id
+  ) THEN
+    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_IMMUTABLE' USING ERRCODE = '55000';
+  END IF;
+  RETURN CASE WHEN TG_OP = 'DELETE' THEN OLD ELSE NEW END;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS supacloud_artifact_storage_fence ON storage.objects;
+CREATE TRIGGER supacloud_artifact_storage_fence
+BEFORE UPDATE OR DELETE ON storage.objects
+FOR EACH ROW EXECUTE FUNCTION supacloud_artifacts.guard_storage_object();
+
+CREATE OR REPLACE FUNCTION supacloud_artifacts.snapshot(
+  p_artifact_id uuid,
+  p_idempotent boolean DEFAULT false
+) RETURNS jsonb
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $$
+  SELECT jsonb_build_object(
+    'artifactId', artifact.id,
+    'bucketId', artifact.bucket_id,
+    'objectPath', artifact.object_path,
+    'objectVersion', artifact.object_version,
+    'artifactType', artifact.artifact_type,
+    'sha256', artifact.sha256,
+    'sizeBytes', artifact.size_bytes::text,
+    'mimeType', artifact.mime_type,
+    'metadata', artifact.metadata,
+    'retentionUntil', artifact.retention_until,
+    'createdBy', artifact.created_by,
+    'createdAt', artifact.created_at,
+    'idempotent', p_idempotent,
+    'parents', coalesce((
+      SELECT jsonb_agg(jsonb_build_object(
+        'artifactId', edge.parent_artifact_id,
+        'relationType', edge.relation_type,
+        'metadata', edge.metadata,
+        'createdAt', edge.created_at
+      ) ORDER BY edge.created_at, edge.parent_artifact_id)
+      FROM supacloud_artifacts.lineage edge
+      WHERE edge.child_artifact_id = artifact.id
+    ), '[]'::jsonb)
+  )
+  FROM supacloud_artifacts.artifacts artifact
+  WHERE artifact.id = p_artifact_id
+$$;
+
+DROP FUNCTION IF EXISTS supacloud_artifacts.register(uuid, text, text, text, text, bigint, text, jsonb, timestamptz, uuid);
+CREATE OR REPLACE FUNCTION supacloud_artifacts.register(request jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  artifact_id uuid;
+  size_bytes bigint;
+  metadata jsonb;
+  retention_until timestamptz;
+  created_by uuid;
+  normalized_bucket text;
+  normalized_path text;
+  normalized_type text;
+  normalized_sha256 text;
+  normalized_mime text;
+  object_row storage.objects%ROWTYPE;
+  existing supacloud_artifacts.artifacts%ROWTYPE;
+BEGIN
+  IF jsonb_typeof(request) IS DISTINCT FROM 'object' THEN
+    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_INVALID' USING ERRCODE = '22023';
+  END IF;
+  artifact_id := (request ->> 'artifactId')::uuid;
+  size_bytes := (request ->> 'sizeBytes')::bigint;
+  metadata := coalesce(request -> 'metadata', '{}'::jsonb);
+  retention_until := (request ->> 'retentionUntil')::timestamptz;
+  created_by := (request ->> 'createdBy')::uuid;
+  normalized_bucket := nullif(btrim(request ->> 'bucketId'), '');
+  normalized_path := nullif(btrim(request ->> 'objectPath'), '');
+  normalized_type := nullif(btrim(request ->> 'artifactType'), '');
+  normalized_sha256 := lower(nullif(btrim(request ->> 'sha256'), ''));
+  normalized_mime := lower(nullif(btrim(request ->> 'mimeType'), ''));
+  IF artifact_id IS NULL OR normalized_bucket IS NULL OR normalized_path IS NULL
+     OR normalized_path LIKE '/%' OR normalized_path LIKE '%\\%'
+     OR normalized_path ~ '(^|/)(.|..)(/|$)'
+     OR normalized_type IS NULL
+     OR normalized_type !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'
+     OR normalized_sha256 IS NULL OR normalized_sha256 !~ '^[0-9a-f]{64}$'
+     OR size_bytes IS NULL OR size_bytes < 0
+     OR normalized_mime IS NULL OR char_length(normalized_mime) > 255
+     OR jsonb_typeof(metadata) IS DISTINCT FROM 'object'
+     OR (retention_until IS NOT NULL AND retention_until < now()) THEN
+    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_INVALID' USING ERRCODE = '22023';
+  END IF;
+
+  SELECT * INTO object_row FROM storage.objects
+  WHERE bucket_id = normalized_bucket AND name = normalized_path;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_OBJECT_NOT_FOUND' USING ERRCODE = 'P0002';
+  END IF;
+
+  PERFORM pg_advisory_xact_lock(hashtextextended(artifact_id::text, 0));
+  SELECT * INTO existing FROM supacloud_artifacts.artifacts WHERE id = artifact_id;
+  IF FOUND THEN
+    IF existing.storage_object_id <> object_row.id
+       OR existing.artifact_type <> normalized_type
+       OR existing.sha256 <> normalized_sha256
+       OR existing.size_bytes <> size_bytes
+       OR existing.mime_type <> normalized_mime
+       OR existing.metadata <> metadata
+       OR existing.retention_until IS DISTINCT FROM retention_until
+       OR existing.created_by IS DISTINCT FROM created_by THEN
+      RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';
+    END IF;
+    RETURN supacloud_artifacts.snapshot(artifact_id, true);
+  END IF;
+
+  INSERT INTO supacloud_artifacts.artifacts (
+    id, storage_object_id, bucket_id, object_path, object_version,
+    artifact_type, sha256, size_bytes, mime_type, metadata,
+    retention_until, created_by
+  ) VALUES (
+    artifact_id, object_row.id, normalized_bucket, normalized_path,
+    object_row.version::text, normalized_type, normalized_sha256,
+    size_bytes, normalized_mime, metadata, retention_until, created_by
+  );
+  RETURN supacloud_artifacts.snapshot(artifact_id, false);
+EXCEPTION
+  WHEN invalid_parameter_value OR invalid_text_representation OR numeric_value_out_of_range THEN
+    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_INVALID' USING ERRCODE = '22023';
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION supacloud_artifacts.link(
+  p_parent_artifact_id uuid,
+  p_child_artifact_id uuid,
+  p_relation_type text,
+  p_metadata jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  normalized_relation text := nullif(btrim(p_relation_type), '');
+  inserted_count integer;
+BEGIN
+  IF p_parent_artifact_id IS NULL OR p_child_artifact_id IS NULL
+     OR p_parent_artifact_id = p_child_artifact_id
+     OR normalized_relation IS NULL
+     OR normalized_relation !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$'
+     OR jsonb_typeof(p_metadata) IS DISTINCT FROM 'object' THEN
+    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_LINEAGE_INVALID' USING ERRCODE = '22023';
+  END IF;
+  IF EXISTS (
+    WITH RECURSIVE descendants(artifact_id) AS (
+      SELECT edge.child_artifact_id
+      FROM supacloud_artifacts.lineage edge
+      WHERE edge.parent_artifact_id = p_child_artifact_id
+      UNION
+      SELECT edge.child_artifact_id
+      FROM supacloud_artifacts.lineage edge
+      JOIN descendants current ON edge.parent_artifact_id = current.artifact_id
+    )
+    SELECT 1 FROM descendants WHERE artifact_id = p_parent_artifact_id
+  ) THEN
+    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_LINEAGE_CYCLE' USING ERRCODE = '23514';
+  END IF;
+  INSERT INTO supacloud_artifacts.lineage (
+    parent_artifact_id, child_artifact_id, relation_type, metadata
+  ) VALUES (
+    p_parent_artifact_id, p_child_artifact_id, normalized_relation, p_metadata
+  ) ON CONFLICT DO NOTHING;
+  GET DIAGNOSTICS inserted_count = ROW_COUNT;
+  IF inserted_count = 0 AND NOT EXISTS (
+    SELECT 1 FROM supacloud_artifacts.lineage
+    WHERE parent_artifact_id = p_parent_artifact_id
+      AND child_artifact_id = p_child_artifact_id
+      AND relation_type = normalized_relation
+      AND metadata = p_metadata
+  ) THEN
+    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_IDEMPOTENCY_CONFLICT' USING ERRCODE = '23505';
+  END IF;
+  RETURN supacloud_artifacts.snapshot(p_child_artifact_id, inserted_count = 0);
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION public.supacloud_artifact_register(request jsonb)
+RETURNS jsonb
+LANGUAGE sql VOLATILE SECURITY DEFINER SET search_path = '' AS $$
+  SELECT supacloud_artifacts.register(request)
+$$;
+
+CREATE OR REPLACE FUNCTION public.supacloud_artifact_get(request jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = '' AS $$
+BEGIN
+  RETURN supacloud_artifacts.snapshot((request ->> 'artifactId')::uuid, false);
+EXCEPTION
+  WHEN invalid_parameter_value OR invalid_text_representation THEN
+    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_GET_INVALID' USING ERRCODE = '22023';
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION public.supacloud_artifact_link(request jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$
+BEGIN
+  RETURN supacloud_artifacts.link(
+    (request ->> 'parentArtifactId')::uuid,
+    (request ->> 'childArtifactId')::uuid,
+    request ->> 'relationType',
+    coalesce(request -> 'metadata', '{}'::jsonb)
+  );
+EXCEPTION
+  WHEN invalid_parameter_value OR invalid_text_representation THEN
+    RAISE EXCEPTION 'SUPACLOUD_ARTIFACT_LINEAGE_INVALID' USING ERRCODE = '22023';
+END;
+$$;
+
+REVOKE ALL ON ALL TABLES IN SCHEMA supacloud_artifacts
+  FROM PUBLIC, anon, authenticated, service_role;
+REVOKE ALL ON ALL FUNCTIONS IN SCHEMA supacloud_artifacts
+  FROM PUBLIC, anon, authenticated, service_role;
+REVOKE ALL ON FUNCTION public.supacloud_artifact_register(jsonb) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.supacloud_artifact_get(jsonb) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.supacloud_artifact_link(jsonb) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.supacloud_artifact_register(jsonb) TO service_role;
+GRANT EXECUTE ON FUNCTION public.supacloud_artifact_get(jsonb) TO service_role;
+GRANT EXECUTE ON FUNCTION public.supacloud_artifact_link(jsonb) TO service_role;
+-- supacloud:sql-module:artifacts-public:end
 `;
 var CRON_SQL = `
 create schema if not exists cron;
@@ -10272,12 +10718,260 @@ async function serveBun(backend, opts = {}) {
 // src/runtime/node/native/engine.ts
 import { execFileSync, spawn, spawnSync } from "child_process";
 import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
-import { appendFileSync, chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync } from "fs";
+import { appendFileSync, chmodSync, existsSync as existsSync2, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync } from "fs";
 import { writeFile as writeFile2 } from "fs/promises";
 import { homedir, tmpdir } from "os";
 import { join as join2 } from "path";
 import { extract as extractTar } from "tar";
 
+// src/runtime/node/native/replication.ts
+import { existsSync, statSync, writeFileSync } from "fs";
+import { isIP } from "net";
+import { resolve as resolve2 } from "path";
+var POWERSYNC_REPLICATION_ROLE = "supacloud_powersync";
+var POWERSYNC_PUBLICATION = "powersync";
+function validatePowerSyncReplicationOptions(options) {
+  const host = options.host.trim();
+  validateConnectionInput(host, options.port, options.password);
+  const publicationTables = uniqueSorted(options.publicationTables.map(normalizeQualifiedTable));
+  const allowCidrs = uniqueSorted(options.allowCidrs.map(normalizeCidr));
+  validateAllowlists(publicationTables, allowCidrs);
+  validateNetworkBoundary(host, allowCidrs, Boolean(options.tls));
+  const tls = options.tls ? validateTlsOptions(options.tls) : undefined;
+  return { ...options, host, allowCidrs, publicationTables, tls };
+}
+function buildPowerSyncPostgresArgs(options, hbaFile) {
+  const validated = validatePowerSyncReplicationOptions(options);
+  const args = [
+    "-c",
+    `listen_addresses=${validated.host}`,
+    "-c",
+    `port=${validated.port}`,
+    "-c",
+    "wal_level=logical",
+    "-c",
+    "max_wal_senders=4",
+    "-c",
+    "max_replication_slots=4",
+    "-c",
+    "max_slot_wal_keep_size=1024MB",
+    "-c",
+    "wal_keep_size=64MB",
+    "-c",
+    `hba_file=${resolve2(hbaFile)}`
+  ];
+  if (!validated.tls)
+    return [...args, "-c", "ssl=off"];
+  args.push("-c", "ssl=on", "-c", `ssl_cert_file=${validated.tls.certFile}`, "-c", `ssl_key_file=${validated.tls.keyFile}`);
+  return args;
+}
+function writePowerSyncHba(path, options) {
+  const validated = validatePowerSyncReplicationOptions(options);
+  const hostRecord = validated.tls ? "hostssl" : "host";
+  const lines = [
+    "# Managed by SupaCloud Lite. Changes are replaced when the PowerSync profile starts.",
+    "local all postgres trust",
+    ...validated.allowCidrs.flatMap((cidr) => [
+      `${hostRecord} postgres ${POWERSYNC_REPLICATION_ROLE} ${cidr} scram-sha-256`,
+      `${hostRecord} replication ${POWERSYNC_REPLICATION_ROLE} ${cidr} scram-sha-256`
+    ]),
+    "host all all 0.0.0.0/0 reject",
+    "host all all ::/0 reject",
+    ""
+  ];
+  writeFileSync(path, lines.join(`
+`), { mode: 384 });
+}
+async function ensurePowerSyncReplicationCatalog(engine, options) {
+  const validated = validatePowerSyncReplicationOptions(options);
+  await engine.transaction(async (tx) => {
+    const tables = await inspectPublicationTables(tx, validated.publicationTables);
+    validatePublicationTables(tables);
+    await configureReplicationRole(tx, validated.password);
+    await synchronizeReplicationGrants(tx, tables);
+    await assertEffectiveSelectAllowlist(tx, tables);
+    await synchronizePublication(tx, tables);
+  });
+}
+function validatePublicationTables(tables) {
+  const missing = tables.filter((table) => !table.present).map((table) => table.name);
+  if (missing.length > 0) {
+    throw new Error(`PowerSync publication tables do not exist: ${missing.join(", ")}`);
+  }
+  const unsupported2 = tables.filter((table) => table.present && !["r", "p"].includes(table.relkind ?? ""));
+  if (unsupported2.length > 0) {
+    throw new Error(`PowerSync publication only accepts ordinary or partitioned tables: ${unsupported2.map((table) => table.name).join(", ")}`);
+  }
+}
+async function configureReplicationRole(tx, passwordValue) {
+  await tx.exec(`
+    DO $profile$
+    BEGIN
+      IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${POWERSYNC_REPLICATION_ROLE}') THEN
+        CREATE ROLE ${POWERSYNC_REPLICATION_ROLE};
+      END IF;
+    END
+    $profile$;
+    ALTER ROLE ${POWERSYNC_REPLICATION_ROLE}
+      WITH LOGIN NOINHERIT REPLICATION BYPASSRLS CONNECTION LIMIT 4 PASSWORD ${quoteLiteral2(passwordValue)};
+    ALTER ROLE ${POWERSYNC_REPLICATION_ROLE} SET search_path = pg_catalog;
+    GRANT CONNECT ON DATABASE postgres TO ${POWERSYNC_REPLICATION_ROLE};
+  `);
+}
+async function synchronizeReplicationGrants(tx, tables) {
+  await revokeReplicationGrants(tx);
+  await grantReplicationAllowlist(tx, tables);
+}
+async function revokeReplicationGrants(tx) {
+  const staleGrants = await tx.query(`
+    SELECT DISTINCT table_schema, table_name
+    FROM information_schema.role_table_grants
+    WHERE grantee = '${POWERSYNC_REPLICATION_ROLE}' AND privilege_type = 'SELECT'
+  `);
+  for (const grant of staleGrants.rows) {
+    await tx.exec(`REVOKE SELECT ON TABLE ${quoteIdentifier(grant.table_schema)}.${quoteIdentifier(grant.table_name)} ` + `FROM ${POWERSYNC_REPLICATION_ROLE}`);
+  }
+  const applicationSchemas = await tx.query(`
+    SELECT nspname AS schema_name
+    FROM pg_namespace
+    WHERE nspname NOT IN ('pg_catalog', 'information_schema')
+      AND nspname !~ '^pg_toast'
+  `);
+  for (const schema of applicationSchemas.rows) {
+    await tx.exec(`REVOKE USAGE ON SCHEMA ${quoteIdentifier(schema.schema_name)} FROM ${POWERSYNC_REPLICATION_ROLE}`);
+  }
+}
+async function grantReplicationAllowlist(tx, tables) {
+  const schemas = uniqueSorted(tables.map((table) => table.schema));
+  for (const schema of schemas) {
+    await tx.exec(`GRANT USAGE ON SCHEMA ${quoteIdentifier(schema)} TO ${POWERSYNC_REPLICATION_ROLE}`);
+  }
+  for (const table of tables) {
+    await tx.exec(`GRANT SELECT ON TABLE ${quoteQualifiedTable(table.name)} TO ${POWERSYNC_REPLICATION_ROLE}`);
+  }
+}
+async function assertEffectiveSelectAllowlist(tx, tables) {
+  const allowed = new Set(tables.map((table) => table.name));
+  const selectable = await tx.query(`
+    SELECT namespace.nspname || '.' || relation.relname AS qualified_name
+    FROM pg_class relation
+    JOIN pg_namespace namespace ON namespace.oid = relation.relnamespace
+    WHERE relation.relkind IN ('r', 'p')
+      AND namespace.nspname NOT IN ('pg_catalog', 'information_schema')
+      AND namespace.nspname !~ '^pg_toast'
+      AND has_table_privilege('${POWERSYNC_REPLICATION_ROLE}', relation.oid, 'SELECT')
+    ORDER BY namespace.nspname, relation.relname
+  `);
+  const outsideAllowlist = selectable.rows.map((row) => row.qualified_name).filter((table) => !allowed.has(table));
+  if (outsideAllowlist.length > 0) {
+    throw new Error(`PowerSync role has SELECT outside the publication allowlist: ${outsideAllowlist.join(", ")}`);
+  }
+}
+async function synchronizePublication(tx, tables) {
+  const publication = await tx.query(`SELECT puballtables FROM pg_publication WHERE pubname = '${POWERSYNC_PUBLICATION}'`);
+  if (publication.rows[0]?.puballtables) {
+    throw new Error("existing powersync publication uses FOR ALL TABLES; replace it with an explicit allowlist");
+  }
+  if (publication.rows.length === 0) {
+    await tx.exec(`CREATE PUBLICATION ${POWERSYNC_PUBLICATION} WITH (publish = 'insert, update, delete')`);
+  }
+  await tx.exec(`ALTER PUBLICATION ${POWERSYNC_PUBLICATION} SET TABLE ${tables.map((table) => quoteQualifiedTable(table.name)).join(", ")}; ` + `ALTER PUBLICATION ${POWERSYNC_PUBLICATION} SET (publish = 'insert, update, delete')`);
+}
+async function inspectPublicationTables(tx, names) {
+  const rows = [];
+  for (const name of names) {
+    const tableLookup = await tx.query(`
+      SELECT namespace.nspname AS schema_name, relation.relkind
+      FROM pg_class relation
+      JOIN pg_namespace namespace ON namespace.oid = relation.relnamespace
+      WHERE relation.oid = to_regclass($1)
+    `, [name]);
+    const row = tableLookup.rows[0];
+    rows.push({ name, schema: row?.schema_name, relkind: row?.relkind, present: Boolean(row) });
+  }
+  return rows;
+}
+function validateConnectionInput(host, port, password) {
+  if (!host || host !== "localhost" && isIP(host) === 0) {
+    throw new Error("PowerSync replication host must be localhost or an explicit IP address");
+  }
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error("PowerSync replication port must be between 1 and 65535");
+  }
+  if (password.length < 32) {
+    throw new Error("SUPACLOUD_LITE_POWERSYNC_PASSWORD must contain at least 32 characters");
+  }
+  if (password.includes("\x00"))
+    throw new Error("SUPACLOUD_LITE_POWERSYNC_PASSWORD must not contain NUL bytes");
+}
+function validateAllowlists(publicationTables, allowCidrs) {
+  if (publicationTables.length === 0) {
+    throw new Error("PowerSync replication requires an explicit publication table allowlist");
+  }
+  if (allowCidrs.length === 0)
+    throw new Error("PowerSync replication requires at least one client CIDR");
+}
+function validateNetworkBoundary(host, allowCidrs, tls) {
+  if (!isLoopbackHost(host) && !tls) {
+    throw new Error("non-loopback PowerSync replication requires TLS certificate and key files");
+  }
+  if (!tls && allowCidrs.some((cidr) => !isLoopbackCidr(cidr))) {
+    throw new Error("non-loopback PowerSync client CIDRs require TLS");
+  }
+}
+function validateTlsOptions(options) {
+  const tls = {
+    certFile: resolve2(options.certFile),
+    keyFile: resolve2(options.keyFile)
+  };
+  for (const path of [tls.certFile, tls.keyFile]) {
+    if (!existsSync(path) || !statSync(path).isFile())
+      throw new Error(`PowerSync TLS file does not exist: ${path}`);
+  }
+  if (process.platform !== "win32" && (statSync(tls.keyFile).mode & 63) !== 0) {
+    throw new Error("PowerSync TLS private key must not be readable by group or other users");
+  }
+  return tls;
+}
+function normalizeQualifiedTable(tableName) {
+  const normalized = tableName.trim().toLowerCase();
+  if (!/^[a-z_][a-z0-9_]*\.[a-z_][a-z0-9_]*$/.test(normalized)) {
+    throw new Error(`invalid PowerSync publication table: ${tableName}`);
+  }
+  return normalized;
+}
+function normalizeCidr(cidr) {
+  const normalized = cidr.trim();
+  const match = /^(.+)\/(\d{1,3})$/.exec(normalized);
+  if (!match)
+    throw new Error(`invalid PowerSync client CIDR: ${cidr}`);
+  const address = match[1];
+  const family = isIP(address);
+  const prefix = Number(match[2]);
+  if (family === 0 || prefix < 0 || prefix > (family === 4 ? 32 : 128)) {
+    throw new Error(`invalid PowerSync client CIDR: ${cidr}`);
+  }
+  return `${address}/${prefix}`;
+}
+function isLoopbackHost(host) {
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+function isLoopbackCidr(cidr) {
+  return cidr === "127.0.0.1/32" || cidr === "::1/128";
+}
+function quoteIdentifier(identifier) {
+  return `"${identifier.replaceAll('"', '""')}"`;
+}
+function quoteQualifiedTable(tableName) {
+  return tableName.split(".").map(quoteIdentifier).join(".");
+}
+function quoteLiteral2(literal) {
+  return `'${literal.replaceAll("'", "''")}'`;
+}
+function uniqueSorted(values) {
+  return [...new Set(values)].sort();
+}
+
 // src/runtime/node/native/wire.ts
 import { createConnection } from "net";
 import { createHash, createHmac, pbkdf2Sync, randomBytes } from "crypto";
@@ -10309,7 +11003,7 @@ class PgWireClient {
     return client;
   }
   open(opts) {
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       this.socket = opts.socketPath ? createConnection(opts.socketPath) : createConnection(opts.port ?? 5432, opts.host ?? "127.0.0.1");
       this.socket.on("error", (e) => {
         if (this.pending)
@@ -10407,7 +11101,7 @@ class PgWireClient {
               this.buffer = Buffer.concat([this.buffer, c]);
               this.processMessages();
             });
-            resolve2();
+            resolve3();
             return;
           }
         }
@@ -10416,10 +11110,10 @@ class PgWireClient {
     });
   }
   run(send) {
-    const op = this.queue.then(() => new Promise((resolve2, reject) => {
+    const op = this.queue.then(() => new Promise((resolve3, reject) => {
       if (this.closed)
         return reject(new Error("connection closed"));
-      this.pending = { resolve: resolve2, reject, results: [], columns: [], error: null };
+      this.pending = { resolve: resolve3, reject, results: [], columns: [], error: null };
       send();
     }));
     this.queue = op.catch(() => {});
@@ -10450,11 +11144,11 @@ class PgWireClient {
     return results[0] ?? { rows: [] };
   }
   close() {
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       if (this.closed)
-        return resolve2();
+        return resolve3();
       this.socket.write(message(88, Buffer.alloc(0)));
-      this.socket.end(() => resolve2());
+      this.socket.end(() => resolve3());
     });
   }
   nextMessage() {
@@ -10843,7 +11537,7 @@ function reportedGlibcVersion() {
 }
 function glibcDynamicLoaderPresent() {
   const loaderPaths = process.arch === "x64" ? GLIBC_DYNAMIC_LOADERS.x64 : process.arch === "arm64" ? GLIBC_DYNAMIC_LOADERS.arm64 : [];
-  return loaderPaths.some((loaderPath) => existsSync(loaderPath));
+  return loaderPaths.some((loaderPath) => existsSync2(loaderPath));
 }
 function lddVersion() {
   const command = spawnSync("ldd", ["--version"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
@@ -10863,7 +11557,7 @@ function target() {
   throw new Error(`unsupported platform for native engine: ${process.platform} (use the default PGlite engine)`);
 }
 function isCompleteInstall(dir) {
-  return existsSync(join2(dir, "bin", "postgres")) && existsSync(join2(dir, "share", "postgres.bki"));
+  return existsSync2(join2(dir, "bin", "postgres")) && existsSync2(join2(dir, "share", "postgres.bki"));
 }
 var PINNED_SHA256 = {
   "postgresql-17.7.0-x86_64-unknown-linux-gnu": "66ad03281a43624f955c8e16ac975cb0ab751e7edf8ba35308e3b08dd7d065c3",
@@ -10969,7 +11663,7 @@ async function fetchRelease(url) {
       lastError = error;
     }
     if (attempt < 3)
-      await new Promise((resolve2) => setTimeout(resolve2, attempt * 500));
+      await new Promise((resolve3) => setTimeout(resolve3, attempt * 500));
   }
   throw lastError instanceof Error ? lastError : new Error(`failed to download ${url}`);
 }
@@ -10981,6 +11675,7 @@ dynamic_shared_memory_type = posix
 max_connections = 10
 wal_level = minimal
 max_wal_senders = 0
+max_replication_slots = 0
 logging_collector = off
 `;
 async function createNativeEngine(opts) {
@@ -10991,7 +11686,7 @@ async function createNativeEngine(opts) {
   try {
     const installDir = await ensurePostgres(opts.version, opts.cacheDir, opts.log, opts.downloadMirror);
     const bin = (name) => join2(installDir, "bin", name);
-    if (!existsSync(join2(opts.dataDir, "PG_VERSION"))) {
+    if (!existsSync2(join2(opts.dataDir, "PG_VERSION"))) {
       mkdirSync(opts.dataDir, { recursive: true });
       try {
         execFileSync(bin("initdb"), ["-U", "postgres", "-A", "trust", "-E", "UTF8", "-D", opts.dataDir], {
@@ -11007,7 +11702,20 @@ ${stderr || error.message}`);
     removeStalePidFile(join2(opts.dataDir, "postmaster.pid"));
     socketDirectory = mkdtempSync(join2(tmpdir(), "scl-"));
     chmodSync(socketDirectory, 448);
-    postgres = spawn(bin("postgres"), ["-D", opts.dataDir, "-k", socketDirectory, "-c", "timezone=UTC"], {
+    const replicationHba = opts.replication ? join2(opts.dataDir, "supacloud-powersync-hba.conf") : undefined;
+    if (opts.replication && replicationHba)
+      writePowerSyncHba(replicationHba, opts.replication);
+    const replicationArgs = opts.replication && replicationHba ? buildPowerSyncPostgresArgs(opts.replication, replicationHba) : [
+      "-c",
+      "listen_addresses=",
+      "-c",
+      "wal_level=minimal",
+      "-c",
+      "max_wal_senders=0",
+      "-c",
+      "max_replication_slots=0"
+    ];
+    postgres = spawn(bin("postgres"), ["-D", opts.dataDir, "-k", socketDirectory, "-c", "timezone=UTC", ...replicationArgs], {
       stdio: ["ignore", "ignore", "pipe"],
       detached: false
     });
@@ -11023,7 +11731,8 @@ ${stderr || error.message}`);
     };
     process.once("exit", killPostgres);
     removeExitHandler = () => process.off("exit", killPostgres);
-    const socketPath = join2(socketDirectory, ".s.PGSQL.5432");
+    const postgresPort = opts.replication?.port ?? 5432;
+    const socketPath = join2(socketDirectory, `.s.PGSQL.${postgresPort}`);
     const connect = async () => {
       const deadline = Date.now() + 20000;
       while (Date.now() <= deadline) {
@@ -11038,7 +11747,7 @@ ${detail}` : " (no output)"}
 ` + `data dir: ${opts.dataDir}
 ` + "If a previous run is still holding it, stop it; or delete the data dir to start fresh.");
           }
-          await new Promise((resolve2) => setTimeout(resolve2, 150));
+          await new Promise((resolve3) => setTimeout(resolve3, 150));
         }
       }
       throw new Error(`timed out waiting for embedded postgres at ${socketPath}`);
@@ -11066,19 +11775,19 @@ async function stopPostgres(postgres, hasExited) {
   if (hasExited())
     return;
   postgres.kill("SIGINT");
-  await new Promise((resolve2) => {
+  await new Promise((resolve3) => {
     const killTimeout = setTimeout(() => {
       postgres.kill("SIGKILL");
-      resolve2();
+      resolve3();
     }, 5000);
     postgres.once("exit", () => {
       clearTimeout(killTimeout);
-      resolve2();
+      resolve3();
     });
   });
 }
 function removeStalePidFile(pidPath) {
-  if (!existsSync(pidPath))
+  if (!existsSync2(pidPath))
     return;
   try {
     const pid = Number.parseInt(readFileSync(pidPath, "utf8").split(`
@@ -11094,9 +11803,238 @@ function removeStalePidFile(pidPath) {
     }
   } catch {}
 }
+// src/runtime/node/native/readiness.ts
+function liteCapabilities(engine, replicationProfile) {
+  if (engine === "pglite") {
+    return {
+      engine,
+      state_machine_sql: "supported",
+      durable_workflows: "supported",
+      commands: "supported",
+      artifacts: "supported",
+      postgrest_schema_config: "static",
+      logical_replication: "unsupported",
+      powersync_source: "unsupported"
+    };
+  }
+  return {
+    engine,
+    state_machine_sql: "supported",
+    durable_workflows: "supported",
+    commands: "supported",
+    artifacts: "supported",
+    postgrest_schema_config: "static",
+    logical_replication: replicationProfile ? "supported" : "disabled",
+    powersync_source: replicationProfile ? "supported" : "disabled",
+    ...replicationProfile ? { replication_profile: replicationProfile } : {}
+  };
+}
+async function inspectPowerSyncReadiness(engine, options) {
+  return buildReadiness(await loadReplicationInventory(engine), options);
+}
+async function loadReplicationInventory(engine) {
+  const [settings, senders, role, publication, publicationTables, selectableTables, slots] = await Promise.all([
+    engine.query(`
+      SELECT name, setting
+      FROM pg_settings
+      WHERE name IN (
+        'wal_level', 'max_wal_senders', 'max_replication_slots',
+        'max_slot_wal_keep_size', 'ssl', 'listen_addresses', 'port'
+      )
+    `),
+    engine.query("SELECT count(*)::integer AS count FROM pg_stat_replication"),
+    engine.query(`
+      SELECT rolcanlogin, rolreplication, rolbypassrls
+      FROM pg_roles WHERE rolname = '${POWERSYNC_REPLICATION_ROLE}'
+    `),
+    engine.query(`
+      SELECT puballtables, pubinsert, pubupdate, pubdelete
+      FROM pg_publication WHERE pubname = '${POWERSYNC_PUBLICATION}'
+    `),
+    engine.query(`
+      SELECT
+        quote_ident(namespace.nspname) || '.' || quote_ident(relation.relname) AS qualified_name,
+        relation.relreplident = 'n' OR (
+          relation.relreplident = 'd'
+          AND NOT EXISTS (
+            SELECT 1 FROM pg_index index_record
+            WHERE index_record.indrelid = relation.oid AND index_record.indisprimary
+          )
+        ) AS replica_identity_missing
+      FROM pg_publication_tables published
+      JOIN pg_namespace namespace ON namespace.nspname = published.schemaname
+      JOIN pg_class relation
+        ON relation.relnamespace = namespace.oid AND relation.relname = published.tablename
+      WHERE published.pubname = '${POWERSYNC_PUBLICATION}'
+      ORDER BY namespace.nspname, relation.relname
+    `),
+    engine.query(`
+      SELECT namespace.nspname || '.' || relation.relname AS qualified_name
+      FROM pg_roles role_record
+      JOIN pg_class relation ON true
+      JOIN pg_namespace namespace ON namespace.oid = relation.relnamespace
+      WHERE role_record.rolname = '${POWERSYNC_REPLICATION_ROLE}'
+        AND relation.relkind IN ('r', 'p')
+        AND namespace.nspname NOT IN ('pg_catalog', 'information_schema')
+        AND namespace.nspname !~ '^pg_toast'
+        AND has_table_privilege(role_record.oid, relation.oid, 'SELECT')
+      ORDER BY namespace.nspname, relation.relname
+    `),
+    engine.query(`
+      SELECT
+        slot_name,
+        active,
+        wal_status,
+        coalesce(pg_wal_lsn_diff(pg_current_wal_lsn(), restart_lsn), 0)::text AS retained_wal_bytes,
+        coalesce(pg_wal_lsn_diff(pg_current_wal_lsn(), confirmed_flush_lsn), 0)::text AS unconfirmed_wal_bytes,
+        safe_wal_size::text,
+        invalidation_reason
+      FROM pg_replication_slots
+      WHERE slot_type = 'logical'
+      ORDER BY slot_name
+    `)
+  ]);
+  return {
+    settings: new Map(settings.rows.map((row) => [row.name, row.setting])),
+    activeSenders: senders.rows[0]?.count ?? 0,
+    role: role.rows[0],
+    publication: publication.rows[0],
+    publicationTables: publicationTables.rows,
+    selectableTables: selectableTables.rows.map((row) => row.qualified_name),
+    slots: slots.rows
+  };
+}
+function buildReadiness(inventory, options) {
+  const actualTables = catalogTableNames(inventory.publicationTables);
+  const expectedTables = [...options.publicationTables].sort();
+  const missingIdentity = missingReplicaIdentity(inventory.publicationTables);
+  const blockers = readinessBlockers(inventory, actualTables, expectedTables, missingIdentity);
+  return {
+    ready: blockers.length === 0,
+    blockers,
+    warnings: readinessWarnings(inventory),
+    connection: {
+      host: options.host,
+      port: options.port,
+      tls: Boolean(options.tls),
+      allowed_cidrs: options.allowCidrs
+    },
+    wal: {
+      level: inventory.settings.get("wal_level") ?? "unknown",
+      max_senders: integerSetting(inventory.settings.get("max_wal_senders")),
+      active_senders: inventory.activeSenders,
+      max_replication_slots: integerSetting(inventory.settings.get("max_replication_slots")),
+      used_replication_slots: inventory.slots.length,
+      max_slot_wal_keep_size: inventory.settings.get("max_slot_wal_keep_size") ?? "unknown"
+    },
+    role: roleReadiness(inventory.role, unexpectedSelectableTables(inventory, expectedTables)),
+    publication: publicationReadiness(inventory.publication, actualTables, expectedTables, missingIdentity),
+    slots: inventory.slots.map((slot) => ({
+      name: slot.slot_name,
+      active: slot.active,
+      wal_status: slot.wal_status,
+      retained_wal_bytes: slot.retained_wal_bytes,
+      unconfirmed_wal_bytes: slot.unconfirmed_wal_bytes,
+      safe_wal_size: slot.safe_wal_size,
+      invalidation_reason: slot.invalidation_reason
+    }))
+  };
+}
+function readinessBlockers(inventory, actualTables, expectedTables, missingIdentity) {
+  const blockers = capacityBlockers(inventory);
+  if (!roleIsReady(inventory.role))
+    blockers.push("POWERSYNC_ROLE_NOT_READY");
+  if (unexpectedSelectableTables(inventory, expectedTables).length > 0) {
+    blockers.push("POWERSYNC_ROLE_SELECT_OUTSIDE_ALLOWLIST");
+  }
+  blockers.push(...publicationBlockers(inventory.publication, actualTables, expectedTables, missingIdentity));
+  return blockers;
+}
+function capacityBlockers(inventory) {
+  const blockers = [];
+  const maxSenders = integerSetting(inventory.settings.get("max_wal_senders"));
+  const maxSlots = integerSetting(inventory.settings.get("max_replication_slots"));
+  if (inventory.settings.get("wal_level") !== "logical")
+    blockers.push("WAL_LEVEL_NOT_LOGICAL");
+  if (maxSenders - inventory.activeSenders < 1)
+    blockers.push("NO_FREE_WAL_SENDER");
+  if (maxSlots - inventory.slots.length < 1)
+    blockers.push("NO_FREE_REPLICATION_SLOT");
+  return blockers;
+}
+function publicationBlockers(publication, actualTables, expectedTables, missingIdentity) {
+  if (!publication)
+    return ["POWERSYNC_PUBLICATION_MISSING"];
+  const blockers = [];
+  if (publication.puballtables)
+    blockers.push("POWERSYNC_PUBLICATION_NOT_ALLOWLISTED");
+  if (!publication.pubinsert || !publication.pubupdate || !publication.pubdelete) {
+    blockers.push("POWERSYNC_PUBLICATION_DML_INCOMPLETE");
+  }
+  if (!sameStrings(actualTables, expectedTables))
+    blockers.push("POWERSYNC_PUBLICATION_TABLE_MISMATCH");
+  if (missingIdentity.length > 0)
+    blockers.push("POWERSYNC_REPLICA_IDENTITY_INCOMPLETE");
+  return blockers;
+}
+function readinessWarnings(inventory) {
+  const warnings = [];
+  if (inventory.settings.get("max_slot_wal_keep_size") === "-1")
+    warnings.push("SLOT_WAL_KEEP_SIZE_UNBOUNDED");
+  if (inventory.slots.some((slot) => slot.wal_status === "lost" || slot.invalidation_reason)) {
+    warnings.push("INVALID_LOGICAL_SLOTS");
+  }
+  return warnings;
+}
+function roleIsReady(role) {
+  return Boolean(role?.rolcanlogin && role.rolreplication && role.rolbypassrls);
+}
+function roleReadiness(role, unexpectedTables) {
+  return {
+    name: POWERSYNC_REPLICATION_ROLE,
+    present: Boolean(role),
+    login: role?.rolcanlogin ?? false,
+    replication: role?.rolreplication ?? false,
+    bypass_rls: role?.rolbypassrls ?? false,
+    unexpected_selectable_tables: unexpectedTables
+  };
+}
+function unexpectedSelectableTables(inventory, expectedTables) {
+  const expected = new Set(expectedTables);
+  return inventory.selectableTables.filter((table) => !expected.has(table));
+}
+function publicationReadiness(publication, tables, expectedTables, missingIdentity) {
+  return {
+    name: POWERSYNC_PUBLICATION,
+    present: Boolean(publication),
+    all_tables: publication?.puballtables ?? false,
+    tables,
+    expected_tables: expectedTables,
+    publishes_insert: publication?.pubinsert ?? false,
+    publishes_update: publication?.pubupdate ?? false,
+    publishes_delete: publication?.pubdelete ?? false,
+    replica_identity_missing_tables: missingIdentity
+  };
+}
+function catalogTableNames(rows) {
+  return rows.map((row) => normalizeCatalogTable(row.qualified_name));
+}
+function missingReplicaIdentity(rows) {
+  return rows.filter((row) => row.replica_identity_missing).map((row) => normalizeCatalogTable(row.qualified_name));
+}
+function integerSetting(value) {
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : 0;
+}
+function normalizeCatalogTable(value) {
+  return value.replaceAll('"', "").toLowerCase();
+}
+function sameStrings(left, right) {
+  return left.length === right.length && left.every((value, index) => value === right[index]);
+}
 // src/project-runtime.ts
 import { chmod, link, lstat, mkdir as mkdir4, readFile as readFile6, realpath as realpath2, unlink as unlink2, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname4, isAbsolute, join as join7, parse, relative, resolve as resolve2 } from "path";
+import { dirname as dirname4, isAbsolute, join as join7, parse, relative, resolve as resolve3 } from "path";
 
 // src/runtime/node/config-toml.ts
 import { readFileSync as readFileSync2 } from "fs";
@@ -11479,7 +12417,7 @@ import { pathToFileURL } from "url";
 // src/runtime/node/bundle-function.ts
 import { createHash as createHash3 } from "crypto";
 import { mkdir as mkdir3, readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { join as join4 } from "path";
 function rewriteRemoteSpecifier(spec) {
@@ -11493,7 +12431,7 @@ var HTTP_CACHE = join4(tmpdir2(), "supacloud-lite-fn-http");
 async function fetchModule(url) {
   const key = createHash3("sha256").update(url).digest("hex");
   const cached = join4(HTTP_CACHE, key);
-  if (existsSync2(cached))
+  if (existsSync3(cached))
     return readFile3(cached, "utf8");
   const res = await fetch(url, { redirect: "follow" });
   if (!res.ok)
@@ -11700,7 +12638,7 @@ function isNotFound(error) {
 
 // src/project-runtime.ts
 function resolveProjectPaths(options = {}) {
-  const projectDir = resolve2(options.projectDir ?? process.cwd());
+  const projectDir = resolve3(options.projectDir ?? process.cwd());
   const stateDir = resolvePath(projectDir, options.stateDir ?? process.env.SUPACLOUD_LITE_STATE_DIR ?? ".supacloud-lite");
   const databaseEngine = resolveDatabaseEngine(options.engine, options.memory);
   const dataDir = options.memory ? undefined : resolvePath(projectDir, options.dataDir ?? process.env.SUPACLOUD_LITE_DATA_DIR ?? join7(stateDir, databaseEngine === "native" ? "pgdata" : "db"));
@@ -11776,6 +12714,7 @@ async function createProjectBackend(options = {}) {
   const configuredStorageBackend = options.storageDriver ? "fs" : resolveStorageBackend(options.storageBackend);
   const storageBackend = options.storageDriver ? "custom" : configuredStorageBackend;
   const databaseEngine = paths.databaseEngine;
+  const replication = resolveNativeReplicationOptions(options, databaseEngine);
   if (paths.dataDir) {
     await mkdir4(paths.dataDir, { recursive: true, mode: 448 });
     await chmod(paths.dataDir, 448);
@@ -11783,7 +12722,7 @@ async function createProjectBackend(options = {}) {
   await mkdir4(paths.storageDir, { recursive: true, mode: 448 });
   await chmod(paths.storageDir, 448);
   const storageDriver = options.storageDriver ?? createStorageDriver(configuredStorageBackend, paths.storageDir, options.s3);
-  const engine = databaseEngine === "native" ? await createNativeEngine({ dataDir: paths.dataDir, log: options.log }) : undefined;
+  const engine = databaseEngine === "native" ? await createNativeEngine({ dataDir: paths.dataDir, log: options.log, replication }) : undefined;
   let backend;
   try {
     backend = await createBackend({
@@ -11817,8 +12756,17 @@ async function createProjectBackend(options = {}) {
       storageDriver,
       log: options.log
     });
+    if (replication && options.applyMigrations !== false) {
+      await ensurePowerSyncReplicationCatalog(backend.db.engine, replication);
+    }
   } catch (error) {
-    if (engine) {
+    if (backend) {
+      try {
+        await backend.close();
+      } catch (cleanupError) {
+        throw new AggregateError([error, cleanupError], "project database startup cleanup failed");
+      }
+    } else if (engine) {
       try {
         await engine.close();
       } catch (cleanupError) {
@@ -11838,9 +12786,33 @@ async function createProjectBackend(options = {}) {
     functionNames: [...functions.keys()],
     webhookCount: webhooks.length,
     storageBackend,
-    databaseEngine
+    databaseEngine,
+    replicationProfile: replication?.profile
   };
 }
+function resolveNativeReplicationOptions(options, databaseEngine = resolveDatabaseEngine(options.engine, options.memory)) {
+  const profile = options.replicationProfile ?? process.env.SUPACLOUD_LITE_REPLICATION_PROFILE;
+  if (!profile)
+    return;
+  if (profile !== "powersync")
+    throw new Error(`unsupported SUPACLOUD_LITE_REPLICATION_PROFILE: ${profile}`);
+  if (databaseEngine !== "native")
+    throw new Error("PowerSync replication is only supported by --engine native");
+  const tlsCertFile = options.replicationTlsCertFile ?? process.env.SUPACLOUD_LITE_REPLICATION_TLS_CERT_FILE;
+  const tlsKeyFile = options.replicationTlsKeyFile ?? process.env.SUPACLOUD_LITE_REPLICATION_TLS_KEY_FILE;
+  if (Boolean(tlsCertFile) !== Boolean(tlsKeyFile)) {
+    throw new Error("PowerSync replication TLS requires both certificate and key files");
+  }
+  return validatePowerSyncReplicationOptions({
+    profile,
+    host: options.replicationHost ?? process.env.SUPACLOUD_LITE_REPLICATION_HOST ?? "127.0.0.1",
+    port: options.replicationPort ?? parsePort(process.env.SUPACLOUD_LITE_REPLICATION_PORT, 54322),
+    allowCidrs: options.replicationAllowCidrs ?? commaSeparated(process.env.SUPACLOUD_LITE_REPLICATION_ALLOW_CIDRS, ["127.0.0.1/32", "::1/128"]),
+    publicationTables: options.powersyncPublicationTables ?? commaSeparated(process.env.SUPACLOUD_LITE_POWERSYNC_TABLES),
+    password: options.powersyncPassword ?? process.env.SUPACLOUD_LITE_POWERSYNC_PASSWORD ?? "",
+    tls: tlsCertFile && tlsKeyFile ? { certFile: tlsCertFile, keyFile: tlsKeyFile } : undefined
+  });
+}
 function resolveDatabaseEngine(value, memory = false) {
   const configured = value ?? process.env.SUPACLOUD_LITE_ENGINE ?? "pglite";
   if (configured !== "pglite" && configured !== "native") {
@@ -11916,7 +12888,7 @@ async function loadWebhooks(projectDir) {
   }
 }
 function resolvePath(projectDir, path) {
-  return isAbsolute(path) ? path : resolve2(projectDir, path);
+  return isAbsolute(path) ? path : resolve3(projectDir, path);
 }
 function randomHex(bytes) {
   const value = crypto.getRandomValues(new Uint8Array(bytes));
@@ -11943,6 +12915,9 @@ function parsePort(value, fallback) {
     throw new Error(`invalid port: ${value}`);
   return port;
 }
+function commaSeparated(value, fallback = []) {
+  return value === undefined ? fallback : value.split(",").map((entry) => entry.trim()).filter(Boolean);
+}
 function displayHost(host) {
   if (host === "0.0.0.0" || host === "::")
     return "127.0.0.1";
@@ -11958,7 +12933,7 @@ async function findEphemeralPort(host = "127.0.0.1") {
 }
 // src/snapshot.ts
 import { chmod as chmod2, copyFile, lstat as lstat2, mkdir as mkdir5, mkdtemp, readdir as readdir3, readFile as readFile7, rename as rename2, rm as rm4, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname5, join as join8, parse as parse2, relative as relative2, resolve as resolve3, sep as sep2 } from "path";
+import { dirname as dirname5, join as join8, parse as parse2, relative as relative2, resolve as resolve4, sep as sep2 } from "path";
 import { create as createTar, extract as extractTar2 } from "tar";
 var SNAPSHOT_FORMAT = "supacloud-lite-snapshot";
 var SNAPSHOT_VERSION = 1;
@@ -11982,7 +12957,7 @@ async function createSnapshot(options) {
       postgresMajor: await readPostgresMajor(paths.dataDir)
     } : {}
   };
-  const output = resolve3(options.output);
+  const output = resolve4(options.output);
   if (await existingInfo(output))
     throw new Error(`snapshot output already exists: ${output}`);
   await mkdir5(dirname5(output), { recursive: true });
@@ -12023,7 +12998,7 @@ async function restoreSnapshot(options) {
     await mkdir5(payloadRoot, { recursive: true });
     await extractTar2({
       cwd: payloadRoot,
-      file: resolve3(options.input),
+      file: resolve4(options.input),
       preserveOwner: false,
       preservePaths: false,
       strict: true,
@@ -12100,11 +13075,11 @@ async function restoreSnapshot(options) {
 function normalizePaths(paths) {
   return {
     ...paths,
-    projectDir: resolve3(paths.projectDir),
-    stateDir: resolve3(paths.stateDir),
-    dataDir: paths.dataDir ? resolve3(paths.dataDir) : undefined,
-    storageDir: resolve3(paths.storageDir),
-    secretsFile: resolve3(paths.secretsFile)
+    projectDir: resolve4(paths.projectDir),
+    stateDir: resolve4(paths.stateDir),
+    dataDir: paths.dataDir ? resolve4(paths.dataDir) : undefined,
+    storageDir: resolve4(paths.storageDir),
+    secretsFile: resolve4(paths.secretsFile)
   };
 }
 async function assertSnapshotPaths(paths, options = {}) {
@@ -12134,7 +13109,7 @@ async function assertSnapshotPaths(paths, options = {}) {
 async function assertDirectoryOrMissing(path) {
   if (!path)
     return;
-  if (resolve3(path) === parse2(resolve3(path)).root)
+  if (resolve4(path) === parse2(resolve4(path)).root)
     throw new Error(`snapshot path must not be the filesystem root: ${path}`);
   try {
     const info = await lstat2(path);
@@ -12356,29 +13331,35 @@ async function assertNoSymlinks(root) {
   }
 }
 function isWithin(parent, child) {
-  const normalizedParent = resolve3(parent);
-  const normalizedChild = resolve3(child);
+  const normalizedParent = resolve4(parent);
+  const normalizedChild = resolve4(child);
   return normalizedChild !== normalizedParent && normalizedChild.startsWith(`${normalizedParent}${sep2}`);
 }
 function pathsOverlap(left, right) {
-  const normalizedLeft = resolve3(left);
-  const normalizedRight = resolve3(right);
+  const normalizedLeft = resolve4(left);
+  const normalizedRight = resolve4(right);
   return normalizedLeft === normalizedRight || isWithin(normalizedLeft, normalizedRight) || isWithin(normalizedRight, normalizedLeft);
 }
 export {
+  writePowerSyncHba,
   verifyJwt,
+  validatePowerSyncReplicationOptions,
   startProjectServer,
   signJwt,
   serveBun,
   restoreSnapshot,
   resolveStorageBackend,
   resolveProjectPaths,
+  resolveNativeReplicationOptions,
   resolveDatabaseEngine,
   mintProjectKeys,
+  liteCapabilities,
   isNativeEngineSupported,
+  inspectPowerSyncReadiness,
   inspectDb,
   generateTypes,
   ensureProjectSecrets,
+  ensurePowerSyncReplicationCatalog,
   ensurePostgres,
   decodeJwt,
   createSnapshot,
@@ -12386,8 +13367,11 @@ export {
   createPgliteEngine,
   createNativeEngine,
   createBackend as createLiteBackend,
+  buildPowerSyncPostgresArgs,
   SUPACLOUD_LITE_VERSION,
   S3StorageDriver,
+  POWERSYNC_REPLICATION_ROLE,
+  POWERSYNC_PUBLICATION,
   MemoryStorageDriver,
   FsStorageDriver
 };