@supacloud/cli 0.103.3 → 0.103.6

package/dist/index.js

@@ -10960,7 +10960,7 @@ function formatDeploymentEvidence(evidence) {
   return [
     `DEPLOYMENT ${evidence.scope.project_ref}/${evidence.scope.application_id}/${evidence.scope.environment_id}`,
     `  status:     ${report.status}`,
-    ...report.status !== evidence.status ? [`  recorded status: ${evidence.status} (additional proof missing)`] : [],
+    ...report.status !== evidence.status ? [`  recorded status: ${evidence.status} (customer assessment differs)`] : [],
     `  manifest:   ${evidence.source.manifest_sha256.slice(0, 12)}`,
     `  database:   ${evidence.database.provider} ${evidence.database.version} (${evidence.database.topology})`,
     `  activation: ${evidence.activation.activation_id}`,
@@ -10988,7 +10988,7 @@ function summarizeDeploymentEvidence(value) {
   for (const component of evidence.components) {
     observe(component.name, component.status, component.checked_at !== null && component.health_check !== null, "Inspect this component's health and logs for the recorded activation before changing or restarting it.");
   }
-  observe("database.migration", evidence.database.migration.status, evidence.database.migration.compatibility === "verified" && evidence.database.migration.inventory_sha256 !== null, "Read the migration inventory and compare its digest; do not reapply an unconfirmed migration.");
+  observe("database.migration", evidence.database.migration.compatibility === "failed" ? "failed" : evidence.database.migration.status, evidence.database.migration.compatibility === "verified" && evidence.database.migration.inventory_sha256 !== null, "Read the migration inventory and compare its digest; do not reapply an unconfirmed migration.");
   observe("database.backup", evidence.database.backup.status, evidence.database.backup.latest_success_at !== null && evidence.database.backup.freshness_seconds !== null, "Read backup inventory and freshness for this project; a successful deployment is not a backup.");
   observe("database.recovery", evidence.database.recovery.status, evidence.database.recovery.drill_id !== null && evidence.database.recovery.rpo_seconds !== null && evidence.database.recovery.rto_seconds !== null, "Obtain a separate approved restore drill and verify data, permissions and storage; never restore automatically.");
   observe("health", evidence.health.status, evidence.health.checked_at !== null, "Read back this activation's readiness; process health alone does not prove a business operation.");
@@ -10997,9 +10997,10 @@ function summarizeDeploymentEvidence(value) {
   if (evidence.rollback.result !== null) {
     observe("code-rollback.result", evidence.rollback.result, true, "Read back the rollback activation and authenticated smoke before another mutation.");
   }
+  const assessment = issues.some((issue) => issue.status === "failed") || evidence.status === "failed" ? "failed" : issues.some((issue) => issue.status === "unknown") || evidence.status === "unknown" ? "unknown" : issues.length > 0 || evidence.status === "incomplete" ? "incomplete" : "confirmed";
   return {
     version: 1,
-    status: evidence.status === "confirmed" && issues.length > 0 ? "incomplete" : evidence.status,
+    status: assessment,
     recordedStatus: evidence.status,
     scope: evidence.scope,
     recordedAt: evidence.recorded_at,
@@ -15003,7 +15004,7 @@ Actions: status, list_buckets, get_bucket, create_bucket, update_bucket, delete_
 }
 
 // src/shared/tools/advanced-tools.ts
-import { createHash as createHash4, timingSafeEqual } from "node:crypto";
+import { createHash as createHash5, timingSafeEqual } from "node:crypto";
 import {
   closeSync,
   constants as fsConstants,
@@ -15013,14 +15014,101 @@ import {
   mkdirSync,
   mkdtempSync,
   openSync,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   readdirSync as readdirSync3,
   rmSync,
   statSync as statSync4,
   writeFileSync
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename as basename5, join as join5, relative as relative2, resolve as resolve6, sep as sep2 } from "node:path";
+import { basename as basename5, join as join5, relative as relative2, resolve as resolve7, sep as sep2 } from "node:path";
+
+// src/shared/tools/function-aot.ts
+import { execFile } from "node:child_process";
+import { createHash as createHash4 } from "node:crypto";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { dirname as dirname3, resolve as resolve6 } from "node:path";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var runner = `
+import { pathToFileURL } from "node:url";
+import { basename, dirname } from "node:path";
+const [entry, appEntry, outfile, minify] = Bun.argv.slice(1);
+const plugin = await import(import.meta.resolve("elysia/plugin/aot/bun", pathToFileURL(appEntry).href));
+const result = await Bun.build({
+  entrypoints: [entry], outdir: dirname(outfile), naming: { entry: basename(outfile) },
+  target: "bun", format: "esm", splitting: false, metafile: true,
+  minify: minify === "true", env: "disable",
+  plugins: [plugin.aot(appEntry, {
+    strip: false, production: false,
+    registerFrom: Bun.fileURLToPath(import.meta.resolve("elysia", pathToFileURL(appEntry).href)),
+    reconstructFrom: Bun.fileURLToPath(import.meta.resolve("elysia/reconstruct", pathToFileURL(appEntry).href))
+  }), {
+    name: "resolve-aot-manifest-dependencies",
+    setup(build) {
+      build.onResolve({ filter: /^(elysia|typebox)(\\/.*)?$/ }, ({ path }) => ({
+        path: Bun.fileURLToPath(import.meta.resolve(path, pathToFileURL(appEntry).href))
+      }));
+    }
+  }]
+});
+if (!result.success) throw new Error(result.logs.map(log => log.message).join("\\n"));
+if (!Object.keys(result.metafile.inputs).some(input => input.includes("elysia-aot") && input.endsWith("manifest"))) {
+  throw new Error("AOT app entry is not in the bundle graph; compiled manifest was not injected");
+}
+if (result.outputs.length !== 1) throw new Error("AOT requires a single JavaScript bundle without sidecar assets");
+await Bun.write(outfile, await result.outputs[0].text());
+process.exit(0);
+`;
+function validateFunctionAot(args) {
+  if (args.aot !== undefined && args.action !== "deploy") {
+    throw new Error("'--aot' is only supported for 'deploy'");
+  }
+  if (args["aot-entry"] !== undefined && args.aot !== true) {
+    throw new Error("'--aot-entry' requires '--aot'");
+  }
+  if (args.aot !== true)
+    return;
+  if (args.framework !== "elysia")
+    throw new Error("'--aot' requires 'framework=elysia'");
+  if (typeof args.path !== "string" || args.code !== undefined || args["prebundled-path"] !== undefined) {
+    throw new Error("'--aot' requires '--path' without '--code' or '--prebundled-path'");
+  }
+}
+async function buildFunctionAot(entrypoint, outfile, options = {}) {
+  const env = {};
+  for (const key of ["PATH", "HOME", "TMPDIR", "TMP", "TEMP", "SystemRoot"]) {
+    if (process.env[key] !== undefined)
+      env[key] = process.env[key];
+  }
+  env.NODE_ENV = "production";
+  try {
+    const { stderr } = await execFileAsync("bun", [
+      "--no-env-file",
+      "--eval",
+      runner,
+      resolve6(entrypoint),
+      resolve6(options.appEntry ?? entrypoint),
+      outfile,
+      String(options.minify === true)
+    ], {
+      cwd: dirname3(entrypoint),
+      env,
+      timeout: 120000,
+      killSignal: "SIGKILL",
+      maxBuffer: 1024 * 1024
+    });
+    if (stderr)
+      process.stderr.write(stderr);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Local Elysia AOT build failed (Bun and the app's Elysia AOT plugin are required): ${message}`);
+  }
+  const code = readFileSync5(outfile, "utf8");
+  if (!code.trim())
+    throw new Error("AOT build produced an empty bundle");
+  return { code, prebundled: true, expectedSha256: createHash4("sha256").update(code).digest("hex") };
+}
 
 // src/shared/tools/edge-function-response.ts
 var CANONICAL_VERSION_PATTERN = /^(?:0|[1-9][0-9]*)$/;
@@ -15162,6 +15250,8 @@ function projectedFunctionIdentity(payload, expectedProjectRef, expectedSlug) {
   const response = objectRecord(payload);
   if (!response || response.project_ref !== expectedProjectRef || response.slug !== expectedSlug || response.active_version !== "absent" && !canonicalVersion(response.active_version) || !validObservedFunctionActivationId(response.activation_id) || typeof response.verify_jwt !== "boolean" || !stringRoutes(response.background_routes))
     return null;
+  if (response.bytecode !== undefined && !["off", "auto", "required"].includes(response.bytecode))
+    return null;
   const optionalFields = optionalConfigFields(response);
   if (!optionalFields || !coherentFunctionVersion(response.active_version, optionalFields.version))
     return null;
@@ -15177,6 +15267,7 @@ function projectedFunctionIdentity(payload, expectedProjectRef, expectedSlug) {
     slug: expectedSlug,
     active_version: response.active_version,
     verify_jwt: response.verify_jwt,
+    ...response.bytecode === undefined ? {} : { bytecode: response.bytecode },
     background_routes: response.background_routes,
     ...framework === undefined ? {} : { framework },
     ...optionalFields,
@@ -15194,6 +15285,10 @@ function configMatchesExpectation(response, expected) {
   }
   if (response.framework !== undefined && !FUNCTION_FRAMEWORKS.includes(response.framework))
     return false;
+  if (response.bytecode !== undefined && !["off", "auto", "required"].includes(response.bytecode))
+    return false;
+  if (expected.bytecode !== undefined && response.bytecode !== expected.bytecode)
+    return false;
   if (expected.verify_jwt !== undefined && response.verify_jwt !== expected.verify_jwt)
     return false;
   if (expected.framework !== undefined && response.framework !== expected.framework)
@@ -15223,6 +15318,7 @@ function confirmedFunctionConfigMutation(payload, expectation) {
     verify_jwt: response.verify_jwt,
     background_routes: response.background_routes,
     ...response.framework === undefined ? {} : { framework: response.framework },
+    ...response.bytecode === undefined ? {} : { bytecode: response.bytecode },
     ...optionalFields,
     ...capabilities === undefined ? {} : { capabilities },
     ...limits === undefined ? {} : { limits }
@@ -15320,13 +15416,13 @@ function scaffoldFunction(pathArg, slug, framework) {
   if (typeof framework !== "string" || !FUNCTION_FRAMEWORKS2.includes(framework)) {
     throw new Error("'framework' required for 'scaffold'");
   }
-  const target = resolve6(typeof pathArg === "string" ? pathArg : join5("supabase", "functions", slug));
+  const target = resolve7(typeof pathArg === "string" ? pathArg : join5("supabase", "functions", slug));
   if (existsSync5(target))
     throw new Error(`Scaffold target already exists: ${target}`);
   const files = scaffoldFiles(framework, slug);
   for (const [relativePath, contents] of Object.entries(files)) {
     const destination = join5(target, relativePath);
-    mkdirSync(resolve6(destination, ".."), { recursive: true });
+    mkdirSync(resolve7(destination, ".."), { recursive: true });
     writeFileSync(destination, contents, { flag: "wx" });
   }
   return JSON.stringify({ success: true, framework, path: target, files: Object.keys(files) }, null, 2);
@@ -15364,17 +15460,17 @@ function assertExpectedSha256(bytes, expectedSha256) {
   if (!SHA256_HEX_PATTERN.test(expectedSha256)) {
     throw new Error("'--expected-sha256' must be a lowercase 64-character SHA-256");
   }
-  const actualDigest = createHash4("sha256").update(bytes).digest();
+  const actualDigest = createHash5("sha256").update(bytes).digest();
   const expectedDigest = Buffer.from(expectedSha256, "hex");
   if (!timingSafeEqual(actualDigest, expectedDigest)) {
     throw new Error("Prebundled file SHA-256 does not match --expected-sha256");
   }
 }
 function readVerifiedPrebundledCode(pathArg, expectedSha256) {
-  const descriptor = openSync(resolve6(pathArg), fsConstants.O_RDONLY | fsConstants.O_NONBLOCK);
+  const descriptor = openSync(resolve7(pathArg), fsConstants.O_RDONLY | fsConstants.O_NONBLOCK);
   try {
     const identityBeforeRead = openFileIdentity(descriptor);
-    const bytes = readFileSync5(descriptor);
+    const bytes = readFileSync6(descriptor);
     const identityAfterRead = openFileIdentity(descriptor);
     if (BigInt(bytes.byteLength) !== identityBeforeRead.size || !sameOpenFile(identityBeforeRead, identityAfterRead)) {
       throw new Error("Prebundled file changed while it was being read");
@@ -15408,7 +15504,7 @@ function readBundleDirectory(root, directory = root) {
     }
     if (!entryState.isFile())
       throw new Error(`Bundle directory must contain only regular files: ${bundlePath}`);
-    files[bundlePath] = verifiedUtf8Code(readFileSync5(entryPath));
+    files[bundlePath] = verifiedUtf8Code(readFileSync6(entryPath));
   }
   return files;
 }
@@ -15420,7 +15516,7 @@ function preparedBundleFiles(args) {
   }
   if (typeof bundleDirectory !== "string")
     return files;
-  const resolvedDirectory = resolve6(bundleDirectory);
+  const resolvedDirectory = resolve7(bundleDirectory);
   const rootState = lstatSync(resolvedDirectory);
   if (rootState.isSymbolicLink() || !rootState.isDirectory()) {
     throw new Error("'--bundle-dir' must be a regular directory and must not be a symlink");
@@ -15501,6 +15597,17 @@ async function preparedDeployCode(args) {
     return { code: codeArg, prebundled: false };
   if (typeof pathArg !== "string")
     throw new Error("Function deploy source is invalid");
+  if (args.aot === true) {
+    const directory = mkdtempSync(join5(tmpdir(), "supacloud-function-aot-"));
+    try {
+      return await buildFunctionAot(resolveEntrypoint(pathArg), join5(directory, "index.js"), {
+        ...typeof args["aot-entry"] === "string" ? { appEntry: args["aot-entry"] } : {},
+        minify: args.minify === true
+      });
+    } finally {
+      rmSync(directory, { recursive: true, force: true });
+    }
+  }
   return bundledDeployCode(pathArg);
 }
 async function bundledDeployCode(pathArg) {
@@ -15522,7 +15629,7 @@ function rejectActionSpecificFlags(action, args) {
   }
 }
 function resolveEntrypoint(pathArg) {
-  const resolved = resolve6(pathArg);
+  const resolved = resolve7(pathArg);
   const stat = statSync4(resolved);
   if (!stat.isDirectory())
     return resolved;
@@ -15800,6 +15907,10 @@ function confirmedFunctionConfig(payload, expected) {
     return false;
   if (expected.framework !== undefined && response.framework !== expected.framework)
     return false;
+  if (response.bytecode !== undefined && response.bytecode !== "off" && response.bytecode !== "auto" && response.bytecode !== "required")
+    return false;
+  if (expected.bytecode !== undefined && response.bytecode !== expected.bytecode)
+    return false;
   if (expected.background_routes !== undefined) {
     if (!Array.isArray(response.background_routes))
       return false;
@@ -15830,7 +15941,7 @@ function functionSourceOutput(slug, sourceCode, output) {
   if (!output) {
     return { content: [{ type: "text", text: JSON.stringify({ code: sourceCode }, null, 2) }] };
   }
-  const outputPath = resolve6(output);
+  const outputPath = resolve7(output);
   writeFileSync(outputPath, sourceCode, { flag: "wx" });
   return {
     content: [{
@@ -15914,6 +16025,7 @@ function confirmedFunctionMutation(expectation, payload) {
     activeVersion,
     activationId,
     verifyJwt: config.verify_jwt,
+    ...config.bytecode === undefined ? {} : { bytecode: config.bytecode },
     ...framework === undefined ? {} : { framework },
     ...config.capabilities === undefined ? {} : { capabilities: config.capabilities },
     ...config.limits === undefined ? {} : { limits: config.limits }
@@ -15935,6 +16047,7 @@ function functionMutationResponse(expectation, response) {
     active_version: confirmed.activeVersion,
     version: confirmed.activeVersion,
     verify_jwt: confirmed.verifyJwt,
+    ...confirmed.bytecode === undefined ? {} : { bytecode: confirmed.bytecode },
     ...confirmed.framework === undefined ? {} : { framework: confirmed.framework },
     ...confirmed.capabilities === undefined ? {} : { capabilities: confirmed.capabilities },
     ...confirmed.limits === undefined ? {} : { limits: confirmed.limits }
@@ -16013,7 +16126,10 @@ Actions: list, get_config, deploy, deploy_bundle, config, source, activate, dele
     "bundle-dir": optional(String2(), "[deploy_bundle] Local self-contained UTF-8 bundle directory; excludes node_modules, .git, AppleDouble, symlinks, and special files"),
     entrypoint: optional(String2(), "[deploy_bundle] Entrypoint file (default: index.ts)"),
     minify: optional(Boolean2(), "[deploy/deploy_bundle] Minify bundle"),
+    aot: optional(Boolean2(), "[deploy] Experimental: execute trusted local Elysia initialization to precompile before uploading; off by default"),
+    "aot-entry": optional(String2(), "[deploy --aot] Module exporting the Elysia app (defaults to path)"),
     verify_jwt: optional(Boolean2(), "[deploy/deploy_bundle/config] Set JWT verification for this function"),
+    bytecode: optional(withDescription(stringEnum2(["off", "auto", "required"]), "[deploy/deploy_bundle/config] Generate Bun bytecode during Edge Runtime preheat")),
     background_routes: withDescription(backgroundRoutesSchema, "[deploy/deploy_bundle/config] Background route paths; pass comma-separated or JSON array in CLI"),
     framework: optional(withDescription(stringEnum2(["fetch", "elysia", "hono", "sveltekit-function"]), "[deploy/deploy_bundle/config/scaffold] Fetch framework adapter profile")),
     capabilities: optional(functionCapabilitiesSchema, "[deploy/deploy_bundle/config] Host capabilities: secrets, outbound_hosts, bindings, background"),
@@ -16023,6 +16139,13 @@ Actions: list, get_config, deploy, deploy_bundle, config, source, activate, dele
     "expected-active-version": withDescription(expectedActiveVersionSchema, "[deploy/deploy_bundle/activate] Required current active version, or 'absent' when none exists"),
     "expected-activation-id": withDescription(expectedActivationIdSchema, "[deploy/deploy_bundle/config/activate/delete] Required activation ID from list, or 'legacy' for a new or legacy function")
   }, async (args) => {
+    if (args.aot === true && options.readOnly) {
+      return {
+        isError: true,
+        content: [{ type: "text", text: "⚠️ Edge Function AOT deployment blocked in read-only mode." }]
+      };
+    }
+    validateFunctionAot(args);
     if (args.action === "activate")
       return activateFunctionVersion(http, args, options.readOnly);
     if (args.action === "scaffold") {
@@ -16037,6 +16160,7 @@ Actions: list, get_config, deploy, deploy_bundle, config, source, activate, dele
       entrypoint,
       minify,
       verify_jwt,
+      bytecode,
       background_routes,
       framework,
       capabilities,
@@ -16060,6 +16184,7 @@ Actions: list, get_config, deploy, deploy_bundle, config, source, activate, dele
     } : undefined;
     const functionConfig = () => ({
       ...typeof verify_jwt === "boolean" ? { verify_jwt } : {},
+      ...bytecode === undefined ? {} : { bytecode },
       ...Array.isArray(background_routes) ? { background_routes } : {},
       ...framework === undefined ? {} : { framework },
       ...capabilities === undefined ? {} : { capabilities },
@@ -16368,13 +16493,13 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status}): ${JSON.stringif
 }
 
 // src/shared/tools/frontend-release-control.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { constants as fsConstants2 } from "node:fs";
 import { open as open2 } from "node:fs/promises";
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 
 // src/shared/mutation-protocol.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 var MUTATION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/;
 var OPERATION_PATTERN = /^[a-z0-9][a-z0-9._:-]{0,127}$/;
@@ -16453,7 +16578,7 @@ function stableStringifyNode(jsonValue) {
 }
 function mutationRequestFingerprint(normalizedRequest) {
   assertCanonicalJsonNode(normalizedRequest, new WeakSet, 0);
-  return createHash5("sha256").update(stableStringifyNode(normalizedRequest)).digest("hex");
+  return createHash6("sha256").update(stableStringifyNode(normalizedRequest)).digest("hex");
 }
 function objectRecord3(candidate) {
   return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
@@ -16742,7 +16867,7 @@ function sameArchiveIdentity(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
 }
 async function archiveSha256(handle, sizeBytes) {
-  const hash = createHash6("sha256");
+  const hash = createHash7("sha256");
   const chunk = new Uint8Array(Math.min(sizeBytes, ARCHIVE_CHUNK_BYTES));
   for (let offset = 0;offset < sizeBytes; ) {
     const requested = Math.min(chunk.byteLength, sizeBytes - offset);
@@ -16755,7 +16880,7 @@ async function archiveSha256(handle, sizeBytes) {
   return hash.digest("hex");
 }
 async function verifiedArchive(path) {
-  const archivePath = resolve7(path);
+  const archivePath = resolve8(path);
   const handle = await open2(archivePath, fsConstants2.O_RDONLY | fsConstants2.O_NOFOLLOW);
   try {
     const before = await handle.stat({ bigint: true });
@@ -16877,7 +17002,7 @@ function stableJson(candidate) {
   return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
 }
 function activationFingerprint(identity) {
-  return createHash6("sha256").update(stableJson({
+  return createHash7("sha256").update(stableJson({
     project_ref: identity.projectRef,
     deployment_id: identity.deploymentId,
     release_id: identity.releaseId,
@@ -20365,7 +20490,7 @@ function registerBranchTools(server, http, options = {}) {
 
 // src/shared/tools/supabase-cli-tools.ts
 import { chmodSync, existsSync as existsSync6, mkdirSync as mkdirSync2, statSync as statSync5, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname3, isAbsolute as isAbsolute2, join as join6, resolve as resolve8 } from "node:path";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join6, resolve as resolve9 } from "node:path";
 var SENSITIVE_ENV_KEY = /(?:^|_)(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIALS?|AUTHORIZATION|AUTH|SESSION|COOKIE|BEARER|DB_URI|DB_URL|DSN|DATABASE_URL|DATABASE_URI|CONNECTION_STRING|CONNECTION_URI)(?:_|$)/i;
 var VALID_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 var VALID_MIGRATION_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]{0,100}$/;
@@ -20410,12 +20535,12 @@ function schemaArguments(schema) {
 function workdirArguments(workdir) {
   if (!workdir)
     throw new Error("A workdir is required");
-  return ["--workdir", resolve8(workdir)];
+  return ["--workdir", resolve9(workdir)];
 }
 function resolveOutputPath(workdir, file, label) {
   if (!file || /[\r\n\0]/.test(file))
     throw new Error(`${label} file is required`);
-  return isAbsolute2(file) ? resolve8(file) : resolve8(workdir, file);
+  return isAbsolute2(file) ? resolve9(file) : resolve9(workdir, file);
 }
 function databaseTargetArguments(databaseUrl) {
   return databaseUrl ? ["--db-url", requirePostgresUrl(databaseUrl)] : ["--local"];
@@ -20590,7 +20715,7 @@ function actionArguments(request, workdir) {
 function buildOfficialSupabaseArgs(request) {
   if (request.action === "version")
     return ["--version"];
-  const workdir = request.workdir ? resolve8(request.workdir) : undefined;
+  const workdir = request.workdir ? resolve9(request.workdir) : undefined;
   if (!workdir)
     throw new Error("A workdir is required");
   return [...actionArguments(request, workdir), ...workdirArguments(workdir)];
@@ -20667,13 +20792,13 @@ function resolveOfficialSupabaseCommand(workdir, environment = process.env) {
     }
     return ["npx", "--yes", `supabase@${version}`];
   }
-  const localPackageEntry = join6(resolve8(workdir), "node_modules", "supabase", "dist", "supabase.js");
+  const localPackageEntry = join6(resolve9(workdir), "node_modules", "supabase", "dist", "supabase.js");
   if (existsSync6(localPackageEntry))
     return [process.execPath, localPackageEntry];
   return ["supabase"];
 }
 function resolveExistingWorkdir(workdirInput, fallback) {
-  const workdir = resolve8(workdirInput || fallback);
+  const workdir = resolve9(workdirInput || fallback);
   if (!existsSync6(workdir) || !statSync5(workdir).isDirectory()) {
     throw new Error(`Supabase workdir not found: ${workdir}`);
   }
@@ -20774,7 +20899,7 @@ async function executeMigrationPush(request, runtime) {
   if (!projectRef)
     return missingProjectRefResult();
   const workdir = resolveExistingWorkdir(request.workdir, runtime.fallbackWorkdir);
-  const migrationDirectory = resolve8(workdir, request.dir || "supabase/migrations");
+  const migrationDirectory = resolve9(workdir, request.dir || "supabase/migrations");
   const migrationResponse = await pushMigrations({
     action: "push_migrations",
     ref: projectRef,
@@ -20811,7 +20936,7 @@ async function executeOfficialAction(request, runtime) {
   buildOfficialSupabaseArgs(normalizedRequest);
   const outputPath = actionOutputPath(normalizedRequest, workdir);
   if (outputPath)
-    mkdirSync2(dirname3(outputPath), { recursive: true });
+    mkdirSync2(dirname4(outputPath), { recursive: true });
   const secrets = sensitiveValues(runtime.environment, request.db_url);
   const execution = await runtime.executeOfficialCli(normalizedRequest);
   if (execution.exitCode === 0 && request.action === "gen_types" && outputPath) {
@@ -20887,11 +21012,11 @@ function registerSupabaseCliTools(server, options = {}) {
 
 // src/shared/tools/lite-cli-tools.ts
 import { existsSync as existsSync8, statSync as statSync7 } from "node:fs";
-import { resolve as resolve10 } from "node:path";
+import { resolve as resolve11 } from "node:path";
 
 // src/shared/tools/lite-cli-command.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6, statSync as statSync6 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join7, relative as relative3, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, statSync as statSync6 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join7, relative as relative3, resolve as resolve10 } from "node:path";
 function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -20902,11 +21027,11 @@ function resolveLiteCommand(workdir, environment = process.env) {
       throw new Error("Invalid SUPACLOUD_LITE_CLI_BIN");
     return [explicitBinary];
   }
-  const packageRoot = join7(resolve9(workdir), "node_modules", "@supacloud", "lite");
+  const packageRoot = join7(resolve10(workdir), "node_modules", "@supacloud", "lite");
   const manifestPath = join7(packageRoot, "package.json");
   if (!existsSync7(manifestPath))
     return ["supacloud-lite"];
-  const manifest = JSON.parse(readFileSync6(manifestPath, "utf8"));
+  const manifest = JSON.parse(readFileSync7(manifestPath, "utf8"));
   if (!isRecord5(manifest) || manifest.name !== "@supacloud/lite" || !isRecord5(manifest.bin)) {
     throw new Error("Invalid installed @supacloud/lite package manifest");
   }
@@ -20914,7 +21039,7 @@ function resolveLiteCommand(workdir, environment = process.env) {
   if (typeof entry !== "string" || !entry.trim() || entry.includes("\x00") || isAbsolute3(entry)) {
     throw new Error("Invalid installed @supacloud/lite bin");
   }
-  const executable = resolve9(packageRoot, entry);
+  const executable = resolve10(packageRoot, entry);
   const packageRelative = relative3(packageRoot, executable);
   if (!packageRelative || packageRelative === ".." || packageRelative.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute3(packageRelative)) {
     throw new Error("Installed @supacloud/lite bin must stay inside its package");
@@ -20926,7 +21051,7 @@ function resolveLiteCommand(workdir, environment = process.env) {
 }
 // src/shared/tools/lite-cli-tools.ts
 function requireWorkdir(workdir, fallback) {
-  const resolved = resolve10(workdir || fallback);
+  const resolved = resolve11(workdir || fallback);
   if (!existsSync8(resolved) || !statSync7(resolved).isDirectory()) {
     throw new Error(`Lite workdir not found: ${resolved}`);
   }
@@ -21135,12 +21260,12 @@ import {
   mkdirSync as mkdirSync3,
   mkdtempSync as mkdtempSync2,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync8,
   renameSync,
   rmSync as rmSync2
 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname4, join as join8, relative as relative4, resolve as resolve11, sep as sep3 } from "node:path";
+import { dirname as dirname5, join as join8, relative as relative4, resolve as resolve12, sep as sep3 } from "node:path";
 import { fileURLToPath } from "node:url";
 var SKILL_NAME = "supacloud";
 function regularFiles(rootDirectory, currentDirectory = rootDirectory) {
@@ -21163,7 +21288,7 @@ function directoriesMatch(sourceDirectory, destinationDirectory) {
   const destinationFiles = regularFiles(destinationDirectory);
   if (sourceFiles.join("\x00") !== destinationFiles.join("\x00"))
     return false;
-  return sourceFiles.every((file) => readFileSync7(join8(sourceDirectory, file)).equals(readFileSync7(join8(destinationDirectory, file))));
+  return sourceFiles.every((file) => readFileSync8(join8(sourceDirectory, file)).equals(readFileSync8(join8(destinationDirectory, file))));
 }
 function backupTimestamp(now) {
   return now.toISOString().replace(/[-:.]/g, "");
@@ -21213,8 +21338,8 @@ function replaceSkill(sourceDirectory, targetRoot, destinationDirectory, backupD
   }
 }
 function skillSummary(request, action, files, backupDirectory) {
-  const sourceDirectory = resolve11(request.sourceDirectory);
-  const targetRoot = resolve11(request.targetRoot);
+  const sourceDirectory = resolve12(request.sourceDirectory);
+  const targetRoot = resolve12(request.targetRoot);
   return {
     name: SKILL_NAME,
     sourceDirectory,
@@ -21228,8 +21353,8 @@ function skillSummary(request, action, files, backupDirectory) {
   };
 }
 function installSkill(request) {
-  const sourceDirectory = resolve11(request.sourceDirectory);
-  const targetRoot = resolve11(request.targetRoot);
+  const sourceDirectory = resolve12(request.sourceDirectory);
+  const targetRoot = resolve12(request.targetRoot);
   const destinationDirectory = join8(targetRoot, SKILL_NAME);
   if (!existsSync9(join8(sourceDirectory, "SKILL.md"))) {
     throw new Error(`Bundled SupaCloud CLI skill not found: ${sourceDirectory}`);
@@ -21246,16 +21371,16 @@ function installSkill(request) {
   return installReplacementSkill(request, files);
 }
 function installNewSkill(request, files) {
-  const sourceDirectory = resolve11(request.sourceDirectory);
-  const targetRoot = resolve11(request.targetRoot);
+  const sourceDirectory = resolve12(request.sourceDirectory);
+  const targetRoot = resolve12(request.targetRoot);
   if (request.mode === "write") {
     createSkill(sourceDirectory, targetRoot, join8(targetRoot, SKILL_NAME));
   }
   return skillSummary(request, "create", files, null);
 }
 function installReplacementSkill(request, files) {
-  const sourceDirectory = resolve11(request.sourceDirectory);
-  const targetRoot = resolve11(request.targetRoot);
+  const sourceDirectory = resolve12(request.sourceDirectory);
+  const targetRoot = resolve12(request.targetRoot);
   const destinationDirectory = join8(targetRoot, SKILL_NAME);
   const backupDirectory = availableBackupDirectory(destinationDirectory, request.now);
   if (request.mode === "write") {
@@ -21265,13 +21390,13 @@ function installReplacementSkill(request, files) {
 }
 function resolveDefaultCodexSkillRoot(environment = process.env, homeDirectory = homedir2()) {
   const codexHome = environment.CODEX_HOME?.trim();
-  return join8(resolve11(codexHome || join8(homeDirectory, ".codex")), "skills");
+  return join8(resolve12(codexHome || join8(homeDirectory, ".codex")), "skills");
 }
 function resolveBundledSkillDirectory(moduleUrl = import.meta.url) {
-  const moduleDirectory = dirname4(fileURLToPath(moduleUrl));
+  const moduleDirectory = dirname5(fileURLToPath(moduleUrl));
   const candidates = [
-    resolve11(moduleDirectory, "../../../skills", SKILL_NAME),
-    resolve11(moduleDirectory, "../skills", SKILL_NAME)
+    resolve12(moduleDirectory, "../../../skills", SKILL_NAME),
+    resolve12(moduleDirectory, "../skills", SKILL_NAME)
   ];
   const skillDirectory = candidates.find((candidate) => existsSync9(join8(candidate, "SKILL.md")));
   if (!skillDirectory)
@@ -21309,9 +21434,9 @@ function registerAiTools(server) {
 }
 
 // src/shared/tools/app-tools.ts
-import { existsSync as existsSync11, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync9 } from "node:fs";
 import { mkdir as mkdir5, readFile as readFile4, readdir as readdir5, writeFile as writeFile4 } from "node:fs/promises";
-import { basename as basename7, dirname as dirname8, join as join13, relative as relative7, resolve as resolve17 } from "node:path";
+import { basename as basename7, dirname as dirname9, join as join13, relative as relative7, resolve as resolve18 } from "node:path";
 import {
   applyDiagnosticFix,
   buildDeliveryProject,
@@ -21319,12 +21444,14 @@ import {
   compileProject,
   compileOptionsFromConfig,
   createContextPack,
+  createExecutionContextPack,
   createDiagnosticRepairPlan,
   doctorProject,
   loadSupacloudConfig,
   formatDeliveryPlan,
   planDeliveryProject,
   resolveSupacloudConfig,
+  readExecutionMetadata,
   watchProject
 } from "@supacloud/compiler";
 
@@ -21447,25 +21574,25 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.46.6"
+      version: "0.47.2"
     },
     app: {
-      version: "0.27.1",
+      version: "0.28.2",
       dependencies: {
         rxjs: "7.8.2"
       }
     },
     elysia: {
-      version: "0.33.1"
+      version: "0.33.4"
     },
     commands: {
-      version: "0.9.3"
+      version: "0.9.6"
     },
     contracts: {
-      version: "0.11.1"
+      version: "0.11.4"
     },
     db: {
-      version: "0.18.0",
+      version: "0.18.3",
       peerDependencies: {
         "drizzle-orm": "1.0.0-rc.5-5935859"
       },
@@ -21474,7 +21601,7 @@ var starter_metadata_default = {
       }
     },
     sdk: {
-      version: "0.43.0",
+      version: "0.43.3",
       peerDependencies: {
         "@supabase/supabase-js": "^2.117.3"
       }
@@ -21579,7 +21706,7 @@ test("cancelled stream consumers release their subscription", async () => {
 
 // src/shared/tools/app-starter.ts
 import { lstat as lstat2, mkdir as mkdir3, readdir as readdir3, writeFile as writeFile3 } from "node:fs/promises";
-import { basename as basename6, dirname as dirname5, join as join9, resolve as resolve12 } from "node:path";
+import { basename as basename6, dirname as dirname6, join as join9, resolve as resolve13 } from "node:path";
 
 // src/shared/tools/app-starter-environment.ts
 var STARTER_ENVIRONMENT = String.raw`import { existsSync, readFileSync } from "node:fs";
@@ -22264,10 +22391,11 @@ var STARTER_REVIEW_JOB = `import { DB_CLIENT, Inject, Injectable, Job } from "@s
 import { ApplicationError } from "@supacloud/elysia";
 import { t } from "elysia";
 import type { Static } from "elysia/type";
+import { REVIEW_VERSION_MAX } from "./limits";
 
 export const AttachmentInput = t.Object({
   reviewId: t.String({ minLength: 1, maxLength: 100 }),
-  version: t.Integer({ minimum: 2 }),
+  version: t.Integer({ minimum: 2, maximum: REVIEW_VERSION_MAX }),
   artifactId: t.String({ format: "uuid" }),
 }, { additionalProperties: false });
 
@@ -23701,11 +23829,19 @@ export function createReviewClient(transport: ReviewTransport, pending?: ReviewP
       try { listener(); } catch {}
     }
   };
-  function finish(operation: ReviewOperation, result: ReviewWriteResult) {
+  function outcome(operation: ReviewOperation, result: unknown): ReviewWriteResult["status"] {
+    try {
+      if (result === null || typeof result !== "object" || Array.isArray(result) || !("status" in result)) return "unknown";
+      const status = result.status;
+      if (status === "denied" || status === "conflict") return status;
+      if (status === "confirmed" && "operationId" in result && "reviewId" in result
+        && result.operationId === operation.operationId && result.reviewId === operation.reviewId) return "confirmed";
+    } catch { /* Invalid adapters must not discard recovery evidence. */ }
+    return "unknown";
+  }
+  function finish(operation: ReviewOperation, result: unknown) {
     if (closed) return;
-    let status = result.status === "confirmed"
-      && (result.operationId !== operation.operationId || result.reviewId !== operation.reviewId)
-      ? "unknown" : result.status;
+    let status = outcome(operation, result);
     if (status !== "unknown") {
       try {
         if (pending) {
@@ -23722,6 +23858,7 @@ export function createReviewClient(transport: ReviewTransport, pending?: ReviewP
     const request = ++generation;
     state = { ...state, list: { status: "loading", rows: [] } };
     notify();
+    if (closed || request !== generation) return;
     try {
       const rows = await transport.list();
       if (closed || request !== generation) return;
@@ -23786,7 +23923,10 @@ export function createReviewClient(transport: ReviewTransport, pending?: ReviewP
       try {
         const result = await transport.lookup(structuredClone(operation));
         // Denial or conflict during lookup does not prove the original write did not commit.
-        finish(operation, result.status === "confirmed" ? result : { status: "unknown" });
+        // Normalize once: custom adapter accessors may change between reads.
+        finish(operation, outcome(operation, result) === "confirmed"
+          ? { status: "confirmed", operationId: operation.operationId, reviewId: operation.reviewId }
+          : { status: "unknown" });
         if (snapshot().mutation.status === "confirmed") await load();
       } catch {
         finish(operation, { status: "unknown" });
@@ -23959,6 +24099,34 @@ test("list has loading, empty, permission and failure states; old results cannot
     expect(JSON.stringify(failed.snapshot())).not.toContain("private");
   }
 });
+test("disposing from a loading subscriber prevents read dispatch", async () => {
+  let reads = 0;
+  const client = createReviewClient(transport({ list: async () => { reads++; return [draft]; } }));
+  client.subscribe(() => {
+    if (client.snapshot().list.status === "loading") client.dispose();
+  });
+  await client.load();
+  expect(reads).toBe(0);
+  await client.load();
+  expect(reads).toBe(0);
+});
+
+test("a reentrant newer load supersedes the outer read before dispatch", async () => {
+  let reads = 0, replaced = false;
+  let replacement: Promise<void> | undefined;
+  const client = createReviewClient(transport({ list: async () => { reads++; return [draft]; } }));
+  client.subscribe(() => {
+    if (!replaced && client.snapshot().list.status === "loading") {
+      replaced = true;
+      replacement = client.load();
+    }
+  });
+  await client.load();
+  await replacement;
+  expect(reads).toBe(1);
+  expect(client.snapshot().list).toEqual({ status: "ready", rows: [draft] });
+});
+
 test("double submit sends one write; unknown retains its identity and only a lookup can confirm it", async () => {
   let sends = 0, lookups = 0, resolve: (result: ReviewWriteResult) => void = () => {};
   const client = createReviewClient(transport({
@@ -23991,6 +24159,72 @@ test("conflict refreshes but does not retry the write; wrong receipt remains unk
   await wrong.approve(draft);
   expect(wrong.snapshot().mutation.status).toBe("unknown");
 });
+
+test("malformed adapter outcomes preserve pending evidence across writes and recovery", async () => {
+  const malformed: unknown[] = [
+    null, undefined, false, [], "confirmed", {}, { status: "complete" }, { status: 200 },
+    { status: "confirmed" }, { status: "confirmed", operationId: "foreign", reviewId: draft.id },
+    { get status() { throw new Error("private adapter detail"); } },
+  ];
+  for (const kind of ["approve", "upload"] as const) {
+    for (const value of malformed) {
+      let saved: ReviewOperation | null = null, sends = 0, clears = 0, reads = 0, recovered = false;
+      const readSaved = (): ReviewOperation | null => saved;
+      // Simulate an untyped/custom adapter crossing the public TypeScript boundary.
+      const invalid = value as ReviewWriteResult;
+      const send = async () => { sends++; return invalid; };
+      const client = createReviewClient(transport({
+        approve: send, upload: send,
+        list: async () => { reads++; return []; },
+        lookup: async op => recovered
+          ? { status: "confirmed", operationId: op.operationId, reviewId: op.reviewId } : invalid,
+      }), {
+        load: () => saved, save: op => { saved = op; },
+        clear: () => { clears++; saved = null; },
+      });
+      const submit = () => kind === "approve" ? client.approve(draft)
+        : client.upload(uploadDraft, new Blob(["hello"], { type: "text/plain" }));
+      await submit();
+      const original = client.snapshot().mutation.operation;
+      expect(original).not.toBeNull();
+      expect(readSaved()).toEqual(original);
+      expect(client.snapshot().mutation).toEqual({ status: "unknown", operation: original });
+      await client.reconcile();
+      await submit();
+      expect(client.snapshot().mutation).toEqual({ status: "unknown", operation: original });
+      expect(readSaved()).toEqual(original);
+      expect(sends).toBe(1); expect(clears).toBe(0); expect(reads).toBe(0);
+      expect(JSON.stringify(client.snapshot())).not.toContain("private adapter detail");
+      recovered = true;
+      await client.reconcile();
+      expect(client.snapshot().mutation.status).toBe("confirmed");
+      expect(readSaved()).toBeNull();
+      expect(sends).toBe(1); expect(clears).toBe(1); expect(reads).toBe(1);
+    }
+  }
+});
+test("recovery validates adapter accessors once before clearing pending evidence", async () => {
+  let saved: ReviewOperation | null = null, reads = 0, sends = 0, clears = 0;
+  const client = createReviewClient(transport({
+    approve: async () => { sends++; return { status: "unknown" }; },
+    lookup: async operation => ({
+      get status() { return ++reads === 1 ? "confirmed" as const : "denied" as const; },
+      operationId: operation.operationId, reviewId: operation.reviewId,
+    }),
+  }), {
+    load: () => saved, save: operation => { saved = operation; },
+    clear: () => { clears++; saved = null; },
+  });
+  await client.approve(draft);
+  expect(client.snapshot().mutation.status).toBe("unknown");
+  await client.reconcile();
+  expect(reads).toBe(1);
+  expect(client.snapshot().mutation.status).toBe("confirmed");
+  expect(saved).toBeNull();
+  expect(clears).toBe(1);
+  expect(sends).toBe(1);
+});
+
 test("upload validates size/type, retains failure identity, and disposal drops late results", async () => {
   let uploads = 0;
   const client = createReviewClient(transport({ upload: async () => { uploads++; throw new Error("private"); } }));
@@ -24483,6 +24717,12 @@ export async function listReviews(
   const { data, error, count } = await (signal ? query.abortSignal(signal) : query);
   if (error) throw error;
   if (data === null || count === null) throw new Error("Incomplete review page response");
+  if (!Array.isArray(data)
+    || !Number.isSafeInteger(count) || count < 0
+    || data.length > pageSize
+    || (data.length > 0 && start + data.length > count)) {
+    throw new Error("Invalid review page response");
+  }
   return { data, total: count, page, pageSize, hasNextPage: start + data.length < count };
 }
 `;
@@ -25706,6 +25946,7 @@ handler contract, not production Storage, queue delivery or external identity.
 ## Inspection And Repair
 
 \`\`\`sh
+supacloud app context --root . --target review --events execution.ndjson --request-id request-123 --format json
 bunx supacloud-compiler context review --root src --json
 bunx supacloud-compiler context review --root src --events execution-events.json --request-id request-123 --json
 bunx supacloud-compiler explain review --root src
@@ -25715,6 +25956,11 @@ bunx supacloud-compiler fix ./fix.json --dry-run
 
 Context packs include directional dependencies, relevant aspect files, diagnostics
 and static execution plans, without provider values or source expressions.
+The app context entry point retains its module workflow and adds a separate
+execution evidence block when --events and --request-id are provided together.
+It requires an explicit --target and --format json, rejects --write, and
+resolves relative event paths from --root. The top-level context alias supports
+the same flags. Omit both execution flags for the unchanged authoring context.
 The optional --events example expects a trusted host
 to capture approved onExecution metadata in { "version": 1, "events": [...] }.
 It also accepts a bounded JSON-lines export containing only the generated
@@ -25746,7 +25992,7 @@ and governance; TypeScript checks both application and generated source.
   };
 }
 async function initializeAppProject(options) {
-  const root = resolve12(options.root ?? process.cwd());
+  const root = resolve13(options.root ?? process.cwd());
   const name = options.name ?? basename6(root);
   if (!/^[a-z][a-z0-9-]*$/.test(name) || name.length > 100) {
     throw new Error("Project name must be lowercase kebab-case (1-100 characters)");
@@ -25765,7 +26011,7 @@ async function initializeAppProject(options) {
   });
   for (const [relativePath, content] of Object.entries(files)) {
     const path = join9(root, relativePath);
-    await mkdir3(dirname5(path), { recursive: true });
+    await mkdir3(dirname6(path), { recursive: true });
     await writeFile3(path, content, { encoding: "utf8", flag: "wx" });
   }
   return { root, name, files: Object.keys(files) };
@@ -25773,7 +26019,7 @@ async function initializeAppProject(options) {
 
 // src/shared/tools/app-database-check.ts
 import { existsSync as existsSync10 } from "node:fs";
-import { join as join10, resolve as resolve13 } from "node:path";
+import { join as join10, resolve as resolve14 } from "node:path";
 var CHECK_ENTRY = `
 import { createRequire } from "node:module";
 import { join } from "node:path";
@@ -25784,7 +26030,7 @@ process.argv = [process.execPath, cli, "check", "--root", root];
 await import(pathToFileURL(cli).href);
 `;
 function checkAppDatabaseSources(projectRoot) {
-  const root = resolve13(projectRoot);
+  const root = resolve14(projectRoot);
   if (!existsSync10(join10(root, "database.sources.json")))
     return;
   const name = "database-source-contracts";
@@ -26024,6 +26270,7 @@ import type { StaticDecode } from "typebox";
 
 export type ${className}ListInput = StaticDecode<typeof ${className}ListQuery>;
 export type ${className}ApproveInput = StaticDecode<typeof ${className}ApproveBody>;
+export type ${className}ApproveCommand = ${className}ApproveInput & { id: string };
 export type ${className}Result = StaticDecode<typeof ${className}Row>;
 
 export interface ${className}ReadPort {
@@ -26032,11 +26279,7 @@ export interface ${className}ReadPort {
 }
 
 export interface ${className}WritePort {
-    approve(input: {
-        id: string;
-        expectedVersion: number;
-        reason?: string;
-    }): Promise<${className}Result>;
+    approve(input: ${className}ApproveCommand): Promise<${className}Result>;
 }
 
 export const ${className}Reader = new InjectionToken<${className}ReadPort>(
@@ -26244,6 +26487,10 @@ The scaffold does not create migrations, infer permissions, or provide an in-mem
 production fallback. Database migrations remain the database source of truth.
 The HTTP schemas describe the boundary, not a second database model. Bind their
 fields to the existing database-source contract checker before delivery.
+The Writer input is derived from the approval body contract plus the route ID.
+Add request fields in the contract, not a second handwritten Writer interface.
+Typecheck application adapters after changing a field type; the derived Port
+must expose incompatible assumptions in business code.
 
 The named RPC adapter must invoke the continuation in the same database transaction
 used by the request-scoped Writer, or own the complete command instead; never execute
@@ -26289,7 +26536,7 @@ Scenario: Delivery
 // src/shared/tools/app-local-dev.ts
 import { spawn } from "node:child_process";
 import { readFile as readFile2 } from "node:fs/promises";
-import { join as join11, resolve as resolve14 } from "node:path";
+import { join as join11, resolve as resolve15 } from "node:path";
 function localDatabaseUrl(value) {
   try {
     if (!value || /[\x00-\x20\x7f]/.test(value))
@@ -26336,7 +26583,7 @@ async function probeDatabase(url, signal) {
   }
 }
 async function runLocalDevelopment(options) {
-  const root = resolve14(options.root);
+  const root = resolve15(options.root);
   const profile = options.profile ?? "fast";
   if (profile !== "fast" && profile !== "integration")
     throw new Error("Unknown development profile");
@@ -26437,7 +26684,7 @@ async function runLocalDevelopment(options) {
 
 // src/shared/tools/app-verification-plan.ts
 import { readdir as readdir4, realpath as realpath3 } from "node:fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute4, relative as relative5, resolve as resolve15 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute4, relative as relative5, resolve as resolve16 } from "node:path";
 function inside2(root, file) {
   const path = relative5(root, file).replaceAll("\\", "/");
   return path !== ".." && !path.startsWith("../") && !isAbsolute4(path);
@@ -26448,9 +26695,10 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
     throw new Error("Select one unambiguous module or owned symbol for verification");
   const owner = owners[0];
   const project = await realpath3(root);
-  const requestedRoot = resolve15(root);
+  const requestedRoot = resolve16(root);
   const sources = [
     owner.file,
+    owner.featureSpec?.file,
     ...owner.providers.map((item) => item.file),
     ...owner.controllers.map((item) => item.file),
     ...graph.moduleHandlerFiles?.[owner.name] ?? [],
@@ -26459,7 +26707,7 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
     ...(owner.jobs ?? []).flatMap((item) => (item.aspects ?? []).flatMap((aspect) => aspect.file ? [aspect.file] : [])),
     ...owner.controllers.flatMap((item) => item.routes.flatMap((route) => (route.aspects ?? []).flatMap((aspect) => aspect.file ? [aspect.file] : [])))
   ].filter((file) => typeof file === "string");
-  const directories = [...new Set(sources.map((file) => dirname6(resolve15(sourceRoot, file))))].sort();
+  const directories = [...new Set(sources.map((file) => dirname7(resolve16(sourceRoot, file))))].sort();
   const tests = new Set;
   const manual = [];
   const coverage = [];
@@ -26484,7 +26732,7 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
     const local = [];
     for (const entry of await readdir4(actual, { withFileTypes: true })) {
       if (entry.isFile() && /\.(test|spec)\.[cm]?[jt]sx?$/.test(entry.name)) {
-        const file = relative5(project, resolve15(actual, entry.name)).replaceAll("\\", "/");
+        const file = relative5(project, resolve16(actual, entry.name)).replaceAll("\\", "/");
         tests.add(file);
         local.push(file);
       }
@@ -26504,7 +26752,7 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
     source: "declaration",
     target: owner.name,
     ready: manual.length === 0,
-    files: [...new Set(sources.map((file) => relative5(requestedRoot, resolve15(sourceRoot, file)).replaceAll("\\", "/")))].sort(),
+    files: [...new Set(sources.map((file) => relative5(requestedRoot, resolve16(sourceRoot, file)).replaceAll("\\", "/")))].sort(),
     tests: selected.slice(0, 32),
     commands: selected.length <= 32 ? [
       ...selected.map((file) => ["bun", "test", `./${file}`]),
@@ -26525,7 +26773,7 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
 // src/shared/tools/app-scaffold-writes.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { link, lstat as lstat3, mkdir as mkdir4, open as open3, readFile as readFile3, realpath as realpath4, rename as rename2, rmdir, unlink } from "node:fs/promises";
-import { dirname as dirname7, isAbsolute as isAbsolute5, join as join12, relative as relative6, resolve as resolve16, sep as sep4, win32 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute5, join as join12, relative as relative6, resolve as resolve17, sep as sep4, win32 } from "node:path";
 
 class ScaffoldError extends Error {
   code;
@@ -26546,7 +26794,7 @@ function scaffoldPath(root, path) {
   if (parts.some((part) => /[<>:"|?*\u0000-\u001f]/.test(part) || /[ .]$/.test(part) && part !== "." && part !== ".." || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part) || part.toLowerCase() === ".git" || part.toLowerCase() === ".supacloud-generate.lock")) {
     throw new ScaffoldError("SCAFFOLD_PATH_INVALID", "Scaffold path is reserved or not portable");
   }
-  const target = resolve16(root, path);
+  const target = resolve17(root, path);
   const local = relative6(root, target);
   if (!local || local === ".." || local.startsWith(`..${sep4}`) || isAbsolute5(local)) {
     throw new ScaffoldError("SCAFFOLD_PATH_INVALID", "Scaffold path is outside the project root");
@@ -26585,7 +26833,7 @@ function sameFile(a, b) {
   return a === null ? b === null : b !== null && a.content === b.content && a.dev === b.dev && a.ino === b.ino && a.mode === b.mode;
 }
 async function planScaffoldWrites(root, writes) {
-  const canonical = await realpath4(resolve16(root));
+  const canonical = await realpath4(resolve17(root));
   const targets = new Set;
   const planned = [];
   for (const write of writes) {
@@ -26628,7 +26876,7 @@ async function applyScaffoldWrites(plan) {
     for (const write of plan.writes) {
       const target = scaffoldPath(plan.root, write.path);
       let current = plan.root;
-      for (const part of relative6(plan.root, dirname7(target)).split(sep4).filter(Boolean)) {
+      for (const part of relative6(plan.root, dirname8(target)).split(sep4).filter(Boolean)) {
         current = join12(current, part);
         try {
           await mkdir4(current);
@@ -26894,7 +27142,7 @@ async function generateScaffold(args) {
       throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", `--${flag.replaceAll("_", "-")} must be boolean`);
     }
   }
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const dir = args.dir ?? "src/features";
   if (dir !== ".")
     scaffoldPath(root, dir);
@@ -26948,7 +27196,7 @@ async function generateScaffold(args) {
     if (new RegExp(`\\b${moduleSymbol}\\b`).test(original)) {
       throw new ScaffoldError("SCAFFOLD_REGISTRATION_CONFLICT", `Registration target already references ${moduleSymbol}; review the import manually`);
     }
-    let importPath = relative7(dirname8(target), resolve17(root, modulePath)).replaceAll("\\", "/").replace(/\.ts$/, "");
+    let importPath = relative7(dirname9(target), resolve18(root, modulePath)).replaceAll("\\", "/").replace(/\.ts$/, "");
     if (!importPath.startsWith("."))
       importPath = `./${importPath}`;
     const edit = await applyDiagnosticFix({
@@ -27021,13 +27269,13 @@ function sourceRoot(args, root, configured) {
   return args.root && !hasConfig ? "." : configured;
 }
 async function projectCompileConfig(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const configFile = ["ts", "mts", "js", "mjs"].map((extension) => join13(root, `supacloud.config.${extension}`)).find((candidate) => existsSync11(candidate)) ?? null;
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
   const configuredRoot = sourceRoot(args, root, loadedConfig.root);
   const include = parseInclude(args.include) ?? loadedConfig.include;
-  const outDir = args.out_dir ? resolve17(root, args.out_dir) : defaults.outDir;
+  const outDir = args.out_dir ? resolve18(root, args.out_dir) : defaults.outDir;
   const compileOptions = compileOptionsFromConfig({
     ...loadedConfig,
     ...configuredRoot === undefined ? {} : { root: configuredRoot },
@@ -27074,6 +27322,7 @@ async function runContext(args) {
   const subject = args.target?.trim();
   if (subject) {
     const pack = createContextPack({ ...result.graph, diagnostics: result.diagnostics }, subject);
+    const execution = args.events === undefined ? undefined : createExecutionContextPack({ ...result.graph, diagnostics: result.diagnostics }, subject, await readExecutionMetadata(resolve18(root, args.events)), args.request_id);
     const verification = await createVerificationPlan(root, result.graph, pack.subject, sourceDir);
     const repairs = createDiagnosticRepairPlan(pack.diagnostics);
     const workflow = {
@@ -27104,7 +27353,7 @@ async function runContext(args) {
       },
       executed: false
     };
-    return textResult(args.format === "json" ? JSON.stringify({ ...pack, workflow }, null, 2) : [
+    return textResult(args.format === "json" ? JSON.stringify({ ...pack, ...execution ? { execution } : {}, workflow }, null, 2) : [
       formatModuleContextPack(pack),
       `  edit files (project-relative): ${workflow.editFiles.join(", ") || "-"}`,
       `  focused tests: ${verification.tests.join(", ") || "-"}`,
@@ -27256,11 +27505,11 @@ async function runDoctor(args) {
 `), doctor.errors > 0);
 }
 async function runFix(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const fixPath = args.fix?.trim();
   if (!fixPath)
     throw new Error("app fix requires --fix <path-to-diagnostic-fix.json>");
-  const parsed = JSON.parse(await readFile4(resolve17(root, fixPath), "utf8"));
+  const parsed = JSON.parse(await readFile4(resolve18(root, fixPath), "utf8"));
   const write = args.write === true;
   const applied = await applyDiagnosticFix(parsed, { rootDir: root, dryRun: !write });
   return textResult(JSON.stringify({
@@ -27303,7 +27552,7 @@ function devDatabase(profile, explicit) {
 }
 function readManifestModules(outDir) {
   try {
-    const parsed = JSON.parse(readFileSync8(join13(outDir, "app.manifest.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync9(join13(outDir, "app.manifest.json"), "utf8"));
     return Array.isArray(parsed.modules) ? parsed.modules.map((module) => module.name) : [];
   } catch {
     return [];
@@ -27346,12 +27595,12 @@ async function runAppDev(args, options) {
     throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "app dev --profile must be fast or integration");
   }
   const database = devDatabase(profile, args.database_url);
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
   const configuredRoot = sourceRoot(args, root, loadedConfig.root);
   const include = parseInclude(args.include) ?? loadedConfig.include;
-  const outDir = args.out_dir ? resolve17(root, args.out_dir) : defaults.outDir;
+  const outDir = args.out_dir ? resolve18(root, args.out_dir) : defaults.outDir;
   const watch = args.once !== true && args.watch !== false;
   const compileOptions = compileOptionsFromConfig({
     ...loadedConfig,
@@ -27437,7 +27686,7 @@ async function runAppDev(args, options) {
   return report(lastEvent, "stopped");
 }
 async function runCompile(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
   const configuredRoot = sourceRoot(args, root, loadedConfig.root);
@@ -27446,7 +27695,7 @@ async function runCompile(args) {
     ...compileOptionsFromConfig({
       ...loadedConfig,
       ...configuredRoot === undefined ? {} : { root: configuredRoot },
-      outDir: args.out_dir ? resolve17(root, args.out_dir) : defaults.outDir,
+      outDir: args.out_dir ? resolve18(root, args.out_dir) : defaults.outDir,
       ...include === undefined ? {} : { include },
       strict: args.strict ?? loadedConfig.strict ?? false
     }, root),
@@ -27470,7 +27719,7 @@ async function runCompile(args) {
   return textResult(text, hasError);
 }
 async function runCheck(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const database = checkAppDatabaseSources(root);
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
@@ -27479,7 +27728,7 @@ async function runCheck(args) {
   const config = compileOptionsFromConfig({
     ...loadedConfig,
     ...configuredRoot === undefined ? {} : { root: configuredRoot },
-    outDir: args.out_dir ? resolve17(root, args.out_dir) : defaults.outDir,
+    outDir: args.out_dir ? resolve18(root, args.out_dir) : defaults.outDir,
     ...include === undefined ? {} : { include },
     strict: args.strict ?? loadedConfig.strict ?? false
   }, root);
@@ -27509,7 +27758,7 @@ async function runCheck(args) {
 }
 async function readManifest(root, args) {
   const config = await loadSupacloudConfig(root);
-  const outDir = args.out_dir ? resolve17(root, args.out_dir) : resolveSupacloudConfig(config, root).outDir;
+  const outDir = args.out_dir ? resolve18(root, args.out_dir) : resolveSupacloudConfig(config, root).outDir;
   const manifestPath = join13(outDir, "app.manifest.json");
   if (!existsSync11(manifestPath)) {
     throw new Error(`Manifest not found: ${manifestPath}（先运行 app compile 生成）`);
@@ -27554,7 +27803,7 @@ function formatGraphText(manifest) {
 `);
 }
 async function runGraph(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const manifest = await readManifest(root, args);
   if (args.format === "json")
     return textResult(JSON.stringify(manifest, null, 2));
@@ -27622,7 +27871,7 @@ async function runExplain(args) {
   const target = args.target?.trim();
   if (!target)
     throw new Error("app explain requires --target（provider 类名 / token 名 / command 名 / job 名）");
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const manifest = await readManifest(root, args);
   for (const module of manifest.modules) {
     const job = module.jobs?.find((entry) => entry.name === target || entry.className === target);
@@ -27697,10 +27946,10 @@ async function runExplain(args) {
   return textResult(`未找到对象: ${target}`, true);
 }
 async function runExportTools(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const manifest = await readManifest(root, { ...args, out_dir: undefined });
   const definitions = buildToolDefinitions(manifest);
-  const outDir = resolve17(args.out_dir || join13(root, "generated"));
+  const outDir = resolve18(args.out_dir || join13(root, "generated"));
   if (args.format === "json") {
     return textResult(JSON.stringify(definitions, null, 2));
   }
@@ -27721,7 +27970,7 @@ async function runExportTools(args) {
   return textResult(summary);
 }
 async function runDelivery(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   if (args.action === "build") {
     const database = checkAppDatabaseSources(root);
     if (database && !database.ok) {
@@ -27731,7 +27980,7 @@ async function runDelivery(args) {
   const loaded = await loadSupacloudConfig(root);
   const options = compileOptionsFromConfig({
     ...loaded,
-    ...args.out_dir === undefined ? {} : { outDir: resolve17(root, args.out_dir) },
+    ...args.out_dir === undefined ? {} : { outDir: resolve18(root, args.out_dir) },
     ...args.include === undefined ? {} : { include: parseInclude(args.include) },
     ...args.strict === undefined ? {} : { strict: args.strict }
   }, root);
@@ -27808,7 +28057,7 @@ async function runAppRelease(request, options, delegate) {
   if (request.activation_id !== undefined || request.expected_activation_id !== undefined) {
     throw new Error("app release generates one activation identity; use app deploy for an exact retry");
   }
-  const root = resolve17(request.root || process.cwd());
+  const root = resolve18(request.root || process.cwd());
   const completed = {};
   let manifestPath;
   let buildReceipt;
@@ -27816,7 +28065,7 @@ async function runAppRelease(request, options, delegate) {
     if (request.manifest_path === undefined) {
       throw new Error("app release --skip_build requires --manifest_path");
     }
-    manifestPath = resolve17(root, request.manifest_path);
+    manifestPath = resolve18(root, request.manifest_path);
     completed.build = { skipped: true, manifest_path: manifestPath };
   } else {
     const built = await runDelivery({ ...request, action: "build", root, format: "json" });
@@ -27853,7 +28102,7 @@ async function runAppRelease(request, options, delegate) {
   let configurationWrite;
   const activationId = crypto.randomUUID();
   if (request.configuration_path !== undefined) {
-    const configurationPath = resolve17(root, request.configuration_path);
+    const configurationPath = resolve18(root, request.configuration_path);
     try {
       configurationWrite = parseApplicationConfigurationWrite(await Bun.file(configurationPath).json());
       configurationId = configurationWrite.configuration_id;
@@ -28180,15 +28429,21 @@ Execution: skipped`);
   return format === "json" || json ? result : formatPromotionExecution(result);
 }
 async function runAppTool(request, options = {}) {
-  if (request.dry_run !== undefined && request["dry-run"] !== undefined || request.register_in !== undefined && request["register-in"] !== undefined || request.database_url !== undefined && request["database-url"] !== undefined) {
+  if (request.dry_run !== undefined && request["dry-run"] !== undefined || request.register_in !== undefined && request["register-in"] !== undefined || request.database_url !== undefined && request["database-url"] !== undefined || request.request_id !== undefined && request["request-id"] !== undefined) {
     throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "Do not combine hyphenated and underscored aliases of the same flag");
   }
   request = {
     ...request,
     ...request["dry-run"] === undefined ? {} : { dry_run: request["dry-run"] },
     ...request["register-in"] === undefined ? {} : { register_in: request["register-in"] },
-    ...request["database-url"] === undefined ? {} : { database_url: request["database-url"] }
+    ...request["database-url"] === undefined ? {} : { database_url: request["database-url"] },
+    ...request["request-id"] === undefined ? {} : { request_id: request["request-id"] }
   };
+  if (request.events !== undefined || request.request_id !== undefined) {
+    if (request.action !== "context" || !request.events?.trim() || !request.target?.trim() || !request.request_id || !/^[A-Za-z0-9._:-]{1,256}$/.test(request.request_id) || request.format !== "json" || request.write !== undefined) {
+      throw new Error("Execution context requires app context, --target, --events, --request-id and --format json; --write is not supported");
+    }
+  }
   if ((request.dry_run !== undefined || request.register_in !== undefined) && request.action !== "generate") {
     throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "--dry-run and --register-in apply only to app generate");
   }
@@ -28375,6 +28630,9 @@ function registerAppTools(server, options = {}) {
     database_url: optional(String2(), "[dev] Explicit loopback integration URL; watch/once only inspect its shape"),
     "database-url": optional(String2(), "[dev] CLI alias of database_url"),
     target: optional(String2(), "[explain/context/verify-plan] Provider class name / token name / command name / job name / module name"),
+    events: optional(String2(), "[context] Project-relative execution metadata JSON or generated JSON-lines file"),
+    request_id: optional(String2(), "[context] Opaque request ID or Workflow run ID selected from --events"),
+    "request-id": optional(String2(), "[context] CLI alias of request_id"),
     fix: optional(String2(), "[fix] Path to a DiagnosticFix JSON file produced by `doctor --format json`"),
     write: optional(Boolean2(), "[fix] Write the fix to disk (default: preview only)"),
     skip_build: optional(Boolean2(), "[release] Reuse --manifest_path instead of running the local delivery build")
@@ -28400,6 +28658,9 @@ function registerAppAliases(server) {
     strict: optional(Boolean2(), "[compile/check] Promote warnings to errors"),
     format: optional(stringEnum2(["text", "json"]), "Output format (default: text)"),
     target: optional(String2(), "[explain/context] Provider class name / token name / command name / job name / module name"),
+    events: optional(String2(), "[context] Project-relative execution metadata JSON or generated JSON-lines file"),
+    request_id: optional(String2(), "[context] Opaque request ID or Workflow run ID selected from --events"),
+    "request-id": optional(String2(), "[context] CLI alias of request_id"),
     fix: optional(String2(), "[fix] Path to a DiagnosticFix JSON file produced by `doctor --format json`"),
     write: optional(Boolean2(), "[fix] Write the fix to disk (default: preview only)")
   };
@@ -28410,7 +28671,7 @@ function registerAppAliases(server) {
 
 // src/shared/tools/db-governance-tools.ts
 import { existsSync as existsSync13 } from "node:fs";
-import { join as join16, resolve as resolve20 } from "node:path";
+import { join as join16, resolve as resolve21 } from "node:path";
 import {
   buildDatabaseManifest,
   explainObject,
@@ -28420,10 +28681,10 @@ import {
 } from "@supacloud/db";
 
 // src/shared/tools/db-workflow.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { lstat as lstat4, mkdir as mkdir6, mkdtemp, readFile as readFile5, readdir as readdir6, rename as rename3, rm as rm2, writeFile as writeFile5 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname10, isAbsolute as isAbsolute7, join as join15, relative as relative8, resolve as resolve19 } from "node:path";
+import { dirname as dirname11, isAbsolute as isAbsolute7, join as join15, relative as relative8, resolve as resolve20 } from "node:path";
 import {
   assertApplicationRoleRestricted,
   readDatabaseRole,
@@ -28435,7 +28696,7 @@ import { parseDatabaseSourcesConfig } from "@supacloud/db/source-contracts";
 
 // src/shared/tools/supabase-cli-tools.ts
 import { chmodSync as chmodSync2, existsSync as existsSync12, mkdirSync as mkdirSync4, statSync as statSync8, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname9, isAbsolute as isAbsolute6, join as join14, resolve as resolve18 } from "node:path";
+import { dirname as dirname10, isAbsolute as isAbsolute6, join as join14, resolve as resolve19 } from "node:path";
 var SENSITIVE_ENV_KEY2 = /(?:^|_)(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIALS?|AUTHORIZATION|AUTH|SESSION|COOKIE|BEARER|DB_URI|DB_URL|DSN|DATABASE_URL|DATABASE_URI|CONNECTION_STRING|CONNECTION_URI)(?:_|$)/i;
 var VALID_VERSION2 = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 var VALID_MIGRATION_NAME2 = /^[A-Za-z0-9][A-Za-z0-9_-]{0,100}$/;
@@ -28480,12 +28741,12 @@ function schemaArguments2(schema) {
 function workdirArguments2(workdir) {
   if (!workdir)
     throw new Error("A workdir is required");
-  return ["--workdir", resolve18(workdir)];
+  return ["--workdir", resolve19(workdir)];
 }
 function resolveOutputPath2(workdir, file, label) {
   if (!file || /[\r\n\0]/.test(file))
     throw new Error(`${label} file is required`);
-  return isAbsolute6(file) ? resolve18(file) : resolve18(workdir, file);
+  return isAbsolute6(file) ? resolve19(file) : resolve19(workdir, file);
 }
 function databaseTargetArguments2(databaseUrl) {
   return databaseUrl ? ["--db-url", requirePostgresUrl2(databaseUrl)] : ["--local"];
@@ -28660,7 +28921,7 @@ function actionArguments2(request, workdir) {
 function buildOfficialSupabaseArgs2(request) {
   if (request.action === "version")
     return ["--version"];
-  const workdir = request.workdir ? resolve18(request.workdir) : undefined;
+  const workdir = request.workdir ? resolve19(request.workdir) : undefined;
   if (!workdir)
     throw new Error("A workdir is required");
   return [...actionArguments2(request, workdir), ...workdirArguments2(workdir)];
@@ -28702,14 +28963,14 @@ function resolveOfficialSupabaseCommand2(workdir, environment = process.env) {
     }
     return ["npx", "--yes", `supabase@${version}`];
   }
-  const localPackageEntry = join14(resolve18(workdir), "node_modules", "supabase", "dist", "supabase.js");
+  const localPackageEntry = join14(resolve19(workdir), "node_modules", "supabase", "dist", "supabase.js");
   if (existsSync12(localPackageEntry))
     return [process.execPath, localPackageEntry];
   return ["supabase"];
 }
 
 // src/shared/tools/db-workflow.ts
-var hash4 = (content) => createHash7("sha256").update(content).digest("hex");
+var hash4 = (content) => createHash8("sha256").update(content).digest("hex");
 var result = (value, isError = false) => ({
   isError,
   content: [{ type: "text", text: JSON.stringify(value, null, 2) }]
@@ -28873,8 +29134,8 @@ async function reverse(args, root, options) {
   if (!selectedSchemas.length || selectedSchemas.some((schema) => !/^[a-z_][a-z0-9_$]*$/i.test(schema))) {
     throw new Error("Select valid PostgreSQL schemas");
   }
-  await mkdir6(dirname10(out), { recursive: true });
-  const stage = await mkdtemp(join15(dirname10(out), ".reverse-"));
+  await mkdir6(dirname11(out), { recursive: true });
+  const stage = await mkdtemp(join15(dirname11(out), ".reverse-"));
   try {
     const snapshot = await withDatabase(args, options, async (executor, url) => {
       const snapshot = await reverseDatabase(executor, selectedSchemas);
@@ -28918,8 +29179,8 @@ async function diff2(args, root, options) {
   const input = await migrations(root, args.dir ?? (await boundary(root))?.migrations ?? "supabase/migrations");
   if (overlaps(input.dir, out))
     throw new Error("Candidate output overlaps reviewed migration history");
-  await mkdir6(dirname10(out), { recursive: true });
-  const stage = await mkdtemp(join15(dirname10(out), ".diff-"));
+  await mkdir6(dirname11(out), { recursive: true });
+  const stage = await mkdtemp(join15(dirname11(out), ".diff-"));
   try {
     await initializeCandidate(stage, args.db_major_version);
     if (!await copySqlSources(root, sourcePath, join15(stage, "supabase/schemas")))
@@ -29011,7 +29272,7 @@ async function migrationAction(args, root, options) {
   }
 }
 async function runDbWorkflow(args, projectRoot, options = {}) {
-  const root = resolve19(projectRoot);
+  const root = resolve20(projectRoot);
   if ((await lstat4(root)).isSymbolicLink())
     throw new Error("Workflow root must not be a symlink");
   switch (args.action) {
@@ -29072,7 +29333,7 @@ function normalizeModule(candidate, sourcePath) {
   };
 }
 async function loadDatabaseModules(root, moduleFile) {
-  const filePath = moduleFile ? resolve20(root, moduleFile) : join16(root, "db", "modules.ts");
+  const filePath = moduleFile ? resolve21(root, moduleFile) : join16(root, "db", "modules.ts");
   if (!existsSync13(filePath)) {
     throw new Error(moduleFile ? `Module file not found: ${filePath}` : `Module file not found: ${filePath}（用 --module_file 指定一个导出 defineDatabaseModule(...) 的文件）`);
   }
@@ -29208,7 +29469,7 @@ async function runLint(args, root) {
   const issues = [];
   for (const module of selected) {
     const readSqlFile = async (path) => {
-      const absolute = resolve20(root, path);
+      const absolute = resolve21(root, path);
       try {
         return await Bun.file(absolute).text();
       } catch (error) {
@@ -29248,14 +29509,14 @@ var defaultLiteSpawn = async (command, cwd) => {
   return { exitCode, stdout, stderr };
 };
 async function runModuleCheckLite(args, root, spawn, liteBinary) {
-  const projectDir = resolve20(args.project_dir?.trim() || root);
+  const projectDir = resolve21(args.project_dir?.trim() || root);
   const binary = liteBinary === undefined ? Bun.which("supacloud-lite") : liteBinary;
   if (!binary) {
     throw new Error("db module_check --lite 需要本机可用的 supacloud-lite（npm i -g @supacloud/lite，或加入 PATH）");
   }
   const command = [binary, "db", "check", "--project-dir", projectDir];
   if (args.module_file?.trim())
-    command.push("--module-file", resolve20(root, args.module_file.trim()));
+    command.push("--module-file", resolve21(root, args.module_file.trim()));
   const result = await spawn(command, projectDir);
   const output = [result.stdout.trim(), result.stderr.trim()].filter(Boolean).join(`
 `);
@@ -29315,7 +29576,7 @@ function registerDbGovernanceTools(server, options = {}) {
     migration_role: optional(String2(), "[role_sql] Privileged migration role"),
     database: optional(String2(), "[role_sql] PostgreSQL database name")
   }, async (request) => {
-    const root = resolve20(request.root || fallbackRoot);
+    const root = resolve21(request.root || fallbackRoot);
     switch (request.action) {
       case "context":
         return runContext2(request, root);
@@ -29345,8 +29606,8 @@ function registerDbGovernanceTools(server, options = {}) {
 
 // src/shared/tools/scheduled-function-tools.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { readFileSync as readFileSync9, statSync as statSync9 } from "node:fs";
-import { resolve as resolve21 } from "node:path";
+import { readFileSync as readFileSync10, statSync as statSync9 } from "node:fs";
+import { resolve as resolve22 } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 var HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/;
 var ENVIRONMENT_NAME_PATTERN3 = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
@@ -29430,14 +29691,14 @@ function validScheduledFunctionCron(expression) {
 function readScheduleBodyFile(bodyPathInput) {
   if (!bodyPathInput.trim())
     throw new Error("'body_file' must be a path");
-  const bodyPath = resolve21(bodyPathInput);
+  const bodyPath = resolve22(bodyPathInput);
   const bodyStat = statSync9(bodyPath);
   if (!bodyStat.isFile() || bodyStat.size > MAX_BODY_FILE_BYTES) {
     throw new Error("Scheduled Function body file must be a regular file no larger than 1 MiB");
   }
   let payload;
   try {
-    payload = JSON.parse(readFileSync9(bodyPath, "utf8"));
+    payload = JSON.parse(readFileSync10(bodyPath, "utf8"));
   } catch (error) {
     if (!(error instanceof SyntaxError))
       throw error;
@@ -29813,9 +30074,9 @@ var MUTATION_TOOL_SCHEMA = {
 };
 
 // src/shared/tools/release-tools.ts
-import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync14, mkdirSync as mkdirSync5, readdirSync as readdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname11, join as join17, relative as relative9, resolve as resolve22 } from "node:path";
+import { createHash as createHash9 } from "node:crypto";
+import { existsSync as existsSync14, mkdirSync as mkdirSync5, readdirSync as readdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname12, join as join17, relative as relative9, resolve as resolve23 } from "node:path";
 var SAFE_PROJECT_REF = /^[A-Za-z0-9_-]{1,64}$/;
 var SAFE_ENVIRONMENT_ID = /^[A-Za-z0-9_-]{1,64}$/;
 var BACKUP_ID = /^logical-full_[A-Za-z0-9_-]{1,64}_[a-f0-9]{32}$/;
@@ -30056,7 +30317,7 @@ function genericScopedReleaseScopeJson(scope) {
   return JSON.stringify(canonicalValue(scope));
 }
 function genericScopedReleaseScopeSha256(scope) {
-  return createHash8("sha256").update(genericScopedReleaseScopeJson(scope)).digest("hex");
+  return createHash9("sha256").update(genericScopedReleaseScopeJson(scope)).digest("hex");
 }
 function scopeEnvironmentId(scope, action) {
   const environmentId = isRecord6(scope) ? scope.targetEnvironmentId : undefined;
@@ -30137,13 +30398,13 @@ function collectScopeFiles(cwd, file, files, dir, task) {
   const results = [];
   const resolvePathWithFallbacks = (filePath) => {
     const trimmed = filePath.trim();
-    const resolved = resolve22(cwd, trimmed);
+    const resolved = resolve23(cwd, trimmed);
     if (existsSync14(resolved))
       return resolved;
     const candidates = [
-      resolve22(cwd, "supacloud/fa/release-scopes", trimmed),
-      resolve22(cwd, "release-scopes", trimmed),
-      resolve22(cwd, "scopes", trimmed)
+      resolve23(cwd, "supacloud/fa/release-scopes", trimmed),
+      resolve23(cwd, "release-scopes", trimmed),
+      resolve23(cwd, "scopes", trimmed)
     ];
     const found = candidates.find(existsSync14);
     if (found)
@@ -30166,10 +30427,10 @@ function collectScopeFiles(cwd, file, files, dir, task) {
   if (!taskFilter && (!dir || typeof dir !== "string" || !dir.trim())) {
     throw new Error("At least one of --file, --files, or --task is required for scope_rebind");
   }
-  const candidates = typeof dir === "string" && dir.trim() ? [resolve22(cwd, dir.trim())] : [
-    resolve22(cwd, "supacloud/fa/release-scopes"),
-    resolve22(cwd, "release-scopes"),
-    resolve22(cwd, "scopes")
+  const candidates = typeof dir === "string" && dir.trim() ? [resolve23(cwd, dir.trim())] : [
+    resolve23(cwd, "supacloud/fa/release-scopes"),
+    resolve23(cwd, "release-scopes"),
+    resolve23(cwd, "scopes")
   ];
   for (const directory of candidates) {
     if (existsSync14(directory)) {
@@ -30184,7 +30445,7 @@ function collectScopeFiles(cwd, file, files, dir, task) {
               results.push(fullPath);
             } else {
               try {
-                const parsed = JSON.parse(readFileSync10(fullPath, "utf8"));
+                const parsed = JSON.parse(readFileSync11(fullPath, "utf8"));
                 if (typeof parsed?.taskId === "string" && parsed.taskId.toLowerCase() === taskFilter) {
                   results.push(fullPath);
                 }
@@ -30203,7 +30464,7 @@ function collectScopeFiles(cwd, file, files, dir, task) {
   return [...new Set(results)];
 }
 function handleScopeRebind(args) {
-  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve22(args.cwd.trim()) : process.cwd();
+  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve23(args.cwd.trim()) : process.cwd();
   const targetBaseCommit = resolveGitBaseCommit(cwd, args.base_commit);
   const requestedEnvironmentId = requestedScopeEnvironment(args, "scope_rebind");
   const scopeFiles = collectScopeFiles(cwd, args.file, args.files, args.dir, args.task);
@@ -30211,7 +30472,7 @@ function handleScopeRebind(args) {
   const parsedScopes = scopeFiles.map((filePath) => {
     let content;
     try {
-      content = readFileSync10(filePath, "utf8");
+      content = readFileSync11(filePath, "utf8");
     } catch (cause) {
       throw new Error(`Failed to read scope file '${filePath}': ${cause instanceof Error ? cause.message : String(cause)}`);
     }
@@ -30261,18 +30522,18 @@ function handleScopeRebind(args) {
   });
 }
 function handleScopeInspect(args) {
-  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve22(args.cwd.trim()) : process.cwd();
+  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve23(args.cwd.trim()) : process.cwd();
   const requestedEnvironmentId = requestedScopeEnvironment(args, "scope_inspect");
   if (typeof args.file !== "string" || !args.file.trim()) {
     throw new Error("'file' is required for scope_inspect");
   }
   const trimmed = args.file.trim();
-  let filePath = resolve22(cwd, trimmed);
+  let filePath = resolve23(cwd, trimmed);
   if (!existsSync14(filePath)) {
     const candidates = [
-      resolve22(cwd, "supacloud/fa/release-scopes", trimmed),
-      resolve22(cwd, "release-scopes", trimmed),
-      resolve22(cwd, "scopes", trimmed)
+      resolve23(cwd, "supacloud/fa/release-scopes", trimmed),
+      resolve23(cwd, "release-scopes", trimmed),
+      resolve23(cwd, "scopes", trimmed)
     ];
     const found = candidates.find(existsSync14);
     if (found)
@@ -30282,7 +30543,7 @@ function handleScopeInspect(args) {
   }
   let content;
   try {
-    content = readFileSync10(filePath, "utf8");
+    content = readFileSync11(filePath, "utf8");
   } catch (cause) {
     throw new Error(`Failed to read scope file '${args.file}': ${cause instanceof Error ? cause.message : String(cause)}`);
   }
@@ -30337,7 +30598,7 @@ function parseCommaList(value) {
   return [];
 }
 function handleScopeCreate(args, fallbackRef) {
-  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve22(args.cwd.trim()) : process.cwd();
+  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve23(args.cwd.trim()) : process.cwd();
   if (typeof args.file !== "string" || !args.file.trim()) {
     throw new Error("'file' is required for scope_create");
   }
@@ -30353,8 +30614,8 @@ function handleScopeCreate(args, fallbackRef) {
     throw new Error("'ref' is invalid for release controls");
   }
   const targetBaseCommit = resolveGitBaseCommit(cwd, args.base_commit);
-  const filePath = resolve22(cwd, args.file.trim());
-  mkdirSync5(dirname11(filePath), { recursive: true });
+  const filePath = resolve23(cwd, args.file.trim());
+  mkdirSync5(dirname12(filePath), { recursive: true });
   const scope = {
     baseCommit: targetBaseCommit,
     excludedFunctions: parseCommaList(args.excluded_functions),
@@ -30600,9 +30861,9 @@ function registerReleaseTools(server, http, options = {}) {
 // src/shared/tools/deploy-tools.ts
 import { access, lstat as lstat5, mkdtemp as mkdtemp2, opendir, readFile as readFile6, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
 import { spawn as spawn2 } from "node:child_process";
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 import { tmpdir as tmpdir3 } from "node:os";
-import { basename as basename8, dirname as dirname12, join as join18, relative as relative10, resolve as resolve23, sep as sep5 } from "node:path";
+import { basename as basename8, dirname as dirname13, join as join18, relative as relative10, resolve as resolve24, sep as sep5 } from "node:path";
 
 // src/shared/tools/project-deployment.ts
 async function requireProjectDeploymentProtocol(http, projectRef, environmentId) {
@@ -30728,15 +30989,15 @@ async function readJson(path) {
   }
 }
 async function findDeployConfigRoot(startDirectory, environmentName) {
-  let directory = resolve23(startDirectory);
+  let directory = resolve24(startDirectory);
   while (true) {
     const environmentFile = environmentName ? `.env.supacloud.${environmentName}` : null;
     if (await pathExists(join18(directory, "supacloud.json")) || await pathExists(join18(directory, "supacloud.config.ts")) || environmentFile !== null && await pathExists(join18(directory, environmentFile))) {
       return directory;
     }
-    const parent = dirname12(directory);
+    const parent = dirname13(directory);
     if (parent === directory)
-      return resolve23(startDirectory);
+      return resolve24(startDirectory);
     directory = parent;
   }
 }
@@ -30889,7 +31150,7 @@ async function defaultBuildCommand(projectDirectory, configRoot) {
       return "yarn build";
     if (directory === configRoot)
       break;
-    const parent = dirname12(directory);
+    const parent = dirname13(directory);
     if (parent === directory || !directory.startsWith(`${configRoot}${sep5}`))
       break;
     directory = parent;
@@ -30957,9 +31218,9 @@ function selectFrontendTarget(configRoot, config) {
   throw new Error(`Multiple frontend deploy targets found (${targets.map(([name]) => name).sort().join(", ")}). Set defaultTarget to the Web target`);
 }
 function targetRoot(configRoot, target, name) {
-  const root = resolve23(configRoot, target.root || (name === "frontend" ? "." : name));
-  const prefix = `${resolve23(configRoot)}${sep5}`;
-  if (root !== resolve23(configRoot) && !root.startsWith(prefix)) {
+  const root = resolve24(configRoot, target.root || (name === "frontend" ? "." : name));
+  const prefix = `${resolve24(configRoot)}${sep5}`;
+  if (root !== resolve24(configRoot) && !root.startsWith(prefix)) {
     throw new Error(`Deploy target '${name}' root must stay inside the repository root`);
   }
   return root;
@@ -30977,8 +31238,8 @@ function defaultOutputDirectory(framework) {
   }
 }
 function resolveInsideProject(projectDirectory, candidate, allowRoot = false) {
-  const resolved = resolve23(projectDirectory, candidate);
-  const projectRoot = resolve23(projectDirectory);
+  const resolved = resolve24(projectDirectory, candidate);
+  const projectRoot = resolve24(projectDirectory);
   const projectPrefix = `${projectRoot}${sep5}`;
   if (!allowRoot && resolved === projectRoot || resolved !== projectRoot && !resolved.startsWith(projectPrefix)) {
     throw new Error("Frontend output directory must stay inside the project directory");
@@ -31057,9 +31318,9 @@ async function collectArchiveFiles(root) {
       throw new Error(`Frontend output exceeds ${MAX_SOURCE_BYTES} bytes`);
     const archivePath = relative10(root, path).split(sep5).join("/");
     files.set(archivePath, data);
-    digests.push({ path: archivePath, size: data.byteLength, sha256: createHash9("sha256").update(data).digest("hex") });
+    digests.push({ path: archivePath, size: data.byteLength, sha256: createHash10("sha256").update(data).digest("hex") });
   }
-  const tree = createHash9("sha256");
+  const tree = createHash10("sha256");
   for (const file of digests.sort((left, right) => left.path.localeCompare(right.path))) {
     const pathBytes = Buffer.from(file.path, "utf8");
     const frame = Buffer.alloc(12);
@@ -31075,7 +31336,7 @@ async function createCollectedFrontendArchive(outputDirectory, collected) {
   try {
     const archiveBytes = await createFrontendTarZstd(collected.files);
     await writeFile6(archivePath, archiveBytes);
-    const sha256 = createHash9("sha256").update(archiveBytes).digest("hex");
+    const sha256 = createHash10("sha256").update(archiveBytes).digest("hex");
     return {
       archivePath,
       sha256,
@@ -31119,7 +31380,7 @@ async function publishConfiguredFrontend(http, projectRef, configRoot, skipBuild
 }
 function registerDeployTools(server, http, options = {}) {
   registerTool(server, "deploy", "Build and publish the linked project with one command", deployToolSchema, async (args) => {
-    const invocationDirectory = resolve23(String(args.cwd || options.cwd || process.cwd()));
+    const invocationDirectory = resolve24(String(args.cwd || options.cwd || process.cwd()));
     const projectRef = String(args.ref || options.projectRef || "").trim();
     if (!projectRef)
       throw new Error("A linked project ref is required. Set SUPACLOUD_PROJECT_REF or pass --ref");
@@ -31197,8 +31458,8 @@ function registerDeployTools(server, http, options = {}) {
 import { existsSync as existsSync15 } from "node:fs";
 import { readFile as readFile7 } from "node:fs/promises";
 import { readdir as readdir7 } from "node:fs/promises";
-import { createHash as createHash10 } from "node:crypto";
-import { join as join19, resolve as resolve24 } from "node:path";
+import { createHash as createHash11 } from "node:crypto";
+import { join as join19, resolve as resolve25 } from "node:path";
 import { compileProject as compileProject2 } from "@supacloud/compiler";
 var SAFE_TOKEN = /^[A-Za-z0-9._:@/+,-]+$/;
 var SAFE_REMOTE_ROOT = /^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+\/?$/;
@@ -31244,12 +31505,12 @@ function toolFailed(value) {
   return result.isError === true || content.some((chunk) => chunk !== null && typeof chunk === "object" && ("text" in chunk) && typeof chunk.text === "string" && chunk.text.trimStart().startsWith("❌"));
 }
 async function migrateDatabase(args, options) {
-  const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
+  const root = resolve25(String(args.project_dir || options.cwd || process.cwd()));
   const projectConfig = await readProjectConfig(root);
   const config = projectConfig.dev || {};
   const database = config.database || {};
   const execute = options.execute || ((command, commandArgs, cwd) => runProcess(command, commandArgs, cwd));
-  const drizzleConfig = resolve24(root, String(args.drizzle_config || database.drizzleConfig || "drizzle.config.ts"));
+  const drizzleConfig = resolve25(root, String(args.drizzle_config || database.drizzleConfig || "drizzle.config.ts"));
   const migrationsDir = String(args.migrations_dir || database.migrationsDir || "supabase/migrations");
   if (!existsSync15(drizzleConfig))
     throw new Error(`Drizzle config not found: ${drizzleConfig}`);
@@ -31296,7 +31557,7 @@ async function sourceFingerprint(root) {
     }
   };
   await visit(root);
-  const hash = createHash10("sha256");
+  const hash = createHash11("sha256");
   for (const file of files) {
     hash.update(file.slice(root.length).replace(/\\/g, "/"));
     hash.update(await readFile7(file));
@@ -31321,14 +31582,14 @@ function targetDirectory(root, target, functionSlug, config = {}) {
     const targets = config["targets"];
     const entries = targets && typeof targets === "object" ? Object.values(targets) : [];
     const match = entries.find((entry) => entry !== null && typeof entry === "object" && ("type" in entry) && entry.type === "edge_function" && (!("root" in entry) || typeof entry.root === "string") && (!("slug" in entry) || typeof entry.slug === "string") && (!functionSlug || ("slug" in entry) && entry.slug === functionSlug));
-    const base = match?.root ? resolve24(root, match.root) : join19(root, "supabase", "functions");
+    const base = match?.root ? resolve25(root, match.root) : join19(root, "supabase", "functions");
     return match?.root ? base : functionSlug ? join19(base, safeToken(functionSlug, "function")) : base;
   }
   if (target === "frontend") {
     const targets = config["targets"];
     const entries = targets && typeof targets === "object" ? Object.values(targets) : [];
     const match = entries.find((entry) => entry !== null && typeof entry === "object" && ("type" in entry) && entry.type === "frontend" && (!("root" in entry) || typeof entry.root === "string"));
-    return match?.root ? resolve24(root, match.root) : join19(root, "apps", "web");
+    return match?.root ? resolve25(root, match.root) : join19(root, "apps", "web");
   }
   return root;
 }
@@ -31367,10 +31628,10 @@ function reloadCommand(config, target, projectRef, functionSlug) {
   return [...command.split(" "), "--project-ref", safeToken(projectRef || "test", "project_ref"), "--target", targetConfigPath(target), ...functionSlug ? ["--function", safeToken(functionSlug, "function")] : []];
 }
 function sshArgs(connection, remoteCommand) {
-  return ["-p", String(connection.port), "-i", resolve24(connection.key), "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=yes", `${connection.user}@${connection.host}`, ...remoteCommand];
+  return ["-p", String(connection.port), "-i", resolve25(connection.key), "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=yes", `${connection.user}@${connection.host}`, ...remoteCommand];
 }
 function rsyncArgs(connection, source, destination, excludes, deleteRemote) {
-  const args = ["-az", "--checksum", "--partial", "--protect-args", "-e", `ssh -p ${connection.port} -i ${resolve24(connection.key)} -o BatchMode=yes -o StrictHostKeyChecking=yes`];
+  const args = ["-az", "--checksum", "--partial", "--protect-args", "-e", `ssh -p ${connection.port} -i ${resolve25(connection.key)} -o BatchMode=yes -o StrictHostKeyChecking=yes`];
   if (deleteRemote)
     args.push("--delete-delay");
   for (const exclude of excludes) {
@@ -31382,7 +31643,7 @@ function rsyncArgs(connection, source, destination, excludes, deleteRemote) {
   return args;
 }
 async function syncOnce(args, options) {
-  const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
+  const root = resolve25(String(args.project_dir || options.cwd || process.cwd()));
   const projectConfig = await readProjectConfig(root);
   const config = projectConfig.dev || {};
   const target = String(args.target || "project");
@@ -31391,8 +31652,8 @@ async function syncOnce(args, options) {
     throw new Error(`Dev source directory not found: ${source}`);
   let compiled = false;
   if (config.compile === true && target !== "db") {
-    const compileRoot = resolve24(root, config.compileRoot || ".");
-    const compileOutDir = resolve24(root, config.compileOutDir || "generated");
+    const compileRoot = resolve25(root, config.compileRoot || ".");
+    const compileOutDir = resolve25(root, config.compileOutDir || "generated");
     const compilation = await compileProject2({
       rootDir: compileRoot,
       outDir: compileOutDir,
@@ -31430,7 +31691,7 @@ function registerRemoteDevTools(server, options = {}) {
     if (["production", "prod"].includes((options.environment || "").toLowerCase()))
       throw new Error("Remote dev mode is forbidden for production environments");
     if (args.action === "status") {
-      const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
+      const root = resolve25(String(args.project_dir || options.cwd || process.cwd()));
       const config = await readDevConfig(root);
       const connection = connectionArgs(options, config, args);
       const execute = options.execute || ((command, commandArgs, cwd) => runProcess(command, commandArgs, cwd));
@@ -31444,7 +31705,7 @@ function registerRemoteDevTools(server, options = {}) {
       return { content: [{ type: "text", text: JSON.stringify(await migrateDatabase(args, options), null, 2) }] };
     }
     if (args.action === "watch") {
-      const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
+      const root = resolve25(String(args.project_dir || options.cwd || process.cwd()));
       const interval = Math.max(100, Math.min(1e4, Number(args.interval_ms || 300)));
       let fingerprint = "";
       let lastSync = null;
@@ -31466,12 +31727,12 @@ function registerRemoteDevTools(server, options = {}) {
 // src/shared/tools/developer-experience-tools.ts
 import { existsSync as existsSync17 } from "node:fs";
 import { mkdir as mkdir7, readdir as readdir8, readFile as readFile8, writeFile as writeFile7 } from "node:fs/promises";
-import { dirname as dirname13, join as join20, resolve as resolve26 } from "node:path";
+import { dirname as dirname14, join as join20, resolve as resolve27 } from "node:path";
 
 // src/shared/context.ts
-import { existsSync as existsSync16, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync12 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { resolve as resolve25 } from "node:path";
+import { resolve as resolve26 } from "node:path";
 var CORE_CONTEXT_KEYS2 = [
   "SUPABASE_URL",
   "SUPABASE_SERVICE_ROLE_KEY",
@@ -31513,7 +31774,7 @@ function readEnvFile2(path, required) {
     return {};
   }
   try {
-    return parseEnvFile2(readFileSync11(path, "utf8"));
+    return parseEnvFile2(readFileSync12(path, "utf8"));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Failed to read SupaCloud environment file ${path}: ${message}`);
@@ -31587,7 +31848,7 @@ function parseInsecureTls2(values) {
 }
 function namedEnvironmentSource2(cwd, selector) {
   const environment = normalizeEnvironmentName(selector);
-  const path = resolve25(cwd, `.env.supacloud.${selector}`);
+  const path = resolve26(cwd, `.env.supacloud.${selector}`);
   const values = readEnvFile2(path, true);
   if (values.SUPACLOUD_ENV && normalizeEnvironmentName(values.SUPACLOUD_ENV) !== environment) {
     throw new Error(`SUPACLOUD_ENV in ${path} does not match selector ${selector}`);
@@ -31595,7 +31856,7 @@ function namedEnvironmentSource2(cwd, selector) {
   return { values, kind: "named_env_file", path, environment };
 }
 function explicitEnvironmentSource2(cwd, envFile) {
-  const path = resolve25(cwd, envFile);
+  const path = resolve26(cwd, envFile);
   const values = readEnvFile2(path, true);
   if (!values.SUPACLOUD_ENV)
     throw new Error(`SUPACLOUD_ENV is required in ${path}`);
@@ -31624,7 +31885,7 @@ function contextSource2(env, cwd, selection) {
   if (hasProcessContext2(env)) {
     return { values: processValues2(env), kind: "process_env", path: null, environment: "" };
   }
-  const path = resolve25(cwd, ".env");
+  const path = resolve26(cwd, ".env");
   const values = readEnvFile2(path, false);
   const environment = values.SUPACLOUD_ENV ? normalizeEnvironmentName(values.SUPACLOUD_ENV) : "";
   return { values, kind: Object.keys(values).length ? "legacy_dotenv" : "none", path: existsSync16(path) ? path : null, environment };
@@ -31639,7 +31900,7 @@ function resolveSupaCloudContext2(env = process.env, cwd = process.cwd(), select
     host,
     sshUser: env.SUPACLOUD_SSH_USER ?? "root",
     sshPort: parseInt(env.SUPACLOUD_SSH_PORT ?? "22", 10),
-    sshKey: env.SUPACLOUD_SSH_KEY ?? resolve25(homedir3(), ".ssh", "id_rsa"),
+    sshKey: env.SUPACLOUD_SSH_KEY ?? resolve26(homedir3(), ".ssh", "id_rsa"),
     sshPass: env.SUPACLOUD_SSH_PASS ?? "",
     apiUrl: core.apiUrl,
     apiToken: core.apiToken,
@@ -31760,7 +32021,7 @@ async function ensureGitignore(root) {
   return true;
 }
 async function initializeProject(request, options) {
-  const root = resolve26(request.root || options.cwd || process.cwd());
+  const root = resolve27(request.root || options.cwd || process.cwd());
   await mkdir7(root, { recursive: true });
   const configPath = join20(root, "supacloud.json");
   if (existsSync17(configPath)) {
@@ -31873,11 +32134,11 @@ function deployMissing(context, application, hasFrontend = false) {
 }
 async function inspectProfile(profile) {
   try {
-    const context = resolveSupaCloudContext2({}, dirname13(profile.path), {
+    const context = resolveSupaCloudContext2({}, dirname14(profile.path), {
       environmentName: profile.name
     });
     const status = statusMissing(context);
-    const configText = await readFile8(join20(dirname13(profile.path), "supacloud.json"), "utf8").catch((error) => {
+    const configText = await readFile8(join20(dirname14(profile.path), "supacloud.json"), "utf8").catch((error) => {
       if (error instanceof Error && "code" in error && error.code === "ENOENT")
         return "{}";
       throw error;
@@ -31921,7 +32182,7 @@ async function inspectProfile(profile) {
   }
 }
 async function inspectEnvironment(request, options) {
-  const root = resolve26(request.root || options.cwd || process.cwd());
+  const root = resolve27(request.root || options.cwd || process.cwd());
   const profiles = await environmentProfiles(root);
   if (request.action === "list") {
     const active = options.activeContext?.environment || null;
@@ -32103,7 +32364,7 @@ async function runProjectDeployment(http, args) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.103.3",
+  version: "0.103.6",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -32155,19 +32416,19 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.46.6",
-    "@supacloud/delivery": "0.19.0",
-    "@supacloud/db": "0.18.0",
+    "@supacloud/compiler": "^0.47.2",
+    "@supacloud/delivery": "0.19.3",
+    "@supacloud/db": "0.18.3",
     typebox: "1.3.37"
   },
   overrides: {
-    "@supacloud/contracts": "0.11.1",
-    "@supacloud/delivery": "0.19.0",
+    "@supacloud/contracts": "0.11.4",
+    "@supacloud/delivery": "0.19.3",
     "@graphql-tools/utils": "^12.0.4"
   },
   devDependencies: {
     "@supabase/supabase-js": "2.117.3",
-    "@supacloud/elysia": "0.33.1",
+    "@supacloud/elysia": "0.33.4",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
     elysia: "2.0.0-beta.32",
@@ -32456,6 +32717,7 @@ EXAMPLES
   ${preferredCommand} app explain --target CaseService
   ${preferredCommand} app context --root . --format json
   ${preferredCommand} app context --root . --target CaseModule --format json
+  ${preferredCommand} app context --root . --target CaseModule --events execution.ndjson --request-id request-123 --format json
   ${preferredCommand} app doctor --root .
   ${preferredCommand} app fix --root . --fix fix.json --write
   ${preferredCommand} generate --kind module --name billing