@supacloud/cli 0.113.0 → 0.115.0

package/dist/index.js

@@ -8901,9 +8901,11 @@ function parseCliFlags(args, startIndex, schema) {
     if (!flag)
       continue;
     index = flag.nextIndex;
-    if (Object.hasOwn(parsedFlags, flag.name))
+    const normalizedName = flag.name.replaceAll("-", "_");
+    const schemaName = Object.hasOwn(fields, flag.name) ? flag.name : Object.hasOwn(fields, normalizedName) ? normalizedName : flag.name;
+    if (Object.hasOwn(parsedFlags, schemaName))
       throw new Error(DUPLICATE_CLI_FLAG_MESSAGE);
-    parsedFlags[flag.name] = flag.rawValue === undefined ? true : schemaCompatibleCliValue(fields[flag.name], flag.rawValue);
+    parsedFlags[schemaName] = flag.rawValue === undefined ? true : schemaCompatibleCliValue(fields[schemaName], flag.rawValue);
   }
   return parsedFlags;
 }
@@ -8918,18 +8920,19 @@ async function runCli(cliTools, args, options = {}) {
     const shape = getSchemaShape(tool.schema);
     const actionField = shape.action;
     const actionOptions = getEnumOptions(actionField);
-    const actionless = toolName === "deploy";
+    const actionless = actionOptions.length === 0;
     const otherFields = Object.entries(shape).filter(([name]) => name !== "action");
     const actionLines = actionOptions.length ? `Available actions:
   ${actionOptions.join(`
   `)}` : actionless ? "" : "This command does not declare action metadata.";
+    const actionUsage = actionOptions.length ? toolName === "deploy" ? " [action]" : " <action>" : "";
     const argLines = otherFields.length ? otherFields.map(([name, field]) => {
       const description = getDescription(field) || "(no description)";
       return `  --${name}  ${description}`;
     }).join(`
 `) : "  (no additional flags)";
     return [
-      `Usage: ${commandName} ${toolName}${actionless ? "" : " <action>"} [--flags]`,
+      `Usage: ${commandName} ${toolName}${actionUsage} [--flags]`,
       "",
       ...actionLines ? [actionLines, ""] : [],
       "Flags:",
@@ -9028,11 +9031,8 @@ var CORE_CONTEXT_KEYS = [
   "SUPABASE_URL",
   "SUPABASE_SERVICE_ROLE_KEY",
   "SUPACLOUD_API_URL",
-  "SUPACLOUD_MANAGEMENT_API_URL",
-  "MANAGEMENT_API_URL",
   "SUPACLOUD_API_TOKEN",
   "SUPACLOUD_PROJECT_REF",
-  "X_PROJECT_REF",
   "SUPACLOUD_HOST",
   "SUPACLOUD_APPLICATION_ID",
   "SUPACLOUD_APPLICATION_ENVIRONMENT_ID",
@@ -9103,8 +9103,8 @@ function sourceCredentialScope(values, explicitApiUrl, supabaseUrl) {
 }
 function sourceProjectCore(values) {
   const supabaseUrl = canonicalApiOrigin(values.SUPABASE_URL || "");
-  const projectRef = (values.SUPACLOUD_PROJECT_REF || values.X_PROJECT_REF || "").trim() || inferProjectRefFromSupabaseUrl(supabaseUrl);
-  const explicitApiUrl = values.SUPACLOUD_API_URL || values.SUPACLOUD_MANAGEMENT_API_URL || values.MANAGEMENT_API_URL || "";
+  const projectRef = (values.SUPACLOUD_PROJECT_REF || "").trim() || inferProjectRefFromSupabaseUrl(supabaseUrl);
+  const explicitApiUrl = values.SUPACLOUD_API_URL || "";
   const credentialScope = sourceCredentialScope(values, explicitApiUrl, supabaseUrl);
   const managementUrl = explicitApiUrl || (values.SUPACLOUD_HOST ? `http://${values.SUPACLOUD_HOST}:9090` : "");
   const apiUrl = credentialScope === "management" ? canonicalApiOrigin(managementUrl) : "";
@@ -9125,17 +9125,14 @@ function completeProjectContext(values) {
   return Boolean(core.apiUrl && core.apiToken && core.projectRef);
 }
 function parseInsecureTls(values) {
-  for (const key of ["SUPACLOUD_TLS_VERIFY", "SUPACLOUD_TLS_INSECURE"]) {
-    const value = values[key]?.trim().toLowerCase();
-    if (value === undefined)
-      continue;
-    if (["1", "true", "yes", "on"].includes(value))
-      return key === "SUPACLOUD_TLS_INSECURE";
-    if (["0", "false", "no", "off"].includes(value))
-      return key === "SUPACLOUD_TLS_VERIFY";
-    throw new Error(`${key} must be a boolean (true or false)`);
-  }
-  return true;
+  const value = values.SUPACLOUD_TLS_VERIFY?.trim().toLowerCase();
+  if (value === undefined)
+    return true;
+  if (["1", "true", "yes", "on"].includes(value))
+    return false;
+  if (["0", "false", "no", "off"].includes(value))
+    return true;
+  throw new Error("SUPACLOUD_TLS_VERIFY must be a boolean (true or false)");
 }
 function namedEnvironmentSource(cwd, selector) {
   const environment = normalizeEnvironmentName(selector);
@@ -9270,7 +9267,7 @@ function parseGlobalOptions(args) {
 
 // src/shared/execution-policy.ts
 var ACTION_POLICY = {
-  deploy: { write: ["deploy"] },
+  deploy: { local: ["init"], write: ["deploy"] },
   applications: {
     read: ["list_releases", "get_release", "get_runtime", "get_deployment_evidence", "get_configuration", "get_release_transfer_plan", "get_promotion_plan", "get_promotion_status", "get_rollback_snapshot", "get_history", "get_deploy_plan", "logs", "get_preview_plan", "list_previews", "get_preview"],
     write: ["upload_release", "put_configuration", "deploy_application", "transfer_release", "promote_application", "reconcile_promotion", "create_preview", "reconcile_preview", "cleanup_preview", "activate_release", "deploy_release", "rollback_release", "reconcile_activation", "retire_activation"]
@@ -9281,7 +9278,7 @@ var ACTION_POLICY = {
     local: ["list"]
   },
   database: {
-    read: ["list_tables", "describe_columns", "list_indexes", "list_constraints", "list_extensions", "extension_catalog", "rls_status", "rls_policies", "list_auth_users", "get_auth_user", "connections", "stats", "slow_queries", "list_migrations", "migration_inventory", "migration_import", "delivery_migration_plan", "project_url", "generate_types", "database_lint", "db_lint", "rpc_catalog", "list_rpcs"],
+    read: ["list_tables", "describe_columns", "export_svadmin_schema", "list_indexes", "list_constraints", "list_extensions", "extension_catalog", "rls_status", "rls_policies", "list_auth_users", "get_auth_user", "connections", "stats", "slow_queries", "list_migrations", "migration_inventory", "migration_import", "delivery_migration_plan", "project_url", "generate_types", "database_lint", "db_lint", "rpc_catalog", "list_rpcs", "governance_check", "role_check"],
     local: ["lint_migrations", "lint", "rebase_migrations"],
     write: ["query", "execute", "apply_migration", "push_migrations", "baseline_migrations", "create_table_rls", "enable_extension", "disable_extension"]
   },
@@ -12909,6 +12906,7 @@ function registerDatabaseTools(server, http, config = {}) {
     "query",
     "list_tables",
     "describe_columns",
+    "export_svadmin_schema",
     "list_indexes",
     "list_constraints",
     "list_extensions",
@@ -12929,7 +12927,9 @@ function registerDatabaseTools(server, http, config = {}) {
     "db_lint",
     "rpc_catalog",
     "list_rpcs",
-    "migration_import"
+    "migration_import",
+    "governance_check",
+    "role_check"
   ];
   const writeActions = ["execute", "apply_migration", "push_migrations", "baseline_migrations", "create_table_rls", "enable_extension", "disable_extension"];
   const remoteActions = [...readActions, ...localActions];
@@ -12947,10 +12947,11 @@ Actions: ${allActions.join(", ")}${localOnly ? " (local-only mode)" : readOnly ?
     strict: optional(Boolean2(), "[push_migrations/lint_migrations/lint/database_lint] Exit with error if high-risk issues or migrations are detected"),
     fail_on_high: optional(Boolean2(), "[push_migrations/lint_migrations/lint/database_lint] Alias for --strict"),
     fail_on_medium: optional(Boolean2(), "[push_migrations/lint_migrations/lint] Exit with error if medium-risk or high-risk migrations are detected"),
-    json: optional(Boolean2(), "[lint_migrations/lint/database_lint/rpc_catalog] Output structured JSON analysis"),
+    format: optional(stringEnum2(["text", "json"]), "[lint_migrations/lint/database_lint/rpc_catalog] Output format (default: text)"),
     schema: optional(String2(), "[describe_columns/list_indexes/list_constraints/rls_status/rls_policies/create_table_rls/database_lint] Schema name (default: public)"),
     table: optional(String2(), "[describe_columns/indexes/constraints/rls_*] Table name"),
-    schemas: optional(_Array_(String2()), "[list_tables/generate_types/rpc_catalog] Schemas array"),
+    schemas: optional(_Array_(String2()), "[list_tables/generate_types/rpc_catalog/governance_check/role_check] Schemas array"),
+    modules: optional(_Array_(Record(String2(), Unknown()), { maxItems: 64 }), "[governance_check] JSON-safe database module declarations"),
     user_id: optional(String2(), "[get_auth_user] User UUID"),
     limit: optional(Number2(), "[list_auth_users] Max users (default: 20)"),
     name: optional(String2(), "[apply_migration] Migration name"),
@@ -13105,6 +13106,38 @@ Actions: ${allActions.join(", ")}${localOnly ? " (local-only mode)" : readOnly ?
         text = r.ok ? formatColumnsList(r.data, schema, args.table) : `❌ Failed (${r.status})`;
         break;
       }
+      case "export_svadmin_schema": {
+        if (!args.table)
+          throw new Error("'table' required");
+        const schemaName = validatedIdentifier(schema, "schema");
+        const tableName = validatedIdentifier(args.table, "table");
+        const schemaLiteral = `'${schemaName}'`;
+        const tableLiteral = `'${tableName}'`;
+        const regclassLiteral = `'${schemaName}.${tableName}'`;
+        const colSql = `SELECT column_name, data_type, is_nullable, column_default, character_maximum_length FROM information_schema.columns WHERE table_schema = ${schemaLiteral} AND table_name = ${tableLiteral} ORDER BY ordinal_position;`;
+        const colRes = await execSql(colSql);
+        if (!colRes.ok)
+          throw new Error(`Failed to inspect columns (${colRes.status})`);
+        const conSql = `SELECT conname as name, contype as type, pg_get_constraintdef(oid) as definition FROM pg_constraint WHERE connamespace = ${schemaLiteral}::regnamespace AND conrelid = ${regclassLiteral}::regclass;`;
+        const conRes = await execSql(conSql);
+        if (!conRes.ok)
+          throw new Error(`Failed to inspect constraints (${conRes.status})`);
+        const cols = buildSvadminColumns(colRes.data, conRes.data);
+        if (args.format === "json") {
+          return {
+            content: [{
+              type: "text",
+              text: JSON.stringify({
+                resource: args.table,
+                sourceType: "databaseColumns",
+                columns: cols
+              }, null, 2)
+            }]
+          };
+        }
+        text = formatSvadminSchemaExport(args.table, cols);
+        break;
+      }
       case "list_indexes": {
         if (!args.table)
           throw new Error("'table' required");
@@ -13266,7 +13299,7 @@ Actions: ${allActions.join(", ")}${localOnly ? " (local-only mode)" : readOnly ?
           migrationFiles = sortMigrationFiles(files.map((file) => readMigrationFile(dir, file)));
         }
         const analysis = analyzeMigrationFiles(migrationFiles);
-        if (args.json) {
+        if (args.format === "json") {
           text = JSON.stringify(analysis, null, 2);
         } else {
           text = formatMigrationRiskReport(analysis);
@@ -13501,7 +13534,7 @@ ${riskReport}`
         if (!r.ok) {
           return { content: [{ type: "text", text: `❌ Database lint request failed (${r.status})` }], isError: true };
         }
-        if (args.json) {
+        if (args.format === "json") {
           text = JSON.stringify(r.data, null, 2);
         } else {
           text = formatDatabaseLintReport(r.data);
@@ -13516,6 +13549,45 @@ ${riskReport}`
         }
         break;
       }
+      case "governance_check": {
+        const schemasList = args.schemas && args.schemas.length > 0 ? args.schemas : args.schema ? [args.schema] : ["public"];
+        const safeRef = projectRefPathSegment(ref, "governance_check");
+        const r = await managementHttp().post(`/v1/projects/${safeRef}/database/module-check`, {
+          modules: args.modules,
+          schemas: schemasList
+        });
+        if (!r.ok) {
+          return { content: [{ type: "text", text: `❌ Database module check failed (${r.status})` }], isError: true };
+        }
+        const result = recordPayload(r.data);
+        if (!result || typeof result["ok"] !== "boolean" || !Array.isArray(result["reports"])) {
+          throw new Error("Invalid database module check response");
+        }
+        text = formatModuleCheckReport(r.data);
+        if (!result["ok"]) {
+          return { content: [{ type: "text", text }], isError: true };
+        }
+        break;
+      }
+      case "role_check": {
+        const schemasList = args.schemas && args.schemas.length > 0 ? args.schemas : args.schema ? [args.schema] : ["public"];
+        const safeRef = projectRefPathSegment(ref, "role_check");
+        const r = await managementHttp().post(`/v1/projects/${safeRef}/database/role-check`, {
+          schemas: schemasList
+        });
+        if (!r.ok) {
+          return { content: [{ type: "text", text: `❌ Database role check failed (${r.status})` }], isError: true };
+        }
+        const result = recordPayload(r.data);
+        if (!result || typeof result["ok"] !== "boolean" || !recordPayload(result["state"]) || result["error"] !== undefined && typeof result["error"] !== "string") {
+          throw new Error("Invalid database role check response");
+        }
+        text = JSON.stringify(r.data, null, 2);
+        if (!result["ok"]) {
+          return { content: [{ type: "text", text }], isError: true };
+        }
+        break;
+      }
       case "rpc_catalog":
       case "list_rpcs": {
         const schemasList = args.schemas && args.schemas.length > 0 ? args.schemas : args.schema ? [args.schema] : ["public", "api"];
@@ -13524,7 +13596,7 @@ ${riskReport}`
         if (!r.ok) {
           return { content: [{ type: "text", text: `❌ RPC catalog request failed (${r.status})` }], isError: true };
         }
-        if (args.json) {
+        if (args.format === "json") {
           text = JSON.stringify(r.data, null, 2);
         } else {
           text = formatRpcCatalog(r.data);
@@ -13538,10 +13610,13 @@ ${riskReport}`
   });
 }
 function quoteIdentifier(value, label) {
+  return `"${validatedIdentifier(value, label)}"`;
+}
+function validatedIdentifier(value, label) {
   if (typeof value !== "string" || !/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(value)) {
     throw new Error(`Invalid ${label} identifier`);
   }
-  return `"${value}"`;
+  return value;
 }
 function validateColumnDefinitions(value) {
   if (typeof value !== "string")
@@ -13597,6 +13672,34 @@ function formatDatabaseLintReport(data) {
   return lines.join(`
 `).trimEnd();
 }
+function formatModuleCheckReport(data) {
+  const result = recordPayload(data);
+  const reports = Array.isArray(result?.["reports"]) ? result["reports"] : [];
+  const lines = [];
+  for (const raw of reports) {
+    const report = recordPayload(raw);
+    if (!report)
+      continue;
+    const name = typeof report["module"] === "string" ? report["module"] : "unknown";
+    const ok = report["ok"] === true;
+    lines.push(`module: ${name} (${ok ? "ok" : "FAILED"})`);
+    const issues = Array.isArray(report["issues"]) ? report["issues"] : [];
+    if (issues.length === 0)
+      lines.push("  no issues");
+    for (const rawIssue of issues) {
+      const issue = recordPayload(rawIssue);
+      if (!issue)
+        continue;
+      const severity = typeof issue["severity"] === "string" ? issue["severity"] : "error";
+      const code = typeof issue["code"] === "string" ? issue["code"] : "unknown";
+      const object = typeof issue["object"] === "string" ? issue["object"] : "?";
+      const message = typeof issue["message"] === "string" ? issue["message"] : "";
+      lines.push(`  ${severity} ${code} ${object} ${message}`);
+    }
+  }
+  return lines.length > 0 ? lines.join(`
+`) : JSON.stringify(data, null, 2);
+}
 function formatRpcCatalog(data) {
   if (!data || typeof data !== "object")
     return JSON.stringify(data, null, 2);
@@ -13713,6 +13816,67 @@ function formatConstraintList(data) {
 `).join(`
 `);
 }
+function buildSvadminColumns(colData, conData) {
+  const colRows = responseRows(colData, _Object_({
+    column_name: String2(),
+    data_type: String2(),
+    is_nullable: String2(),
+    character_maximum_length: Optional(Union([Number2(), Null()])),
+    column_default: Optional(Union([String2(), Null()]))
+  }));
+  const conRows = responseRows(conData, _Object_({
+    name: String2(),
+    type: String2(),
+    definition: String2()
+  }));
+  const pkConstraint = conRows.find((c) => c.type === "p");
+  const pkCols = new Set;
+  if (pkConstraint) {
+    const match = pkConstraint.definition.match(/\(([^)]+)\)/);
+    if (match?.[1]) {
+      match[1].split(",").map((s) => s.trim().replace(/"/g, "")).forEach((c) => pkCols.add(c));
+    }
+  }
+  const fkMap = new Map;
+  for (const c of conRows) {
+    if (c.type === "f") {
+      const match = c.definition.match(/FOREIGN KEY\s*\(([^)]+)\)\s*REFERENCES\s*([^(]+)/i);
+      if (match?.[1] && match?.[2]) {
+        const colName = match[1].trim().replace(/"/g, "");
+        const refTable = match[2].trim().split(".").pop()?.replace(/"/g, "") ?? "";
+        fkMap.set(colName, refTable);
+      }
+    }
+  }
+  return colRows.map((c) => {
+    const isPrimary = pkCols.has(c.column_name) || c.column_name === "id";
+    const ref = fkMap.get(c.column_name);
+    return {
+      name: c.column_name,
+      type: c.data_type,
+      nullable: c.is_nullable === "YES",
+      isPrimary,
+      ...c.column_default ? { defaultValue: c.column_default } : {},
+      isForeignKey: Boolean(ref || c.column_name.endsWith("_id")),
+      ...ref ? { referencesResource: ref } : {}
+    };
+  });
+}
+function formatSvadminSchemaExport(table, columns) {
+  const payload = {
+    resource: table,
+    sourceType: "databaseColumns",
+    columns
+  };
+  return `SVAdmin schema for '${table}'
+
+` + `Pass this object to svadmin_generateResource. The CLI does not generate the resource.
+` + `${JSON.stringify(payload, null, 2)}
+
+` + `Column metadata (${columns.length}):
+` + columns.map((c) => `  - ${c.name}: ${c.type}${c.isPrimary ? " [PK]" : ""}${c.isForeignKey ? ` [FK -> ${c.referencesResource ?? "inferred"}]` : ""}${c.nullable ? " (nullable)" : " (required)"}`).join(`
+`);
+}
 function formatExtensionList(data) {
   const rows = responseRows(data, _Object_({ name: String2(), version: String2(), schema: String2() }));
   if (!rows.length)
@@ -15533,7 +15697,7 @@ function scaffoldFiles(framework, slug) {
       "package.json": JSON.stringify({
         private: true,
         type: "module",
-        dependencies: { elysia: "2.0.0-rc.0" }
+        dependencies: { elysia: "2.0.0-rc.1" }
       }, null, 2) + `
 `,
       "index.ts": `import { Elysia } from "elysia";
@@ -20705,13 +20869,13 @@ function registerBranchTools(server, http, options = {}) {
     data_mode: optional(stringEnum2(["schema_only", "full_clone"]), "[create] Preview data mode (default: schema_only)"),
     plan_checksum: optional(String2(), "[promote] Reviewed plan checksum from promotion_plan"),
     confirm_destructive: optional(Boolean2(), "[promote] Confirm reviewed destructive migrations"),
-    json: optional(Boolean2(), "[promotion_plan/promote] Return machine-readable JSON")
+    format: optional(stringEnum2(["text", "json"]), "[promotion_plan/promote] Output format (default: text)")
   }, async (args) => {
     const action = requireString(args.action, "action");
     const ref = resolveProjectRef(args.ref, options.projectRef);
     const writeAction = action === "create" || action === "delete" || action === "promote";
     if (writeAction && options.readOnly) {
-      return args.json && action === "promote" ? releaseControlFailure("branch.promote", "MUTATION_NOT_SUCCEEDED", null, {
+      return args.format === "json" && action === "promote" ? releaseControlFailure("branch.promote", "MUTATION_NOT_SUCCEEDED", null, {
         project_ref: ref,
         branch_ref: args.branch_ref,
         reason: "READ_ONLY"
@@ -20737,13 +20901,13 @@ function registerBranchTools(server, http, options = {}) {
         responseTimeoutMs: 5000
       });
       if (!result.ok) {
-        return promotionFailure(releaseControlFailure("branch.promotion_plan", "HTTP_ERROR", result.transportError ? null : result.status, scope), args.json === true, false);
+        return promotionFailure(releaseControlFailure("branch.promotion_plan", "HTTP_ERROR", result.transportError ? null : result.status, scope), args.format === "json", false);
       }
       const plan = parsePromotionPlan(result.data, { parentRef: ref, branchRef });
       if (result.status !== 200 || !plan) {
-        return promotionFailure(releaseControlFailure("branch.promotion_plan", "INVALID_RESPONSE", result.status, scope), args.json === true, false);
+        return promotionFailure(releaseControlFailure("branch.promotion_plan", "INVALID_RESPONSE", result.status, scope), args.format === "json", false);
       }
-      return args.json ? releaseControlSuccess("branch.promotion_plan", { ...scope, plan }) : { content: [{ type: "text", text: formatPromotionPlan(plan) }] };
+      return args.format === "json" ? releaseControlSuccess("branch.promotion_plan", { ...scope, plan }) : { content: [{ type: "text", text: formatPromotionPlan(plan) }] };
     } else if (action === "promote") {
       const branchRef = requireString(args.branch_ref, "branch_ref");
       const planChecksum = requireString(args.plan_checksum, "plan_checksum");
@@ -20762,18 +20926,18 @@ function registerBranchTools(server, http, options = {}) {
       });
       const beforeMutation = { ...state, mutation_sent: false };
       if (!preflight.ok) {
-        return promotionFailure(releaseControlFailure("branch.promote", "HTTP_ERROR", preflight.transportError ? null : preflight.status, { ...beforeMutation, reason: "PREFLIGHT_FAILED" }), args.json === true, false);
+        return promotionFailure(releaseControlFailure("branch.promote", "HTTP_ERROR", preflight.transportError ? null : preflight.status, { ...beforeMutation, reason: "PREFLIGHT_FAILED" }), args.format === "json", false);
       }
       const plan = parsePromotionPlan(preflight.data, { parentRef: ref, branchRef });
       if (preflight.status !== 200 || !plan) {
-        return promotionFailure(releaseControlFailure("branch.promote", "INVALID_RESPONSE", preflight.status, { ...beforeMutation, reason: "PREFLIGHT_UNVERIFIED" }), args.json === true, false);
+        return promotionFailure(releaseControlFailure("branch.promote", "INVALID_RESPONSE", preflight.status, { ...beforeMutation, reason: "PREFLIGHT_UNVERIFIED" }), args.format === "json", false);
       }
       const preflightReason = plan.plan_checksum !== planChecksum ? "PLAN_CHANGED" : !plan.safe_to_apply ? "PLAN_BLOCKED" : plan.requires_destructive_confirmation && args.confirm_destructive !== true ? "DESTRUCTIVE_CONFIRMATION_REQUIRED" : null;
       if (preflightReason) {
-        return promotionFailure(releaseControlFailure("branch.promote", "MUTATION_NOT_SUCCEEDED", null, { ...beforeMutation, reason: preflightReason, observed_plan_checksum: plan.plan_checksum }), args.json === true, false);
+        return promotionFailure(releaseControlFailure("branch.promote", "MUTATION_NOT_SUCCEEDED", null, { ...beforeMutation, reason: preflightReason, observed_plan_checksum: plan.plan_checksum }), args.format === "json", false);
       }
       if (plan.pending.length === 0) {
-        return args.json ? releaseControlSuccess("branch.promote", {
+        return args.format === "json" ? releaseControlSuccess("branch.promote", {
           ...beforeMutation,
           promoted: false,
           unchanged: true,
@@ -20799,13 +20963,13 @@ function registerBranchTools(server, http, options = {}) {
           mutation_sent: true,
           reported_applied_versions: appliedVersions(result),
           ...safePromotionCode(result) ? { server_code: safePromotionCode(result) } : {}
-        }), args.json === true, result.transportError === true || result.responseReadError === true || result.status === 408 || result.status >= 500);
+        }), args.format === "json", result.transportError === true || result.responseReadError === true || result.status === 408 || result.status >= 500);
       }
       const promoted = parsePromotionResult(result.data, { parentRef: ref, branchRef }, plan.pending);
       if (result.status !== 200 || !promoted) {
-        return promotionFailure(releaseControlFailure("branch.promote", "OUTCOME_UNKNOWN", result.status, { ...state, mutation_sent: true }), args.json === true, true);
+        return promotionFailure(releaseControlFailure("branch.promote", "OUTCOME_UNKNOWN", result.status, { ...state, mutation_sent: true }), args.format === "json", true);
       }
-      return args.json ? releaseControlSuccess("branch.promote", {
+      return args.format === "json" ? releaseControlSuccess("branch.promote", {
         ...promoted,
         unchanged: false,
         mutation_sent: true,
@@ -21478,7 +21642,8 @@ function buildLiteArgs(request) {
   booleanFlag(args, "--service-role", request.service_role);
   booleanFlag(args, "--force", request.force);
   booleanFlag(args, "--memory", request.memory);
-  booleanFlag(args, "--json", request.json);
+  if (request.format === "json")
+    args.push("--json");
   if (request.baseline && request.action !== "db_pull")
     throw new Error("baseline requires db_pull");
   booleanFlag(args, "--baseline", request.baseline);
@@ -21603,7 +21768,7 @@ function registerLiteCliTools(server, options = {}) {
     service_role: optional(Boolean2(), "[keys] Also print the service_role key"),
     force: optional(Boolean2(), "[snapshot_restore] Replace non-empty restore targets"),
     memory: optional(Boolean2(), "[*] Use an in-memory PGlite database"),
-    json: optional(Boolean2(), "[doctor] Emit machine-readable output"),
+    format: optional(stringEnum2(["text", "json"]), "[doctor] Output format (default: text)"),
     baseline: optional(Boolean2(), "[db_pull] Record already-present schema in local migration history after review"),
     production: optional(Boolean2(), "[doctor] Add single-node production readiness checks"),
     runtime_mode: optional(stringEnum2(["development", "strict"]), "[*] Lite runtime mode"),
@@ -21762,6 +21927,26 @@ function resolveDefaultCodexSkillRoot(environment = process.env, homeDirectory =
   const codexHome = environment.CODEX_HOME?.trim();
   return join8(resolve12(codexHome || join8(homeDirectory, ".codex")), "skills");
 }
+var SKILL_TARGET_ALIASES = ["codex", "claude", "agents", "project"];
+function resolveSkillTargetRoot(target, options = {}) {
+  const environment = options.environment ?? process.env;
+  const homeDirectory = options.homeDirectory ?? homedir2();
+  const workingDirectory = options.workingDirectory ?? process.cwd();
+  const normalized = target?.trim().toLowerCase();
+  if (!normalized || normalized === "codex")
+    return resolveDefaultCodexSkillRoot(environment, homeDirectory);
+  if (normalized === "claude") {
+    const config = environment.CLAUDE_CONFIG_DIR?.trim();
+    return join8(resolve12(config || join8(homeDirectory, ".claude")), "skills");
+  }
+  if (normalized === "agents") {
+    const config = environment.AGENTS_HOME?.trim();
+    return join8(resolve12(config || join8(homeDirectory, ".agents")), "skills");
+  }
+  if (normalized === "project")
+    return join8(resolve12(workingDirectory), ".agents", "skills");
+  return resolve12(target);
+}
 function resolveBundledSkillDirectory(moduleUrl = import.meta.url) {
   const moduleDirectory = dirname5(fileURLToPath(moduleUrl));
   const candidates = [
@@ -21779,7 +21964,7 @@ function textResponse(payload) {
 function registerAiTools(server) {
   registerTool(server, "ai", "Install or inspect the bundled SupaCloud CLI AI skill. Actions: show_skill, install_skill", {
     action: stringEnum2(["show_skill", "install_skill"]),
-    target: optional(String2(), "[install_skill] Skill root directory; defaults to $CODEX_HOME/skills or ~/.codex/skills"),
+    target: optional(String2(), "[install_skill] codex|claude|agents|project or an explicit Skill root directory"),
     dry_run: optional(Boolean2(), "[install_skill] Preview the installation without writing files"),
     force: optional(Boolean2(), "[install_skill] Back up and replace different existing skill content")
   }, async (request) => {
@@ -21790,12 +21975,17 @@ function registerAiTools(server) {
         name: SKILL_NAME,
         sourceDirectory,
         defaultTargetRoot,
-        defaultDestination: join8(defaultTargetRoot, SKILL_NAME)
+        defaultDestination: join8(defaultTargetRoot, SKILL_NAME),
+        targetAliases: Object.fromEntries(SKILL_TARGET_ALIASES.map((alias) => [
+          alias,
+          resolveSkillTargetRoot(alias)
+        ]))
       });
     }
+    const targetRoot = resolveSkillTargetRoot(request.target);
     return textResponse(installSkill({
       sourceDirectory,
-      targetRoot: request.target || defaultTargetRoot,
+      targetRoot,
       mode: request.dry_run ? "dry-run" : "write",
       conflictPolicy: request.force ? "replace" : "reject",
       now: new Date
@@ -21995,16 +22185,16 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.53.0"
+      version: "0.54.0"
     },
     app: {
-      version: "0.35.0",
+      version: "0.36.0",
       dependencies: {
         rxjs: "7.8.2"
       }
     },
     elysia: {
-      version: "0.37.0"
+      version: "0.38.0"
     },
     commands: {
       version: "0.11.2"
@@ -22013,7 +22203,7 @@ var starter_metadata_default = {
       version: "0.15.2"
     },
     db: {
-      version: "0.20.3",
+      version: "0.20.4",
       peerDependencies: {
         "drizzle-orm": "1.0.0-rc.5-5935859"
       },
@@ -22099,6 +22289,10 @@ requirement and equivalent lifecycle tests.
 Bind subscriptions to an explicit owner and propagate cancellation to native I/O.
 Never automatically retry a write or turn observable delivery into durable ack.
 Do not bypass authorization, transactions, idempotency or audit to simplify code.
+Start with \`supacloud app context --format json\` and \`supacloud app doctor --format json\`;
+do not scan the whole repository first or treat generated/ as source. Apply only
+reviewed diagnostic fixes with \`supacloud app fix --fix <file>\`, then re-run check
+and doctor. Never weaken compiler governance to hide a diagnostic.
 Run bun run check; include negative and cleanup tests. Never store live credentials.
 `;
 var STARTER_REACTIVE_TEST = `import { expect, test } from "bun:test";
@@ -22340,7 +22534,6 @@ export function createCompiledModules(): never {
 }
 `;
 function baseFiles(name, sdkDependencies) {
-  const minimal = sdkDependencies !== undefined;
   return {
     "package.json": json({
       name,
@@ -22366,8 +22559,8 @@ function baseFiles(name, sdkDependencies) {
         "@supacloud/app": `^${appMetadata.version}`,
         "@supacloud/elysia": `^${elysiaMetadata.version}`,
         effect: "4.0.5",
-        elysia: "2.0.0-rc.0",
-        ...sdkDependencies ?? { rxjs: appMetadata.dependencies.rxjs }
+        elysia: "2.0.0-rc.1",
+        ...sdkDependencies
       },
       devDependencies: {
         "@supacloud/compiler": `^${compilerMetadata.version}`,
@@ -22412,253 +22605,16 @@ PORT=3000
 `,
     "supacloud.config.ts": `import { defineSupacloudConfig } from "@supacloud/compiler";
 
-export default defineSupacloudConfig({
-  root: "src",
-  outDir: "generated",
-  strict: true,
-  moduleBoundaryPreset: "modular-monolith",
-  effect: {
-    requireRouteEffects: true,
-    requireErrorMappings: true,
-    requireDependencies: true,
-    requireTaggedErrorTypes: true,
-    requireExactDependencyTypes: true,
-    requireTimeoutForDependencies: true,
-    forbidDirectRuntimeExecution: true,
-    forbidDirectThrows: true,
-  },
-  typeSafety: { scanProductionSource: true, noAnyInGenerated: true },
-  disallowControllerDirectDb: true,
-  detectOrphanModules: true,
-  commandCapabilities: { permission: true, transaction: true, idempotency: true, audit: true },
-});
+export default defineSupacloudConfig();
 `,
     "src/application.ts": APPLICATION_SOURCE(name),
     "generated/application.ts": GENERATED_BOOTSTRAP,
-    ...minimal ? {} : {
-      "REACTIVE.md": STARTER_REACTIVE_GUIDE,
-      "AGENTS.md": STARTER_REACTIVE_AGENTS,
-      "tests/reactive.test.ts": STARTER_REACTIVE_TEST
-    },
     "scripts/environment.ts": STARTER_ENVIRONMENT,
     "tests/environment.test.ts": STARTER_ENVIRONMENT_TEST,
     "scripts/dev.ts": DEV_SCRIPT,
     "scripts/serve.ts": SERVE_SCRIPT
   };
 }
-function httpTemplate(name) {
-  return {
-    ...baseFiles(name),
-    "src/orders/contracts.ts": `import { t } from "elysia";
-export const OrderParams = t.Object({ id: t.String({ minLength: 1 }) });
-export const CreateOrderBody = t.Object({ name: t.String({ minLength: 1 }) });
-export const OrderResult = t.Object({ id: t.String(), name: t.String() });
-export const HealthResult = t.Object({ ok: t.Boolean() });
-`,
-    "src/orders/orders.ts": `import { Effect } from "effect";
-import { Body, Controller, Get, Param, Post, defineFeatureSlice } from "@supacloud/app";
-import { status } from "elysia";
-import { OrderParams, CreateOrderBody, OrderResult, HealthResult } from "./contracts";
-@Controller("/orders")
-export class OrdersController {
-  @Get("/health", {
-    responses: { 200: HealthResult },
-    effect: { required: true, dependencies: [], errors: [], retry: "none" },
-  })
-  health(): Effect.Effect<{ ok: boolean }, never, never> { return Effect.succeed({ ok: true }); }
-
-  @Get("/:id", {
-    params: OrderParams,
-    responses: { 200: OrderResult },
-    effect: { required: true, dependencies: [], errors: [], retry: "none" },
-  })
-  get(@Param("id") id: string): Effect.Effect<{ id: string; name: string }, never, never> {
-    return Effect.succeed({ id, name: "demo" });
-  }
-
-  @Post("/", {
-    body: CreateOrderBody,
-    responses: { 201: OrderResult },
-    effect: { required: true, dependencies: [], errors: [], retry: "none" },
-  })
-  create(@Body() body: { name: string }) {
-    return Effect.succeed(status(201, { id: "demo", name: body.name }));
-  }
-}
-
-export const OrdersFeature = defineFeatureSlice({
-  name: "orders",
-  tags: ["type:feature"],
-  controllers: [OrdersController],
-});
-`,
-    "scripts/sandbox.ts": `import { createMemorySandbox } from "@supacloud/elysia";
-import { createCompiledModules } from "../generated/application";
-
-export function createDemo() {
-  if (process.env["APP_ENV"] !== "development" && process.env["APP_ENV"] !== "test") {
-    throw new Error("Memory adapters are restricted to development and test");
-  }
-  return createMemorySandbox({
-    modules: createCompiledModules(),
-    identity: { authenticated: true, subject: "local-demo" },
-  });
-}
-`,
-    "tests/orders.test.ts": `import { expect, test } from "bun:test";
-import { createDemo } from "../scripts/sandbox";
-
-test("health, read and create routes follow the declared HTTP contract", async () => {
-  const sandbox = createDemo();
-  expect((await sandbox.request("/orders/health")).status).toBe(200);
-  expect((await sandbox.request("/orders/1")).status).toBe(200);
-  const created = await sandbox.request("/orders", {
-    method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ name: "first" }),
-  });
-  expect(created.status).toBe(201);
-  expect(await created.json()).toEqual({ id: "demo", name: "first" });
-  const invalid = await sandbox.request("/orders", {
-    method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({}),
-  });
-  expect(invalid.status).toBe(422);
-});
-`,
-    "README.md": `# ${name}
-
-HTTP API golden path.
-
-## Local Development
-
-\`\`\`sh
-bun install
-bun run check
-bun run dev
-\`\`\`
-
-The server binds only to 127.0.0.1:3000 by default.
-
-\`\`\`sh
-curl http://127.0.0.1:3000/orders/health
-curl http://127.0.0.1:3000/orders/1
-curl -X POST http://127.0.0.1:3000/orders \\
-  -H 'Content-Type: application/json' -d '{"name":"first"}'
-\`\`\`
-
-The generated feature declares explicit route schemas so the compiler can detect
-route/schema drift. Keep request and response shapes in \`src/orders/orders.ts\`;
-do not widen them to \`unknown\` just to accept unvalidated data.
-
-## Production Boundary
-
-\`bun run build\` emits an application factory, not a server. Import \`createApp\`
-from \`output/supacloud/application.js\` in your trusted host and supply real dependency,
-request-context and command-governance adapters. The memory sandbox is
-development/test only.
-
-Keep backend bundles outside the frontend output directory. Vite normally cleans
-\`dist/\` before building; server artifacts placed there can be deleted or included
-in a public frontend archive. Use disjoint output directories, not a disabled
-frontend clean step. Compiler source artifacts remain in \`generated/\`.
-
-## Inspection And Repair
-
-\`\`\`sh
-supacloud context --root . --target orders --format json
-supacloud doctor --root .
-\`\`\`
-`
-  };
-}
-function edgeTemplate(name) {
-  return {
-    ...baseFiles(name),
-    "src/sync/sync.ts": `import { Injectable, Job, defineFeatureSlice } from "@supacloud/app";
-
-/**
- * Worker/edge golden path: a declared, retry-bounded job with an explicit
- * idempotency requirement. The platform owns scheduling, retry and DLQ; the
- * handler stays side-effect explicit and must not assume exactly-once execution.
- */
-@Injectable()
-@Job({
-  name: "sync.orders",
-  mode: "task",
-  idempotency: "required",
-  timeoutSec: 60,
-  maxAttempts: 3,
-})
-export class SyncOrdersJob {
-  async run(): Promise<{ ok: boolean }> {
-    return { ok: true };
-  }
-}
-
-export const SyncFeature = defineFeatureSlice({
-  name: "sync",
-  tags: ["type:feature"],
-  providers: [SyncOrdersJob],
-  jobs: [SyncOrdersJob],
-});
-`,
-    "scripts/sandbox.ts": `import { createMemorySandbox } from "@supacloud/elysia";
-import { createCompiledModules } from "../generated/application";
-
-export function createDemo() {
-  if (process.env["APP_ENV"] !== "development" && process.env["APP_ENV"] !== "test") {
-    throw new Error("Memory adapters are restricted to development and test");
-  }
-  return createMemorySandbox({
-    modules: createCompiledModules(),
-    identity: { authenticated: true, subject: "local-worker" },
-  });
-}
-`,
-    "tests/sync.test.ts": `import { expect, test } from "bun:test";
-import { SyncOrdersJob } from "../src/sync/sync";
-
-test("the declared job handler is deterministic and idempotent by construction", async () => {
-  const job = new SyncOrdersJob();
-  expect(await job.run()).toEqual({ ok: true });
-  expect(await job.run()).toEqual({ ok: true });
-});
-`,
-    "README.md": `# ${name}
-
-Worker / Edge golden path.
-
-## Local Development
-
-\`\`\`sh
-bun install
-bun run check
-bun run test
-\`\`\`
-
-\`src/sync/sync.ts\` declares a platform job with an explicit mode, timeout,
-attempt bound and idempotency requirement. The platform schedules and retries;
-the handler must be safe to run more than once and must not assume exactly-once
-execution.
-
-## Production Boundary
-
-The job runs through the platform worker/edge adapter, not the local memory
-sandbox. Bind persistence, authorization and audit to durable adapters before
-invoking it in production. Do not schedule destructive work without an
-idempotency key.
-
-\`bun run build\` emits \`output/supacloud/application.js\`, an application factory,
-not a deployed Worker. Keep it outside any frontend output directory such as
-\`dist/\`; frontend clean steps and public archives must not own server bundles.
-
-## Inspection And Repair
-
-\`\`\`sh
-supacloud context --root . --target sync --format json
-supacloud doctor --root .
-\`\`\`
-`
-  };
-}
 function minimalTemplate(name, sdkDependencies) {
   return {
     ...baseFiles(name, sdkDependencies),
@@ -22713,8 +22669,12 @@ export function createDemo() {
 - Cross-table business writes require trusted authorization, transactions,
   idempotency and audit. Never put service-role or Management tokens in a browser.
 - Do not edit generated/. Do not rewrite historical migrations.
+- Start with \`supacloud app context --format json\` and \`supacloud app doctor --format json\`.
+  Do not scan the whole repository first or treat generated/ as source.
+- Apply only reviewed diagnostic fixes with \`supacloud app fix --fix <file>\`, then
+  re-run check and doctor. Never weaken compiler governance to hide a diagnostic.
 - Run the directly related single test file and git diff --check for daily changes.
-- Use app verify-plan --target <module> to inspect the focused verification plan.
+- Use \`supacloud app verify-plan --target <module>\` to inspect the focused verification plan.
 - Do not introduce another workflow engine, DI container or session store.
 `,
     "README.md": `# ${name}
@@ -22748,8 +22708,8 @@ Use fixed trusted HTTPS endpoints and never retry an uncertain write.
 
 GraphQL is optional; this starter has no synthetic GraphQL schema.
 For a complete persistent command/attachment example, create a separate reference
-project with app init --template command. The http and edge recipes also remain
-explicit options; do not install every recipe into this application.
+project with app init --template command. Do not install every recipe into this
+application.
 
 ## Integration and delivery
 
@@ -22766,58 +22726,9 @@ regeneration, then validate types, database permissions and authenticated behavi
   };
 }
 function appTemplateFiles(name, template, sdkDependencies) {
-  if (template === "minimal") {
-    if (!sdkDependencies)
-      throw new Error("Minimal template requires the initializer's SDK dependency versions");
-    return minimalTemplate(name, sdkDependencies);
-  }
-  if (template !== "http" && template !== "edge")
+  if (template !== "minimal")
     throw new Error("Use appStarterFiles for the command recipe");
-  const files = template === "http" ? httpTemplate(name) : edgeTemplate(name);
-  const feature = template === "http" ? "OrdersFeature" : "SyncFeature";
-  const source = template === "http" ? "./orders/orders" : "./sync/sync";
-  return {
-    ...files,
-    "src/app.module.ts": `import { Module } from "@supacloud/app";
-import { ${feature} } from "${source}";
-
-// Compose feature modules here. Do not make unrelated features import each other.
-@Module({
-  name: "application-root",
-  tags: ["type:app"],
-  imports: [${feature}],
-})
-export class AppModule {}
-`,
-    "README.md": files["README.md"] + `
-## Application Composition
-
-\`src/app.module.ts\` is the application composition root. Register additional
-feature modules there, rather than importing them from another feature.
-The compiler discovers this declaration; no runtime container lookup is needed.
-
-With the matching candidate/released CLI installed:
-
-\`\`\`sh
-supacloud app generate --kind resource --name inventory --register-in src/app.module.ts --dry-run --format json
-supacloud app generate --kind resource --name inventory --register-in src/app.module.ts
-bun run check
-bun run inspect
-\`\`\`
-
-The resource is an asynchronous read skeleton, not implemented CRUD. Its Service
-rejects until an authorized data adapter is supplied; implement it and replace the
-placeholder test together. Generation does not grant access or connect a database.
-
-\`bun run inspect\` delegates to the installed compiler and prints the current
-source graph as JSON without starting the app or regenerating artifacts. This is
-not a live mounted-route report. Configuration remains trusted project code.
-After changing source, compile before using artifact-backed CLI graph/explain.
-
-In CI, run \`bun run check:generated\` before commands that regenerate artifacts;
-\`bun run check\` is the convenient bootstrap path for a newly created project.
-`
-  };
+  return minimalTemplate(name, sdkDependencies);
 }
 
 // src/shared/tools/app-starter-review-job.ts
@@ -24118,9 +24029,9 @@ After installing dependencies, run \`bun run db:generate\` once and commit db/co
 The default \`bun run check\` and build fail on stale database contracts before any
 compiler regeneration. After an intentional source change, run db:generate again,
 review the diff, then run check.
-The command starter registers databaseGovernance.moduleFile = "db/modules.ts" and
-keeps the default \`databaseGovernance.mode = "check"\`: compile/check/build run
-the offline source-contract gate without a database. Use \`bun run dev:integration\`
+The command starter uses the default database governance module path
+\`db/modules.ts\` and fixes \`databaseGovernance.mode = "check"\`: compile/check/build
+run the offline source-contract gate without a database. Use \`bun run dev:integration\`
 with the CLI's explicit loopback database URL, or set databaseGovernance.mode to
 "enforce" with an explicitly supplied \`DATABASE_URL\`, to run SQL lint and live
 Catalog reconciliation. Missing connections, stale source contracts and Catalog
@@ -25532,7 +25443,7 @@ function appStarterFiles(name) {
         "@supacloud/js": `^${sdkMetadata.version}`,
         "@supabase/supabase-js": sdkMetadata.peerDependencies["@supabase/supabase-js"],
         effect: "4.0.5",
-        elysia: "2.0.0-rc.0",
+        elysia: "2.0.0-rc.1",
         rxjs: appMetadata2.dependencies.rxjs
       },
       devDependencies: {
@@ -25591,25 +25502,7 @@ PORT=3000
     "supacloud.config.ts": `import { defineSupacloudConfig } from "@supacloud/compiler";
 
 export default defineSupacloudConfig({
-  root: "src",
-  outDir: "generated",
-  strict: true,
-  moduleBoundaryPreset: "modular-monolith",
-  databaseGovernance: { mode: "check", moduleFile: "db/modules.ts", databaseUrlEnv: "DATABASE_URL" },
-  effect: {
-    requireRouteEffects: true,
-    requireErrorMappings: true,
-    requireDependencies: true,
-    requireTaggedErrorTypes: true,
-    requireExactDependencyTypes: true,
-    requireTimeoutForDependencies: true,
-    forbidDirectRuntimeExecution: true,
-    forbidDirectThrows: true,
-  },
-  typeSafety: { scanProductionSource: true, noAnyInGenerated: true },
-  disallowControllerDirectDb: true,
-  detectOrphanModules: true,
-  commandCapabilities: { permission: true, transaction: true, idempotency: true, audit: true },
+  databaseGovernance: { mode: "check" },
   delivery: {
     version: 1,
     build: {
@@ -26400,7 +26293,7 @@ and static execution plans, without provider values or source expressions.
 The app context entry point retains its module workflow and adds a separate
 execution evidence block when --events and --request-id are provided together.
 It requires an explicit --target and --format json, rejects --write, and
-resolves relative event paths from --root. The top-level context alias supports
+resolves relative event paths from --root. The app context action supports
 the same flags. Omit both execution flags for the unchanged authoring context.
 The optional --events example expects a trusted host
 to capture approved onExecution metadata in { "version": 1, "events": [...] }.
@@ -28159,13 +28052,27 @@ async function initProject(args) {
     throw new Error("app init never overwrites files; choose an empty directory");
   const template = args.template ?? "minimal";
   const { root, name, files } = await initializeAppProject({ root: args.root, name: args.name, template });
-  return textResult([
-    `Initialized ${name} in ${root} (${files.length} files, template: ${template}).`,
-    `cd '${root.replaceAll("'", "'\\''")}'`,
+  const next = [
     "bun install",
     ...template === "command" ? ["bun run db:generate"] : [],
     "bun run check",
-    "bun run dev",
+    "bun run dev"
+  ];
+  if (args.format === "json")
+    return textResult(JSON.stringify({
+      version: 1,
+      ok: true,
+      root,
+      name,
+      template,
+      files,
+      next,
+      note: "Local demo only. Production requires persistent governance and identity adapters; see README.md."
+    }, null, 2));
+  return textResult([
+    `Initialized ${name} in ${root} (${files.length} files, template: ${template}).`,
+    `cd '${root.replaceAll("'", "'\\''")}'`,
+    ...next,
     "Local demo only. Production requires persistent governance and identity adapters; see README.md."
   ].join(`
 `));
@@ -28564,9 +28471,9 @@ async function runContext(args) {
 `));
 }
 function doctorFixPlan(doctor) {
-  return createDiagnosticRepairPlan(doctor.diagnostics ?? []).map((repair) => ({
+  return createDiagnosticRepairPlan(doctor.diagnostics ?? []).map((repair, index) => ({
     ...repair,
-    command: "supacloud app fix --fix <fix.json>"
+    command: `supacloud app fix --from-doctor <doctor.json> --fix-index ${index}`
   }));
 }
 async function findUnwiredContracts(rootDir) {
@@ -28622,6 +28529,11 @@ async function runDoctor(args) {
   const autoFixable = fixPlan.filter((repair) => repair.readiness === "preview").length;
   const inputRequired = fixPlan.filter((repair) => repair.readiness === "input-required").length;
   const manualFixes = fixPlan.filter((repair) => repair.readiness === "manual").length;
+  const next = doctor.errors === 0 ? ["supacloud app compile", "supacloud app verify-plan --target <module>"] : [
+    ...fixPlan.filter((repair) => repair.readiness === "preview").slice(0, 1).map((repair) => repair.command),
+    "supacloud app check --format json",
+    "supacloud app doctor --format json"
+  ];
   const unwiredContracts = context ? [] : await findUnwiredContracts(root);
   const scope = context ? {
     target: context.subject,
@@ -28633,6 +28545,7 @@ async function runDoctor(args) {
   if (args.format === "json") {
     return textResult(JSON.stringify({
       ok: doctor.errors === 0,
+      next,
       autoFixable,
       inputRequired,
       manualFixes,
@@ -28651,7 +28564,7 @@ async function runDoctor(args) {
   lines.push("");
   lines.push(doctor.errors === 0 ? "No blocking issues. Run `supacloud app compile` to refresh generated artifacts." : `${doctor.errors} blocking issue(s). Run \`supacloud app check\` for the full diagnostic list.`);
   if (autoFixable > 0) {
-    lines.push(`${autoFixable} preview-ready fix(es): run \`supacloud app doctor --format json\`, save each \`fix\`, then preview with \`supacloud app fix --fix <fix.json>\`. Add --write only after review.`);
+    lines.push(`${autoFixable} preview-ready fix(es): run \`supacloud app doctor --format json > doctor.json\`, then preview with \`supacloud app fix --from-doctor doctor.json --fix-index <n>\`. Add --write only after review.`);
   }
   if (inputRequired > 0 || manualFixes > 0) {
     lines.push(`${inputRequired} fix(es) require explicit input; ${manualFixes} require manual implementation.`);
@@ -28668,13 +28581,49 @@ async function runDoctor(args) {
 async function runFix(args) {
   const root = resolve18(args.root || process.cwd());
   const fixPath = args.fix?.trim();
-  if (!fixPath)
-    throw new Error("app fix requires --fix <path-to-diagnostic-fix.json>");
-  const parsed = JSON.parse(await readFile4(resolve18(root, fixPath), "utf8"));
+  const doctorPath = args.from_doctor?.trim();
+  if (fixPath && doctorPath)
+    throw new Error("app fix accepts either --fix or --from-doctor, not both");
+  if (!fixPath && !doctorPath)
+    throw new Error("app fix requires --fix <fix.json> or --from-doctor <doctor.json> --fix-index <n>");
+  let parsed;
+  let source = "fix";
+  let repair;
+  if (doctorPath) {
+    const rawIndex = args.fix_index;
+    if (!Number.isSafeInteger(rawIndex) || rawIndex === undefined || rawIndex < 0) {
+      throw new Error("app fix --from-doctor requires a non-negative --fix-index <n>");
+    }
+    const doctor = JSON.parse(await readFile4(resolve18(root, doctorPath), "utf8"));
+    if (!doctor || typeof doctor !== "object" || !Array.isArray(doctor.fixPlan)) {
+      throw new Error("Invalid doctor output: expected a fixPlan array");
+    }
+    const plan = doctor.fixPlan;
+    if (rawIndex >= plan.length)
+      throw new Error(`--fix-index ${rawIndex} is outside fixPlan (0..${plan.length - 1})`);
+    const entry = plan[rawIndex];
+    if (!entry || typeof entry !== "object" || !("fix" in entry)) {
+      throw new Error(`fixPlan[${rawIndex}] does not contain a fix payload`);
+    }
+    const repairEntry = entry;
+    if (repairEntry.readiness !== undefined && repairEntry.readiness !== "preview") {
+      throw new Error(`fixPlan[${rawIndex}] is ${repairEntry.readiness}; only preview-ready repairs can be applied automatically`);
+    }
+    repair = repairEntry;
+    parsed = repairEntry.fix;
+    source = "doctor";
+  } else {
+    parsed = JSON.parse(await readFile4(resolve18(root, fixPath), "utf8"));
+  }
   const write = args.write === true;
   const applied = await applyDiagnosticFix(parsed, { rootDir: root, dryRun: !write });
   return textResult(JSON.stringify({
     ok: true,
+    source,
+    ...source === "doctor" ? {
+      index: args.fix_index,
+      ...repair?.code === undefined ? {} : { code: repair.code }
+    } : {},
     written: write,
     file: applied.file,
     changed: applied.changed,
@@ -28894,11 +28843,14 @@ async function runCheck(args) {
     strict: args.strict ?? loadedConfig.strict ?? false
   }, root);
   const result = await checkProject(config);
-  const hasError = result.diagnostics.some((diagnostic) => diagnostic.severity === "error") || result.mismatches.length > 0 || database?.ok === false;
+  const diagnosticError = result.diagnostics.some((diagnostic) => diagnostic.severity === "error");
+  const hasError = diagnosticError || result.mismatches.length > 0 || database?.ok === false;
+  const next = hasError ? diagnosticError || database?.ok === false ? ["supacloud app doctor --format json"] : ["supacloud app compile", "supacloud app check --format json"] : ["supacloud app verify-plan --target <module>"];
   if (args.format === "json")
     return textResult(JSON.stringify({
       version: 1,
       ok: !hasError,
+      next,
       source: "declaration",
       diagnostics: result.diagnostics,
       mismatches: result.mismatches,
@@ -29324,7 +29276,7 @@ async function runAppRelease(request, options, delegate) {
     ...typeof deployReceipt.activation_id === "string" ? { activation_id: deployReceipt.activation_id } : {},
     ...deployReceipt.web === undefined ? {} : { web: deployReceipt.web }
   };
-  return request.format === "json" || request.json === true ? textResult(JSON.stringify(result, null, 2)) : textResult([
+  return request.format === "json" ? textResult(JSON.stringify(result, null, 2)) : textResult([
     `${ref}/${id}/${environmentId}: ${deployReceipt.status === "accepted" ? "accepted" : result.no_op ? "no-op" : "released"}`,
     `Release: ${releaseId}`,
     `Configuration: ${configurationId}`,
@@ -29527,7 +29479,7 @@ async function runPromotion(request, options, delegate) {
   const ref = request.ref ?? options.projectRef;
   if (request.mutation_id !== undefined)
     throw new Error("app promote generates a new mutation ID; use promote-status or promote-reconcile to inspect an existing mutation");
-  const { format, json, ...remoteRequest } = request;
+  const { format, ...remoteRequest } = request;
   const planArgs = {
     ...remoteRequest,
     action: "get_promotion_plan",
@@ -29565,7 +29517,7 @@ async function runPromotion(request, options, delegate) {
       no_op: true,
       execution_performed: false
     });
-    return format === "json" || json ? noOp : textResult(`${plan.project_ref}/${plan.application_id}/${plan.environment_id}: no-op
+    return format === "json" ? noOp : textResult(`${plan.project_ref}/${plan.application_id}/${plan.environment_id}: no-op
 Execution: skipped`);
   }
   if (plan.blockers.some((code) => !["MIGRATION_PENDING", "BACKUP_REQUIRED"].includes(code))) {
@@ -29587,23 +29539,9 @@ Execution: skipped`);
   };
   validateToolArguments2(APPLICATION_TOOL_SCHEMA2, executeArgs);
   const result = await delegate(executeArgs);
-  return format === "json" || json ? result : formatPromotionExecution(result);
+  return format === "json" ? result : formatPromotionExecution(result);
 }
 async function runAppTool(request, options = {}) {
-  if (request.dry_run !== undefined && request["dry-run"] !== undefined || request.register_in !== undefined && request["register-in"] !== undefined || request.database_url !== undefined && request["database-url"] !== undefined || request.database_source !== undefined && request["database-source"] !== undefined || request.database_table !== undefined && request["database-table"] !== undefined || request.database_type !== undefined && request["database-type"] !== undefined || request.read_permission !== undefined && request["read-permission"] !== undefined || request.request_id !== undefined && request["request-id"] !== undefined) {
-    throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "Do not combine hyphenated and underscored aliases of the same flag");
-  }
-  request = {
-    ...request,
-    ...request["dry-run"] === undefined ? {} : { dry_run: request["dry-run"] },
-    ...request["register-in"] === undefined ? {} : { register_in: request["register-in"] },
-    ...request["database-url"] === undefined ? {} : { database_url: request["database-url"] },
-    ...request["database-source"] === undefined ? {} : { database_source: request["database-source"] },
-    ...request["database-table"] === undefined ? {} : { database_table: request["database-table"] },
-    ...request["database-type"] === undefined ? {} : { database_type: request["database-type"] },
-    ...request["read-permission"] === undefined ? {} : { read_permission: request["read-permission"] },
-    ...request["request-id"] === undefined ? {} : { request_id: request["request-id"] }
-  };
   if (request.events !== undefined || request.request_id !== undefined) {
     if (request.action !== "context" || !request.events?.trim() || !request.target?.trim() || !request.request_id || !/^[A-Za-z0-9._:-]{1,256}$/.test(request.request_id) || request.format !== "json" || request.write !== undefined) {
       throw new Error("Execution context requires app context, --target, --events, --request-id and --format json; --write is not supported");
@@ -29615,10 +29553,6 @@ async function runAppTool(request, options = {}) {
   if (request.database_url !== undefined && request.action !== "dev" && request.action !== "watch") {
     throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "--database-url applies only to app dev --profile integration");
   }
-  if (request.json !== undefined && !Object.hasOwn(REMOTE_APP_ACTIONS, request.action) && request.action !== "promote" && request.action !== "release")
-    throw new Error("--json applies only to remote app actions");
-  if (request.json && request.format === "text")
-    throw new Error("--json and --format text cannot be combined");
   if (request.action === "promote") {
     const delegate = options.getApplications?.();
     if (!delegate)
@@ -29637,7 +29571,7 @@ async function runAppTool(request, options = {}) {
       return textResult("App remote actions require a Management API context.", true);
     const promotionDiff = request.action === "diff" && request.source_ref !== undefined && request.source_environment_id !== undefined && request.source_release_id !== undefined;
     const action = promotionDiff ? "get_promotion_plan" : REMOTE_APP_ACTIONS[request.action];
-    const { format, json, ...remoteRequest } = request;
+    const { format, ...remoteRequest } = request;
     const args = {
       ...remoteRequest,
       action,
@@ -29645,7 +29579,7 @@ async function runAppTool(request, options = {}) {
     };
     validateToolArguments2(APPLICATION_TOOL_SCHEMA2, args);
     const result = await delegate(args);
-    if (request.action === "evidence" && format !== "json" && json !== true && !result.isError) {
+    if (request.action === "evidence" && format !== "json" && !result.isError) {
       try {
         const payload = JSON.parse(result.content[0].text);
         if (payload === null || typeof payload !== "object" || !("project_ref" in payload) || payload.project_ref !== args.ref || !("application_id" in payload) || payload.application_id !== request.id || !("environment_id" in payload) || payload.environment_id !== request.environment_id || !("evidence" in payload))
@@ -29660,17 +29594,17 @@ async function runAppTool(request, options = {}) {
         return textResult("DEPLOYMENT unknown: invalid or mismatched evidence; no mutation was attempted.", true);
       }
     }
-    if (request.action === "history" && format !== "json" && json !== true) {
+    if (request.action === "history" && format !== "json") {
       return historyText(result, request, args.ref);
     }
     if ((request.action === "deploy-plan" || request.action === "diff") && format !== "json" && (request.action === "deploy-plan" || request.source_ref === undefined || request.source_environment_id === undefined || request.source_release_id === undefined)) {
       return formatRemoteDeployPlan(result);
     }
     if (request.action === "promote-plan" || request.action === "diff" && request.source_ref !== undefined && request.source_environment_id !== undefined && request.source_release_id !== undefined) {
-      if (!result.isError && format !== "json" && !json)
+      if (!result.isError && format !== "json")
         return formatPromotionPlan2(result);
     }
-    return (request.action === "transfer-plan" || request.action === "transfer") && format !== "json" && !json ? formatReleaseTransfer(result) : format !== "json" && !json ? formatWorkflowObservation(result, request.action) : result;
+    return (request.action === "transfer-plan" || request.action === "transfer") && format !== "json" ? formatReleaseTransfer(result) : format !== "json" ? formatWorkflowObservation(result, request.action) : result;
   }
   switch (request.action) {
     case "verify-plan": {
@@ -29772,83 +29706,38 @@ function registerAppTools(server, options = {}) {
       "promote-reconcile"
     ]), "App action; promote obtains and verifies its plan before one mutation request"),
     kind: optional(stringEnum2(["module", "command", "query", "controller", "job", "contract", "resource", "feature"]), "[generate] Scaffold kind"),
-    template: optional(stringEnum2(["minimal", "http", "command", "edge"]), "[init] Minimal application by default; explicit http/command/edge recipes"),
+    template: optional(stringEnum2(["minimal", "command"]), "[init] Minimal application by default; command adds the persistent governed-command reference"),
     name: optional(String2(), "[init/generate] Project or object name"),
     module: optional(String2(), "[generate] Target feature module (required for command/query/controller)"),
     permission: optional(String2(), "[generate feature] Explicit approval permission; not inferred from name"),
     read_permission: optional(String2(), "[generate feature] Explicit read permission; not inferred from name"),
-    "read-permission": optional(String2(), "[generate feature] CLI alias of read_permission"),
     rpc: optional(String2(), "[generate feature] Explicit durable RPC capability; must be registered by the host"),
     database_source: optional(String2(), "[generate feature] Project-relative database source path"),
     database_table: optional(String2(), "[generate feature] Schema-qualified table owned by the feature"),
     database_type: optional(String2(), "[generate feature] Exported row type derived from the database source"),
-    "database-source": optional(String2(), "[generate feature] CLI alias of database_source"),
-    "database-table": optional(String2(), "[generate feature] CLI alias of database_table"),
-    "database-type": optional(String2(), "[generate feature] CLI alias of database_type"),
     dir: optional(String2(), "[generate] Feature root directory (default: src/features)"),
     force: optional(Boolean2(), "[generate] Overwrite a single regular file; resource/feature/controller never overwrite"),
     dry_run: optional(Boolean2(), "[generate] Validate and preview the complete change set without writing"),
-    "dry-run": optional(Boolean2(), "[generate] CLI alias of dry_run"),
     register_in: optional(String2(), "[generate] Existing parent module file for module/resource/feature; uses the compiler AST editor"),
-    "register-in": optional(String2(), "[generate] CLI alias of register_in"),
     root: optional(String2(), "[dev/plan/build/release/compile/check] Project directory containing supacloud.config.ts (default: current directory)"),
     include: optional(String2(), "[dev/compile/check] Comma-separated glob patterns for source files"),
     out_dir: optional(String2(), "[dev/compile/plan/build/export-tools] Output directory (default: configured outDir)"),
     strict: optional(Boolean2(), "[dev/compile/check] Promote warnings to errors"),
-    format: optional(stringEnum2(["text", "json"]), "[dev/generate/compile/check/plan/release/deploy-plan/diff/history/promote-plan/graph/export-tools] Output format (default: text)"),
-    json: optional(Boolean2(), "[history/transfer-plan/transfer/promote-plan] Preserve or return the full machine-readable receipt"),
+    format: optional(stringEnum2(["text", "json"]), "[*] Output format (default: text)"),
     profile: optional(stringEnum2(["fast", "integration"]), "[dev] Run dev or dev:integration; integration verifies an explicit loopback database"),
     once: optional(Boolean2(), "[dev] Validate and report once without watching"),
     watch: optional(Boolean2(), "[dev] Watch for changes (default: true; --once disables)"),
     database_url: optional(String2(), "[dev] Explicit loopback integration URL; watch/once only inspect its shape"),
-    "database-url": optional(String2(), "[dev] CLI alias of database_url"),
     target: optional(String2(), "[explain/context/verify-plan] Provider class name / token name / command name / job name / module name"),
     events: optional(String2(), "[context] Project-relative execution metadata JSON or generated JSON-lines file"),
     request_id: optional(String2(), "[context] Opaque request ID or Workflow run ID selected from --events"),
-    "request-id": optional(String2(), "[context] CLI alias of request_id"),
     fix: optional(String2(), "[fix] Path to a DiagnosticFix JSON file produced by `doctor --format json`"),
+    from_doctor: optional(String2(), "[fix] Read one fix from a doctor --format json output"),
+    fix_index: optional(Number2({ minimum: 0, multipleOf: 1 }), "[fix] Zero-based fixPlan index used with --from-doctor"),
     write: optional(Boolean2(), "[fix] Write the fix to disk (default: preview only)"),
     skip_build: optional(Boolean2(), "[release] Reuse --manifest_path instead of running the local delivery build")
   }, (request) => runAppTool(request, options));
 }
-var APP_ALIAS_ACTIONS = ["generate", "compile", "check", "graph", "explain", "context", "doctor", "fix"];
-function registerAppAliases(server) {
-  const schema = {
-    kind: optional(stringEnum2(["module", "command", "query", "controller", "job", "contract", "resource", "feature"]), "[generate] Scaffold kind"),
-    name: optional(String2(), "[generate] Object name"),
-    module: optional(String2(), "[generate] Target feature module"),
-    permission: optional(String2(), "[generate feature] Explicit approval permission; not inferred from name"),
-    read_permission: optional(String2(), "[generate feature] Explicit read permission; not inferred from name"),
-    "read-permission": optional(String2(), "[generate feature] CLI alias of read_permission"),
-    rpc: optional(String2(), "[generate feature] Explicit durable RPC capability; must be registered by the host"),
-    database_source: optional(String2(), "[generate feature] Project-relative database source path"),
-    database_table: optional(String2(), "[generate feature] Schema-qualified table owned by the feature"),
-    database_type: optional(String2(), "[generate feature] Exported row type derived from the database source"),
-    "database-source": optional(String2(), "[generate feature] CLI alias of database_source"),
-    "database-table": optional(String2(), "[generate feature] CLI alias of database_table"),
-    "database-type": optional(String2(), "[generate feature] CLI alias of database_type"),
-    dir: optional(String2(), "[generate] Feature root directory (default: src/features)"),
-    force: optional(Boolean2(), "[generate] Overwrite a single regular file; resource/feature/controller never overwrite"),
-    dry_run: optional(Boolean2(), "[generate] Validate and preview the complete change set without writing"),
-    "dry-run": optional(Boolean2(), "[generate] CLI alias of dry_run"),
-    register_in: optional(String2(), "[generate] Existing parent module file for module/resource/feature; uses the compiler AST editor"),
-    "register-in": optional(String2(), "[generate] CLI alias of register_in"),
-    root: optional(String2(), "Project directory containing supacloud.config.ts (default: current directory)"),
-    include: optional(String2(), "[compile/check] Comma-separated glob patterns for source files"),
-    out_dir: optional(String2(), "[compile/export-tools] Output directory (default: <root>/generated)"),
-    strict: optional(Boolean2(), "[compile/check] Promote warnings to errors"),
-    format: optional(stringEnum2(["text", "json"]), "Output format (default: text)"),
-    target: optional(String2(), "[explain/context] Provider class name / token name / command name / job name / module name"),
-    events: optional(String2(), "[context] Project-relative execution metadata JSON or generated JSON-lines file"),
-    request_id: optional(String2(), "[context] Opaque request ID or Workflow run ID selected from --events"),
-    "request-id": optional(String2(), "[context] CLI alias of request_id"),
-    fix: optional(String2(), "[fix] Path to a DiagnosticFix JSON file produced by `doctor --format json`"),
-    write: optional(Boolean2(), "[fix] Write the fix to disk (default: preview only)")
-  };
-  for (const action of APP_ALIAS_ACTIONS) {
-    registerTool(server, action, `Top-level alias of \`app ${action}\`.`, schema, (request) => runAppTool({ ...request, action }));
-  }
-}
 
 // src/shared/tools/db-governance-tools.ts
 import { existsSync as existsSync13 } from "node:fs";
@@ -30291,7 +30180,7 @@ async function runOfficial(root, workdir, args, environment, options) {
   if (code !== 0)
     throw new Error(`Official Supabase candidate generation failed (exit ${code}); no candidate was published. Select a compatible pinned CLI; no fallback engine is used.`);
 }
-async function initializeCandidate(stage, majorVersion = 17) {
+async function initializeCandidate(stage, majorVersion = 18) {
   if (![15, 16, 17, 18].includes(majorVersion))
     throw new Error("Select a supported PostgreSQL major version (15-18)");
   await mkdir6(join15(stage, "supabase/migrations"), { recursive: true });
@@ -30718,25 +30607,84 @@ async function runModuleCheckLite(args, root, spawn, liteBinary) {
 `);
   return textResult2(output || "lite db check 无输出", result.exitCode !== 0);
 }
-async function runModuleCheckAction(args, root, environment, spawn, liteBinary) {
-  if (args.lite)
-    return runModuleCheckLite(args, root, spawn, liteBinary);
-  const databaseUrl = args.database_url?.trim() || environment.DATABASE_URL?.trim();
-  if (!databaseUrl) {
-    throw new Error("db module_check requires --database_url、环境变量 DATABASE_URL 或 --lite");
-  }
-  const modules = await loadDatabaseModules(root, args.module_file);
-  const schemas = parseSchemas(args.schema);
-  const client = new Bun.SQL(databaseUrl);
-  const executor = {
-    async query(sql, params) {
-      return await client.unsafe(sql, params ?? []);
-    }
-  };
-  try {
-    const reports = [];
-    for (const module of modules) {
-      reports.push(await runModuleCheck(module, executor, schemas));
+function remoteModuleManifest(modules) {
+  return modules.map((module) => ({
+    name: module.name,
+    tables: module.tables,
+    policies: module.policies.map((policy) => ({
+      name: policy.name,
+      table: policy.table,
+      operation: policy.operation,
+      roles: policy.roles,
+      ...policy.usingExpr === undefined ? {} : { usingExpr: policy.usingExpr },
+      ...policy.checkExpr === undefined ? {} : { checkExpr: policy.checkExpr }
+    })),
+    functions: module.functions.map((fn) => ({
+      name: fn.name,
+      security: fn.security,
+      ...fn.signature === undefined ? {} : { signature: fn.signature }
+    })),
+    triggers: module.triggers.map((trigger) => ({
+      name: trigger.name,
+      table: trigger.table,
+      ...trigger.enabled === undefined ? {} : { enabled: trigger.enabled }
+    })),
+    grants: module.grants.map((grant) => ({
+      object: grant.object,
+      privilege: grant.privilege,
+      role: grant.role
+    }))
+  }));
+}
+async function runModuleCheckRemote(args, root, options) {
+  const run = options.runDatabase?.();
+  if (!run)
+    throw new Error("db module_check --remote 需要 Management API context（SUPACLOUD_API_URL + SUPACLOUD_API_TOKEN）");
+  const ref = args.ref?.trim() || options.projectRef?.trim();
+  if (!ref)
+    throw new Error("db module_check --remote 需要 --ref 或 SUPACLOUD_PROJECT_REF");
+  const modules = await loadDatabaseModules(root, args.module_file);
+  const schemas = args.schema?.split(",").map((entry) => entry.trim()).filter(Boolean) ?? ["public"];
+  return await run({
+    action: "governance_check",
+    ref,
+    modules: remoteModuleManifest(modules),
+    schemas
+  });
+}
+async function runRoleCheckRemote(args, options) {
+  const run = options.runDatabase?.();
+  if (!run)
+    throw new Error("db role_check --remote 需要 Management API context（SUPACLOUD_API_URL + SUPACLOUD_API_TOKEN）");
+  const ref = args.ref?.trim() || options.projectRef?.trim();
+  if (!ref)
+    throw new Error("db role_check --remote 需要 --ref 或 SUPACLOUD_PROJECT_REF");
+  const schemas = args.schema?.split(",").map((entry) => entry.trim()).filter(Boolean) ?? ["public"];
+  return await run({ action: "role_check", ref, schemas });
+}
+async function runModuleCheckAction(args, root, environment, spawn, liteBinary, options) {
+  if (args.lite && args.remote)
+    throw new Error("db module_check 只能选择 --lite 或 --remote");
+  if (args.remote)
+    return runModuleCheckRemote(args, root, options);
+  if (args.lite)
+    return runModuleCheckLite(args, root, spawn, liteBinary);
+  const databaseUrl = args.database_url?.trim() || environment.DATABASE_URL?.trim();
+  if (!databaseUrl) {
+    throw new Error("db module_check requires --database_url、环境变量 DATABASE_URL、--lite 或 --remote");
+  }
+  const modules = await loadDatabaseModules(root, args.module_file);
+  const schemas = parseSchemas(args.schema);
+  const client = new Bun.SQL(databaseUrl);
+  const executor = {
+    async query(sql, params) {
+      return await client.unsafe(sql, params ?? []);
+    }
+  };
+  try {
+    const reports = [];
+    for (const module of modules) {
+      reports.push(await runModuleCheck(module, executor, schemas));
     }
     const hasError = reports.some((report) => !report.ok);
     return textResult2(reports.map(formatReconcileReport).join(`
@@ -30761,12 +30709,13 @@ function registerDbGovernanceTools(server, options = {}) {
     database_url: optional(String2(), "[module_check] Postgres connection URL (default: DATABASE_URL)"),
     schema: optional(String2(), "[module_check] Comma-separated schemas to inspect (default: public)"),
     lite: optional(Boolean2(), "[module_check] Reconcile against a local SupaCloud Lite project (runs supacloud-lite db check)"),
+    remote: optional(Boolean2(), "[module_check/role_check] Use Management API without a local database URL"),
     project_dir: optional(String2(), "[module_check] Lite project directory (with --lite; default: --root)"),
     schema_dir: optional(String2(), "[diff] Maintained declarative SQL directory (default: supabase/schemas)"),
-    db_major_version: optional(Number2(), "[reverse/diff] PostgreSQL shadow major version (default: 17)"),
+    db_major_version: optional(Number2(), "[reverse/diff] PostgreSQL shadow major version (default: 18); set only when matching a non-18 source"),
     out: optional(String2(), "[reverse/diff] Candidate output path (reverse requires a new directory)"),
     dir: optional(String2(), "[diff/plan/apply] Reviewed forward migration directory"),
-    ref: optional(String2(), "[plan/apply] Target project ref"),
+    ref: optional(String2(), "[module_check/role_check/plan/apply] Target project ref (remote checks default to SUPACLOUD_PROJECT_REF)"),
     approved_digest: optional(String2(), "[apply] Exact digest returned by db plan"),
     application_role: optional(String2(), "[role_sql] Application database role"),
     migration_role: optional(String2(), "[role_sql] Privileged migration role"),
@@ -30781,12 +30730,20 @@ function registerDbGovernanceTools(server, options = {}) {
       case "explain":
         return runExplain2(request, root);
       case "module_check":
-        return runModuleCheckAction(request, root, environment, liteSpawn, options.liteBinary);
+        return runModuleCheckAction(request, root, environment, liteSpawn, options.liteBinary, options);
+      case "role_check":
+        if (request.remote)
+          return runRoleCheckRemote(request, options);
+        return runDbWorkflow({ ...request, action: request.action }, root, {
+          environment,
+          projectRef: options.projectRef,
+          apiUrl: options.apiUrl,
+          runDatabase: options.runDatabase
+        });
       case "reverse":
       case "diff":
       case "plan":
       case "apply":
-      case "role_check":
       case "role_sql":
         return runDbWorkflow({ ...request, action: request.action }, root, {
           environment,
@@ -32126,11 +32083,11 @@ function registerReleaseTools(server, http, options = {}) {
 }
 
 // src/shared/tools/deploy-tools.ts
-import { access, lstat as lstat5, mkdtemp as mkdtemp2, opendir, readFile as readFile6, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
+import { access, lstat as lstat5, mkdtemp as mkdtemp2, opendir, readFile as readFile7, rm as rm3, writeFile as writeFile7 } from "node:fs/promises";
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash11 } from "node:crypto";
 import { tmpdir as tmpdir3 } from "node:os";
-import { basename as basename8, dirname as dirname13, join as join18, relative as relative10, resolve as resolve24, sep as sep5 } from "node:path";
+import { basename as basename8, dirname as dirname14, join as join19, relative as relative10, resolve as resolve26, sep as sep5 } from "node:path";
 
 // src/shared/tools/project-deployment.ts
 async function requireProjectDeploymentProtocol(http, projectRef, environmentId) {
@@ -32205,6 +32162,364 @@ async function readProjectDeploymentStatus(http, projectRef, environmentId, depl
   }
 }
 
+// src/shared/tools/developer-experience-tools.ts
+import { existsSync as existsSync16 } from "node:fs";
+import { mkdir as mkdir7, readdir as readdir7, readFile as readFile6, writeFile as writeFile6 } from "node:fs/promises";
+import { dirname as dirname13, join as join18, resolve as resolve25 } from "node:path";
+
+// src/shared/context.ts
+import { existsSync as existsSync15, readFileSync as readFileSync12 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { resolve as resolve24 } from "node:path";
+var CORE_CONTEXT_KEYS2 = [
+  "SUPABASE_URL",
+  "SUPABASE_SERVICE_ROLE_KEY",
+  "SUPACLOUD_API_URL",
+  "SUPACLOUD_API_TOKEN",
+  "SUPACLOUD_PROJECT_REF",
+  "SUPACLOUD_HOST",
+  "SUPACLOUD_APPLICATION_ID",
+  "SUPACLOUD_APPLICATION_ENVIRONMENT_ID",
+  "SUPACLOUD_APPLICATION_CONFIGURATION_PATH",
+  "SUPACLOUD_APPLICATION_CONFIGURATION_ID",
+  "SUPACLOUD_APPLICATION_MANIFEST_PATH"
+];
+function unquotedEnvValue2(rawValue) {
+  const value = rawValue.trim();
+  const quote = value[0];
+  return quote && (quote === '"' || quote === "'") && value.endsWith(quote) ? value.slice(1, -1) : value;
+}
+function parseEnvFile2(contents) {
+  const values = {};
+  for (const rawLine of contents.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!match)
+      continue;
+    values[match[1]] = unquotedEnvValue2(match[2]);
+  }
+  return values;
+}
+function readEnvFile2(path, required) {
+  if (!existsSync15(path)) {
+    if (required)
+      throw new Error(`SupaCloud environment file not found: ${path}`);
+    return {};
+  }
+  try {
+    return parseEnvFile2(readFileSync12(path, "utf8"));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to read SupaCloud environment file ${path}: ${message}`);
+  }
+}
+function canonicalApiOrigin2(value) {
+  const candidate = value.trim();
+  if (!candidate)
+    return "";
+  try {
+    const url = new URL(candidate);
+    const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+    const allowedProtocol = url.protocol === "https:" || url.protocol === "http:" && loopback;
+    const exactOrigin = candidate === url.origin || candidate === `${url.origin}/`;
+    return allowedProtocol && !url.username && !url.password && exactOrigin && url.pathname === "/" && !url.search && !url.hash ? url.origin : "";
+  } catch (error) {
+    if (error instanceof TypeError)
+      return "";
+    throw error;
+  }
+}
+function hostFromUrl2(value) {
+  return value ? new URL(value).hostname : "";
+}
+function inferProjectRefFromSupabaseUrl2(value) {
+  if (!value)
+    return "";
+  return new URL(value).hostname.match(/^([a-z0-9-]+)\.api\./i)?.[1] ?? "";
+}
+function sourceCredentialScope2(values, explicitApiUrl, supabaseUrl) {
+  const hasManagementContext = Boolean(explicitApiUrl.trim() || values.SUPACLOUD_API_TOKEN?.trim() || values.SUPACLOUD_HOST?.trim());
+  if (hasManagementContext)
+    return "management";
+  return supabaseUrl || values.SUPABASE_SERVICE_ROLE_KEY?.trim() ? "project_application" : "incomplete";
+}
+function sourceProjectCore2(values) {
+  const supabaseUrl = canonicalApiOrigin2(values.SUPABASE_URL || "");
+  const projectRef = (values.SUPACLOUD_PROJECT_REF || "").trim() || inferProjectRefFromSupabaseUrl2(supabaseUrl);
+  const explicitApiUrl = values.SUPACLOUD_API_URL || "";
+  const credentialScope = sourceCredentialScope2(values, explicitApiUrl, supabaseUrl);
+  const managementUrl = explicitApiUrl || (values.SUPACLOUD_HOST ? `http://${values.SUPACLOUD_HOST}:9090` : "");
+  const apiUrl = credentialScope === "management" ? canonicalApiOrigin2(managementUrl) : "";
+  const apiToken = credentialScope === "management" ? values.SUPACLOUD_API_TOKEN || "" : "";
+  return { apiUrl, apiToken, projectRef, supabaseUrl, credentialScope };
+}
+function processValues2(env) {
+  return Object.fromEntries(Object.entries(env).filter((entry) => entry[1] !== undefined));
+}
+function hasProcessContext2(env) {
+  return CORE_CONTEXT_KEYS2.some((key) => Object.hasOwn(env, key));
+}
+function completeProjectContext2(values) {
+  const core = sourceProjectCore2(values);
+  if (core.credentialScope === "project_application") {
+    return Boolean(core.supabaseUrl && values.SUPABASE_SERVICE_ROLE_KEY?.trim() && core.projectRef);
+  }
+  return Boolean(core.apiUrl && core.apiToken && core.projectRef);
+}
+function parseInsecureTls2(values) {
+  const value = values.SUPACLOUD_TLS_VERIFY?.trim().toLowerCase();
+  if (value === undefined)
+    return true;
+  if (["1", "true", "yes", "on"].includes(value))
+    return false;
+  if (["0", "false", "no", "off"].includes(value))
+    return true;
+  throw new Error("SUPACLOUD_TLS_VERIFY must be a boolean (true or false)");
+}
+function namedEnvironmentSource2(cwd, selector) {
+  const environment = normalizeEnvironmentName(selector);
+  const path = resolve24(cwd, `.env.supacloud.${selector}`);
+  const values = readEnvFile2(path, true);
+  if (values.SUPACLOUD_ENV && normalizeEnvironmentName(values.SUPACLOUD_ENV) !== environment) {
+    throw new Error(`SUPACLOUD_ENV in ${path} does not match selector ${selector}`);
+  }
+  return { values, kind: "named_env_file", path, environment };
+}
+function explicitEnvironmentSource2(cwd, envFile) {
+  const path = resolve24(cwd, envFile);
+  const values = readEnvFile2(path, true);
+  if (!values.SUPACLOUD_ENV)
+    throw new Error(`SUPACLOUD_ENV is required in ${path}`);
+  return {
+    values,
+    kind: "explicit_env_file",
+    path,
+    environment: normalizeEnvironmentName(values.SUPACLOUD_ENV)
+  };
+}
+function contextSource2(env, cwd, selection) {
+  if (selection.environmentName && selection.envFile)
+    throw new Error("Environment selectors are mutually exclusive");
+  if (selection.environmentName)
+    return namedEnvironmentSource2(cwd, selection.environmentName);
+  if (selection.envFile)
+    return explicitEnvironmentSource2(cwd, selection.envFile);
+  if (env.SUPACLOUD_ENV) {
+    const environment = normalizeEnvironmentName(env.SUPACLOUD_ENV);
+    const values = processValues2(env);
+    if (completeProjectContext2(values)) {
+      return { values, kind: "process_env", path: null, environment };
+    }
+    return namedEnvironmentSource2(cwd, env.SUPACLOUD_ENV);
+  }
+  if (hasProcessContext2(env)) {
+    return { values: processValues2(env), kind: "process_env", path: null, environment: "" };
+  }
+  const path = resolve24(cwd, ".env");
+  const values = readEnvFile2(path, false);
+  const environment = values.SUPACLOUD_ENV ? normalizeEnvironmentName(values.SUPACLOUD_ENV) : "";
+  return { values, kind: Object.keys(values).length ? "legacy_dotenv" : "none", path: existsSync15(path) ? path : null, environment };
+}
+function resolveSupaCloudContext2(env = process.env, cwd = process.cwd(), selection = {}) {
+  const source = contextSource2(env, cwd, selection);
+  const core = sourceProjectCore2(source.values);
+  const host = source.values.SUPACLOUD_HOST || hostFromUrl2(core.apiUrl || core.supabaseUrl);
+  const readOnly = env.SUPACLOUD_READ_ONLY === "true" || source.values.SUPACLOUD_READ_ONLY === "true";
+  const insecureTls = parseInsecureTls2(source.values);
+  return {
+    host,
+    sshUser: env.SUPACLOUD_SSH_USER ?? "root",
+    sshPort: parseInt(env.SUPACLOUD_SSH_PORT ?? "22", 10),
+    sshKey: env.SUPACLOUD_SSH_KEY ?? resolve24(homedir3(), ".ssh", "id_rsa"),
+    sshPass: env.SUPACLOUD_SSH_PASS ?? "",
+    apiUrl: core.apiUrl,
+    apiToken: core.apiToken,
+    projectRef: core.projectRef,
+    readOnly,
+    environment: source.environment,
+    production: source.environment === "prod" || source.environment === "production",
+    inferredSupabaseUrl: core.supabaseUrl,
+    inferredServiceRoleKey: source.values.SUPABASE_SERVICE_ROLE_KEY || "",
+    credentialScope: core.credentialScope,
+    source: source.kind,
+    sourcePath: source.path,
+    environmentVariables: source.values,
+    applicationId: source.values.SUPACLOUD_APPLICATION_ID?.trim() || "",
+    applicationEnvironmentId: source.values.SUPACLOUD_APPLICATION_ENVIRONMENT_ID?.trim() || source.environment,
+    applicationConfigurationPath: source.values.SUPACLOUD_APPLICATION_CONFIGURATION_PATH?.trim() || "",
+    applicationConfigurationId: source.values.SUPACLOUD_APPLICATION_CONFIGURATION_ID?.trim() || "",
+    applicationManifestPath: source.values.SUPACLOUD_APPLICATION_MANIFEST_PATH?.trim() || "",
+    insecureTls
+  };
+}
+
+// src/shared/tools/developer-experience-tools.ts
+var initToolSchema = {
+  root: optional(String2(), "Project directory to initialize (default: current directory)"),
+  format: optional(stringEnum2(["text", "json"]), "Output format (default: text)")
+};
+var environmentToolSchema = {
+  action: withDescription(stringEnum2(["list", "check"]), "Environment profile inspection action"),
+  root: optional(String2(), "Project directory containing .env.supacloud.* files"),
+  format: optional(stringEnum2(["text", "json"]), "Output format (default: text)")
+};
+var TEST_PROFILE = [
+  "SUPACLOUD_ENV=test",
+  "SUPACLOUD_API_URL=https://management.test.example.com",
+  "SUPACLOUD_API_TOKEN=<test-management-api-token>",
+  "SUPACLOUD_PROJECT_REF=<test-project-ref>",
+  "# Optional for executable application delivery: SUPACLOUD_APPLICATION_ID=<application-id>",
+  ""
+].join(`
+`);
+var PRODUCTION_PROFILE = [
+  "SUPACLOUD_ENV=production",
+  "SUPACLOUD_API_URL=https://management.example.com",
+  "SUPACLOUD_API_TOKEN=<production-management-api-token>",
+  "SUPACLOUD_PROJECT_REF=<production-project-ref>",
+  "# Optional for executable application delivery: SUPACLOUD_APPLICATION_ID=<application-id>",
+  ""
+].join(`
+`);
+function textResult3(text, isError = false) {
+  return { isError, content: [{ type: "text", text }] };
+}
+function jsonResult(value, isError = false) {
+  return textResult3(JSON.stringify(value, null, 2), isError);
+}
+function record5(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function packageDependencies(manifest) {
+  return new Set([
+    ...Object.keys(manifest.dependencies ?? {}),
+    ...Object.keys(manifest.devDependencies ?? {})
+  ]);
+}
+function outputDirectoryFor(manifest) {
+  const dependencies = packageDependencies(manifest);
+  if (dependencies.has("next"))
+    return "out";
+  if (dependencies.has("@sveltejs/kit") || dependencies.has("svelte"))
+    return "build";
+  return "dist";
+}
+async function readPackageManifest(root) {
+  const path = join18(root, "package.json");
+  if (!existsSync16(path))
+    return {};
+  try {
+    const parsed = JSON.parse(await readFile6(path, "utf8"));
+    const value = record5(parsed);
+    if (!value)
+      throw new Error("package.json must contain an object");
+    const scripts = record5(value.scripts);
+    const dependencies = record5(value.dependencies);
+    const devDependencies = record5(value.devDependencies);
+    return {
+      scripts: scripts ?? undefined,
+      dependencies: dependencies ?? undefined,
+      devDependencies: devDependencies ?? undefined
+    };
+  } catch (error) {
+    throw new Error(`Invalid package.json: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function writeNewFile(path, content) {
+  try {
+    await writeFile6(path, content, { encoding: "utf8", flag: "wx", mode: 384 });
+    return true;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "EEXIST")
+      return false;
+    throw error;
+  }
+}
+async function ensureGitignore(root) {
+  const path = join18(root, ".gitignore");
+  const existing = existsSync16(path) ? await readFile6(path, "utf8") : "";
+  const required = [".env.supacloud.*", "!.env.supacloud.*.example"];
+  const missing = required.filter((entry) => !existing.split(/\r?\n/).includes(entry));
+  if (missing.length === 0)
+    return false;
+  const prefix = existing.length > 0 && !existing.endsWith(`
+`) ? `${existing}
+` : existing;
+  await writeFile6(path, `${prefix}${missing.join(`
+`)}
+`, "utf8");
+  return true;
+}
+async function initializeProject(request, options = {}) {
+  const root = resolve25(request.root || options.cwd || process.cwd());
+  await mkdir7(root, { recursive: true });
+  const configPath = join18(root, "supacloud.json");
+  if (existsSync16(configPath)) {
+    throw new Error(`supacloud.json already exists in ${root}; init never overwrites project configuration`);
+  }
+  const manifest = await readPackageManifest(root);
+  const hasBuildScript = typeof manifest.scripts?.build === "string" && Boolean(manifest.scripts.build.trim());
+  const outputDirectory = outputDirectoryFor(manifest);
+  const config = {
+    frontend: {
+      root: ".",
+      outputDirectory
+    }
+  };
+  const created = [];
+  try {
+    await writeFile6(configPath, `${JSON.stringify(config, null, 2)}
+`, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: 420
+    });
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "EEXIST") {
+      throw new Error(`supacloud.json already exists in ${root}; init never overwrites project configuration`);
+    }
+    throw error;
+  }
+  created.push("supacloud.json");
+  if (await writeNewFile(join18(root, ".env.supacloud.test.example"), TEST_PROFILE)) {
+    created.push(".env.supacloud.test.example");
+  }
+  if (await writeNewFile(join18(root, ".env.supacloud.production.example"), PRODUCTION_PROFILE)) {
+    created.push(".env.supacloud.production.example");
+  }
+  if (await ensureGitignore(root))
+    created.push(".gitignore");
+  const result = {
+    schema: "supacloud.developer-experience.init.v1",
+    ok: true,
+    root,
+    created,
+    detected: {
+      package_json: existsSync16(join18(root, "package.json")),
+      build_script: hasBuildScript,
+      output_directory: outputDirectory
+    },
+    next: [
+      "cp .env.supacloud.test.example .env.supacloud.test",
+      "Configure frontend assets; set SUPACLOUD_APPLICATION_ID only for executable application delivery.",
+      "supacloud env check",
+      "supacloud --env test deploy"
+    ]
+  };
+  if (request.format === "json")
+    return jsonResult(result);
+  return textResult3([
+    `Initialized SupaCloud deployment in ${root}.`,
+    `Created: ${created.join(", ")}.`,
+    hasBuildScript ? `Detected package.json build script; deploy output defaults to ${outputDirectory}.` : "No package.json build script detected; add one before deploying.",
+    "",
+    ...result.next
+  ].join(`
+`));
+}
+
 // src/shared/tools/deploy-tools.ts
 var MAX_SOURCE_BYTES = 256 * 1024 * 1024;
 var PUBLIC_BUILD_ENV_PREFIXES = ["PUBLIC_", "VITE_", "NEXT_PUBLIC_", "NUXT_PUBLIC_", "ASTRO_PUBLIC_"];
@@ -32213,18 +32528,21 @@ function isPublicBuildEnv(name) {
   return PUBLIC_BUILD_ENV_PREFIXES.some((prefix) => name.startsWith(prefix));
 }
 function isProtectedBuildEnv(name) {
-  return name.startsWith("SUPACLOUD_") || name === "SUPABASE_SERVICE_ROLE_KEY" || name === "SUPABASE_ACCESS_TOKEN" || name === "MANAGEMENT_API_URL" || name === "MANAGEMENT_API_TOKEN";
+  return name.startsWith("SUPACLOUD_") || name === "SUPABASE_SERVICE_ROLE_KEY" || name === "SUPABASE_ACCESS_TOKEN" || name === "MANAGEMENT_API_TOKEN";
 }
 var deployToolSchema = {
+  action: optional(stringEnum2(["init"]), "[init] Create local deployment configuration and environment examples"),
+  ...initToolSchema,
+  root: optional(String2(), "[init] Project directory to initialize (default: current directory)"),
   ref: optional(String2(), "Project ref (defaults to the linked project)"),
   cwd: optional(String2(), "Project directory (default: current directory)"),
   skip_build: optional(Boolean2(), "Use an existing output directory without building"),
   assets_only: optional(Boolean2(), "Publish only configured static assets; leave backend Functions, schedules and migrations unchanged"),
   backend: optional(Boolean2(), "Publish the application backend independently; do not build or activate frontend assets"),
   status: optional(String2({ format: "uuid" }), "Read a backend deployment status without publishing"),
-  json: optional(Boolean2(), "Print only the final JSON result")
+  format: optional(stringEnum2(["text", "json"]), "Output format (default: text)")
 };
-function record5(candidate) {
+function record6(candidate) {
   return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
 }
 function requiredString(candidate, field) {
@@ -32234,7 +32552,7 @@ function requiredString(candidate, field) {
   return candidate.trim();
 }
 function frontendDeployment(candidate) {
-  const value = record5(candidate);
+  const value = record6(candidate);
   if (!value)
     throw new Error("Invalid frontend deployment response");
   return {
@@ -32248,7 +32566,7 @@ function frontendDeployment(candidate) {
 }
 async function readJson(path) {
   try {
-    return JSON.parse(await readFile6(path, "utf8"));
+    return JSON.parse(await readFile7(path, "utf8"));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
       return null;
@@ -32256,15 +32574,15 @@ async function readJson(path) {
   }
 }
 async function findDeployConfigRoot(startDirectory, environmentName) {
-  let directory = resolve24(startDirectory);
+  let directory = resolve26(startDirectory);
   while (true) {
     const environmentFile = environmentName ? `.env.supacloud.${environmentName}` : null;
-    if (await pathExists(join18(directory, "supacloud.json")) || await pathExists(join18(directory, "supacloud.config.ts")) || environmentFile !== null && await pathExists(join18(directory, environmentFile))) {
+    if (await pathExists(join19(directory, "supacloud.json")) || await pathExists(join19(directory, "supacloud.config.ts")) || environmentFile !== null && await pathExists(join19(directory, environmentFile))) {
       return directory;
     }
-    const parent = dirname13(directory);
+    const parent = dirname14(directory);
     if (parent === directory)
-      return resolve24(startDirectory);
+      return resolve26(startDirectory);
     directory = parent;
   }
 }
@@ -32304,7 +32622,7 @@ function optionalStringArray(value, field) {
   });
 }
 function deployTargetConfig(candidate, name) {
-  const value = record5(candidate);
+  const value = record6(candidate);
   if (!value || value.type !== "frontend" && value.type !== "edge_function") {
     throw new Error(`supacloud.json targets.${name}.type must be 'frontend' or 'edge_function'`);
   }
@@ -32329,14 +32647,14 @@ function deployTargetConfig(candidate, name) {
   };
 }
 async function readDeployConfig(configRoot) {
-  const configPath = join18(configRoot, "supacloud.json");
+  const configPath = join19(configRoot, "supacloud.json");
   const candidate = await readJson(configPath);
   if (candidate === null)
     return {};
-  const config = record5(candidate);
-  const frontend = record5(config?.frontend);
-  const application = record5(config?.application);
-  const targetValues = record5(config?.targets);
+  const config = record6(candidate);
+  const frontend = record6(config?.frontend);
+  const application = record6(config?.application);
+  const targetValues = record6(config?.targets);
   if (!config || config.frontend !== undefined && !frontend || config.application !== undefined && !application || config.targets !== undefined && !targetValues) {
     throw new Error("supacloud.json must contain object-valued 'application', 'frontend' or 'targets' configuration");
   }
@@ -32376,16 +32694,16 @@ async function readDeployConfig(configRoot) {
   };
 }
 async function packageName(projectDirectory) {
-  const candidate = record5(await readJson(join18(projectDirectory, "package.json")));
+  const candidate = record6(await readJson(join19(projectDirectory, "package.json")));
   return typeof candidate?.name === "string" && candidate.name.trim() ? candidate.name.trim() : null;
 }
 async function pathExists(path) {
   return access(path).then(() => true, () => false);
 }
 async function hasProjectReleaseManifest(root) {
-  if (await pathExists(join18(root, "deploy-manifest.json")))
+  if (await pathExists(join19(root, "deploy-manifest.json")))
     return true;
-  const directory = await opendir(join18(root, "supacloud")).catch((error) => {
+  const directory = await opendir(join19(root, "supacloud")).catch((error) => {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
       return null;
     throw error;
@@ -32396,28 +32714,28 @@ async function hasProjectReleaseManifest(root) {
   for await (const entry of directory) {
     if (++entries > 128)
       throw new Error("Too many SupaCloud project roots to resolve a deployment");
-    if ((entry.isDirectory() || entry.isSymbolicLink()) && await pathExists(join18(root, "supacloud", entry.name, "deploy-manifest.json")))
+    if ((entry.isDirectory() || entry.isSymbolicLink()) && await pathExists(join19(root, "supacloud", entry.name, "deploy-manifest.json")))
       return true;
   }
   return false;
 }
 async function defaultBuildCommand(projectDirectory, configRoot) {
-  const packageJson = record5(await readJson(join18(projectDirectory, "package.json")));
-  const scripts = record5(packageJson?.scripts);
+  const packageJson = record6(await readJson(join19(projectDirectory, "package.json")));
+  const scripts = record6(packageJson?.scripts);
   if (typeof scripts?.build !== "string" || !scripts.build.trim()) {
     throw new Error("No build command was configured and package.json has no build script");
   }
   let directory = projectDirectory;
   while (true) {
-    if (await pathExists(join18(directory, "bun.lock")) || await pathExists(join18(directory, "bun.lockb")))
+    if (await pathExists(join19(directory, "bun.lock")) || await pathExists(join19(directory, "bun.lockb")))
       return "bun run build";
-    if (await pathExists(join18(directory, "pnpm-lock.yaml")))
+    if (await pathExists(join19(directory, "pnpm-lock.yaml")))
       return "pnpm run build";
-    if (await pathExists(join18(directory, "yarn.lock")))
+    if (await pathExists(join19(directory, "yarn.lock")))
       return "yarn build";
     if (directory === configRoot)
       break;
-    const parent = dirname13(directory);
+    const parent = dirname14(directory);
     if (parent === directory || !directory.startsWith(`${configRoot}${sep5}`))
       break;
     directory = parent;
@@ -32425,7 +32743,7 @@ async function defaultBuildCommand(projectDirectory, configRoot) {
   return "npm run build";
 }
 function deploymentList(candidate) {
-  const values = Array.isArray(candidate) ? candidate : Array.isArray(record5(candidate)?.deployments) ? record5(candidate)?.deployments : null;
+  const values = Array.isArray(candidate) ? candidate : Array.isArray(record6(candidate)?.deployments) ? record6(candidate)?.deployments : null;
   if (!values)
     throw new Error("Invalid frontend deployment list response");
   return values.map(frontendDeployment);
@@ -32485,9 +32803,9 @@ function selectFrontendTarget(configRoot, config) {
   throw new Error(`Multiple frontend deploy targets found (${targets.map(([name]) => name).sort().join(", ")}). Set defaultTarget to the Web target`);
 }
 function targetRoot(configRoot, target, name) {
-  const root = resolve24(configRoot, target.root || (name === "frontend" ? "." : name));
-  const prefix = `${resolve24(configRoot)}${sep5}`;
-  if (root !== resolve24(configRoot) && !root.startsWith(prefix)) {
+  const root = resolve26(configRoot, target.root || (name === "frontend" ? "." : name));
+  const prefix = `${resolve26(configRoot)}${sep5}`;
+  if (root !== resolve26(configRoot) && !root.startsWith(prefix)) {
     throw new Error(`Deploy target '${name}' root must stay inside the repository root`);
   }
   return root;
@@ -32505,8 +32823,8 @@ function defaultOutputDirectory(framework) {
   }
 }
 function resolveInsideProject(projectDirectory, candidate, allowRoot = false) {
-  const resolved = resolve24(projectDirectory, candidate);
-  const projectRoot = resolve24(projectDirectory);
+  const resolved = resolve26(projectDirectory, candidate);
+  const projectRoot = resolve26(projectDirectory);
   const projectPrefix = `${projectRoot}${sep5}`;
   if (!allowRoot && resolved === projectRoot || resolved !== projectRoot && !resolved.startsWith(projectPrefix)) {
     throw new Error("Frontend output directory must stay inside the project directory");
@@ -32560,7 +32878,7 @@ async function collectArchiveFiles(root) {
       entries.push(entry);
     entries.sort((left, right) => left.name.localeCompare(right.name, "en"));
     for (const entry of entries) {
-      const path = join18(directory, entry.name);
+      const path = join19(directory, entry.name);
       const stats = await lstat5(path);
       if (stats.isSymbolicLink())
         throw new Error(`Frontend output cannot contain symbolic links: ${path}`);
@@ -32579,7 +32897,7 @@ async function collectArchiveFiles(root) {
   const files = new Map;
   const digests = [];
   for (const path of paths) {
-    const data = new Uint8Array(await readFile6(path));
+    const data = new Uint8Array(await readFile7(path));
     bytes += data.byteLength;
     if (bytes > MAX_SOURCE_BYTES)
       throw new Error(`Frontend output exceeds ${MAX_SOURCE_BYTES} bytes`);
@@ -32598,11 +32916,11 @@ async function collectArchiveFiles(root) {
   return { files, bytes, count: paths.length, treeSha256: tree.digest("hex") };
 }
 async function createCollectedFrontendArchive(outputDirectory, collected) {
-  const temporaryDirectory = await mkdtemp2(join18(tmpdir3(), "supacloud-deploy-"));
-  const archivePath = join18(temporaryDirectory, `${basename8(outputDirectory)}.tar.zst`);
+  const temporaryDirectory = await mkdtemp2(join19(tmpdir3(), "supacloud-deploy-"));
+  const archivePath = join19(temporaryDirectory, `${basename8(outputDirectory)}.tar.zst`);
   try {
     const archiveBytes = await createFrontendTarZstd(collected.files);
-    await writeFile6(archivePath, archiveBytes);
+    await writeFile7(archivePath, archiveBytes);
     const sha256 = createHash11("sha256").update(archiveBytes).digest("hex");
     return {
       archivePath,
@@ -32647,7 +32965,13 @@ async function publishConfiguredFrontend(http, projectRef, configRoot, skipBuild
 }
 function registerDeployTools(server, http, options = {}) {
   registerTool(server, "deploy", "Build and publish the linked project with one command", deployToolSchema, async (args) => {
-    const invocationDirectory = resolve24(String(args.cwd || options.cwd || process.cwd()));
+    const invocationDirectory = resolve26(String(args.cwd || options.cwd || process.cwd()));
+    if (args.action === "init") {
+      return initializeProject({
+        ...typeof args.root === "string" ? { root: args.root } : {},
+        ...args.format === "json" ? { format: "json" } : {}
+      }, { cwd: invocationDirectory });
+    }
     const projectRef = String(args.ref || options.projectRef || "").trim();
     if (!projectRef)
       throw new Error("A linked project ref is required. Set SUPACLOUD_PROJECT_REF or pass --ref");
@@ -32678,7 +33002,7 @@ function registerDeployTools(server, http, options = {}) {
         throw new Error("Static asset deployment requires SUPACLOUD_ENV");
       }
       await requireProjectDeploymentProtocol(http, projectRef, environmentId);
-      const result = await publishConfiguredFrontend(http, projectRef, configRoot, args.skip_build === true, args.json === true, options.environmentVariables);
+      const result = await publishConfiguredFrontend(http, projectRef, configRoot, args.skip_build === true, args.format === "json", options.environmentVariables);
       if (!result)
         throw new Error("Static asset deployment did not produce a receipt");
       return result;
@@ -32713,7 +33037,7 @@ function registerDeployTools(server, http, options = {}) {
         ...configurationId ? { configuration_id: configurationId } : {},
         ...application.manifestPath ? { manifest_path: application.manifestPath } : {},
         ...args.skip_build === true ? { skip_build: true } : {},
-        ...args.json === true ? { format: "json", json: true } : {}
+        ...args.format === "json" ? { format: "json" } : {}
       });
       return result;
     }
@@ -32722,11 +33046,11 @@ function registerDeployTools(server, http, options = {}) {
 }
 
 // src/shared/tools/remote-dev-tools.ts
-import { existsSync as existsSync15 } from "node:fs";
-import { readFile as readFile7 } from "node:fs/promises";
-import { readdir as readdir7 } from "node:fs/promises";
+import { existsSync as existsSync17 } from "node:fs";
+import { readFile as readFile8 } from "node:fs/promises";
+import { readdir as readdir8 } from "node:fs/promises";
 import { createHash as createHash12 } from "node:crypto";
-import { join as join19, resolve as resolve25 } from "node:path";
+import { join as join20, resolve as resolve27 } from "node:path";
 import { compileProject as compileProject2 } from "@supacloud/compiler";
 var SAFE_TOKEN = /^[A-Za-z0-9._:@/+,-]+$/;
 var SAFE_REMOTE_ROOT = /^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+\/?$/;
@@ -32743,7 +33067,6 @@ var remoteDevToolSchema = {
   delete: optional(Boolean2(), "Delete remote files absent locally"),
   reload: optional(Boolean2(), "Reload the affected target after sync (default: true)"),
   interval_ms: optional(Number2(), "Watch debounce interval in milliseconds (default: 300)"),
-  json: optional(Boolean2(), "Emit machine-readable JSON"),
   apply: optional(Boolean2(), "Apply generated migrations to the selected test database"),
   drizzle_config: optional(String2(), "Drizzle config path"),
   migrations_dir: optional(String2(), "Migration directory"),
@@ -32761,8 +33084,8 @@ async function runProcess(executable, args, cwd) {
 function resolveDrizzleCommand(root, configured) {
   if (configured?.trim())
     return configured.trim();
-  const local = join19(root, "node_modules", ".bin", "drizzle-kit");
-  return existsSync15(local) ? local : "drizzle-kit";
+  const local = join20(root, "node_modules", ".bin", "drizzle-kit");
+  return existsSync17(local) ? local : "drizzle-kit";
 }
 function toolFailed(value) {
   if (!value || typeof value !== "object")
@@ -32772,14 +33095,14 @@ function toolFailed(value) {
   return result.isError === true || content.some((chunk) => chunk !== null && typeof chunk === "object" && ("text" in chunk) && typeof chunk.text === "string" && chunk.text.trimStart().startsWith("❌"));
 }
 async function migrateDatabase(args, options) {
-  const root = resolve25(String(args.project_dir || options.cwd || process.cwd()));
+  const root = resolve27(String(args.project_dir || options.cwd || process.cwd()));
   const projectConfig = await readProjectConfig(root);
   const config = projectConfig.dev || {};
   const database = config.database || {};
   const execute = options.execute || ((command, commandArgs, cwd) => runProcess(command, commandArgs, cwd));
-  const drizzleConfig = resolve25(root, String(args.drizzle_config || database.drizzleConfig || "drizzle.config.ts"));
+  const drizzleConfig = resolve27(root, String(args.drizzle_config || database.drizzleConfig || "drizzle.config.ts"));
   const migrationsDir = String(args.migrations_dir || database.migrationsDir || "supabase/migrations");
-  if (!existsSync15(drizzleConfig))
+  if (!existsSync17(drizzleConfig))
     throw new Error(`Drizzle config not found: ${drizzleConfig}`);
   const generated = await execute(resolveDrizzleCommand(root, typeof args.drizzle_bin === "string" ? args.drizzle_bin : database.drizzleBin), ["generate", "--config", drizzleConfig], root);
   if (generated.exitCode !== 0)
@@ -32797,11 +33120,11 @@ async function migrateDatabase(args, options) {
   return { ok: true, mode: "dev", action: "migrate", generated: true, applied: true, migrations_dir: migrationsDir, result: applied };
 }
 async function readProjectConfig(root) {
-  const file = join19(root, "supacloud.json");
-  if (!existsSync15(file))
+  const file = join20(root, "supacloud.json");
+  if (!existsSync17(file))
     return {};
   try {
-    const parsed = JSON.parse(await readFile7(file, "utf8"));
+    const parsed = JSON.parse(await readFile8(file, "utf8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch (error) {
     throw new Error(`Invalid supacloud.json: ${error instanceof Error ? error.message : String(error)}`);
@@ -32814,9 +33137,9 @@ async function readDevConfig(root) {
 async function sourceFingerprint(root) {
   const files = [];
   const visit = async (directory) => {
-    const entries = await readdir7(directory, { withFileTypes: true });
+    const entries = await readdir8(directory, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-      const path = join19(directory, entry.name);
+      const path = join20(directory, entry.name);
       if (entry.isDirectory() && ![".git", "node_modules", "dist", "generated", ".supacloud"].includes(entry.name))
         await visit(path);
       else if (entry.isFile())
@@ -32827,7 +33150,7 @@ async function sourceFingerprint(root) {
   const hash = createHash12("sha256");
   for (const file of files) {
     hash.update(file.slice(root.length).replace(/\\/g, "/"));
-    hash.update(await readFile7(file));
+    hash.update(await readFile8(file));
   }
   return hash.digest("hex");
 }
@@ -32844,19 +33167,19 @@ function remoteRoot(value) {
 }
 function targetDirectory(root, target, functionSlug, config = {}) {
   if (target === "db")
-    return join19(root, "supabase", "migrations");
+    return join20(root, "supabase", "migrations");
   if (target === "functions") {
     const targets = config["targets"];
     const entries = targets && typeof targets === "object" ? Object.values(targets) : [];
     const match = entries.find((entry) => entry !== null && typeof entry === "object" && ("type" in entry) && entry.type === "edge_function" && (!("root" in entry) || typeof entry.root === "string") && (!("slug" in entry) || typeof entry.slug === "string") && (!functionSlug || ("slug" in entry) && entry.slug === functionSlug));
-    const base = match?.root ? resolve25(root, match.root) : join19(root, "supabase", "functions");
-    return match?.root ? base : functionSlug ? join19(base, safeToken(functionSlug, "function")) : base;
+    const base = match?.root ? resolve27(root, match.root) : join20(root, "supabase", "functions");
+    return match?.root ? base : functionSlug ? join20(base, safeToken(functionSlug, "function")) : base;
   }
   if (target === "frontend") {
     const targets = config["targets"];
     const entries = targets && typeof targets === "object" ? Object.values(targets) : [];
     const match = entries.find((entry) => entry !== null && typeof entry === "object" && ("type" in entry) && entry.type === "frontend" && (!("root" in entry) || typeof entry.root === "string"));
-    return match?.root ? resolve25(root, match.root) : join19(root, "apps", "web");
+    return match?.root ? resolve27(root, match.root) : join20(root, "apps", "web");
   }
   return root;
 }
@@ -32895,10 +33218,10 @@ function reloadCommand(config, target, projectRef, functionSlug) {
   return [...command.split(" "), "--project-ref", safeToken(projectRef || "test", "project_ref"), "--target", targetConfigPath(target), ...functionSlug ? ["--function", safeToken(functionSlug, "function")] : []];
 }
 function sshArgs(connection, remoteCommand) {
-  return ["-p", String(connection.port), "-i", resolve25(connection.key), "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=yes", `${connection.user}@${connection.host}`, ...remoteCommand];
+  return ["-p", String(connection.port), "-i", resolve27(connection.key), "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=yes", `${connection.user}@${connection.host}`, ...remoteCommand];
 }
 function rsyncArgs(connection, source, destination, excludes, deleteRemote) {
-  const args = ["-az", "--checksum", "--partial", "--protect-args", "-e", `ssh -p ${connection.port} -i ${resolve25(connection.key)} -o BatchMode=yes -o StrictHostKeyChecking=yes`];
+  const args = ["-az", "--checksum", "--partial", "--protect-args", "-e", `ssh -p ${connection.port} -i ${resolve27(connection.key)} -o BatchMode=yes -o StrictHostKeyChecking=yes`];
   if (deleteRemote)
     args.push("--delete-delay");
   for (const exclude of excludes) {
@@ -32910,17 +33233,17 @@ function rsyncArgs(connection, source, destination, excludes, deleteRemote) {
   return args;
 }
 async function syncOnce(args, options) {
-  const root = resolve25(String(args.project_dir || options.cwd || process.cwd()));
+  const root = resolve27(String(args.project_dir || options.cwd || process.cwd()));
   const projectConfig = await readProjectConfig(root);
   const config = projectConfig.dev || {};
   const target = String(args.target || "project");
   const source = targetDirectory(root, target, typeof args.function === "string" ? args.function : undefined, projectConfig);
-  if (!existsSync15(source))
+  if (!existsSync17(source))
     throw new Error(`Dev source directory not found: ${source}`);
   let compiled = false;
   if (config.compile === true && target !== "db") {
-    const compileRoot = resolve25(root, config.compileRoot || ".");
-    const compileOutDir = resolve25(root, config.compileOutDir || "generated");
+    const compileRoot = resolve27(root, config.compileRoot || ".");
+    const compileOutDir = resolve27(root, config.compileOutDir || "generated");
     const compilation = await compileProject2({
       rootDir: compileRoot,
       outDir: compileOutDir,
@@ -32958,7 +33281,7 @@ function registerRemoteDevTools(server, options = {}) {
     if (["production", "prod"].includes((options.environment || "").toLowerCase()))
       throw new Error("Remote dev mode is forbidden for production environments");
     if (args.action === "status") {
-      const root = resolve25(String(args.project_dir || options.cwd || process.cwd()));
+      const root = resolve27(String(args.project_dir || options.cwd || process.cwd()));
       const config = await readDevConfig(root);
       const connection = connectionArgs(options, config, args);
       const execute = options.execute || ((command, commandArgs, cwd) => runProcess(command, commandArgs, cwd));
@@ -32972,7 +33295,7 @@ function registerRemoteDevTools(server, options = {}) {
       return { content: [{ type: "text", text: JSON.stringify(await migrateDatabase(args, options), null, 2) }] };
     }
     if (args.action === "watch") {
-      const root = resolve25(String(args.project_dir || options.cwd || process.cwd()));
+      const root = resolve27(String(args.project_dir || options.cwd || process.cwd()));
       const interval = Math.max(100, Math.min(1e4, Number(args.interval_ms || 300)));
       let fingerprint = "";
       let lastSync = null;
@@ -32992,215 +33315,19 @@ function registerRemoteDevTools(server, options = {}) {
 }
 
 // src/shared/tools/developer-experience-tools.ts
-import { existsSync as existsSync17 } from "node:fs";
-import { mkdir as mkdir7, readdir as readdir8, readFile as readFile8, writeFile as writeFile7 } from "node:fs/promises";
-import { dirname as dirname14, join as join20, resolve as resolve27 } from "node:path";
-
-// src/shared/context.ts
-import { existsSync as existsSync16, readFileSync as readFileSync12 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { resolve as resolve26 } from "node:path";
-var CORE_CONTEXT_KEYS2 = [
-  "SUPABASE_URL",
-  "SUPABASE_SERVICE_ROLE_KEY",
-  "SUPACLOUD_API_URL",
-  "SUPACLOUD_MANAGEMENT_API_URL",
-  "MANAGEMENT_API_URL",
-  "SUPACLOUD_API_TOKEN",
-  "SUPACLOUD_PROJECT_REF",
-  "X_PROJECT_REF",
-  "SUPACLOUD_HOST",
-  "SUPACLOUD_APPLICATION_ID",
-  "SUPACLOUD_APPLICATION_ENVIRONMENT_ID",
-  "SUPACLOUD_APPLICATION_CONFIGURATION_PATH",
-  "SUPACLOUD_APPLICATION_CONFIGURATION_ID",
-  "SUPACLOUD_APPLICATION_MANIFEST_PATH"
-];
-function unquotedEnvValue2(rawValue) {
-  const value = rawValue.trim();
-  const quote = value[0];
-  return quote && (quote === '"' || quote === "'") && value.endsWith(quote) ? value.slice(1, -1) : value;
-}
-function parseEnvFile2(contents) {
-  const values = {};
-  for (const rawLine of contents.split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#"))
-      continue;
-    const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
-    if (!match)
-      continue;
-    values[match[1]] = unquotedEnvValue2(match[2]);
-  }
-  return values;
-}
-function readEnvFile2(path, required) {
-  if (!existsSync16(path)) {
-    if (required)
-      throw new Error(`SupaCloud environment file not found: ${path}`);
-    return {};
-  }
-  try {
-    return parseEnvFile2(readFileSync12(path, "utf8"));
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`Failed to read SupaCloud environment file ${path}: ${message}`);
-  }
-}
-function canonicalApiOrigin2(value) {
-  const candidate = value.trim();
-  if (!candidate)
-    return "";
-  try {
-    const url = new URL(candidate);
-    const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
-    const allowedProtocol = url.protocol === "https:" || url.protocol === "http:" && loopback;
-    const exactOrigin = candidate === url.origin || candidate === `${url.origin}/`;
-    return allowedProtocol && !url.username && !url.password && exactOrigin && url.pathname === "/" && !url.search && !url.hash ? url.origin : "";
-  } catch (error) {
-    if (error instanceof TypeError)
-      return "";
-    throw error;
-  }
-}
-function hostFromUrl2(value) {
-  return value ? new URL(value).hostname : "";
-}
-function inferProjectRefFromSupabaseUrl2(value) {
-  if (!value)
-    return "";
-  return new URL(value).hostname.match(/^([a-z0-9-]+)\.api\./i)?.[1] ?? "";
-}
-function sourceCredentialScope2(values, explicitApiUrl, supabaseUrl) {
-  const hasManagementContext = Boolean(explicitApiUrl.trim() || values.SUPACLOUD_API_TOKEN?.trim() || values.SUPACLOUD_HOST?.trim());
-  if (hasManagementContext)
-    return "management";
-  return supabaseUrl || values.SUPABASE_SERVICE_ROLE_KEY?.trim() ? "project_application" : "incomplete";
-}
-function sourceProjectCore2(values) {
-  const supabaseUrl = canonicalApiOrigin2(values.SUPABASE_URL || "");
-  const projectRef = (values.SUPACLOUD_PROJECT_REF || values.X_PROJECT_REF || "").trim() || inferProjectRefFromSupabaseUrl2(supabaseUrl);
-  const explicitApiUrl = values.SUPACLOUD_API_URL || values.SUPACLOUD_MANAGEMENT_API_URL || values.MANAGEMENT_API_URL || "";
-  const credentialScope = sourceCredentialScope2(values, explicitApiUrl, supabaseUrl);
-  const managementUrl = explicitApiUrl || (values.SUPACLOUD_HOST ? `http://${values.SUPACLOUD_HOST}:9090` : "");
-  const apiUrl = credentialScope === "management" ? canonicalApiOrigin2(managementUrl) : "";
-  const apiToken = credentialScope === "management" ? values.SUPACLOUD_API_TOKEN || "" : "";
-  return { apiUrl, apiToken, projectRef, supabaseUrl, credentialScope };
-}
-function processValues2(env) {
-  return Object.fromEntries(Object.entries(env).filter((entry) => entry[1] !== undefined));
-}
-function hasProcessContext2(env) {
-  return CORE_CONTEXT_KEYS2.some((key) => Object.hasOwn(env, key));
-}
-function completeProjectContext2(values) {
-  const core = sourceProjectCore2(values);
-  if (core.credentialScope === "project_application") {
-    return Boolean(core.supabaseUrl && values.SUPABASE_SERVICE_ROLE_KEY?.trim() && core.projectRef);
-  }
-  return Boolean(core.apiUrl && core.apiToken && core.projectRef);
-}
-function parseInsecureTls2(values) {
-  for (const key of ["SUPACLOUD_TLS_VERIFY", "SUPACLOUD_TLS_INSECURE"]) {
-    const value = values[key]?.trim().toLowerCase();
-    if (value === undefined)
-      continue;
-    if (["1", "true", "yes", "on"].includes(value))
-      return key === "SUPACLOUD_TLS_INSECURE";
-    if (["0", "false", "no", "off"].includes(value))
-      return key === "SUPACLOUD_TLS_VERIFY";
-    throw new Error(`${key} must be a boolean (true or false)`);
-  }
-  return true;
-}
-function namedEnvironmentSource2(cwd, selector) {
-  const environment = normalizeEnvironmentName(selector);
-  const path = resolve26(cwd, `.env.supacloud.${selector}`);
-  const values = readEnvFile2(path, true);
-  if (values.SUPACLOUD_ENV && normalizeEnvironmentName(values.SUPACLOUD_ENV) !== environment) {
-    throw new Error(`SUPACLOUD_ENV in ${path} does not match selector ${selector}`);
-  }
-  return { values, kind: "named_env_file", path, environment };
-}
-function explicitEnvironmentSource2(cwd, envFile) {
-  const path = resolve26(cwd, envFile);
-  const values = readEnvFile2(path, true);
-  if (!values.SUPACLOUD_ENV)
-    throw new Error(`SUPACLOUD_ENV is required in ${path}`);
-  return {
-    values,
-    kind: "explicit_env_file",
-    path,
-    environment: normalizeEnvironmentName(values.SUPACLOUD_ENV)
-  };
-}
-function contextSource2(env, cwd, selection) {
-  if (selection.environmentName && selection.envFile)
-    throw new Error("Environment selectors are mutually exclusive");
-  if (selection.environmentName)
-    return namedEnvironmentSource2(cwd, selection.environmentName);
-  if (selection.envFile)
-    return explicitEnvironmentSource2(cwd, selection.envFile);
-  if (env.SUPACLOUD_ENV) {
-    const environment = normalizeEnvironmentName(env.SUPACLOUD_ENV);
-    const values = processValues2(env);
-    if (completeProjectContext2(values)) {
-      return { values, kind: "process_env", path: null, environment };
-    }
-    return namedEnvironmentSource2(cwd, env.SUPACLOUD_ENV);
-  }
-  if (hasProcessContext2(env)) {
-    return { values: processValues2(env), kind: "process_env", path: null, environment: "" };
-  }
-  const path = resolve26(cwd, ".env");
-  const values = readEnvFile2(path, false);
-  const environment = values.SUPACLOUD_ENV ? normalizeEnvironmentName(values.SUPACLOUD_ENV) : "";
-  return { values, kind: Object.keys(values).length ? "legacy_dotenv" : "none", path: existsSync16(path) ? path : null, environment };
-}
-function resolveSupaCloudContext2(env = process.env, cwd = process.cwd(), selection = {}) {
-  const source = contextSource2(env, cwd, selection);
-  const core = sourceProjectCore2(source.values);
-  const host = source.values.SUPACLOUD_HOST || hostFromUrl2(core.apiUrl || core.supabaseUrl);
-  const readOnly = env.SUPACLOUD_READ_ONLY === "true" || source.values.SUPACLOUD_READ_ONLY === "true";
-  const insecureTls = parseInsecureTls2(source.values);
-  return {
-    host,
-    sshUser: env.SUPACLOUD_SSH_USER ?? "root",
-    sshPort: parseInt(env.SUPACLOUD_SSH_PORT ?? "22", 10),
-    sshKey: env.SUPACLOUD_SSH_KEY ?? resolve26(homedir3(), ".ssh", "id_rsa"),
-    sshPass: env.SUPACLOUD_SSH_PASS ?? "",
-    apiUrl: core.apiUrl,
-    apiToken: core.apiToken,
-    projectRef: core.projectRef,
-    readOnly,
-    environment: source.environment,
-    production: source.environment === "prod" || source.environment === "production",
-    inferredSupabaseUrl: core.supabaseUrl,
-    inferredServiceRoleKey: source.values.SUPABASE_SERVICE_ROLE_KEY || "",
-    credentialScope: core.credentialScope,
-    source: source.kind,
-    sourcePath: source.path,
-    environmentVariables: source.values,
-    applicationId: source.values.SUPACLOUD_APPLICATION_ID?.trim() || "",
-    applicationEnvironmentId: source.values.SUPACLOUD_APPLICATION_ENVIRONMENT_ID?.trim() || source.environment,
-    applicationConfigurationPath: source.values.SUPACLOUD_APPLICATION_CONFIGURATION_PATH?.trim() || "",
-    applicationConfigurationId: source.values.SUPACLOUD_APPLICATION_CONFIGURATION_ID?.trim() || "",
-    applicationManifestPath: source.values.SUPACLOUD_APPLICATION_MANIFEST_PATH?.trim() || "",
-    insecureTls
-  };
-}
-
-// src/shared/tools/developer-experience-tools.ts
-var initToolSchema = {
+import { existsSync as existsSync18 } from "node:fs";
+import { mkdir as mkdir8, readdir as readdir9, readFile as readFile9, writeFile as writeFile8 } from "node:fs/promises";
+import { dirname as dirname15, join as join21, resolve as resolve28 } from "node:path";
+var initToolSchema2 = {
   root: optional(String2(), "Project directory to initialize (default: current directory)"),
-  json: optional(Boolean2(), "Emit one machine-readable JSON result")
+  format: optional(stringEnum2(["text", "json"]), "Output format (default: text)")
 };
-var environmentToolSchema = {
+var environmentToolSchema2 = {
   action: withDescription(stringEnum2(["list", "check"]), "Environment profile inspection action"),
   root: optional(String2(), "Project directory containing .env.supacloud.* files"),
-  json: optional(Boolean2(), "Emit one machine-readable JSON result")
+  format: optional(stringEnum2(["text", "json"]), "Output format (default: text)")
 };
-var TEST_PROFILE = [
+var TEST_PROFILE2 = [
   "SUPACLOUD_ENV=test",
   "SUPACLOUD_API_URL=https://management.test.example.com",
   "SUPACLOUD_API_TOKEN=<test-management-api-token>",
@@ -33209,7 +33336,7 @@ var TEST_PROFILE = [
   ""
 ].join(`
 `);
-var PRODUCTION_PROFILE = [
+var PRODUCTION_PROFILE2 = [
   "SUPACLOUD_ENV=production",
   "SUPACLOUD_API_URL=https://management.example.com",
   "SUPACLOUD_API_TOKEN=<production-management-api-token>",
@@ -33218,41 +33345,41 @@ var PRODUCTION_PROFILE = [
   ""
 ].join(`
 `);
-function textResult3(text, isError = false) {
+function textResult4(text, isError = false) {
   return { isError, content: [{ type: "text", text }] };
 }
-function jsonResult(value, isError = false) {
-  return textResult3(JSON.stringify(value, null, 2), isError);
+function jsonResult2(value, isError = false) {
+  return textResult4(JSON.stringify(value, null, 2), isError);
 }
-function record6(value) {
+function record7(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function packageDependencies(manifest) {
+function packageDependencies2(manifest) {
   return new Set([
     ...Object.keys(manifest.dependencies ?? {}),
     ...Object.keys(manifest.devDependencies ?? {})
   ]);
 }
-function outputDirectoryFor(manifest) {
-  const dependencies = packageDependencies(manifest);
+function outputDirectoryFor2(manifest) {
+  const dependencies = packageDependencies2(manifest);
   if (dependencies.has("next"))
     return "out";
   if (dependencies.has("@sveltejs/kit") || dependencies.has("svelte"))
     return "build";
   return "dist";
 }
-async function readPackageManifest(root) {
-  const path = join20(root, "package.json");
-  if (!existsSync17(path))
+async function readPackageManifest2(root) {
+  const path = join21(root, "package.json");
+  if (!existsSync18(path))
     return {};
   try {
-    const parsed = JSON.parse(await readFile8(path, "utf8"));
-    const value = record6(parsed);
+    const parsed = JSON.parse(await readFile9(path, "utf8"));
+    const value = record7(parsed);
     if (!value)
       throw new Error("package.json must contain an object");
-    const scripts = record6(value.scripts);
-    const dependencies = record6(value.dependencies);
-    const devDependencies = record6(value.devDependencies);
+    const scripts = record7(value.scripts);
+    const dependencies = record7(value.dependencies);
+    const devDependencies = record7(value.devDependencies);
     return {
       scripts: scripts ?? undefined,
       dependencies: dependencies ?? undefined,
@@ -33262,9 +33389,9 @@ async function readPackageManifest(root) {
     throw new Error(`Invalid package.json: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
-async function writeNewFile(path, content) {
+async function writeNewFile2(path, content) {
   try {
-    await writeFile7(path, content, { encoding: "utf8", flag: "wx", mode: 384 });
+    await writeFile8(path, content, { encoding: "utf8", flag: "wx", mode: 384 });
     return true;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "EEXIST")
@@ -33272,9 +33399,9 @@ async function writeNewFile(path, content) {
     throw error;
   }
 }
-async function ensureGitignore(root) {
-  const path = join20(root, ".gitignore");
-  const existing = existsSync17(path) ? await readFile8(path, "utf8") : "";
+async function ensureGitignore2(root) {
+  const path = join21(root, ".gitignore");
+  const existing = existsSync18(path) ? await readFile9(path, "utf8") : "";
   const required = [".env.supacloud.*", "!.env.supacloud.*.example"];
   const missing = required.filter((entry) => !existing.split(/\r?\n/).includes(entry));
   if (missing.length === 0)
@@ -33282,21 +33409,21 @@ async function ensureGitignore(root) {
   const prefix = existing.length > 0 && !existing.endsWith(`
 `) ? `${existing}
 ` : existing;
-  await writeFile7(path, `${prefix}${missing.join(`
+  await writeFile8(path, `${prefix}${missing.join(`
 `)}
 `, "utf8");
   return true;
 }
-async function initializeProject(request, options) {
-  const root = resolve27(request.root || options.cwd || process.cwd());
-  await mkdir7(root, { recursive: true });
-  const configPath = join20(root, "supacloud.json");
-  if (existsSync17(configPath)) {
+async function initializeProject2(request, options = {}) {
+  const root = resolve28(request.root || options.cwd || process.cwd());
+  await mkdir8(root, { recursive: true });
+  const configPath = join21(root, "supacloud.json");
+  if (existsSync18(configPath)) {
     throw new Error(`supacloud.json already exists in ${root}; init never overwrites project configuration`);
   }
-  const manifest = await readPackageManifest(root);
+  const manifest = await readPackageManifest2(root);
   const hasBuildScript = typeof manifest.scripts?.build === "string" && Boolean(manifest.scripts.build.trim());
-  const outputDirectory = outputDirectoryFor(manifest);
+  const outputDirectory = outputDirectoryFor2(manifest);
   const config = {
     frontend: {
       root: ".",
@@ -33305,7 +33432,7 @@ async function initializeProject(request, options) {
   };
   const created = [];
   try {
-    await writeFile7(configPath, `${JSON.stringify(config, null, 2)}
+    await writeFile8(configPath, `${JSON.stringify(config, null, 2)}
 `, {
       encoding: "utf8",
       flag: "wx",
@@ -33318,13 +33445,13 @@ async function initializeProject(request, options) {
     throw error;
   }
   created.push("supacloud.json");
-  if (await writeNewFile(join20(root, ".env.supacloud.test.example"), TEST_PROFILE)) {
+  if (await writeNewFile2(join21(root, ".env.supacloud.test.example"), TEST_PROFILE2)) {
     created.push(".env.supacloud.test.example");
   }
-  if (await writeNewFile(join20(root, ".env.supacloud.production.example"), PRODUCTION_PROFILE)) {
+  if (await writeNewFile2(join21(root, ".env.supacloud.production.example"), PRODUCTION_PROFILE2)) {
     created.push(".env.supacloud.production.example");
   }
-  if (await ensureGitignore(root))
+  if (await ensureGitignore2(root))
     created.push(".gitignore");
   const result = {
     schema: "supacloud.developer-experience.init.v1",
@@ -33332,7 +33459,7 @@ async function initializeProject(request, options) {
     root,
     created,
     detected: {
-      package_json: existsSync17(join20(root, "package.json")),
+      package_json: existsSync18(join21(root, "package.json")),
       build_script: hasBuildScript,
       output_directory: outputDirectory
     },
@@ -33343,9 +33470,9 @@ async function initializeProject(request, options) {
       "supacloud --env test deploy"
     ]
   };
-  if (request.json === true)
-    return jsonResult(result);
-  return textResult3([
+  if (request.format === "json")
+    return jsonResult2(result);
+  return textResult4([
     `Initialized SupaCloud deployment in ${root}.`,
     `Created: ${created.join(", ")}.`,
     hasBuildScript ? `Detected package.json build script; deploy output defaults to ${outputDirectory}.` : "No package.json build script detected; add one before deploying.",
@@ -33359,14 +33486,14 @@ function profileNameFromFile(name) {
   return match?.[1] ?? null;
 }
 async function environmentProfiles(root) {
-  const entries = await readdir8(root, { withFileTypes: true }).catch((error) => {
+  const entries = await readdir9(root, { withFileTypes: true }).catch((error) => {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
       return [];
     throw error;
   });
   return entries.filter((entry) => entry.isFile()).map((entry) => {
     const name = profileNameFromFile(entry.name);
-    return name ? { name, path: join20(root, entry.name), exists: true } : null;
+    return name ? { name, path: join21(root, entry.name), exists: true } : null;
   }).filter((profile) => profile !== null).sort((left, right) => left.name.localeCompare(right.name));
 }
 function statusMissing(context) {
@@ -33401,18 +33528,18 @@ function deployMissing(context, application, hasFrontend = false) {
 }
 async function inspectProfile(profile) {
   try {
-    const context = resolveSupaCloudContext2({}, dirname14(profile.path), {
+    const context = resolveSupaCloudContext2({}, dirname15(profile.path), {
       environmentName: profile.name
     });
     const status = statusMissing(context);
-    const configText = await readFile8(join20(dirname14(profile.path), "supacloud.json"), "utf8").catch((error) => {
+    const configText = await readFile9(join21(dirname15(profile.path), "supacloud.json"), "utf8").catch((error) => {
       if (error instanceof Error && "code" in error && error.code === "ENOENT")
         return "{}";
       throw error;
     });
-    const config = record6(JSON.parse(configText));
-    const hasFrontend = record6(config?.frontend) !== null || Object.values(record6(config?.targets) ?? {}).some((target) => record6(target)?.type === "frontend");
-    const deploy = deployMissing(context, record6(config?.application), hasFrontend);
+    const config = record7(JSON.parse(configText));
+    const hasFrontend = record7(config?.frontend) !== null || Object.values(record7(config?.targets) ?? {}).some((target) => record7(target)?.type === "frontend");
+    const deploy = deployMissing(context, record7(config?.application), hasFrontend);
     return {
       name: profile.name,
       path: profile.path,
@@ -33449,7 +33576,7 @@ async function inspectProfile(profile) {
   }
 }
 async function inspectEnvironment(request, options) {
-  const root = resolve27(request.root || options.cwd || process.cwd());
+  const root = resolve28(request.root || options.cwd || process.cwd());
   const profiles = await environmentProfiles(root);
   if (request.action === "list") {
     const active = options.activeContext?.environment || null;
@@ -33464,13 +33591,13 @@ async function inspectEnvironment(request, options) {
         active: profile.name.toLowerCase() === active?.toLowerCase()
       }))
     };
-    if (request.json === true)
-      return jsonResult(result);
+    if (request.format === "json")
+      return jsonResult2(result);
     if (profiles.length === 0) {
-      return textResult3(`No .env.supacloud.<name> profiles found in ${root}.
-Run \`supacloud init\` to create safe examples.`);
+      return textResult4(`No .env.supacloud.<name> profiles found in ${root}.
+Run \`supacloud deploy init\` to create safe examples.`);
     }
-    return textResult3([
+    return textResult4([
       `Environment profiles in ${root}:`,
       ...result.environments.map((profile) => `${profile.active ? "*" : " "} ${profile.name}  ${profile.path}`)
     ].join(`
@@ -33484,11 +33611,11 @@ Run \`supacloud init\` to create safe examples.`);
     active: options.activeContext?.environment || null,
     environments: reports
   };
-  if (request.json === true)
-    return jsonResult(result, !result.ok);
+  if (request.format === "json")
+    return jsonResult2(result, !result.ok);
   if (reports.length === 0) {
-    return textResult3(`No environment profiles found in ${root}.
-Run \`supacloud init\` and copy an example profile.`, true);
+    return textResult4(`No environment profiles found in ${root}.
+Run \`supacloud deploy init\` and copy an example profile.`, true);
   }
   const lines = reports.map((report) => {
     if (report.error)
@@ -33498,12 +33625,11 @@ Run \`supacloud init\` and copy an example profile.`, true);
     const ref = report.projectRef ? `project=${report.projectRef}` : "project=unknown";
     return `${status}  ${report.name}  ${deploy}  ${ref}`;
   });
-  return textResult3(lines.join(`
+  return textResult4(lines.join(`
 `), !result.ok);
 }
 function registerDeveloperExperienceTools(server, options = {}) {
-  registerTool(server, "init", "Create SupaCloud deployment configuration and non-secret environment examples without overwriting project files.", initToolSchema, (request) => initializeProject(request, options));
-  registerTool(server, "env", "List or locally validate named SupaCloud environment profiles without contacting the platform or printing secrets.", environmentToolSchema, (request) => inspectEnvironment(request, options));
+  registerTool(server, "env", "List or locally validate named SupaCloud environment profiles without contacting the platform or printing secrets.", environmentToolSchema2, (request) => inspectEnvironment(request, options));
 }
 
 // src/shared/tools/project-deployment.ts
@@ -33631,7 +33757,7 @@ async function runProjectDeployment(http, args) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.113.0",
+  version: "0.115.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -33683,9 +33809,9 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.53.0",
+    "@supacloud/compiler": "^0.54.0",
     "@supacloud/delivery": "0.24.0",
-    "@supacloud/db": "0.20.3",
+    "@supacloud/db": "0.20.4",
     typebox: "1.4.3"
   },
   overrides: {
@@ -33695,10 +33821,10 @@ var package_default = {
   },
   devDependencies: {
     "@supabase/supabase-js": "2.118.0",
-    "@supacloud/elysia": "0.37.0",
+    "@supacloud/elysia": "0.38.0",
     "@types/bun": "^1.4.4",
     effect: "4.0.5",
-    elysia: "2.0.0-rc.0",
+    elysia: "2.0.0-rc.1",
     typescript: "^7.0.2"
   }
 };
@@ -33867,7 +33993,7 @@ USAGE
 
   ${preferredCommand} [global flags] deploy [--flags]
   ${preferredCommand} [global flags] <module> <action> [--flags]
-  ${preferredCommand} init [--root <directory>]
+  ${preferredCommand} deploy init [--root <directory>]
   ${preferredCommand} env <list|check> [--root <directory>]
   ${preferredCommand} [global flags] status
   ${preferredCommand} --help
@@ -33901,9 +34027,9 @@ DEFAULT CONTEXT
 
 EXAMPLES
 
-  ${preferredCommand} init
+  ${preferredCommand} deploy init
   ${preferredCommand} env check
-  ${preferredCommand} env check --json
+  ${preferredCommand} env check --format json
   ${preferredCommand} status
   ${preferredCommand} deploy
   ${preferredCommand} --env test deploy
@@ -33938,7 +34064,7 @@ EXAMPLES
   ${preferredCommand} supabase db_dump --db_url "postgresql://..." --file backups/schema.sql
   ${preferredCommand} lite migrate --project_dir .
   ${preferredCommand} lite start --project_dir . --port 54321
-  ${preferredCommand} lite doctor --project_dir . --json
+  ${preferredCommand} lite doctor --project_dir . --format json
   ${preferredCommand} branch create --name feature-auth --data_mode schema_only
   ${preferredCommand} branch promotion_plan --branch_ref preview123
   ${preferredCommand} branch promote --branch_ref preview123 --plan_checksum <sha256>
@@ -33946,8 +34072,6 @@ EXAMPLES
   ${preferredCommand} ai install_skill --dry_run
   ${preferredCommand} mcp config
   ${preferredCommand} app init --name my-service
-  ${preferredCommand} app init --name my-api --template http
-  ${preferredCommand} app init --name my-worker --template edge
   ${preferredCommand} app generate --kind module --name billing
   ${preferredCommand} app generate --kind command --module billing --name issue-invoice
   ${preferredCommand} app generate --kind job --module billing --name sync-orders
@@ -33988,13 +34112,6 @@ EXAMPLES
   ${preferredCommand} app context --root . --target CaseModule --events execution.ndjson --request-id request-123 --format json
   ${preferredCommand} app doctor --root .
   ${preferredCommand} app fix --root . --fix fix.json --write
-  ${preferredCommand} generate --kind module --name billing
-  ${preferredCommand} generate --kind job --module billing --name sync-orders
-  ${preferredCommand} generate --kind contract --module billing --name issue-invoice
-  ${preferredCommand} check --root . --strict
-  ${preferredCommand} context --format json
-  ${preferredCommand} context --target CaseModule --format json
-  ${preferredCommand} doctor
   ${preferredCommand} db context --root . --module_file db/modules.ts --module cases
   ${preferredCommand} db context --root . --module_file db/modules.ts --target public.case_create
   ${preferredCommand} db lint --root . --module_file db/modules.ts
@@ -34006,6 +34123,7 @@ EXAMPLES
   ${preferredCommand} db plan --dir supabase/migrations
   ${preferredCommand} db apply --dir supabase/migrations --approved_digest <reviewed-digest>
   ${preferredCommand} db role_check --schema public
+  ${preferredCommand} db role_check --remote --schema public
   ${preferredCommand} db role_sql --application_role app_user --migration_role app_migrator --database app_db
   ${preferredCommand} edge_functions get_config --ref abc123 --slug hello
   ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello --expected-active-version absent --expected-activation-id legacy
@@ -34068,7 +34186,6 @@ function createCliTools(context, confirmProduction) {
     activeContext: context
   })));
   Object.assign(tools, captureTools((server) => registerAppTools(server, { onDevProgress: writeDevProgress })));
-  Object.assign(tools, captureTools((server) => registerAppAliases(server)));
   Object.assign(tools, captureTools((server) => registerDbGovernanceTools(server, {
     projectRef: context.projectRef || undefined,
     apiUrl: context.apiUrl || undefined,
@@ -34103,7 +34220,7 @@ function createCliTools(context, confirmProduction) {
         ]
       })
     };
-    for (const name of ["database", "auth", "oauth_clients", "storage", "edge_functions", "secrets", "frontend", "applications", "queue", "task_events", "scheduled_functions", "mutations", "diagnostics", "gateway", "branch", "release"]) {
+    for (const name of ["database", "auth", "oauth_clients", "storage", "edge_functions", "secrets", "frontend", "queue", "task_events", "scheduled_functions", "mutations", "diagnostics", "gateway", "branch", "release"]) {
       tools[name] = {
         schema: { action: genericActionSchema },
         callback: async () => ({
@@ -34130,7 +34247,6 @@ function createCliTools(context, confirmProduction) {
       tools.branch = { schema: branchHelpTool.schema, callback: branchContextCallback };
     }
     const frontendContextCallback = tools.frontend.callback;
-    tools.applications = { schema: APPLICATION_TOOL_SCHEMA, callback: tools.applications.callback };
     const frontendHelpTool = captureTools((server) => registerFrontendTools(server, {})).frontend;
     if (frontendHelpTool) {
       tools.frontend = { schema: frontendHelpTool.schema, callback: frontendContextCallback };
@@ -34140,13 +34256,22 @@ function createCliTools(context, confirmProduction) {
     registerContextAwareHelp();
     tools.deploy = {
       schema: deployToolSchema,
-      callback: async () => ({
-        isError: true,
-        content: [{
-          type: "text",
-          text: `\u26A0\uFE0F Deploy requires Management API context. Run \`${preferredCommand} status\` to inspect current detection.`
-        }]
-      })
+      callback: async (args) => {
+        const input = args && typeof args === "object" ? args : {};
+        if (input.action === "init") {
+          return initializeProject2({
+            ...typeof input.root === "string" ? { root: input.root } : {},
+            ...input.format === "json" ? { format: "json" } : {}
+          }, { cwd: process.cwd() });
+        }
+        return {
+          isError: true,
+          content: [{
+            type: "text",
+            text: `\u26A0\uFE0F Deploy requires Management API context. Run \`${preferredCommand} status\` to inspect current detection.`
+          }]
+        };
+      }
     };
     Object.assign(tools, captureTools((server) => registerDatabaseTools(server, undefined, {
       localOnly: true
@@ -34245,9 +34370,9 @@ function createCliTools(context, confirmProduction) {
     applicationOrigin: context.inferredSupabaseUrl || undefined
   })));
   assign(captureTools((server) => registerFrontendTools(server, http)));
-  assign(captureTools((server) => registerApplicationTools(server, http)));
+  const applicationTools = captureTools((server) => registerApplicationTools(server, http));
   Object.assign(tools, captureTools((server) => registerAppTools(server, {
-    getApplications: () => tools.applications?.callback,
+    getApplications: () => applicationTools.applications?.callback,
     onDevProgress: writeDevProgress,
     projectRef: context.projectRef || undefined,
     projectDeployment: (args) => runProjectDeployment(http, args)
@@ -34302,7 +34427,7 @@ async function main() {
   }
   const cliTools = createCliTools(context, globalOptions.confirmProduction);
   if (args.length === 1 && !["ai", "supabase", "lite", "app", "db", "env"].includes(args[0]) && cliTools[args[0]]) {
-    if ("action" in cliTools[args[0]].schema) {
+    if ("action" in cliTools[args[0]].schema && args[0] !== "deploy") {
       if (context.credentialScope !== "management" || !context.apiUrl || !context.apiToken) {
         console.error(`This command requires Management API context. Run \`${preferredCommand} status\` to inspect current detection.`);
         process.exitCode = 1;