@supacloud/cli 0.15.0 → 0.17.0

package/dist/index.js

@@ -6471,7 +6471,7 @@ var ACTION_POLICY = {
     write: ["task_cancel", "task_retry", "update_background_settings"]
   },
   database: {
-    read: ["list_tables", "describe_columns", "list_indexes", "list_constraints", "list_extensions", "rls_status", "rls_policies", "list_auth_users", "get_auth_user", "connections", "stats", "slow_queries", "list_migrations", "project_url", "generate_types"],
+    read: ["list_tables", "describe_columns", "list_indexes", "list_constraints", "list_extensions", "rls_status", "rls_policies", "list_auth_users", "get_auth_user", "connections", "stats", "slow_queries", "list_migrations", "migration_inventory", "project_url", "generate_types"],
     write: ["query", "apply_migration", "push_migrations", "baseline_migrations", "create_table_rls"]
   },
   supabase: {
@@ -6483,15 +6483,15 @@ var ACTION_POLICY = {
     write: ["configure_provider", "update_provider", "disable_provider", "wechat_mini", "wechat_open", "update_settings", "update_config"]
   },
   storage: {
-    read: ["status", "list_buckets", "list_files"],
-    write: ["upload_base64", "delete_file"]
+    read: ["status", "list_buckets", "get_bucket", "list_files"],
+    write: ["create_bucket", "update_bucket", "delete_bucket", "upload_base64", "delete_file"]
   },
   edge_functions: {
     read: ["list", "source"],
     local: ["check"],
     write: ["deploy", "deploy_bundle", "config", "activate", "delete"]
   },
-  scheduled_functions: { read: ["list"], write: ["create", "update", "delete"] },
+  scheduled_functions: { read: ["list", "get"], write: ["create", "update", "delete"] },
   secrets: { read: ["list"], write: ["upsert", "delete"] },
   frontend: {
     read: ["list", "get", "build_logs", "list_frameworks", "list_records"],
@@ -6784,10 +6784,120 @@ class HttpTransport {
 import { createHash } from "node:crypto";
 import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
 import { basename, join } from "node:path";
+
+// src/shared/project-ref.ts
+var PROJECT_REF_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+function projectRefPathSegment(ref, operation) {
+  if (typeof ref !== "string" || !PROJECT_REF_PATTERN.test(ref)) {
+    throw new Error(`'ref' is invalid for ${operation}`);
+  }
+  return encodeURIComponent(ref);
+}
+
+// src/shared/tools/database-tools.ts
 var MAX_MIGRATION_VERSION = 9223372036854775807n;
 var FALLBACK_MIGRATION_VERSION_BASE = 8000000000000000000n;
 var FALLBACK_MIGRATION_VERSION_RANGE = 1000000000000000000n;
 var FALLBACK_MIGRATION_VERSION_LIMIT = FALLBACK_MIGRATION_VERSION_BASE + FALLBACK_MIGRATION_VERSION_RANGE;
+var MAX_MIGRATION_INVENTORY_BYTES = 64 * 1024 * 1024;
+function isMigrationInventoryVersion(version) {
+  if (typeof version !== "string" || !/^\d{1,19}$/.test(version))
+    return false;
+  const numericVersion = BigInt(version);
+  return numericVersion >= 1n && numericVersion <= MAX_MIGRATION_VERSION && numericVersion.toString() === version;
+}
+function isMigrationInventoryName(name) {
+  return name === null || typeof name === "string" && name.length <= 255 && name.length > 0 && name.trim() === name;
+}
+function isMigrationInventoryStatements(statements) {
+  return Array.isArray(statements) && statements.every((statement) => typeof statement === "string" && statement.length > 0 && statement.trim() === statement && !statement.includes("\r"));
+}
+function isMigrationInventoryAppliedAt(appliedAt) {
+  return appliedAt === null || typeof appliedAt === "string" && appliedAt.trim() === appliedAt && appliedAt.length > 0 && !Number.isNaN(Date.parse(appliedAt));
+}
+function migrationInventoryChecksum(entry) {
+  return createHash("sha256").update(JSON.stringify({
+    version: entry.version,
+    name: entry.name,
+    statements: entry.statements
+  })).digest("hex");
+}
+function migrationInventoryEntry(rawEntry) {
+  if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry))
+    return null;
+  const entry = rawEntry;
+  if (!isMigrationInventoryVersion(entry.version))
+    return null;
+  if (!isMigrationInventoryName(entry.name))
+    return null;
+  if (!isMigrationInventoryStatements(entry.statements))
+    return null;
+  if (typeof entry.statement_count !== "number" || !Number.isInteger(entry.statement_count))
+    return null;
+  if (entry.statement_count !== entry.statements.length)
+    return null;
+  if (typeof entry.checksum !== "string" || !/^[0-9a-f]{64}$/.test(entry.checksum))
+    return null;
+  if (!isMigrationInventoryAppliedAt(entry.applied_at))
+    return null;
+  const migration = {
+    version: entry.version,
+    name: entry.name,
+    statements: entry.statements,
+    statement_count: entry.statement_count,
+    checksum: entry.checksum,
+    applied_at: entry.applied_at
+  };
+  return migration.checksum === migrationInventoryChecksum(migration) ? migration : null;
+}
+function compareMigrationInventoryEntries(left, right) {
+  const leftVersion = BigInt(left.version);
+  const rightVersion = BigInt(right.version);
+  if (leftVersion === rightVersion)
+    return 0;
+  return leftVersion < rightVersion ? -1 : 1;
+}
+function migrationInventory(payload) {
+  if (!Array.isArray(payload))
+    return null;
+  const inventory = [];
+  const versions = new Set;
+  for (const rawEntry of payload) {
+    const entry = migrationInventoryEntry(rawEntry);
+    if (!entry)
+      return null;
+    if (versions.has(entry.version))
+      return null;
+    versions.add(entry.version);
+    inventory.push(entry);
+  }
+  return inventory.sort(compareMigrationInventoryEntries);
+}
+function migrationInventoryPath(ref) {
+  return `/v1/projects/${projectRefPathSegment(ref, "migration_inventory")}/database/migrations`;
+}
+function migrationInventoryFailure(code, httpStatus) {
+  return {
+    isError: true,
+    content: [{
+      type: "text",
+      text: JSON.stringify({
+        ok: false,
+        operation: "database.migration_inventory",
+        error: { code, http_status: httpStatus }
+      }, null, 2)
+    }]
+  };
+}
+function migrationInventoryResponse(response) {
+  if (!response.ok) {
+    return migrationInventoryFailure("HTTP_ERROR", response.transportError ? null : response.status);
+  }
+  const inventory = migrationInventory(response.data);
+  if (!inventory)
+    return migrationInventoryFailure("INVALID_RESPONSE", response.status);
+  return { content: [{ type: "text", text: JSON.stringify(inventory, null, 2) }] };
+}
 function readMigrationFile(dir, file) {
   const rawBytes = readFileSync2(join(dir, file));
   return {
@@ -6854,6 +6964,28 @@ function migrationRows(data) {
 function migrationIdentityKey(version, name) {
   return `${version}\x00${name}`;
 }
+function migrationIdentities(data) {
+  return migrationRows(data).flatMap((row) => row.version == null || row.name == null ? [] : [{ version: String(row.version), name: String(row.name) }]);
+}
+function identityConflicts(local, remote) {
+  const reusesVersionOrName = local.version === remote.version || local.name === remote.name;
+  const exactlyMatches = local.version === remote.version && local.name === remote.name;
+  return reusesVersionOrName && !exactlyMatches;
+}
+function migrationIdentityConflicts(data, migrationFiles) {
+  const remoteMigrations = migrationIdentities(data);
+  return migrationFiles.flatMap((localMigration) => remoteMigrations.filter((remoteMigration) => identityConflicts(localMigration, remoteMigration)).map((remoteMigration) => ({ file: localMigration.file, local: localMigration, remote: remoteMigration })));
+}
+function assertNoMigrationIdentityConflicts(data, migrationFiles) {
+  const conflicts = migrationIdentityConflicts(data, migrationFiles);
+  if (!conflicts.length)
+    return;
+  throw new Error([
+    "Migration identity conflicts:",
+    ...conflicts.map(({ file, local, remote }) => `- ${file} (${local.version}) conflicts with remote ${remote.name} (${remote.version})`)
+  ].join(`
+`));
+}
 function nameBoundMigrationMarkerKeys(data) {
   const keys = new Set;
   for (const row of migrationRows(data)) {
@@ -6939,6 +7071,7 @@ function registerDatabaseTools(server, http, config = {}) {
     "stats",
     "slow_queries",
     "list_migrations",
+    "migration_inventory",
     "project_url",
     "generate_types"
   ];
@@ -7078,6 +7211,10 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
         text = r.ok ? formatMigrations(r.data) : `❌ Failed (${r.status})`;
         break;
       }
+      case "migration_inventory": {
+        const response = await http.get(migrationInventoryPath(ref), { maxResponseBytes: MAX_MIGRATION_INVENTORY_BYTES });
+        return migrationInventoryResponse(response);
+      }
       case "project_url": {
         const r = await http.get(`/v1/projects/${ref}`);
         text = r.ok ? JSON.stringify({ url: r.data.api?.url || `https://${ref}.supabase.co` }, null, 2) : `❌ Failed (${r.status})`;
@@ -7112,6 +7249,7 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
           text = `❌ Failed to load applied migrations (${migrationsResult.status}): ${JSON.stringify(migrationsResult.data)}`;
           break;
         }
+        assertNoMigrationIdentityConflicts(migrationsResult.data, migrationFiles);
         if (args.dry_run) {
           const appliedKeys = appliedMigrationKeys(migrationsResult.data);
           const pending = migrationFiles.filter(({ name, version }) => !appliedKeys.has(name) && !appliedKeys.has(String(version)));
@@ -7729,135 +7867,534 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status}): ${JSON.stringif
   });
 }
 
+// src/shared/tools/release-control-response.ts
+var RELEASE_CONTROL_RESPONSE_SCHEMA = "supacloud.cli.release-control.v1";
+function releaseControlSuccess(operation, payload) {
+  return releaseControlResponse({
+    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
+    ok: true,
+    operation,
+    ...payload
+  });
+}
+function releaseControlFailure(operation, code, httpStatus) {
+  return releaseControlErrorResponse({
+    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
+    ok: false,
+    operation,
+    error: { code, http_status: httpStatus }
+  });
+}
+function releaseControlMutationFailure(operation, response) {
+  const outcomeUnknown = response.transportError || response.status === 408 || response.status >= 500;
+  return outcomeUnknown ? releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.transportError ? null : response.status) : releaseControlFailure(operation, "HTTP_ERROR", response.status);
+}
+function releaseControlResponse(payload) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(payload, null, 2) }]
+  };
+}
+function releaseControlErrorResponse(payload) {
+  return { ...releaseControlResponse(payload), isError: true };
+}
+
 // src/shared/tools/storage-tools.ts
+var MAX_BUCKET_ID_LENGTH = 100;
+var MAX_MIME_TYPE_COUNT = 100;
+var MAX_MIME_TYPE_LENGTH = 255;
+var PROJECT_REF_PATTERN2 = /^[A-Za-z0-9_-]{1,64}$/;
+var BUCKET_ID_PATTERN = new RegExp(`^(?!\\.+$)[A-Za-z0-9._-]{1,${MAX_BUCKET_ID_LENGTH}}$`);
+var MIME_TYPE_PATTERN = /^(?=\S)(?=.*\S$)[^\u0000-\u001f\u007f]+$/;
+var BUCKET_REVISION_PATTERN = /^[0-9]{1,20}$/;
+var ACTION_ARGUMENTS = {
+  status: new Set(["action"]),
+  list_buckets: new Set(["action", "ref"]),
+  get_bucket: new Set(["action", "ref", "bucket"]),
+  create_bucket: new Set(["action", "ref", "bucket", "public", "file_size_limit", "allowed_mime_types"]),
+  update_bucket: new Set(["action", "ref", "bucket", "expected_revision", "public", "file_size_limit", "allowed_mime_types"]),
+  delete_bucket: new Set(["action", "ref", "bucket", "expected_revision", "require_empty"]),
+  list_files: new Set(["action", "ref", "bucket"]),
+  upload_base64: new Set(["action", "ref", "bucket", "filename", "base64_content", "mime_type"]),
+  delete_file: new Set(["action", "ref", "bucket", "filename"])
+};
+function normalizedMimeTypes(candidate) {
+  return Array.isArray(candidate) ? candidate.map((mimeType) => typeof mimeType === "string" ? mimeType.trim() : mimeType) : candidate;
+}
+function parseAllowedMimeTypes(input) {
+  if (Array.isArray(input))
+    return normalizedMimeTypes(input);
+  const trimmed = input.trim();
+  if (!trimmed)
+    return [];
+  if (!trimmed.startsWith("[")) {
+    return normalizedMimeTypes(trimmed.split(","));
+  }
+  try {
+    return normalizedMimeTypes(JSON.parse(trimmed));
+  } catch (error) {
+    if (!(error instanceof SyntaxError))
+      throw error;
+    throw new Error("Invalid allowed_mime_types JSON array");
+  }
+}
+var allowedMimeTypesSchema = Type.Optional(decodedSchema(Type.Union([Type.String(), Type.Array(Type.String())]), Type.Array(Type.String({
+  minLength: 1,
+  maxLength: MAX_MIME_TYPE_LENGTH,
+  pattern: MIME_TYPE_PATTERN.source
+}), { maxItems: MAX_MIME_TYPE_COUNT }), parseAllowedMimeTypes));
+var fileSizeLimitSchema = Type.Optional(Type.Integer({
+  minimum: 1,
+  maximum: Number.MAX_SAFE_INTEGER
+}));
+function requiredText(args, field) {
+  const text = args[field];
+  if (typeof text !== "string" || !text.trim()) {
+    throw new Error(`'${field}' required for '${String(args.action)}'`);
+  }
+  return text.trim();
+}
+function validBucketId(bucket) {
+  return BUCKET_ID_PATTERN.test(bucket);
+}
+function requiredProjectRef(args) {
+  const ref = requiredText(args, "ref");
+  if (!PROJECT_REF_PATTERN2.test(ref))
+    throw new Error("'ref' is invalid for Storage buckets");
+  return ref;
+}
+function requiredBucketId(args) {
+  const bucket = requiredText(args, "bucket");
+  if (!validBucketId(bucket))
+    throw new Error("'bucket' is invalid for Storage buckets");
+  return bucket;
+}
+function requiredBucketRevision(args) {
+  const revision = requiredText(args, "expected_revision");
+  if (!BUCKET_REVISION_PATTERN.test(revision))
+    throw new Error("'expected_revision' is invalid for Storage buckets");
+  return revision;
+}
+function assertEmptyBucketDeletion(args) {
+  if (args.require_empty !== true)
+    throw new Error("'require_empty=true' required for 'delete_bucket'");
+}
+function assertActionArguments(action, args) {
+  const allowedArguments = ACTION_ARGUMENTS[action];
+  if (!allowedArguments)
+    throw new Error(`Unsupported Storage action '${action}'`);
+  const unsupported = Object.keys(args).filter((field) => !allowedArguments.has(field));
+  if (unsupported.length > 0)
+    throw new Error(`'${unsupported[0]}' is not supported for '${action}'`);
+}
+function storageBucketPath(ref, bucket) {
+  if (!PROJECT_REF_PATTERN2.test(ref))
+    throw new Error("'ref' is invalid for Storage buckets");
+  if (bucket !== undefined && !validBucketId(bucket)) {
+    throw new Error("'bucket' is invalid for Storage buckets");
+  }
+  const root = `/v1/projects/${encodeURIComponent(ref)}/storage/buckets`;
+  return bucket === undefined ? root : `${root}/${encodeURIComponent(bucket)}`;
+}
+function bucketRecord(candidate) {
+  return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
+}
+function isFileSizeLimit(candidate) {
+  return candidate === null || typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate > 0;
+}
+function assertBucketSettings(args) {
+  if (args.file_size_limit !== undefined && (args.file_size_limit === null || !isFileSizeLimit(args.file_size_limit))) {
+    throw new Error("'file_size_limit' must be a positive safe integer");
+  }
+  if (args.allowed_mime_types !== undefined && (args.allowed_mime_types === null || !isAllowedMimeTypes(args.allowed_mime_types))) {
+    throw new Error("'allowed_mime_types' is invalid");
+  }
+}
+function isAllowedMimeTypes(candidate) {
+  return candidate === null || Array.isArray(candidate) && candidate.length <= MAX_MIME_TYPE_COUNT && candidate.every((mimeType) => typeof mimeType === "string" && mimeType.length <= MAX_MIME_TYPE_LENGTH && MIME_TYPE_PATTERN.test(mimeType));
+}
+function isBucketRevision(candidate) {
+  return candidate === null || typeof candidate === "string" && BUCKET_REVISION_PATTERN.test(candidate);
+}
+function safeBucket(candidate, expectedBucket) {
+  const bucket = bucketRecord(candidate);
+  if (bucket === null || typeof bucket.id !== "string" || !validBucketId(bucket.id) || typeof bucket.name !== "string" || !validBucketId(bucket.name) || typeof bucket.public !== "boolean" || !isFileSizeLimit(bucket.file_size_limit) || !isAllowedMimeTypes(bucket.allowed_mime_types) || !isBucketRevision(bucket.revision) || expectedBucket !== undefined && bucket.id !== expectedBucket && bucket.name !== expectedBucket) {
+    return null;
+  }
+  return {
+    id: bucket.id,
+    name: bucket.name,
+    public: bucket.public,
+    file_size_limit: bucket.file_size_limit,
+    allowed_mime_types: bucket.allowed_mime_types === null ? null : [...bucket.allowed_mime_types],
+    revision: bucket.revision
+  };
+}
+function safeExactBucket(candidate, expectedBucket) {
+  const bucket = safeBucket(candidate);
+  return bucket?.id === expectedBucket ? bucket : null;
+}
+function safeBucketList(candidate) {
+  if (!Array.isArray(candidate))
+    return null;
+  const buckets = candidate.map((bucket) => safeBucket(bucket));
+  if (buckets.some((bucket) => bucket === null))
+    return null;
+  const safeBuckets = buckets;
+  const ids = safeBuckets.map((bucket) => bucket.id);
+  const names = safeBuckets.map((bucket) => bucket.name);
+  return new Set(ids).size === ids.length && new Set(names).size === names.length ? safeBuckets : null;
+}
+function safeCreatedBucketReceipt(candidate, expectedBucket, request) {
+  const bucket = bucketRecord(candidate);
+  if (bucket?.id !== expectedBucket || bucket.name !== expectedBucket || bucket.public !== (request.public === true))
+    return null;
+  return { bucket: { id: expectedBucket, name: expectedBucket, public: request.public === true } };
+}
+function safeDeletedBucket(candidate, expectedBucket, expectedRevision) {
+  const receipt = bucketRecord(candidate);
+  return receipt?.id === expectedBucket && receipt.deleted === true && receipt.require_empty === true && receipt.previous_revision === expectedRevision && receipt.new_revision === null ? {
+    bucket_id: expectedBucket,
+    deleted: true,
+    require_empty: true,
+    previous_revision: expectedRevision,
+    new_revision: null
+  } : null;
+}
+function mutationReadbackResponse(expectation) {
+  const { operation, ref, response, expectedBucket, request, previousRevision, expectedNewRevision } = expectation;
+  const readback = safeExactBucket(response.data, expectedBucket);
+  const validReadback = readback?.name === expectedBucket && readback.revision !== null && (expectedNewRevision === undefined || readback.revision === expectedNewRevision) && bucketMatchesRequest(readback, request);
+  if (!response.ok || !validReadback || !readback) {
+    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.transportError ? null : response.status);
+  }
+  return releaseControlSuccess(operation, {
+    project_ref: ref,
+    bucket_id: expectedBucket,
+    previous_revision: previousRevision,
+    new_revision: readback.revision,
+    bucket: readback
+  });
+}
+function bucketResponse(expectation) {
+  const { operation, ref, response, operationKind, safePayload } = expectation;
+  if (!response.ok) {
+    return operationKind === "mutation" ? releaseControlMutationFailure(operation, response) : releaseControlFailure(operation, "HTTP_ERROR", response.transportError ? null : response.status);
+  }
+  const payload = safePayload(response.data);
+  if (!payload) {
+    return operationKind === "mutation" ? releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.status) : releaseControlFailure(operation, "INVALID_RESPONSE", null);
+  }
+  return releaseControlSuccess(operation, { project_ref: ref, ...payload });
+}
+function createBucketRequest(args) {
+  assertBucketSettings(args);
+  const request = { name: requiredText(args, "bucket") };
+  if (args.public !== undefined)
+    request.public = args.public;
+  if (args.file_size_limit !== undefined)
+    request.file_size_limit = args.file_size_limit;
+  if (args.allowed_mime_types !== undefined)
+    request.allowed_mime_types = args.allowed_mime_types;
+  return request;
+}
+function updateBucketRequest(args) {
+  assertBucketSettings(args);
+  const settings = Object.fromEntries(["public", "file_size_limit", "allowed_mime_types"].filter((field) => args[field] !== undefined).map((field) => [field, args[field]]));
+  if (Object.keys(settings).length === 0)
+    throw new Error("Bucket update requires at least one field");
+  return { expected_revision: requiredBucketRevision(args), ...settings };
+}
+function equalAllowedMimeTypes(candidate, expected) {
+  if (!Array.isArray(expected))
+    return false;
+  if (expected.length === 0 && candidate === null)
+    return true;
+  return Array.isArray(candidate) && candidate.length === expected.length && candidate.every((mimeType, index) => mimeType === expected[index]);
+}
+function bucketMatchesRequest(candidate, request) {
+  const bucket = bucketRecord(candidate);
+  if (!bucket)
+    return false;
+  if (request.public !== undefined && bucket.public !== request.public)
+    return false;
+  if (request.file_size_limit !== undefined && bucket.file_size_limit !== request.file_size_limit)
+    return false;
+  return request.allowed_mime_types === undefined || equalAllowedMimeTypes(bucket.allowed_mime_types, request.allowed_mime_types);
+}
+async function createBucketMutationReceipt(http, ref, bucket, request) {
+  return bucketResponse({
+    operation: "storage.create_bucket",
+    ref,
+    response: await http.post(storageBucketPath(ref), request),
+    operationKind: "mutation",
+    safePayload: (candidate) => safeCreatedBucketReceipt(candidate, bucket, request)
+  });
+}
+function safeUpdatedBucket(candidate, expectedBucket, expectedRevision, request) {
+  const receipt = bucketRecord(candidate);
+  const bucket = safeExactBucket(candidate, expectedBucket);
+  return bucket && bucket.name === expectedBucket && bucket.revision !== null && bucket.revision !== expectedRevision && receipt?.previous_revision === expectedRevision && receipt.new_revision === bucket.revision && bucketMatchesRequest(bucket, request) ? bucket : null;
+}
+async function listBuckets(http, args) {
+  const ref = requiredProjectRef(args);
+  return bucketResponse({
+    operation: "storage.list_buckets",
+    ref,
+    response: await http.get(storageBucketPath(ref)),
+    operationKind: "read",
+    safePayload: (candidate) => {
+      const buckets = safeBucketList(candidate);
+      return buckets ? { buckets } : null;
+    }
+  });
+}
+async function getBucket(http, args) {
+  const ref = requiredProjectRef(args);
+  const bucket = requiredBucketId(args);
+  return bucketResponse({
+    operation: "storage.get_bucket",
+    ref,
+    response: await http.get(storageBucketPath(ref, bucket)),
+    operationKind: "read",
+    safePayload: (candidate) => {
+      const safeReadback = safeBucket(candidate, bucket);
+      return safeReadback ? { bucket: safeReadback } : null;
+    }
+  });
+}
+async function createBucket(http, args) {
+  const ref = requiredProjectRef(args);
+  const request = createBucketRequest(args);
+  const bucket = request.name;
+  const bucketPath = storageBucketPath(ref, bucket);
+  const receipt = await createBucketMutationReceipt(http, ref, bucket, request);
+  if (receipt.isError)
+    return receipt;
+  const expectedReadback = { ...request, public: request.public === true };
+  return mutationReadbackResponse({
+    operation: "storage.create_bucket",
+    ref,
+    response: await http.get(bucketPath),
+    expectedBucket: bucket,
+    request: expectedReadback,
+    previousRevision: null
+  });
+}
+async function updateBucket(http, args) {
+  const ref = requiredProjectRef(args);
+  const bucket = requiredBucketId(args);
+  const request = updateBucketRequest(args);
+  const expectedRevision = request.expected_revision;
+  const bucketPath = storageBucketPath(ref, bucket);
+  const mutation = await http.put(bucketPath, request);
+  if (!mutation.ok)
+    return releaseControlMutationFailure("storage.update_bucket", mutation);
+  const updated = safeUpdatedBucket(mutation.data, bucket, expectedRevision, request);
+  if (!updated)
+    return releaseControlFailure("storage.update_bucket", "OUTCOME_UNKNOWN", mutation.status);
+  return mutationReadbackResponse({
+    operation: "storage.update_bucket",
+    ref,
+    response: await http.get(bucketPath),
+    expectedBucket: bucket,
+    request,
+    previousRevision: expectedRevision,
+    expectedNewRevision: updated.revision ?? undefined
+  });
+}
+async function deleteBucket(http, args) {
+  const ref = requiredProjectRef(args);
+  const bucket = requiredBucketId(args);
+  const expectedRevision = requiredBucketRevision(args);
+  assertEmptyBucketDeletion(args);
+  const bucketPath = storageBucketPath(ref, bucket);
+  const deletePath = `${bucketPath}?expected_revision=${encodeURIComponent(expectedRevision)}&require_empty=true`;
+  const receipt = bucketResponse({
+    operation: "storage.delete_bucket",
+    ref,
+    response: await http.delete(deletePath),
+    operationKind: "mutation",
+    safePayload: (candidate) => safeDeletedBucket(candidate, bucket, expectedRevision)
+  });
+  if (receipt.isError)
+    return receipt;
+  const readback = await http.get(bucketPath);
+  if (readback.ok || readback.transportError || readback.status !== 404) {
+    return releaseControlFailure("storage.delete_bucket", "OUTCOME_UNKNOWN", readback.transportError ? null : readback.status);
+  }
+  return receipt;
+}
+var BUCKET_ACTION_HANDLERS = {
+  list_buckets: listBuckets,
+  get_bucket: getBucket,
+  create_bucket: createBucket,
+  update_bucket: updateBucket,
+  delete_bucket: deleteBucket
+};
+function executeBucketAction(action, http, args) {
+  if (!Object.hasOwn(BUCKET_ACTION_HANDLERS, action))
+    return null;
+  return BUCKET_ACTION_HANDLERS[action](http, args);
+}
 function registerStorageTools(server, http) {
   server.tool("storage", `S3/MinIO storage management.
-Actions: status, list_buckets, list_files, upload_base64, delete_file`, {
-    action: withDescription(stringEnum(["status", "list_buckets", "list_files", "upload_base64", "delete_file"]), "Action"),
-    ref: optional(Type.String(), "Project ref (required except for 'status')"),
-    bucket: optional(Type.String(), "[list_files/upload/delete] Bucket name"),
-    filename: optional(Type.String(), "[upload/delete] File name/path"),
+Actions: status, list_buckets, get_bucket, create_bucket, update_bucket, delete_bucket, list_files, upload_base64, delete_file`, {
+    action: withDescription(stringEnum([
+      "status",
+      "list_buckets",
+      "get_bucket",
+      "create_bucket",
+      "update_bucket",
+      "delete_bucket",
+      "list_files",
+      "upload_base64",
+      "delete_file"
+    ]), "Action"),
+    ref: optional(Type.String({ pattern: PROJECT_REF_PATTERN2.source }), "[list_buckets/get_bucket/create_bucket/update_bucket/delete_bucket/list_files/upload_base64/delete_file] Project ref"),
+    bucket: optional(Type.String({ pattern: BUCKET_ID_PATTERN.source }), "[get_bucket/create_bucket/update_bucket/delete_bucket/list_files/upload_base64/delete_file] Bucket name or ID"),
+    public: optional(Type.Boolean(), "[create_bucket/update_bucket] Public bucket access"),
+    file_size_limit: withDescription(fileSizeLimitSchema, "[create_bucket/update_bucket] Positive safe-integer per-file size limit in bytes"),
+    allowed_mime_types: withDescription(allowedMimeTypesSchema, "[create_bucket/update_bucket] MIME types as a comma-separated or JSON array"),
+    expected_revision: optional(Type.String({ pattern: BUCKET_REVISION_PATTERN.source }), "[update_bucket/delete_bucket] Exact revision from list_buckets/get_bucket"),
+    require_empty: optional(Type.Boolean(), "[delete_bucket] Must be true; deletion never empties a bucket"),
+    filename: optional(Type.String(), "[upload_base64/delete_file] File name/path"),
     base64_content: optional(Type.String(), "[upload_base64] Base64 encoded content"),
     mime_type: optional(Type.String(), "[upload_base64] MIME type (default: application/octet-stream)")
   }, async (args) => {
-    const { action, ref, bucket, filename, base64_content, mime_type } = args;
-    const need = (f, v) => {
-      if (!v)
-        throw new Error(`'${f}' required for '${action}'`);
-    };
-    const fmt = (data, label, fmtFn) => {
-      return Array.isArray(data) ? fmtFn(data) : JSON.stringify(data, null, 2);
-    };
+    const action = String(args.action);
+    assertActionArguments(action, args);
+    const bucketAction = executeBucketAction(action, http, args);
+    const bucketActionResponse = bucketAction ? await bucketAction : null;
+    if (bucketActionResponse)
+      return bucketActionResponse;
     let text;
     switch (action) {
       case "status":
         text = JSON.stringify((await http.get("/v1/storage/status")).data, null, 2);
         break;
-      case "list_buckets": {
-        need("ref", ref);
-        const res = await http.get(`/v1/storage/${ref}/buckets`);
-        if (!res.ok) {
-          text = `❌ Failed (${res.status})`;
-          break;
-        }
-        const buckets = res.data;
-        if (!Array.isArray(buckets) || !buckets.length) {
-          text = "No buckets found.";
-          break;
-        }
-        text = `\uD83D\uDCE6 Buckets (${buckets.length}):
-` + buckets.map((b) => `  - ${b.name} (${b.public ? "\uD83D\uDD13 public" : "\uD83D\uDD12 private"})`).join(`
-`);
-        break;
-      }
       case "list_files": {
-        need("ref", ref);
-        need("bucket", bucket);
-        const res = await http.get(`/v1/storage/${ref}/buckets/${bucket}/files`);
-        if (!res.ok) {
-          text = `❌ Failed (${res.status})`;
+        const ref = requiredProjectRef(args);
+        const bucket = requiredBucketId(args);
+        const response = await http.get(`/v1/storage/${ref}/buckets/${bucket}/files`);
+        if (!response.ok) {
+          text = `❌ Failed (${response.status})`;
           break;
         }
-        const files = res.data;
+        const files = response.data;
         if (!Array.isArray(files) || !files.length) {
           text = "No files.";
           break;
         }
         text = `\uD83D\uDCC1 Files (${files.length}):
-` + files.map((f) => `  - ${f.name} (${f.size ? (f.size / 1024).toFixed(1) + "KB" : "?"})`).join(`
+` + files.map((file) => `  - ${file.name} (${file.size ? (file.size / 1024).toFixed(1) + "KB" : "?"})`).join(`
 `);
         break;
       }
       case "upload_base64": {
-        need("ref", ref);
-        need("bucket", bucket);
-        need("filename", filename);
-        need("base64_content", base64_content);
+        const ref = requiredProjectRef(args);
+        const bucket = requiredBucketId(args);
+        const filename = requiredText(args, "filename");
+        const base64Content = requiredText(args, "base64_content");
         try {
-          const buffer = Buffer.from(base64_content, "base64");
-          const blob = new Blob([buffer], { type: mime_type || "application/octet-stream" });
+          const buffer = Buffer.from(base64Content, "base64");
+          const blob = new Blob([buffer], { type: typeof args.mime_type === "string" ? args.mime_type : "application/octet-stream" });
           const formData = new FormData;
           formData.append("file", blob, filename);
-          const res = await http.postMultipart(`/v1/storage/${ref}/buckets/${bucket}/upload`, formData);
-          text = res.ok ? `✅ File ${filename} uploaded to ${bucket}` : `❌ Upload failed (${res.status})`;
-        } catch (e) {
-          text = `❌ Error: ${e.message}`;
+          const response = await http.postMultipart(`/v1/storage/${ref}/buckets/${bucket}/upload`, formData);
+          text = response.ok ? `✅ File ${filename} uploaded to ${bucket}` : `❌ Upload failed (${response.status})`;
+        } catch (error) {
+          text = `❌ Error: ${error instanceof Error ? error.message : String(error)}`;
         }
         break;
       }
-      case "delete_file":
-        need("ref", ref);
-        need("bucket", bucket);
-        need("filename", filename);
-        text = (await http.delete(`/v1/storage/${ref}/buckets/${bucket}/files/${filename}`)).ok ? `✅ File ${filename} deleted` : `❌ Failed`;
+      case "delete_file": {
+        const ref = requiredProjectRef(args);
+        const bucket = requiredBucketId(args);
+        const filename = requiredText(args, "filename");
+        text = (await http.delete(`/v1/storage/${ref}/buckets/${bucket}/files/${filename}`)).ok ? `✅ File ${filename} deleted` : "❌ Failed";
         break;
+      }
       default:
-        text = `❌ Unknown action: ${action}`;
+        return releaseControlFailure(`storage.${action}`, "INVALID_RESPONSE", null);
     }
     return { content: [{ type: "text", text }] };
   });
 }
 
 // src/shared/tools/advanced-tools.ts
-import { existsSync as existsSync3, mkdtempSync, readFileSync as readFileSync3, rmSync, statSync as statSync2, writeFileSync } from "node:fs";
+import { createHash as createHash2, timingSafeEqual } from "node:crypto";
+import {
+  closeSync,
+  constants as fsConstants,
+  existsSync as existsSync3,
+  fstatSync,
+  mkdtempSync,
+  openSync,
+  readFileSync as readFileSync3,
+  rmSync,
+  statSync as statSync2,
+  writeFileSync
+} from "node:fs";
 import { tmpdir } from "node:os";
 import { basename as basename2, join as join2, resolve as resolve2 } from "node:path";
 import { promisify } from "node:util";
 import { execFile } from "node:child_process";
-
-// src/shared/tools/release-control-response.ts
-var RELEASE_CONTROL_RESPONSE_SCHEMA = "supacloud.cli.release-control.v1";
-function releaseControlSuccess(operation, payload) {
-  return releaseControlResponse({
-    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
-    ok: true,
-    operation,
-    ...payload
-  });
+var execFileAsync = promisify(execFile);
+var SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/;
+function openFileIdentity(descriptor) {
+  const state = fstatSync(descriptor, { bigint: true });
+  if (!state.isFile())
+    throw new Error("Prebundled path must be a regular file");
+  return {
+    dev: state.dev,
+    ino: state.ino,
+    size: state.size,
+    mtimeNs: state.mtimeNs,
+    ctimeNs: state.ctimeNs
+  };
 }
-function releaseControlFailure(operation, code, httpStatus) {
-  return releaseControlErrorResponse({
-    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
-    ok: false,
-    operation,
-    error: { code, http_status: httpStatus }
-  });
+function sameOpenFile(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
 }
-function releaseControlMutationFailure(operation, response) {
-  const outcomeUnknown = response.transportError || response.status === 408 || response.status >= 500;
-  return outcomeUnknown ? releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.transportError ? null : response.status) : releaseControlFailure(operation, "HTTP_ERROR", response.status);
+function verifiedUtf8Code(bytes) {
+  let code;
+  try {
+    code = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch (error) {
+    if (error instanceof TypeError)
+      throw new Error("Prebundled file is not valid UTF-8");
+    throw error;
+  }
+  if (!Buffer.from(code, "utf8").equals(bytes)) {
+    throw new Error("Prebundled file does not round-trip as UTF-8");
+  }
+  return code;
 }
-function releaseControlResponse(payload) {
-  return {
-    content: [{ type: "text", text: JSON.stringify(payload, null, 2) }]
-  };
+function assertExpectedSha256(bytes, expectedSha256) {
+  if (!SHA256_HEX_PATTERN.test(expectedSha256)) {
+    throw new Error("'--expected-sha256' must be a lowercase 64-character SHA-256");
+  }
+  const actualDigest = createHash2("sha256").update(bytes).digest();
+  const expectedDigest = Buffer.from(expectedSha256, "hex");
+  if (!timingSafeEqual(actualDigest, expectedDigest)) {
+    throw new Error("Prebundled file SHA-256 does not match --expected-sha256");
+  }
 }
-function releaseControlErrorResponse(payload) {
-  return { ...releaseControlResponse(payload), isError: true };
+function readVerifiedPrebundledCode(pathArg, expectedSha256) {
+  const descriptor = openSync(resolve2(pathArg), fsConstants.O_RDONLY | fsConstants.O_NONBLOCK);
+  try {
+    const identityBeforeRead = openFileIdentity(descriptor);
+    const bytes = readFileSync3(descriptor);
+    const identityAfterRead = openFileIdentity(descriptor);
+    if (BigInt(bytes.byteLength) !== identityBeforeRead.size || !sameOpenFile(identityBeforeRead, identityAfterRead)) {
+      throw new Error("Prebundled file changed while it was being read");
+    }
+    assertExpectedSha256(bytes, expectedSha256);
+    return verifiedUtf8Code(bytes);
+  } finally {
+    closeSync(descriptor);
+  }
 }
-
-// src/shared/tools/advanced-tools.ts
-var execFileAsync = promisify(execFile);
 async function runBunBuild(args) {
   try {
     return await execFileAsync("bun", ["build", ...args], { maxBuffer: 10 * 1024 * 1024 });
@@ -7882,6 +8419,54 @@ async function bundleEdgeFunctionPath(pathArg) {
     rmSync(tmpDir, { recursive: true, force: true });
   }
 }
+function prebundledDeployCode(pathArg, expectedSha256, minify) {
+  if (typeof expectedSha256 !== "string") {
+    throw new Error("'--expected-sha256' required with '--prebundled-path'");
+  }
+  if (minify !== undefined) {
+    throw new Error("'--minify' cannot be combined with '--prebundled-path'");
+  }
+  return {
+    code: readVerifiedPrebundledCode(pathArg, expectedSha256),
+    prebundled: true,
+    expectedSha256
+  };
+}
+async function preparedDeployCode(args) {
+  const codeArg = args.code;
+  const pathArg = args.path;
+  const prebundledPath = args["prebundled-path"];
+  const sources = [codeArg, pathArg, prebundledPath].filter((source) => source !== undefined);
+  if (sources.length !== 1) {
+    throw new Error("Exactly one of '--code', '--path', or '--prebundled-path' is required for 'deploy'");
+  }
+  if (typeof prebundledPath === "string") {
+    return prebundledDeployCode(prebundledPath, args["expected-sha256"], args.minify);
+  }
+  if (args["expected-sha256"] !== undefined) {
+    throw new Error("'--expected-sha256' requires '--prebundled-path'");
+  }
+  if (typeof codeArg === "string")
+    return { code: codeArg, prebundled: false };
+  if (typeof pathArg !== "string")
+    throw new Error("Function deploy source is invalid");
+  return bundledDeployCode(pathArg);
+}
+async function bundledDeployCode(pathArg) {
+  try {
+    return { code: await bundleEdgeFunctionPath(pathArg), prebundled: false };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to bundle/read path ${pathArg}: ${message}`);
+  }
+}
+function rejectPrebundledFlagsOutsideDeploy(action, args) {
+  for (const flag of ["prebundled-path", "expected-sha256"]) {
+    if (action !== "deploy" && args[flag] !== undefined) {
+      throw new Error(`'--${flag}' is not supported for '${action}'`);
+    }
+  }
+}
 function resolveEntrypoint(pathArg) {
   const resolved = resolve2(pathArg);
   const stat = statSync2(resolved);
@@ -7928,21 +8513,42 @@ function parseFunctionFiles(input) {
   }
 }
 var functionFilesSchema = decodedSchema(Type.Union([Type.String(), functionFilesRecordSchema]), functionFilesRecordSchema, parseFunctionFiles);
-function parseFunctionVersion(input) {
+function positiveFunctionVersion(input, label) {
+  if (typeof input !== "string" && typeof input !== "number") {
+    throw new Error(`${label} must be a canonical positive safe integer`);
+  }
   const version = String(input);
-  if (!CANONICAL_FUNCTION_VERSION_PATTERN.test(version) || !Number.isSafeInteger(Number(version))) {
-    throw new Error("Function version must be a canonical safe integer");
+  if (!POSITIVE_FUNCTION_VERSION_PATTERN.test(version) || !Number.isSafeInteger(Number(version))) {
+    throw new Error(`${label} must be a canonical positive safe integer`);
   }
   return version;
 }
-var CANONICAL_FUNCTION_VERSION_PATTERN = /^(?:0|[1-9][0-9]*)$/;
-var SAFE_FUNCTION_REF_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+var POSITIVE_FUNCTION_VERSION_PATTERN = /^[1-9][0-9]*$/;
 var SAFE_FUNCTION_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
-var FUNCTION_ACTIVATION_ARGUMENTS = new Set(["action", "ref", "slug", "version"]);
+var FUNCTION_ACTIVATION_ARGUMENTS = new Set([
+  "action",
+  "ref",
+  "slug",
+  "version",
+  "expected-active-version"
+]);
 var functionVersionSchema = Type.Optional(decodedSchema(Type.Union([
-  Type.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),
-  Type.String({ pattern: CANONICAL_FUNCTION_VERSION_PATTERN.source, maxLength: 16 })
-]), Type.String({ pattern: CANONICAL_FUNCTION_VERSION_PATTERN.source, maxLength: 16 }), parseFunctionVersion));
+  Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),
+  Type.String({ pattern: POSITIVE_FUNCTION_VERSION_PATTERN.source, maxLength: 16 })
+]), Type.String({ pattern: POSITIVE_FUNCTION_VERSION_PATTERN.source, maxLength: 16 }), (input) => positiveFunctionVersion(input, "Function version")));
+function parseExpectedActiveVersion(input) {
+  if (input === "absent")
+    return input;
+  return positiveFunctionVersion(input, "Expected active version");
+}
+var expectedActiveVersionSchema = Type.Optional(decodedSchema(Type.Union([
+  Type.Literal("absent"),
+  Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),
+  Type.String({ pattern: POSITIVE_FUNCTION_VERSION_PATTERN.source, maxLength: 16 })
+]), Type.Union([
+  Type.Literal("absent"),
+  Type.String({ pattern: POSITIVE_FUNCTION_VERSION_PATTERN.source, maxLength: 16 })
+]), parseExpectedActiveVersion));
 var secretListSchema = Type.Array(Type.Object({ name: Type.String(), value: Type.String() }));
 var ENVIRONMENT_SECRET_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
 var MAX_SECRET_COUNT = 1024;
@@ -8060,10 +8666,35 @@ function secretsForUpsert(inlineSecrets, environmentNames, environment) {
     throw new Error("'secrets' array required");
   return inlineSecrets;
 }
+var INVALID_FUNCTION_LIST_RESPONSE = "❌ Edge Function list response is invalid";
+var INVALID_FUNCTION_SOURCE_RESPONSE = "❌ Edge Function source response is invalid";
+function invalidFunctionReadResponse(message) {
+  return { isError: true, content: [{ type: "text", text: message }] };
+}
+function safeFunctionList(payload) {
+  if (!Array.isArray(payload))
+    return null;
+  const functionSlugs = new Set;
+  for (const candidate of payload) {
+    const edgeFunction = objectRecord(candidate);
+    const slug = edgeFunction?.slug;
+    const version = edgeFunction?.version;
+    if (typeof slug !== "string" || !SAFE_FUNCTION_SLUG_PATTERN.test(slug) || typeof version !== "number" || !Number.isSafeInteger(version) || version < 1 || functionSlugs.has(slug))
+      return null;
+    functionSlugs.add(slug);
+  }
+  return payload;
+}
+function functionListResponse(response) {
+  if (!response.ok)
+    return invalidFunctionReadResponse(`❌ Failed (${response.status})`);
+  const functions = safeFunctionList(response.data);
+  return functions ? { content: [{ type: "text", text: JSON.stringify(functions, null, 2) }] } : invalidFunctionReadResponse(INVALID_FUNCTION_LIST_RESPONSE);
+}
 function confirmedFunctionConfig(payload, expected) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+  const response = objectRecord(payload);
+  if (!response)
     return false;
-  const response = payload;
   if (expected.verify_jwt !== undefined && response.verify_jwt !== expected.verify_jwt)
     return false;
   if (expected.background_routes !== undefined) {
@@ -8074,28 +8705,87 @@ function confirmedFunctionConfig(payload, expected) {
   }
   return true;
 }
-function functionSourceCode(payload) {
+function functionSourceCode(payload, field = "code") {
   if (!payload || typeof payload !== "object" || Array.isArray(payload))
     return null;
-  const code = payload.code;
+  const code = payload[field];
   return typeof code === "string" ? code : null;
 }
+function requestedSourceVersion(candidate) {
+  return candidate === undefined ? undefined : positiveFunctionVersion(candidate, "Function source version");
+}
+function functionSourceOutput(slug, sourceCode, output) {
+  if (!output) {
+    return { content: [{ type: "text", text: JSON.stringify({ code: sourceCode }, null, 2) }] };
+  }
+  const outputPath = resolve2(output);
+  writeFileSync(outputPath, sourceCode, { flag: "wx" });
+  return {
+    content: [{
+      type: "text",
+      text: `✅ Function ${slug} source written to ${outputPath} (${Buffer.byteLength(sourceCode)} bytes)`
+    }]
+  };
+}
 function objectRecord(candidate) {
   return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
 }
-function activationResponse(slug, version, response) {
-  const operation = "edge_functions.activate";
+function edgeFunctionResourcePath(ref, slug) {
+  const root = `/v1/projects/${projectRefPathSegment(ref, "Edge Functions")}/functions`;
+  if (slug === undefined)
+    return root;
+  if (typeof slug !== "string" || !SAFE_FUNCTION_SLUG_PATTERN.test(slug)) {
+    throw new Error("'slug' is invalid for Edge Functions");
+  }
+  return `${root}/${encodeURIComponent(slug)}`;
+}
+async function readFunctionSource(http, request) {
+  const sourceVersion = requestedSourceVersion(request.version);
+  const resourcePath = edgeFunctionResourcePath(request.projectRef, request.slug);
+  const sourcePath = sourceVersion === undefined ? `${resourcePath}/source` : `${resourcePath}/versions/${encodeURIComponent(sourceVersion)}`;
+  const response = await http.get(sourcePath);
   if (!response.ok)
-    return releaseControlMutationFailure(operation, response);
-  const receipt = objectRecord(response.data);
-  const config = objectRecord(receipt?.config);
-  if (receipt?.success !== true || receipt.version !== version || config?.version !== version || typeof config.verify_jwt !== "boolean") {
-    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.status);
+    return invalidFunctionReadResponse(`❌ Failed (${response.status})`);
+  const sourceCode = functionSourceCode(response.data, sourceVersion === undefined ? "code" : "source_code");
+  return sourceCode === null ? invalidFunctionReadResponse(INVALID_FUNCTION_SOURCE_RESPONSE) : functionSourceOutput(request.slug, sourceCode, request.output);
+}
+function mutationIdentityMatches(receipt, expectation) {
+  return receipt.success === true && receipt.project_ref === expectation.projectRef && receipt.slug === expectation.slug && receipt.previous_active_version === expectation.expectedActiveVersion;
+}
+function validReceiptVersion(activeVersion) {
+  return typeof activeVersion === "string" && POSITIVE_FUNCTION_VERSION_PATTERN.test(activeVersion) && Number.isSafeInteger(Number(activeVersion));
+}
+function confirmedMutationVersion(receipt, config, expectation) {
+  const activeVersion = receipt.active_version;
+  if (!validReceiptVersion(activeVersion) || receipt.version !== activeVersion || config.version !== activeVersion || expectation.targetVersion !== undefined && activeVersion !== expectation.targetVersion) {
+    return null;
   }
-  return releaseControlSuccess(operation, {
-    slug,
-    version,
-    verify_jwt: config.verify_jwt
+  return activeVersion;
+}
+function confirmedFunctionMutation(expectation, payload) {
+  const receipt = objectRecord(payload);
+  const config = objectRecord(receipt?.config);
+  if (!receipt || !config || !mutationIdentityMatches(receipt, expectation))
+    return null;
+  const activeVersion = confirmedMutationVersion(receipt, config, expectation);
+  if (activeVersion === null || typeof config.verify_jwt !== "boolean" || !confirmedFunctionConfig(config, expectation.config ?? {}))
+    return null;
+  return { activeVersion, verifyJwt: config.verify_jwt };
+}
+function functionMutationResponse(expectation, response) {
+  if (!response.ok)
+    return releaseControlMutationFailure(expectation.operation, response);
+  const confirmed = confirmedFunctionMutation(expectation, response.data);
+  if (!confirmed) {
+    return releaseControlFailure(expectation.operation, "OUTCOME_UNKNOWN", response.status);
+  }
+  return releaseControlSuccess(expectation.operation, {
+    project_ref: expectation.projectRef,
+    slug: expectation.slug,
+    previous_active_version: expectation.expectedActiveVersion,
+    active_version: confirmed.activeVersion,
+    version: confirmed.activeVersion,
+    verify_jwt: confirmed.verifyJwt
   });
 }
 function readOnlyActivationResult() {
@@ -8107,15 +8797,22 @@ function readOnlyActivationResult() {
 function functionActivationTarget(args) {
   const projectRef = typeof args.ref === "string" ? args.ref.trim() : "";
   const functionSlug = typeof args.slug === "string" ? args.slug.trim() : "";
-  const version = args.version;
-  if (!SAFE_FUNCTION_REF_PATTERN.test(projectRef))
-    throw new Error("'ref' is invalid for 'activate'");
+  const version = positiveFunctionVersion(args.version, "Function activation version");
+  projectRefPathSegment(projectRef, "Edge Function activation");
   if (!SAFE_FUNCTION_SLUG_PATTERN.test(functionSlug))
     throw new Error("'slug' is invalid for 'activate'");
-  if (typeof version !== "string" || !CANONICAL_FUNCTION_VERSION_PATTERN.test(version) || !Number.isSafeInteger(Number(version))) {
-    throw new Error("'version' is invalid for 'activate'");
+  const expectedActiveVersion = requiredExpectedActiveVersion(args, "activate");
+  return { projectRef, functionSlug, version, expectedActiveVersion };
+}
+function requiredExpectedActiveVersion(args, action) {
+  const expected = args["expected-active-version"];
+  if (expected === undefined) {
+    throw new Error(`'--expected-active-version' required for '${action}'`);
   }
-  return { projectRef, functionSlug, version };
+  const parsed = parseExpectedActiveVersion(expected);
+  if (typeof parsed !== "string")
+    throw new Error("Expected active version is invalid");
+  return parsed;
 }
 async function activateFunctionVersion(http, args, readOnly = false) {
   if (readOnly)
@@ -8123,29 +8820,40 @@ async function activateFunctionVersion(http, args, readOnly = false) {
   const unsupported = Object.keys(args).filter((name) => !FUNCTION_ACTIVATION_ARGUMENTS.has(name));
   if (unsupported.length > 0)
     throw new Error(`'${unsupported[0]}' is not supported for 'activate'`);
-  const { projectRef, functionSlug, version } = functionActivationTarget(args);
-  const endpoint = `/v1/projects/${encodeURIComponent(projectRef)}/functions/${encodeURIComponent(functionSlug)}` + `/versions/${encodeURIComponent(version)}/activate`;
-  return activationResponse(functionSlug, version, await http.post(endpoint));
+  const { projectRef, functionSlug, version, expectedActiveVersion } = functionActivationTarget(args);
+  const endpoint = edgeFunctionResourcePath(projectRef, functionSlug) + `/versions/${encodeURIComponent(version)}/activate`;
+  return functionMutationResponse({
+    operation: "edge_functions.activate",
+    projectRef,
+    slug: functionSlug,
+    expectedActiveVersion,
+    targetVersion: version
+  }, await http.post(endpoint, { expected_active_version: expectedActiveVersion }));
 }
 function registerAdvancedTools(server, http, environment = process.env, options = {}) {
-  server.tool("edge_functions", `Edge Function management (Deno/Bun serverless). Server auto-bundles dependencies.
+  server.tool("edge_functions", `Edge Function management (Deno/Bun serverless). Source deploys are bundled; verified prebuilt artifacts stay byte-exact.
 Actions: list, deploy, deploy_bundle, config, source, activate, delete, check`, {
     action: withDescription(stringEnum(["list", "deploy", "deploy_bundle", "config", "source", "activate", "delete", "check"]), "Action"),
     ref: withDescription(Type.String(), "Project ref"),
     slug: optional(Type.String(), "[deploy/deploy_bundle/config/source/activate/delete/check] Function name"),
-    version: withDescription(functionVersionSchema, "[activate] Existing Function version"),
+    version: withDescription(functionVersionSchema, "[source/activate] Existing immutable Function version; source requires a positive version"),
     code: optional(Type.String(), "[deploy/check] Function source code (TypeScript)"),
     path: optional(Type.String(), "[deploy/check] Local file path to read code from (alternative to code)"),
+    "prebundled-path": optional(Type.String(), "[deploy] Prebuilt runtime bundle to upload without rebuilding; requires expected-sha256"),
+    "expected-sha256": optional(Type.String({ pattern: SHA256_HEX_PATTERN.source, minLength: 64, maxLength: 64 }), "[deploy] Required lowercase SHA-256 of the exact prebundled-path bytes"),
     output: optional(Type.String(), "[source] Write source to this local file instead of stdout; the file must not already exist"),
     files: optional(functionFilesSchema, "[deploy_bundle] File map as a JSON object: { 'index.ts': '...', '_shared/x.ts': '...' }"),
     entrypoint: optional(Type.String(), "[deploy_bundle] Entrypoint file (default: index.ts)"),
     minify: optional(Type.Boolean(), "[deploy/deploy_bundle] Minify bundle"),
     verify_jwt: optional(Type.Boolean(), "[deploy/deploy_bundle/config] Set JWT verification for this function"),
-    background_routes: withDescription(backgroundRoutesSchema, "[deploy/deploy_bundle/config] Background route paths; pass comma-separated or JSON array in CLI")
+    background_routes: withDescription(backgroundRoutesSchema, "[deploy/deploy_bundle/config] Background route paths; pass comma-separated or JSON array in CLI"),
+    "expected-active-version": withDescription(expectedActiveVersionSchema, "[deploy/deploy_bundle/activate] Required current active version, or 'absent' when none exists")
   }, async (args) => {
     if (args.action === "activate")
       return activateFunctionVersion(http, args, options.readOnly);
     const { action, ref, slug, path: pathArg, output, files, entrypoint, minify, verify_jwt, background_routes } = args;
+    rejectPrebundledFlagsOutsideDeploy(action, args);
+    const expectedActiveVersion = action === "deploy" || action === "deploy_bundle" ? requiredExpectedActiveVersion(args, action) : undefined;
     let code = args.code;
     const need = (f, v) => {
       if (!v)
@@ -8162,16 +8870,10 @@ Actions: list, deploy, deploy_bundle, config, source, activate, delete, check`,
       if (!hasFunctionConfig()) {
         throw new Error("'verify_jwt' or 'background_routes' required for 'config'");
       }
-      const cr = await http.patch(`/v1/projects/${ref}/functions/${slug}/config`, functionConfig());
+      const cr = await http.patch(`${edgeFunctionResourcePath(ref, slug)}/config`, functionConfig());
       return cr.ok ? `✅ Function ${slug} config updated
 ${JSON.stringify(cr.data, null, 2)}` : `❌ Config update failed (${cr.status}): ${JSON.stringify(cr.data)}`;
     };
-    const deploymentPolicyReceiptText = (successText, responsePayload) => {
-      if (!hasFunctionConfig() || confirmedFunctionConfig(responsePayload, functionConfig())) {
-        return successText;
-      }
-      return "❌ Unsafe deployment receipt: POST succeeded but did not confirm the requested function policy. No follow-up PATCH was attempted because code and policy must be activated atomically.";
-    };
     const checkSyntax = async (sourceCode) => {
       const tmpDir = mkdtempSync(join2(tmpdir(), "supacloud-edge-check-"));
       const tmpFile = join2(tmpDir, "index.ts");
@@ -8186,7 +8888,7 @@ ${e.stderr || e.message}` };
         rmSync(tmpDir, { recursive: true, force: true });
       }
     };
-    if (pathArg && !code) {
+    if (action === "check" && pathArg && !code) {
       try {
         code = await bundleEdgeFunctionPath(pathArg);
       } catch (error) {
@@ -8196,8 +8898,7 @@ ${e.stderr || e.message}` };
     }
     switch (action) {
       case "list":
-        text = JSON.stringify((await http.get(`/v1/projects/${ref}/functions`)).data, null, 2);
-        break;
+        return functionListResponse(await http.get(edgeFunctionResourcePath(ref)));
       case "check":
         need("code (or path)", code);
         const checkRes = await checkSyntax(code);
@@ -8210,65 +8911,59 @@ ${checkRes.err}`;
         break;
       case "deploy":
         need("slug", slug);
-        need("code", code);
-        const deployCheck = await checkSyntax(code);
-        if (!deployCheck.ok) {
-          text = `❌ Deployment aborted. Syntax check failed:
+        const deployCode = await preparedDeployCode(args);
+        if (!deployCode.prebundled) {
+          const deployCheck = await checkSyntax(deployCode.code);
+          if (!deployCheck.ok) {
+            text = `❌ Deployment aborted. Syntax check failed:
 ${deployCheck.err}`;
-          break;
+            break;
+          }
         }
-        const dr = await http.post(`/v1/projects/${ref}/functions/${slug}`, {
-          code,
-          minify,
+        const deploymentResponse = await http.post(edgeFunctionResourcePath(ref, slug), {
+          code: deployCode.code,
+          ...deployCode.prebundled ? { prebundled: true, expected_sha256: deployCode.expectedSha256 } : { minify },
+          expected_active_version: expectedActiveVersion,
           ...functionConfig()
         });
-        if (!dr.ok) {
-          text = `❌ Failed (${dr.status}): ${JSON.stringify(dr.data)}`;
-          break;
-        }
-        text = deploymentPolicyReceiptText(`✅ Function ${slug} deployed`, dr.data);
-        break;
+        return functionMutationResponse({
+          operation: "edge_functions.deploy",
+          projectRef: ref,
+          slug,
+          expectedActiveVersion,
+          config: functionConfig()
+        }, deploymentResponse);
       case "deploy_bundle":
         need("slug", slug);
         need("files", files);
-        const br = await http.post(`/v1/projects/${ref}/functions/${slug}/bundle`, {
+        const bundleResponse = await http.post(`${edgeFunctionResourcePath(ref, slug)}/bundle`, {
           files,
           entrypoint,
           minify,
+          expected_active_version: expectedActiveVersion,
           ...functionConfig()
         });
-        if (!br.ok) {
-          text = `❌ Failed (${br.status}): ${JSON.stringify(br.data)}`;
-          break;
-        }
-        text = deploymentPolicyReceiptText(`✅ Function ${slug} bundle deployed (${Object.keys(files).length} files)`, br.data);
-        break;
+        return functionMutationResponse({
+          operation: "edge_functions.deploy_bundle",
+          projectRef: ref,
+          slug,
+          expectedActiveVersion,
+          config: functionConfig()
+        }, bundleResponse);
       case "config":
         text = await updateFunctionConfig();
         break;
       case "source":
         need("slug", slug);
-        const sr = await http.get(`/v1/projects/${ref}/functions/${slug}/source`);
-        if (!sr.ok) {
-          text = `❌ Not found (${sr.status})`;
-          break;
-        }
-        if (!output) {
-          text = JSON.stringify(sr.data, null, 2);
-          break;
-        }
-        const sourceCode = functionSourceCode(sr.data);
-        if (sourceCode === null) {
-          text = "❌ Source response did not contain a string code field";
-          break;
-        }
-        const outputPath = resolve2(output);
-        writeFileSync(outputPath, sourceCode, { flag: "wx" });
-        text = `✅ Function ${slug} source written to ${outputPath} (${Buffer.byteLength(sourceCode)} bytes)`;
-        break;
+        return readFunctionSource(http, {
+          projectRef: ref,
+          slug,
+          version: args.version,
+          output
+        });
       case "delete":
         need("slug", slug);
-        text = (await http.delete(`/v1/projects/${ref}/functions/${slug}`)).ok ? `✅ Function ${slug} deleted` : `❌ Failed`;
+        text = (await http.delete(edgeFunctionResourcePath(ref, slug))).ok ? `✅ Function ${slug} deleted` : `❌ Failed`;
         break;
       default:
         text = `❌ Unknown action`;
@@ -10180,7 +10875,6 @@ var FORBIDDEN_HEADER_NAMES = new Set([
   "via",
   "x-project-ref"
 ]);
-var PROJECT_REF_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
 var SCHEDULE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var SAFE_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 var CRON_PART_PATTERN = /^(\*|([0-9]+)(?:-([0-9]+))?)(?:\/([0-9]+))?$/;
@@ -10190,12 +10884,14 @@ var MAX_BODY_FILE_BYTES = 1048576;
 var MAX_HEADER_COUNT = 64;
 var MAX_HEADER_VALUE_LENGTH = 8192;
 var MAX_SCHEDULE_NAME_LENGTH = 120;
+var CANONICAL_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
 var headerEnvironmentRecord = Type.Record(Type.String(), Type.String());
-var ACTION_ARGUMENTS = {
+var ACTION_ARGUMENTS2 = {
   list: new Set(["action", "ref"]),
+  get: new Set(["action", "ref", "schedule_id"]),
   create: new Set(["action", "ref", "name", "slug", "cron", "method", "body_file", "header_env"]),
-  update: new Set(["action", "ref", "schedule_id", "name", "cron", "method", "enabled", "body_file", "header_env"]),
-  delete: new Set(["action", "ref", "schedule_id"])
+  update: new Set(["action", "ref", "schedule_id", "expected_updated_at", "name", "cron", "method", "enabled", "body_file", "header_env"]),
+  delete: new Set(["action", "ref", "schedule_id", "expected_updated_at"])
 };
 function parseHeaderEnvironment(input) {
   if (typeof input !== "string")
@@ -10315,7 +11011,13 @@ function validScheduleDefinition(schedule) {
   return typeof schedule.cron === "string" && validScheduledFunctionCron(schedule.cron) && (schedule.method === "GET" || schedule.method === "POST") && typeof schedule.enabled === "boolean";
 }
 function validScheduleMetadata(schedule) {
-  return typeof schedule.created_at === "string" && typeof schedule.updated_at === "string";
+  return typeof schedule.created_at === "string" && isCanonicalTimestamp(schedule.updated_at);
+}
+function isCanonicalTimestamp(candidate) {
+  if (typeof candidate !== "string" || !CANONICAL_TIMESTAMP_PATTERN.test(candidate))
+    return false;
+  const milliseconds = Date.parse(candidate);
+  return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === candidate;
 }
 function safeSchedulePayload(schedule) {
   const headerNames = safeHeaderNames(schedule.header_names);
@@ -10349,26 +11051,25 @@ function safeSchedule(candidate) {
     updated_at: schedule.updated_at
   };
 }
-function requiredText(args, name, action) {
+function requiredText2(args, name, action) {
   const candidate = args[name];
   if (typeof candidate !== "string" || !candidate.trim()) {
     throw new Error(`'${name}' is required for '${action}'`);
   }
   return candidate.trim();
 }
-function assertActionArguments(action, args) {
-  const unsupported = Object.keys(args).filter((name) => !ACTION_ARGUMENTS[action].has(name));
+function assertActionArguments2(action, args) {
+  const unsupported = Object.keys(args).filter((name) => !ACTION_ARGUMENTS2[action].has(name));
   if (unsupported.length > 0) {
     throw new Error(`'${unsupported[0]}' is not supported for '${action}'`);
   }
 }
 function schedulePath(ref, scheduleId) {
-  if (!PROJECT_REF_PATTERN.test(ref))
-    throw new Error("'ref' is invalid for Scheduled Functions");
+  const projectRefSegment = projectRefPathSegment(ref, "Scheduled Functions");
   if (scheduleId !== undefined && !SCHEDULE_ID_PATTERN.test(scheduleId)) {
     throw new Error("'schedule_id' is invalid");
   }
-  const root = `/v1/projects/${encodeURIComponent(ref)}/scheduled-functions`;
+  const root = `/v1/projects/${projectRefSegment}/scheduled-functions`;
   return scheduleId ? `${root}/${encodeURIComponent(scheduleId)}` : root;
 }
 function scheduleFailure(operation, response) {
@@ -10389,6 +11090,17 @@ function listResponse(ref, response) {
     return releaseControlFailure(operation, "INVALID_RESPONSE", null);
   return releaseControlSuccess(operation, { project_ref: ref, schedules });
 }
+function getResponse(ref, scheduleId, response) {
+  const operation = "scheduled_functions.get";
+  if (!response.ok)
+    return scheduleFailure(operation, response);
+  const payload = objectRecord2(response.data);
+  const schedule = safeSchedule(payload?.schedule);
+  if (payload?.project_ref !== ref || !schedule || schedule.id !== scheduleId) {
+    return releaseControlFailure(operation, "INVALID_RESPONSE", null);
+  }
+  return releaseControlSuccess(operation, { project_ref: ref, schedule });
+}
 function mutationResponse(expectation, response) {
   const { action, ref, requestId, expectedFields } = expectation;
   const scheduleId = action === "update" ? expectation.scheduleId : undefined;
@@ -10398,22 +11110,29 @@ function mutationResponse(expectation, response) {
   const payload = objectRecord2(response.data);
   const schedule = safeSchedule(payload?.schedule);
   const confirmsRequest = schedule && Object.entries(expectedFields).every(([field, expected]) => isDeepStrictEqual(schedule[field], expected));
-  if (payload?.project_ref !== ref || payload.request_id !== requestId || payload?.[action === "create" ? "created" : "updated"] !== true || !schedule || !confirmsRequest || scheduleId !== undefined && schedule.id !== scheduleId) {
+  const confirmsRevision = action === "create" || payload?.previous_updated_at === expectation.expectedUpdatedAt && schedule !== null && schedule.updated_at > expectation.expectedUpdatedAt;
+  if (payload?.project_ref !== ref || payload.request_id !== requestId || payload?.[action === "create" ? "created" : "updated"] !== true || !schedule || !confirmsRequest || !confirmsRevision || scheduleId !== undefined && schedule.id !== scheduleId) {
     return releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.status);
   }
-  return releaseControlSuccess(operation, { project_ref: ref, request_id: requestId, schedule });
+  return releaseControlSuccess(operation, {
+    project_ref: ref,
+    request_id: requestId,
+    ...action === "update" ? { previous_updated_at: expectation.expectedUpdatedAt } : {},
+    schedule
+  });
 }
-function deleteResponse(ref, scheduleId, response) {
+function deleteResponse(ref, scheduleId, expectedUpdatedAt, response) {
   const operation = "scheduled_functions.delete";
   if (!response.ok)
     return releaseControlMutationFailure(operation, response);
   const payload = objectRecord2(response.data);
-  if (payload?.deleted !== true || payload.project_ref !== ref || payload.schedule_id !== scheduleId) {
+  if (payload?.deleted !== true || payload.project_ref !== ref || payload.schedule_id !== scheduleId || payload.deleted_updated_at !== expectedUpdatedAt) {
     return releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.status);
   }
   return releaseControlSuccess(operation, {
     project_ref: ref,
     schedule_id: scheduleId,
+    deleted_updated_at: expectedUpdatedAt,
     deleted: true
   });
 }
@@ -10429,7 +11148,7 @@ function createRequest(args, environment) {
     name: requiredName(args, "create"),
     slug: requiredSlug(args, "create"),
     cron: requiredCron(args, "create"),
-    method: requiredText(args, "method", "create"),
+    method: requiredText2(args, "method", "create"),
     body: scheduleBody(args.body_file) ?? {},
     headers: scheduleHeaders(args.header_env, environment) ?? {}
   };
@@ -10445,24 +11164,32 @@ function safeMutationFields(request) {
   return safeFields;
 }
 function requiredName(args, action) {
-  const name = requiredText(args, "name", action);
+  const name = requiredText2(args, "name", action);
   if (name.length > MAX_SCHEDULE_NAME_LENGTH)
     throw new Error(`'name' is too long for '${action}'`);
   return name;
 }
 function requiredSlug(args, action) {
-  const slug = requiredText(args, "slug", action);
+  const slug = requiredText2(args, "slug", action);
   if (!SAFE_SLUG_PATTERN.test(slug))
     throw new Error(`'slug' is invalid for '${action}'`);
   return slug;
 }
 function requiredCron(args, action) {
-  const cron = requiredText(args, "cron", action);
+  const cron = requiredText2(args, "cron", action);
   if (!validScheduledFunctionCron(cron))
     throw new Error(`'cron' is invalid for '${action}'`);
   return cron;
 }
+function requiredExpectedUpdatedAt(args, action) {
+  const candidate = args.expected_updated_at;
+  if (!isCanonicalTimestamp(candidate)) {
+    throw new Error(`'expected_updated_at' must be a canonical UTC timestamp for '${action}'`);
+  }
+  return candidate;
+}
 function updateRequest(args, environment) {
+  const expectedUpdatedAt = requiredExpectedUpdatedAt(args, "update");
   const body = scheduleBody(args.body_file);
   const headers = scheduleHeaders(args.header_env, environment);
   const cron = args.cron === undefined ? undefined : requiredCron(args, "update");
@@ -10478,14 +11205,21 @@ function updateRequest(args, environment) {
   if (Object.keys(mutationFields).length === 0) {
     throw new Error("Scheduled Function update requires at least one field");
   }
-  return { request_id: randomUUID(), ...mutationFields };
+  return {
+    request_id: randomUUID(),
+    expected_updated_at: expectedUpdatedAt,
+    ...mutationFields
+  };
+}
+function deletePath(schedulePathname, expectedUpdatedAt) {
+  return `${schedulePathname}?expected_updated_at=${encodeURIComponent(expectedUpdatedAt)}`;
 }
 async function executeScheduleAction(http, environment, args, readOnly = false) {
   const action = args.action;
-  if (readOnly && action !== "list")
+  if (readOnly && action !== "list" && action !== "get")
     return readOnlyResult2();
-  assertActionArguments(action, args);
-  const ref = requiredText(args, "ref", action);
+  assertActionArguments2(action, args);
+  const ref = requiredText2(args, "ref", action);
   if (action === "list")
     return listResponse(ref, await http.get(schedulePath(ref)));
   if (action === "create") {
@@ -10493,28 +11227,35 @@ async function executeScheduleAction(http, environment, args, readOnly = false)
     const requestId = request.request_id;
     return mutationResponse({ action, ref, requestId, expectedFields: safeMutationFields(request) }, await http.post(schedulePath(ref), request));
   }
-  const scheduleId = requiredText(args, "schedule_id", action);
+  const scheduleId = requiredText2(args, "schedule_id", action);
+  const targetPath = schedulePath(ref, scheduleId);
+  if (action === "get")
+    return getResponse(ref, scheduleId, await http.get(targetPath));
   if (action === "update") {
     const request = updateRequest(args, environment);
     const requestId = request.request_id;
+    const expectedUpdatedAt2 = request.expected_updated_at;
     return mutationResponse({
       action,
       ref,
       scheduleId,
       requestId,
+      expectedUpdatedAt: expectedUpdatedAt2,
       expectedFields: safeMutationFields(request)
-    }, await http.patch(schedulePath(ref, scheduleId), request));
+    }, await http.patch(targetPath, request));
   }
-  return deleteResponse(ref, scheduleId, await http.delete(schedulePath(ref, scheduleId)));
+  const expectedUpdatedAt = requiredExpectedUpdatedAt(args, "delete");
+  return deleteResponse(ref, scheduleId, expectedUpdatedAt, await http.delete(deletePath(targetPath, expectedUpdatedAt)));
 }
 function registerScheduledFunctionTools(server, http, environment = process.env, options = {}) {
   server.tool("scheduled_functions", SCHEDULE_TOOL_DESCRIPTION, SCHEDULE_TOOL_SCHEMA, (args) => executeScheduleAction(http, environment, args, options.readOnly));
 }
-var SCHEDULE_TOOL_DESCRIPTION = "Scheduled Edge Function lifecycle. Actions: list, create, update, delete";
+var SCHEDULE_TOOL_DESCRIPTION = "Scheduled Edge Function lifecycle. Actions: list, get, create, update, delete";
 var SCHEDULE_TOOL_SCHEMA = {
-  action: withDescription(stringEnum(["list", "create", "update", "delete"]), "Action"),
+  action: withDescription(stringEnum(["list", "get", "create", "update", "delete"]), "Action"),
   ref: withDescription(Type.String(), "Project ref"),
-  schedule_id: optional(Type.String(), "[update/delete] Schedule ID"),
+  schedule_id: optional(Type.String(), "[get/update/delete] Schedule ID"),
+  expected_updated_at: optional(Type.String(), "[update/delete] Canonical updated_at from list"),
   name: optional(Type.String(), "[create/update] Display name"),
   slug: optional(Type.String(), "[create] Edge Function slug"),
   cron: optional(Type.String(), "[create/update] Five-field cron expression"),
@@ -10526,7 +11267,7 @@ var SCHEDULE_TOOL_SCHEMA = {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.15.0",
+  version: "0.17.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -10731,6 +11472,7 @@ EXAMPLES
   ${preferredCommand} frontend list --ref abc123
   ${preferredCommand} database query --sql "select now()"
   ${preferredCommand} database query --ref abc123 --file ./queries/vector-search.sql
+  ${preferredCommand} database migration_inventory --ref abc123
   ${preferredCommand} database push_migrations --ref abc123 --dir supabase/migrations --dry_run
   ${preferredCommand} supabase migration_new --name add_accounts
   ${preferredCommand} supabase db_diff --schema public --name add_accounts
@@ -10741,8 +11483,9 @@ EXAMPLES
   ${preferredCommand} branch promote --branch_ref preview123 --plan_checksum <sha256>
   ${preferredCommand} ai show_skill
   ${preferredCommand} ai install_skill --dry_run
-  ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello
-  ${preferredCommand} edge_functions activate --ref abc123 --slug hello --version 3
+  ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello --expected-active-version absent
+  ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --prebundled-path ./dist/hello.js --expected-sha256 <sha256> --expected-active-version 4
+  ${preferredCommand} edge_functions activate --ref abc123 --slug hello --version 3 --expected-active-version 4
   ${preferredCommand} scheduled_functions list --ref abc123
   ${preferredCommand} edge_functions config --ref abc123 --slug hello --verify_jwt false --background_routes "/queue/*,/render/*"
   ${preferredCommand} secrets upsert --ref abc123 --from-env API_KEY,WEBHOOK_SECRET
@@ -10824,6 +11567,11 @@ function createCliTools(context, confirmProduction) {
         })
       };
     }
+    const storageContextCallback = tools.storage.callback;
+    const storageHelpTool = captureTools((server) => registerStorageTools(server, {})).storage;
+    if (storageHelpTool) {
+      tools.storage = { schema: storageHelpTool.schema, callback: storageContextCallback };
+    }
     const branchContextCallback = tools.branch.callback;
     const branchHelpTool = captureTools((server) => registerBranchTools(server, {}, {
       readOnly: true