@supacloud/cli 0.15.0 → 0.16.0

package/README.md

@@ -146,6 +146,7 @@ supacloud-cli queue dlq --queue emails --limit 20
 supacloud-cli task_events inspect_webhook --ref abc123
 supacloud-cli database query --sql "select now()"
 supacloud-cli database query --ref abc123 --file ./queries/vector-search.sql
+supacloud-cli database migration_inventory --ref abc123
 supacloud-cli database push_migrations --ref abc123 --dir supabase/migrations --dry_run
 supacloud-cli supabase migration_new --name add_accounts
 supacloud-cli supabase db_diff --schema public --name add_accounts
@@ -160,8 +161,23 @@ supacloud-cli edge_functions source --ref abc123 --slug hello --output ./hello.t
 supacloud-cli edge_functions activate --ref abc123 --slug hello --version 3
 supacloud-cli scheduled_functions list --ref abc123
 supacloud-cli secrets upsert --ref abc123 --from-env API_KEY,WEBHOOK_SECRET
+supacloud-cli storage list_buckets --ref abc123
+supacloud-cli storage get_bucket --ref abc123 --bucket reports
+supacloud-cli storage create_bucket --ref abc123 --bucket reports --public false \
+  --file_size_limit 10485760 --allowed_mime_types "application/pdf,image/png"
+supacloud-cli storage update_bucket --ref abc123 --bucket reports \
+  --allowed_mime_types '["application/pdf"]'
+supacloud-cli storage delete_bucket --ref abc123 --bucket reports
 ```
 
+`database migration_inventory` reads the canonical migration ledger through the
+project-scoped Management API and prints only a validated JSON array. It rejects
+non-2xx responses, malformed entries, unsafe project refs, duplicate canonical
+migration versions, checksum
+drift, and statement-count mismatches instead of treating them as an empty
+ledger. `database list_migrations` remains available with its legacy SQL-backed,
+human-readable behavior.
+
 `edge_functions deploy --path` bundles local TypeScript and dependencies with
 Bun and runs a local syntax check before upload. The Management API validates and
 normalizes the final server-side artifact against the multi-tenant Edge Runtime

package/dist/index.js

@@ -6471,7 +6471,7 @@ var ACTION_POLICY = {
     write: ["task_cancel", "task_retry", "update_background_settings"]
   },
   database: {
-    read: ["list_tables", "describe_columns", "list_indexes", "list_constraints", "list_extensions", "rls_status", "rls_policies", "list_auth_users", "get_auth_user", "connections", "stats", "slow_queries", "list_migrations", "project_url", "generate_types"],
+    read: ["list_tables", "describe_columns", "list_indexes", "list_constraints", "list_extensions", "rls_status", "rls_policies", "list_auth_users", "get_auth_user", "connections", "stats", "slow_queries", "list_migrations", "migration_inventory", "project_url", "generate_types"],
     write: ["query", "apply_migration", "push_migrations", "baseline_migrations", "create_table_rls"]
   },
   supabase: {
@@ -6483,8 +6483,8 @@ var ACTION_POLICY = {
     write: ["configure_provider", "update_provider", "disable_provider", "wechat_mini", "wechat_open", "update_settings", "update_config"]
   },
   storage: {
-    read: ["status", "list_buckets", "list_files"],
-    write: ["upload_base64", "delete_file"]
+    read: ["status", "list_buckets", "get_bucket", "list_files"],
+    write: ["create_bucket", "update_bucket", "delete_bucket", "upload_base64", "delete_file"]
   },
   edge_functions: {
     read: ["list", "source"],
@@ -6784,10 +6784,120 @@ class HttpTransport {
 import { createHash } from "node:crypto";
 import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
 import { basename, join } from "node:path";
+
+// src/shared/project-ref.ts
+var PROJECT_REF_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+function projectRefPathSegment(ref, operation) {
+  if (typeof ref !== "string" || !PROJECT_REF_PATTERN.test(ref)) {
+    throw new Error(`'ref' is invalid for ${operation}`);
+  }
+  return encodeURIComponent(ref);
+}
+
+// src/shared/tools/database-tools.ts
 var MAX_MIGRATION_VERSION = 9223372036854775807n;
 var FALLBACK_MIGRATION_VERSION_BASE = 8000000000000000000n;
 var FALLBACK_MIGRATION_VERSION_RANGE = 1000000000000000000n;
 var FALLBACK_MIGRATION_VERSION_LIMIT = FALLBACK_MIGRATION_VERSION_BASE + FALLBACK_MIGRATION_VERSION_RANGE;
+var MAX_MIGRATION_INVENTORY_BYTES = 64 * 1024 * 1024;
+function isMigrationInventoryVersion(version) {
+  if (typeof version !== "string" || !/^\d{1,19}$/.test(version))
+    return false;
+  const numericVersion = BigInt(version);
+  return numericVersion >= 1n && numericVersion <= MAX_MIGRATION_VERSION && numericVersion.toString() === version;
+}
+function isMigrationInventoryName(name) {
+  return name === null || typeof name === "string" && name.length <= 255 && name.length > 0 && name.trim() === name;
+}
+function isMigrationInventoryStatements(statements) {
+  return Array.isArray(statements) && statements.every((statement) => typeof statement === "string" && statement.length > 0 && statement.trim() === statement && !statement.includes("\r"));
+}
+function isMigrationInventoryAppliedAt(appliedAt) {
+  return appliedAt === null || typeof appliedAt === "string" && appliedAt.trim() === appliedAt && appliedAt.length > 0 && !Number.isNaN(Date.parse(appliedAt));
+}
+function migrationInventoryChecksum(entry) {
+  return createHash("sha256").update(JSON.stringify({
+    version: entry.version,
+    name: entry.name,
+    statements: entry.statements
+  })).digest("hex");
+}
+function migrationInventoryEntry(rawEntry) {
+  if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry))
+    return null;
+  const entry = rawEntry;
+  if (!isMigrationInventoryVersion(entry.version))
+    return null;
+  if (!isMigrationInventoryName(entry.name))
+    return null;
+  if (!isMigrationInventoryStatements(entry.statements))
+    return null;
+  if (typeof entry.statement_count !== "number" || !Number.isInteger(entry.statement_count))
+    return null;
+  if (entry.statement_count !== entry.statements.length)
+    return null;
+  if (typeof entry.checksum !== "string" || !/^[0-9a-f]{64}$/.test(entry.checksum))
+    return null;
+  if (!isMigrationInventoryAppliedAt(entry.applied_at))
+    return null;
+  const migration = {
+    version: entry.version,
+    name: entry.name,
+    statements: entry.statements,
+    statement_count: entry.statement_count,
+    checksum: entry.checksum,
+    applied_at: entry.applied_at
+  };
+  return migration.checksum === migrationInventoryChecksum(migration) ? migration : null;
+}
+function compareMigrationInventoryEntries(left, right) {
+  const leftVersion = BigInt(left.version);
+  const rightVersion = BigInt(right.version);
+  if (leftVersion === rightVersion)
+    return 0;
+  return leftVersion < rightVersion ? -1 : 1;
+}
+function migrationInventory(payload) {
+  if (!Array.isArray(payload))
+    return null;
+  const inventory = [];
+  const versions = new Set;
+  for (const rawEntry of payload) {
+    const entry = migrationInventoryEntry(rawEntry);
+    if (!entry)
+      return null;
+    if (versions.has(entry.version))
+      return null;
+    versions.add(entry.version);
+    inventory.push(entry);
+  }
+  return inventory.sort(compareMigrationInventoryEntries);
+}
+function migrationInventoryPath(ref) {
+  return `/v1/projects/${projectRefPathSegment(ref, "migration_inventory")}/database/migrations`;
+}
+function migrationInventoryFailure(code, httpStatus) {
+  return {
+    isError: true,
+    content: [{
+      type: "text",
+      text: JSON.stringify({
+        ok: false,
+        operation: "database.migration_inventory",
+        error: { code, http_status: httpStatus }
+      }, null, 2)
+    }]
+  };
+}
+function migrationInventoryResponse(response) {
+  if (!response.ok) {
+    return migrationInventoryFailure("HTTP_ERROR", response.transportError ? null : response.status);
+  }
+  const inventory = migrationInventory(response.data);
+  if (!inventory)
+    return migrationInventoryFailure("INVALID_RESPONSE", response.status);
+  return { content: [{ type: "text", text: JSON.stringify(inventory, null, 2) }] };
+}
 function readMigrationFile(dir, file) {
   const rawBytes = readFileSync2(join(dir, file));
   return {
@@ -6939,6 +7049,7 @@ function registerDatabaseTools(server, http, config = {}) {
     "stats",
     "slow_queries",
     "list_migrations",
+    "migration_inventory",
     "project_url",
     "generate_types"
   ];
@@ -7078,6 +7189,10 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
         text = r.ok ? formatMigrations(r.data) : `❌ Failed (${r.status})`;
         break;
       }
+      case "migration_inventory": {
+        const response = await http.get(migrationInventoryPath(ref), { maxResponseBytes: MAX_MIGRATION_INVENTORY_BYTES });
+        return migrationInventoryResponse(response);
+      }
       case "project_url": {
         const r = await http.get(`/v1/projects/${ref}`);
         text = r.ok ? JSON.stringify({ url: r.data.api?.url || `https://${ref}.supabase.co` }, null, 2) : `❌ Failed (${r.status})`;
@@ -7729,90 +7844,424 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status}): ${JSON.stringif
   });
 }
 
+// src/shared/tools/release-control-response.ts
+var RELEASE_CONTROL_RESPONSE_SCHEMA = "supacloud.cli.release-control.v1";
+function releaseControlSuccess(operation, payload) {
+  return releaseControlResponse({
+    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
+    ok: true,
+    operation,
+    ...payload
+  });
+}
+function releaseControlFailure(operation, code, httpStatus) {
+  return releaseControlErrorResponse({
+    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
+    ok: false,
+    operation,
+    error: { code, http_status: httpStatus }
+  });
+}
+function releaseControlMutationFailure(operation, response) {
+  const outcomeUnknown = response.transportError || response.status === 408 || response.status >= 500;
+  return outcomeUnknown ? releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.transportError ? null : response.status) : releaseControlFailure(operation, "HTTP_ERROR", response.status);
+}
+function releaseControlResponse(payload) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(payload, null, 2) }]
+  };
+}
+function releaseControlErrorResponse(payload) {
+  return { ...releaseControlResponse(payload), isError: true };
+}
+
 // src/shared/tools/storage-tools.ts
+var MAX_BUCKET_ID_LENGTH = 100;
+var MAX_MIME_TYPE_COUNT = 100;
+var MAX_MIME_TYPE_LENGTH = 255;
+var PROJECT_REF_PATTERN2 = /^[A-Za-z0-9_-]{1,64}$/;
+var BUCKET_ID_PATTERN = new RegExp(`^(?!\\.+$)[A-Za-z0-9._-]{1,${MAX_BUCKET_ID_LENGTH}}$`);
+var MIME_TYPE_PATTERN = /^(?=\S)(?=.*\S$)[^\u0000-\u001f\u007f]+$/;
+var ACTION_ARGUMENTS = {
+  status: new Set(["action"]),
+  list_buckets: new Set(["action", "ref"]),
+  get_bucket: new Set(["action", "ref", "bucket"]),
+  create_bucket: new Set(["action", "ref", "bucket", "public", "file_size_limit", "allowed_mime_types"]),
+  update_bucket: new Set(["action", "ref", "bucket", "public", "file_size_limit", "allowed_mime_types"]),
+  delete_bucket: new Set(["action", "ref", "bucket"]),
+  list_files: new Set(["action", "ref", "bucket"]),
+  upload_base64: new Set(["action", "ref", "bucket", "filename", "base64_content", "mime_type"]),
+  delete_file: new Set(["action", "ref", "bucket", "filename"])
+};
+function normalizedMimeTypes(candidate) {
+  return Array.isArray(candidate) ? candidate.map((mimeType) => typeof mimeType === "string" ? mimeType.trim() : mimeType) : candidate;
+}
+function parseAllowedMimeTypes(input) {
+  if (Array.isArray(input))
+    return normalizedMimeTypes(input);
+  const trimmed = input.trim();
+  if (!trimmed)
+    return [];
+  if (!trimmed.startsWith("[")) {
+    return normalizedMimeTypes(trimmed.split(","));
+  }
+  try {
+    return normalizedMimeTypes(JSON.parse(trimmed));
+  } catch (error) {
+    if (!(error instanceof SyntaxError))
+      throw error;
+    throw new Error("Invalid allowed_mime_types JSON array");
+  }
+}
+var allowedMimeTypesSchema = Type.Optional(decodedSchema(Type.Union([Type.String(), Type.Array(Type.String())]), Type.Array(Type.String({
+  minLength: 1,
+  maxLength: MAX_MIME_TYPE_LENGTH,
+  pattern: MIME_TYPE_PATTERN.source
+}), { maxItems: MAX_MIME_TYPE_COUNT }), parseAllowedMimeTypes));
+var fileSizeLimitSchema = Type.Optional(Type.Integer({
+  minimum: 1,
+  maximum: Number.MAX_SAFE_INTEGER
+}));
+function requiredText(args, field) {
+  const text = args[field];
+  if (typeof text !== "string" || !text.trim()) {
+    throw new Error(`'${field}' required for '${String(args.action)}'`);
+  }
+  return text.trim();
+}
+function validBucketId(bucket) {
+  return BUCKET_ID_PATTERN.test(bucket);
+}
+function requiredProjectRef(args) {
+  const ref = requiredText(args, "ref");
+  if (!PROJECT_REF_PATTERN2.test(ref))
+    throw new Error("'ref' is invalid for Storage buckets");
+  return ref;
+}
+function requiredBucketId(args) {
+  const bucket = requiredText(args, "bucket");
+  if (!validBucketId(bucket))
+    throw new Error("'bucket' is invalid for Storage buckets");
+  return bucket;
+}
+function assertActionArguments(action, args) {
+  const allowedArguments = ACTION_ARGUMENTS[action];
+  if (!allowedArguments)
+    throw new Error(`Unsupported Storage action '${action}'`);
+  const unsupported = Object.keys(args).filter((field) => !allowedArguments.has(field));
+  if (unsupported.length > 0)
+    throw new Error(`'${unsupported[0]}' is not supported for '${action}'`);
+}
+function storageBucketPath(ref, bucket) {
+  if (!PROJECT_REF_PATTERN2.test(ref))
+    throw new Error("'ref' is invalid for Storage buckets");
+  if (bucket !== undefined && !validBucketId(bucket)) {
+    throw new Error("'bucket' is invalid for Storage buckets");
+  }
+  const root = `/v1/projects/${encodeURIComponent(ref)}/storage/buckets`;
+  return bucket === undefined ? root : `${root}/${encodeURIComponent(bucket)}`;
+}
+function bucketRecord(candidate) {
+  return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
+}
+function isFileSizeLimit(candidate) {
+  return candidate === null || typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate > 0;
+}
+function assertBucketSettings(args) {
+  if (args.file_size_limit !== undefined && (args.file_size_limit === null || !isFileSizeLimit(args.file_size_limit))) {
+    throw new Error("'file_size_limit' must be a positive safe integer");
+  }
+  if (args.allowed_mime_types !== undefined && (args.allowed_mime_types === null || !isAllowedMimeTypes(args.allowed_mime_types))) {
+    throw new Error("'allowed_mime_types' is invalid");
+  }
+}
+function isAllowedMimeTypes(candidate) {
+  return candidate === null || Array.isArray(candidate) && candidate.length <= MAX_MIME_TYPE_COUNT && candidate.every((mimeType) => typeof mimeType === "string" && mimeType.length <= MAX_MIME_TYPE_LENGTH && MIME_TYPE_PATTERN.test(mimeType));
+}
+function safeBucket(candidate, expectedBucket) {
+  const bucket = bucketRecord(candidate);
+  if (bucket === null || typeof bucket.id !== "string" || !validBucketId(bucket.id) || typeof bucket.name !== "string" || !validBucketId(bucket.name) || typeof bucket.public !== "boolean" || !isFileSizeLimit(bucket.file_size_limit) || !isAllowedMimeTypes(bucket.allowed_mime_types) || expectedBucket !== undefined && bucket.id !== expectedBucket && bucket.name !== expectedBucket) {
+    return null;
+  }
+  return {
+    id: bucket.id,
+    name: bucket.name,
+    public: bucket.public,
+    file_size_limit: bucket.file_size_limit,
+    allowed_mime_types: bucket.allowed_mime_types === null ? null : [...bucket.allowed_mime_types]
+  };
+}
+function safeExactBucket(candidate, expectedBucket) {
+  const bucket = safeBucket(candidate);
+  return bucket?.id === expectedBucket ? bucket : null;
+}
+function safeBucketList(candidate) {
+  if (!Array.isArray(candidate))
+    return null;
+  const buckets = candidate.map((bucket) => safeBucket(bucket));
+  if (buckets.some((bucket) => bucket === null))
+    return null;
+  const safeBuckets = buckets;
+  const ids = safeBuckets.map((bucket) => bucket.id);
+  const names = safeBuckets.map((bucket) => bucket.name);
+  return new Set(ids).size === ids.length && new Set(names).size === names.length ? safeBuckets : null;
+}
+function safeCreatedBucketReceipt(candidate, expectedBucket, request) {
+  const bucket = bucketRecord(candidate);
+  if (bucket?.id !== expectedBucket || bucket.name !== expectedBucket || bucket.public !== (request.public === true))
+    return null;
+  return { bucket: { id: expectedBucket, name: expectedBucket, public: request.public === true } };
+}
+function safeDeletedBucket(candidate, expectedBucket) {
+  const receipt = bucketRecord(candidate);
+  return receipt?.id === expectedBucket && receipt.deleted === true ? { bucket_id: expectedBucket, deleted: true } : null;
+}
+function mutationReadbackResponse(expectation) {
+  const { operation, ref, response, expectedBucket, request } = expectation;
+  const readback = safeExactBucket(response.data, expectedBucket);
+  const validReadback = readback?.name === expectedBucket && bucketMatchesRequest(readback, request);
+  if (!response.ok || !validReadback || !readback) {
+    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.transportError ? null : response.status);
+  }
+  return releaseControlSuccess(operation, { project_ref: ref, bucket: readback });
+}
+function bucketResponse(expectation) {
+  const { operation, ref, response, operationKind, safePayload } = expectation;
+  if (!response.ok) {
+    return operationKind === "mutation" ? releaseControlMutationFailure(operation, response) : releaseControlFailure(operation, "HTTP_ERROR", response.transportError ? null : response.status);
+  }
+  const payload = safePayload(response.data);
+  if (!payload) {
+    return operationKind === "mutation" ? releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.status) : releaseControlFailure(operation, "INVALID_RESPONSE", null);
+  }
+  return releaseControlSuccess(operation, { project_ref: ref, ...payload });
+}
+function createBucketRequest(args) {
+  assertBucketSettings(args);
+  const request = { name: requiredText(args, "bucket") };
+  if (args.public !== undefined)
+    request.public = args.public;
+  if (args.file_size_limit !== undefined)
+    request.file_size_limit = args.file_size_limit;
+  if (args.allowed_mime_types !== undefined)
+    request.allowed_mime_types = args.allowed_mime_types;
+  return request;
+}
+function updateBucketRequest(args) {
+  assertBucketSettings(args);
+  const request = Object.fromEntries(["public", "file_size_limit", "allowed_mime_types"].filter((field) => args[field] !== undefined).map((field) => [field, args[field]]));
+  if (Object.keys(request).length === 0)
+    throw new Error("Bucket update requires at least one field");
+  return request;
+}
+function equalAllowedMimeTypes(candidate, expected) {
+  if (!Array.isArray(expected))
+    return false;
+  if (expected.length === 0 && candidate === null)
+    return true;
+  return Array.isArray(candidate) && candidate.length === expected.length && candidate.every((mimeType, index) => mimeType === expected[index]);
+}
+function bucketMatchesRequest(candidate, request) {
+  const bucket = bucketRecord(candidate);
+  if (!bucket)
+    return false;
+  if (request.public !== undefined && bucket.public !== request.public)
+    return false;
+  if (request.file_size_limit !== undefined && bucket.file_size_limit !== request.file_size_limit)
+    return false;
+  return request.allowed_mime_types === undefined || equalAllowedMimeTypes(bucket.allowed_mime_types, request.allowed_mime_types);
+}
+async function createBucketMutationReceipt(http, ref, bucket, request) {
+  return bucketResponse({
+    operation: "storage.create_bucket",
+    ref,
+    response: await http.post(storageBucketPath(ref), request),
+    operationKind: "mutation",
+    safePayload: (candidate) => safeCreatedBucketReceipt(candidate, bucket, request)
+  });
+}
+async function updateBucketMutationReceipt(expectation) {
+  const { http, ref, bucket, bucketPath, request } = expectation;
+  return bucketResponse({
+    operation: "storage.update_bucket",
+    ref,
+    response: await http.put(bucketPath, request),
+    operationKind: "mutation",
+    safePayload: (apiPayload) => {
+      const updated = safeExactBucket(apiPayload, bucket);
+      return updated && bucketMatchesRequest(updated, request) ? { bucket: updated } : null;
+    }
+  });
+}
+async function listBuckets(http, args) {
+  const ref = requiredProjectRef(args);
+  return bucketResponse({
+    operation: "storage.list_buckets",
+    ref,
+    response: await http.get(storageBucketPath(ref)),
+    operationKind: "read",
+    safePayload: (candidate) => {
+      const buckets = safeBucketList(candidate);
+      return buckets ? { buckets } : null;
+    }
+  });
+}
+async function getBucket(http, args) {
+  const ref = requiredProjectRef(args);
+  const bucket = requiredBucketId(args);
+  return bucketResponse({
+    operation: "storage.get_bucket",
+    ref,
+    response: await http.get(storageBucketPath(ref, bucket)),
+    operationKind: "read",
+    safePayload: (candidate) => {
+      const safeReadback = safeBucket(candidate, bucket);
+      return safeReadback ? { bucket: safeReadback } : null;
+    }
+  });
+}
+async function createBucket(http, args) {
+  const ref = requiredProjectRef(args);
+  const request = createBucketRequest(args);
+  const bucket = request.name;
+  const bucketPath = storageBucketPath(ref, bucket);
+  const receipt = await createBucketMutationReceipt(http, ref, bucket, request);
+  if (receipt.isError)
+    return receipt;
+  const expectedReadback = { ...request, public: request.public === true };
+  return mutationReadbackResponse({
+    operation: "storage.create_bucket",
+    ref,
+    response: await http.get(bucketPath),
+    expectedBucket: bucket,
+    request: expectedReadback
+  });
+}
+async function updateBucket(http, args) {
+  const ref = requiredProjectRef(args);
+  const bucket = requiredBucketId(args);
+  const request = updateBucketRequest(args);
+  const bucketPath = storageBucketPath(ref, bucket);
+  const receipt = await updateBucketMutationReceipt({ http, ref, bucket, bucketPath, request });
+  if (receipt.isError)
+    return receipt;
+  return mutationReadbackResponse({
+    operation: "storage.update_bucket",
+    ref,
+    response: await http.get(bucketPath),
+    expectedBucket: bucket,
+    request
+  });
+}
+async function deleteBucket(http, args) {
+  const ref = requiredProjectRef(args);
+  const bucket = requiredBucketId(args);
+  const bucketPath = storageBucketPath(ref, bucket);
+  const receipt = bucketResponse({
+    operation: "storage.delete_bucket",
+    ref,
+    response: await http.delete(bucketPath),
+    operationKind: "mutation",
+    safePayload: (candidate) => safeDeletedBucket(candidate, bucket)
+  });
+  if (receipt.isError)
+    return receipt;
+  const readback = await http.get(bucketPath);
+  if (readback.ok || readback.transportError || readback.status !== 404) {
+    return releaseControlFailure("storage.delete_bucket", "OUTCOME_UNKNOWN", readback.transportError ? null : readback.status);
+  }
+  return receipt;
+}
+var BUCKET_ACTION_HANDLERS = {
+  list_buckets: listBuckets,
+  get_bucket: getBucket,
+  create_bucket: createBucket,
+  update_bucket: updateBucket,
+  delete_bucket: deleteBucket
+};
+function executeBucketAction(action, http, args) {
+  if (!Object.hasOwn(BUCKET_ACTION_HANDLERS, action))
+    return null;
+  return BUCKET_ACTION_HANDLERS[action](http, args);
+}
 function registerStorageTools(server, http) {
   server.tool("storage", `S3/MinIO storage management.
-Actions: status, list_buckets, list_files, upload_base64, delete_file`, {
-    action: withDescription(stringEnum(["status", "list_buckets", "list_files", "upload_base64", "delete_file"]), "Action"),
-    ref: optional(Type.String(), "Project ref (required except for 'status')"),
-    bucket: optional(Type.String(), "[list_files/upload/delete] Bucket name"),
-    filename: optional(Type.String(), "[upload/delete] File name/path"),
+Actions: status, list_buckets, get_bucket, create_bucket, update_bucket, delete_bucket, list_files, upload_base64, delete_file`, {
+    action: withDescription(stringEnum([
+      "status",
+      "list_buckets",
+      "get_bucket",
+      "create_bucket",
+      "update_bucket",
+      "delete_bucket",
+      "list_files",
+      "upload_base64",
+      "delete_file"
+    ]), "Action"),
+    ref: optional(Type.String({ pattern: PROJECT_REF_PATTERN2.source }), "[list_buckets/get_bucket/create_bucket/update_bucket/delete_bucket/list_files/upload_base64/delete_file] Project ref"),
+    bucket: optional(Type.String({ pattern: BUCKET_ID_PATTERN.source }), "[get_bucket/create_bucket/update_bucket/delete_bucket/list_files/upload_base64/delete_file] Bucket name or ID"),
+    public: optional(Type.Boolean(), "[create_bucket/update_bucket] Public bucket access"),
+    file_size_limit: withDescription(fileSizeLimitSchema, "[create_bucket/update_bucket] Positive safe-integer per-file size limit in bytes"),
+    allowed_mime_types: withDescription(allowedMimeTypesSchema, "[create_bucket/update_bucket] MIME types as a comma-separated or JSON array"),
+    filename: optional(Type.String(), "[upload_base64/delete_file] File name/path"),
     base64_content: optional(Type.String(), "[upload_base64] Base64 encoded content"),
     mime_type: optional(Type.String(), "[upload_base64] MIME type (default: application/octet-stream)")
   }, async (args) => {
-    const { action, ref, bucket, filename, base64_content, mime_type } = args;
-    const need = (f, v) => {
-      if (!v)
-        throw new Error(`'${f}' required for '${action}'`);
-    };
-    const fmt = (data, label, fmtFn) => {
-      return Array.isArray(data) ? fmtFn(data) : JSON.stringify(data, null, 2);
-    };
+    const action = String(args.action);
+    assertActionArguments(action, args);
+    const bucketAction = executeBucketAction(action, http, args);
+    const bucketActionResponse = bucketAction ? await bucketAction : null;
+    if (bucketActionResponse)
+      return bucketActionResponse;
     let text;
     switch (action) {
       case "status":
         text = JSON.stringify((await http.get("/v1/storage/status")).data, null, 2);
         break;
-      case "list_buckets": {
-        need("ref", ref);
-        const res = await http.get(`/v1/storage/${ref}/buckets`);
-        if (!res.ok) {
-          text = `❌ Failed (${res.status})`;
-          break;
-        }
-        const buckets = res.data;
-        if (!Array.isArray(buckets) || !buckets.length) {
-          text = "No buckets found.";
-          break;
-        }
-        text = `\uD83D\uDCE6 Buckets (${buckets.length}):
-` + buckets.map((b) => `  - ${b.name} (${b.public ? "\uD83D\uDD13 public" : "\uD83D\uDD12 private"})`).join(`
-`);
-        break;
-      }
       case "list_files": {
-        need("ref", ref);
-        need("bucket", bucket);
-        const res = await http.get(`/v1/storage/${ref}/buckets/${bucket}/files`);
-        if (!res.ok) {
-          text = `❌ Failed (${res.status})`;
+        const ref = requiredProjectRef(args);
+        const bucket = requiredBucketId(args);
+        const response = await http.get(`/v1/storage/${ref}/buckets/${bucket}/files`);
+        if (!response.ok) {
+          text = `❌ Failed (${response.status})`;
           break;
         }
-        const files = res.data;
+        const files = response.data;
         if (!Array.isArray(files) || !files.length) {
           text = "No files.";
           break;
         }
         text = `\uD83D\uDCC1 Files (${files.length}):
-` + files.map((f) => `  - ${f.name} (${f.size ? (f.size / 1024).toFixed(1) + "KB" : "?"})`).join(`
+` + files.map((file) => `  - ${file.name} (${file.size ? (file.size / 1024).toFixed(1) + "KB" : "?"})`).join(`
 `);
         break;
       }
       case "upload_base64": {
-        need("ref", ref);
-        need("bucket", bucket);
-        need("filename", filename);
-        need("base64_content", base64_content);
+        const ref = requiredProjectRef(args);
+        const bucket = requiredBucketId(args);
+        const filename = requiredText(args, "filename");
+        const base64Content = requiredText(args, "base64_content");
         try {
-          const buffer = Buffer.from(base64_content, "base64");
-          const blob = new Blob([buffer], { type: mime_type || "application/octet-stream" });
+          const buffer = Buffer.from(base64Content, "base64");
+          const blob = new Blob([buffer], { type: typeof args.mime_type === "string" ? args.mime_type : "application/octet-stream" });
           const formData = new FormData;
           formData.append("file", blob, filename);
-          const res = await http.postMultipart(`/v1/storage/${ref}/buckets/${bucket}/upload`, formData);
-          text = res.ok ? `✅ File ${filename} uploaded to ${bucket}` : `❌ Upload failed (${res.status})`;
-        } catch (e) {
-          text = `❌ Error: ${e.message}`;
+          const response = await http.postMultipart(`/v1/storage/${ref}/buckets/${bucket}/upload`, formData);
+          text = response.ok ? `✅ File ${filename} uploaded to ${bucket}` : `❌ Upload failed (${response.status})`;
+        } catch (error) {
+          text = `❌ Error: ${error instanceof Error ? error.message : String(error)}`;
         }
         break;
       }
-      case "delete_file":
-        need("ref", ref);
-        need("bucket", bucket);
-        need("filename", filename);
-        text = (await http.delete(`/v1/storage/${ref}/buckets/${bucket}/files/${filename}`)).ok ? `✅ File ${filename} deleted` : `❌ Failed`;
+      case "delete_file": {
+        const ref = requiredProjectRef(args);
+        const bucket = requiredBucketId(args);
+        const filename = requiredText(args, "filename");
+        text = (await http.delete(`/v1/storage/${ref}/buckets/${bucket}/files/${filename}`)).ok ? `✅ File ${filename} deleted` : "❌ Failed";
         break;
+      }
       default:
-        text = `❌ Unknown action: ${action}`;
+        return releaseControlFailure(`storage.${action}`, "INVALID_RESPONSE", null);
     }
     return { content: [{ type: "text", text }] };
   });
@@ -7824,39 +8273,6 @@ import { tmpdir } from "node:os";
 import { basename as basename2, join as join2, resolve as resolve2 } from "node:path";
 import { promisify } from "node:util";
 import { execFile } from "node:child_process";
-
-// src/shared/tools/release-control-response.ts
-var RELEASE_CONTROL_RESPONSE_SCHEMA = "supacloud.cli.release-control.v1";
-function releaseControlSuccess(operation, payload) {
-  return releaseControlResponse({
-    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
-    ok: true,
-    operation,
-    ...payload
-  });
-}
-function releaseControlFailure(operation, code, httpStatus) {
-  return releaseControlErrorResponse({
-    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
-    ok: false,
-    operation,
-    error: { code, http_status: httpStatus }
-  });
-}
-function releaseControlMutationFailure(operation, response) {
-  const outcomeUnknown = response.transportError || response.status === 408 || response.status >= 500;
-  return outcomeUnknown ? releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.transportError ? null : response.status) : releaseControlFailure(operation, "HTTP_ERROR", response.status);
-}
-function releaseControlResponse(payload) {
-  return {
-    content: [{ type: "text", text: JSON.stringify(payload, null, 2) }]
-  };
-}
-function releaseControlErrorResponse(payload) {
-  return { ...releaseControlResponse(payload), isError: true };
-}
-
-// src/shared/tools/advanced-tools.ts
 var execFileAsync = promisify(execFile);
 async function runBunBuild(args) {
   try {
@@ -10180,7 +10596,6 @@ var FORBIDDEN_HEADER_NAMES = new Set([
   "via",
   "x-project-ref"
 ]);
-var PROJECT_REF_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
 var SCHEDULE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var SAFE_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 var CRON_PART_PATTERN = /^(\*|([0-9]+)(?:-([0-9]+))?)(?:\/([0-9]+))?$/;
@@ -10191,7 +10606,7 @@ var MAX_HEADER_COUNT = 64;
 var MAX_HEADER_VALUE_LENGTH = 8192;
 var MAX_SCHEDULE_NAME_LENGTH = 120;
 var headerEnvironmentRecord = Type.Record(Type.String(), Type.String());
-var ACTION_ARGUMENTS = {
+var ACTION_ARGUMENTS2 = {
   list: new Set(["action", "ref"]),
   create: new Set(["action", "ref", "name", "slug", "cron", "method", "body_file", "header_env"]),
   update: new Set(["action", "ref", "schedule_id", "name", "cron", "method", "enabled", "body_file", "header_env"]),
@@ -10349,26 +10764,25 @@ function safeSchedule(candidate) {
     updated_at: schedule.updated_at
   };
 }
-function requiredText(args, name, action) {
+function requiredText2(args, name, action) {
   const candidate = args[name];
   if (typeof candidate !== "string" || !candidate.trim()) {
     throw new Error(`'${name}' is required for '${action}'`);
   }
   return candidate.trim();
 }
-function assertActionArguments(action, args) {
-  const unsupported = Object.keys(args).filter((name) => !ACTION_ARGUMENTS[action].has(name));
+function assertActionArguments2(action, args) {
+  const unsupported = Object.keys(args).filter((name) => !ACTION_ARGUMENTS2[action].has(name));
   if (unsupported.length > 0) {
     throw new Error(`'${unsupported[0]}' is not supported for '${action}'`);
   }
 }
 function schedulePath(ref, scheduleId) {
-  if (!PROJECT_REF_PATTERN.test(ref))
-    throw new Error("'ref' is invalid for Scheduled Functions");
+  const projectRefSegment = projectRefPathSegment(ref, "Scheduled Functions");
   if (scheduleId !== undefined && !SCHEDULE_ID_PATTERN.test(scheduleId)) {
     throw new Error("'schedule_id' is invalid");
   }
-  const root = `/v1/projects/${encodeURIComponent(ref)}/scheduled-functions`;
+  const root = `/v1/projects/${projectRefSegment}/scheduled-functions`;
   return scheduleId ? `${root}/${encodeURIComponent(scheduleId)}` : root;
 }
 function scheduleFailure(operation, response) {
@@ -10429,7 +10843,7 @@ function createRequest(args, environment) {
     name: requiredName(args, "create"),
     slug: requiredSlug(args, "create"),
     cron: requiredCron(args, "create"),
-    method: requiredText(args, "method", "create"),
+    method: requiredText2(args, "method", "create"),
     body: scheduleBody(args.body_file) ?? {},
     headers: scheduleHeaders(args.header_env, environment) ?? {}
   };
@@ -10445,19 +10859,19 @@ function safeMutationFields(request) {
   return safeFields;
 }
 function requiredName(args, action) {
-  const name = requiredText(args, "name", action);
+  const name = requiredText2(args, "name", action);
   if (name.length > MAX_SCHEDULE_NAME_LENGTH)
     throw new Error(`'name' is too long for '${action}'`);
   return name;
 }
 function requiredSlug(args, action) {
-  const slug = requiredText(args, "slug", action);
+  const slug = requiredText2(args, "slug", action);
   if (!SAFE_SLUG_PATTERN.test(slug))
     throw new Error(`'slug' is invalid for '${action}'`);
   return slug;
 }
 function requiredCron(args, action) {
-  const cron = requiredText(args, "cron", action);
+  const cron = requiredText2(args, "cron", action);
   if (!validScheduledFunctionCron(cron))
     throw new Error(`'cron' is invalid for '${action}'`);
   return cron;
@@ -10484,8 +10898,8 @@ async function executeScheduleAction(http, environment, args, readOnly = false)
   const action = args.action;
   if (readOnly && action !== "list")
     return readOnlyResult2();
-  assertActionArguments(action, args);
-  const ref = requiredText(args, "ref", action);
+  assertActionArguments2(action, args);
+  const ref = requiredText2(args, "ref", action);
   if (action === "list")
     return listResponse(ref, await http.get(schedulePath(ref)));
   if (action === "create") {
@@ -10493,7 +10907,7 @@ async function executeScheduleAction(http, environment, args, readOnly = false)
     const requestId = request.request_id;
     return mutationResponse({ action, ref, requestId, expectedFields: safeMutationFields(request) }, await http.post(schedulePath(ref), request));
   }
-  const scheduleId = requiredText(args, "schedule_id", action);
+  const scheduleId = requiredText2(args, "schedule_id", action);
   if (action === "update") {
     const request = updateRequest(args, environment);
     const requestId = request.request_id;
@@ -10526,7 +10940,7 @@ var SCHEDULE_TOOL_SCHEMA = {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.15.0",
+  version: "0.16.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -10731,6 +11145,7 @@ EXAMPLES
   ${preferredCommand} frontend list --ref abc123
   ${preferredCommand} database query --sql "select now()"
   ${preferredCommand} database query --ref abc123 --file ./queries/vector-search.sql
+  ${preferredCommand} database migration_inventory --ref abc123
   ${preferredCommand} database push_migrations --ref abc123 --dir supabase/migrations --dry_run
   ${preferredCommand} supabase migration_new --name add_accounts
   ${preferredCommand} supabase db_diff --schema public --name add_accounts
@@ -10824,6 +11239,11 @@ function createCliTools(context, confirmProduction) {
         })
       };
     }
+    const storageContextCallback = tools.storage.callback;
+    const storageHelpTool = captureTools((server) => registerStorageTools(server, {})).storage;
+    if (storageHelpTool) {
+      tools.storage = { schema: storageHelpTool.schema, callback: storageContextCallback };
+    }
     const branchContextCallback = tools.branch.callback;
     const branchHelpTool = captureTools((server) => registerBranchTools(server, {}, {
       readOnly: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",