Do I need ArcGIS Enterprise (Server)?
No. agol_fdw talks directly to ArcGIS Online hosted feature services over the GeoServices REST API. The auth provider is pluggable, so Enterprise/on-prem auth can be added later, but AGOL Online works out of the box.
Is it read/write?
Both. Materialized tables are ordinary Postgres tables — you can write to them freely. Outbound writes flow to AGOL through the outbox/worker path; inbound AGOL edits come back through webhooks. (The sync worker itself is in active development in v0.1.0.)
How are conflicts handled?
With optimistic concurrency keyed on agol_version. When an inbound edit conflicts with a newer local version, it lands in conflict_log — never auto-resolved. A human reviews and decides.
What about attachments?
AGOL attachments are offloaded to durable S3 storage. Time-limited access is available via the presigned_url() function, so attachments stay queryable from SQL without bloating the database.
Does it require ogr_fdw?
No — ogr_fdw is optional, only needed if you want live, read-only AGOL queries via foreign tables. Full materialization and sync work without it.
What's the maturity today?
v0.1.0 is the foundation release: schema introspection, DDL generation, geodatabase-semantics translation, and materialization are implemented and tested. The standalone sync worker, webhook receiver, and full sync engine are stubbed (signatures locked) and in active development. See each feature page for status badges.
How are credentials secured?
OAuth2 client-id/secret are encrypted at rest with pgcrypto, keyed by the AGOL_FDW_KEY environment variable (not stored in the database). Tokens are cached and refreshed proactively. A database dump alone won't expose your secrets.
Is there a UI, or is it SQL only?
The primary control surface is SQL. A browser-based agol_fdw Console (admin + map viewer, built as GeoLibre plugins) is in active development to drive the lifecycle and view/edit data without leaving the browser.
