@supacloud/admin 0.9.0 → 0.10.0

package/dist/index.js

@@ -18847,6 +18847,11 @@ var require_lib3 = __commonJS((exports, module) => {
   };
 });
 
+// src/index.ts
+import { resolve as resolve3 } from "node:path";
+import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
+
 // node_modules/@sinclair/typebox/build/esm/type/guard/value.mjs
 var exports_value = {};
 __export(exports_value, {
@@ -24900,6 +24905,9 @@ function decodedSchema(inputSchema, outputSchema, decode2, options) {
   return options ? { ...transform2, ...options } : transform2;
 }
 function schemaEnumValues(schema) {
+  if (typeof schema.const === "string" || typeof schema.const === "number") {
+    return [String(schema.const)];
+  }
   if (!Array.isArray(schema.anyOf))
     return [];
   return schema.anyOf.flatMap((branch) => {
@@ -24919,11 +24927,6 @@ function schemaProperties(schema) {
   return schema;
 }
 
-// src/index.ts
-import { resolve as resolve2 } from "node:path";
-import { fileURLToPath } from "node:url";
-import { realpathSync } from "node:fs";
-
 // src/shared/transports/ssh.ts
 var import_ssh2 = __toESM(require_lib3(), 1);
 import { randomUUID, timingSafeEqual } from "node:crypto";
@@ -25447,70 +25450,174 @@ async function runCli(cliTools, args, options = {}) {
 }
 
 // src/shared/context.ts
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 import { homedir } from "node:os";
 import { resolve } from "node:path";
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-function readDotEnvFile(cwd) {
-  const envPath = resolve(cwd, ".env");
-  if (!existsSync(envPath))
-    return {};
-  const values = {};
-  try {
-    const envContent = readFileSync2(envPath, "utf-8");
-    for (const line of envContent.split(`
-`)) {
-      const match = line.trim().match(/^([^=]+)=(.*)$/);
-      if (!match)
-        continue;
-      const key = match[1].trim();
-      const value = match[2].trim().replace(/^["']|["']$/g, "");
-      values[key] = value;
-    }
-  } catch {
-    return {};
+
+// src/shared/global-options.ts
+var GLOBAL_FLAGS = {
+  "--env": "environmentName",
+  "--env-file": "envFile",
+  "--confirm-production": "confirmProduction"
+};
+var ENVIRONMENT_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+function globalFlag(argument) {
+  return Object.keys(GLOBAL_FLAGS).find((flag) => argument === flag || argument.startsWith(`${flag}=`)) ?? null;
+}
+function globalFlagValue(args, index, flag) {
+  if (args[index].startsWith(`${flag}=`)) {
+    const inlineValue = args[index].slice(flag.length + 1);
+    if (!inlineValue)
+      throw new Error(`${flag} requires a value`);
+    return { flagValue: inlineValue, consumed: 1 };
+  }
+  const followingValue = args[index + 1];
+  if (!followingValue || followingValue.startsWith("--")) {
+    throw new Error(`${flag} requires a value`);
+  }
+  return { flagValue: followingValue, consumed: 2 };
+}
+function normalizeEnvironmentName(name) {
+  if (!ENVIRONMENT_NAME_PATTERN.test(name)) {
+    throw new Error("--env and SUPACLOUD_ENV must match ^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$");
+  }
+  const normalized = name.toLowerCase();
+  return normalized === "prod" || normalized === "production" ? "production" : normalized;
+}
+function parseGlobalArgument(args, index, selectedOptions) {
+  const flag = globalFlag(args[index]);
+  if (!flag)
+    return { commandArgument: args[index], consumed: 1 };
+  const optionKey = GLOBAL_FLAGS[flag];
+  if (selectedOptions[optionKey] !== undefined) {
+    throw new Error(`${flag} may be provided only once`);
+  }
+  const parsedFlag = globalFlagValue(args, index, flag);
+  return { optionKey, optionValue: parsedFlag.flagValue, consumed: parsedFlag.consumed };
+}
+function validateEnvironmentSelection(selectedOptions) {
+  if (selectedOptions.environmentName && selectedOptions.envFile) {
+    throw new Error("--env and --env-file are mutually exclusive");
+  }
+  if (selectedOptions.environmentName)
+    normalizeEnvironmentName(selectedOptions.environmentName);
+}
+function parseGlobalAdminOptions(args) {
+  const selectedOptions = {};
+  const commandArgs = [];
+  for (let index = 0;index < args.length; ) {
+    const parsedArgument = parseGlobalArgument(args, index, selectedOptions);
+    if (parsedArgument.commandArgument !== undefined) {
+      commandArgs.push(parsedArgument.commandArgument);
+    } else if (parsedArgument.optionKey && parsedArgument.optionValue !== undefined) {
+      selectedOptions[parsedArgument.optionKey] = parsedArgument.optionValue;
+    }
+    index += parsedArgument.consumed;
+  }
+  validateEnvironmentSelection(selectedOptions);
+  return { ...selectedOptions, args: commandArgs };
+}
+
+// src/shared/context.ts
+var ADMIN_CONTEXT_KEYS = [
+  "SUPABASE_URL",
+  "SUPABASE_SERVICE_ROLE_KEY",
+  "SUPACLOUD_API_URL",
+  "SUPACLOUD_MANAGEMENT_API_URL",
+  "MANAGEMENT_API_URL",
+  "SUPACLOUD_API_TOKEN",
+  "SUPACLOUD_PROJECT_REF",
+  "X_PROJECT_REF",
+  "SUPACLOUD_HOST",
+  "SUPACLOUD_SSH_USER",
+  "SUPACLOUD_SSH_PORT",
+  "SUPACLOUD_SSH_KEY",
+  "SUPACLOUD_SSH_PASS",
+  "SUPACLOUD_SSH_HOST_FINGERPRINT",
+  "SUPACLOUD_READ_ONLY"
+];
+var SOURCE_ENVIRONMENT_KEYS = [...ADMIN_CONTEXT_KEYS, "SUPACLOUD_ENV"];
+function unquotedEnvValue(rawValue) {
+  const trimmedValue = rawValue.trim();
+  const quote = trimmedValue[0];
+  return quote && (quote === '"' || quote === "'") && trimmedValue.endsWith(quote) ? trimmedValue.slice(1, -1) : trimmedValue;
+}
+function parseEnvFile(contents) {
+  const environment = {};
+  for (const rawLine of contents.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (match)
+      environment[match[1]] = unquotedEnvValue(match[2]);
   }
-  return values;
+  return environment;
 }
-function pickValue(env, dotenv, keys) {
-  for (const key of keys) {
-    const envValue = env[key];
-    if (envValue)
-      return { value: envValue, source: "env" };
+function readEnvFile(path, required) {
+  if (!existsSync(path)) {
+    if (required)
+      throw new Error(`SupaCloud environment file not found: ${path}`);
+    return {};
   }
-  for (const key of keys) {
-    const dotenvValue = dotenv[key];
-    if (dotenvValue)
-      return { value: dotenvValue, source: "dotenv" };
+  try {
+    return parseEnvFile(readFileSync2(path, "utf8"));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to read SupaCloud environment file ${path}: ${message}`);
   }
-  return { value: "", source: "env" };
 }
-function detectSource(sources) {
-  const present = new Set(sources.filter((value) => value !== "none"));
-  if (present.size === 0)
-    return "none";
-  if (present.size === 1)
-    return present.has("env") ? "env" : "dotenv";
-  return "mixed";
-}
-function normalizeUrl(value) {
-  const trimmed = value.trim().replace(/\/+$/, "");
+function normalizeUrl(urlCandidate) {
+  const trimmed = urlCandidate.trim();
   if (!trimmed)
     return "";
   try {
-    return new URL(trimmed).toString().replace(/\/+$/, "");
+    const url = new URL(trimmed);
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash)
+      return "";
+    return url.toString().replace(/\/+$/, "");
   } catch {
     return "";
   }
 }
-function hostFromUrl(value) {
+function managementApiUrlCandidate(environment) {
+  return environment.SUPACLOUD_API_URL || environment.SUPACLOUD_MANAGEMENT_API_URL || environment.MANAGEMENT_API_URL || "";
+}
+function assertAdminCredentialScope(environment, source) {
+  const hasProjectApplicationCredentials = Boolean(environment.SUPABASE_URL?.trim() || environment.SUPABASE_SERVICE_ROLE_KEY?.trim());
+  const hasManagementApiUrl = Boolean(normalizeUrl(managementApiUrlCandidate(environment)));
+  const hasManagementApiToken = Boolean(environment.SUPACLOUD_API_TOKEN?.trim());
+  if (hasProjectApplicationCredentials && (!hasManagementApiUrl || !hasManagementApiToken)) {
+    throw new Error(`Project application credentials in ${source} cannot be used as a SupaCloud Admin profile; ` + "SUPACLOUD_API_URL and SUPACLOUD_API_TOKEN are required");
+  }
+}
+function assertAdminFileContext(environment, path) {
+  assertAdminCredentialScope(environment, path);
+  const hasManagementApiUrl = Boolean(normalizeUrl(managementApiUrlCandidate(environment)));
+  const hasManagementApiToken = Boolean(environment.SUPACLOUD_API_TOKEN?.trim());
+  if (hasManagementApiUrl !== hasManagementApiToken) {
+    throw new Error(`SupaCloud Admin API context in ${path} requires both SUPACLOUD_API_URL and SUPACLOUD_API_TOKEN`);
+  }
+}
+function processContextSource(environment, environmentName) {
+  assertAdminCredentialScope(environment, "process environment");
+  return { environment, kind: "process_env", path: null, environmentName };
+}
+function hostFromUrl(urlCandidate) {
   try {
-    return new URL(value).hostname;
+    return new URL(urlCandidate).hostname;
   } catch {
     return "";
   }
 }
-function inferManagementApiUrlFromSupabaseUrl(value, projectRef = "") {
-  const normalized = normalizeUrl(value);
+function inferProjectRefFromSupabaseUrl(supabaseUrlCandidate) {
+  const normalized = normalizeUrl(supabaseUrlCandidate);
+  if (!normalized)
+    return "";
+  return new URL(normalized).hostname.match(/^([a-z0-9-]+)\.api\./i)?.[1] ?? "";
+}
+function inferManagementApiUrlFromSupabaseUrl(supabaseUrlCandidate, projectRef = "") {
+  const normalized = normalizeUrl(supabaseUrlCandidate);
   if (!normalized)
     return "";
   const url = new URL(normalized);
@@ -25524,45 +25631,357 @@ function inferManagementApiUrlFromSupabaseUrl(value, projectRef = "") {
     url.hostname = `studio-${ref}.${host.slice(`${ref}.api.`.length)}`;
     return url.toString().replace(/\/+$/, "");
   }
-  const managedHostMatch = host.match(/^([a-z0-9-]+)\.api\.(.+)$/i);
-  if (managedHostMatch) {
-    url.hostname = `studio-${managedHostMatch[1]}.${managedHostMatch[2]}`;
+  const managedHost = host.match(/^([a-z0-9-]+)\.api\.(.+)$/i);
+  if (managedHost) {
+    url.hostname = `studio-${managedHost[1]}.${managedHost[2]}`;
     return url.toString().replace(/\/+$/, "");
   }
   return normalized;
 }
-function resolveSupaCloudContext(env = process.env, cwd = process.cwd()) {
-  const dotenv = readDotEnvFile(cwd);
-  const supabaseUrl = pickValue(env, dotenv, ["SUPABASE_URL"]);
-  const explicitApiUrl = pickValue(env, dotenv, ["SUPACLOUD_API_URL", "SUPACLOUD_MANAGEMENT_API_URL", "MANAGEMENT_API_URL"]);
-  const inferredToken = pickValue(env, dotenv, ["SUPABASE_SERVICE_ROLE_KEY", "SUPACLOUD_API_TOKEN"]);
-  const projectRef = pickValue(env, dotenv, ["SUPACLOUD_PROJECT_REF", "X_PROJECT_REF"]).value;
-  const hostFromEnv = env.SUPACLOUD_HOST;
-  const normalizedSupabaseUrl = normalizeUrl(supabaseUrl.value);
-  const apiUrl = normalizeUrl(explicitApiUrl.value) || inferManagementApiUrlFromSupabaseUrl(normalizedSupabaseUrl, projectRef) || (hostFromEnv ? `http://${hostFromEnv}:9090` : "");
-  const resolvedHostFromUrl = hostFromUrl(apiUrl || normalizedSupabaseUrl);
+function sourceAdminCore(environment) {
+  const supabaseUrl = normalizeUrl(environment.SUPABASE_URL || "");
+  const projectRef = (environment.SUPACLOUD_PROJECT_REF || environment.X_PROJECT_REF || "").trim() || inferProjectRefFromSupabaseUrl(supabaseUrl);
+  const explicitApiUrl = managementApiUrlCandidate(environment);
+  const apiUrl = normalizeUrl(explicitApiUrl) || inferManagementApiUrlFromSupabaseUrl(supabaseUrl, projectRef) || normalizeUrl(environment.SUPACLOUD_HOST ? `http://${environment.SUPACLOUD_HOST}:9090` : "");
+  const apiToken = environment.SUPACLOUD_API_TOKEN || environment.SUPABASE_SERVICE_ROLE_KEY || "";
+  return { apiUrl, apiToken, projectRef, supabaseUrl };
+}
+function processEnvironment(env) {
+  return Object.fromEntries(SOURCE_ENVIRONMENT_KEYS.flatMap((key) => {
+    const environmentValue = env[key];
+    return environmentValue === undefined ? [] : [[key, environmentValue]];
+  }));
+}
+function hasProcessContext(env) {
+  return ADMIN_CONTEXT_KEYS.some((key) => Object.hasOwn(env, key));
+}
+function completeAdminContext(environment) {
+  const adminCore = sourceAdminCore(environment);
+  const hasApiContext = Boolean(adminCore.apiUrl && adminCore.apiToken);
+  const hasSshContext = Boolean(environment.SUPACLOUD_HOST && environment.SUPACLOUD_SSH_HOST_FINGERPRINT);
+  return hasApiContext || hasSshContext;
+}
+function namedEnvironmentSource(cwd, selector) {
+  const environment = normalizeEnvironmentName(selector);
+  const path = resolve(cwd, `.env.supacloud.${selector}`);
+  const selectedEnvironment = readEnvFile(path, true);
+  if (!selectedEnvironment.SUPACLOUD_ENV) {
+    throw new Error(`SUPACLOUD_ENV is required in ${path}`);
+  }
+  if (normalizeEnvironmentName(selectedEnvironment.SUPACLOUD_ENV) !== environment) {
+    throw new Error(`SUPACLOUD_ENV in ${path} does not match selector ${selector}`);
+  }
+  assertAdminFileContext(selectedEnvironment, path);
   return {
-    host: hostFromEnv ?? resolvedHostFromUrl,
-    sshUser: env.SUPACLOUD_SSH_USER ?? "root",
-    sshPort: parseInt(env.SUPACLOUD_SSH_PORT ?? "22", 10),
-    sshKey: env.SUPACLOUD_SSH_KEY ?? resolve(homedir(), ".ssh", "id_rsa"),
-    sshPass: env.SUPACLOUD_SSH_PASS ?? "",
-    sshHostFingerprint: env.SUPACLOUD_SSH_HOST_FINGERPRINT ?? "",
-    apiUrl,
-    apiToken: env.SUPACLOUD_API_TOKEN ?? inferredToken.value,
-    projectRef,
-    readOnly: env.SUPACLOUD_READ_ONLY === "true",
-    inferredSupabaseUrl: normalizedSupabaseUrl,
-    inferredServiceRoleKey: inferredToken.value,
-    source: detectSource([
-      supabaseUrl.value || explicitApiUrl.value ? supabaseUrl.value ? supabaseUrl.source : explicitApiUrl.source : "none",
-      inferredToken.value ? inferredToken.source : "none"
-    ])
+    environment: selectedEnvironment,
+    kind: "named_env_file",
+    path,
+    environmentName: environment
+  };
+}
+function explicitEnvironmentSource(cwd, envFile) {
+  const path = resolve(cwd, envFile);
+  const selectedEnvironment = readEnvFile(path, true);
+  if (!selectedEnvironment.SUPACLOUD_ENV)
+    throw new Error(`SUPACLOUD_ENV is required in ${path}`);
+  assertAdminFileContext(selectedEnvironment, path);
+  return {
+    environment: selectedEnvironment,
+    kind: "explicit_env_file",
+    path,
+    environmentName: normalizeEnvironmentName(selectedEnvironment.SUPACLOUD_ENV)
+  };
+}
+function legacyEnvironmentSource(cwd) {
+  const path = resolve(cwd, ".env");
+  const environment = readEnvFile(path, false);
+  if (Object.keys(environment).length > 0)
+    assertAdminFileContext(environment, path);
+  const environmentName = environment.SUPACLOUD_ENV ? normalizeEnvironmentName(environment.SUPACLOUD_ENV) : "";
+  return {
+    environment,
+    kind: Object.keys(environment).length ? "legacy_dotenv" : "none",
+    path: existsSync(path) ? path : null,
+    environmentName
+  };
+}
+function ambientContextSource(env, cwd) {
+  const environment = processEnvironment(env);
+  if (env.SUPACLOUD_ENV) {
+    const environmentName = normalizeEnvironmentName(env.SUPACLOUD_ENV);
+    if (completeAdminContext(environment)) {
+      return processContextSource(environment, environmentName);
+    }
+    return namedEnvironmentSource(cwd, env.SUPACLOUD_ENV);
+  }
+  if (hasProcessContext(env)) {
+    return processContextSource(environment, "");
+  }
+  return legacyEnvironmentSource(cwd);
+}
+function contextSource(env, cwd, selection) {
+  if (selection.environmentName && selection.envFile) {
+    throw new Error("Environment selectors are mutually exclusive");
+  }
+  if (selection.environmentName)
+    return namedEnvironmentSource(cwd, selection.environmentName);
+  if (selection.envFile)
+    return explicitEnvironmentSource(cwd, selection.envFile);
+  return ambientContextSource(env, cwd);
+}
+function resolvedSshContext(environment) {
+  const rawPort = environment.SUPACLOUD_SSH_PORT || "22";
+  if (!/^\d+$/.test(rawPort)) {
+    throw new Error("SUPACLOUD_SSH_PORT must be an integer between 1 and 65535");
+  }
+  const sshPort = Number(rawPort);
+  if (!Number.isSafeInteger(sshPort) || sshPort < 1 || sshPort > 65535) {
+    throw new Error("SUPACLOUD_SSH_PORT must be an integer between 1 and 65535");
+  }
+  return {
+    sshUser: environment.SUPACLOUD_SSH_USER || "root",
+    sshPort,
+    sshKey: environment.SUPACLOUD_SSH_KEY || resolve(homedir(), ".ssh", "id_rsa"),
+    sshPass: environment.SUPACLOUD_SSH_PASS || "",
+    sshHostFingerprint: environment.SUPACLOUD_SSH_HOST_FINGERPRINT || ""
+  };
+}
+function resolveSupaCloudContext(env = process.env, cwd = process.cwd(), selection = {}) {
+  const source = contextSource(env, cwd, selection);
+  const adminCore = sourceAdminCore(source.environment);
+  const host = source.environment.SUPACLOUD_HOST || hostFromUrl(adminCore.apiUrl || adminCore.supabaseUrl);
+  return {
+    host,
+    ...resolvedSshContext(source.environment),
+    apiUrl: adminCore.apiUrl,
+    apiToken: adminCore.apiToken,
+    projectRef: adminCore.projectRef,
+    readOnly: env.SUPACLOUD_READ_ONLY === "true" || source.environment.SUPACLOUD_READ_ONLY === "true",
+    environment: source.environmentName,
+    production: source.environmentName === "production",
+    inferredSupabaseUrl: adminCore.supabaseUrl,
+    inferredServiceRoleKey: source.environment.SUPABASE_SERVICE_ROLE_KEY || "",
+    source: source.kind,
+    sourcePath: source.path
   };
 }
 
+// src/shared/execution-policy.ts
+var ACTION_POLICY = {
+  project: {
+    read: ["list", "get", "settings", "api_keys", "health", "logs", "tasks", "services"],
+    write: ["create", "delete", "pause", "restore", "restart", "update_settings"]
+  },
+  platform: {
+    read: ["metrics", "list_backups", "network", "list_orgs", "get_org"],
+    write: ["create_backup", "update_network"]
+  },
+  gateway: {
+    read: ["routes", "get_certificate", "custom_hostname"],
+    write: [
+      "upsert_route",
+      "update_route",
+      "delete_route",
+      "config",
+      "update_certificate",
+      "issue_certificate",
+      "deploy_certificate",
+      "rebuild",
+      "set_custom_hostname",
+      "delete_custom_hostname",
+      "verify_custom_hostname"
+    ]
+  },
+  ssh: {
+    read: [
+      "ping",
+      "versions",
+      "diagnose",
+      "exec",
+      "troubleshoot",
+      "container_logs",
+      "tenant_list",
+      "tenant_inspect",
+      "tenant_diagnose"
+    ],
+    write: ["setup", "install", "upgrade", "tenant_migrate"]
+  }
+};
+var DYNAMIC_ACTION_FIELDS = {
+  "project.service_control": "service_action",
+  "ssh.tenant_manage": "tenant_action"
+};
+var REFLESS_WRITE_ACTIONS = new Set([
+  "project.create",
+  "ssh.setup",
+  "ssh.install",
+  "ssh.upgrade"
+]);
+var SSH_PROJECT_REF_ACTIONS = new Set(["tenant_manage", "tenant_inspect", "tenant_diagnose"]);
+var PLATFORM_PROJECT_REF_ACTIONS = new Set([
+  "list_backups",
+  "create_backup",
+  "network",
+  "update_network"
+]);
+function declaredMode(moduleName, action) {
+  const policy = ACTION_POLICY[moduleName];
+  if (!policy)
+    return;
+  for (const mode of ["read", "write", "local"]) {
+    if (policy[mode]?.includes(action))
+      return mode;
+  }
+  return;
+}
+function serviceControlMode(serviceAction) {
+  if (serviceAction === "status")
+    return "read";
+  if (["start", "stop", "restart", "pause", "resume"].includes(String(serviceAction))) {
+    return "write";
+  }
+  return;
+}
+function executionMode(moduleName, action, args) {
+  if (moduleName === "project" && action === "service_control") {
+    return serviceControlMode(args.service_action);
+  }
+  if (moduleName === "ssh" && action === "tenant_manage") {
+    return serviceControlMode(args.tenant_action);
+  }
+  return declaredMode(moduleName, action);
+}
+function stringArgument(args, field) {
+  const candidate = args[field];
+  return typeof candidate === "string" && candidate ? candidate : null;
+}
+function sshRequestedProjectRef(action, args) {
+  if (action === "tenant_migrate")
+    return stringArgument(args, "target_ref");
+  return SSH_PROJECT_REF_ACTIONS.has(action) ? stringArgument(args, "project_ref") : null;
+}
+function requestedProjectRef(moduleName, action, args) {
+  if (moduleName === "ssh")
+    return sshRequestedProjectRef(action, args);
+  if (moduleName === "project") {
+    return ["list", "create"].includes(action) ? null : stringArgument(args, "ref");
+  }
+  if (moduleName === "platform") {
+    return PLATFORM_PROJECT_REF_ACTIONS.has(action) ? stringArgument(args, "ref") : null;
+  }
+  return moduleName === "gateway" ? stringArgument(args, "ref") : null;
+}
+function requiresProjectRef(moduleName, action) {
+  return !REFLESS_WRITE_ACTIONS.has(`${moduleName}.${action}`);
+}
+function apiConfirmationTarget(context) {
+  if (!context.apiUrl) {
+    throw new Error("Production platform write requires a configured SUPACLOUD_API_URL");
+  }
+  return `platform:${new URL(context.apiUrl).host}`;
+}
+function sshConfirmationTarget(context) {
+  if (!context.host) {
+    throw new Error("Production SSH write requires a configured SUPACLOUD_HOST");
+  }
+  const portSuffix = context.sshPort === 22 ? "" : `:${context.sshPort}`;
+  return `host:${context.host}${portSuffix}`;
+}
+function productionConfirmationTarget(moduleName, action, args, context) {
+  const projectRef = requestedProjectRef(moduleName, action, args);
+  if (projectRef)
+    return projectRef;
+  if (moduleName === "ssh")
+    return sshConfirmationTarget(context);
+  return apiConfirmationTarget(context);
+}
+function assertProfileProjectBoundary(requestedRef, context) {
+  if (requestedRef && context.projectRef && requestedRef !== context.projectRef) {
+    throw new Error("Production profiles cannot target a different project ref");
+  }
+}
+function requiredProjectRefFlag(moduleName, action) {
+  if (moduleName !== "ssh")
+    return "ref";
+  return action === "tenant_migrate" ? "target_ref" : "project_ref";
+}
+function authorizeWrite(request) {
+  const { moduleName, action, args, projectRef, authorization } = request;
+  const { context, confirmProduction } = authorization;
+  if (context.readOnly) {
+    throw new Error(`Remote write ${moduleName}.${action} is blocked in read-only mode (SUPACLOUD_READ_ONLY=true)`);
+  }
+  if (!context.environment) {
+    throw new Error(`Remote write ${moduleName}.${action} requires an explicit SUPACLOUD_ENV`);
+  }
+  if (!context.production)
+    return;
+  if (requiresProjectRef(moduleName, action) && !projectRef) {
+    throw new Error(`Production write ${moduleName}.${action} requires --${requiredProjectRefFlag(moduleName, action)}`);
+  }
+  const confirmationTarget = productionConfirmationTarget(moduleName, action, args, context);
+  if (confirmProduction !== confirmationTarget) {
+    throw new Error(`Production write requires --confirm-production ${confirmationTarget}`);
+  }
+}
+function assertKnownMode(moduleName, action, mode, context) {
+  if (!mode && (context.production || context.readOnly)) {
+    throw new Error(`Execution policy has no classification for ${moduleName}.${action}`);
+  }
+}
+function authorizeExecution(moduleName, args, authorization) {
+  const action = typeof args.action === "string" ? args.action : "";
+  if (!action)
+    return;
+  const mode = executionMode(moduleName, action, args);
+  const { context } = authorization;
+  assertKnownMode(moduleName, action, mode, context);
+  if (!mode)
+    return;
+  const projectRef = requestedProjectRef(moduleName, action, args);
+  if (context.production)
+    assertProfileProjectBoundary(projectRef, context);
+  if (mode !== "write")
+    return;
+  authorizeWrite({ moduleName, action, args, projectRef, authorization });
+}
+function validateDynamicAction(tool, moduleName, action, field) {
+  const fieldSchema = schemaProperties(tool.schema)[field];
+  const fieldActions = fieldSchema ? schemaEnumValues(fieldSchema) : [];
+  if (fieldActions.length === 0) {
+    throw new Error(`Execution policy cannot inspect ${moduleName}.${action}.${field}`);
+  }
+  for (const fieldAction of fieldActions) {
+    if (!executionMode(moduleName, action, { [field]: fieldAction })) {
+      throw new Error(`Execution policy has no classification for ${moduleName}.${action}.${fieldAction}`);
+    }
+  }
+}
+function validateRegisteredAction(tool, moduleName, action) {
+  const dynamicField = DYNAMIC_ACTION_FIELDS[`${moduleName}.${action}`];
+  if (dynamicField)
+    return validateDynamicAction(tool, moduleName, action, dynamicField);
+  if (!declaredMode(moduleName, action)) {
+    throw new Error(`Execution policy has no classification for ${moduleName}.${action}`);
+  }
+}
+function validateExecutionPolicyCoverage(tools) {
+  for (const [moduleName, tool] of Object.entries(tools)) {
+    const actionSchema = schemaProperties(tool.schema).action;
+    if (!actionSchema)
+      continue;
+    const registeredActions = schemaEnumValues(actionSchema);
+    if (registeredActions.length === 0) {
+      throw new Error(`Execution policy cannot inspect ${moduleName}.action`);
+    }
+    for (const action of registeredActions)
+      validateRegisteredAction(tool, moduleName, action);
+  }
+}
+
 // src/shared/transports/http.ts
 var DEFAULT_TIMEOUT = 30000;
+var MAX_POST_TIMEOUT_MS = 35 * 60000;
 var MAX_RETRIES = 2;
 var RETRY_BASE_DELAY = 500;
 function isRetryableMethod(method) {
@@ -25575,9 +25994,26 @@ function isRetryableError(error) {
   const networkError = error;
   return networkError.name === "AbortError" || networkError.code === "ECONNREFUSED" || networkError.code === "ECONNRESET";
 }
-async function fetchWithTimeout(url, options) {
+function transportFailure(error) {
+  const networkError = error instanceof Error ? error : null;
+  const code = networkError?.name === "AbortError" ? "TIMEOUT" : networkError?.code === "ECONNRESET" ? "CONNECTION_RESET" : "NETWORK_ERROR";
+  return {
+    ok: false,
+    status: 500,
+    data: { error: "Network Error", code },
+    transportError: true
+  };
+}
+function validatedPostTimeout(options) {
+  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_POST_TIMEOUT_MS) {
+    throw new RangeError(`HTTP request timeout must be between 1 and ${MAX_POST_TIMEOUT_MS} ms`);
+  }
+  return timeoutMs;
+}
+async function fetchWithTimeout(url, options, timeoutMs = DEFAULT_TIMEOUT) {
   const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
   try {
     return await fetch(url, {
       ...options,
@@ -25587,11 +26023,11 @@ async function fetchWithTimeout(url, options) {
     clearTimeout(timeout);
   }
 }
-async function fetchWithRetry(url, options) {
+async function fetchWithRetry(url, options, timeoutMs = DEFAULT_TIMEOUT) {
   const retries = isRetryableMethod(options.method) ? MAX_RETRIES : 0;
   for (let attempt = 0;attempt <= retries; attempt++) {
     try {
-      const res = await fetchWithTimeout(url, options);
+      const res = await fetchWithTimeout(url, options, timeoutMs);
       if (res.status >= 500 && res.status < 600 && attempt < retries) {
         const delay = RETRY_BASE_DELAY * Math.pow(2, attempt);
         await new Promise((r) => setTimeout(r, delay));
@@ -25632,20 +26068,21 @@ class HttpTransport {
       const data = await res.json().catch(() => null);
       return { ok: res.ok, status: res.status, data };
     } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
+      return transportFailure(error);
     }
   }
-  async post(path, body) {
+  async post(path, body, options) {
+    const timeoutMs = validatedPostTimeout(options);
     try {
       const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
         method: "POST",
         headers: this.headers(),
         body: body ? JSON.stringify(body) : undefined
-      });
+      }, timeoutMs);
       const data = await res.json().catch(() => null);
       return { ok: res.ok, status: res.status, data };
     } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
+      return transportFailure(error);
     }
   }
   async postMultipart(path, formData) {
@@ -25659,7 +26096,7 @@ class HttpTransport {
       const data = await res.json().catch(() => null);
       return { ok: res.ok, status: res.status, data };
     } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
+      return transportFailure(error);
     }
   }
   async patch(path, body) {
@@ -25672,7 +26109,7 @@ class HttpTransport {
       const data = await res.json().catch(() => null);
       return { ok: res.ok, status: res.status, data };
     } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
+      return transportFailure(error);
     }
   }
   async put(path, body) {
@@ -25685,7 +26122,7 @@ class HttpTransport {
       const data = await res.json().catch(() => null);
       return { ok: res.ok, status: res.status, data };
     } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
+      return transportFailure(error);
     }
   }
   async delete(path) {
@@ -25697,7 +26134,7 @@ class HttpTransport {
       const data = await res.json().catch(() => null);
       return { ok: res.ok, status: res.status, data };
     } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
+      return transportFailure(error);
     }
   }
   async ping() {
@@ -28475,6 +28912,127 @@ ${r.stderr.slice(-1000)}`;
   });
 }
 
+// src/shared/tools/backup-release-control.ts
+var SAFE_PATH_SEGMENT = /^[A-Za-z0-9_-]{1,64}$/;
+var SAFE_BACKUP_FIELD = /^[A-Za-z0-9_.-]{1,128}$/;
+var PHYSICAL_BACKUP_REQUEST_TIMEOUT_MS = 35 * 60000;
+function nonnegativeSafeInteger(candidate) {
+  return typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate >= 0;
+}
+function backupTimestamp(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const timestamp = candidate;
+  if (!nonnegativeSafeInteger(timestamp.start) || !nonnegativeSafeInteger(timestamp.stop))
+    return null;
+  if (timestamp.stop > 0 && timestamp.stop < timestamp.start)
+    return null;
+  return { start: timestamp.start, stop: timestamp.stop };
+}
+function backupFailure(operation, code, httpStatus) {
+  return {
+    isError: true,
+    content: [{
+      type: "text",
+      text: JSON.stringify({
+        ok: false,
+        operation,
+        error: { code, http_status: httpStatus }
+      })
+    }]
+  };
+}
+function backupRecord(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const record = candidate;
+  const timestamp = backupTimestamp(record.timestamp);
+  if (!timestamp)
+    return null;
+  if (typeof record.id !== "string" || !SAFE_BACKUP_FIELD.test(record.id))
+    return null;
+  if (record.type !== "full" && record.type !== "incr" && record.type !== "diff")
+    return null;
+  if (!nonnegativeSafeInteger(record.size))
+    return null;
+  if (typeof record.database !== "string" || !SAFE_BACKUP_FIELD.test(record.database))
+    return null;
+  return {
+    id: record.id,
+    type: record.type,
+    timestamp,
+    size: record.size,
+    database: record.database
+  };
+}
+function backupInventory(payload) {
+  if (!Array.isArray(payload))
+    return null;
+  const records = payload.map(backupRecord);
+  if (records.some((record) => record === null))
+    return null;
+  const inventory = records;
+  return new Set(inventory.map((record) => record.id)).size === inventory.length ? inventory : null;
+}
+function backupEndpoint(projectRef) {
+  if (!SAFE_PATH_SEGMENT.test(projectRef))
+    throw new Error("'ref' is invalid for physical backup");
+  return `/v1/projects/${encodeURIComponent(projectRef)}/database/backups`;
+}
+async function readBackupInventory(http, endpoint) {
+  const response = await http.get(endpoint);
+  return { response, inventory: response.ok ? backupInventory(response.data) ?? undefined : undefined };
+}
+function successfulBackupResponse(payload) {
+  return { content: [{ type: "text", text: JSON.stringify(payload, null, 2) }] };
+}
+function completedFullBackup(before, after) {
+  const previousIds = new Set(before.map((backup) => backup.id));
+  const candidates = after.filter((backup) => !previousIds.has(backup.id) && backup.type === "full" && backup.timestamp.stop > 0 && backup.size > 0);
+  return candidates.length === 1 ? candidates[0] : null;
+}
+function mutationFailureCode(statusCode) {
+  return statusCode >= 400 && statusCode < 500 && statusCode !== 408 ? "HTTP_ERROR" : "OUTCOME_UNKNOWN";
+}
+function confirmsFullBackup(payload) {
+  return Boolean(payload) && typeof payload === "object" && !Array.isArray(payload) && payload.message === "full backup completed";
+}
+function reconciledCreationResponse(projectRef, before, creation, afterRead) {
+  if (!creation.ok) {
+    return backupFailure("platform.create_backup", mutationFailureCode(creation.status), creation.status);
+  }
+  if (!confirmsFullBackup(creation.data)) {
+    return backupFailure("platform.create_backup", "OUTCOME_UNKNOWN", creation.status);
+  }
+  if (!afterRead.response.ok || !afterRead.inventory) {
+    return backupFailure("platform.create_backup", "OUTCOME_UNKNOWN", afterRead.response.status);
+  }
+  const backup = completedFullBackup(before, afterRead.inventory);
+  if (!backup)
+    return backupFailure("platform.create_backup", "OUTCOME_UNKNOWN", afterRead.response.status);
+  return successfulBackupResponse({ project_ref: projectRef, requested_type: "full", backup });
+}
+async function listPhysicalBackups(http, projectRef) {
+  const { response, inventory } = await readBackupInventory(http, backupEndpoint(projectRef));
+  if (!response.ok)
+    return backupFailure("platform.list_backups", "HTTP_ERROR", response.status);
+  if (!inventory)
+    return backupFailure("platform.list_backups", "INVALID_RESPONSE", null);
+  return successfulBackupResponse(inventory);
+}
+async function createFullPhysicalBackup(http, projectRef) {
+  const endpoint = backupEndpoint(projectRef);
+  const beforeRead = await readBackupInventory(http, endpoint);
+  if (!beforeRead.response.ok) {
+    return backupFailure("platform.create_backup", "HTTP_ERROR", beforeRead.response.status);
+  }
+  if (!beforeRead.inventory)
+    return backupFailure("platform.create_backup", "INVALID_RESPONSE", null);
+  const creation = await http.post(endpoint, { type: "full" }, { timeoutMs: PHYSICAL_BACKUP_REQUEST_TIMEOUT_MS });
+  const afterRead = await readBackupInventory(http, endpoint);
+  return reconciledCreationResponse(projectRef, beforeRead.inventory, creation, afterRead);
+}
+
 // src/shared/tools/advanced-tools.ts
 function registerAdvancedTools(server, http) {
   server.tool("edge_functions", `Edge Function management (Deno/Bun serverless). Server auto-bundles dependencies.
@@ -28628,11 +29186,12 @@ Actions: metrics, list_backups, create_backup, network, update_network, list_org
       "list_orgs",
       "get_org"
     ]), "Action"),
-    ref: optional(Type.String(), "Project ref (for backup/network actions)"),
+    ref: optional(Type.String(), "[*] Project ref for project-scoped platform actions"),
+    backup_type: optional(stringEnum(["full"]), "[create_backup] Explicit physical backup type"),
     slug: optional(Type.String(), "[get_org] Organization slug"),
     allowed_cidrs: optional(Type.Array(Type.String()), "[update_network] Allowed CIDRs")
   }, async (args) => {
-    const { action, ref, slug, allowed_cidrs } = args;
+    const { action, ref, backup_type, slug, allowed_cidrs } = args;
     const need = (f, v) => {
       if (!v)
         throw new Error(`'${f}' required for '${action}'`);
@@ -28644,14 +29203,11 @@ Actions: metrics, list_backups, create_backup, network, update_network, list_org
         break;
       case "list_backups":
         need("ref", ref);
-        text = JSON.stringify((await http.get(`/v1/projects/${ref}/database/backups`)).data, null, 2);
-        break;
+        return listPhysicalBackups(http, ref);
       case "create_backup": {
         need("ref", ref);
-        const r = await http.post(`/v1/projects/${ref}/database/backups`);
-        text = r.ok ? `✅ Backup created
-${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status})`;
-        break;
+        need("backup_type", backup_type);
+        return createFullPhysicalBackup(http, ref);
       }
       case "network":
         need("ref", ref);
@@ -28677,6 +29233,419 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status})`;
   });
 }
 
+// src/shared/tools/project-create-env.ts
+import { constants } from "node:fs";
+import { isAbsolute, basename as basename4, dirname as dirname2, join as join3, normalize, parse as parse2, resolve as resolve2 } from "node:path";
+import {
+  lstat,
+  open,
+  realpath,
+  unlink
+} from "node:fs/promises";
+var PROJECT_REF = /^[a-z]{20}$/;
+var SERVICE_ROLE_KEY = /^[A-Za-z0-9_-]{8,2048}\.[A-Za-z0-9_-]{8,8192}\.[A-Za-z0-9_-]{8,2048}$/;
+var SERVICE_ROLE_ALGORITHMS = new Set(["HS256", "ES256"]);
+var MAX_ENV_FILE_PATH_BYTES = 4096;
+var ENV_FILE_MODE = 384;
+var GROUP_OR_WORLD_WRITE_MODE = 18;
+var PROC_SELF_FD = "/proc/self/fd";
+
+class ProjectCreateEnvError extends Error {
+  code;
+  credentialFileState;
+  constructor(code, credentialFileState = "absent") {
+    super(code);
+    this.code = code;
+    this.credentialFileState = credentialFileState;
+    this.name = "ProjectCreateEnvError";
+  }
+}
+function descriptorRelativePath(directory, filename) {
+  return `${PROC_SELF_FD}/${directory.fd}/${filename}`;
+}
+var nodeProjectEnvFileOperations = {
+  platform: process.platform,
+  effectiveUid: () => process.geteuid?.() ?? -1,
+  lstat,
+  realpath,
+  openDirectory: (path2) => open(path2, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW),
+  openExclusiveAt: (directory, filename, mode) => open(descriptorRelativePath(directory, filename), "wx", mode),
+  lstatAt: (directory, filename) => lstat(descriptorRelativePath(directory, filename)),
+  unlinkAt: (directory, filename) => unlink(descriptorRelativePath(directory, filename))
+};
+function fileSystemErrorCode(candidate) {
+  if (!candidate || typeof candidate !== "object" || !("code" in candidate))
+    return null;
+  return typeof candidate.code === "string" ? candidate.code : null;
+}
+async function assertTargetAbsent(path2, operations) {
+  try {
+    await operations.lstat(path2);
+  } catch (error) {
+    if (fileSystemErrorCode(error) === "ENOENT")
+      return;
+    throw new ProjectCreateEnvError("ENV_FILE_PATH_INVALID");
+  }
+  throw new ProjectCreateEnvError("ENV_FILE_EXISTS");
+}
+function hasStableCanonicalParent(directory, canonicalParent, parentBeforeRealpath, parentAfterRealpath) {
+  return parentBeforeRealpath.isDirectory() && !parentBeforeRealpath.isSymbolicLink() && parentAfterRealpath.isDirectory() && !parentAfterRealpath.isSymbolicLink() && canonicalParent === directory && sameFileIdentity(parentBeforeRealpath, parentAfterRealpath);
+}
+function parentIdentity(canonicalPath, parentStat) {
+  return {
+    canonicalPath,
+    dev: parentStat.dev,
+    ino: parentStat.ino,
+    mode: parentStat.mode,
+    uid: parentStat.uid
+  };
+}
+async function verifiedParentIdentity(directory, operations) {
+  const parentBeforeRealpath = await operations.lstat(directory);
+  const canonicalParent = await operations.realpath(directory);
+  await assertTrustedDirectoryChain(directory, operations);
+  const parentAfterRealpath = await operations.lstat(directory);
+  assertOwnedTargetParent(parentAfterRealpath, operations.effectiveUid());
+  const stableParent = hasStableCanonicalParent(directory, canonicalParent, parentBeforeRealpath, parentAfterRealpath);
+  if (!stableParent)
+    throw new ProjectCreateEnvError("ENV_FILE_PARENT_INVALID");
+  return parentIdentity(canonicalParent, parentAfterRealpath);
+}
+async function assertSafeParent(directory, operations) {
+  try {
+    return await verifiedParentIdentity(directory, operations);
+  } catch (error) {
+    if (error instanceof ProjectCreateEnvError)
+      throw error;
+    throw new ProjectCreateEnvError("ENV_FILE_PARENT_INVALID");
+  }
+}
+function directoryChain(directory) {
+  const root = parse2(directory).root;
+  const ancestors = [root];
+  let current = root;
+  for (const component of directory.slice(root.length).split("/").filter(Boolean)) {
+    current = join3(current, component);
+    ancestors.push(current);
+  }
+  return ancestors;
+}
+function assertTrustedAncestor(directoryStat, effectiveUid) {
+  const ownerIsTrusted = directoryStat.uid === 0 || directoryStat.uid === effectiveUid;
+  const hasUntrustedWriteAccess = Boolean(directoryStat.mode & GROUP_OR_WORLD_WRITE_MODE);
+  if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink() || !ownerIsTrusted || hasUntrustedWriteAccess) {
+    throw new ProjectCreateEnvError("ENV_FILE_PARENT_INVALID");
+  }
+}
+function assertOwnedTargetParent(directoryStat, effectiveUid) {
+  assertTrustedAncestor(directoryStat, effectiveUid);
+  if (directoryStat.uid !== effectiveUid) {
+    throw new ProjectCreateEnvError("ENV_FILE_PARENT_INVALID");
+  }
+}
+async function assertTrustedDirectoryChain(directory, operations) {
+  const effectiveUid = operations.effectiveUid();
+  if (!Number.isSafeInteger(effectiveUid) || effectiveUid < 0) {
+    throw new ProjectCreateEnvError("ENV_FILE_PARENT_INVALID");
+  }
+  for (const ancestor of directoryChain(directory)) {
+    assertTrustedAncestor(await operations.lstat(ancestor), effectiveUid);
+  }
+}
+function sameFileIdentity(first, second) {
+  return first.dev === second.dev && first.ino === second.ino;
+}
+function sameParentIdentity(current, expected) {
+  return sameFileIdentity(current, expected) && current.mode === expected.mode && current.uid === expected.uid;
+}
+function hasSafeRequestedPath(requestedPath) {
+  return Boolean(requestedPath) && isAbsolute(requestedPath) && requestedPath === normalize(requestedPath) && requestedPath === resolve2(requestedPath) && Buffer.byteLength(requestedPath, "utf8") <= MAX_ENV_FILE_PATH_BYTES && !/[\0\r\n]/.test(requestedPath) && ![".", ".."].includes(basename4(requestedPath));
+}
+async function prepareProjectEnvFile(requestedPath, environment, operations = nodeProjectEnvFileOperations) {
+  if (operations.platform !== "linux") {
+    throw new ProjectCreateEnvError("ENV_FILE_PLATFORM_UNSUPPORTED");
+  }
+  if (!hasSafeRequestedPath(requestedPath)) {
+    throw new ProjectCreateEnvError("ENV_FILE_PATH_INVALID");
+  }
+  const directory = dirname2(requestedPath);
+  const filename = basename4(requestedPath);
+  const parentIdentity2 = await assertSafeParent(directory, operations);
+  await assertTargetAbsent(requestedPath, operations);
+  let directoryHandle = null;
+  let openFile = null;
+  let fileIdentity = null;
+  try {
+    directoryHandle = await operations.openDirectory(directory);
+    await assertDirectoryBinding(directory, directoryHandle, parentIdentity2, operations);
+    openFile = await openProjectEnvFile(directoryHandle, filename, operations);
+    const openFileStat = await openFile.stat();
+    assertSecureFileType(openFileStat);
+    fileIdentity = { dev: openFileStat.dev, ino: openFileStat.ino };
+    await openFile.chmod(ENV_FILE_MODE);
+    const prepared = {
+      path: requestedPath,
+      filename,
+      environment,
+      parentIdentity: parentIdentity2,
+      fileIdentity,
+      directoryHandle,
+      openFile
+    };
+    await assertPreparedFileBinding(prepared, operations);
+    return prepared;
+  } catch (error) {
+    if (directoryHandle) {
+      const credentialFileState = await removeFailedEnvFile({ directoryHandle, filename, openFile, fileIdentity, operations });
+      if (credentialFileState === "unknown") {
+        throw new ProjectCreateEnvError("ENV_FILE_CLEANUP_FAILED", "unknown");
+      }
+    }
+    if (error instanceof ProjectCreateEnvError)
+      throw error;
+    throw new ProjectCreateEnvError("ENV_FILE_WRITE_FAILED");
+  }
+}
+function environmentFileContent(credentials, environment) {
+  return [
+    `SUPACLOUD_ENV=${environment}`,
+    `SUPACLOUD_PROJECT_REF=${credentials.projectRef}`,
+    `SUPABASE_URL=${credentials.apiUrl}`,
+    `SUPABASE_SERVICE_ROLE_KEY=${credentials.serviceRoleKey}`,
+    ""
+  ].join(`
+`);
+}
+async function sanitizeAndClose(openFile) {
+  let sanitized = true;
+  try {
+    await openFile.truncate(0);
+    await openFile.sync();
+  } catch {
+    sanitized = false;
+  }
+  try {
+    await openFile.close();
+  } catch {}
+  return sanitized;
+}
+async function directorySyncSucceeded(directoryHandle) {
+  try {
+    await directoryHandle.sync();
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function cleanedCredentialState(cleanup, sanitized) {
+  const { directoryHandle, filename, fileIdentity, operations } = cleanup;
+  try {
+    const targetStat = await operations.lstatAt(directoryHandle, filename);
+    if (!fileIdentity || !sameFileIdentity(targetStat, fileIdentity))
+      return "unknown";
+    await operations.unlinkAt(directoryHandle, filename);
+  } catch (error) {
+    if (fileSystemErrorCode(error) !== "ENOENT")
+      return "unknown";
+  }
+  if (!await directorySyncSucceeded(directoryHandle))
+    return "unknown";
+  return sanitized ? "absent" : "unknown";
+}
+async function removeFailedEnvFile(cleanup) {
+  const { directoryHandle, filename, openFile, fileIdentity, operations } = cleanup;
+  if (!openFile) {
+    try {
+      await directoryHandle.close();
+    } catch {}
+    return "absent";
+  }
+  const sanitized = await sanitizeAndClose(openFile);
+  const credentialFileState = await cleanedCredentialState(cleanup, sanitized);
+  try {
+    await directoryHandle.close();
+  } catch {}
+  return credentialFileState;
+}
+function assertSecureFileType(fileStat) {
+  if (!fileStat.isFile() || fileStat.isSymbolicLink()) {
+    throw new ProjectCreateEnvError("ENV_FILE_VERIFY_FAILED");
+  }
+}
+function assertSecureOpenFile(fileStat, effectiveUid) {
+  assertSecureFileType(fileStat);
+  if ((fileStat.mode & 511) !== ENV_FILE_MODE || fileStat.uid !== effectiveUid) {
+    throw new ProjectCreateEnvError("ENV_FILE_VERIFY_FAILED");
+  }
+}
+async function openProjectEnvFile(directory, filename, operations) {
+  try {
+    return await operations.openExclusiveAt(directory, filename, ENV_FILE_MODE);
+  } catch (error) {
+    if (fileSystemErrorCode(error) === "EEXIST") {
+      throw new ProjectCreateEnvError("ENV_FILE_EXISTS");
+    }
+    throw error;
+  }
+}
+async function assertDirectoryBinding(path2, directoryHandle, expectedIdentity, operations) {
+  const heldDirectoryStat = await directoryHandle.stat();
+  const currentPathIdentity = await assertSafeParent(path2, operations);
+  assertOwnedTargetParent(heldDirectoryStat, operations.effectiveUid());
+  if (!sameParentIdentity(heldDirectoryStat, expectedIdentity) || !sameParentIdentity(currentPathIdentity, expectedIdentity)) {
+    throw new ProjectCreateEnvError("ENV_FILE_PARENT_INVALID");
+  }
+}
+async function assertPreparedFileBinding(prepared, operations) {
+  if (!prepared.directoryHandle || !prepared.openFile) {
+    throw new ProjectCreateEnvError("ENV_FILE_VERIFY_FAILED");
+  }
+  await assertDirectoryBinding(dirname2(prepared.path), prepared.directoryHandle, prepared.parentIdentity, operations);
+  const openFileStat = await prepared.openFile.stat();
+  const targetStat = await operations.lstatAt(prepared.directoryHandle, prepared.filename);
+  const effectiveUid = operations.effectiveUid();
+  assertSecureOpenFile(openFileStat, effectiveUid);
+  assertSecureOpenFile(targetStat, effectiveUid);
+  if (!sameFileIdentity(openFileStat, prepared.fileIdentity) || !sameFileIdentity(targetStat, prepared.fileIdentity)) {
+    throw new ProjectCreateEnvError("ENV_FILE_VERIFY_FAILED");
+  }
+}
+async function assertCompletedFileBinding(prepared, operations) {
+  if (!prepared.directoryHandle)
+    throw new ProjectCreateEnvError("ENV_FILE_VERIFY_FAILED");
+  await assertDirectoryBinding(dirname2(prepared.path), prepared.directoryHandle, prepared.parentIdentity, operations);
+  const targetStat = await operations.lstatAt(prepared.directoryHandle, prepared.filename);
+  assertSecureOpenFile(targetStat, operations.effectiveUid());
+  if (!sameFileIdentity(targetStat, prepared.fileIdentity)) {
+    throw new ProjectCreateEnvError("ENV_FILE_VERIFY_FAILED");
+  }
+}
+async function discardPreparedProjectEnvFile(prepared, operations = nodeProjectEnvFileOperations) {
+  if (!prepared.directoryHandle)
+    return "absent";
+  const directoryHandle = prepared.directoryHandle;
+  const openFile = prepared.openFile;
+  prepared.directoryHandle = null;
+  prepared.openFile = null;
+  return removeFailedEnvFile({
+    directoryHandle,
+    filename: prepared.filename,
+    openFile,
+    fileIdentity: prepared.fileIdentity,
+    operations
+  });
+}
+async function writeProjectEnvFile(prepared, credentials, operations = nodeProjectEnvFileOperations) {
+  if (!prepared.directoryHandle || !prepared.openFile) {
+    throw new ProjectCreateEnvError("ENV_FILE_WRITE_FAILED");
+  }
+  const directoryHandle = prepared.directoryHandle;
+  const openFile = prepared.openFile;
+  try {
+    await assertPreparedFileBinding(prepared, operations);
+    await openFile.chmod(ENV_FILE_MODE);
+    await assertPreparedFileBinding(prepared, operations);
+    await openFile.writeFile(environmentFileContent(credentials, prepared.environment));
+    await openFile.sync();
+    await assertPreparedFileBinding(prepared, operations);
+    await openFile.close();
+    prepared.openFile = null;
+    await assertCompletedFileBinding(prepared, operations);
+    await directoryHandle.sync();
+    await directoryHandle.close();
+    prepared.directoryHandle = null;
+  } catch (error) {
+    prepared.directoryHandle = null;
+    prepared.openFile = null;
+    const credentialFileState = await removeFailedEnvFile({
+      directoryHandle,
+      filename: prepared.filename,
+      openFile,
+      fileIdentity: prepared.fileIdentity,
+      operations
+    });
+    if (credentialFileState === "unknown") {
+      throw new ProjectCreateEnvError("ENV_FILE_CLEANUP_FAILED", "unknown");
+    }
+    if (error instanceof ProjectCreateEnvError)
+      throw error;
+    throw new ProjectCreateEnvError("ENV_FILE_WRITE_FAILED");
+  }
+}
+function isRecord(candidate) {
+  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
+}
+function decodedJwtPart(encodedPart) {
+  try {
+    const decodedPart = JSON.parse(Buffer.from(encodedPart, "base64url").toString("utf8"));
+    return isRecord(decodedPart) ? decodedPart : null;
+  } catch {
+    return null;
+  }
+}
+function isServiceRoleKey(candidate) {
+  if (typeof candidate !== "string" || !SERVICE_ROLE_KEY.test(candidate))
+    return false;
+  const [encodedHeader, encodedClaims] = candidate.split(".");
+  const jwtHeader = decodedJwtPart(encodedHeader);
+  const jwtClaims = decodedJwtPart(encodedClaims);
+  return jwtHeader?.typ === "JWT" && typeof jwtHeader.alg === "string" && SERVICE_ROLE_ALGORITHMS.has(jwtHeader.alg) && jwtClaims?.role === "service_role" && jwtClaims.iss === "supabase" && typeof jwtClaims.exp === "number" && Number.isFinite(jwtClaims.exp) && jwtClaims.exp > Date.now() / 1000;
+}
+function parsedProjectApiUrl(candidate) {
+  if (typeof candidate !== "string" || candidate.length > 2048)
+    return null;
+  try {
+    return new URL(candidate);
+  } catch {
+    return null;
+  }
+}
+function hasSafeProjectApiUrlShape(parsedUrl) {
+  const loopbackHttp = parsedUrl.protocol === "http:" && ["localhost", "127.0.0.1", "::1", "[::1]"].includes(parsedUrl.hostname);
+  return (parsedUrl.protocol === "https:" || loopbackHttp) && !parsedUrl.username && !parsedUrl.password && !parsedUrl.search && !parsedUrl.hash && (parsedUrl.pathname === "/" || parsedUrl.pathname === "");
+}
+function hasExpectedProjectApiOrigin(parsedUrl, projectRef, expectedApiOrigin) {
+  const hostname = parsedUrl.hostname.toLowerCase();
+  if (expectedApiOrigin)
+    return parsedUrl.origin === expectedApiOrigin;
+  return !parsedUrl.port && hostname.split(".")[0] === projectRef;
+}
+function projectApiUrl(candidate, projectRef, expectedApiOrigin) {
+  const parsedUrl = parsedProjectApiUrl(candidate);
+  if (!parsedUrl || !hasSafeProjectApiUrlShape(parsedUrl))
+    return null;
+  if (!hasExpectedProjectApiOrigin(parsedUrl, projectRef, expectedApiOrigin))
+    return null;
+  return parsedUrl.origin;
+}
+function parseProjectCreateIdentity(responsePayload, expectedApiOrigin) {
+  if (!isRecord(responsePayload) || typeof responsePayload.ref !== "string")
+    return null;
+  if (!PROJECT_REF.test(responsePayload.ref) || !isRecord(responsePayload.api))
+    return null;
+  const apiUrl = projectApiUrl(responsePayload.api.url, responsePayload.ref, expectedApiOrigin);
+  return apiUrl ? { projectRef: responsePayload.ref, apiUrl } : null;
+}
+function parseProjectCreateWithoutCredentials(responsePayload, expectedApiOrigin) {
+  const identity = parseProjectCreateIdentity(responsePayload, expectedApiOrigin);
+  if (!identity || !isRecord(responsePayload))
+    return null;
+  return Object.hasOwn(responsePayload, "credentials") ? null : identity;
+}
+function parseProjectCreateCredentials(responsePayload, expectedApiOrigin, expectedProjectName) {
+  if (!expectedApiOrigin || !expectedProjectName || !isRecord(responsePayload))
+    return null;
+  if (responsePayload.name !== expectedProjectName)
+    return null;
+  const identity = parseProjectCreateIdentity(responsePayload, expectedApiOrigin);
+  if (!identity)
+    return null;
+  if (!isRecord(responsePayload.credentials))
+    return null;
+  const serviceRoleKey = responsePayload.credentials.service_role_key;
+  return isServiceRoleKey(serviceRoleKey) ? { ...identity, serviceRoleKey } : null;
+}
+
 // src/shared/tools/project-cli-tools.ts
 var PROJECT_SERVICE_NAMES = [
   "postgrest",
@@ -28711,6 +29680,10 @@ var AUTH_SERVICE_HOST_SUFFIX = "-auth";
 var SAFE_PROJECT_REF2 = /^[a-z0-9-]{1,20}$/;
 var SAFE_AUTHORITY_PROJECT_REF = /^[A-Za-z0-9_-]{1,20}$/;
 var MAX_SERVICE_CONTROL_MESSAGE_LENGTH = 256;
+var RELEASE_CONTROL_RESPONSE_SCHEMA = "supacloud.cli.release-control.v1";
+var PROJECT_CREATE_OPERATION = "project.create";
+var PROJECT_ENVIRONMENTS = ["test", "production"];
+var DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 var SUPPORTED_PROJECT_SERVICE_ACTIONS = {
   postgrest: ["start", "stop", "restart", "pause", "resume", "status"],
   gotrue: ["start", "stop", "restart"],
@@ -28728,6 +29701,142 @@ function failedProjectServiceResponse(message) {
     isError: true
   };
 }
+function projectCreateReceipt(payload) {
+  return {
+    content: [{ type: "text", text: JSON.stringify({
+      schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
+      ...payload
+    }, null, 2) }]
+  };
+}
+function projectCreateErrorReceipt(payload) {
+  return { ...projectCreateReceipt(payload), isError: true };
+}
+function projectCreateFailure(code, httpStatus) {
+  return projectCreateErrorReceipt({
+    ok: false,
+    operation: PROJECT_CREATE_OPERATION,
+    error: { code, http_status: httpStatus }
+  });
+}
+function projectCreateMutationFailure(response) {
+  const outcomeUnknown = response.transportError || response.status === 408 || response.status >= 500;
+  return outcomeUnknown ? projectCreateFailure("OUTCOME_UNKNOWN", response.transportError ? null : response.status) : projectCreateFailure("HTTP_ERROR", response.status);
+}
+function isCompleteApiHostname(hostname) {
+  if (hostname === "localhost")
+    return true;
+  if (/^(?:\d{1,3}\.){3}\d{1,3}$/.test(hostname)) {
+    return hostname.split(".").every((octet) => Number(octet) <= 255);
+  }
+  if (hostname.startsWith("[") && hostname.endsWith("]"))
+    return true;
+  const labels = hostname.split(".");
+  return labels.length >= 2 && labels.every((label) => DNS_LABEL.test(label));
+}
+function normalizedApiDomain(candidate) {
+  const normalized = candidate?.trim().toLowerCase();
+  if (!normalized || normalized.length > 253 || /[\s/@?#]/.test(normalized))
+    return;
+  try {
+    const parsed = new URL(`https://${normalized}`);
+    const exactHostname = parsed.hostname === normalized && !parsed.port;
+    return exactHostname && isCompleteApiHostname(normalized) ? normalized : undefined;
+  } catch {
+    return;
+  }
+}
+function canonicalProjectApiOrigin(hostname) {
+  const loopback = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+  return new URL(`${loopback ? "http" : "https"}://${hostname}`).origin;
+}
+function expectedProjectApiOrigin(domain, apiDomain) {
+  if (apiDomain) {
+    const normalizedApi = normalizedApiDomain(apiDomain);
+    return normalizedApi ? canonicalProjectApiOrigin(normalizedApi) : undefined;
+  }
+  const normalizedDomain = normalizedApiDomain(domain);
+  if (!normalizedDomain)
+    return;
+  const hostname = normalizedDomain.startsWith("api.") ? normalizedDomain : `api.${normalizedDomain}`;
+  return canonicalProjectApiOrigin(hostname);
+}
+function projectCreateEnvironment(candidate) {
+  return candidate === "test" || candidate === "production" ? candidate : undefined;
+}
+function projectCreateFileFailure(identity, credentialFileState, code, httpStatus) {
+  return projectCreateErrorReceipt({
+    ok: false,
+    operation: PROJECT_CREATE_OPERATION,
+    project_ref: identity.projectRef,
+    api_url: identity.apiUrl,
+    remote_created: true,
+    credential_file_state: credentialFileState,
+    ...credentialFileState === "absent" ? { credentials_written: false } : {},
+    retry_safe: false,
+    error: { code, http_status: httpStatus }
+  });
+}
+async function writeCreatedProjectEnv(preparedEnvFile, credentials, responseStatus, fileOperations) {
+  try {
+    await writeProjectEnvFile(preparedEnvFile, credentials, fileOperations);
+    return null;
+  } catch (error) {
+    const code = error instanceof ProjectCreateEnvError ? error.code : "ENV_FILE_WRITE_FAILED";
+    if (!(error instanceof ProjectCreateEnvError) || error.credentialFileState === "unknown") {
+      return projectCreateFileFailure(credentials, "unknown", code, responseStatus);
+    }
+    return projectCreateFileFailure(credentials, "absent", code, responseStatus);
+  }
+}
+function successfulProjectCreate(identity, preparedEnvFile) {
+  return projectCreateReceipt({
+    ok: true,
+    operation: PROJECT_CREATE_OPERATION,
+    project_ref: identity.projectRef,
+    api_url: identity.apiUrl,
+    credentials_written: Boolean(preparedEnvFile),
+    ...preparedEnvFile ? {
+      env_file: preparedEnvFile.path,
+      env_file_scope: "project_application"
+    } : {}
+  });
+}
+function invalidProjectCreateResponse(responsePayload, responseStatus, expectedApiOrigin) {
+  const identity = parseProjectCreateIdentity(responsePayload, expectedApiOrigin);
+  return identity ? projectCreateFileFailure(identity, "absent", "INVALID_RESPONSE", responseStatus) : projectCreateFailure("OUTCOME_UNKNOWN", responseStatus);
+}
+function projectCreateWithoutEnvResponse(response, expectedApiOrigin) {
+  const identity = parseProjectCreateWithoutCredentials(response.data, expectedApiOrigin);
+  return identity ? successfulProjectCreate(identity) : invalidProjectCreateResponse(response.data, response.status, expectedApiOrigin);
+}
+async function discardProjectEnvReservation(preparedEnvFile, response, expectedApiOrigin, fileOperations) {
+  const credentialFileState = await discardPreparedProjectEnvFile(preparedEnvFile, fileOperations);
+  if (credentialFileState === "absent")
+    return null;
+  const identity = parseProjectCreateIdentity(response.data, expectedApiOrigin);
+  return identity ? projectCreateFileFailure(identity, "unknown", "ENV_FILE_CLEANUP_FAILED", response.status) : projectCreateFailure("ENV_FILE_CLEANUP_FAILED", response.status);
+}
+async function projectCreateWithEnvResponse(response, preparedEnvFile, binding, fileOperations) {
+  const credentials = parseProjectCreateCredentials(response.data, binding.apiOrigin, binding.projectName);
+  if (!credentials) {
+    const cleanupFailure = await discardProjectEnvReservation(preparedEnvFile, response, binding.apiOrigin, fileOperations);
+    return cleanupFailure ?? invalidProjectCreateResponse(response.data, response.status, binding.apiOrigin);
+  }
+  const writeFailure = await writeCreatedProjectEnv(preparedEnvFile, credentials, response.status, fileOperations);
+  return writeFailure ?? successfulProjectCreate(credentials, preparedEnvFile);
+}
+async function projectCreateResponse(response, preparedEnvFile, binding, fileOperations) {
+  if (!response.ok || response.status !== 201) {
+    if (preparedEnvFile) {
+      const cleanupFailure = await discardProjectEnvReservation(preparedEnvFile, response, binding.apiOrigin, fileOperations);
+      if (cleanupFailure)
+        return cleanupFailure;
+    }
+    return response.ok ? projectCreateFailure("OUTCOME_UNKNOWN", response.status) : projectCreateMutationFailure(response);
+  }
+  return preparedEnvFile ? projectCreateWithEnvResponse(response, preparedEnvFile, binding, fileOperations) : projectCreateWithoutEnvResponse(response, binding.apiOrigin);
+}
 function failedProjectServiceHttpResponse(response) {
   if (response.status === 409 && isRecordPayload(response.data) && response.data.code === AUTH_RUNTIME_MANAGED_BY_OWNER && typeof response.data.authority_project_ref === "string" && SAFE_AUTHORITY_PROJECT_REF.test(response.data.authority_project_ref)) {
     const ownerBoundary = {
@@ -28864,7 +29973,8 @@ function resolveRef(refFromArgs, defaultRef) {
     throw new Error("'ref' is required for this action");
   return ref;
 }
-function registerAdminProjectCliTools(server, http) {
+function registerAdminProjectCliTools(server, http, options = {}) {
+  const fileOperations = options.projectEnvFileOperations;
   server.tool("project", "Platform-level project lifecycle management. Actions: list, create, get, delete, pause, restore, restart, settings, update_settings, api_keys, health, logs, tasks, services, service_control", {
     action: withDescription(stringEnum([
       "list",
@@ -28891,6 +30001,8 @@ function registerAdminProjectCliTools(server, http) {
     api_domain: optional(Type.String(), "[create] Explicit API domain"),
     auth_domain: optional(Type.String(), "[create] Explicit Auth/OIDC domain"),
     studio_domain: optional(Type.String(), "[create] Explicit Studio domain"),
+    env_file: optional(Type.String(), "[create] Linux-only absolute new application env path for parent-bound service-role delivery (0600)"),
+    environment: optional(stringEnum(PROJECT_ENVIRONMENTS), "[create] Required with env_file; application credential environment"),
     settings: optional(Type.Record(Type.String(), Type.Unknown()), "[update_settings] Config fields to update"),
     log_type: optional(stringEnum(["all", "auth", "database", "api"]), "[logs] Filter by service"),
     service: optional(stringEnum(PROJECT_SERVICE_NAMES), "[service_control] Canonical service name"),
@@ -28905,6 +30017,8 @@ function registerAdminProjectCliTools(server, http) {
     api_domain,
     auth_domain,
     studio_domain,
+    env_file,
+    environment,
     settings,
     log_type,
     service,
@@ -28918,6 +30032,23 @@ function registerAdminProjectCliTools(server, http) {
       case "create": {
         if (!name)
           throw new Error("'name' is required for create");
+        const boundApiOrigin = expectedProjectApiOrigin(domain, api_domain);
+        if (env_file && !boundApiOrigin) {
+          return projectCreateFailure("API_DOMAIN_BINDING_REQUIRED", null);
+        }
+        let preparedEnvFile;
+        if (env_file) {
+          const boundEnvironment = projectCreateEnvironment(environment);
+          if (!boundEnvironment) {
+            return projectCreateFailure("ENVIRONMENT_BINDING_REQUIRED", null);
+          }
+          try {
+            preparedEnvFile = await prepareProjectEnvFile(env_file, boundEnvironment, fileOperations);
+          } catch (error) {
+            const code = error instanceof ProjectCreateEnvError ? error.code : "ENV_FILE_PATH_INVALID";
+            return projectCreateFailure(code, null);
+          }
+        }
         const createRequest = {
           name,
           region: region || "local",
@@ -28931,8 +30062,9 @@ function registerAdminProjectCliTools(server, http) {
           createRequest.auth_domain = auth_domain;
         if (studio_domain)
           createRequest.studio_domain = studio_domain;
-        text = ok(await http.post("/v1/projects", createRequest));
-        break;
+        if (preparedEnvFile)
+          createRequest.credential_delivery = "response";
+        return projectCreateResponse(await http.post("/v1/projects", createRequest), preparedEnvFile, { projectName: name, apiOrigin: boundApiOrigin }, fileOperations);
       }
       case "get":
         text = ok(await http.get(`/v1/projects/${resolveRef(ref)}`));
@@ -29340,7 +30472,7 @@ Actions: routes, upsert_route, update_route, delete_route, config, get_certifica
 // package.json
 var package_default = {
   name: "@supacloud/admin",
-  version: "0.9.0",
+  version: "0.10.0",
   description: "Platform administration CLI for SupaCloud operators",
   type: "module",
   main: "./dist/index.js",
@@ -29381,31 +30513,6 @@ var package_default = {
 };
 
 // src/index.ts
-var platformActionSchema = stringEnum([
-  "metrics",
-  "list_backups",
-  "create_backup",
-  "network",
-  "update_network",
-  "list_orgs",
-  "get_org"
-]);
-var sshActionSchema = stringEnum([
-  "ping",
-  "setup",
-  "install",
-  "upgrade",
-  "versions",
-  "diagnose",
-  "exec",
-  "troubleshoot",
-  "container_logs",
-  "tenant_manage",
-  "tenant_list",
-  "tenant_inspect",
-  "tenant_diagnose",
-  "tenant_migrate"
-]);
 function captureTools(register) {
   const tools = {};
   const server = {
@@ -29420,6 +30527,31 @@ function captureTools(register) {
   register(server);
   return tools;
 }
+function unavailableTool(schema, message) {
+  return {
+    schema,
+    callback: async () => ({
+      isError: true,
+      content: [{ type: "text", text: message }]
+    })
+  };
+}
+function unavailableAdminSchemas() {
+  const schemaOnlyHttp = {};
+  return {
+    project: captureTools((server) => registerAdminProjectCliTools(server, schemaOnlyHttp)).project.schema,
+    platform: captureTools((server) => registerAdvancedTools(server, schemaOnlyHttp)).platform.schema,
+    gateway: captureTools((server) => registerGatewayTools(server, schemaOnlyHttp)).gateway.schema,
+    ssh: captureTools((server) => registerSshTools(server, {})).ssh.schema
+  };
+}
+function registerUnavailableAdminTools(tools) {
+  const schemas = unavailableAdminSchemas();
+  tools.project = unavailableTool(schemas.project, "⚠️ Project lifecycle commands require SUPACLOUD_API_URL and SUPACLOUD_API_TOKEN.");
+  tools.platform = unavailableTool(schemas.platform, "⚠️ Platform commands require SUPACLOUD_API_URL and SUPACLOUD_API_TOKEN.");
+  tools.ssh = unavailableTool(schemas.ssh, "⚠️ SSH commands require SUPACLOUD_HOST, SSH credentials, and SUPACLOUD_SSH_HOST_FINGERPRINT.");
+  tools.gateway = unavailableTool(schemas.gateway, "⚠️ Gateway / Caddy commands require SUPACLOUD_API_URL and SUPACLOUD_API_TOKEN (admin privileges).");
+}
 function printHelp(context = resolveSupaCloudContext()) {
   console.error(`
 ╔═══════════════════════════════════════════════════════════╗
@@ -29429,11 +30561,20 @@ function printHelp(context = resolveSupaCloudContext()) {
 
 USAGE
 
-  supacloud-admin <module> <action> [--flags]
-  supacloud-admin status
+  supacloud-admin [global flags] <module> <action> [--flags]
+  supacloud-admin [global flags] status
   supacloud-admin --help
   supacloud-admin --version
 
+GLOBAL FLAGS
+
+  --env <name>                    Load .env.supacloud.<name> from the current directory.
+  --env-file <path>               Load an exact file that declares SUPACLOUD_ENV.
+  --confirm-production <target>   Confirm the exact production project or platform target.
+
+  Global flags may appear before or after the command. --env and --env-file are
+  mutually exclusive, and a selected source is never mixed with another source.
+
 EXPECTED CONTEXT
 
   Platform commands typically rely on:
@@ -29442,17 +30583,25 @@ EXPECTED CONTEXT
     SUPACLOUD_SSH_HOST_FINGERPRINT=SHA256:...
     SUPACLOUD_API_URL
     SUPACLOUD_API_TOKEN
+    SUPACLOUD_ENV
+    SUPACLOUD_READ_ONLY
 
+  Environment: ${context.environment || "(unclassified)"}
+  Context source: ${context.source}${context.sourcePath ? ` (${context.sourcePath})` : ""}
   Detected host: ${context.host || "(none)"}
   Detected API URL: ${context.apiUrl || "(none)"}
 
+  SUPACLOUD_READ_ONLY=true blocks every remote write. Production project writes
+  require the exact project ref. Production writes without a project ref use
+  platform:<API host> or host:<SSH host[:port]> as the confirmation target.
+
 EXAMPLES
 
   supacloud-admin status
   supacloud-admin ssh ping
   supacloud-admin ssh versions
   supacloud-admin ssh install --public_domain api.example.com --studio_domain studio.example.com
-  supacloud-admin project create --name my-app --domain example.com
+  supacloud-admin project create --name my-app --domain example.com --env_file /secure/path/.env.project-credentials.test --environment test
   supacloud-admin project list
   supacloud-admin project services --ref abc123
   supacloud-admin project service_control --ref abc123 --service gotrue --service_action stop
@@ -29463,7 +30612,18 @@ EXAMPLES
   supacloud-admin gateway rebuild --ref abc123 --clean
 `);
 }
-function createAdminTools(context = resolveSupaCloudContext()) {
+function authorizedToolMap(tools, context, confirmProduction) {
+  validateExecutionPolicyCoverage(tools);
+  for (const [moduleName, tool] of Object.entries(tools)) {
+    const callback = tool.callback;
+    tool.callback = async (args) => {
+      authorizeExecution(moduleName, args, { context, confirmProduction });
+      return callback(args);
+    };
+  }
+  return tools;
+}
+function createAdminTools(context = resolveSupaCloudContext(), confirmProduction) {
   const tools = {
     status: {
       schema: {},
@@ -29478,65 +30638,17 @@ function createAdminTools(context = resolveSupaCloudContext()) {
               hasApiToken: Boolean(context.apiToken),
               hasSshKey: Boolean(context.sshKey),
               hasSshHostFingerprint: Boolean(context.sshHostFingerprint),
-              source: context.source
+              environment: context.environment || null,
+              production: context.production,
+              readOnly: context.readOnly,
+              source: { kind: context.source, path: context.sourcePath }
             }, null, 2)
           }
         ]
       })
     }
   };
-  const registerAdminHelp = () => {
-    const projectHelpTool = captureTools((server) => registerAdminProjectCliTools(server, {})).project;
-    tools.project = {
-      schema: projectHelpTool.schema,
-      callback: async () => ({
-        isError: true,
-        content: [
-          {
-            type: "text",
-            text: "⚠️ Project lifecycle commands require SUPACLOUD_API_URL and SUPACLOUD_API_TOKEN."
-          }
-        ]
-      })
-    };
-    tools.platform = {
-      schema: { action: platformActionSchema },
-      callback: async () => ({
-        isError: true,
-        content: [
-          {
-            type: "text",
-            text: "⚠️ Platform commands require SUPACLOUD_API_URL and SUPACLOUD_API_TOKEN."
-          }
-        ]
-      })
-    };
-    tools.ssh = {
-      schema: { action: sshActionSchema },
-      callback: async () => ({
-        isError: true,
-        content: [
-          {
-            type: "text",
-            text: "⚠️ SSH commands require SUPACLOUD_HOST, SSH credentials, and SUPACLOUD_SSH_HOST_FINGERPRINT."
-          }
-        ]
-      })
-    };
-    tools.gateway = {
-      schema: { action: Type.String() },
-      callback: async () => ({
-        isError: true,
-        content: [
-          {
-            type: "text",
-            text: "⚠️ Gateway / Caddy commands require SUPACLOUD_API_URL and SUPACLOUD_API_TOKEN (admin privileges)."
-          }
-        ]
-      })
-    };
-  };
-  registerAdminHelp();
+  registerUnavailableAdminTools(tools);
   if (context.host && context.sshHostFingerprint) {
     try {
       const ssh = new SshTransport({
@@ -29551,7 +30663,7 @@ function createAdminTools(context = resolveSupaCloudContext()) {
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       tools.ssh = {
-        schema: { action: sshActionSchema },
+        schema: tools.ssh.schema,
         callback: async () => ({
           isError: true,
           content: [{
@@ -29563,7 +30675,7 @@ function createAdminTools(context = resolveSupaCloudContext()) {
     }
   } else if (context.host) {
     tools.ssh = {
-      schema: { action: sshActionSchema },
+      schema: tools.ssh.schema,
       callback: async () => ({
         isError: true,
         content: [{
@@ -29614,31 +30726,38 @@ function createAdminTools(context = resolveSupaCloudContext()) {
       })
     };
   }
-  return tools;
+  return authorizedToolMap(tools, context, confirmProduction);
 }
 async function main() {
-  const args = process.argv.slice(2);
-  if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
-    printHelp();
-    process.exit(0);
-  }
-  if (args.length === 1 && args[0] === "--version") {
+  const rawArgs = process.argv.slice(2);
+  if (rawArgs.length === 1 && rawArgs[0] === "--version") {
     console.log(package_default.version);
     return;
   }
-  const cliTools = createAdminTools();
+  const globalOptions = parseGlobalAdminOptions(rawArgs);
+  const args = globalOptions.args;
+  const context = resolveSupaCloudContext(process.env, process.cwd(), {
+    environmentName: globalOptions.environmentName,
+    envFile: globalOptions.envFile
+  });
+  if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
+    printHelp(context);
+    process.exitCode = 0;
+    return;
+  }
+  const cliTools = createAdminTools(context, globalOptions.confirmProduction);
   if (args.length === 1 && cliTools[args[0]]) {
-    const result = await cliTools[args[0]].callback({});
-    if (result?.content && Array.isArray(result.content)) {
-      for (const chunk of result.content) {
+    const toolResponse = await cliTools[args[0]].callback({});
+    if (toolResponse?.content && Array.isArray(toolResponse.content)) {
+      for (const chunk of toolResponse.content) {
         if (chunk.type === "text") {
           console.log(chunk.text);
         }
       }
     } else {
-      console.log(JSON.stringify(result, null, 2));
+      console.log(JSON.stringify(toolResponse, null, 2));
     }
-    if (cliToolResultIsError(result))
+    if (cliToolResultIsError(toolResponse))
       process.exitCode = 1;
     return;
   }
@@ -29648,7 +30767,7 @@ function isDirectRun() {
   if (!process.argv[1])
     return false;
   try {
-    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(resolve2(process.argv[1]));
+    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(resolve3(process.argv[1]));
   } catch {
     return false;
   }