@supacloud/cli 0.112.0 → 0.112.2

package/README.md

@@ -492,7 +492,7 @@ Example configuration write file:
   "configuration_id": "01234567-89ab-4def-8123-456789abcdef",
   "expected_configuration_id": null,
   "configuration": {
-    "bun_version": "1.4.3",
+    "bun_version": "1.4.4",
     "targets": [
       {
         "name": "api",
@@ -1002,10 +1002,14 @@ supacloud lite db_pull --project_dir . --file remote_schema
 supacloud lite db_pull --project_dir . --file reviewed_schema --baseline
 supacloud lite gen_types --project_dir . --output src/database.types.ts
 supacloud lite snapshot_create --project_dir . --output backups/lite.tar.gz
-supacloud lite doctor --project_dir . --json
-supacloud lite start --project_dir . --port 54321
+supacloud lite doctor --project_dir . --json --production --runtime_mode strict
+supacloud lite db_check --project_dir . --module_file supabase/db/modules.ts
+supacloud lite start --project_dir . --port 54321 --runtime_mode strict
 ```
 
+`auth create-user` is not exposed here. The standalone `supacloud-lite` binary
+reads the password from stdin and rejects password arguments.
+
 The adapter resolves the executable in this order:
 
 1. `SUPACLOUD_LITE_CLI_BIN`

package/dist/index.js

@@ -6770,9 +6770,14 @@ function IsTime(value, strictTimeZone = true) {
 }
 
 // node_modules/typebox/build/format/date_time.mjs
+var DATE_TIME_SUFFIX = /^(?:\[!?(?:(?!\.{1,2}[/\]])[A-Za-z._][A-Za-z._0-9+-]{0,13}(?:\/(?!\.{1,2}[/\]])[A-Za-z._][A-Za-z._0-9+-]{0,13})*|[+-](?:[01][0-9]|2[0-3]):[0-5][0-9])\](?:\[!?[a-z_][a-z_0-9-]*=[A-Za-z0-9]+(?:-[A-Za-z0-9]+)*\])*|(?:\[!?[a-z_][a-z_0-9-]*=[A-Za-z0-9]+(?:-[A-Za-z0-9]+)*\])*)$/;
 function IsDateTime(value) {
-  const dateTime = value.split(/T/i);
-  return dateTime.length === 2 && IsDate2(dateTime[0]) && IsTime(dateTime[1]);
+  const index = value.indexOf("[");
+  const datetime = index === -1 ? value : value.slice(0, index);
+  if (index !== -1 && !DATE_TIME_SUFFIX.test(value.slice(index)))
+    return false;
+  const split = datetime.split(/T/i);
+  return split.length === 2 && IsDate2(split[0]) && IsTime(split[1]);
 }
 
 // node_modules/typebox/build/format/duration.mjs
@@ -9313,6 +9318,7 @@ var ACTION_POLICY = {
       "db_reset",
       "db_diff",
       "db_pull",
+      "db_check",
       "snapshot_create",
       "snapshot_restore",
       "upgrade",
@@ -16371,6 +16377,16 @@ Actions: list, get_config, deploy, deploy_bundle, config, source, activate, dele
       const tmpFile = join5(tmpDir, "index.ts");
       writeFileSync(tmpFile, sourceCode);
       try {
+        if (/@ts-(?:ignore|nocheck|expect-error)\b/.test(sourceCode)) {
+          const { scanProductionSource } = await import("@supacloud/compiler");
+          const suppression = scanProductionSource({ rootDir: tmpDir, include: ["index.ts"] }).find((diagnostic) => diagnostic.code === "source-type-suppression");
+          if (suppression) {
+            return {
+              ok: false,
+              err: `Vibecoding guardrail violation: Type suppression directive at line ${suppression.line} is disallowed in Edge Functions. Please fix the underlying type mismatch instead of suppressing it.`
+            };
+          }
+        }
         await runBunBuild([tmpFile, "--external", "*"]);
         return { ok: true };
       } catch (error) {
@@ -21413,6 +21429,9 @@ function buildLiteArgs(request) {
       if (request.file)
         args.push(request.file);
       break;
+    case "db_check":
+      args.push("db", "check");
+      break;
     case "snapshot_create":
       args.push("snapshot", "create");
       break;
@@ -21451,6 +21470,17 @@ function buildLiteArgs(request) {
   if (request.baseline && request.action !== "db_pull")
     throw new Error("baseline requires db_pull");
   booleanFlag(args, "--baseline", request.baseline);
+  if (request.production && request.action !== "doctor")
+    throw new Error("production requires doctor");
+  booleanFlag(args, "--production", request.production);
+  if (request.module_file && request.action !== "db_check")
+    throw new Error("module_file requires db_check");
+  optionalFlag(args, "--module-file", request.module_file);
+  optionalFlag(args, "--runtime-mode", request.runtime_mode);
+  optionalFlag(args, "--postgres-dir", request.postgres_dir);
+  optionalFlag(args, "--identity-module", request.identity_module);
+  optionalFlag(args, "--external-auth-proxy-issuer", request.external_auth_proxy_issuer);
+  optionalFlag(args, "--external-auth-proxy-redirect-origin", request.external_auth_proxy_redirect_origin);
   return args;
 }
 async function spawnLiteCommand(command, workdir, environment, inheritOutput) {
@@ -21533,7 +21563,8 @@ function registerLiteCliTools(server, options = {}) {
       "snapshot_restore",
       "upgrade",
       "inspect",
-      "doctor"
+      "doctor",
+      "db_check"
     ]), "Lite CLI action"),
     workdir: optional(String2(), "[*] Process working directory (default: current directory)"),
     project_dir: optional(String2(), "[*] Project containing supabase/"),
@@ -21561,7 +21592,14 @@ function registerLiteCliTools(server, options = {}) {
     force: optional(Boolean2(), "[snapshot_restore] Replace non-empty restore targets"),
     memory: optional(Boolean2(), "[*] Use an in-memory PGlite database"),
     json: optional(Boolean2(), "[doctor] Emit machine-readable output"),
-    baseline: optional(Boolean2(), "[db_pull] Record already-present schema in local migration history after review")
+    baseline: optional(Boolean2(), "[db_pull] Record already-present schema in local migration history after review"),
+    production: optional(Boolean2(), "[doctor] Add single-node production readiness checks"),
+    runtime_mode: optional(stringEnum2(["development", "strict"]), "[*] Lite runtime mode"),
+    postgres_dir: optional(String2(), "[native] Operator-managed PostgreSQL installation"),
+    identity_module: optional(String2(), "[*] Trusted external identity bridge module"),
+    external_auth_proxy_issuer: optional(String2(), "[start] Same-origin OAuth proxy issuer"),
+    external_auth_proxy_redirect_origin: optional(String2(), "[start] Allowed logout redirect origins"),
+    module_file: optional(String2(), "[db_check] Database module manifest")
   }, async (request) => {
     buildLiteArgs(request);
     const execution = await execute(request);
@@ -21945,25 +21983,25 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.52.0"
+      version: "0.52.2"
     },
     app: {
-      version: "0.34.0",
+      version: "0.35.0",
       dependencies: {
         rxjs: "7.8.2"
       }
     },
     elysia: {
-      version: "0.36.2"
+      version: "0.37.0"
     },
     commands: {
-      version: "0.11.1"
+      version: "0.11.2"
     },
     contracts: {
-      version: "0.15.1"
+      version: "0.15.2"
     },
     db: {
-      version: "0.20.1",
+      version: "0.20.3",
       peerDependencies: {
         "drizzle-orm": "1.0.0-rc.5-5935859"
       },
@@ -21972,7 +22010,7 @@ var starter_metadata_default = {
       }
     },
     sdk: {
-      version: "0.45.3",
+      version: "0.45.5",
       peerDependencies: {
         "@supabase/supabase-js": "^2.118.0"
       }
@@ -22297,7 +22335,7 @@ function baseFiles(name, sdkDependencies) {
       version: "0.0.0",
       private: true,
       type: "module",
-      engines: { bun: ">=1.4.3" },
+      engines: { bun: ">=1.4.4" },
       scripts: {
         compile: "bun --no-env-file node_modules/@supacloud/compiler/dist/cli.js compile",
         "check:generated": "bun --no-env-file node_modules/@supacloud/compiler/dist/cli.js check",
@@ -22321,7 +22359,7 @@ function baseFiles(name, sdkDependencies) {
       },
       devDependencies: {
         "@supacloud/compiler": `^${compilerMetadata.version}`,
-        "@types/bun": "^1.4.3",
+        "@types/bun": "^1.4.4",
         typescript: "^7.0.2"
       }
     }),
@@ -25452,7 +25490,7 @@ function appStarterFiles(name) {
       version: "0.0.0",
       private: true,
       type: "module",
-      engines: { bun: ">=1.4.3" },
+      engines: { bun: ">=1.4.4" },
       scripts: {
         compile: "bun --no-env-file node_modules/@supacloud/compiler/dist/cli.js compile",
         "check:generated": "bun --no-env-file node_modules/@supacloud/compiler/dist/cli.js check",
@@ -25488,7 +25526,7 @@ function appStarterFiles(name) {
       devDependencies: {
         "@supacloud/compiler": `^${compilerMetadata2.version}`,
         "drizzle-kit": dbMetadata.devDependencies["drizzle-kit"],
-        "@types/bun": "^1.4.3",
+        "@types/bun": "^1.4.4",
         typescript: "^7.0.2"
       }
     }),
@@ -33581,7 +33619,7 @@ async function runProjectDeployment(http, args) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.112.0",
+  version: "0.112.2",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -33633,20 +33671,20 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.52.0",
-    "@supacloud/delivery": "0.23.0",
-    "@supacloud/db": "0.20.1",
-    typebox: "1.4.2"
+    "@supacloud/compiler": "^0.52.2",
+    "@supacloud/delivery": "0.23.1",
+    "@supacloud/db": "0.20.3",
+    typebox: "1.4.3"
   },
   overrides: {
-    "@supacloud/contracts": "0.15.1",
-    "@supacloud/delivery": "0.23.0",
+    "@supacloud/contracts": "0.15.2",
+    "@supacloud/delivery": "0.23.1",
     "@graphql-tools/utils": "^12.0.4"
   },
   devDependencies: {
     "@supabase/supabase-js": "2.118.0",
-    "@supacloud/elysia": "0.36.2",
-    "@types/bun": "^1.4.3",
+    "@supacloud/elysia": "0.37.0",
+    "@types/bun": "^1.4.4",
     effect: "4.0.5",
     elysia: "2.0.0-rc.0",
     typescript: "^7.0.2"

package/dist/shared/tools/application-preview-tools.d.ts

@@ -5,7 +5,7 @@ export declare const APPLICATION_PREVIEW_FIELDS: {
     preview_id: Type.TOptional<Type.TString>;
     branch_ref: Type.TOptional<Type.TString>;
     branch_name: Type.TOptional<Type.TString>;
-    data_mode: Type.TOptional<Type.TEnum<("schema_only" | "full_clone")[]>>;
+    data_mode: Type.TOptional<Type.TEnum<("full_clone" | "schema_only")[]>>;
     ttl_seconds: Type.TOptional<Type.TInteger>;
     wait: Type.TOptional<Type.TBoolean>;
     timeout_seconds: Type.TOptional<Type.TInteger>;
@@ -18,40 +18,40 @@ declare const receiptSchema: Type.TObject<{
     environment_id: Type.TString;
     release_id: Type.TString;
     expires_at: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
-    status: Type.TEnum<("ready" | "failed" | "cleaned" | "planned" | "provisioning")[]>;
+    status: Type.TEnum<("cleaned" | "failed" | "planned" | "provisioning" | "ready")[]>;
     resources: Type.TObject<{
         build_artifact: Type.TObject<{
-            status: Type.TEnum<("pending" | "ready" | "failed" | "cleaned")[]>;
+            status: Type.TEnum<("cleaned" | "failed" | "pending" | "ready")[]>;
             release_id: Type.TString;
         }>;
         database_branch: Type.TObject<{
-            status: Type.TEnum<("pending" | "ready" | "failed" | "cleaned")[]>;
+            status: Type.TEnum<("cleaned" | "failed" | "pending" | "ready")[]>;
             branch_ref: Type.TString;
-            data_mode: Type.TEnum<("schema_only" | "full_clone")[]>;
+            data_mode: Type.TEnum<("full_clone" | "schema_only")[]>;
         }>;
         queue_namespace: Type.TObject<{
-            status: Type.TEnum<("pending" | "ready" | "failed" | "cleaned")[]>;
+            status: Type.TEnum<("cleaned" | "failed" | "pending" | "ready")[]>;
             namespace: Type.TString;
         }>;
         storage_namespace: Type.TObject<{
-            status: Type.TEnum<("pending" | "ready" | "failed" | "cleaned")[]>;
+            status: Type.TEnum<("cleaned" | "failed" | "pending" | "ready")[]>;
             namespace: Type.TString;
         }>;
         test_secret: Type.TObject<{
-            status: Type.TEnum<("pending" | "ready" | "failed" | "cleaned")[]>;
+            status: Type.TEnum<("cleaned" | "failed" | "pending" | "ready")[]>;
             name: Type.TString;
             value_issued: Type.TLiteral<false>;
         }>;
         configuration_revision: Type.TObject<{
-            status: Type.TEnum<("pending" | "ready" | "failed" | "cleaned")[]>;
+            status: Type.TEnum<("cleaned" | "failed" | "pending" | "ready")[]>;
             configuration_id: Type.TUnion<[Type.TString, Type.TNull]>;
         }>;
         application_activation: Type.TObject<{
-            status: Type.TEnum<("pending" | "ready" | "failed" | "cleaned")[]>;
+            status: Type.TEnum<("cleaned" | "failed" | "pending" | "ready")[]>;
             activation_id: Type.TUnion<[Type.TString, Type.TNull]>;
         }>;
         smoke_test: Type.TObject<{
-            status: Type.TEnum<("pending" | "ready" | "failed" | "cleaned")[]>;
+            status: Type.TEnum<("cleaned" | "failed" | "pending" | "ready")[]>;
             checks: Type.TArray<Type.TString>;
             passed: Type.TArray<Type.TString>;
             failed: Type.TArray<Type.TString>;

package/dist/shared/tools/application-schemas.d.ts

@@ -147,7 +147,7 @@ export declare const ApplicationPromotionPlanSchema: import("typebox").TObject<{
         confirmed: import("typebox").TLiteral<false>;
     }>;
     action: import("typebox").TUnion<[import("typebox").TLiteral<"promote">, import("typebox").TLiteral<"no-op">, import("typebox").TLiteral<"blocked">]>;
-    blockers: import("typebox").TArray<import("typebox").TEnum<("SOURCE_NOT_ACTIVE" | "SOURCE_RECEIPT_UNCONFIRMED" | "SOURCE_NOT_READY" | "SOURCE_SMOKE_UNVERIFIED" | "TARGET_CONFIGURATION_MISSING" | "TARGET_CONFIGURATION_MISMATCH" | "MIGRATION_PENDING" | "MIGRATION_CONFLICT" | "OPERATOR_PROVISIONING_REQUIRED" | "BACKUP_REQUIRED")[]>>;
+    blockers: import("typebox").TArray<import("typebox").TEnum<("BACKUP_REQUIRED" | "MIGRATION_CONFLICT" | "MIGRATION_PENDING" | "OPERATOR_PROVISIONING_REQUIRED" | "SOURCE_NOT_ACTIVE" | "SOURCE_NOT_READY" | "SOURCE_RECEIPT_UNCONFIRMED" | "SOURCE_SMOKE_UNVERIFIED" | "TARGET_CONFIGURATION_MISMATCH" | "TARGET_CONFIGURATION_MISSING")[]>>;
     steps: import("typebox").TArray<import("typebox").TString>;
     execution_performed: import("typebox").TLiteral<false>;
     data_recovery: import("typebox").TLiteral<"separate-required">;

package/dist/shared/tools/application-tools.d.ts

@@ -5,11 +5,11 @@ export declare const APPLICATION_TOOL_SCHEMA: {
     preview_id: Type.TOptional<Type.TString>;
     branch_ref: Type.TOptional<Type.TString>;
     branch_name: Type.TOptional<Type.TString>;
-    data_mode: Type.TOptional<Type.TEnum<("schema_only" | "full_clone")[]>>;
+    data_mode: Type.TOptional<Type.TEnum<("full_clone" | "schema_only")[]>>;
     ttl_seconds: Type.TOptional<Type.TInteger>;
     wait: Type.TOptional<Type.TBoolean>;
     timeout_seconds: Type.TOptional<Type.TInteger>;
-    action: Type.TEnum<("upload_release" | "activate_release" | "list_releases" | "get_release" | "logs" | "get_runtime" | "get_deployment_evidence" | "get_configuration" | "get_release_transfer_plan" | "get_promotion_plan" | "get_promotion_status" | "get_rollback_snapshot" | "get_history" | "get_deploy_plan" | "get_preview_plan" | "list_previews" | "get_preview" | "put_configuration" | "deploy_application" | "transfer_release" | "promote_application" | "reconcile_promotion" | "create_preview" | "reconcile_preview" | "cleanup_preview" | "deploy_release" | "rollback_release" | "reconcile_activation" | "retire_activation")[]>;
+    action: Type.TEnum<("activate_release" | "cleanup_preview" | "create_preview" | "deploy_application" | "deploy_release" | "get_configuration" | "get_deploy_plan" | "get_deployment_evidence" | "get_history" | "get_preview" | "get_preview_plan" | "get_promotion_plan" | "get_promotion_status" | "get_release" | "get_release_transfer_plan" | "get_rollback_snapshot" | "get_runtime" | "list_previews" | "list_releases" | "logs" | "promote_application" | "put_configuration" | "reconcile_activation" | "reconcile_preview" | "reconcile_promotion" | "retire_activation" | "rollback_release" | "transfer_release" | "upload_release")[]>;
     ref: Type.TString;
     id: Type.TString;
     environment_id: Type.TOptional<Type.TString>;
@@ -86,7 +86,7 @@ export declare const APPLICATION_TOOL_SCHEMA: {
             confirmed: Type.TLiteral<false>;
         }>;
         action: Type.TUnion<[Type.TLiteral<"promote">, Type.TLiteral<"no-op">, Type.TLiteral<"blocked">]>;
-        blockers: Type.TArray<Type.TEnum<("SOURCE_NOT_ACTIVE" | "SOURCE_RECEIPT_UNCONFIRMED" | "SOURCE_NOT_READY" | "SOURCE_SMOKE_UNVERIFIED" | "TARGET_CONFIGURATION_MISSING" | "TARGET_CONFIGURATION_MISMATCH" | "MIGRATION_PENDING" | "MIGRATION_CONFLICT" | "OPERATOR_PROVISIONING_REQUIRED" | "BACKUP_REQUIRED")[]>>;
+        blockers: Type.TArray<Type.TEnum<("BACKUP_REQUIRED" | "MIGRATION_CONFLICT" | "MIGRATION_PENDING" | "OPERATOR_PROVISIONING_REQUIRED" | "SOURCE_NOT_ACTIVE" | "SOURCE_NOT_READY" | "SOURCE_RECEIPT_UNCONFIRMED" | "SOURCE_SMOKE_UNVERIFIED" | "TARGET_CONFIGURATION_MISMATCH" | "TARGET_CONFIGURATION_MISSING")[]>>;
         steps: Type.TArray<Type.TString>;
         execution_performed: Type.TLiteral<false>;
         data_recovery: Type.TLiteral<"separate-required">;

package/dist/shared/tools/application-workflow-schemas.d.ts

@@ -1,15 +1,18 @@
 import { Type } from "typebox";
 export declare const ApplicationPromotionResultSchema: Type.TObject<{
+    project_ref: Type.TString;
+    application_id: Type.TString;
+    environment_id: Type.TString;
     mutation_id: Type.TString;
     activation_id: Type.TString;
     plan_sha256: Type.TString;
     action: Type.TLiteral<"promote">;
     replayed: Type.TBoolean;
+}>;
+export declare const ApplicationPromotionStatusSchema: Type.TObject<{
     project_ref: Type.TString;
     application_id: Type.TString;
     environment_id: Type.TString;
-}>;
-export declare const ApplicationPromotionStatusSchema: Type.TObject<{
     mutation: Type.TUnknown;
     promotion: Type.TObject<{
         phase: Type.TUnion<[Type.TLiteral<"prepared">, Type.TLiteral<"transferring">, Type.TLiteral<"migrating">, Type.TLiteral<"activating">, Type.TLiteral<"verifying">, Type.TNull]>;
@@ -20,11 +23,12 @@ export declare const ApplicationPromotionStatusSchema: Type.TObject<{
         backup_id: Type.TUnion<[Type.TString, Type.TNull]>;
         data_recovery: Type.TLiteral<"separate-required">;
     }>;
+}>;
+export declare const ApplicationPreviewReceiptSchema: Type.TObject<{
     project_ref: Type.TString;
     application_id: Type.TString;
     environment_id: Type.TString;
-}>;
-export declare const ApplicationPreviewReceiptSchema: Type.TObject<{
+    schema: Type.TLiteral<"supacloud.application-preview.v1">;
     preview_id: Type.TString;
     release_id: Type.TString;
     expires_at: Type.TUnion<[Type.TString, Type.TNull]>;
@@ -78,10 +82,6 @@ export declare const ApplicationPreviewReceiptSchema: Type.TObject<{
     source_configuration_id: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
     created_at: Type.TOptional<Type.TString>;
     updated_at: Type.TOptional<Type.TString>;
-    project_ref: Type.TString;
-    application_id: Type.TString;
-    environment_id: Type.TString;
-    schema: Type.TLiteral<"supacloud.application-preview.v1">;
 }>;
 export interface ApplicationWorkflowScope {
     project_ref: string;
@@ -91,19 +91,19 @@ export interface ApplicationWorkflowScope {
 export declare function parsePromotionStatus(value: unknown, identity: ApplicationWorkflowScope & {
     mutation_id: string;
 }): {
-    mutation: import("../mutation-protocol").SafeMutationStatus;
     project_ref: string;
     application_id: string;
     environment_id: string;
     promotion: {
-        backup_id: string | null;
+        phase: "activating" | "migrating" | "prepared" | "transferring" | "verifying" | null;
+        plan_sha256: string | null;
         activation_id: string | null;
         release_id: string | null;
         configuration_id: string | null;
-        plan_sha256: string | null;
+        backup_id: string | null;
         data_recovery: "separate-required";
-        phase: "prepared" | "transferring" | "migrating" | "activating" | "verifying" | null;
     };
+    mutation: import("../mutation-protocol").SafeMutationStatus;
 };
 export declare function parsePreviewReceipt(value: unknown, identity: ApplicationWorkflowScope & {
     preview_id?: string;
@@ -112,125 +112,125 @@ export declare function parsePreviewReceipt(value: unknown, identity: Applicatio
     data_mode?: string;
     configuration_id?: string;
 }): {
-    created_at?: string | undefined;
-    updated_at?: string | undefined;
-    branch_name?: string | undefined;
-    queue_name?: string | undefined;
-    test_secret_name?: string | undefined;
-    source_configuration_id?: string | null | undefined;
     project_ref: string;
     application_id: string;
     environment_id: string;
-    status: "ready" | "failed" | "cleaned" | "planned" | "provisioning";
     schema: "supacloud.application-preview.v1";
+    preview_id: string;
+    release_id: string;
+    expires_at: string | null;
+    status: "cleaned" | "failed" | "planned" | "provisioning" | "ready";
     resources: {
         build_artifact: {
-            status: "pending" | "ready" | "failed" | "cleaned";
+            status: "cleaned" | "failed" | "pending" | "ready";
             release_id: string;
         };
         database_branch: {
-            status: "pending" | "ready" | "failed" | "cleaned";
+            status: "cleaned" | "failed" | "pending" | "ready";
             branch_ref: string;
-            data_mode: "schema_only" | "full_clone";
+            data_mode: "full_clone" | "schema_only";
         };
         queue_namespace: {
-            status: "pending" | "ready" | "failed" | "cleaned";
+            status: "cleaned" | "failed" | "pending" | "ready";
             namespace: string;
         };
         storage_namespace: {
-            status: "pending" | "ready" | "failed" | "cleaned";
+            status: "cleaned" | "failed" | "pending" | "ready";
             namespace: string;
         };
         test_secret: {
+            status: "cleaned" | "failed" | "pending" | "ready";
             name: string;
-            status: "pending" | "ready" | "failed" | "cleaned";
             value_issued: false;
         };
         configuration_revision: {
-            status: "pending" | "ready" | "failed" | "cleaned";
+            status: "cleaned" | "failed" | "pending" | "ready";
             configuration_id: string | null;
         };
         application_activation: {
-            status: "pending" | "ready" | "failed" | "cleaned";
+            status: "cleaned" | "failed" | "pending" | "ready";
             activation_id: string | null;
         };
         smoke_test: {
-            status: "pending" | "ready" | "failed" | "cleaned";
+            status: "cleaned" | "failed" | "pending" | "ready";
             checks: string[];
-            failed: string[];
             passed: string[];
+            failed: string[];
         };
     };
-    release_id: string;
-    preview_id: string;
-    expires_at: string | null;
     cleanup: {
         required: boolean;
-        error: string | null;
         completed: boolean;
+        error: string | null;
     };
+    branch_name?: string | undefined;
+    queue_name?: string | undefined;
+    test_secret_name?: string | undefined;
+    source_configuration_id?: string | null | undefined;
+    created_at?: string | undefined;
+    updated_at?: string | undefined;
 };
 export declare function parsePreviewList(value: unknown, identity: ApplicationWorkflowScope): {
     project_ref: string;
     application_id: string;
     environment_id: string;
     previews: {
-        created_at?: string | undefined;
-        updated_at?: string | undefined;
-        branch_name?: string | undefined;
-        queue_name?: string | undefined;
-        test_secret_name?: string | undefined;
-        source_configuration_id?: string | null | undefined;
         project_ref: string;
         application_id: string;
         environment_id: string;
-        status: "ready" | "failed" | "cleaned" | "planned" | "provisioning";
         schema: "supacloud.application-preview.v1";
+        preview_id: string;
+        release_id: string;
+        expires_at: string | null;
+        status: "cleaned" | "failed" | "planned" | "provisioning" | "ready";
         resources: {
             build_artifact: {
-                status: "pending" | "ready" | "failed" | "cleaned";
+                status: "cleaned" | "failed" | "pending" | "ready";
                 release_id: string;
             };
             database_branch: {
-                status: "pending" | "ready" | "failed" | "cleaned";
+                status: "cleaned" | "failed" | "pending" | "ready";
                 branch_ref: string;
-                data_mode: "schema_only" | "full_clone";
+                data_mode: "full_clone" | "schema_only";
             };
             queue_namespace: {
-                status: "pending" | "ready" | "failed" | "cleaned";
+                status: "cleaned" | "failed" | "pending" | "ready";
                 namespace: string;
             };
             storage_namespace: {
-                status: "pending" | "ready" | "failed" | "cleaned";
+                status: "cleaned" | "failed" | "pending" | "ready";
                 namespace: string;
             };
             test_secret: {
+                status: "cleaned" | "failed" | "pending" | "ready";
                 name: string;
-                status: "pending" | "ready" | "failed" | "cleaned";
                 value_issued: false;
             };
             configuration_revision: {
-                status: "pending" | "ready" | "failed" | "cleaned";
+                status: "cleaned" | "failed" | "pending" | "ready";
                 configuration_id: string | null;
             };
             application_activation: {
-                status: "pending" | "ready" | "failed" | "cleaned";
+                status: "cleaned" | "failed" | "pending" | "ready";
                 activation_id: string | null;
             };
             smoke_test: {
-                status: "pending" | "ready" | "failed" | "cleaned";
+                status: "cleaned" | "failed" | "pending" | "ready";
                 checks: string[];
-                failed: string[];
                 passed: string[];
+                failed: string[];
             };
         };
-        release_id: string;
-        preview_id: string;
-        expires_at: string | null;
         cleanup: {
             required: boolean;
-            error: string | null;
             completed: boolean;
+            error: string | null;
         };
+        branch_name?: string | undefined;
+        queue_name?: string | undefined;
+        test_secret_name?: string | undefined;
+        source_configuration_id?: string | null | undefined;
+        created_at?: string | undefined;
+        updated_at?: string | undefined;
     }[];
 };

package/dist/shared/tools/lite-cli-tools.d.ts

@@ -1,6 +1,6 @@
 export { resolveLiteCommand } from "./lite-cli-command";
 import { type ToolServer } from "../tool-server";
-export type LiteCliAction = "version" | "start" | "migrate" | "status" | "keys" | "gen_types" | "db_reset" | "db_diff" | "db_pull" | "snapshot_create" | "snapshot_restore" | "upgrade" | "inspect" | "doctor";
+export type LiteCliAction = "version" | "start" | "migrate" | "status" | "keys" | "gen_types" | "db_reset" | "db_diff" | "db_pull" | "db_check" | "snapshot_create" | "snapshot_restore" | "upgrade" | "inspect" | "doctor";
 export interface LiteCliArgs {
     action: LiteCliAction;
     workdir?: string;
@@ -30,6 +30,13 @@ export interface LiteCliArgs {
     memory?: boolean;
     json?: boolean;
     baseline?: boolean;
+    production?: boolean;
+    runtime_mode?: "development" | "strict";
+    postgres_dir?: string;
+    identity_module?: string;
+    external_auth_proxy_issuer?: string;
+    external_auth_proxy_redirect_origin?: string;
+    module_file?: string;
 }
 export interface LiteCliExecutionResult {
     exitCode: number;

package/dist/shared/tools/remote-dev-tools.d.ts

@@ -19,8 +19,8 @@ export interface RemoteDevToolOptions {
     runDatabase?: DatabaseCallback;
 }
 export declare const remoteDevToolSchema: {
-    action: Type.TEnum<("status" | "migrate" | "watch" | "sync")[]>;
-    target: Type.TOptional<Type.TEnum<("frontend" | "project" | "db" | "functions")[]>>;
+    action: Type.TEnum<("migrate" | "status" | "sync" | "watch")[]>;
+    target: Type.TOptional<Type.TEnum<("db" | "frontend" | "functions" | "project")[]>>;
     project_dir: Type.TOptional<Type.TString>;
     remote_root: Type.TOptional<Type.TString>;
     remote_host: Type.TOptional<Type.TString>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.112.0",
+  "version": "0.112.2",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,20 +52,20 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@supacloud/compiler": "^0.52.0",
-    "@supacloud/delivery": "0.23.0",
-    "@supacloud/db": "0.20.1",
-    "typebox": "1.4.2"
+    "@supacloud/compiler": "^0.52.2",
+    "@supacloud/delivery": "0.23.1",
+    "@supacloud/db": "0.20.3",
+    "typebox": "1.4.3"
   },
   "overrides": {
-    "@supacloud/contracts": "0.15.1",
-    "@supacloud/delivery": "0.23.0",
+    "@supacloud/contracts": "0.15.2",
+    "@supacloud/delivery": "0.23.1",
     "@graphql-tools/utils": "^12.0.4"
   },
   "devDependencies": {
     "@supabase/supabase-js": "2.118.0",
-    "@supacloud/elysia": "0.36.2",
-    "@types/bun": "^1.4.3",
+    "@supacloud/elysia": "0.37.0",
+    "@types/bun": "^1.4.4",
     "effect": "4.0.5",
     "elysia": "2.0.0-rc.0",
     "typescript": "^7.0.2"

package/skills/supacloud/references/command-map.md

@@ -19,7 +19,7 @@ Load this reference when selecting a command surface or when a user asks an AI t
 | Pull official Supabase configuration | `supabase config_pull` | Preview by default; local write requires `dry_run=false` and `yes`; not SupaCloud settings |
 | Run the official local stack | `supabase stack_start`, `stack_prepare`, `stack_status`, `stack_stop` | Docker default; native alpha requires `SUPACLOUD_ENABLE_NATIVE_STACK=1` |
 | Remove the official local stack | `supabase stack_destroy` | Local data loss; requires `confirm_destroy` and `yes` |
-| Capture Lite drift | `lite db_diff`, `lite db_pull` | Draft outside migrations; only reviewed already-present DDL may use `baseline` |
+| Capture Lite drift | `lite db_diff`, `lite db_pull`, `lite db_check` | Draft outside migrations; only reviewed already-present DDL may use `baseline`; `db_check` is read-only |
 | Rebuild local database | `supabase db_reset` | Local only; preserve required seed behavior |
 | Inspect or back up a remote database | `supabase db_pull`, `migration_list`, `db_dump`, `gen_types` | Requires explicit PostgreSQL DSN; redact it |
 | Replay the release-canary fixture stage receipt | `release release_canary_fixture_stage_replay` | Dual-bind Management project context and that project's service-role application origin; accepts only the exact subject/request UUID pair and a strict idempotent receipt |