@supacloud/cli 0.16.0 → 0.18.0

package/README.md

@@ -155,10 +155,11 @@ supacloud-cli frontend list --ref abc123
 supacloud-cli branch create --name feature-orders --data_mode schema_only
 supacloud-cli branch promotion_plan --branch_ref preview123
 supacloud-cli branch promote --branch_ref preview123 --plan_checksum <sha256>
-supacloud-cli edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello
-supacloud-cli edge_functions deploy_bundle --ref abc123 --slug hello --files '{"index.ts":"export default { fetch: () => new Response(\"ok\") }"}'
-supacloud-cli edge_functions source --ref abc123 --slug hello --output ./hello.ts
-supacloud-cli edge_functions activate --ref abc123 --slug hello --version 3
+supacloud-cli edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello --expected-active-version absent
+supacloud-cli edge_functions deploy --ref abc123 --slug hello --prebundled-path ./dist/hello.js --expected-sha256 <sha256> --expected-active-version 4
+supacloud-cli edge_functions deploy_bundle --ref abc123 --slug hello --files '{"index.ts":"export default { fetch: () => new Response(\"ok\") }"}' --expected-active-version 7
+supacloud-cli edge_functions source --ref abc123 --slug hello --version 7 --output ./hello-v7.ts
+supacloud-cli edge_functions activate --ref abc123 --slug hello --version 3 --expected-active-version 8
 supacloud-cli scheduled_functions list --ref abc123
 supacloud-cli secrets upsert --ref abc123 --from-env API_KEY,WEBHOOK_SECRET
 supacloud-cli storage list_buckets --ref abc123
@@ -166,8 +167,10 @@ supacloud-cli storage get_bucket --ref abc123 --bucket reports
 supacloud-cli storage create_bucket --ref abc123 --bucket reports --public false \
   --file_size_limit 10485760 --allowed_mime_types "application/pdf,image/png"
 supacloud-cli storage update_bucket --ref abc123 --bucket reports \
+  --expected_revision <revision-from-get_bucket> \
   --allowed_mime_types '["application/pdf"]'
-supacloud-cli storage delete_bucket --ref abc123 --bucket reports
+supacloud-cli storage delete_bucket --ref abc123 --bucket reports \
+  --expected_revision <revision-from-get_bucket> --require_empty true
 ```
 
 `database migration_inventory` reads the canonical migration ledger through the
@@ -178,14 +181,44 @@ drift, and statement-count mismatches instead of treating them as an empty
 ledger. `database list_migrations` remains available with its legacy SQL-backed,
 human-readable behavior.
 
+Bucket list/get output includes the metadata `revision`. Update and delete reject
+stale revisions with HTTP 409. Delete additionally requires `require_empty=true`;
+it never empties a bucket. Mutation receipts bind `project_ref`, `bucket_id`,
+`previous_revision`, and `new_revision` (`null` after delete).
+
+`database push_migrations` rejects a remote row that reuses a local migration
+name with another version, or a local version with another name, before either
+dry-run reporting or apply can continue. This keeps the preview consistent with
+the server conflict that would otherwise occur after deployment starts.
+
 `edge_functions deploy --path` bundles local TypeScript and dependencies with
 Bun and runs a local syntax check before upload. The Management API validates and
 normalizes the final server-side artifact against the multi-tenant Edge Runtime
 module policy consistently for CLI, Web Console, and direct API deployments.
+For an artifact already built and validated by release automation, use
+`deploy --prebundled-path <file> --expected-sha256 <64-lowercase-hex>`. The CLI
+holds the opened regular file while reading it, rejects metadata drift, invalid
+UTF-8, or a caller-hash mismatch before HTTP, and never passes the artifact in
+the process argument list. The Management API validates the hash and runtime
+policy again, rejects any normalization that would change the code, and stores
+the submitted bytes unchanged as both immutable source and runtime artifact.
+`--prebundled-path` is mutually exclusive with `--path`, `--code`, and
+`--minify`.
 `deploy_bundle --files` accepts a JSON object in shell usage.
 Use `source --output <file>` for large Functions so terminal or automation output
 limits cannot truncate the original TS/JS source code. The destination must not
-already exist.
+already exist. Add the positive version observed from `list` as
+`source --version <N>` to read the immutable release instead of the moving active
+pointer; this remains correct across an active-version A→B→A transition.
+
+`deploy`, `deploy_bundle`, and `activate` require
+`--expected-active-version <N|absent>`. Read the current non-negative integer
+version from `edge_functions list`; use `0` for a listed legacy Function and
+`absent` only when creating a slug that does not yet exist. A stale value returns
+HTTP 409 without building, preheating, or activating another version. List output remains a JSON array with string
+`slug` and numeric `version` fields, while source output is exactly
+`{ "code": "..." }`. Release automation must use `source --version <N>` for a
+version-bound backup.
 
 `edge_functions activate` restores an existing immutable Function version and
 returns a machine-readable receipt containing the activated version and JWT
@@ -195,28 +228,55 @@ server response body.
 Mutation receipts use schema `supacloud.cli.release-control.v1`. An
 `OUTCOME_UNKNOWN` error means the server may have committed the mutation before
 the response was lost or failed validation; read back current state before any
-retry.
+retry. For Function deploy, bundle deploy, and activation, the CLI applies a
+separate 5-second, 64 KiB response-body boundary after receiving HTTP headers.
+A stalled, oversized, truncated, unreadable, or malformed body is always
+`OUTCOME_UNKNOWN` and its content is never included in CLI output.
+Version `0` is reserved as the active-version CAS token for legacy Functions. It
+can be passed only as `--expected-active-version`; immutable source reads and
+activation targets still require a positive version.
+
+```json
+{
+  "schema": "supacloud.cli.release-control.v1",
+  "ok": true,
+  "operation": "edge_functions.deploy_bundle",
+  "project_ref": "abc123",
+  "slug": "hello",
+  "previous_active_version": "7",
+  "active_version": "8",
+  "version": "8",
+  "verify_jwt": true
+}
+```
 
 Scheduled Function lifecycle operations are also project-scoped:
 
 ```bash
 supacloud-cli scheduled_functions create --ref abc123 --name nightly \
   --slug cleanup --cron "0 2 * * *" --method POST
+supacloud-cli scheduled_functions get --ref abc123 --schedule_id <id>
 supacloud-cli scheduled_functions update --ref abc123 --schedule_id <id> \
-  --cron "0 3 * * *"
-supacloud-cli scheduled_functions delete --ref abc123 --schedule_id <id>
+  --expected_updated_at <updated_at-from-list> --cron "0 3 * * *"
+supacloud-cli scheduled_functions delete --ref abc123 --schedule_id <id> \
+  --expected_updated_at <updated_at-from-list>
 ```
 
 Schedule IDs are canonical UUIDv4 values returned by create/list. Cron values
 use bounded numeric five-field syntax with wildcards, lists, ranges, and steps;
 out-of-range endpoints and steps are rejected before HTTP dispatch.
+Update and delete require the exact canonical UTC `updated_at` returned by list.
+A stale revision fails with HTTP 409 and performs no mutation; read the list
+again before deciding whether to issue a new write.
 
 Use `--body_file ./payload.json` for a JSON-object request body. Header values
 must come from environment variables: pass a JSON name mapping such as
 `--header_env '{"x-schedule-token":"SCHEDULE_TOKEN"}'`. Platform-owned
 `authorization`, `apikey`, and `x-project-ref` headers cannot be overridden. Receipts never
 include header values or body content; list and mutation receipts report only
-whether the body is empty and the configured header names.
+whether the body is empty and the configured header names. Update receipts bind
+`previous_updated_at` to the requested revision and return a newer `updated_at`;
+delete receipts return the matched revision as `deleted_updated_at`.
 
 For secret writes, `--from-env` accepts a comma-separated list of environment
 variable names. The CLI reads each non-empty value from its own process

package/dist/index.js

@@ -6491,7 +6491,7 @@ var ACTION_POLICY = {
     local: ["check"],
     write: ["deploy", "deploy_bundle", "config", "activate", "delete"]
   },
-  scheduled_functions: { read: ["list"], write: ["create", "update", "delete"] },
+  scheduled_functions: { read: ["list", "get"], write: ["create", "update", "delete"] },
   secrets: { read: ["list"], write: ["upsert", "delete"] },
   frontend: {
     read: ["list", "get", "build_logs", "list_frameworks", "list_records"],
@@ -6576,6 +6576,8 @@ function validateExecutionPolicyCoverage(tools) {
 
 // src/shared/transports/http.ts
 var DEFAULT_TIMEOUT = 30000;
+var RELEASE_MUTATION_RESPONSE_TIMEOUT = 5000;
+var RELEASE_MUTATION_RESPONSE_MAX_BYTES = 64 * 1024;
 var MAX_RETRIES = 2;
 var RETRY_BASE_DELAY = 500;
 function isRetryableMethod(method) {
@@ -6598,6 +6600,14 @@ function transportFailure(error) {
     transportError: true
   };
 }
+function responseReadFailure(status) {
+  return {
+    ok: false,
+    status,
+    data: { error: "Response body unavailable", code: "RESPONSE_READ_ERROR" },
+    responseReadError: true
+  };
+}
 async function fetchWithTimeout(url, options) {
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
@@ -6647,41 +6657,114 @@ function joinedResponseBytes(chunks, totalBytes) {
   }
   return responseBytes;
 }
-async function responseBytesWithinLimit(response, maxBytes) {
-  if (declaredResponseTooLarge(response, maxBytes)) {
-    await response.body?.cancel();
-    return null;
-  }
-  if (!response.body)
-    return new Uint8Array;
-  const reader = response.body.getReader();
+function cancelResponseReader(reader) {
+  reader.cancel().catch(() => {
+    return;
+  });
+}
+function serializedRequestBody(body) {
+  return body ? JSON.stringify(body) : undefined;
+}
+async function responseBytesFromReader(reader, maxBytes, declaredBytes) {
   const chunks = [];
   let totalBytes = 0;
   while (true) {
     const { done, value } = await reader.read();
-    if (done)
-      return joinedResponseBytes(chunks, totalBytes);
+    if (done) {
+      if (declaredBytes !== null && totalBytes !== declaredBytes)
+        return { ok: false };
+      return { ok: true, bytes: joinedResponseBytes(chunks, totalBytes) };
+    }
     totalBytes += value.byteLength;
     if (totalBytes > maxBytes) {
-      await reader.cancel();
-      return null;
+      cancelResponseReader(reader);
+      return { ok: false };
     }
     chunks.push(value);
   }
 }
+async function responseBytesWithinLimit(response, maxBytes) {
+  if (declaredResponseTooLarge(response, maxBytes)) {
+    await response.body?.cancel();
+    return null;
+  }
+  if (!response.body)
+    return new Uint8Array;
+  const reader = response.body.getReader();
+  const bodyRead = await responseBytesFromReader(reader, maxBytes, null);
+  return bodyRead.ok ? bodyRead.bytes : null;
+}
 function parsedUtf8Json(responseBytes) {
   try {
     const responseText = new TextDecoder("utf-8", { fatal: true }).decode(responseBytes);
-    return JSON.parse(responseText);
+    return { ok: true, parsedJson: JSON.parse(responseText) };
   } catch (error) {
     if (error instanceof SyntaxError || error instanceof TypeError)
-      return null;
+      return { ok: false };
     throw error;
   }
 }
 async function boundedResponseJson(response, maxBytes) {
   const responseBytes = await responseBytesWithinLimit(response, maxBytes);
-  return responseBytes === null ? null : parsedUtf8Json(responseBytes);
+  if (responseBytes === null)
+    return null;
+  const parsed = parsedUtf8Json(responseBytes);
+  return parsed.ok ? parsed.parsedJson : null;
+}
+function declaredIdentityResponseBytes(response) {
+  const contentEncoding = response.headers.get("content-encoding");
+  if (contentEncoding !== null && contentEncoding.toLowerCase() !== "identity")
+    return null;
+  const contentLength = response.headers.get("content-length");
+  if (contentLength === null)
+    return null;
+  if (!/^\d+$/.test(contentLength))
+    return "invalid";
+  const declaredBytes = Number(contentLength);
+  return Number.isSafeInteger(declaredBytes) ? declaredBytes : "invalid";
+}
+async function releaseMutationResponseBytes(response) {
+  const declaredBytes = declaredIdentityResponseBytes(response);
+  if (declaredBytes === "invalid" || declaredBytes !== null && declaredBytes > RELEASE_MUTATION_RESPONSE_MAX_BYTES) {
+    response.body?.cancel().catch(() => {
+      return;
+    });
+    return { ok: false };
+  }
+  if (!response.body) {
+    return declaredBytes === null || declaredBytes === 0 ? { ok: true, bytes: new Uint8Array } : { ok: false };
+  }
+  return responseBytesBeforeDeadline(response.body.getReader(), declaredBytes);
+}
+async function responseBytesBeforeDeadline(reader, declaredBytes) {
+  let deadlineTimer;
+  const deadline = new Promise((resolve2) => {
+    deadlineTimer = setTimeout(() => {
+      cancelResponseReader(reader);
+      resolve2({ ok: false });
+    }, RELEASE_MUTATION_RESPONSE_TIMEOUT);
+  });
+  try {
+    return await Promise.race([
+      responseBytesFromReader(reader, RELEASE_MUTATION_RESPONSE_MAX_BYTES, declaredBytes),
+      deadline
+    ]);
+  } catch {
+    cancelResponseReader(reader);
+    return { ok: false };
+  } finally {
+    clearTimeout(deadlineTimer);
+  }
+}
+async function releaseMutationResponseJson(response) {
+  const responseBytes = await releaseMutationResponseBytes(response);
+  if (!responseBytes.ok)
+    return { ok: false };
+  const parsed = parsedUtf8Json(responseBytes.bytes);
+  return parsed.ok ? { ok: true, parsedJson: parsed.parsedJson } : { ok: false };
+}
+async function responseJsonOrNull(response) {
+  return { ok: true, parsedJson: await response.json().catch(() => null) };
 }
 
 class HttpTransport {
@@ -6697,6 +6780,19 @@ class HttpTransport {
       "Content-Type": "application/json"
     };
   }
+  async postWithResponseReader(path, serializedBody, responseReader) {
+    try {
+      const response = await fetchWithRetry(`${this.baseUrl}${path}`, {
+        method: "POST",
+        headers: this.headers(),
+        body: serializedBody
+      });
+      const responseBody = await responseReader(response);
+      return responseBody.ok ? { ok: response.ok, status: response.status, data: responseBody.parsedJson } : responseReadFailure(response.status);
+    } catch (error) {
+      return transportFailure(error);
+    }
+  }
   async get(path, options = {}) {
     try {
       const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
@@ -6711,17 +6807,14 @@ class HttpTransport {
   }
   async post(path, body) {
     try {
-      const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
-        method: "POST",
-        headers: this.headers(),
-        body: body ? JSON.stringify(body) : undefined
-      });
-      const data = await res.json().catch(() => null);
-      return { ok: res.ok, status: res.status, data };
+      return await this.postWithResponseReader(path, serializedRequestBody(body), responseJsonOrNull);
     } catch (error) {
       return transportFailure(error);
     }
   }
+  async postReleaseMutation(path, body) {
+    return this.postWithResponseReader(path, serializedRequestBody(body), releaseMutationResponseJson);
+  }
   async postMultipart(path, formData) {
     try {
       const headers = { Authorization: `Bearer ${this.token}` };
@@ -6964,6 +7057,28 @@ function migrationRows(data) {
 function migrationIdentityKey(version, name) {
   return `${version}\x00${name}`;
 }
+function migrationIdentities(data) {
+  return migrationRows(data).flatMap((row) => row.version == null || row.name == null ? [] : [{ version: String(row.version), name: String(row.name) }]);
+}
+function identityConflicts(local, remote) {
+  const reusesVersionOrName = local.version === remote.version || local.name === remote.name;
+  const exactlyMatches = local.version === remote.version && local.name === remote.name;
+  return reusesVersionOrName && !exactlyMatches;
+}
+function migrationIdentityConflicts(data, migrationFiles) {
+  const remoteMigrations = migrationIdentities(data);
+  return migrationFiles.flatMap((localMigration) => remoteMigrations.filter((remoteMigration) => identityConflicts(localMigration, remoteMigration)).map((remoteMigration) => ({ file: localMigration.file, local: localMigration, remote: remoteMigration })));
+}
+function assertNoMigrationIdentityConflicts(data, migrationFiles) {
+  const conflicts = migrationIdentityConflicts(data, migrationFiles);
+  if (!conflicts.length)
+    return;
+  throw new Error([
+    "Migration identity conflicts:",
+    ...conflicts.map(({ file, local, remote }) => `- ${file} (${local.version}) conflicts with remote ${remote.name} (${remote.version})`)
+  ].join(`
+`));
+}
 function nameBoundMigrationMarkerKeys(data) {
   const keys = new Set;
   for (const row of migrationRows(data)) {
@@ -7227,6 +7342,7 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
           text = `❌ Failed to load applied migrations (${migrationsResult.status}): ${JSON.stringify(migrationsResult.data)}`;
           break;
         }
+        assertNoMigrationIdentityConflicts(migrationsResult.data, migrationFiles);
         if (args.dry_run) {
           const appliedKeys = appliedMigrationKeys(migrationsResult.data);
           const pending = migrationFiles.filter(({ name, version }) => !appliedKeys.has(name) && !appliedKeys.has(String(version)));
@@ -7863,7 +7979,7 @@ function releaseControlFailure(operation, code, httpStatus) {
   });
 }
 function releaseControlMutationFailure(operation, response) {
-  const outcomeUnknown = response.transportError || response.status === 408 || response.status >= 500;
+  const outcomeUnknown = response.transportError || response.responseReadError || response.status === 408 || response.status >= 500;
   return outcomeUnknown ? releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.transportError ? null : response.status) : releaseControlFailure(operation, "HTTP_ERROR", response.status);
 }
 function releaseControlResponse(payload) {
@@ -7882,13 +7998,14 @@ var MAX_MIME_TYPE_LENGTH = 255;
 var PROJECT_REF_PATTERN2 = /^[A-Za-z0-9_-]{1,64}$/;
 var BUCKET_ID_PATTERN = new RegExp(`^(?!\\.+$)[A-Za-z0-9._-]{1,${MAX_BUCKET_ID_LENGTH}}$`);
 var MIME_TYPE_PATTERN = /^(?=\S)(?=.*\S$)[^\u0000-\u001f\u007f]+$/;
+var BUCKET_REVISION_PATTERN = /^[0-9]{1,20}$/;
 var ACTION_ARGUMENTS = {
   status: new Set(["action"]),
   list_buckets: new Set(["action", "ref"]),
   get_bucket: new Set(["action", "ref", "bucket"]),
   create_bucket: new Set(["action", "ref", "bucket", "public", "file_size_limit", "allowed_mime_types"]),
-  update_bucket: new Set(["action", "ref", "bucket", "public", "file_size_limit", "allowed_mime_types"]),
-  delete_bucket: new Set(["action", "ref", "bucket"]),
+  update_bucket: new Set(["action", "ref", "bucket", "expected_revision", "public", "file_size_limit", "allowed_mime_types"]),
+  delete_bucket: new Set(["action", "ref", "bucket", "expected_revision", "require_empty"]),
   list_files: new Set(["action", "ref", "bucket"]),
   upload_base64: new Set(["action", "ref", "bucket", "filename", "base64_content", "mime_type"]),
   delete_file: new Set(["action", "ref", "bucket", "filename"])
@@ -7944,6 +8061,16 @@ function requiredBucketId(args) {
     throw new Error("'bucket' is invalid for Storage buckets");
   return bucket;
 }
+function requiredBucketRevision(args) {
+  const revision = requiredText(args, "expected_revision");
+  if (!BUCKET_REVISION_PATTERN.test(revision))
+    throw new Error("'expected_revision' is invalid for Storage buckets");
+  return revision;
+}
+function assertEmptyBucketDeletion(args) {
+  if (args.require_empty !== true)
+    throw new Error("'require_empty=true' required for 'delete_bucket'");
+}
 function assertActionArguments(action, args) {
   const allowedArguments = ACTION_ARGUMENTS[action];
   if (!allowedArguments)
@@ -7978,9 +8105,12 @@ function assertBucketSettings(args) {
 function isAllowedMimeTypes(candidate) {
   return candidate === null || Array.isArray(candidate) && candidate.length <= MAX_MIME_TYPE_COUNT && candidate.every((mimeType) => typeof mimeType === "string" && mimeType.length <= MAX_MIME_TYPE_LENGTH && MIME_TYPE_PATTERN.test(mimeType));
 }
+function isBucketRevision(candidate) {
+  return candidate === null || typeof candidate === "string" && BUCKET_REVISION_PATTERN.test(candidate);
+}
 function safeBucket(candidate, expectedBucket) {
   const bucket = bucketRecord(candidate);
-  if (bucket === null || typeof bucket.id !== "string" || !validBucketId(bucket.id) || typeof bucket.name !== "string" || !validBucketId(bucket.name) || typeof bucket.public !== "boolean" || !isFileSizeLimit(bucket.file_size_limit) || !isAllowedMimeTypes(bucket.allowed_mime_types) || expectedBucket !== undefined && bucket.id !== expectedBucket && bucket.name !== expectedBucket) {
+  if (bucket === null || typeof bucket.id !== "string" || !validBucketId(bucket.id) || typeof bucket.name !== "string" || !validBucketId(bucket.name) || typeof bucket.public !== "boolean" || !isFileSizeLimit(bucket.file_size_limit) || !isAllowedMimeTypes(bucket.allowed_mime_types) || !isBucketRevision(bucket.revision) || expectedBucket !== undefined && bucket.id !== expectedBucket && bucket.name !== expectedBucket) {
     return null;
   }
   return {
@@ -7988,7 +8118,8 @@ function safeBucket(candidate, expectedBucket) {
     name: bucket.name,
     public: bucket.public,
     file_size_limit: bucket.file_size_limit,
-    allowed_mime_types: bucket.allowed_mime_types === null ? null : [...bucket.allowed_mime_types]
+    allowed_mime_types: bucket.allowed_mime_types === null ? null : [...bucket.allowed_mime_types],
+    revision: bucket.revision
   };
 }
 function safeExactBucket(candidate, expectedBucket) {
@@ -8012,18 +8143,30 @@ function safeCreatedBucketReceipt(candidate, expectedBucket, request) {
     return null;
   return { bucket: { id: expectedBucket, name: expectedBucket, public: request.public === true } };
 }
-function safeDeletedBucket(candidate, expectedBucket) {
+function safeDeletedBucket(candidate, expectedBucket, expectedRevision) {
   const receipt = bucketRecord(candidate);
-  return receipt?.id === expectedBucket && receipt.deleted === true ? { bucket_id: expectedBucket, deleted: true } : null;
+  return receipt?.id === expectedBucket && receipt.deleted === true && receipt.require_empty === true && receipt.previous_revision === expectedRevision && receipt.new_revision === null ? {
+    bucket_id: expectedBucket,
+    deleted: true,
+    require_empty: true,
+    previous_revision: expectedRevision,
+    new_revision: null
+  } : null;
 }
 function mutationReadbackResponse(expectation) {
-  const { operation, ref, response, expectedBucket, request } = expectation;
+  const { operation, ref, response, expectedBucket, request, previousRevision, expectedNewRevision } = expectation;
   const readback = safeExactBucket(response.data, expectedBucket);
-  const validReadback = readback?.name === expectedBucket && bucketMatchesRequest(readback, request);
+  const validReadback = readback?.name === expectedBucket && readback.revision !== null && (expectedNewRevision === undefined || readback.revision === expectedNewRevision) && bucketMatchesRequest(readback, request);
   if (!response.ok || !validReadback || !readback) {
     return releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.transportError ? null : response.status);
   }
-  return releaseControlSuccess(operation, { project_ref: ref, bucket: readback });
+  return releaseControlSuccess(operation, {
+    project_ref: ref,
+    bucket_id: expectedBucket,
+    previous_revision: previousRevision,
+    new_revision: readback.revision,
+    bucket: readback
+  });
 }
 function bucketResponse(expectation) {
   const { operation, ref, response, operationKind, safePayload } = expectation;
@@ -8049,10 +8192,10 @@ function createBucketRequest(args) {
 }
 function updateBucketRequest(args) {
   assertBucketSettings(args);
-  const request = Object.fromEntries(["public", "file_size_limit", "allowed_mime_types"].filter((field) => args[field] !== undefined).map((field) => [field, args[field]]));
-  if (Object.keys(request).length === 0)
+  const settings = Object.fromEntries(["public", "file_size_limit", "allowed_mime_types"].filter((field) => args[field] !== undefined).map((field) => [field, args[field]]));
+  if (Object.keys(settings).length === 0)
     throw new Error("Bucket update requires at least one field");
-  return request;
+  return { expected_revision: requiredBucketRevision(args), ...settings };
 }
 function equalAllowedMimeTypes(candidate, expected) {
   if (!Array.isArray(expected))
@@ -8080,18 +8223,10 @@ async function createBucketMutationReceipt(http, ref, bucket, request) {
     safePayload: (candidate) => safeCreatedBucketReceipt(candidate, bucket, request)
   });
 }
-async function updateBucketMutationReceipt(expectation) {
-  const { http, ref, bucket, bucketPath, request } = expectation;
-  return bucketResponse({
-    operation: "storage.update_bucket",
-    ref,
-    response: await http.put(bucketPath, request),
-    operationKind: "mutation",
-    safePayload: (apiPayload) => {
-      const updated = safeExactBucket(apiPayload, bucket);
-      return updated && bucketMatchesRequest(updated, request) ? { bucket: updated } : null;
-    }
-  });
+function safeUpdatedBucket(candidate, expectedBucket, expectedRevision, request) {
+  const receipt = bucketRecord(candidate);
+  const bucket = safeExactBucket(candidate, expectedBucket);
+  return bucket && bucket.name === expectedBucket && bucket.revision !== null && bucket.revision !== expectedRevision && receipt?.previous_revision === expectedRevision && receipt.new_revision === bucket.revision && bucketMatchesRequest(bucket, request) ? bucket : null;
 }
 async function listBuckets(http, args) {
   const ref = requiredProjectRef(args);
@@ -8134,35 +8269,45 @@ async function createBucket(http, args) {
     ref,
     response: await http.get(bucketPath),
     expectedBucket: bucket,
-    request: expectedReadback
+    request: expectedReadback,
+    previousRevision: null
   });
 }
 async function updateBucket(http, args) {
   const ref = requiredProjectRef(args);
   const bucket = requiredBucketId(args);
   const request = updateBucketRequest(args);
+  const expectedRevision = request.expected_revision;
   const bucketPath = storageBucketPath(ref, bucket);
-  const receipt = await updateBucketMutationReceipt({ http, ref, bucket, bucketPath, request });
-  if (receipt.isError)
-    return receipt;
+  const mutation = await http.put(bucketPath, request);
+  if (!mutation.ok)
+    return releaseControlMutationFailure("storage.update_bucket", mutation);
+  const updated = safeUpdatedBucket(mutation.data, bucket, expectedRevision, request);
+  if (!updated)
+    return releaseControlFailure("storage.update_bucket", "OUTCOME_UNKNOWN", mutation.status);
   return mutationReadbackResponse({
     operation: "storage.update_bucket",
     ref,
     response: await http.get(bucketPath),
     expectedBucket: bucket,
-    request
+    request,
+    previousRevision: expectedRevision,
+    expectedNewRevision: updated.revision ?? undefined
   });
 }
 async function deleteBucket(http, args) {
   const ref = requiredProjectRef(args);
   const bucket = requiredBucketId(args);
+  const expectedRevision = requiredBucketRevision(args);
+  assertEmptyBucketDeletion(args);
   const bucketPath = storageBucketPath(ref, bucket);
+  const deletePath = `${bucketPath}?expected_revision=${encodeURIComponent(expectedRevision)}&require_empty=true`;
   const receipt = bucketResponse({
     operation: "storage.delete_bucket",
     ref,
-    response: await http.delete(bucketPath),
+    response: await http.delete(deletePath),
     operationKind: "mutation",
-    safePayload: (candidate) => safeDeletedBucket(candidate, bucket)
+    safePayload: (candidate) => safeDeletedBucket(candidate, bucket, expectedRevision)
   });
   if (receipt.isError)
     return receipt;
@@ -8203,6 +8348,8 @@ Actions: status, list_buckets, get_bucket, create_bucket, update_bucket, delete_
     public: optional(Type.Boolean(), "[create_bucket/update_bucket] Public bucket access"),
     file_size_limit: withDescription(fileSizeLimitSchema, "[create_bucket/update_bucket] Positive safe-integer per-file size limit in bytes"),
     allowed_mime_types: withDescription(allowedMimeTypesSchema, "[create_bucket/update_bucket] MIME types as a comma-separated or JSON array"),
+    expected_revision: optional(Type.String({ pattern: BUCKET_REVISION_PATTERN.source }), "[update_bucket/delete_bucket] Exact revision from list_buckets/get_bucket"),
+    require_empty: optional(Type.Boolean(), "[delete_bucket] Must be true; deletion never empties a bucket"),
     filename: optional(Type.String(), "[upload_base64/delete_file] File name/path"),
     base64_content: optional(Type.String(), "[upload_base64] Base64 encoded content"),
     mime_type: optional(Type.String(), "[upload_base64] MIME type (default: application/octet-stream)")
@@ -8268,12 +8415,79 @@ Actions: status, list_buckets, get_bucket, create_bucket, update_bucket, delete_
 }
 
 // src/shared/tools/advanced-tools.ts
-import { existsSync as existsSync3, mkdtempSync, readFileSync as readFileSync3, rmSync, statSync as statSync2, writeFileSync } from "node:fs";
+import { createHash as createHash2, timingSafeEqual } from "node:crypto";
+import {
+  closeSync,
+  constants as fsConstants,
+  existsSync as existsSync3,
+  fstatSync,
+  mkdtempSync,
+  openSync,
+  readFileSync as readFileSync3,
+  rmSync,
+  statSync as statSync2,
+  writeFileSync
+} from "node:fs";
 import { tmpdir } from "node:os";
 import { basename as basename2, join as join2, resolve as resolve2 } from "node:path";
 import { promisify } from "node:util";
 import { execFile } from "node:child_process";
 var execFileAsync = promisify(execFile);
+var SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/;
+function openFileIdentity(descriptor) {
+  const state = fstatSync(descriptor, { bigint: true });
+  if (!state.isFile())
+    throw new Error("Prebundled path must be a regular file");
+  return {
+    dev: state.dev,
+    ino: state.ino,
+    size: state.size,
+    mtimeNs: state.mtimeNs,
+    ctimeNs: state.ctimeNs
+  };
+}
+function sameOpenFile(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
+}
+function verifiedUtf8Code(bytes) {
+  let code;
+  try {
+    code = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch (error) {
+    if (error instanceof TypeError)
+      throw new Error("Prebundled file is not valid UTF-8");
+    throw error;
+  }
+  if (!Buffer.from(code, "utf8").equals(bytes)) {
+    throw new Error("Prebundled file does not round-trip as UTF-8");
+  }
+  return code;
+}
+function assertExpectedSha256(bytes, expectedSha256) {
+  if (!SHA256_HEX_PATTERN.test(expectedSha256)) {
+    throw new Error("'--expected-sha256' must be a lowercase 64-character SHA-256");
+  }
+  const actualDigest = createHash2("sha256").update(bytes).digest();
+  const expectedDigest = Buffer.from(expectedSha256, "hex");
+  if (!timingSafeEqual(actualDigest, expectedDigest)) {
+    throw new Error("Prebundled file SHA-256 does not match --expected-sha256");
+  }
+}
+function readVerifiedPrebundledCode(pathArg, expectedSha256) {
+  const descriptor = openSync(resolve2(pathArg), fsConstants.O_RDONLY | fsConstants.O_NONBLOCK);
+  try {
+    const identityBeforeRead = openFileIdentity(descriptor);
+    const bytes = readFileSync3(descriptor);
+    const identityAfterRead = openFileIdentity(descriptor);
+    if (BigInt(bytes.byteLength) !== identityBeforeRead.size || !sameOpenFile(identityBeforeRead, identityAfterRead)) {
+      throw new Error("Prebundled file changed while it was being read");
+    }
+    assertExpectedSha256(bytes, expectedSha256);
+    return verifiedUtf8Code(bytes);
+  } finally {
+    closeSync(descriptor);
+  }
+}
 async function runBunBuild(args) {
   try {
     return await execFileAsync("bun", ["build", ...args], { maxBuffer: 10 * 1024 * 1024 });
@@ -8298,6 +8512,54 @@ async function bundleEdgeFunctionPath(pathArg) {
     rmSync(tmpDir, { recursive: true, force: true });
   }
 }
+function prebundledDeployCode(pathArg, expectedSha256, minify) {
+  if (typeof expectedSha256 !== "string") {
+    throw new Error("'--expected-sha256' required with '--prebundled-path'");
+  }
+  if (minify !== undefined) {
+    throw new Error("'--minify' cannot be combined with '--prebundled-path'");
+  }
+  return {
+    code: readVerifiedPrebundledCode(pathArg, expectedSha256),
+    prebundled: true,
+    expectedSha256
+  };
+}
+async function preparedDeployCode(args) {
+  const codeArg = args.code;
+  const pathArg = args.path;
+  const prebundledPath = args["prebundled-path"];
+  const sources = [codeArg, pathArg, prebundledPath].filter((source) => source !== undefined);
+  if (sources.length !== 1) {
+    throw new Error("Exactly one of '--code', '--path', or '--prebundled-path' is required for 'deploy'");
+  }
+  if (typeof prebundledPath === "string") {
+    return prebundledDeployCode(prebundledPath, args["expected-sha256"], args.minify);
+  }
+  if (args["expected-sha256"] !== undefined) {
+    throw new Error("'--expected-sha256' requires '--prebundled-path'");
+  }
+  if (typeof codeArg === "string")
+    return { code: codeArg, prebundled: false };
+  if (typeof pathArg !== "string")
+    throw new Error("Function deploy source is invalid");
+  return bundledDeployCode(pathArg);
+}
+async function bundledDeployCode(pathArg) {
+  try {
+    return { code: await bundleEdgeFunctionPath(pathArg), prebundled: false };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to bundle/read path ${pathArg}: ${message}`);
+  }
+}
+function rejectPrebundledFlagsOutsideDeploy(action, args) {
+  for (const flag of ["prebundled-path", "expected-sha256"]) {
+    if (action !== "deploy" && args[flag] !== undefined) {
+      throw new Error(`'--${flag}' is not supported for '${action}'`);
+    }
+  }
+}
 function resolveEntrypoint(pathArg) {
   const resolved = resolve2(pathArg);
   const stat = statSync2(resolved);
@@ -8344,21 +8606,53 @@ function parseFunctionFiles(input) {
   }
 }
 var functionFilesSchema = decodedSchema(Type.Union([Type.String(), functionFilesRecordSchema]), functionFilesRecordSchema, parseFunctionFiles);
-function parseFunctionVersion(input) {
+function positiveFunctionVersion(input, label) {
+  if (typeof input !== "string" && typeof input !== "number") {
+    throw new Error(`${label} must be a canonical positive safe integer`);
+  }
+  const version = String(input);
+  if (!POSITIVE_FUNCTION_VERSION_PATTERN.test(version) || !Number.isSafeInteger(Number(version))) {
+    throw new Error(`${label} must be a canonical positive safe integer`);
+  }
+  return version;
+}
+function activeFunctionVersionToken(input) {
+  if (typeof input !== "string" && typeof input !== "number") {
+    throw new Error("Expected active version must be a canonical non-negative safe integer");
+  }
   const version = String(input);
   if (!CANONICAL_FUNCTION_VERSION_PATTERN.test(version) || !Number.isSafeInteger(Number(version))) {
-    throw new Error("Function version must be a canonical safe integer");
+    throw new Error("Expected active version must be a canonical non-negative safe integer");
   }
   return version;
 }
 var CANONICAL_FUNCTION_VERSION_PATTERN = /^(?:0|[1-9][0-9]*)$/;
-var SAFE_FUNCTION_REF_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+var POSITIVE_FUNCTION_VERSION_PATTERN = /^[1-9][0-9]*$/;
 var SAFE_FUNCTION_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
-var FUNCTION_ACTIVATION_ARGUMENTS = new Set(["action", "ref", "slug", "version"]);
+var FUNCTION_ACTIVATION_ARGUMENTS = new Set([
+  "action",
+  "ref",
+  "slug",
+  "version",
+  "expected-active-version"
+]);
 var functionVersionSchema = Type.Optional(decodedSchema(Type.Union([
+  Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),
+  Type.String({ pattern: POSITIVE_FUNCTION_VERSION_PATTERN.source, maxLength: 16 })
+]), Type.String({ pattern: POSITIVE_FUNCTION_VERSION_PATTERN.source, maxLength: 16 }), (input) => positiveFunctionVersion(input, "Function version")));
+function parseExpectedActiveVersion(input) {
+  if (input === "absent")
+    return input;
+  return activeFunctionVersionToken(input);
+}
+var expectedActiveVersionSchema = Type.Optional(decodedSchema(Type.Union([
+  Type.Literal("absent"),
   Type.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),
   Type.String({ pattern: CANONICAL_FUNCTION_VERSION_PATTERN.source, maxLength: 16 })
-]), Type.String({ pattern: CANONICAL_FUNCTION_VERSION_PATTERN.source, maxLength: 16 }), parseFunctionVersion));
+]), Type.Union([
+  Type.Literal("absent"),
+  Type.String({ pattern: CANONICAL_FUNCTION_VERSION_PATTERN.source, maxLength: 16 })
+]), parseExpectedActiveVersion));
 var secretListSchema = Type.Array(Type.Object({ name: Type.String(), value: Type.String() }));
 var ENVIRONMENT_SECRET_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
 var MAX_SECRET_COUNT = 1024;
@@ -8476,10 +8770,35 @@ function secretsForUpsert(inlineSecrets, environmentNames, environment) {
     throw new Error("'secrets' array required");
   return inlineSecrets;
 }
+var INVALID_FUNCTION_LIST_RESPONSE = "❌ Edge Function list response is invalid";
+var INVALID_FUNCTION_SOURCE_RESPONSE = "❌ Edge Function source response is invalid";
+function invalidFunctionReadResponse(message) {
+  return { isError: true, content: [{ type: "text", text: message }] };
+}
+function safeFunctionList(payload) {
+  if (!Array.isArray(payload))
+    return null;
+  const functionSlugs = new Set;
+  for (const candidate of payload) {
+    const edgeFunction = objectRecord(candidate);
+    const slug = edgeFunction?.slug;
+    const version = edgeFunction?.version;
+    if (typeof slug !== "string" || !SAFE_FUNCTION_SLUG_PATTERN.test(slug) || typeof version !== "number" || !Number.isSafeInteger(version) || version < 0 || functionSlugs.has(slug))
+      return null;
+    functionSlugs.add(slug);
+  }
+  return payload;
+}
+function functionListResponse(response) {
+  if (!response.ok)
+    return invalidFunctionReadResponse(`❌ Failed (${response.status})`);
+  const functions = safeFunctionList(response.data);
+  return functions ? { content: [{ type: "text", text: JSON.stringify(functions, null, 2) }] } : invalidFunctionReadResponse(INVALID_FUNCTION_LIST_RESPONSE);
+}
 function confirmedFunctionConfig(payload, expected) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+  const response = objectRecord(payload);
+  if (!response)
     return false;
-  const response = payload;
   if (expected.verify_jwt !== undefined && response.verify_jwt !== expected.verify_jwt)
     return false;
   if (expected.background_routes !== undefined) {
@@ -8490,28 +8809,87 @@ function confirmedFunctionConfig(payload, expected) {
   }
   return true;
 }
-function functionSourceCode(payload) {
+function functionSourceCode(payload, field = "code") {
   if (!payload || typeof payload !== "object" || Array.isArray(payload))
     return null;
-  const code = payload.code;
+  const code = payload[field];
   return typeof code === "string" ? code : null;
 }
+function requestedSourceVersion(candidate) {
+  return candidate === undefined ? undefined : positiveFunctionVersion(candidate, "Function source version");
+}
+function functionSourceOutput(slug, sourceCode, output) {
+  if (!output) {
+    return { content: [{ type: "text", text: JSON.stringify({ code: sourceCode }, null, 2) }] };
+  }
+  const outputPath = resolve2(output);
+  writeFileSync(outputPath, sourceCode, { flag: "wx" });
+  return {
+    content: [{
+      type: "text",
+      text: `✅ Function ${slug} source written to ${outputPath} (${Buffer.byteLength(sourceCode)} bytes)`
+    }]
+  };
+}
 function objectRecord(candidate) {
   return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
 }
-function activationResponse(slug, version, response) {
-  const operation = "edge_functions.activate";
+function edgeFunctionResourcePath(ref, slug) {
+  const root = `/v1/projects/${projectRefPathSegment(ref, "Edge Functions")}/functions`;
+  if (slug === undefined)
+    return root;
+  if (typeof slug !== "string" || !SAFE_FUNCTION_SLUG_PATTERN.test(slug)) {
+    throw new Error("'slug' is invalid for Edge Functions");
+  }
+  return `${root}/${encodeURIComponent(slug)}`;
+}
+async function readFunctionSource(http, request) {
+  const sourceVersion = requestedSourceVersion(request.version);
+  const resourcePath = edgeFunctionResourcePath(request.projectRef, request.slug);
+  const sourcePath = sourceVersion === undefined ? `${resourcePath}/source` : `${resourcePath}/versions/${encodeURIComponent(sourceVersion)}`;
+  const response = await http.get(sourcePath);
   if (!response.ok)
-    return releaseControlMutationFailure(operation, response);
-  const receipt = objectRecord(response.data);
-  const config = objectRecord(receipt?.config);
-  if (receipt?.success !== true || receipt.version !== version || config?.version !== version || typeof config.verify_jwt !== "boolean") {
-    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.status);
+    return invalidFunctionReadResponse(`❌ Failed (${response.status})`);
+  const sourceCode = functionSourceCode(response.data, sourceVersion === undefined ? "code" : "source_code");
+  return sourceCode === null ? invalidFunctionReadResponse(INVALID_FUNCTION_SOURCE_RESPONSE) : functionSourceOutput(request.slug, sourceCode, request.output);
+}
+function mutationIdentityMatches(receipt, expectation) {
+  return receipt.success === true && receipt.project_ref === expectation.projectRef && receipt.slug === expectation.slug && receipt.previous_active_version === expectation.expectedActiveVersion;
+}
+function validReceiptVersion(activeVersion) {
+  return typeof activeVersion === "string" && POSITIVE_FUNCTION_VERSION_PATTERN.test(activeVersion) && Number.isSafeInteger(Number(activeVersion));
+}
+function confirmedMutationVersion(receipt, config, expectation) {
+  const activeVersion = receipt.active_version;
+  if (!validReceiptVersion(activeVersion) || receipt.version !== activeVersion || config.version !== activeVersion || expectation.targetVersion !== undefined && activeVersion !== expectation.targetVersion) {
+    return null;
   }
-  return releaseControlSuccess(operation, {
-    slug,
-    version,
-    verify_jwt: config.verify_jwt
+  return activeVersion;
+}
+function confirmedFunctionMutation(expectation, payload) {
+  const receipt = objectRecord(payload);
+  const config = objectRecord(receipt?.config);
+  if (!receipt || !config || !mutationIdentityMatches(receipt, expectation))
+    return null;
+  const activeVersion = confirmedMutationVersion(receipt, config, expectation);
+  if (activeVersion === null || typeof config.verify_jwt !== "boolean" || !confirmedFunctionConfig(config, expectation.config ?? {}))
+    return null;
+  return { activeVersion, verifyJwt: config.verify_jwt };
+}
+function functionMutationResponse(expectation, response) {
+  if (!response.ok)
+    return releaseControlMutationFailure(expectation.operation, response);
+  const confirmed = confirmedFunctionMutation(expectation, response.data);
+  if (!confirmed) {
+    return releaseControlFailure(expectation.operation, "OUTCOME_UNKNOWN", response.status);
+  }
+  return releaseControlSuccess(expectation.operation, {
+    project_ref: expectation.projectRef,
+    slug: expectation.slug,
+    previous_active_version: expectation.expectedActiveVersion,
+    active_version: confirmed.activeVersion,
+    version: confirmed.activeVersion,
+    verify_jwt: confirmed.verifyJwt
   });
 }
 function readOnlyActivationResult() {
@@ -8523,15 +8901,22 @@ function readOnlyActivationResult() {
 function functionActivationTarget(args) {
   const projectRef = typeof args.ref === "string" ? args.ref.trim() : "";
   const functionSlug = typeof args.slug === "string" ? args.slug.trim() : "";
-  const version = args.version;
-  if (!SAFE_FUNCTION_REF_PATTERN.test(projectRef))
-    throw new Error("'ref' is invalid for 'activate'");
+  const version = positiveFunctionVersion(args.version, "Function activation version");
+  projectRefPathSegment(projectRef, "Edge Function activation");
   if (!SAFE_FUNCTION_SLUG_PATTERN.test(functionSlug))
     throw new Error("'slug' is invalid for 'activate'");
-  if (typeof version !== "string" || !CANONICAL_FUNCTION_VERSION_PATTERN.test(version) || !Number.isSafeInteger(Number(version))) {
-    throw new Error("'version' is invalid for 'activate'");
+  const expectedActiveVersion = requiredExpectedActiveVersion(args, "activate");
+  return { projectRef, functionSlug, version, expectedActiveVersion };
+}
+function requiredExpectedActiveVersion(args, action) {
+  const expected = args["expected-active-version"];
+  if (expected === undefined) {
+    throw new Error(`'--expected-active-version' required for '${action}'`);
   }
-  return { projectRef, functionSlug, version };
+  const parsed = parseExpectedActiveVersion(expected);
+  if (typeof parsed !== "string")
+    throw new Error("Expected active version is invalid");
+  return parsed;
 }
 async function activateFunctionVersion(http, args, readOnly = false) {
   if (readOnly)
@@ -8539,29 +8924,40 @@ async function activateFunctionVersion(http, args, readOnly = false) {
   const unsupported = Object.keys(args).filter((name) => !FUNCTION_ACTIVATION_ARGUMENTS.has(name));
   if (unsupported.length > 0)
     throw new Error(`'${unsupported[0]}' is not supported for 'activate'`);
-  const { projectRef, functionSlug, version } = functionActivationTarget(args);
-  const endpoint = `/v1/projects/${encodeURIComponent(projectRef)}/functions/${encodeURIComponent(functionSlug)}` + `/versions/${encodeURIComponent(version)}/activate`;
-  return activationResponse(functionSlug, version, await http.post(endpoint));
+  const { projectRef, functionSlug, version, expectedActiveVersion } = functionActivationTarget(args);
+  const endpoint = edgeFunctionResourcePath(projectRef, functionSlug) + `/versions/${encodeURIComponent(version)}/activate`;
+  return functionMutationResponse({
+    operation: "edge_functions.activate",
+    projectRef,
+    slug: functionSlug,
+    expectedActiveVersion,
+    targetVersion: version
+  }, await http.postReleaseMutation(endpoint, { expected_active_version: expectedActiveVersion }));
 }
 function registerAdvancedTools(server, http, environment = process.env, options = {}) {
-  server.tool("edge_functions", `Edge Function management (Deno/Bun serverless). Server auto-bundles dependencies.
+  server.tool("edge_functions", `Edge Function management (Deno/Bun serverless). Source deploys are bundled; verified prebuilt artifacts stay byte-exact.
 Actions: list, deploy, deploy_bundle, config, source, activate, delete, check`, {
     action: withDescription(stringEnum(["list", "deploy", "deploy_bundle", "config", "source", "activate", "delete", "check"]), "Action"),
     ref: withDescription(Type.String(), "Project ref"),
     slug: optional(Type.String(), "[deploy/deploy_bundle/config/source/activate/delete/check] Function name"),
-    version: withDescription(functionVersionSchema, "[activate] Existing Function version"),
+    version: withDescription(functionVersionSchema, "[source/activate] Existing immutable Function version; source requires a positive version"),
     code: optional(Type.String(), "[deploy/check] Function source code (TypeScript)"),
     path: optional(Type.String(), "[deploy/check] Local file path to read code from (alternative to code)"),
+    "prebundled-path": optional(Type.String(), "[deploy] Prebuilt runtime bundle to upload without rebuilding; requires expected-sha256"),
+    "expected-sha256": optional(Type.String({ pattern: SHA256_HEX_PATTERN.source, minLength: 64, maxLength: 64 }), "[deploy] Required lowercase SHA-256 of the exact prebundled-path bytes"),
     output: optional(Type.String(), "[source] Write source to this local file instead of stdout; the file must not already exist"),
     files: optional(functionFilesSchema, "[deploy_bundle] File map as a JSON object: { 'index.ts': '...', '_shared/x.ts': '...' }"),
     entrypoint: optional(Type.String(), "[deploy_bundle] Entrypoint file (default: index.ts)"),
     minify: optional(Type.Boolean(), "[deploy/deploy_bundle] Minify bundle"),
     verify_jwt: optional(Type.Boolean(), "[deploy/deploy_bundle/config] Set JWT verification for this function"),
-    background_routes: withDescription(backgroundRoutesSchema, "[deploy/deploy_bundle/config] Background route paths; pass comma-separated or JSON array in CLI")
+    background_routes: withDescription(backgroundRoutesSchema, "[deploy/deploy_bundle/config] Background route paths; pass comma-separated or JSON array in CLI"),
+    "expected-active-version": withDescription(expectedActiveVersionSchema, "[deploy/deploy_bundle/activate] Required current active version, or 'absent' when none exists")
   }, async (args) => {
     if (args.action === "activate")
       return activateFunctionVersion(http, args, options.readOnly);
     const { action, ref, slug, path: pathArg, output, files, entrypoint, minify, verify_jwt, background_routes } = args;
+    rejectPrebundledFlagsOutsideDeploy(action, args);
+    const expectedActiveVersion = action === "deploy" || action === "deploy_bundle" ? requiredExpectedActiveVersion(args, action) : undefined;
     let code = args.code;
     const need = (f, v) => {
       if (!v)
@@ -8578,16 +8974,10 @@ Actions: list, deploy, deploy_bundle, config, source, activate, delete, check`,
       if (!hasFunctionConfig()) {
         throw new Error("'verify_jwt' or 'background_routes' required for 'config'");
       }
-      const cr = await http.patch(`/v1/projects/${ref}/functions/${slug}/config`, functionConfig());
+      const cr = await http.patch(`${edgeFunctionResourcePath(ref, slug)}/config`, functionConfig());
       return cr.ok ? `✅ Function ${slug} config updated
 ${JSON.stringify(cr.data, null, 2)}` : `❌ Config update failed (${cr.status}): ${JSON.stringify(cr.data)}`;
     };
-    const deploymentPolicyReceiptText = (successText, responsePayload) => {
-      if (!hasFunctionConfig() || confirmedFunctionConfig(responsePayload, functionConfig())) {
-        return successText;
-      }
-      return "❌ Unsafe deployment receipt: POST succeeded but did not confirm the requested function policy. No follow-up PATCH was attempted because code and policy must be activated atomically.";
-    };
     const checkSyntax = async (sourceCode) => {
       const tmpDir = mkdtempSync(join2(tmpdir(), "supacloud-edge-check-"));
       const tmpFile = join2(tmpDir, "index.ts");
@@ -8602,7 +8992,7 @@ ${e.stderr || e.message}` };
         rmSync(tmpDir, { recursive: true, force: true });
       }
     };
-    if (pathArg && !code) {
+    if (action === "check" && pathArg && !code) {
       try {
         code = await bundleEdgeFunctionPath(pathArg);
       } catch (error) {
@@ -8612,8 +9002,7 @@ ${e.stderr || e.message}` };
     }
     switch (action) {
       case "list":
-        text = JSON.stringify((await http.get(`/v1/projects/${ref}/functions`)).data, null, 2);
-        break;
+        return functionListResponse(await http.get(edgeFunctionResourcePath(ref)));
       case "check":
         need("code (or path)", code);
         const checkRes = await checkSyntax(code);
@@ -8626,65 +9015,59 @@ ${checkRes.err}`;
         break;
       case "deploy":
         need("slug", slug);
-        need("code", code);
-        const deployCheck = await checkSyntax(code);
-        if (!deployCheck.ok) {
-          text = `❌ Deployment aborted. Syntax check failed:
+        const deployCode = await preparedDeployCode(args);
+        if (!deployCode.prebundled) {
+          const deployCheck = await checkSyntax(deployCode.code);
+          if (!deployCheck.ok) {
+            text = `❌ Deployment aborted. Syntax check failed:
 ${deployCheck.err}`;
-          break;
+            break;
+          }
         }
-        const dr = await http.post(`/v1/projects/${ref}/functions/${slug}`, {
-          code,
-          minify,
+        const deploymentResponse = await http.postReleaseMutation(edgeFunctionResourcePath(ref, slug), {
+          code: deployCode.code,
+          ...deployCode.prebundled ? { prebundled: true, expected_sha256: deployCode.expectedSha256 } : { minify },
+          expected_active_version: expectedActiveVersion,
           ...functionConfig()
         });
-        if (!dr.ok) {
-          text = `❌ Failed (${dr.status}): ${JSON.stringify(dr.data)}`;
-          break;
-        }
-        text = deploymentPolicyReceiptText(`✅ Function ${slug} deployed`, dr.data);
-        break;
+        return functionMutationResponse({
+          operation: "edge_functions.deploy",
+          projectRef: ref,
+          slug,
+          expectedActiveVersion,
+          config: functionConfig()
+        }, deploymentResponse);
       case "deploy_bundle":
         need("slug", slug);
         need("files", files);
-        const br = await http.post(`/v1/projects/${ref}/functions/${slug}/bundle`, {
+        const bundleResponse = await http.postReleaseMutation(`${edgeFunctionResourcePath(ref, slug)}/bundle`, {
           files,
           entrypoint,
           minify,
+          expected_active_version: expectedActiveVersion,
           ...functionConfig()
         });
-        if (!br.ok) {
-          text = `❌ Failed (${br.status}): ${JSON.stringify(br.data)}`;
-          break;
-        }
-        text = deploymentPolicyReceiptText(`✅ Function ${slug} bundle deployed (${Object.keys(files).length} files)`, br.data);
-        break;
+        return functionMutationResponse({
+          operation: "edge_functions.deploy_bundle",
+          projectRef: ref,
+          slug,
+          expectedActiveVersion,
+          config: functionConfig()
+        }, bundleResponse);
       case "config":
         text = await updateFunctionConfig();
         break;
       case "source":
         need("slug", slug);
-        const sr = await http.get(`/v1/projects/${ref}/functions/${slug}/source`);
-        if (!sr.ok) {
-          text = `❌ Not found (${sr.status})`;
-          break;
-        }
-        if (!output) {
-          text = JSON.stringify(sr.data, null, 2);
-          break;
-        }
-        const sourceCode = functionSourceCode(sr.data);
-        if (sourceCode === null) {
-          text = "❌ Source response did not contain a string code field";
-          break;
-        }
-        const outputPath = resolve2(output);
-        writeFileSync(outputPath, sourceCode, { flag: "wx" });
-        text = `✅ Function ${slug} source written to ${outputPath} (${Buffer.byteLength(sourceCode)} bytes)`;
-        break;
+        return readFunctionSource(http, {
+          projectRef: ref,
+          slug,
+          version: args.version,
+          output
+        });
       case "delete":
         need("slug", slug);
-        text = (await http.delete(`/v1/projects/${ref}/functions/${slug}`)).ok ? `✅ Function ${slug} deleted` : `❌ Failed`;
+        text = (await http.delete(edgeFunctionResourcePath(ref, slug))).ok ? `✅ Function ${slug} deleted` : `❌ Failed`;
         break;
       default:
         text = `❌ Unknown action`;
@@ -10605,12 +10988,14 @@ var MAX_BODY_FILE_BYTES = 1048576;
 var MAX_HEADER_COUNT = 64;
 var MAX_HEADER_VALUE_LENGTH = 8192;
 var MAX_SCHEDULE_NAME_LENGTH = 120;
+var CANONICAL_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
 var headerEnvironmentRecord = Type.Record(Type.String(), Type.String());
 var ACTION_ARGUMENTS2 = {
   list: new Set(["action", "ref"]),
+  get: new Set(["action", "ref", "schedule_id"]),
   create: new Set(["action", "ref", "name", "slug", "cron", "method", "body_file", "header_env"]),
-  update: new Set(["action", "ref", "schedule_id", "name", "cron", "method", "enabled", "body_file", "header_env"]),
-  delete: new Set(["action", "ref", "schedule_id"])
+  update: new Set(["action", "ref", "schedule_id", "expected_updated_at", "name", "cron", "method", "enabled", "body_file", "header_env"]),
+  delete: new Set(["action", "ref", "schedule_id", "expected_updated_at"])
 };
 function parseHeaderEnvironment(input) {
   if (typeof input !== "string")
@@ -10730,7 +11115,13 @@ function validScheduleDefinition(schedule) {
   return typeof schedule.cron === "string" && validScheduledFunctionCron(schedule.cron) && (schedule.method === "GET" || schedule.method === "POST") && typeof schedule.enabled === "boolean";
 }
 function validScheduleMetadata(schedule) {
-  return typeof schedule.created_at === "string" && typeof schedule.updated_at === "string";
+  return typeof schedule.created_at === "string" && isCanonicalTimestamp(schedule.updated_at);
+}
+function isCanonicalTimestamp(candidate) {
+  if (typeof candidate !== "string" || !CANONICAL_TIMESTAMP_PATTERN.test(candidate))
+    return false;
+  const milliseconds = Date.parse(candidate);
+  return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === candidate;
 }
 function safeSchedulePayload(schedule) {
   const headerNames = safeHeaderNames(schedule.header_names);
@@ -10803,6 +11194,17 @@ function listResponse(ref, response) {
     return releaseControlFailure(operation, "INVALID_RESPONSE", null);
   return releaseControlSuccess(operation, { project_ref: ref, schedules });
 }
+function getResponse(ref, scheduleId, response) {
+  const operation = "scheduled_functions.get";
+  if (!response.ok)
+    return scheduleFailure(operation, response);
+  const payload = objectRecord2(response.data);
+  const schedule = safeSchedule(payload?.schedule);
+  if (payload?.project_ref !== ref || !schedule || schedule.id !== scheduleId) {
+    return releaseControlFailure(operation, "INVALID_RESPONSE", null);
+  }
+  return releaseControlSuccess(operation, { project_ref: ref, schedule });
+}
 function mutationResponse(expectation, response) {
   const { action, ref, requestId, expectedFields } = expectation;
   const scheduleId = action === "update" ? expectation.scheduleId : undefined;
@@ -10812,22 +11214,29 @@ function mutationResponse(expectation, response) {
   const payload = objectRecord2(response.data);
   const schedule = safeSchedule(payload?.schedule);
   const confirmsRequest = schedule && Object.entries(expectedFields).every(([field, expected]) => isDeepStrictEqual(schedule[field], expected));
-  if (payload?.project_ref !== ref || payload.request_id !== requestId || payload?.[action === "create" ? "created" : "updated"] !== true || !schedule || !confirmsRequest || scheduleId !== undefined && schedule.id !== scheduleId) {
+  const confirmsRevision = action === "create" || payload?.previous_updated_at === expectation.expectedUpdatedAt && schedule !== null && schedule.updated_at > expectation.expectedUpdatedAt;
+  if (payload?.project_ref !== ref || payload.request_id !== requestId || payload?.[action === "create" ? "created" : "updated"] !== true || !schedule || !confirmsRequest || !confirmsRevision || scheduleId !== undefined && schedule.id !== scheduleId) {
     return releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.status);
   }
-  return releaseControlSuccess(operation, { project_ref: ref, request_id: requestId, schedule });
+  return releaseControlSuccess(operation, {
+    project_ref: ref,
+    request_id: requestId,
+    ...action === "update" ? { previous_updated_at: expectation.expectedUpdatedAt } : {},
+    schedule
+  });
 }
-function deleteResponse(ref, scheduleId, response) {
+function deleteResponse(ref, scheduleId, expectedUpdatedAt, response) {
   const operation = "scheduled_functions.delete";
   if (!response.ok)
     return releaseControlMutationFailure(operation, response);
   const payload = objectRecord2(response.data);
-  if (payload?.deleted !== true || payload.project_ref !== ref || payload.schedule_id !== scheduleId) {
+  if (payload?.deleted !== true || payload.project_ref !== ref || payload.schedule_id !== scheduleId || payload.deleted_updated_at !== expectedUpdatedAt) {
     return releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.status);
   }
   return releaseControlSuccess(operation, {
     project_ref: ref,
     schedule_id: scheduleId,
+    deleted_updated_at: expectedUpdatedAt,
     deleted: true
   });
 }
@@ -10876,7 +11285,15 @@ function requiredCron(args, action) {
     throw new Error(`'cron' is invalid for '${action}'`);
   return cron;
 }
+function requiredExpectedUpdatedAt(args, action) {
+  const candidate = args.expected_updated_at;
+  if (!isCanonicalTimestamp(candidate)) {
+    throw new Error(`'expected_updated_at' must be a canonical UTC timestamp for '${action}'`);
+  }
+  return candidate;
+}
 function updateRequest(args, environment) {
+  const expectedUpdatedAt = requiredExpectedUpdatedAt(args, "update");
   const body = scheduleBody(args.body_file);
   const headers = scheduleHeaders(args.header_env, environment);
   const cron = args.cron === undefined ? undefined : requiredCron(args, "update");
@@ -10892,11 +11309,18 @@ function updateRequest(args, environment) {
   if (Object.keys(mutationFields).length === 0) {
     throw new Error("Scheduled Function update requires at least one field");
   }
-  return { request_id: randomUUID(), ...mutationFields };
+  return {
+    request_id: randomUUID(),
+    expected_updated_at: expectedUpdatedAt,
+    ...mutationFields
+  };
+}
+function deletePath(schedulePathname, expectedUpdatedAt) {
+  return `${schedulePathname}?expected_updated_at=${encodeURIComponent(expectedUpdatedAt)}`;
 }
 async function executeScheduleAction(http, environment, args, readOnly = false) {
   const action = args.action;
-  if (readOnly && action !== "list")
+  if (readOnly && action !== "list" && action !== "get")
     return readOnlyResult2();
   assertActionArguments2(action, args);
   const ref = requiredText2(args, "ref", action);
@@ -10908,27 +11332,34 @@ async function executeScheduleAction(http, environment, args, readOnly = false)
     return mutationResponse({ action, ref, requestId, expectedFields: safeMutationFields(request) }, await http.post(schedulePath(ref), request));
   }
   const scheduleId = requiredText2(args, "schedule_id", action);
+  const targetPath = schedulePath(ref, scheduleId);
+  if (action === "get")
+    return getResponse(ref, scheduleId, await http.get(targetPath));
   if (action === "update") {
     const request = updateRequest(args, environment);
     const requestId = request.request_id;
+    const expectedUpdatedAt2 = request.expected_updated_at;
     return mutationResponse({
       action,
       ref,
       scheduleId,
       requestId,
+      expectedUpdatedAt: expectedUpdatedAt2,
       expectedFields: safeMutationFields(request)
-    }, await http.patch(schedulePath(ref, scheduleId), request));
+    }, await http.patch(targetPath, request));
   }
-  return deleteResponse(ref, scheduleId, await http.delete(schedulePath(ref, scheduleId)));
+  const expectedUpdatedAt = requiredExpectedUpdatedAt(args, "delete");
+  return deleteResponse(ref, scheduleId, expectedUpdatedAt, await http.delete(deletePath(targetPath, expectedUpdatedAt)));
 }
 function registerScheduledFunctionTools(server, http, environment = process.env, options = {}) {
   server.tool("scheduled_functions", SCHEDULE_TOOL_DESCRIPTION, SCHEDULE_TOOL_SCHEMA, (args) => executeScheduleAction(http, environment, args, options.readOnly));
 }
-var SCHEDULE_TOOL_DESCRIPTION = "Scheduled Edge Function lifecycle. Actions: list, create, update, delete";
+var SCHEDULE_TOOL_DESCRIPTION = "Scheduled Edge Function lifecycle. Actions: list, get, create, update, delete";
 var SCHEDULE_TOOL_SCHEMA = {
-  action: withDescription(stringEnum(["list", "create", "update", "delete"]), "Action"),
+  action: withDescription(stringEnum(["list", "get", "create", "update", "delete"]), "Action"),
   ref: withDescription(Type.String(), "Project ref"),
-  schedule_id: optional(Type.String(), "[update/delete] Schedule ID"),
+  schedule_id: optional(Type.String(), "[get/update/delete] Schedule ID"),
+  expected_updated_at: optional(Type.String(), "[update/delete] Canonical updated_at from list"),
   name: optional(Type.String(), "[create/update] Display name"),
   slug: optional(Type.String(), "[create] Edge Function slug"),
   cron: optional(Type.String(), "[create/update] Five-field cron expression"),
@@ -10940,7 +11371,7 @@ var SCHEDULE_TOOL_SCHEMA = {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.16.0",
+  version: "0.18.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -11156,8 +11587,9 @@ EXAMPLES
   ${preferredCommand} branch promote --branch_ref preview123 --plan_checksum <sha256>
   ${preferredCommand} ai show_skill
   ${preferredCommand} ai install_skill --dry_run
-  ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello
-  ${preferredCommand} edge_functions activate --ref abc123 --slug hello --version 3
+  ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello --expected-active-version absent
+  ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --prebundled-path ./dist/hello.js --expected-sha256 <sha256> --expected-active-version 4
+  ${preferredCommand} edge_functions activate --ref abc123 --slug hello --version 3 --expected-active-version 4
   ${preferredCommand} scheduled_functions list --ref abc123
   ${preferredCommand} edge_functions config --ref abc123 --slug hello --verify_jwt false --background_routes "/queue/*,/render/*"
   ${preferredCommand} secrets upsert --ref abc123 --from-env API_KEY,WEBHOOK_SECRET

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",

package/skills/supacloud-cli/references/command-map.md

@@ -31,7 +31,7 @@ until a project-scoped context is resolved.
 - `supabase`: allowlisted official CLI adapter for migration authoring, local reset/diff, explicit-DSN inspection/backup/type generation, and SupaCloud-controlled migration push.
 - `auth`: provider and authentication configuration.
 - `storage`: buckets and object-management workflows.
-- `edge_functions`: deploy and configure Edge Functions.
+- `edge_functions`: list, read immutable source, deploy, activate, and configure Edge Functions. Pass the non-negative version read from `list` as `--expected-active-version`; use `absent` only for a new slug. Version `0` is a legacy CAS token and cannot be used as a source or activation target.
 - `frontend`: list, build/deploy, domain, and deployment workflows.
 - `secrets`: project secret management; never print values after write.
 - `queue`, `task_events`, `diagnostics`: asynchronous workload operations and bounded diagnostics.