@supacloud/cli 0.14.6 → 0.16.0

package/dist/index.js

@@ -6101,6 +6101,39 @@ function coerceCliValue(value) {
     return Number(value);
   return value;
 }
+var DUPLICATE_CLI_FLAG_MESSAGE = "Duplicate CLI flag is not allowed";
+function cliFlagAt(args, index) {
+  const argument = args[index];
+  if (!argument.startsWith("--") || argument.length <= 2)
+    return null;
+  const rawFlag = argument.slice(2);
+  const equalsIndex = rawFlag.indexOf("=");
+  if (equalsIndex >= 0) {
+    return { name: rawFlag.slice(0, equalsIndex), rawValue: rawFlag.slice(equalsIndex + 1), nextIndex: index };
+  }
+  const nextArgument = args[index + 1];
+  if (nextArgument !== undefined && !nextArgument.startsWith("--")) {
+    return { name: rawFlag, rawValue: nextArgument, nextIndex: index + 1 };
+  }
+  return { name: rawFlag, nextIndex: index };
+}
+function schemaCompatibleCliValue(field, rawValue) {
+  return field && exports_value2.Check(field, rawValue) ? rawValue : coerceCliValue(rawValue);
+}
+function parseCliFlags(args, startIndex, schema) {
+  const parsedFlags = Object.create(null);
+  const fields = schemaProperties(schema);
+  for (let index = startIndex;index < args.length; index++) {
+    const flag = cliFlagAt(args, index);
+    if (!flag)
+      continue;
+    index = flag.nextIndex;
+    if (Object.hasOwn(parsedFlags, flag.name))
+      throw new Error(DUPLICATE_CLI_FLAG_MESSAGE);
+    parsedFlags[flag.name] = flag.rawValue === undefined ? true : schemaCompatibleCliValue(fields[flag.name], flag.rawValue);
+  }
+  return parsedFlags;
+}
 async function runCli(cliTools, args, options = {}) {
   const commandName = options.commandName || "supacloud";
   const formatAvailableCommands = () => Object.keys(cliTools).filter((k) => !["setup_help", "deploy_web_console"].includes(k)).join(`
@@ -6168,28 +6201,14 @@ async function runCli(cliTools, args, options = {}) {
     process.exitCode = 0;
     return;
   }
-  const parsedArgs = {};
   let startIdx = 1;
   if (args.length > 1 && !args[1].startsWith("--")) {
-    parsedArgs.action = args[1];
     startIdx = 2;
   }
-  for (let i = startIdx;i < args.length; i++) {
-    const arg = args[i];
-    if (arg.startsWith("--") && arg.length > 2) {
-      const rawFlag = arg.slice(2);
-      const equalsIndex = rawFlag.indexOf("=");
-      const key = equalsIndex >= 0 ? rawFlag.slice(0, equalsIndex) : rawFlag;
-      let val = true;
-      if (equalsIndex >= 0) {
-        val = coerceCliValue(rawFlag.slice(equalsIndex + 1));
-      } else if (i + 1 < args.length && !args[i + 1].startsWith("--")) {
-        val = coerceCliValue(args[++i]);
-      }
-      parsedArgs[key] = val;
-    }
-  }
   try {
+    const parsedArgs = parseCliFlags(args, startIdx, tool.schema);
+    if (startIdx === 2)
+      parsedArgs.action = args[1];
     const validatedArgs = parseToolArguments(tool.schema, parsedArgs);
     const result = await tool.callback(validatedArgs);
     if (result && result.content && Array.isArray(result.content)) {
@@ -6213,50 +6232,106 @@ async function runCli(cliTools, args, options = {}) {
 }
 
 // src/shared/context.ts
+import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { resolve } from "node:path";
-import { existsSync, readFileSync } from "node:fs";
-function readDotEnvFile(cwd) {
-  const envPath = resolve(cwd, ".env");
-  if (!existsSync(envPath))
-    return {};
+
+// src/shared/global-options.ts
+var GLOBAL_FLAGS = {
+  "--env": "environmentName",
+  "--env-file": "envFile",
+  "--confirm-production": "confirmProduction"
+};
+var ENVIRONMENT_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+function globalFlag(arg) {
+  return Object.keys(GLOBAL_FLAGS).find((flag) => arg === flag || arg.startsWith(`${flag}=`)) ?? null;
+}
+function globalFlagValue(args, index, flag) {
+  const inlineValue = args[index].slice(flag.length + 1);
+  if (args[index].startsWith(`${flag}=`)) {
+    if (!inlineValue)
+      throw new Error(`${flag} requires a value`);
+    return { value: inlineValue, consumed: 1 };
+  }
+  const value = args[index + 1];
+  if (!value || value.startsWith("--"))
+    throw new Error(`${flag} requires a value`);
+  return { value, consumed: 2 };
+}
+function normalizeEnvironmentName(name) {
+  if (!ENVIRONMENT_NAME_PATTERN.test(name)) {
+    throw new Error("--env and SUPACLOUD_ENV must match ^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$");
+  }
+  const normalized = name.toLowerCase();
+  return normalized === "prod" || normalized === "production" ? "production" : normalized;
+}
+function parseGlobalOptions(args) {
   const values = {};
-  try {
-    const envContent = readFileSync(envPath, "utf-8");
-    for (const line of envContent.split(`
-`)) {
-      const match = line.trim().match(/^([^=]+)=(.*)$/);
-      if (!match)
-        continue;
-      const key = match[1].trim();
-      const value = match[2].trim().replace(/^["']|["']$/g, "");
-      values[key] = value;
+  const remainingArgs = [];
+  for (let index = 0;index < args.length; ) {
+    const flag = globalFlag(args[index]);
+    if (!flag) {
+      remainingArgs.push(args[index]);
+      index += 1;
+      continue;
     }
-  } catch {
-    return {};
+    const key = GLOBAL_FLAGS[flag];
+    if (values[key] !== undefined)
+      throw new Error(`${flag} may be provided only once`);
+    const parsed = globalFlagValue(args, index, flag);
+    values[key] = parsed.value;
+    index += parsed.consumed;
+  }
+  if (values.environmentName && values.envFile) {
+    throw new Error("--env and --env-file are mutually exclusive");
+  }
+  if (values.environmentName)
+    normalizeEnvironmentName(values.environmentName);
+  return { ...values, args: remainingArgs };
+}
+
+// src/shared/context.ts
+var CORE_CONTEXT_KEYS = [
+  "SUPABASE_URL",
+  "SUPABASE_SERVICE_ROLE_KEY",
+  "SUPACLOUD_API_URL",
+  "SUPACLOUD_MANAGEMENT_API_URL",
+  "MANAGEMENT_API_URL",
+  "SUPACLOUD_API_TOKEN",
+  "SUPACLOUD_PROJECT_REF",
+  "X_PROJECT_REF",
+  "SUPACLOUD_HOST"
+];
+function unquotedEnvValue(rawValue) {
+  const value = rawValue.trim();
+  const quote = value[0];
+  return quote && (quote === '"' || quote === "'") && value.endsWith(quote) ? value.slice(1, -1) : value;
+}
+function parseEnvFile(contents) {
+  const values = {};
+  for (const rawLine of contents.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!match)
+      continue;
+    values[match[1]] = unquotedEnvValue(match[2]);
   }
   return values;
 }
-function pickValue(env, dotenv, keys) {
-  for (const key of keys) {
-    const envValue = env[key];
-    if (envValue)
-      return { value: envValue, source: "env" };
+function readEnvFile(path, required) {
+  if (!existsSync(path)) {
+    if (required)
+      throw new Error(`SupaCloud environment file not found: ${path}`);
+    return {};
   }
-  for (const key of keys) {
-    const dotenvValue = dotenv[key];
-    if (dotenvValue)
-      return { value: dotenvValue, source: "dotenv" };
+  try {
+    return parseEnvFile(readFileSync(path, "utf8"));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to read SupaCloud environment file ${path}: ${message}`);
   }
-  return { value: "", source: "env" };
-}
-function detectSource(sources) {
-  const present = new Set(sources.filter((value) => value !== "none"));
-  if (present.size === 0)
-    return "none";
-  if (present.size === 1)
-    return present.has("env") ? "env" : "dotenv";
-  return "mixed";
 }
 function normalizeUrl(value) {
   const trimmed = value.trim().replace(/\/+$/, "");
@@ -6279,8 +6354,7 @@ function inferProjectRefFromSupabaseUrl(value) {
   const normalized = normalizeUrl(value);
   if (!normalized)
     return "";
-  const match = new URL(normalized).hostname.match(/^([a-z0-9-]+)\.api\./i);
-  return match?.[1] ?? "";
+  return new URL(normalized).hostname.match(/^([a-z0-9-]+)\.api\./i)?.[1] ?? "";
 }
 function inferManagementApiUrlFromSupabaseUrl(value, projectRef = "") {
   const normalized = normalizeUrl(value);
@@ -6297,43 +6371,209 @@ function inferManagementApiUrlFromSupabaseUrl(value, projectRef = "") {
     url.hostname = `studio-${ref}.${host.slice(`${ref}.api.`.length)}`;
     return url.toString().replace(/\/+$/, "");
   }
-  const managedHostMatch = host.match(/^([a-z0-9-]+)\.api\.(.+)$/i);
-  if (managedHostMatch) {
-    url.hostname = `studio-${managedHostMatch[1]}.${managedHostMatch[2]}`;
+  const managedHost = host.match(/^([a-z0-9-]+)\.api\.(.+)$/i);
+  if (managedHost) {
+    url.hostname = `studio-${managedHost[1]}.${managedHost[2]}`;
     return url.toString().replace(/\/+$/, "");
   }
   return normalized;
 }
-function resolveSupaCloudContext(env = process.env, cwd = process.cwd()) {
-  const dotenv = readDotEnvFile(cwd);
-  const supabaseUrl = pickValue(env, dotenv, ["SUPABASE_URL"]);
-  const explicitApiUrl = pickValue(env, dotenv, ["SUPACLOUD_API_URL", "SUPACLOUD_MANAGEMENT_API_URL", "MANAGEMENT_API_URL"]);
-  const inferredToken = pickValue(env, dotenv, ["SUPABASE_SERVICE_ROLE_KEY", "SUPACLOUD_API_TOKEN"]);
-  const explicitProjectRef = pickValue(env, dotenv, ["SUPACLOUD_PROJECT_REF", "X_PROJECT_REF"]).value;
-  const hostFromEnv = env.SUPACLOUD_HOST;
-  const normalizedSupabaseUrl = normalizeUrl(supabaseUrl.value);
-  const projectRef = explicitProjectRef || inferProjectRefFromSupabaseUrl(normalizedSupabaseUrl);
-  const apiUrl = normalizeUrl(explicitApiUrl.value) || inferManagementApiUrlFromSupabaseUrl(normalizedSupabaseUrl, projectRef) || (hostFromEnv ? `http://${hostFromEnv}:9090` : "");
-  const resolvedHostFromUrl = hostFromUrl(apiUrl || normalizedSupabaseUrl);
+function sourceProjectCore(values) {
+  const supabaseUrl = normalizeUrl(values.SUPABASE_URL || "");
+  const projectRef = (values.SUPACLOUD_PROJECT_REF || values.X_PROJECT_REF || "").trim() || inferProjectRefFromSupabaseUrl(supabaseUrl);
+  const explicitApiUrl = values.SUPACLOUD_API_URL || values.SUPACLOUD_MANAGEMENT_API_URL || values.MANAGEMENT_API_URL || "";
+  const apiUrl = normalizeUrl(explicitApiUrl) || inferManagementApiUrlFromSupabaseUrl(supabaseUrl, projectRef) || (values.SUPACLOUD_HOST ? `http://${values.SUPACLOUD_HOST}:9090` : "");
+  const apiToken = values.SUPACLOUD_API_TOKEN || values.SUPABASE_SERVICE_ROLE_KEY || "";
+  return { apiUrl, apiToken, projectRef, supabaseUrl };
+}
+function processValues(env) {
+  return Object.fromEntries(Object.entries(env).filter((entry) => entry[1] !== undefined));
+}
+function hasProcessContext(env) {
+  return CORE_CONTEXT_KEYS.some((key) => Object.hasOwn(env, key));
+}
+function completeProjectContext(values) {
+  const core = sourceProjectCore(values);
+  return Boolean(core.apiUrl && core.apiToken && core.projectRef);
+}
+function namedEnvironmentSource(cwd, selector) {
+  const environment = normalizeEnvironmentName(selector);
+  const path = resolve(cwd, `.env.supacloud.${selector}`);
+  const values = readEnvFile(path, true);
+  if (values.SUPACLOUD_ENV && normalizeEnvironmentName(values.SUPACLOUD_ENV) !== environment) {
+    throw new Error(`SUPACLOUD_ENV in ${path} does not match selector ${selector}`);
+  }
+  return { values, kind: "named_env_file", path, environment };
+}
+function explicitEnvironmentSource(cwd, envFile) {
+  const path = resolve(cwd, envFile);
+  const values = readEnvFile(path, true);
+  if (!values.SUPACLOUD_ENV)
+    throw new Error(`SUPACLOUD_ENV is required in ${path}`);
   return {
-    host: hostFromEnv ?? resolvedHostFromUrl,
+    values,
+    kind: "explicit_env_file",
+    path,
+    environment: normalizeEnvironmentName(values.SUPACLOUD_ENV)
+  };
+}
+function contextSource(env, cwd, selection) {
+  if (selection.environmentName && selection.envFile)
+    throw new Error("Environment selectors are mutually exclusive");
+  if (selection.environmentName)
+    return namedEnvironmentSource(cwd, selection.environmentName);
+  if (selection.envFile)
+    return explicitEnvironmentSource(cwd, selection.envFile);
+  if (env.SUPACLOUD_ENV) {
+    const environment2 = normalizeEnvironmentName(env.SUPACLOUD_ENV);
+    const values2 = processValues(env);
+    if (completeProjectContext(values2)) {
+      return { values: values2, kind: "process_env", path: null, environment: environment2 };
+    }
+    return namedEnvironmentSource(cwd, env.SUPACLOUD_ENV);
+  }
+  if (hasProcessContext(env)) {
+    return { values: processValues(env), kind: "process_env", path: null, environment: "" };
+  }
+  const path = resolve(cwd, ".env");
+  const values = readEnvFile(path, false);
+  const environment = values.SUPACLOUD_ENV ? normalizeEnvironmentName(values.SUPACLOUD_ENV) : "";
+  return { values, kind: Object.keys(values).length ? "legacy_dotenv" : "none", path: existsSync(path) ? path : null, environment };
+}
+function resolveSupaCloudContext(env = process.env, cwd = process.cwd(), selection = {}) {
+  const source = contextSource(env, cwd, selection);
+  const core = sourceProjectCore(source.values);
+  const host = source.values.SUPACLOUD_HOST || hostFromUrl(core.apiUrl || core.supabaseUrl);
+  const readOnly = env.SUPACLOUD_READ_ONLY === "true" || source.values.SUPACLOUD_READ_ONLY === "true";
+  return {
+    host,
     sshUser: env.SUPACLOUD_SSH_USER ?? "root",
     sshPort: parseInt(env.SUPACLOUD_SSH_PORT ?? "22", 10),
     sshKey: env.SUPACLOUD_SSH_KEY ?? resolve(homedir(), ".ssh", "id_rsa"),
     sshPass: env.SUPACLOUD_SSH_PASS ?? "",
-    apiUrl,
-    apiToken: env.SUPACLOUD_API_TOKEN ?? inferredToken.value,
-    projectRef,
-    readOnly: env.SUPACLOUD_READ_ONLY === "true",
-    inferredSupabaseUrl: normalizedSupabaseUrl,
-    inferredServiceRoleKey: inferredToken.value,
-    source: detectSource([
-      supabaseUrl.value || explicitApiUrl.value ? supabaseUrl.value ? supabaseUrl.source : explicitApiUrl.source : "none",
-      inferredToken.value ? inferredToken.source : "none"
-    ])
+    apiUrl: core.apiUrl,
+    apiToken: core.apiToken,
+    projectRef: core.projectRef,
+    readOnly,
+    environment: source.environment,
+    production: source.environment === "prod" || source.environment === "production",
+    inferredSupabaseUrl: core.supabaseUrl,
+    inferredServiceRoleKey: source.values.SUPABASE_SERVICE_ROLE_KEY || "",
+    source: source.kind,
+    sourcePath: source.path
   };
 }
 
+// src/shared/execution-policy.ts
+var ACTION_POLICY = {
+  project: {
+    read: ["get", "health", "logs", "api_keys", "settings", "tasks", "task_detail", "task_stats", "dlq", "background_settings"],
+    write: ["task_cancel", "task_retry", "update_background_settings"]
+  },
+  database: {
+    read: ["list_tables", "describe_columns", "list_indexes", "list_constraints", "list_extensions", "rls_status", "rls_policies", "list_auth_users", "get_auth_user", "connections", "stats", "slow_queries", "list_migrations", "migration_inventory", "project_url", "generate_types"],
+    write: ["query", "apply_migration", "push_migrations", "baseline_migrations", "create_table_rls"]
+  },
+  supabase: {
+    local: ["version", "migration_new", "db_diff", "db_reset", "db_pull", "db_dump", "migration_list", "gen_types"],
+    write: ["push"]
+  },
+  auth: {
+    read: ["list_providers", "get_provider", "supported_providers", "get_settings", "get_config"],
+    write: ["configure_provider", "update_provider", "disable_provider", "wechat_mini", "wechat_open", "update_settings", "update_config"]
+  },
+  storage: {
+    read: ["status", "list_buckets", "get_bucket", "list_files"],
+    write: ["create_bucket", "update_bucket", "delete_bucket", "upload_base64", "delete_file"]
+  },
+  edge_functions: {
+    read: ["list", "source"],
+    local: ["check"],
+    write: ["deploy", "deploy_bundle", "config", "activate", "delete"]
+  },
+  scheduled_functions: { read: ["list"], write: ["create", "update", "delete"] },
+  secrets: { read: ["list"], write: ["upsert", "delete"] },
+  frontend: {
+    read: ["list", "get", "build_logs", "list_frameworks", "list_records"],
+    write: ["create", "update", "delete", "deploy_git", "deploy_upload", "redeploy", "add_domain", "remove_domain", "set_env"]
+  },
+  task_events: { read: ["inspect_webhook"], write: ["register_webhook", "unregister_webhook"] },
+  diagnostics: { read: ["list_checks", "get_run"], write: ["run_checks", "repair"] },
+  gateway: {
+    read: ["routes", "get_certificate", "custom_hostname"],
+    write: ["upsert_route", "update_route", "delete_route", "config", "update_certificate", "issue_certificate", "deploy_certificate", "rebuild", "set_custom_hostname", "delete_custom_hostname", "verify_custom_hostname"]
+  },
+  branch: { read: ["list", "promotion_plan"], write: ["create", "delete", "promote"] },
+  queue: {
+    read: ["list", "stats", "list_messages", "dlq", "get_message", "get_settings"],
+    write: ["send", "receive", "ack", "release", "fail", "retry", "delete_message", "update_settings"]
+  },
+  ai: { local: ["show_skill", "install_skill"] }
+};
+function declaredMode(moduleName, action) {
+  const policy = ACTION_POLICY[moduleName];
+  if (!policy)
+    return;
+  for (const mode of ["read", "write", "local"]) {
+    if (policy[mode]?.includes(action))
+      return mode;
+  }
+  return;
+}
+function executionMode(moduleName, action, args) {
+  if (moduleName === "database" && ["push_migrations", "baseline_migrations"].includes(action) && args.dry_run === true)
+    return "read";
+  if (moduleName === "supabase" && action === "push" && args.dry_run === true)
+    return "read";
+  return declaredMode(moduleName, action);
+}
+function authorizeExecution(moduleName, args, authorization) {
+  const action = typeof args.action === "string" ? args.action : "";
+  if (!action)
+    return;
+  const mode = executionMode(moduleName, action, args);
+  const { context, confirmProduction } = authorization;
+  if (!mode && (context.production || context.readOnly)) {
+    throw new Error(`Execution policy has no classification for ${moduleName}.${action}`);
+  }
+  if (context.production && mode === "read" && typeof args.ref === "string" && args.ref && args.ref !== context.projectRef) {
+    throw new Error("Production profiles cannot target a different project with --ref");
+  }
+  if (mode !== "write")
+    return;
+  if (context.production && moduleName === "diagnostics" && action === "repair") {
+    throw new Error("diagnostics repair is forbidden in production environments");
+  }
+  if (context.readOnly) {
+    throw new Error(`Remote write ${moduleName}.${action} is blocked in read-only mode (SUPACLOUD_READ_ONLY=true)`);
+  }
+  if (!context.production)
+    return;
+  const requestedRef = args.ref ?? context.projectRef;
+  if (typeof requestedRef !== "string" || !requestedRef) {
+    throw new Error(`Production write ${moduleName}.${action} requires a project ref`);
+  }
+  if (requestedRef !== context.projectRef) {
+    throw new Error("Production profiles cannot target a different project with --ref");
+  }
+  if (confirmProduction !== context.projectRef || confirmProduction !== requestedRef) {
+    throw new Error(`Production write requires --confirm-production ${context.projectRef}`);
+  }
+}
+function validateExecutionPolicyCoverage(tools) {
+  for (const [moduleName, tool] of Object.entries(tools)) {
+    const actionSchema = schemaProperties(tool.schema).action;
+    if (!actionSchema)
+      continue;
+    const actions = schemaEnumValues(actionSchema);
+    for (const action of actions) {
+      if (!declaredMode(moduleName, String(action))) {
+        throw new Error(`Execution policy has no classification for ${moduleName}.${String(action)}`);
+      }
+    }
+  }
+}
+
 // src/shared/transports/http.ts
 var DEFAULT_TIMEOUT = 30000;
 var MAX_RETRIES = 2;
@@ -6348,6 +6588,16 @@ function isRetryableError(error) {
   const networkError = error;
   return networkError.name === "AbortError" || networkError.code === "ECONNREFUSED" || networkError.code === "ECONNRESET";
 }
+function transportFailure(error) {
+  const networkError = error instanceof Error ? error : null;
+  const code = networkError?.name === "AbortError" ? "TIMEOUT" : networkError?.code === "ECONNRESET" ? "CONNECTION_RESET" : "NETWORK_ERROR";
+  return {
+    ok: false,
+    status: 500,
+    data: { error: "Network Error", code },
+    transportError: true
+  };
+}
 async function fetchWithTimeout(url, options) {
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
@@ -6382,6 +6632,57 @@ async function fetchWithRetry(url, options) {
   }
   throw new Error("Unreachable");
 }
+function declaredResponseTooLarge(response, maxBytes) {
+  const contentLength = response.headers.get("content-length");
+  if (contentLength === null || !/^\d+$/.test(contentLength))
+    return false;
+  return Number(contentLength) > maxBytes;
+}
+function joinedResponseBytes(chunks, totalBytes) {
+  const responseBytes = new Uint8Array(totalBytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    responseBytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return responseBytes;
+}
+async function responseBytesWithinLimit(response, maxBytes) {
+  if (declaredResponseTooLarge(response, maxBytes)) {
+    await response.body?.cancel();
+    return null;
+  }
+  if (!response.body)
+    return new Uint8Array;
+  const reader = response.body.getReader();
+  const chunks = [];
+  let totalBytes = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done)
+      return joinedResponseBytes(chunks, totalBytes);
+    totalBytes += value.byteLength;
+    if (totalBytes > maxBytes) {
+      await reader.cancel();
+      return null;
+    }
+    chunks.push(value);
+  }
+}
+function parsedUtf8Json(responseBytes) {
+  try {
+    const responseText = new TextDecoder("utf-8", { fatal: true }).decode(responseBytes);
+    return JSON.parse(responseText);
+  } catch (error) {
+    if (error instanceof SyntaxError || error instanceof TypeError)
+      return null;
+    throw error;
+  }
+}
+async function boundedResponseJson(response, maxBytes) {
+  const responseBytes = await responseBytesWithinLimit(response, maxBytes);
+  return responseBytes === null ? null : parsedUtf8Json(responseBytes);
+}
 
 class HttpTransport {
   baseUrl;
@@ -6396,16 +6697,16 @@ class HttpTransport {
       "Content-Type": "application/json"
     };
   }
-  async get(path) {
+  async get(path, options = {}) {
     try {
       const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
         method: "GET",
         headers: this.headers()
       });
-      const data = await res.json().catch(() => null);
+      const data = options.maxResponseBytes === undefined ? await res.json().catch(() => null) : await boundedResponseJson(res, options.maxResponseBytes);
       return { ok: res.ok, status: res.status, data };
     } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
+      return transportFailure(error);
     }
   }
   async post(path, body) {
@@ -6418,7 +6719,7 @@ class HttpTransport {
       const data = await res.json().catch(() => null);
       return { ok: res.ok, status: res.status, data };
     } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
+      return transportFailure(error);
     }
   }
   async postMultipart(path, formData) {
@@ -6432,7 +6733,7 @@ class HttpTransport {
       const data = await res.json().catch(() => null);
       return { ok: res.ok, status: res.status, data };
     } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
+      return transportFailure(error);
     }
   }
   async patch(path, body) {
@@ -6445,7 +6746,7 @@ class HttpTransport {
       const data = await res.json().catch(() => null);
       return { ok: res.ok, status: res.status, data };
     } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
+      return transportFailure(error);
     }
   }
   async put(path, body) {
@@ -6458,7 +6759,7 @@ class HttpTransport {
       const data = await res.json().catch(() => null);
       return { ok: res.ok, status: res.status, data };
     } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
+      return transportFailure(error);
     }
   }
   async delete(path) {
@@ -6470,7 +6771,7 @@ class HttpTransport {
       const data = await res.json().catch(() => null);
       return { ok: res.ok, status: res.status, data };
     } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
+      return transportFailure(error);
     }
   }
   async ping() {
@@ -6483,10 +6784,120 @@ class HttpTransport {
 import { createHash } from "node:crypto";
 import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
 import { basename, join } from "node:path";
+
+// src/shared/project-ref.ts
+var PROJECT_REF_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+function projectRefPathSegment(ref, operation) {
+  if (typeof ref !== "string" || !PROJECT_REF_PATTERN.test(ref)) {
+    throw new Error(`'ref' is invalid for ${operation}`);
+  }
+  return encodeURIComponent(ref);
+}
+
+// src/shared/tools/database-tools.ts
 var MAX_MIGRATION_VERSION = 9223372036854775807n;
 var FALLBACK_MIGRATION_VERSION_BASE = 8000000000000000000n;
 var FALLBACK_MIGRATION_VERSION_RANGE = 1000000000000000000n;
 var FALLBACK_MIGRATION_VERSION_LIMIT = FALLBACK_MIGRATION_VERSION_BASE + FALLBACK_MIGRATION_VERSION_RANGE;
+var MAX_MIGRATION_INVENTORY_BYTES = 64 * 1024 * 1024;
+function isMigrationInventoryVersion(version) {
+  if (typeof version !== "string" || !/^\d{1,19}$/.test(version))
+    return false;
+  const numericVersion = BigInt(version);
+  return numericVersion >= 1n && numericVersion <= MAX_MIGRATION_VERSION && numericVersion.toString() === version;
+}
+function isMigrationInventoryName(name) {
+  return name === null || typeof name === "string" && name.length <= 255 && name.length > 0 && name.trim() === name;
+}
+function isMigrationInventoryStatements(statements) {
+  return Array.isArray(statements) && statements.every((statement) => typeof statement === "string" && statement.length > 0 && statement.trim() === statement && !statement.includes("\r"));
+}
+function isMigrationInventoryAppliedAt(appliedAt) {
+  return appliedAt === null || typeof appliedAt === "string" && appliedAt.trim() === appliedAt && appliedAt.length > 0 && !Number.isNaN(Date.parse(appliedAt));
+}
+function migrationInventoryChecksum(entry) {
+  return createHash("sha256").update(JSON.stringify({
+    version: entry.version,
+    name: entry.name,
+    statements: entry.statements
+  })).digest("hex");
+}
+function migrationInventoryEntry(rawEntry) {
+  if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry))
+    return null;
+  const entry = rawEntry;
+  if (!isMigrationInventoryVersion(entry.version))
+    return null;
+  if (!isMigrationInventoryName(entry.name))
+    return null;
+  if (!isMigrationInventoryStatements(entry.statements))
+    return null;
+  if (typeof entry.statement_count !== "number" || !Number.isInteger(entry.statement_count))
+    return null;
+  if (entry.statement_count !== entry.statements.length)
+    return null;
+  if (typeof entry.checksum !== "string" || !/^[0-9a-f]{64}$/.test(entry.checksum))
+    return null;
+  if (!isMigrationInventoryAppliedAt(entry.applied_at))
+    return null;
+  const migration = {
+    version: entry.version,
+    name: entry.name,
+    statements: entry.statements,
+    statement_count: entry.statement_count,
+    checksum: entry.checksum,
+    applied_at: entry.applied_at
+  };
+  return migration.checksum === migrationInventoryChecksum(migration) ? migration : null;
+}
+function compareMigrationInventoryEntries(left, right) {
+  const leftVersion = BigInt(left.version);
+  const rightVersion = BigInt(right.version);
+  if (leftVersion === rightVersion)
+    return 0;
+  return leftVersion < rightVersion ? -1 : 1;
+}
+function migrationInventory(payload) {
+  if (!Array.isArray(payload))
+    return null;
+  const inventory = [];
+  const versions = new Set;
+  for (const rawEntry of payload) {
+    const entry = migrationInventoryEntry(rawEntry);
+    if (!entry)
+      return null;
+    if (versions.has(entry.version))
+      return null;
+    versions.add(entry.version);
+    inventory.push(entry);
+  }
+  return inventory.sort(compareMigrationInventoryEntries);
+}
+function migrationInventoryPath(ref) {
+  return `/v1/projects/${projectRefPathSegment(ref, "migration_inventory")}/database/migrations`;
+}
+function migrationInventoryFailure(code, httpStatus) {
+  return {
+    isError: true,
+    content: [{
+      type: "text",
+      text: JSON.stringify({
+        ok: false,
+        operation: "database.migration_inventory",
+        error: { code, http_status: httpStatus }
+      }, null, 2)
+    }]
+  };
+}
+function migrationInventoryResponse(response) {
+  if (!response.ok) {
+    return migrationInventoryFailure("HTTP_ERROR", response.transportError ? null : response.status);
+  }
+  const inventory = migrationInventory(response.data);
+  if (!inventory)
+    return migrationInventoryFailure("INVALID_RESPONSE", response.status);
+  return { content: [{ type: "text", text: JSON.stringify(inventory, null, 2) }] };
+}
 function readMigrationFile(dir, file) {
   const rawBytes = readFileSync2(join(dir, file));
   return {
@@ -6638,6 +7049,7 @@ function registerDatabaseTools(server, http, config = {}) {
     "stats",
     "slow_queries",
     "list_migrations",
+    "migration_inventory",
     "project_url",
     "generate_types"
   ];
@@ -6662,7 +7074,7 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
     owner_column: optional(Type.String(), "[create_table_rls owner] UUID owner column matched to auth.uid()")
   }, async (args) => {
     const { action } = args;
-    const ref = projectRef || args.ref;
+    const ref = args.ref || projectRef;
     const schema = args.schema || "public";
     const schemas = args.schemas || ["public"];
     if (args.file && !args.sql) {
@@ -6777,6 +7189,10 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
         text = r.ok ? formatMigrations(r.data) : `❌ Failed (${r.status})`;
         break;
       }
+      case "migration_inventory": {
+        const response = await http.get(migrationInventoryPath(ref), { maxResponseBytes: MAX_MIGRATION_INVENTORY_BYTES });
+        return migrationInventoryResponse(response);
+      }
       case "project_url": {
         const r = await http.get(`/v1/projects/${ref}`);
         text = r.ok ? JSON.stringify({ url: r.data.api?.url || `https://${ref}.supabase.co` }, null, 2) : `❌ Failed (${r.status})`;
@@ -7216,6 +7632,62 @@ function pgToTs(t) {
 }
 
 // src/shared/tools/auth-tools.ts
+var authConfigRecord = Type.Record(Type.String(), Type.Unknown());
+var safeAuthMutationCodes = new Set([
+  "AUTH_RUNTIME_APPLY_FAILED",
+  "SUPAUTH_DEPENDENT_REFRESH_FAILED"
+]);
+function parseAuthConfig(input) {
+  if (typeof input !== "string")
+    return input;
+  try {
+    return JSON.parse(input);
+  } catch (error) {
+    if (!(error instanceof SyntaxError))
+      throw error;
+    throw new Error("Invalid auth config JSON object");
+  }
+}
+var authConfigSchema = decodedSchema(Type.Union([Type.String(), authConfigRecord]), authConfigRecord, parseAuthConfig);
+function safeAuthFailureFields(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return {};
+  const body = payload;
+  const fields = {};
+  if (typeof body.code === "string" && safeAuthMutationCodes.has(body.code)) {
+    fields.code = body.code;
+  }
+  for (const field of ["persisted", "runtime_applied", "dependents_applied"]) {
+    if (typeof body[field] === "boolean")
+      fields[field] = body[field];
+  }
+  if (body.dependent_status === "failed" || body.dependent_status === "unknown") {
+    fields.dependent_status = body.dependent_status;
+  }
+  if (body.runtime_mode === "local" || body.runtime_mode === "owner" || body.runtime_mode === "shared") {
+    fields.runtime_mode = body.runtime_mode;
+  }
+  return fields;
+}
+function safeAuthMutationFailure(response) {
+  return {
+    ok: false,
+    http_status: response.status,
+    ...safeAuthFailureFields(response.data)
+  };
+}
+function authMutationResult(response, successMessage) {
+  if (response.ok) {
+    return { content: [{ type: "text", text: successMessage }] };
+  }
+  return {
+    isError: true,
+    content: [{
+      type: "text",
+      text: JSON.stringify(safeAuthMutationFailure(response), null, 2)
+    }]
+  };
+}
 function formatProviders(data) {
   if (!data || typeof data !== "object")
     return JSON.stringify(data, null, 2);
@@ -7272,7 +7744,7 @@ Actions: list_providers, get_provider, configure_provider, update_provider, disa
     url: optional(Type.String(), "[configure] Custom OAuth URL"),
     app_id: optional(Type.String(), "[wechat_*] WeChat App ID"),
     app_secret: optional(Type.String(), "[wechat_*] WeChat App Secret"),
-    config: optional(Type.Record(Type.String(), Type.Unknown()), "[update_settings/update_config] Config fields")
+    config: optional(authConfigSchema, "[update_settings/update_config] Config fields as a JSON object")
   }, async (args) => {
     const { action, ref, provider, client_id, client_secret, redirect_uri, url, app_id, app_secret, config } = args;
     const need = (f) => {
@@ -7355,8 +7827,7 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status}): ${JSON.stringif
         need("ref");
         if (!config)
           throw new Error("'config' required");
-        text = (await http.patch(`/v1/projects/${ref}/auth/config`, config)).ok ? `✅ Auth settings updated` : `❌ Failed`;
-        break;
+        return authMutationResult(await http.patch(`/v1/projects/${ref}/auth/config`, config), "✅ Auth settings updated");
       case "get_config":
         need("ref");
         text = ok(await http.get(`/v1/projects/${ref}/config/auth`));
@@ -7365,8 +7836,7 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status}): ${JSON.stringif
         need("ref");
         if (!config)
           throw new Error("'config' required");
-        text = (await http.patch(`/v1/projects/${ref}/config/auth`, config)).ok ? `✅ Auth config updated` : `❌ Failed`;
-        break;
+        return authMutationResult(await http.patch(`/v1/projects/${ref}/config/auth`, config), "✅ Auth config updated");
       default:
         text = `❌ Unknown action: ${action}`;
     }
@@ -7374,90 +7844,424 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status}): ${JSON.stringif
   });
 }
 
+// src/shared/tools/release-control-response.ts
+var RELEASE_CONTROL_RESPONSE_SCHEMA = "supacloud.cli.release-control.v1";
+function releaseControlSuccess(operation, payload) {
+  return releaseControlResponse({
+    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
+    ok: true,
+    operation,
+    ...payload
+  });
+}
+function releaseControlFailure(operation, code, httpStatus) {
+  return releaseControlErrorResponse({
+    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
+    ok: false,
+    operation,
+    error: { code, http_status: httpStatus }
+  });
+}
+function releaseControlMutationFailure(operation, response) {
+  const outcomeUnknown = response.transportError || response.status === 408 || response.status >= 500;
+  return outcomeUnknown ? releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.transportError ? null : response.status) : releaseControlFailure(operation, "HTTP_ERROR", response.status);
+}
+function releaseControlResponse(payload) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(payload, null, 2) }]
+  };
+}
+function releaseControlErrorResponse(payload) {
+  return { ...releaseControlResponse(payload), isError: true };
+}
+
 // src/shared/tools/storage-tools.ts
+var MAX_BUCKET_ID_LENGTH = 100;
+var MAX_MIME_TYPE_COUNT = 100;
+var MAX_MIME_TYPE_LENGTH = 255;
+var PROJECT_REF_PATTERN2 = /^[A-Za-z0-9_-]{1,64}$/;
+var BUCKET_ID_PATTERN = new RegExp(`^(?!\\.+$)[A-Za-z0-9._-]{1,${MAX_BUCKET_ID_LENGTH}}$`);
+var MIME_TYPE_PATTERN = /^(?=\S)(?=.*\S$)[^\u0000-\u001f\u007f]+$/;
+var ACTION_ARGUMENTS = {
+  status: new Set(["action"]),
+  list_buckets: new Set(["action", "ref"]),
+  get_bucket: new Set(["action", "ref", "bucket"]),
+  create_bucket: new Set(["action", "ref", "bucket", "public", "file_size_limit", "allowed_mime_types"]),
+  update_bucket: new Set(["action", "ref", "bucket", "public", "file_size_limit", "allowed_mime_types"]),
+  delete_bucket: new Set(["action", "ref", "bucket"]),
+  list_files: new Set(["action", "ref", "bucket"]),
+  upload_base64: new Set(["action", "ref", "bucket", "filename", "base64_content", "mime_type"]),
+  delete_file: new Set(["action", "ref", "bucket", "filename"])
+};
+function normalizedMimeTypes(candidate) {
+  return Array.isArray(candidate) ? candidate.map((mimeType) => typeof mimeType === "string" ? mimeType.trim() : mimeType) : candidate;
+}
+function parseAllowedMimeTypes(input) {
+  if (Array.isArray(input))
+    return normalizedMimeTypes(input);
+  const trimmed = input.trim();
+  if (!trimmed)
+    return [];
+  if (!trimmed.startsWith("[")) {
+    return normalizedMimeTypes(trimmed.split(","));
+  }
+  try {
+    return normalizedMimeTypes(JSON.parse(trimmed));
+  } catch (error) {
+    if (!(error instanceof SyntaxError))
+      throw error;
+    throw new Error("Invalid allowed_mime_types JSON array");
+  }
+}
+var allowedMimeTypesSchema = Type.Optional(decodedSchema(Type.Union([Type.String(), Type.Array(Type.String())]), Type.Array(Type.String({
+  minLength: 1,
+  maxLength: MAX_MIME_TYPE_LENGTH,
+  pattern: MIME_TYPE_PATTERN.source
+}), { maxItems: MAX_MIME_TYPE_COUNT }), parseAllowedMimeTypes));
+var fileSizeLimitSchema = Type.Optional(Type.Integer({
+  minimum: 1,
+  maximum: Number.MAX_SAFE_INTEGER
+}));
+function requiredText(args, field) {
+  const text = args[field];
+  if (typeof text !== "string" || !text.trim()) {
+    throw new Error(`'${field}' required for '${String(args.action)}'`);
+  }
+  return text.trim();
+}
+function validBucketId(bucket) {
+  return BUCKET_ID_PATTERN.test(bucket);
+}
+function requiredProjectRef(args) {
+  const ref = requiredText(args, "ref");
+  if (!PROJECT_REF_PATTERN2.test(ref))
+    throw new Error("'ref' is invalid for Storage buckets");
+  return ref;
+}
+function requiredBucketId(args) {
+  const bucket = requiredText(args, "bucket");
+  if (!validBucketId(bucket))
+    throw new Error("'bucket' is invalid for Storage buckets");
+  return bucket;
+}
+function assertActionArguments(action, args) {
+  const allowedArguments = ACTION_ARGUMENTS[action];
+  if (!allowedArguments)
+    throw new Error(`Unsupported Storage action '${action}'`);
+  const unsupported = Object.keys(args).filter((field) => !allowedArguments.has(field));
+  if (unsupported.length > 0)
+    throw new Error(`'${unsupported[0]}' is not supported for '${action}'`);
+}
+function storageBucketPath(ref, bucket) {
+  if (!PROJECT_REF_PATTERN2.test(ref))
+    throw new Error("'ref' is invalid for Storage buckets");
+  if (bucket !== undefined && !validBucketId(bucket)) {
+    throw new Error("'bucket' is invalid for Storage buckets");
+  }
+  const root = `/v1/projects/${encodeURIComponent(ref)}/storage/buckets`;
+  return bucket === undefined ? root : `${root}/${encodeURIComponent(bucket)}`;
+}
+function bucketRecord(candidate) {
+  return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
+}
+function isFileSizeLimit(candidate) {
+  return candidate === null || typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate > 0;
+}
+function assertBucketSettings(args) {
+  if (args.file_size_limit !== undefined && (args.file_size_limit === null || !isFileSizeLimit(args.file_size_limit))) {
+    throw new Error("'file_size_limit' must be a positive safe integer");
+  }
+  if (args.allowed_mime_types !== undefined && (args.allowed_mime_types === null || !isAllowedMimeTypes(args.allowed_mime_types))) {
+    throw new Error("'allowed_mime_types' is invalid");
+  }
+}
+function isAllowedMimeTypes(candidate) {
+  return candidate === null || Array.isArray(candidate) && candidate.length <= MAX_MIME_TYPE_COUNT && candidate.every((mimeType) => typeof mimeType === "string" && mimeType.length <= MAX_MIME_TYPE_LENGTH && MIME_TYPE_PATTERN.test(mimeType));
+}
+function safeBucket(candidate, expectedBucket) {
+  const bucket = bucketRecord(candidate);
+  if (bucket === null || typeof bucket.id !== "string" || !validBucketId(bucket.id) || typeof bucket.name !== "string" || !validBucketId(bucket.name) || typeof bucket.public !== "boolean" || !isFileSizeLimit(bucket.file_size_limit) || !isAllowedMimeTypes(bucket.allowed_mime_types) || expectedBucket !== undefined && bucket.id !== expectedBucket && bucket.name !== expectedBucket) {
+    return null;
+  }
+  return {
+    id: bucket.id,
+    name: bucket.name,
+    public: bucket.public,
+    file_size_limit: bucket.file_size_limit,
+    allowed_mime_types: bucket.allowed_mime_types === null ? null : [...bucket.allowed_mime_types]
+  };
+}
+function safeExactBucket(candidate, expectedBucket) {
+  const bucket = safeBucket(candidate);
+  return bucket?.id === expectedBucket ? bucket : null;
+}
+function safeBucketList(candidate) {
+  if (!Array.isArray(candidate))
+    return null;
+  const buckets = candidate.map((bucket) => safeBucket(bucket));
+  if (buckets.some((bucket) => bucket === null))
+    return null;
+  const safeBuckets = buckets;
+  const ids = safeBuckets.map((bucket) => bucket.id);
+  const names = safeBuckets.map((bucket) => bucket.name);
+  return new Set(ids).size === ids.length && new Set(names).size === names.length ? safeBuckets : null;
+}
+function safeCreatedBucketReceipt(candidate, expectedBucket, request) {
+  const bucket = bucketRecord(candidate);
+  if (bucket?.id !== expectedBucket || bucket.name !== expectedBucket || bucket.public !== (request.public === true))
+    return null;
+  return { bucket: { id: expectedBucket, name: expectedBucket, public: request.public === true } };
+}
+function safeDeletedBucket(candidate, expectedBucket) {
+  const receipt = bucketRecord(candidate);
+  return receipt?.id === expectedBucket && receipt.deleted === true ? { bucket_id: expectedBucket, deleted: true } : null;
+}
+function mutationReadbackResponse(expectation) {
+  const { operation, ref, response, expectedBucket, request } = expectation;
+  const readback = safeExactBucket(response.data, expectedBucket);
+  const validReadback = readback?.name === expectedBucket && bucketMatchesRequest(readback, request);
+  if (!response.ok || !validReadback || !readback) {
+    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.transportError ? null : response.status);
+  }
+  return releaseControlSuccess(operation, { project_ref: ref, bucket: readback });
+}
+function bucketResponse(expectation) {
+  const { operation, ref, response, operationKind, safePayload } = expectation;
+  if (!response.ok) {
+    return operationKind === "mutation" ? releaseControlMutationFailure(operation, response) : releaseControlFailure(operation, "HTTP_ERROR", response.transportError ? null : response.status);
+  }
+  const payload = safePayload(response.data);
+  if (!payload) {
+    return operationKind === "mutation" ? releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.status) : releaseControlFailure(operation, "INVALID_RESPONSE", null);
+  }
+  return releaseControlSuccess(operation, { project_ref: ref, ...payload });
+}
+function createBucketRequest(args) {
+  assertBucketSettings(args);
+  const request = { name: requiredText(args, "bucket") };
+  if (args.public !== undefined)
+    request.public = args.public;
+  if (args.file_size_limit !== undefined)
+    request.file_size_limit = args.file_size_limit;
+  if (args.allowed_mime_types !== undefined)
+    request.allowed_mime_types = args.allowed_mime_types;
+  return request;
+}
+function updateBucketRequest(args) {
+  assertBucketSettings(args);
+  const request = Object.fromEntries(["public", "file_size_limit", "allowed_mime_types"].filter((field) => args[field] !== undefined).map((field) => [field, args[field]]));
+  if (Object.keys(request).length === 0)
+    throw new Error("Bucket update requires at least one field");
+  return request;
+}
+function equalAllowedMimeTypes(candidate, expected) {
+  if (!Array.isArray(expected))
+    return false;
+  if (expected.length === 0 && candidate === null)
+    return true;
+  return Array.isArray(candidate) && candidate.length === expected.length && candidate.every((mimeType, index) => mimeType === expected[index]);
+}
+function bucketMatchesRequest(candidate, request) {
+  const bucket = bucketRecord(candidate);
+  if (!bucket)
+    return false;
+  if (request.public !== undefined && bucket.public !== request.public)
+    return false;
+  if (request.file_size_limit !== undefined && bucket.file_size_limit !== request.file_size_limit)
+    return false;
+  return request.allowed_mime_types === undefined || equalAllowedMimeTypes(bucket.allowed_mime_types, request.allowed_mime_types);
+}
+async function createBucketMutationReceipt(http, ref, bucket, request) {
+  return bucketResponse({
+    operation: "storage.create_bucket",
+    ref,
+    response: await http.post(storageBucketPath(ref), request),
+    operationKind: "mutation",
+    safePayload: (candidate) => safeCreatedBucketReceipt(candidate, bucket, request)
+  });
+}
+async function updateBucketMutationReceipt(expectation) {
+  const { http, ref, bucket, bucketPath, request } = expectation;
+  return bucketResponse({
+    operation: "storage.update_bucket",
+    ref,
+    response: await http.put(bucketPath, request),
+    operationKind: "mutation",
+    safePayload: (apiPayload) => {
+      const updated = safeExactBucket(apiPayload, bucket);
+      return updated && bucketMatchesRequest(updated, request) ? { bucket: updated } : null;
+    }
+  });
+}
+async function listBuckets(http, args) {
+  const ref = requiredProjectRef(args);
+  return bucketResponse({
+    operation: "storage.list_buckets",
+    ref,
+    response: await http.get(storageBucketPath(ref)),
+    operationKind: "read",
+    safePayload: (candidate) => {
+      const buckets = safeBucketList(candidate);
+      return buckets ? { buckets } : null;
+    }
+  });
+}
+async function getBucket(http, args) {
+  const ref = requiredProjectRef(args);
+  const bucket = requiredBucketId(args);
+  return bucketResponse({
+    operation: "storage.get_bucket",
+    ref,
+    response: await http.get(storageBucketPath(ref, bucket)),
+    operationKind: "read",
+    safePayload: (candidate) => {
+      const safeReadback = safeBucket(candidate, bucket);
+      return safeReadback ? { bucket: safeReadback } : null;
+    }
+  });
+}
+async function createBucket(http, args) {
+  const ref = requiredProjectRef(args);
+  const request = createBucketRequest(args);
+  const bucket = request.name;
+  const bucketPath = storageBucketPath(ref, bucket);
+  const receipt = await createBucketMutationReceipt(http, ref, bucket, request);
+  if (receipt.isError)
+    return receipt;
+  const expectedReadback = { ...request, public: request.public === true };
+  return mutationReadbackResponse({
+    operation: "storage.create_bucket",
+    ref,
+    response: await http.get(bucketPath),
+    expectedBucket: bucket,
+    request: expectedReadback
+  });
+}
+async function updateBucket(http, args) {
+  const ref = requiredProjectRef(args);
+  const bucket = requiredBucketId(args);
+  const request = updateBucketRequest(args);
+  const bucketPath = storageBucketPath(ref, bucket);
+  const receipt = await updateBucketMutationReceipt({ http, ref, bucket, bucketPath, request });
+  if (receipt.isError)
+    return receipt;
+  return mutationReadbackResponse({
+    operation: "storage.update_bucket",
+    ref,
+    response: await http.get(bucketPath),
+    expectedBucket: bucket,
+    request
+  });
+}
+async function deleteBucket(http, args) {
+  const ref = requiredProjectRef(args);
+  const bucket = requiredBucketId(args);
+  const bucketPath = storageBucketPath(ref, bucket);
+  const receipt = bucketResponse({
+    operation: "storage.delete_bucket",
+    ref,
+    response: await http.delete(bucketPath),
+    operationKind: "mutation",
+    safePayload: (candidate) => safeDeletedBucket(candidate, bucket)
+  });
+  if (receipt.isError)
+    return receipt;
+  const readback = await http.get(bucketPath);
+  if (readback.ok || readback.transportError || readback.status !== 404) {
+    return releaseControlFailure("storage.delete_bucket", "OUTCOME_UNKNOWN", readback.transportError ? null : readback.status);
+  }
+  return receipt;
+}
+var BUCKET_ACTION_HANDLERS = {
+  list_buckets: listBuckets,
+  get_bucket: getBucket,
+  create_bucket: createBucket,
+  update_bucket: updateBucket,
+  delete_bucket: deleteBucket
+};
+function executeBucketAction(action, http, args) {
+  if (!Object.hasOwn(BUCKET_ACTION_HANDLERS, action))
+    return null;
+  return BUCKET_ACTION_HANDLERS[action](http, args);
+}
 function registerStorageTools(server, http) {
   server.tool("storage", `S3/MinIO storage management.
-Actions: status, list_buckets, list_files, upload_base64, delete_file`, {
-    action: withDescription(stringEnum(["status", "list_buckets", "list_files", "upload_base64", "delete_file"]), "Action"),
-    ref: optional(Type.String(), "Project ref (required except for 'status')"),
-    bucket: optional(Type.String(), "[list_files/upload/delete] Bucket name"),
-    filename: optional(Type.String(), "[upload/delete] File name/path"),
+Actions: status, list_buckets, get_bucket, create_bucket, update_bucket, delete_bucket, list_files, upload_base64, delete_file`, {
+    action: withDescription(stringEnum([
+      "status",
+      "list_buckets",
+      "get_bucket",
+      "create_bucket",
+      "update_bucket",
+      "delete_bucket",
+      "list_files",
+      "upload_base64",
+      "delete_file"
+    ]), "Action"),
+    ref: optional(Type.String({ pattern: PROJECT_REF_PATTERN2.source }), "[list_buckets/get_bucket/create_bucket/update_bucket/delete_bucket/list_files/upload_base64/delete_file] Project ref"),
+    bucket: optional(Type.String({ pattern: BUCKET_ID_PATTERN.source }), "[get_bucket/create_bucket/update_bucket/delete_bucket/list_files/upload_base64/delete_file] Bucket name or ID"),
+    public: optional(Type.Boolean(), "[create_bucket/update_bucket] Public bucket access"),
+    file_size_limit: withDescription(fileSizeLimitSchema, "[create_bucket/update_bucket] Positive safe-integer per-file size limit in bytes"),
+    allowed_mime_types: withDescription(allowedMimeTypesSchema, "[create_bucket/update_bucket] MIME types as a comma-separated or JSON array"),
+    filename: optional(Type.String(), "[upload_base64/delete_file] File name/path"),
     base64_content: optional(Type.String(), "[upload_base64] Base64 encoded content"),
     mime_type: optional(Type.String(), "[upload_base64] MIME type (default: application/octet-stream)")
   }, async (args) => {
-    const { action, ref, bucket, filename, base64_content, mime_type } = args;
-    const need = (f, v) => {
-      if (!v)
-        throw new Error(`'${f}' required for '${action}'`);
-    };
-    const fmt = (data, label, fmtFn) => {
-      return Array.isArray(data) ? fmtFn(data) : JSON.stringify(data, null, 2);
-    };
+    const action = String(args.action);
+    assertActionArguments(action, args);
+    const bucketAction = executeBucketAction(action, http, args);
+    const bucketActionResponse = bucketAction ? await bucketAction : null;
+    if (bucketActionResponse)
+      return bucketActionResponse;
     let text;
     switch (action) {
       case "status":
         text = JSON.stringify((await http.get("/v1/storage/status")).data, null, 2);
         break;
-      case "list_buckets": {
-        need("ref", ref);
-        const res = await http.get(`/v1/storage/${ref}/buckets`);
-        if (!res.ok) {
-          text = `❌ Failed (${res.status})`;
-          break;
-        }
-        const buckets = res.data;
-        if (!Array.isArray(buckets) || !buckets.length) {
-          text = "No buckets found.";
-          break;
-        }
-        text = `\uD83D\uDCE6 Buckets (${buckets.length}):
-` + buckets.map((b) => `  - ${b.name} (${b.public ? "\uD83D\uDD13 public" : "\uD83D\uDD12 private"})`).join(`
-`);
-        break;
-      }
       case "list_files": {
-        need("ref", ref);
-        need("bucket", bucket);
-        const res = await http.get(`/v1/storage/${ref}/buckets/${bucket}/files`);
-        if (!res.ok) {
-          text = `❌ Failed (${res.status})`;
+        const ref = requiredProjectRef(args);
+        const bucket = requiredBucketId(args);
+        const response = await http.get(`/v1/storage/${ref}/buckets/${bucket}/files`);
+        if (!response.ok) {
+          text = `❌ Failed (${response.status})`;
           break;
         }
-        const files = res.data;
+        const files = response.data;
         if (!Array.isArray(files) || !files.length) {
           text = "No files.";
           break;
         }
         text = `\uD83D\uDCC1 Files (${files.length}):
-` + files.map((f) => `  - ${f.name} (${f.size ? (f.size / 1024).toFixed(1) + "KB" : "?"})`).join(`
+` + files.map((file) => `  - ${file.name} (${file.size ? (file.size / 1024).toFixed(1) + "KB" : "?"})`).join(`
 `);
         break;
       }
       case "upload_base64": {
-        need("ref", ref);
-        need("bucket", bucket);
-        need("filename", filename);
-        need("base64_content", base64_content);
+        const ref = requiredProjectRef(args);
+        const bucket = requiredBucketId(args);
+        const filename = requiredText(args, "filename");
+        const base64Content = requiredText(args, "base64_content");
         try {
-          const buffer = Buffer.from(base64_content, "base64");
-          const blob = new Blob([buffer], { type: mime_type || "application/octet-stream" });
+          const buffer = Buffer.from(base64Content, "base64");
+          const blob = new Blob([buffer], { type: typeof args.mime_type === "string" ? args.mime_type : "application/octet-stream" });
           const formData = new FormData;
           formData.append("file", blob, filename);
-          const res = await http.postMultipart(`/v1/storage/${ref}/buckets/${bucket}/upload`, formData);
-          text = res.ok ? `✅ File ${filename} uploaded to ${bucket}` : `❌ Upload failed (${res.status})`;
-        } catch (e) {
-          text = `❌ Error: ${e.message}`;
+          const response = await http.postMultipart(`/v1/storage/${ref}/buckets/${bucket}/upload`, formData);
+          text = response.ok ? `✅ File ${filename} uploaded to ${bucket}` : `❌ Upload failed (${response.status})`;
+        } catch (error) {
+          text = `❌ Error: ${error instanceof Error ? error.message : String(error)}`;
         }
         break;
       }
-      case "delete_file":
-        need("ref", ref);
-        need("bucket", bucket);
-        need("filename", filename);
-        text = (await http.delete(`/v1/storage/${ref}/buckets/${bucket}/files/${filename}`)).ok ? `✅ File ${filename} deleted` : `❌ Failed`;
+      case "delete_file": {
+        const ref = requiredProjectRef(args);
+        const bucket = requiredBucketId(args);
+        const filename = requiredText(args, "filename");
+        text = (await http.delete(`/v1/storage/${ref}/buckets/${bucket}/files/${filename}`)).ok ? `✅ File ${filename} deleted` : "❌ Failed";
         break;
+      }
       default:
-        text = `❌ Unknown action: ${action}`;
+        return releaseControlFailure(`storage.${action}`, "INVALID_RESPONSE", null);
     }
     return { content: [{ type: "text", text }] };
   });
@@ -7540,7 +8344,29 @@ function parseFunctionFiles(input) {
   }
 }
 var functionFilesSchema = decodedSchema(Type.Union([Type.String(), functionFilesRecordSchema]), functionFilesRecordSchema, parseFunctionFiles);
+function parseFunctionVersion(input) {
+  const version = String(input);
+  if (!CANONICAL_FUNCTION_VERSION_PATTERN.test(version) || !Number.isSafeInteger(Number(version))) {
+    throw new Error("Function version must be a canonical safe integer");
+  }
+  return version;
+}
+var CANONICAL_FUNCTION_VERSION_PATTERN = /^(?:0|[1-9][0-9]*)$/;
+var SAFE_FUNCTION_REF_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+var SAFE_FUNCTION_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+var FUNCTION_ACTIVATION_ARGUMENTS = new Set(["action", "ref", "slug", "version"]);
+var functionVersionSchema = Type.Optional(decodedSchema(Type.Union([
+  Type.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),
+  Type.String({ pattern: CANONICAL_FUNCTION_VERSION_PATTERN.source, maxLength: 16 })
+]), Type.String({ pattern: CANONICAL_FUNCTION_VERSION_PATTERN.source, maxLength: 16 }), parseFunctionVersion));
 var secretListSchema = Type.Array(Type.Object({ name: Type.String(), value: Type.String() }));
+var ENVIRONMENT_SECRET_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
+var MAX_SECRET_COUNT = 1024;
+var MAX_ENVIRONMENT_SECRET_BYTES = 24 * 1024;
+var MAX_SECRET_JSON_BYTES = 1024 * 1024;
+var INVALID_ENVIRONMENT_SECRET_NAMES_MESSAGE = "Environment secret names are invalid";
+var INVALID_ENVIRONMENT_SECRET_VALUES_MESSAGE = "Environment secret values are missing or exceed safe limits";
+var INVALID_SECRET_LIST_RESPONSE = "❌ Project secret list response is invalid";
 function parseSecrets(value) {
   if (Array.isArray(value))
     return value;
@@ -7567,6 +8393,89 @@ function parseSecrets(value) {
   }).filter((entry) => entry.name);
 }
 var secretsSchema = Type.Optional(decodedSchema(Type.Union([Type.String(), secretListSchema]), secretListSchema, parseSecrets));
+function validEnvironmentSecretNames(names) {
+  if (names.length === 0 || names.length > MAX_SECRET_COUNT)
+    return false;
+  const uniqueNames = new Set;
+  for (const name of names) {
+    if (!ENVIRONMENT_SECRET_NAME_PATTERN.test(name) || uniqueNames.has(name))
+      return false;
+    uniqueNames.add(name);
+  }
+  return true;
+}
+function parseEnvironmentSecretNames(input) {
+  const names = input.split(",", MAX_SECRET_COUNT + 1).map((name) => name.trim());
+  if (!validEnvironmentSecretNames(names)) {
+    throw new Error(INVALID_ENVIRONMENT_SECRET_NAMES_MESSAGE);
+  }
+  return names;
+}
+var environmentSecretNamesSchema = Type.Optional(decodedSchema(Type.String(), Type.Array(Type.String({ pattern: ENVIRONMENT_SECRET_NAME_PATTERN.source }), {
+  minItems: 1,
+  maxItems: MAX_SECRET_COUNT,
+  uniqueItems: true
+}), parseEnvironmentSecretNames));
+function jsonWithinSecretLimit(payload) {
+  try {
+    const serializedPayload = JSON.stringify(payload);
+    return serializedPayload !== undefined && Buffer.byteLength(serializedPayload) <= MAX_SECRET_JSON_BYTES;
+  } catch (error) {
+    if (error instanceof TypeError)
+      return false;
+    throw error;
+  }
+}
+function maskedSecretEntry(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const { name, value } = candidate;
+  if (typeof name !== "string" || !ENVIRONMENT_SECRET_NAME_PATTERN.test(name))
+    return null;
+  if (value !== "********")
+    return null;
+  return { name, value: "********" };
+}
+function projectedMaskedSecrets(payload) {
+  if (!Array.isArray(payload) || payload.length > MAX_SECRET_COUNT)
+    return null;
+  if (!jsonWithinSecretLimit(payload))
+    return null;
+  const secretNames = new Set;
+  const projectedSecrets = [];
+  for (const candidate of payload) {
+    const secret = maskedSecretEntry(candidate);
+    if (!secret || secretNames.has(secret.name))
+      return null;
+    secretNames.add(secret.name);
+    projectedSecrets.push(secret);
+  }
+  return projectedSecrets;
+}
+function secretsFromEnvironment(names, environment) {
+  const secrets = names.map((name) => {
+    const secretValue = environment[name];
+    if (typeof secretValue !== "string" || secretValue.length === 0 || Buffer.byteLength(secretValue) > MAX_ENVIRONMENT_SECRET_BYTES) {
+      throw new Error(INVALID_ENVIRONMENT_SECRET_VALUES_MESSAGE);
+    }
+    return { name, value: secretValue };
+  });
+  if (!jsonWithinSecretLimit(secrets)) {
+    throw new Error(INVALID_ENVIRONMENT_SECRET_VALUES_MESSAGE);
+  }
+  return secrets;
+}
+function secretsForUpsert(inlineSecrets, environmentNames, environment) {
+  if (inlineSecrets !== undefined && environmentNames !== undefined) {
+    throw new Error("'--from-env' cannot be combined with '--secrets'");
+  }
+  if (environmentNames !== undefined) {
+    return secretsFromEnvironment(environmentNames, environment);
+  }
+  if (!inlineSecrets?.length)
+    throw new Error("'secrets' array required");
+  return inlineSecrets;
+}
 function confirmedFunctionConfig(payload, expected) {
   if (!payload || typeof payload !== "object" || Array.isArray(payload))
     return false;
@@ -7587,12 +8496,60 @@ function functionSourceCode(payload) {
   const code = payload.code;
   return typeof code === "string" ? code : null;
 }
-function registerAdvancedTools(server, http) {
+function objectRecord(candidate) {
+  return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
+}
+function activationResponse(slug, version, response) {
+  const operation = "edge_functions.activate";
+  if (!response.ok)
+    return releaseControlMutationFailure(operation, response);
+  const receipt = objectRecord(response.data);
+  const config = objectRecord(receipt?.config);
+  if (receipt?.success !== true || receipt.version !== version || config?.version !== version || typeof config.verify_jwt !== "boolean") {
+    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.status);
+  }
+  return releaseControlSuccess(operation, {
+    slug,
+    version,
+    verify_jwt: config.verify_jwt
+  });
+}
+function readOnlyActivationResult() {
+  return {
+    isError: true,
+    content: [{ type: "text", text: "⚠️ Edge Function activation blocked in read-only mode." }]
+  };
+}
+function functionActivationTarget(args) {
+  const projectRef = typeof args.ref === "string" ? args.ref.trim() : "";
+  const functionSlug = typeof args.slug === "string" ? args.slug.trim() : "";
+  const version = args.version;
+  if (!SAFE_FUNCTION_REF_PATTERN.test(projectRef))
+    throw new Error("'ref' is invalid for 'activate'");
+  if (!SAFE_FUNCTION_SLUG_PATTERN.test(functionSlug))
+    throw new Error("'slug' is invalid for 'activate'");
+  if (typeof version !== "string" || !CANONICAL_FUNCTION_VERSION_PATTERN.test(version) || !Number.isSafeInteger(Number(version))) {
+    throw new Error("'version' is invalid for 'activate'");
+  }
+  return { projectRef, functionSlug, version };
+}
+async function activateFunctionVersion(http, args, readOnly = false) {
+  if (readOnly)
+    return readOnlyActivationResult();
+  const unsupported = Object.keys(args).filter((name) => !FUNCTION_ACTIVATION_ARGUMENTS.has(name));
+  if (unsupported.length > 0)
+    throw new Error(`'${unsupported[0]}' is not supported for 'activate'`);
+  const { projectRef, functionSlug, version } = functionActivationTarget(args);
+  const endpoint = `/v1/projects/${encodeURIComponent(projectRef)}/functions/${encodeURIComponent(functionSlug)}` + `/versions/${encodeURIComponent(version)}/activate`;
+  return activationResponse(functionSlug, version, await http.post(endpoint));
+}
+function registerAdvancedTools(server, http, environment = process.env, options = {}) {
   server.tool("edge_functions", `Edge Function management (Deno/Bun serverless). Server auto-bundles dependencies.
-Actions: list, deploy, deploy_bundle, config, source, delete, check`, {
-    action: withDescription(stringEnum(["list", "deploy", "deploy_bundle", "config", "source", "delete", "check"]), "Action"),
+Actions: list, deploy, deploy_bundle, config, source, activate, delete, check`, {
+    action: withDescription(stringEnum(["list", "deploy", "deploy_bundle", "config", "source", "activate", "delete", "check"]), "Action"),
     ref: withDescription(Type.String(), "Project ref"),
-    slug: optional(Type.String(), "[deploy/deploy_bundle/config/source/delete/check] Function name"),
+    slug: optional(Type.String(), "[deploy/deploy_bundle/config/source/activate/delete/check] Function name"),
+    version: withDescription(functionVersionSchema, "[activate] Existing Function version"),
     code: optional(Type.String(), "[deploy/check] Function source code (TypeScript)"),
     path: optional(Type.String(), "[deploy/check] Local file path to read code from (alternative to code)"),
     output: optional(Type.String(), "[source] Write source to this local file instead of stdout; the file must not already exist"),
@@ -7602,6 +8559,8 @@ Actions: list, deploy, deploy_bundle, config, source, delete, check`, {
     verify_jwt: optional(Type.Boolean(), "[deploy/deploy_bundle/config] Set JWT verification for this function"),
     background_routes: withDescription(backgroundRoutesSchema, "[deploy/deploy_bundle/config] Background route paths; pass comma-separated or JSON array in CLI")
   }, async (args) => {
+    if (args.action === "activate")
+      return activateFunctionVersion(http, args, options.readOnly);
     const { action, ref, slug, path: pathArg, output, files, entrypoint, minify, verify_jwt, background_routes } = args;
     let code = args.code;
     const need = (f, v) => {
@@ -7737,18 +8696,28 @@ Actions: list, upsert, delete`, {
     action: withDescription(stringEnum(["list", "upsert", "delete"]), "Action"),
     ref: withDescription(Type.String(), "Project ref"),
     secrets: withDescription(secretsSchema, "[upsert] Secret list as JSON array or KEY=VALUE,KEY2=VALUE2"),
+    "from-env": withDescription(environmentSecretNamesSchema, "[upsert] Comma-separated environment variable names; values are read from this CLI process"),
     name: optional(Type.String(), "[delete] Secret name to delete")
   }, async (args) => {
     const { action, ref, secrets, name } = args;
+    const environmentNames = args["from-env"];
     let text;
     switch (action) {
-      case "list":
-        text = JSON.stringify((await http.get(`/v1/projects/${ref}/secrets`)).data, null, 2);
+      case "list": {
+        const response = await http.get(`/v1/projects/${ref}/secrets`, {
+          maxResponseBytes: MAX_SECRET_JSON_BYTES
+        });
+        if (!response.ok) {
+          text = `❌ Failed (${response.status})`;
+          break;
+        }
+        const maskedSecrets = projectedMaskedSecrets(response.data);
+        text = maskedSecrets === null ? INVALID_SECRET_LIST_RESPONSE : JSON.stringify(maskedSecrets, null, 2);
         break;
+      }
       case "upsert":
-        if (!secrets?.length)
-          throw new Error("'secrets' array required");
-        text = (await http.post(`/v1/projects/${ref}/secrets`, secrets)).ok ? `✅ Updated ${secrets.length} secrets` : `❌ Failed`;
+        const secretsToUpsert = secretsForUpsert(secrets, environmentNames, environment);
+        text = (await http.post(`/v1/projects/${ref}/secrets`, secretsToUpsert)).ok ? `✅ Updated ${secretsToUpsert.length} secrets` : `❌ Failed`;
         break;
       case "delete":
         if (!name)
@@ -8171,7 +9140,7 @@ function buildProjectLogsPath(ref, logType) {
   return `/v1/projects/${ref}/logs?${params.toString()}`;
 }
 function resolveRef(refFromArgs, defaultRef) {
-  const ref = defaultRef || refFromArgs;
+  const ref = refFromArgs || defaultRef;
   if (!ref)
     throw new Error("'ref' is required for this action");
   return ref;
@@ -8360,7 +9329,7 @@ function formatMessages(data, label = "Messages") {
   return out;
 }
 function resolveRef2(refFromArgs, defaultRef) {
-  const ref = defaultRef || refFromArgs;
+  const ref = refFromArgs || defaultRef;
   if (!ref)
     throw new Error("'ref' is required for this action");
   return ref;
@@ -8660,7 +9629,7 @@ Actions: routes, upsert_route, update_route, delete_route, config, get_certifica
     custom_hostname: optional(Type.String(), "[set_custom_hostname] 自定义域名")
   }, async (args) => {
     const resolveRef3 = (override) => {
-      const ref2 = projectRef || override;
+      const ref2 = override || projectRef;
       if (!ref2)
         throw new Error("'ref' is required for this action");
       return ref2;
@@ -9602,6 +10571,414 @@ function registerAiTools(server) {
   });
 }
 
+// src/shared/tools/scheduled-function-tools.ts
+import { randomUUID } from "node:crypto";
+import { readFileSync as readFileSync6, statSync as statSync4 } from "node:fs";
+import { resolve as resolve5 } from "node:path";
+import { isDeepStrictEqual } from "node:util";
+var HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/;
+var ENVIRONMENT_NAME_PATTERN2 = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
+var FORBIDDEN_HEADER_NAMES = new Set([
+  "apikey",
+  "authorization",
+  "connection",
+  "content-length",
+  "forwarded",
+  "host",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "proxy-connection",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  "via",
+  "x-project-ref"
+]);
+var SCHEDULE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var SAFE_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+var CRON_PART_PATTERN = /^(\*|([0-9]+)(?:-([0-9]+))?)(?:\/([0-9]+))?$/;
+var CRON_FIELD_BOUNDS = [[0, 59], [0, 23], [1, 31], [1, 12], [0, 7]];
+var MAX_CRON_EXPRESSION_LENGTH = 256;
+var MAX_BODY_FILE_BYTES = 1048576;
+var MAX_HEADER_COUNT = 64;
+var MAX_HEADER_VALUE_LENGTH = 8192;
+var MAX_SCHEDULE_NAME_LENGTH = 120;
+var headerEnvironmentRecord = Type.Record(Type.String(), Type.String());
+var ACTION_ARGUMENTS2 = {
+  list: new Set(["action", "ref"]),
+  create: new Set(["action", "ref", "name", "slug", "cron", "method", "body_file", "header_env"]),
+  update: new Set(["action", "ref", "schedule_id", "name", "cron", "method", "enabled", "body_file", "header_env"]),
+  delete: new Set(["action", "ref", "schedule_id"])
+};
+function parseHeaderEnvironment(input) {
+  if (typeof input !== "string")
+    return input;
+  try {
+    return JSON.parse(input);
+  } catch (error) {
+    if (!(error instanceof SyntaxError))
+      throw error;
+    throw new Error("Invalid header_env JSON object");
+  }
+}
+var headerEnvironmentSchema = Type.Optional(decodedSchema(Type.Union([Type.String(), headerEnvironmentRecord]), headerEnvironmentRecord, parseHeaderEnvironment));
+function objectRecord2(candidate) {
+  return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
+}
+function boundedCronInteger(input, minimum, maximum) {
+  const parsed = Number(input);
+  return Number.isSafeInteger(parsed) && parsed >= minimum && parsed <= maximum;
+}
+function validCronPart(part, minimum, maximum) {
+  const match = CRON_PART_PATTERN.exec(part);
+  if (!match)
+    return false;
+  const start = match[1] === "*" ? minimum : Number(match[2]);
+  const end = match[1] === "*" ? maximum : Number(match[3] ?? match[2]);
+  const step = Number(match[4] ?? "1");
+  return boundedCronInteger(String(start), minimum, maximum) && boundedCronInteger(String(end), minimum, maximum) && start <= end && boundedCronInteger(String(step), 1, maximum - minimum + 1);
+}
+function validCronField(field, minimum, maximum) {
+  const parts = field.split(",");
+  return parts.length <= maximum - minimum + 1 && parts.every((part) => part.length > 0 && validCronPart(part, minimum, maximum));
+}
+function validScheduledFunctionCron(expression) {
+  if (!expression || expression.length > MAX_CRON_EXPRESSION_LENGTH)
+    return false;
+  const fields = expression.trim().split(/\s+/);
+  return fields.length === CRON_FIELD_BOUNDS.length && fields.every((field, index) => {
+    const [minimum, maximum] = CRON_FIELD_BOUNDS[index];
+    return validCronField(field, minimum, maximum);
+  });
+}
+function readScheduleBodyFile(bodyPathInput) {
+  if (!bodyPathInput.trim())
+    throw new Error("'body_file' must be a path");
+  const bodyPath = resolve5(bodyPathInput);
+  const bodyStat = statSync4(bodyPath);
+  if (!bodyStat.isFile() || bodyStat.size > MAX_BODY_FILE_BYTES) {
+    throw new Error("Scheduled Function body file must be a regular file no larger than 1 MiB");
+  }
+  let payload;
+  try {
+    payload = JSON.parse(readFileSync6(bodyPath, "utf8"));
+  } catch (error) {
+    if (!(error instanceof SyntaxError))
+      throw error;
+    throw new Error("Scheduled Function body file must contain exact JSON");
+  }
+  const body = objectRecord2(payload);
+  if (!body)
+    throw new Error("Scheduled Function body file must contain a JSON object");
+  return body;
+}
+function scheduleBody(bodyFile) {
+  if (bodyFile === undefined)
+    return;
+  if (typeof bodyFile !== "string")
+    throw new Error("'body_file' must be a path");
+  return readScheduleBodyFile(bodyFile);
+}
+function resolvedHeaderEntry(headerName, environmentName, environment) {
+  const normalizedName = headerName.toLowerCase();
+  if (!HEADER_NAME_PATTERN.test(headerName) || forbiddenHeaderName(normalizedName) || typeof environmentName !== "string" || !ENVIRONMENT_NAME_PATTERN2.test(environmentName)) {
+    throw new Error("SCHEDULE_HEADER_MAPPING_INVALID");
+  }
+  const headerValue = environment[environmentName];
+  if (!headerValue)
+    throw new Error("SCHEDULE_HEADER_ENV_MISSING");
+  if (!headerValueIsStable(normalizedName, headerValue))
+    throw new Error("SCHEDULE_HEADER_INVALID");
+  return [normalizedName, headerValue];
+}
+function forbiddenHeaderName(name) {
+  return FORBIDDEN_HEADER_NAMES.has(name) || name.startsWith("x-forwarded-");
+}
+function headerValueIsStable(name, value) {
+  if (!value || value.length > MAX_HEADER_VALUE_LENGTH)
+    return false;
+  try {
+    const headers = new Headers;
+    headers.set(name, value);
+    return headers.get(name) === value;
+  } catch {
+    return false;
+  }
+}
+function scheduleHeaders(mapping, environment) {
+  if (mapping === undefined)
+    return;
+  const headerEnvironment = objectRecord2(mapping);
+  if (!headerEnvironment)
+    throw new Error("'header_env' must be a JSON object");
+  const entries = Object.entries(headerEnvironment).map(([headerName, environmentName]) => resolvedHeaderEntry(headerName, environmentName, environment));
+  const names = entries.map(([name]) => name);
+  if (entries.length > MAX_HEADER_COUNT || new Set(names).size !== names.length) {
+    throw new Error("SCHEDULE_HEADER_INVALID");
+  }
+  return Object.fromEntries(entries);
+}
+function validSafeSchedule(schedule) {
+  return validScheduleIdentity(schedule) && validScheduleDefinition(schedule) && validScheduleMetadata(schedule);
+}
+function validScheduleIdentity(schedule) {
+  return typeof schedule.id === "string" && SCHEDULE_ID_PATTERN.test(schedule.id) && typeof schedule.name === "string" && schedule.name.trim().length > 0 && schedule.name.length <= MAX_SCHEDULE_NAME_LENGTH && typeof schedule.slug === "string" && SAFE_SLUG_PATTERN.test(schedule.slug);
+}
+function validScheduleDefinition(schedule) {
+  return typeof schedule.cron === "string" && validScheduledFunctionCron(schedule.cron) && (schedule.method === "GET" || schedule.method === "POST") && typeof schedule.enabled === "boolean";
+}
+function validScheduleMetadata(schedule) {
+  return typeof schedule.created_at === "string" && typeof schedule.updated_at === "string";
+}
+function safeSchedulePayload(schedule) {
+  const headerNames = safeHeaderNames(schedule.header_names);
+  if (typeof schedule.body_empty !== "boolean" || !headerNames)
+    return null;
+  return { body_empty: schedule.body_empty, header_names: headerNames };
+}
+function safeHeaderNames(candidate) {
+  if (!Array.isArray(candidate) || candidate.length > MAX_HEADER_COUNT)
+    return null;
+  const names = candidate.map((name) => typeof name === "string" ? name.toLowerCase() : "");
+  const valid = candidate.every((name, index) => typeof name === "string" && HEADER_NAME_PATTERN.test(name) && !forbiddenHeaderName(names[index]));
+  return valid && new Set(names).size === names.length ? names.sort() : null;
+}
+function safeSchedule(candidate) {
+  const schedule = objectRecord2(candidate);
+  if (!schedule || !validSafeSchedule(schedule))
+    return null;
+  const safePayload = safeSchedulePayload(schedule);
+  if (!safePayload)
+    return null;
+  return {
+    id: schedule.id,
+    name: schedule.name,
+    slug: schedule.slug,
+    cron: schedule.cron,
+    method: schedule.method,
+    enabled: schedule.enabled,
+    ...safePayload,
+    created_at: schedule.created_at,
+    updated_at: schedule.updated_at
+  };
+}
+function requiredText2(args, name, action) {
+  const candidate = args[name];
+  if (typeof candidate !== "string" || !candidate.trim()) {
+    throw new Error(`'${name}' is required for '${action}'`);
+  }
+  return candidate.trim();
+}
+function assertActionArguments2(action, args) {
+  const unsupported = Object.keys(args).filter((name) => !ACTION_ARGUMENTS2[action].has(name));
+  if (unsupported.length > 0) {
+    throw new Error(`'${unsupported[0]}' is not supported for '${action}'`);
+  }
+}
+function schedulePath(ref, scheduleId) {
+  const projectRefSegment = projectRefPathSegment(ref, "Scheduled Functions");
+  if (scheduleId !== undefined && !SCHEDULE_ID_PATTERN.test(scheduleId)) {
+    throw new Error("'schedule_id' is invalid");
+  }
+  const root = `/v1/projects/${projectRefSegment}/scheduled-functions`;
+  return scheduleId ? `${root}/${encodeURIComponent(scheduleId)}` : root;
+}
+function scheduleFailure(operation, response) {
+  return releaseControlFailure(operation, "HTTP_ERROR", response.transportError ? null : response.status);
+}
+function listResponse(ref, response) {
+  const operation = "scheduled_functions.list";
+  if (!response.ok)
+    return scheduleFailure(operation, response);
+  const payload = objectRecord2(response.data);
+  const rawSchedules = payload?.schedules;
+  const schedules = Array.isArray(rawSchedules) ? rawSchedules.map(safeSchedule) : null;
+  if (payload?.project_ref !== ref || !schedules || schedules.some((schedule) => !schedule)) {
+    return releaseControlFailure(operation, "INVALID_RESPONSE", null);
+  }
+  const ids = schedules.map((schedule) => schedule.id);
+  if (new Set(ids).size !== ids.length)
+    return releaseControlFailure(operation, "INVALID_RESPONSE", null);
+  return releaseControlSuccess(operation, { project_ref: ref, schedules });
+}
+function mutationResponse(expectation, response) {
+  const { action, ref, requestId, expectedFields } = expectation;
+  const scheduleId = action === "update" ? expectation.scheduleId : undefined;
+  const operation = `scheduled_functions.${action}`;
+  if (!response.ok)
+    return releaseControlMutationFailure(operation, response);
+  const payload = objectRecord2(response.data);
+  const schedule = safeSchedule(payload?.schedule);
+  const confirmsRequest = schedule && Object.entries(expectedFields).every(([field, expected]) => isDeepStrictEqual(schedule[field], expected));
+  if (payload?.project_ref !== ref || payload.request_id !== requestId || payload?.[action === "create" ? "created" : "updated"] !== true || !schedule || !confirmsRequest || scheduleId !== undefined && schedule.id !== scheduleId) {
+    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.status);
+  }
+  return releaseControlSuccess(operation, { project_ref: ref, request_id: requestId, schedule });
+}
+function deleteResponse(ref, scheduleId, response) {
+  const operation = "scheduled_functions.delete";
+  if (!response.ok)
+    return releaseControlMutationFailure(operation, response);
+  const payload = objectRecord2(response.data);
+  if (payload?.deleted !== true || payload.project_ref !== ref || payload.schedule_id !== scheduleId) {
+    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.status);
+  }
+  return releaseControlSuccess(operation, {
+    project_ref: ref,
+    schedule_id: scheduleId,
+    deleted: true
+  });
+}
+function readOnlyResult2() {
+  return {
+    isError: true,
+    content: [{ type: "text", text: "⚠️ Scheduled Function write blocked in read-only mode." }]
+  };
+}
+function createRequest(args, environment) {
+  return {
+    request_id: randomUUID(),
+    name: requiredName(args, "create"),
+    slug: requiredSlug(args, "create"),
+    cron: requiredCron(args, "create"),
+    method: requiredText2(args, "method", "create"),
+    body: scheduleBody(args.body_file) ?? {},
+    headers: scheduleHeaders(args.header_env, environment) ?? {}
+  };
+}
+function safeMutationFields(request) {
+  const safeFields = Object.fromEntries(["name", "slug", "cron", "method", "enabled"].filter((field) => request[field] !== undefined).map((field) => [field, request[field]]));
+  if (request.body !== undefined) {
+    safeFields.body_empty = Object.keys(request.body).length === 0;
+  }
+  if (request.headers !== undefined) {
+    safeFields.header_names = Object.keys(request.headers).sort();
+  }
+  return safeFields;
+}
+function requiredName(args, action) {
+  const name = requiredText2(args, "name", action);
+  if (name.length > MAX_SCHEDULE_NAME_LENGTH)
+    throw new Error(`'name' is too long for '${action}'`);
+  return name;
+}
+function requiredSlug(args, action) {
+  const slug = requiredText2(args, "slug", action);
+  if (!SAFE_SLUG_PATTERN.test(slug))
+    throw new Error(`'slug' is invalid for '${action}'`);
+  return slug;
+}
+function requiredCron(args, action) {
+  const cron = requiredText2(args, "cron", action);
+  if (!validScheduledFunctionCron(cron))
+    throw new Error(`'cron' is invalid for '${action}'`);
+  return cron;
+}
+function updateRequest(args, environment) {
+  const body = scheduleBody(args.body_file);
+  const headers = scheduleHeaders(args.header_env, environment);
+  const cron = args.cron === undefined ? undefined : requiredCron(args, "update");
+  const name = args.name === undefined ? undefined : requiredName(args, "update");
+  const mutationFields = Object.fromEntries([
+    ["name", name],
+    ["cron", cron],
+    ["method", args.method],
+    ["enabled", args.enabled],
+    ["body", body],
+    ["headers", headers]
+  ].filter((entry) => entry[1] !== undefined));
+  if (Object.keys(mutationFields).length === 0) {
+    throw new Error("Scheduled Function update requires at least one field");
+  }
+  return { request_id: randomUUID(), ...mutationFields };
+}
+async function executeScheduleAction(http, environment, args, readOnly = false) {
+  const action = args.action;
+  if (readOnly && action !== "list")
+    return readOnlyResult2();
+  assertActionArguments2(action, args);
+  const ref = requiredText2(args, "ref", action);
+  if (action === "list")
+    return listResponse(ref, await http.get(schedulePath(ref)));
+  if (action === "create") {
+    const request = createRequest(args, environment);
+    const requestId = request.request_id;
+    return mutationResponse({ action, ref, requestId, expectedFields: safeMutationFields(request) }, await http.post(schedulePath(ref), request));
+  }
+  const scheduleId = requiredText2(args, "schedule_id", action);
+  if (action === "update") {
+    const request = updateRequest(args, environment);
+    const requestId = request.request_id;
+    return mutationResponse({
+      action,
+      ref,
+      scheduleId,
+      requestId,
+      expectedFields: safeMutationFields(request)
+    }, await http.patch(schedulePath(ref, scheduleId), request));
+  }
+  return deleteResponse(ref, scheduleId, await http.delete(schedulePath(ref, scheduleId)));
+}
+function registerScheduledFunctionTools(server, http, environment = process.env, options = {}) {
+  server.tool("scheduled_functions", SCHEDULE_TOOL_DESCRIPTION, SCHEDULE_TOOL_SCHEMA, (args) => executeScheduleAction(http, environment, args, options.readOnly));
+}
+var SCHEDULE_TOOL_DESCRIPTION = "Scheduled Edge Function lifecycle. Actions: list, create, update, delete";
+var SCHEDULE_TOOL_SCHEMA = {
+  action: withDescription(stringEnum(["list", "create", "update", "delete"]), "Action"),
+  ref: withDescription(Type.String(), "Project ref"),
+  schedule_id: optional(Type.String(), "[update/delete] Schedule ID"),
+  name: optional(Type.String(), "[create/update] Display name"),
+  slug: optional(Type.String(), "[create] Edge Function slug"),
+  cron: optional(Type.String(), "[create/update] Five-field cron expression"),
+  method: optional(stringEnum(["GET", "POST"]), "[create/update] HTTP method"),
+  enabled: optional(Type.Boolean(), "[update] Enabled state"),
+  body_file: optional(Type.String(), "[create/update] Local JSON object file; content is never printed"),
+  header_env: withDescription(headerEnvironmentSchema, "[create/update] JSON map of HTTP header names to environment variable names")
+};
+// package.json
+var package_default = {
+  name: "@supacloud/cli",
+  version: "0.16.0",
+  description: "Project-scoped CLI for SupaCloud users",
+  type: "module",
+  main: "./dist/index.js",
+  bin: {
+    "supacloud-cli": "dist/index.js"
+  },
+  files: [
+    "dist",
+    "README.md",
+    "skills"
+  ],
+  scripts: {
+    dev: "bun run --watch src/index.ts",
+    build: "bun build src/index.ts --outdir dist --target node",
+    prepublishOnly: "bun run build",
+    typecheck: "tsc --noEmit"
+  },
+  keywords: [
+    "supacloud",
+    "cli",
+    "deploy",
+    "supabase"
+  ],
+  license: "MIT",
+  repository: {
+    type: "git",
+    url: "https://github.com/zuohuadong/supacloud.git",
+    directory: "packages/cli"
+  },
+  dependencies: {
+    "@sinclair/typebox": "^0.34.52"
+  },
+  devDependencies: {
+    "@types/bun": "^1.3.14",
+    typescript: "^7.0.2"
+  }
+};
+
 // src/index.ts
 var commandName = "supacloud-cli";
 var preferredCommand = commandName;
@@ -9679,9 +11056,12 @@ async function createProjectStatusResult(context) {
   const checks = await collectProjectStatusChecks(context);
   const statusPayload = {
     mode: "project",
-    source: context.source,
+    environment: context.environment || null,
+    source: { kind: context.source, path: context.sourcePath },
     projectRef: context.projectRef || null,
     apiUrl: context.apiUrl || null,
+    readOnly: context.readOnly,
+    production: context.production,
     autoLinked: Boolean(context.inferredSupabaseUrl && context.inferredServiceRoleKey),
     hasApiToken: Boolean(context.apiToken),
     checks
@@ -9714,7 +11094,7 @@ function captureTools(register) {
   register(server);
   return tools;
 }
-function printHelp(context = resolveSupaCloudContext()) {
+function printHelp(context) {
   const autoLink = context.inferredSupabaseUrl ? `Project context: ${context.inferredSupabaseUrl} (${context.source})` : "Project context: not detected";
   console.error(`
 ╔═══════════════════════════════════════════════════════════╗
@@ -9724,18 +11104,31 @@ function printHelp(context = resolveSupaCloudContext()) {
 
 USAGE
 
-  ${preferredCommand} <module> <action> [--flags]
-  ${preferredCommand} status
+  ${preferredCommand} [global flags] <module> <action> [--flags]
+  ${preferredCommand} [global flags] status
   ${preferredCommand} --help
+  ${preferredCommand} --version
+
+GLOBAL FLAGS
+
+  --env <name>                    Load .env.supacloud.<name> from the current directory.
+  --env-file <path>               Load an exact file that declares SUPACLOUD_ENV.
+  --confirm-production <ref>      Confirm a write to the selected production project.
+
+  Global flags may appear before or after the command. --env and --env-file are
+  mutually exclusive, and a selected source is never mixed with another source.
 
 DEFAULT CONTEXT
 
-  Unauthenticated runs default to the current project's .env.
+  Without a selector or project variables, runs use the current project's legacy .env.
   Supported auto-link variables:
     SUPABASE_URL / SUPACLOUD_API_URL
     SUPABASE_SERVICE_ROLE_KEY / SUPACLOUD_API_TOKEN
     SUPACLOUD_PROJECT_REF (when it cannot be inferred from <ref>.api.*)
 
+  SUPACLOUD_READ_ONLY=true blocks remote writes. Production writes require an
+  exact --confirm-production value, and cannot override the selected project ref.
+
   status checks configuration, Management API connectivity, and authentication.
   It exits non-zero when a required check fails.
 
@@ -9752,6 +11145,7 @@ EXAMPLES
   ${preferredCommand} frontend list --ref abc123
   ${preferredCommand} database query --sql "select now()"
   ${preferredCommand} database query --ref abc123 --file ./queries/vector-search.sql
+  ${preferredCommand} database migration_inventory --ref abc123
   ${preferredCommand} database push_migrations --ref abc123 --dir supabase/migrations --dry_run
   ${preferredCommand} supabase migration_new --name add_accounts
   ${preferredCommand} supabase db_diff --schema public --name add_accounts
@@ -9763,7 +11157,10 @@ EXAMPLES
   ${preferredCommand} ai show_skill
   ${preferredCommand} ai install_skill --dry_run
   ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello
+  ${preferredCommand} edge_functions activate --ref abc123 --slug hello --version 3
+  ${preferredCommand} scheduled_functions list --ref abc123
   ${preferredCommand} edge_functions config --ref abc123 --slug hello --verify_jwt false --background_routes "/queue/*,/render/*"
+  ${preferredCommand} secrets upsert --ref abc123 --from-env API_KEY,WEBHOOK_SECRET
   ${preferredCommand} gateway routes --ref abc123
   ${preferredCommand} gateway upsert_route --ref abc123 --route_id webhook --hosts "api.example.com" --paths "/webhook/*" --upstream 10.0.0.5:8080
   ${preferredCommand} gateway config --ref abc123 --rate_limit_tier pro
@@ -9777,8 +11174,18 @@ SEPARATE ADMIN CLI
     npx @supacloud/admin --help
 `);
 }
-function createCliTools() {
-  const context = resolveSupaCloudContext();
+function authorizedToolMap(tools, context, confirmProduction) {
+  validateExecutionPolicyCoverage(tools);
+  for (const [moduleName, tool] of Object.entries(tools)) {
+    const callback = tool.callback;
+    tool.callback = async (args) => {
+      authorizeExecution(moduleName, args, { context, confirmProduction });
+      return callback(args);
+    };
+  }
+  return tools;
+}
+function createCliTools(context, confirmProduction) {
   let pushMigrations;
   const tools = {
     status: {
@@ -9804,6 +11211,8 @@ function createCliTools() {
               "⚠️ Project commands need a project-scoped API context.",
               "",
               "Provide one of these sources:",
+              "  - --env <name> for .env.supacloud.<name>",
+              "  - --env-file <path> for a file declaring SUPACLOUD_ENV",
               "  - .env with SUPABASE_URL + SUPABASE_SERVICE_ROLE_KEY",
               "  - SUPACLOUD_API_URL + SUPACLOUD_API_TOKEN",
               "",
@@ -9816,7 +11225,7 @@ function createCliTools() {
         ]
       })
     };
-    for (const name of ["database", "auth", "storage", "edge_functions", "secrets", "frontend", "queue", "task_events", "diagnostics", "gateway", "branch"]) {
+    for (const name of ["database", "auth", "storage", "edge_functions", "secrets", "frontend", "queue", "task_events", "scheduled_functions", "diagnostics", "gateway", "branch"]) {
       tools[name] = {
         schema: { action: genericActionSchema },
         callback: async () => ({
@@ -9830,6 +11239,11 @@ function createCliTools() {
         })
       };
     }
+    const storageContextCallback = tools.storage.callback;
+    const storageHelpTool = captureTools((server) => registerStorageTools(server, {})).storage;
+    if (storageHelpTool) {
+      tools.storage = { schema: storageHelpTool.schema, callback: storageContextCallback };
+    }
     const branchContextCallback = tools.branch.callback;
     const branchHelpTool = captureTools((server) => registerBranchTools(server, {}, {
       readOnly: true
@@ -9853,11 +11267,14 @@ function createCliTools() {
               `${preferredCommand} expects project-scoped credentials by default.`,
               "Provide one of these sources:",
               "",
-              "  1. Current workspace .env",
+              "  1. Named environment file",
+              "     supacloud-cli --env test status",
+              "",
+              "  2. Current workspace .env",
               "     SUPABASE_URL=https://your-project.example.com",
               "     SUPABASE_SERVICE_ROLE_KEY=...",
               "",
-              "  2. Explicit environment variables",
+              "  3. Explicit environment variables",
               "     SUPACLOUD_API_URL=https://your-project.example.com",
               "     SUPACLOUD_API_TOKEN=...",
               "",
@@ -9869,7 +11286,7 @@ function createCliTools() {
         ]
       })
     };
-    return tools;
+    return authorizedToolMap(tools, context, confirmProduction);
   }
   const http = new HttpTransport({
     baseUrl: context.apiUrl,
@@ -9887,7 +11304,12 @@ function createCliTools() {
   assign(databaseTools);
   assign(captureTools((server) => registerAuthTools(server, http)));
   assign(captureTools((server) => registerStorageTools(server, http)));
-  assign(captureTools((server) => registerAdvancedTools(server, http)));
+  assign(captureTools((server) => registerAdvancedTools(server, http, process.env, {
+    readOnly: context.readOnly
+  })));
+  assign(captureTools((server) => registerScheduledFunctionTools(server, http, process.env, {
+    readOnly: context.readOnly
+  })));
   assign(captureTools((server) => registerFrontendTools(server, http)));
   assign(captureTools((server) => registerGatewayTools(server, http, {
     projectRef: context.projectRef || undefined
@@ -9900,16 +11322,26 @@ function createCliTools() {
     projectRef: context.projectRef || undefined
   })));
   delete tools.platform;
-  return tools;
+  return authorizedToolMap(tools, context, confirmProduction);
 }
 async function main() {
-  const args = process.argv.slice(2);
+  const rawArgs = process.argv.slice(2);
+  if (rawArgs.length === 1 && rawArgs[0] === "--version") {
+    console.log(package_default.version);
+    return;
+  }
+  const globalOptions = parseGlobalOptions(rawArgs);
+  const args = globalOptions.args;
+  const context = resolveSupaCloudContext(process.env, process.cwd(), {
+    environmentName: globalOptions.environmentName,
+    envFile: globalOptions.envFile
+  });
   if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
-    printHelp();
+    printHelp(context);
     process.exitCode = 0;
     return;
   }
-  const cliTools = createCliTools();
+  const cliTools = createCliTools(context, globalOptions.confirmProduction);
   if (args.length === 1 && !["ai", "supabase"].includes(args[0]) && cliTools[args[0]]) {
     const result = await cliTools[args[0]].callback({});
     if (result?.content && Array.isArray(result.content)) {