@supacloud/cli 0.19.0 → 0.21.0

package/README.md

@@ -161,11 +161,13 @@ supacloud-cli frontend list --ref abc123
 supacloud-cli branch create --name feature-orders --data_mode schema_only
 supacloud-cli branch promotion_plan --branch_ref preview123
 supacloud-cli branch promote --branch_ref preview123 --plan_checksum <sha256>
-supacloud-cli edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello --expected-active-version absent
-supacloud-cli edge_functions deploy --ref abc123 --slug hello --prebundled-path ./dist/hello.js --expected-sha256 <sha256> --expected-active-version 4
-supacloud-cli edge_functions deploy_bundle --ref abc123 --slug hello --files '{"index.ts":"export default { fetch: () => new Response(\"ok\") }"}' --expected-active-version 7
+supacloud-cli edge_functions get_config --ref abc123 --slug hello
+supacloud-cli edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello --expected-active-version absent --expected-activation-id legacy
+supacloud-cli edge_functions deploy --ref abc123 --slug hello --prebundled-path ./dist/hello.js --expected-sha256 <sha256> --expected-active-version 4 --expected-activation-id <uuid>
+supacloud-cli edge_functions deploy_bundle --ref abc123 --slug hello --files '{"index.ts":"export default { fetch: () => new Response(\"ok\") }"}' --expected-active-version 7 --expected-activation-id <uuid>
 supacloud-cli edge_functions source --ref abc123 --slug hello --version 7 --output ./hello-v7.ts
-supacloud-cli edge_functions activate --ref abc123 --slug hello --version 3 --expected-active-version 8
+supacloud-cli edge_functions activate --ref abc123 --slug hello --version 3 --expected-active-version 8 --expected-activation-id <uuid>
+supacloud-cli edge_functions delete --ref abc123 --slug hello --expected-activation-id <uuid>
 supacloud-cli scheduled_functions list --ref abc123
 supacloud-cli secrets upsert --ref abc123 --from-env API_KEY,WEBHOOK_SECRET
 supacloud-cli storage list_buckets --ref abc123
@@ -221,10 +223,17 @@ pointer; this remains correct across an active-version A→B→A transition.
 `--expected-active-version <N|absent>`. Read the current non-negative integer
 version from `edge_functions list`; use `0` for a listed legacy Function and
 `absent` only when creating a slug that does not yet exist. A stale value returns
-HTTP 409 without building, preheating, or activating another version. List output remains a JSON array with string
-`slug` and numeric `version` fields, while source output is exactly
-`{ "code": "..." }`. Release automation must use `source --version <N>` for a
-version-bound backup.
+HTTP 409 without building, preheating, or activating another version. Every
+Function mutation also requires `--expected-activation-id <uuid|legacy>` from
+the same `list` or `get_config` snapshot. Use `get_config` for a single atomic
+read of `active_version`, `activation_id`, and policy, including an `absent`
+tombstone after deletion. Use `legacy` only for a never-created slug or a listed
+legacy Function; recreating a deleted slug must use the tombstone UUID returned
+by `delete` or `get_config`. This second token prevents an A→B→A version cycle
+from satisfying a stale mutation. List output remains a JSON array with string
+`slug`, numeric `version`, and canonical `activation_id` fields, while source
+output is exactly `{ "code": "..." }`. Release automation must use
+`source --version <N>` for a version-bound backup.
 
 `edge_functions activate` restores an existing immutable Function version and
 returns a machine-readable receipt containing the activated version and JWT
@@ -234,10 +243,10 @@ server response body.
 Mutation receipts use schema `supacloud.cli.release-control.v1`. An
 `OUTCOME_UNKNOWN` error means the server may have committed the mutation before
 the response was lost or failed validation; read back current state before any
-retry. For Function deploy, bundle deploy, and activation, the CLI applies a
-separate 5-second, 64 KiB response-body boundary after receiving HTTP headers.
-A stalled, oversized, truncated, unreadable, or malformed body is always
-`OUTCOME_UNKNOWN` and its content is never included in CLI output.
+retry. For Function deploy, bundle deploy, activation, config, and delete, the
+CLI applies a separate 5-second, 64 KiB response-body boundary after receiving
+HTTP headers. A stalled, oversized, truncated, unreadable, or malformed body is
+always `OUTCOME_UNKNOWN` and its content is never included in CLI output.
 Version `0` is reserved as the active-version CAS token for legacy Functions. It
 can be passed only as `--expected-active-version`; immutable source reads and
 activation targets still require a positive version.
@@ -250,6 +259,8 @@ activation targets still require a positive version.
   "project_ref": "abc123",
   "slug": "hello",
   "previous_active_version": "7",
+  "expected_activation_id": "9dc0e8da-207f-4f25-ae74-b1de4e66784d",
+  "activation_id": "6417591d-c038-46e8-91ca-4c8080514144",
   "active_version": "8",
   "version": "8",
   "verify_jwt": true

package/dist/index.js

@@ -6478,7 +6478,7 @@ var ACTION_POLICY = {
     write: ["create_bucket", "update_bucket", "delete_bucket", "upload_base64", "delete_file"]
   },
   edge_functions: {
-    read: ["list", "source"],
+    read: ["list", "get_config", "source"],
     local: ["check"],
     write: ["deploy", "deploy_bundle", "config", "activate", "delete"]
   },
@@ -6572,6 +6572,15 @@ var RELEASE_MUTATION_RESPONSE_TIMEOUT = 5000;
 var RELEASE_MUTATION_RESPONSE_MAX_BYTES = 64 * 1024;
 var MAX_RETRIES = 2;
 var RETRY_BASE_DELAY = 500;
+function validatedGetResponseLimit(options) {
+  const maxBytes = options.maxResponseBytes;
+  if (maxBytes === undefined)
+    return;
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new RangeError("HTTP response limit must be a positive safe integer");
+  }
+  return maxBytes;
+}
 function isRetryableMethod(method) {
   const normalizedMethod = (method ?? "GET").toUpperCase();
   return normalizedMethod === "GET" || normalizedMethod === "HEAD";
@@ -6773,10 +6782,10 @@ class HttpTransport {
       "Content-Type": "application/json"
     };
   }
-  async postWithResponseReader(path, serializedBody, responseReader) {
+  async mutationWithResponseReader(method, path, serializedBody, responseReader) {
     try {
       const response = await fetchWithRetry(`${this.baseUrl}${path}`, {
-        method: "POST",
+        method,
         headers: this.headers(),
         body: serializedBody
       });
@@ -6787,12 +6796,13 @@ class HttpTransport {
     }
   }
   async get(path, options = {}) {
+    const maxResponseBytes = validatedGetResponseLimit(options);
     try {
       const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
         method: "GET",
         headers: this.headers()
       });
-      const data = options.maxResponseBytes === undefined ? await res.json().catch(() => null) : await boundedResponseJson(res, options.maxResponseBytes);
+      const data = maxResponseBytes === undefined ? await res.json().catch(() => null) : await boundedResponseJson(res, maxResponseBytes);
       return { ok: res.ok, status: res.status, data };
     } catch (error) {
       return transportFailure(error);
@@ -6800,13 +6810,19 @@ class HttpTransport {
   }
   async post(path, body) {
     try {
-      return await this.postWithResponseReader(path, serializedRequestBody(body), responseJsonOrNull);
+      return await this.mutationWithResponseReader("POST", path, serializedRequestBody(body), responseJsonOrNull);
     } catch (error) {
       return transportFailure(error);
     }
   }
   async postReleaseMutation(path, body) {
-    return this.postWithResponseReader(path, serializedRequestBody(body), releaseMutationResponseJson);
+    return this.mutationWithResponseReader("POST", path, serializedRequestBody(body), releaseMutationResponseJson);
+  }
+  async patchReleaseMutation(path, body) {
+    return this.mutationWithResponseReader("PATCH", path, serializedRequestBody(body), releaseMutationResponseJson);
+  }
+  async deleteReleaseMutation(path, body) {
+    return this.mutationWithResponseReader("DELETE", path, serializedRequestBody(body), releaseMutationResponseJson);
   }
   async postMultipart(path, formData) {
     try {
@@ -6848,11 +6864,12 @@ class HttpTransport {
       return transportFailure(error);
     }
   }
-  async delete(path) {
+  async delete(path, body) {
     try {
       const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
         method: "DELETE",
-        headers: this.headers()
+        headers: this.headers(),
+        body: serializedRequestBody(body)
       });
       const data = await res.json().catch(() => null);
       return { ok: res.ok, status: res.status, data };
@@ -7957,14 +7974,15 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status}): ${JSON.stringif
 var RELEASE_CONTROL_RESPONSE_SCHEMA = "supacloud.cli.release-control.v1";
 function releaseControlSuccess(operation, payload) {
   return releaseControlResponse({
+    ...payload,
     schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
     ok: true,
-    operation,
-    ...payload
+    operation
   });
 }
-function releaseControlFailure(operation, code, httpStatus) {
+function releaseControlFailure(operation, code, httpStatus, safeState = {}) {
   return releaseControlErrorResponse({
+    ...safeState,
     schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
     ok: false,
     operation,
@@ -8425,6 +8443,155 @@ import { tmpdir } from "node:os";
 import { basename as basename2, join as join2, resolve as resolve2 } from "node:path";
 import { promisify } from "node:util";
 import { execFile } from "node:child_process";
+
+// src/shared/tools/edge-function-response.ts
+var CANONICAL_VERSION_PATTERN = /^(?:0|[1-9][0-9]*)$/;
+var SAFE_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+var ACTIVATION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var LEGACY_ACTIVATION_ID = "legacy";
+var LIST_STRING_FIELDS = [
+  "id",
+  "name",
+  "status",
+  "entrypoint_path",
+  "created_at",
+  "updated_at"
+];
+var LIST_BOOLEAN_FIELDS = ["verify_jwt", "import_map"];
+function objectRecord(candidate) {
+  return candidate !== null && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
+}
+function canonicalVersion(candidate) {
+  return typeof candidate === "string" && CANONICAL_VERSION_PATTERN.test(candidate) && Number.isSafeInteger(Number(candidate));
+}
+function stringRoutes(candidate) {
+  return Array.isArray(candidate) && candidate.every((route) => typeof route === "string");
+}
+function optionalTypedFields(source, fields, expectedType) {
+  return fields.every((field) => source[field] === undefined || typeof source[field] === expectedType);
+}
+function validObservedFunctionActivationId(candidate) {
+  return candidate === LEGACY_ACTIVATION_ID || typeof candidate === "string" && ACTIVATION_ID_PATTERN.test(candidate);
+}
+function validCommittedFunctionActivationId(candidate) {
+  return typeof candidate === "string" && ACTIVATION_ID_PATTERN.test(candidate);
+}
+function projectedFunctionListEntry(candidate) {
+  const functionRecord = objectRecord(candidate);
+  if (!functionRecord || typeof functionRecord.slug !== "string" || !SAFE_SLUG_PATTERN.test(functionRecord.slug) || typeof functionRecord.version !== "number" || !Number.isSafeInteger(functionRecord.version) || functionRecord.version < 0 || !validObservedFunctionActivationId(functionRecord.activation_id) || !optionalTypedFields(functionRecord, LIST_STRING_FIELDS, "string") || !optionalTypedFields(functionRecord, LIST_BOOLEAN_FIELDS, "boolean") || functionRecord.background_routes !== undefined && !stringRoutes(functionRecord.background_routes))
+    return null;
+  const projected = {
+    slug: functionRecord.slug,
+    version: functionRecord.version,
+    activation_id: functionRecord.activation_id
+  };
+  for (const field of [...LIST_STRING_FIELDS, ...LIST_BOOLEAN_FIELDS]) {
+    if (functionRecord[field] !== undefined)
+      projected[field] = functionRecord[field];
+  }
+  if (functionRecord.background_routes !== undefined) {
+    projected.background_routes = functionRecord.background_routes;
+  }
+  return projected;
+}
+function projectedFunctionList(payload) {
+  if (!Array.isArray(payload))
+    return null;
+  const slugs = new Set;
+  const projected = [];
+  for (const candidate of payload) {
+    const functionRecord = projectedFunctionListEntry(candidate);
+    if (!functionRecord)
+      return null;
+    const slug = functionRecord.slug;
+    if (typeof slug !== "string" || slugs.has(slug))
+      return null;
+    slugs.add(slug);
+    projected.push(functionRecord);
+  }
+  return projected;
+}
+function optionalConfigFields(response) {
+  if (response.version !== undefined && !canonicalVersion(response.version))
+    return null;
+  if (response.import_map !== undefined && typeof response.import_map !== "string")
+    return null;
+  if (response.entrypoint !== undefined && typeof response.entrypoint !== "string")
+    return null;
+  return {
+    ...response.version === undefined ? {} : { version: response.version },
+    ...response.import_map === undefined ? {} : { import_map: response.import_map },
+    ...response.entrypoint === undefined ? {} : { entrypoint: response.entrypoint }
+  };
+}
+function coherentFunctionVersion(activeVersion, version) {
+  if (activeVersion === "absent")
+    return version === undefined;
+  if (activeVersion === "0")
+    return version === undefined || version === "0";
+  return version === activeVersion;
+}
+function projectedFunctionIdentity(payload, expectedProjectRef, expectedSlug) {
+  const response = objectRecord(payload);
+  if (!response || response.project_ref !== expectedProjectRef || response.slug !== expectedSlug || response.active_version !== "absent" && !canonicalVersion(response.active_version) || !validObservedFunctionActivationId(response.activation_id) || typeof response.verify_jwt !== "boolean" || !stringRoutes(response.background_routes))
+    return null;
+  const optionalFields = optionalConfigFields(response);
+  if (!optionalFields || !coherentFunctionVersion(response.active_version, optionalFields.version))
+    return null;
+  return {
+    project_ref: expectedProjectRef,
+    slug: expectedSlug,
+    active_version: response.active_version,
+    verify_jwt: response.verify_jwt,
+    background_routes: response.background_routes,
+    ...optionalFields,
+    activation_id: response.activation_id
+  };
+}
+function mutationIdentityMatches(response, expectation) {
+  return response.success === true && response.project_ref === expectation.projectRef && response.slug === expectation.slug && response.expected_activation_id === expectation.expectedActivationId && validCommittedFunctionActivationId(response.activation_id) && response.activation_id !== expectation.expectedActivationId;
+}
+function configMatchesExpectation(response, expected) {
+  if (typeof response.verify_jwt !== "boolean" || !stringRoutes(response.background_routes)) {
+    return false;
+  }
+  if (expected.verify_jwt !== undefined && response.verify_jwt !== expected.verify_jwt)
+    return false;
+  return expected.background_routes === undefined || JSON.stringify(response.background_routes) === JSON.stringify(expected.background_routes);
+}
+function confirmedFunctionConfigMutation(payload, expectation) {
+  const response = objectRecord(payload);
+  if (!response || !mutationIdentityMatches(response, expectation) || !configMatchesExpectation(response, expectation.config))
+    return null;
+  const optionalFields = optionalConfigFields(response);
+  if (!optionalFields)
+    return null;
+  return {
+    project_ref: expectation.projectRef,
+    slug: expectation.slug,
+    expected_activation_id: expectation.expectedActivationId,
+    activation_id: response.activation_id,
+    verify_jwt: response.verify_jwt,
+    background_routes: response.background_routes,
+    ...optionalFields
+  };
+}
+function confirmedFunctionDeletion(payload, expectation) {
+  const response = objectRecord(payload);
+  const config = objectRecord(response?.config);
+  if (!response || !config || !mutationIdentityMatches(response, expectation) || response.previous_active_version !== "absent" && !canonicalVersion(response.previous_active_version) || response.active_version !== "absent" || config.version !== undefined || config.activation_id !== response.activation_id || typeof config.verify_jwt !== "boolean")
+    return null;
+  return {
+    project_ref: expectation.projectRef,
+    slug: expectation.slug,
+    expected_activation_id: expectation.expectedActivationId,
+    activation_id: response.activation_id,
+    previous_active_version: response.previous_active_version,
+    active_version: "absent"
+  };
+}
+
+// src/shared/tools/advanced-tools.ts
 var execFileAsync = promisify(execFile);
 var SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/;
 function openFileIdentity(descriptor) {
@@ -8622,12 +8789,22 @@ function activeFunctionVersionToken(input) {
 var CANONICAL_FUNCTION_VERSION_PATTERN = /^(?:0|[1-9][0-9]*)$/;
 var POSITIVE_FUNCTION_VERSION_PATTERN = /^[1-9][0-9]*$/;
 var SAFE_FUNCTION_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+var FUNCTION_ACTIVATION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var LEGACY_FUNCTION_ACTIVATION_ID = "legacy";
 var FUNCTION_ACTIVATION_ARGUMENTS = new Set([
   "action",
   "ref",
   "slug",
   "version",
-  "expected-active-version"
+  "expected-active-version",
+  "expected-activation-id"
+]);
+var FUNCTION_IDENTITY_MUTATIONS = new Set([
+  "deploy",
+  "deploy_bundle",
+  "config",
+  "activate",
+  "delete"
 ]);
 var functionVersionSchema = Type.Optional(decodedSchema(Type.Union([
   Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),
@@ -8646,6 +8823,10 @@ var expectedActiveVersionSchema = Type.Optional(decodedSchema(Type.Union([
   Type.Literal("absent"),
   Type.String({ pattern: CANONICAL_FUNCTION_VERSION_PATTERN.source, maxLength: 16 })
 ]), parseExpectedActiveVersion));
+var expectedActivationIdSchema = Type.Optional(Type.Union([
+  Type.Literal(LEGACY_FUNCTION_ACTIVATION_ID),
+  Type.String({ pattern: FUNCTION_ACTIVATION_ID_PATTERN.source, minLength: 36, maxLength: 36 })
+]));
 var secretListSchema = Type.Array(Type.Object({ name: Type.String(), value: Type.String() }));
 var ENVIRONMENT_SECRET_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
 var MAX_SECRET_COUNT = 1024;
@@ -8768,28 +8949,14 @@ var INVALID_FUNCTION_SOURCE_RESPONSE = "❌ Edge Function source response is inv
 function invalidFunctionReadResponse(message) {
   return { isError: true, content: [{ type: "text", text: message }] };
 }
-function safeFunctionList(payload) {
-  if (!Array.isArray(payload))
-    return null;
-  const functionSlugs = new Set;
-  for (const candidate of payload) {
-    const edgeFunction = objectRecord(candidate);
-    const slug = edgeFunction?.slug;
-    const version = edgeFunction?.version;
-    if (typeof slug !== "string" || !SAFE_FUNCTION_SLUG_PATTERN.test(slug) || typeof version !== "number" || !Number.isSafeInteger(version) || version < 0 || functionSlugs.has(slug))
-      return null;
-    functionSlugs.add(slug);
-  }
-  return payload;
-}
 function functionListResponse(response) {
   if (!response.ok)
     return invalidFunctionReadResponse(`❌ Failed (${response.status})`);
-  const functions = safeFunctionList(response.data);
+  const functions = projectedFunctionList(response.data);
   return functions ? { content: [{ type: "text", text: JSON.stringify(functions, null, 2) }] } : invalidFunctionReadResponse(INVALID_FUNCTION_LIST_RESPONSE);
 }
 function confirmedFunctionConfig(payload, expected) {
-  const response = objectRecord(payload);
+  const response = objectRecord2(payload);
   if (!response)
     return false;
   if (expected.verify_jwt !== undefined && response.verify_jwt !== expected.verify_jwt)
@@ -8824,7 +8991,7 @@ function functionSourceOutput(slug, sourceCode, output) {
     }]
   };
 }
-function objectRecord(candidate) {
+function objectRecord2(candidate) {
   return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
 }
 function edgeFunctionResourcePath(ref, slug) {
@@ -8846,8 +9013,31 @@ async function readFunctionSource(http, request) {
   const sourceCode = functionSourceCode(response.data, sourceVersion === undefined ? "code" : "source_code");
   return sourceCode === null ? invalidFunctionReadResponse(INVALID_FUNCTION_SOURCE_RESPONSE) : functionSourceOutput(request.slug, sourceCode, request.output);
 }
-function mutationIdentityMatches(receipt, expectation) {
-  return receipt.success === true && receipt.project_ref === expectation.projectRef && receipt.slug === expectation.slug && receipt.previous_active_version === expectation.expectedActiveVersion;
+function mutationIdentityMatches2(receipt, expectation) {
+  return receipt.success === true && receipt.project_ref === expectation.projectRef && receipt.slug === expectation.slug && receipt.previous_active_version === expectation.expectedActiveVersion && receipt.expected_activation_id === expectation.expectedActivationId;
+}
+async function readFunctionIdentity(http, projectRef, slug) {
+  const resourcePath = edgeFunctionResourcePath(projectRef, slug);
+  const response = await http.get(`${resourcePath}/config`);
+  if (!response.ok) {
+    return releaseControlFailure("edge_functions.get_config", "HTTP_ERROR", response.status);
+  }
+  const identity = projectedFunctionIdentity(response.data, projectRef, slug);
+  return identity ? { content: [{ type: "text", text: JSON.stringify(identity, null, 2) }] } : releaseControlFailure("edge_functions.get_config", "INVALID_RESPONSE", response.status);
+}
+async function updateFunctionConfiguration(http, request) {
+  const response = await http.patchReleaseMutation(`${edgeFunctionResourcePath(request.projectRef, request.slug)}/config`, { ...request.config, expected_activation_id: request.expectedActivationId });
+  if (!response.ok)
+    return releaseControlMutationFailure("edge_functions.config", response);
+  const confirmed = confirmedFunctionConfigMutation(response.data, request);
+  return confirmed ? releaseControlSuccess("edge_functions.config", confirmed) : releaseControlFailure("edge_functions.config", "OUTCOME_UNKNOWN", response.status);
+}
+async function deleteFunction(http, request) {
+  const response = await http.deleteReleaseMutation(edgeFunctionResourcePath(request.projectRef, request.slug), { expected_activation_id: request.expectedActivationId });
+  if (!response.ok)
+    return releaseControlMutationFailure("edge_functions.delete", response);
+  const confirmed = confirmedFunctionDeletion(response.data, request);
+  return confirmed ? releaseControlSuccess("edge_functions.delete", confirmed) : releaseControlFailure("edge_functions.delete", "OUTCOME_UNKNOWN", response.status);
 }
 function validReceiptVersion(activeVersion) {
   return typeof activeVersion === "string" && POSITIVE_FUNCTION_VERSION_PATTERN.test(activeVersion) && Number.isSafeInteger(Number(activeVersion));
@@ -8860,14 +9050,15 @@ function confirmedMutationVersion(receipt, config, expectation) {
   return activeVersion;
 }
 function confirmedFunctionMutation(expectation, payload) {
-  const receipt = objectRecord(payload);
-  const config = objectRecord(receipt?.config);
-  if (!receipt || !config || !mutationIdentityMatches(receipt, expectation))
+  const receipt = objectRecord2(payload);
+  const config = objectRecord2(receipt?.config);
+  if (!receipt || !config || !mutationIdentityMatches2(receipt, expectation))
     return null;
   const activeVersion = confirmedMutationVersion(receipt, config, expectation);
-  if (activeVersion === null || typeof config.verify_jwt !== "boolean" || !confirmedFunctionConfig(config, expectation.config ?? {}))
+  const activationId = receipt.activation_id;
+  if (activeVersion === null || !validCommittedFunctionActivationId(activationId) || config.activation_id !== activationId || typeof config.verify_jwt !== "boolean" || !confirmedFunctionConfig(config, expectation.config ?? {}))
     return null;
-  return { activeVersion, verifyJwt: config.verify_jwt };
+  return { activeVersion, activationId, verifyJwt: config.verify_jwt };
 }
 function functionMutationResponse(expectation, response) {
   if (!response.ok)
@@ -8880,6 +9071,8 @@ function functionMutationResponse(expectation, response) {
     project_ref: expectation.projectRef,
     slug: expectation.slug,
     previous_active_version: expectation.expectedActiveVersion,
+    expected_activation_id: expectation.expectedActivationId,
+    activation_id: confirmed.activationId,
     active_version: confirmed.activeVersion,
     version: confirmed.activeVersion,
     verify_jwt: confirmed.verifyJwt
@@ -8899,7 +9092,8 @@ function functionActivationTarget(args) {
   if (!SAFE_FUNCTION_SLUG_PATTERN.test(functionSlug))
     throw new Error("'slug' is invalid for 'activate'");
   const expectedActiveVersion = requiredExpectedActiveVersion(args, "activate");
-  return { projectRef, functionSlug, version, expectedActiveVersion };
+  const expectedActivationId = requiredExpectedActivationId(args, "activate");
+  return { projectRef, functionSlug, version, expectedActiveVersion, expectedActivationId };
 }
 function requiredExpectedActiveVersion(args, action) {
   const expected = args["expected-active-version"];
@@ -8911,28 +9105,42 @@ function requiredExpectedActiveVersion(args, action) {
     throw new Error("Expected active version is invalid");
   return parsed;
 }
+function requiredExpectedActivationId(args, action) {
+  const expected = args["expected-activation-id"];
+  if (expected === undefined) {
+    throw new Error(`'--expected-activation-id' required for '${action}'`);
+  }
+  if (!validObservedFunctionActivationId(expected)) {
+    throw new Error("Expected activation ID must be a canonical UUID or 'legacy'");
+  }
+  return expected;
+}
 async function activateFunctionVersion(http, args, readOnly = false) {
   if (readOnly)
     return readOnlyActivationResult();
   const unsupported = Object.keys(args).filter((name) => !FUNCTION_ACTIVATION_ARGUMENTS.has(name));
   if (unsupported.length > 0)
     throw new Error(`'${unsupported[0]}' is not supported for 'activate'`);
-  const { projectRef, functionSlug, version, expectedActiveVersion } = functionActivationTarget(args);
+  const { projectRef, functionSlug, version, expectedActiveVersion, expectedActivationId } = functionActivationTarget(args);
   const endpoint = edgeFunctionResourcePath(projectRef, functionSlug) + `/versions/${encodeURIComponent(version)}/activate`;
   return functionMutationResponse({
     operation: "edge_functions.activate",
     projectRef,
     slug: functionSlug,
     expectedActiveVersion,
+    expectedActivationId,
     targetVersion: version
-  }, await http.postReleaseMutation(endpoint, { expected_active_version: expectedActiveVersion }));
+  }, await http.postReleaseMutation(endpoint, {
+    expected_active_version: expectedActiveVersion,
+    expected_activation_id: expectedActivationId
+  }));
 }
 function registerAdvancedTools(server, http, environment = process.env, options = {}) {
   server.tool("edge_functions", `Edge Function management (Deno/Bun serverless). Source deploys are bundled; verified prebuilt artifacts stay byte-exact.
-Actions: list, deploy, deploy_bundle, config, source, activate, delete, check`, {
-    action: withDescription(stringEnum(["list", "deploy", "deploy_bundle", "config", "source", "activate", "delete", "check"]), "Action"),
+Actions: list, get_config, deploy, deploy_bundle, config, source, activate, delete, check`, {
+    action: withDescription(stringEnum(["list", "get_config", "deploy", "deploy_bundle", "config", "source", "activate", "delete", "check"]), "Action"),
     ref: withDescription(Type.String(), "Project ref"),
-    slug: optional(Type.String(), "[deploy/deploy_bundle/config/source/activate/delete/check] Function name"),
+    slug: optional(Type.String(), "[get_config/deploy/deploy_bundle/config/source/activate/delete/check] Function name"),
     version: withDescription(functionVersionSchema, "[source/activate] Existing immutable Function version; source requires a positive version"),
     code: optional(Type.String(), "[deploy/check] Function source code (TypeScript)"),
     path: optional(Type.String(), "[deploy/check] Local file path to read code from (alternative to code)"),
@@ -8944,13 +9152,15 @@ Actions: list, deploy, deploy_bundle, config, source, activate, delete, check`,
     minify: optional(Type.Boolean(), "[deploy/deploy_bundle] Minify bundle"),
     verify_jwt: optional(Type.Boolean(), "[deploy/deploy_bundle/config] Set JWT verification for this function"),
     background_routes: withDescription(backgroundRoutesSchema, "[deploy/deploy_bundle/config] Background route paths; pass comma-separated or JSON array in CLI"),
-    "expected-active-version": withDescription(expectedActiveVersionSchema, "[deploy/deploy_bundle/activate] Required current active version, or 'absent' when none exists")
+    "expected-active-version": withDescription(expectedActiveVersionSchema, "[deploy/deploy_bundle/activate] Required current active version, or 'absent' when none exists"),
+    "expected-activation-id": withDescription(expectedActivationIdSchema, "[deploy/deploy_bundle/config/activate/delete] Required activation ID from list, or 'legacy' for a new or legacy function")
   }, async (args) => {
     if (args.action === "activate")
       return activateFunctionVersion(http, args, options.readOnly);
     const { action, ref, slug, path: pathArg, output, files, entrypoint, minify, verify_jwt, background_routes } = args;
     rejectPrebundledFlagsOutsideDeploy(action, args);
     const expectedActiveVersion = action === "deploy" || action === "deploy_bundle" ? requiredExpectedActiveVersion(args, action) : undefined;
+    const expectedActivationId = FUNCTION_IDENTITY_MUTATIONS.has(action) ? requiredExpectedActivationId(args, action) : undefined;
     let code = args.code;
     const need = (f, v) => {
       if (!v)
@@ -8962,15 +9172,6 @@ Actions: list, deploy, deploy_bundle, config, source, activate, delete, check`,
       ...Array.isArray(background_routes) ? { background_routes } : {}
     });
     const hasFunctionConfig = () => Object.keys(functionConfig()).length > 0;
-    const updateFunctionConfig = async () => {
-      need("slug", slug);
-      if (!hasFunctionConfig()) {
-        throw new Error("'verify_jwt' or 'background_routes' required for 'config'");
-      }
-      const cr = await http.patch(`${edgeFunctionResourcePath(ref, slug)}/config`, functionConfig());
-      return cr.ok ? `✅ Function ${slug} config updated
-${JSON.stringify(cr.data, null, 2)}` : `❌ Config update failed (${cr.status}): ${JSON.stringify(cr.data)}`;
-    };
     const checkSyntax = async (sourceCode) => {
       const tmpDir = mkdtempSync(join2(tmpdir(), "supacloud-edge-check-"));
       const tmpFile = join2(tmpDir, "index.ts");
@@ -8996,6 +9197,9 @@ ${e.stderr || e.message}` };
     switch (action) {
       case "list":
         return functionListResponse(await http.get(edgeFunctionResourcePath(ref)));
+      case "get_config":
+        need("slug", slug);
+        return readFunctionIdentity(http, ref, slug);
       case "check":
         need("code (or path)", code);
         const checkRes = await checkSyntax(code);
@@ -9021,6 +9225,7 @@ ${deployCheck.err}`;
           code: deployCode.code,
           ...deployCode.prebundled ? { prebundled: true, expected_sha256: deployCode.expectedSha256 } : { minify },
           expected_active_version: expectedActiveVersion,
+          expected_activation_id: expectedActivationId,
           ...functionConfig()
         });
         return functionMutationResponse({
@@ -9028,6 +9233,7 @@ ${deployCheck.err}`;
           projectRef: ref,
           slug,
           expectedActiveVersion,
+          expectedActivationId,
           config: functionConfig()
         }, deploymentResponse);
       case "deploy_bundle":
@@ -9038,6 +9244,7 @@ ${deployCheck.err}`;
           entrypoint,
           minify,
           expected_active_version: expectedActiveVersion,
+          expected_activation_id: expectedActivationId,
           ...functionConfig()
         });
         return functionMutationResponse({
@@ -9045,11 +9252,20 @@ ${deployCheck.err}`;
           projectRef: ref,
           slug,
           expectedActiveVersion,
+          expectedActivationId,
           config: functionConfig()
         }, bundleResponse);
       case "config":
-        text = await updateFunctionConfig();
-        break;
+        need("slug", slug);
+        if (!hasFunctionConfig()) {
+          throw new Error("'verify_jwt' or 'background_routes' required for 'config'");
+        }
+        return updateFunctionConfiguration(http, {
+          projectRef: ref,
+          slug,
+          expectedActivationId,
+          config: functionConfig()
+        });
       case "source":
         need("slug", slug);
         return readFunctionSource(http, {
@@ -9060,8 +9276,11 @@ ${deployCheck.err}`;
         });
       case "delete":
         need("slug", slug);
-        text = (await http.delete(edgeFunctionResourcePath(ref, slug))).ok ? `✅ Function ${slug} deleted` : `❌ Failed`;
-        break;
+        return deleteFunction(http, {
+          projectRef: ref,
+          slug,
+          expectedActivationId
+        });
       default:
         text = `❌ Unknown action`;
     }
@@ -9395,7 +9614,210 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
   });
 }
 
+// src/shared/tools/project-read-projection.ts
+var PROJECT_READ_RESPONSE_MAX_BYTES = 1048576;
+var PROJECT_REF_PATTERN3 = /^[a-z0-9-]{1,20}$/;
+var SAFE_IDENTIFIER_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+var REGION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
+var STATUS_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
+var DNS_LABEL_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;
+var DATABASE_VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$/;
+var PROJECT_SUMMARY_KEYS = new Set([
+  "id",
+  "ref",
+  "organization_id",
+  "organization_slug",
+  "name",
+  "region",
+  "created_at",
+  "status"
+]);
+var PROJECT_DETAILS_KEYS = new Set([
+  ...PROJECT_SUMMARY_KEYS,
+  "database",
+  "api",
+  "studio",
+  "config",
+  "anon_key",
+  "services"
+]);
+var PROJECT_DATABASE_KEYS = new Set([
+  "host",
+  "version",
+  "postgres_engine",
+  "release_channel"
+]);
+var PROJECT_ENDPOINT_KEYS = new Set(["url"]);
+function plainRecord(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const prototype = Object.getPrototypeOf(candidate);
+  return prototype === Object.prototype || prototype === null ? candidate : null;
+}
+function hasOnlyKeys(record, allowedKeys) {
+  return Object.keys(record).every((key) => allowedKeys.has(key));
+}
+function hasWellFormedUnicode(text) {
+  for (let index = 0;index < text.length; index++) {
+    const codeUnit = text.charCodeAt(index);
+    if (codeUnit >= 55296 && codeUnit <= 56319) {
+      if (index + 1 >= text.length)
+        return false;
+      const lowSurrogate = text.charCodeAt(index + 1);
+      if (lowSurrogate < 56320 || lowSurrogate > 57343)
+        return false;
+      index++;
+    } else if (codeUnit >= 56320 && codeUnit <= 57343) {
+      return false;
+    }
+  }
+  return true;
+}
+function boundedText(candidate, maxLength) {
+  return typeof candidate === "string" && candidate.length > 0 && candidate.length <= maxLength && !/[\u0000-\u001f\u007f]/u.test(candidate) && hasWellFormedUnicode(candidate) ? candidate : null;
+}
+function matchingText(candidate, maxLength, pattern) {
+  const candidateText = boundedText(candidate, maxLength);
+  return candidateText && pattern.test(candidateText) ? candidateText : null;
+}
+function canonicalTimestamp(candidate) {
+  const timestamp = boundedText(candidate, 64);
+  if (!timestamp)
+    return null;
+  const milliseconds = Date.parse(timestamp);
+  return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === timestamp ? timestamp : null;
+}
+function projectedSummary(project) {
+  const summary = {
+    id: matchingText(project.id, 128, SAFE_IDENTIFIER_PATTERN),
+    ref: matchingText(project.ref, 20, PROJECT_REF_PATTERN3),
+    organization_id: matchingText(project.organization_id, 128, SAFE_IDENTIFIER_PATTERN),
+    organization_slug: matchingText(project.organization_slug, 128, SAFE_IDENTIFIER_PATTERN),
+    name: boundedText(project.name, 100),
+    region: matchingText(project.region, 64, REGION_PATTERN),
+    created_at: canonicalTimestamp(project.created_at),
+    status: matchingText(project.status, 64, STATUS_PATTERN)
+  };
+  return Object.values(summary).every((field) => field !== null) ? summary : null;
+}
+function databaseHost(candidate) {
+  const host = boundedText(candidate, 255);
+  if (!host)
+    return null;
+  if (host.startsWith("[") && host.endsWith("]")) {
+    try {
+      const parsedHost = new URL(`http://${host}`);
+      return parsedHost.host === host ? host : null;
+    } catch (error) {
+      if (error instanceof TypeError)
+        return null;
+      throw error;
+    }
+  }
+  const ipv4Parts = host.split(".");
+  if (ipv4Parts.length === 4 && ipv4Parts.every((part) => /^\d{1,3}$/u.test(part))) {
+    return ipv4Parts.every((part) => Number(part) <= 255) ? host : null;
+  }
+  return ipv4Parts.every((label) => DNS_LABEL_PATTERN.test(label)) ? host : null;
+}
+function projectDatabase(candidate) {
+  const database = plainRecord(candidate);
+  if (!database || !hasOnlyKeys(database, PROJECT_DATABASE_KEYS))
+    return null;
+  const host = databaseHost(database.host);
+  const version = matchingText(database.version, 64, DATABASE_VERSION_PATTERN);
+  const postgresEngine = matchingText(database.postgres_engine, 64, DATABASE_VERSION_PATTERN);
+  const releaseChannel = matchingText(database.release_channel, 64, DATABASE_VERSION_PATTERN);
+  return host && version && postgresEngine && releaseChannel ? { host, version, postgres_engine: postgresEngine, release_channel: releaseChannel } : null;
+}
+function rawUrlHasNoPath(candidate) {
+  if (candidate.trim() !== candidate || candidate.includes("\\"))
+    return false;
+  const schemeEnd = candidate.indexOf("://");
+  const pathStart = candidate.indexOf("/", schemeEnd + 3);
+  return pathStart === -1;
+}
+function projectEndpoint(candidate) {
+  const endpoint = plainRecord(candidate);
+  if (!endpoint || !hasOnlyKeys(endpoint, PROJECT_ENDPOINT_KEYS))
+    return null;
+  const endpointUrl = boundedText(endpoint.url, 2048);
+  if (!endpointUrl || !rawUrlHasNoPath(endpointUrl))
+    return null;
+  try {
+    const url = new URL(endpointUrl);
+    if (url.protocol !== "http:" && url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.pathname !== "/")
+      return null;
+    return { url: url.origin };
+  } catch (error) {
+    if (error instanceof TypeError)
+      return null;
+    throw error;
+  }
+}
+function discardedDetailFieldsAreValid(project) {
+  if (project.config !== undefined && plainRecord(project.config) === null)
+    return false;
+  if (project.anon_key !== undefined && boundedText(project.anon_key, 16384) === null)
+    return false;
+  return project.services === undefined || Array.isArray(project.services);
+}
+function projectDetails(candidate, expectedRef) {
+  const project = plainRecord(candidate);
+  if (!project || !hasOnlyKeys(project, PROJECT_DETAILS_KEYS))
+    return null;
+  const summary = projectedSummary(project);
+  const database = projectDatabase(project.database);
+  const api = project.api === undefined ? undefined : projectEndpoint(project.api);
+  const studio = project.studio === undefined ? undefined : projectEndpoint(project.studio);
+  if (!summary || summary.ref !== expectedRef || !database || !discardedDetailFieldsAreValid(project) || project.api !== undefined && !api || project.studio !== undefined && !studio)
+    return null;
+  return {
+    ...summary,
+    database,
+    ...api ? { api } : {},
+    ...studio ? { studio } : {}
+  };
+}
+function payloadWithinLimit(candidate) {
+  try {
+    const serializedPayload = JSON.stringify(candidate);
+    return serializedPayload !== undefined && new TextEncoder().encode(serializedPayload).byteLength <= PROJECT_READ_RESPONSE_MAX_BYTES;
+  } catch {
+    return false;
+  }
+}
+function validHttpStatus(status) {
+  return Number.isSafeInteger(status) && status >= 100 && status <= 599;
+}
+function successfulResponse(response) {
+  return response.ok === true && validHttpStatus(response.status) && response.status >= 200 && response.status <= 299;
+}
+function failedResult(message) {
+  return { text: `❌ ${message}`, isError: true };
+}
+function failedHttpResult(label, status) {
+  return failedResult(validHttpStatus(status) ? `${label} request failed (${status})` : `${label} request failed`);
+}
+function successfulResult(payload) {
+  return { text: JSON.stringify(payload, null, 2), isError: false };
+}
+function projectGetRead(response, expectedRef) {
+  if (!successfulResponse(response))
+    return failedHttpResult("Project get", response.status);
+  if (!payloadWithinLimit(response.data))
+    return failedResult("Invalid project response");
+  const project = projectDetails(response.data, expectedRef);
+  return project ? successfulResult(project) : failedResult("Invalid project response");
+}
+
 // src/shared/tools/project-cli-tools.ts
+function projectReadResponse(readResult) {
+  return {
+    content: [{ type: "text", text: readResult.text }],
+    ...readResult.isError ? { isError: true } : {}
+  };
+}
 var formatTasks = (data) => {
   if (!Array.isArray(data))
     return JSON.stringify(data, null, 2);
@@ -9551,8 +9973,9 @@ Actions: get, health, logs, api_keys, settings, tasks, task_detail, task_cancel,
     let text;
     switch (action) {
       case "get":
-        text = ok(await http.get(`/v1/projects/${resolvedRef}`));
-        break;
+        return projectReadResponse(projectGetRead(await http.get(`/v1/projects/${resolvedRef}`, {
+          maxResponseBytes: PROJECT_READ_RESPONSE_MAX_BYTES
+        }), resolvedRef));
       case "health":
         text = ok(await http.get(`/v1/projects/${resolvedRef}/health`));
         break;
@@ -10973,7 +11396,7 @@ var FORBIDDEN_HEADER_NAMES = new Set([
   "x-project-ref"
 ]);
 var SCHEDULE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-var SAFE_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+var SAFE_SLUG_PATTERN2 = /^[A-Za-z0-9_-]{1,128}$/;
 var CRON_PART_PATTERN = /^(\*|([0-9]+)(?:-([0-9]+))?)(?:\/([0-9]+))?$/;
 var CRON_FIELD_BOUNDS = [[0, 59], [0, 23], [1, 31], [1, 12], [0, 7]];
 var MAX_CRON_EXPRESSION_LENGTH = 256;
@@ -11002,7 +11425,7 @@ function parseHeaderEnvironment(input) {
   }
 }
 var headerEnvironmentSchema = Type.Optional(decodedSchema(Type.Union([Type.String(), headerEnvironmentRecord]), headerEnvironmentRecord, parseHeaderEnvironment));
-function objectRecord2(candidate) {
+function objectRecord3(candidate) {
   return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
 }
 function boundedCronInteger(input, minimum, maximum) {
@@ -11047,7 +11470,7 @@ function readScheduleBodyFile(bodyPathInput) {
       throw error;
     throw new Error("Scheduled Function body file must contain exact JSON");
   }
-  const body = objectRecord2(payload);
+  const body = objectRecord3(payload);
   if (!body)
     throw new Error("Scheduled Function body file must contain a JSON object");
   return body;
@@ -11088,7 +11511,7 @@ function headerValueIsStable(name, value) {
 function scheduleHeaders(mapping, environment) {
   if (mapping === undefined)
     return;
-  const headerEnvironment = objectRecord2(mapping);
+  const headerEnvironment = objectRecord3(mapping);
   if (!headerEnvironment)
     throw new Error("'header_env' must be a JSON object");
   const entries = Object.entries(headerEnvironment).map(([headerName, environmentName]) => resolvedHeaderEntry(headerName, environmentName, environment));
@@ -11102,7 +11525,7 @@ function validSafeSchedule(schedule) {
   return validScheduleIdentity(schedule) && validScheduleDefinition(schedule) && validScheduleMetadata(schedule);
 }
 function validScheduleIdentity(schedule) {
-  return typeof schedule.id === "string" && SCHEDULE_ID_PATTERN.test(schedule.id) && typeof schedule.name === "string" && schedule.name.trim().length > 0 && schedule.name.length <= MAX_SCHEDULE_NAME_LENGTH && typeof schedule.slug === "string" && SAFE_SLUG_PATTERN.test(schedule.slug);
+  return typeof schedule.id === "string" && SCHEDULE_ID_PATTERN.test(schedule.id) && typeof schedule.name === "string" && schedule.name.trim().length > 0 && schedule.name.length <= MAX_SCHEDULE_NAME_LENGTH && typeof schedule.slug === "string" && SAFE_SLUG_PATTERN2.test(schedule.slug);
 }
 function validScheduleDefinition(schedule) {
   return typeof schedule.cron === "string" && validScheduledFunctionCron(schedule.cron) && (schedule.method === "GET" || schedule.method === "POST") && typeof schedule.enabled === "boolean";
@@ -11130,7 +11553,7 @@ function safeHeaderNames(candidate) {
   return valid && new Set(names).size === names.length ? names.sort() : null;
 }
 function safeSchedule(candidate) {
-  const schedule = objectRecord2(candidate);
+  const schedule = objectRecord3(candidate);
   if (!schedule || !validSafeSchedule(schedule))
     return null;
   const safePayload = safeSchedulePayload(schedule);
@@ -11176,7 +11599,7 @@ function listResponse(ref, response) {
   const operation = "scheduled_functions.list";
   if (!response.ok)
     return scheduleFailure(operation, response);
-  const payload = objectRecord2(response.data);
+  const payload = objectRecord3(response.data);
   const rawSchedules = payload?.schedules;
   const schedules = Array.isArray(rawSchedules) ? rawSchedules.map(safeSchedule) : null;
   if (payload?.project_ref !== ref || !schedules || schedules.some((schedule) => !schedule)) {
@@ -11191,7 +11614,7 @@ function getResponse(ref, scheduleId, response) {
   const operation = "scheduled_functions.get";
   if (!response.ok)
     return scheduleFailure(operation, response);
-  const payload = objectRecord2(response.data);
+  const payload = objectRecord3(response.data);
   const schedule = safeSchedule(payload?.schedule);
   if (payload?.project_ref !== ref || !schedule || schedule.id !== scheduleId) {
     return releaseControlFailure(operation, "INVALID_RESPONSE", null);
@@ -11204,7 +11627,7 @@ function mutationResponse(expectation, response) {
   const operation = `scheduled_functions.${action}`;
   if (!response.ok)
     return releaseControlMutationFailure(operation, response);
-  const payload = objectRecord2(response.data);
+  const payload = objectRecord3(response.data);
   const schedule = safeSchedule(payload?.schedule);
   const confirmsRequest = schedule && Object.entries(expectedFields).every(([field, expected]) => isDeepStrictEqual(schedule[field], expected));
   const confirmsRevision = action === "create" || payload?.previous_updated_at === expectation.expectedUpdatedAt && schedule !== null && schedule.updated_at > expectation.expectedUpdatedAt;
@@ -11222,7 +11645,7 @@ function deleteResponse(ref, scheduleId, expectedUpdatedAt, response) {
   const operation = "scheduled_functions.delete";
   if (!response.ok)
     return releaseControlMutationFailure(operation, response);
-  const payload = objectRecord2(response.data);
+  const payload = objectRecord3(response.data);
   if (payload?.deleted !== true || payload.project_ref !== ref || payload.schedule_id !== scheduleId || payload.deleted_updated_at !== expectedUpdatedAt) {
     return releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.status);
   }
@@ -11268,7 +11691,7 @@ function requiredName(args, action) {
 }
 function requiredSlug(args, action) {
   const slug = requiredText2(args, "slug", action);
-  if (!SAFE_SLUG_PATTERN.test(slug))
+  if (!SAFE_SLUG_PATTERN2.test(slug))
     throw new Error(`'slug' is invalid for '${action}'`);
   return slug;
 }
@@ -11366,11 +11789,14 @@ var SCHEDULE_TOOL_SCHEMA = {
 var MUTATION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/;
 var OPERATION_PATTERN = /^[a-z0-9][a-z0-9._:-]{0,127}$/;
-var RESOURCE_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,254}$/;
+var RESOURCE_KEY_PATTERN = /^v1\/(?:[a-z0-9][a-z0-9._-]{0,63})\/([A-Za-z0-9_-]{2,171})$/;
+var RESOURCE_ID_CONTROL_PATTERN = /[\u0000-\u001f\u007f-\u009f]/u;
 var FAILURE_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
 var LEASE_OWNER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,254}$/;
 var TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
 var MAX_STATUS_RESPONSE_BYTES = 196608;
+var MAX_RESOURCE_ID_BYTES = 128;
+var FATAL_UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
 var MUTATION_STATUSES = new Set([
   "pending",
   "running",
@@ -11402,27 +11828,27 @@ var LEASE_KEYS = ["owner", "expires_at", "fencing_epoch"];
 function isMutationId(candidate) {
   return typeof candidate === "string" && MUTATION_ID_PATTERN.test(candidate);
 }
-function objectRecord3(candidate) {
+function objectRecord4(candidate) {
   return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
 }
 function exactRecord(candidate, keys) {
-  const record = objectRecord3(candidate);
+  const record = objectRecord4(candidate);
   if (!record || Object.keys(record).length !== keys.length)
     return null;
   return keys.every((key) => Object.hasOwn(record, key)) ? record : null;
 }
 function emptyProjection(candidate) {
-  const record = objectRecord3(candidate);
+  const record = objectRecord4(candidate);
   return record && Object.keys(record).length === 0 ? record : null;
 }
-function canonicalTimestamp(candidate) {
+function canonicalTimestamp2(candidate) {
   if (typeof candidate !== "string" || !TIMESTAMP_PATTERN.test(candidate))
     return false;
   const milliseconds = Date.parse(candidate);
   return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === candidate;
 }
 function nullableTimestamp(candidate) {
-  return candidate === null || canonicalTimestamp(candidate);
+  return candidate === null || canonicalTimestamp2(candidate);
 }
 function safePrincipal(candidate) {
   const principal = exactRecord(candidate, PRINCIPAL_KEYS);
@@ -11471,12 +11897,32 @@ function validMutationLifecycle(mutation, receipt, responseStatus) {
   }
   return true;
 }
+function canonicalMutationResourceKey(candidate) {
+  if (typeof candidate !== "string")
+    return false;
+  const match = RESOURCE_KEY_PATTERN.exec(candidate);
+  if (!match)
+    return false;
+  const encodedResourceId = match[1];
+  const resourceIdBytes = Buffer.from(encodedResourceId, "base64url");
+  if (resourceIdBytes.byteLength < 1 || resourceIdBytes.byteLength > MAX_RESOURCE_ID_BYTES || resourceIdBytes.toString("base64url") !== encodedResourceId)
+    return false;
+  let resourceId;
+  try {
+    resourceId = FATAL_UTF8_DECODER.decode(resourceIdBytes);
+  } catch (decodeError) {
+    if (decodeError instanceof TypeError)
+      return false;
+    throw decodeError;
+  }
+  return resourceId.trim() === resourceId && !RESOURCE_ID_CONTROL_PATTERN.test(resourceId) && Buffer.from(resourceId, "utf8").equals(resourceIdBytes);
+}
 function validMutationIdentity(mutation) {
   if (!isMutationId(mutation.mutation_id) || typeof mutation.project_ref !== "string")
     return false;
   if (typeof mutation.operation !== "string" || !OPERATION_PATTERN.test(mutation.operation))
     return false;
-  if (mutation.resource_key !== null && (typeof mutation.resource_key !== "string" || !RESOURCE_KEY_PATTERN.test(mutation.resource_key)))
+  if (mutation.resource_key !== null && !canonicalMutationResourceKey(mutation.resource_key))
     return false;
   return typeof mutation.request_fingerprint === "string" && FINGERPRINT_PATTERN.test(mutation.request_fingerprint);
 }
@@ -11485,7 +11931,7 @@ function validMutationTerminalFields(mutation) {
     return false;
   if (mutation.failure_code !== null && (typeof mutation.failure_code !== "string" || !FAILURE_CODE_PATTERN.test(mutation.failure_code)))
     return false;
-  return nullableTimestamp(mutation.completed_at) && canonicalTimestamp(mutation.created_at) && canonicalTimestamp(mutation.updated_at);
+  return nullableTimestamp(mutation.completed_at) && canonicalTimestamp2(mutation.created_at) && canonicalTimestamp2(mutation.updated_at);
 }
 function safeMutationStatus(candidate) {
   const mutation = exactRecord(candidate, MUTATION_KEYS);
@@ -11557,6 +12003,12 @@ async function mutationStatus(http, args) {
   if (readback.kind === "invalid") {
     return releaseControlFailure("mutations.status", "INVALID_RESPONSE", null);
   }
+  if (readback.mutation.status !== "succeeded") {
+    return releaseControlFailure("mutations.status", "MUTATION_NOT_SUCCEEDED", null, {
+      project_ref: ref,
+      mutation: readback.mutation
+    });
+  }
   return releaseControlSuccess("mutations.status", { project_ref: ref, mutation: readback.mutation });
 }
 function registerMutationTools(server, http) {
@@ -11570,7 +12022,7 @@ var MUTATION_TOOL_SCHEMA = {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.19.0",
+  version: "0.21.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -11830,12 +12282,14 @@ EXAMPLES
   ${preferredCommand} branch promote --branch_ref preview123 --plan_checksum <sha256>
   ${preferredCommand} ai show_skill
   ${preferredCommand} ai install_skill --dry_run
-  ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello --expected-active-version absent
-  ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --prebundled-path ./dist/hello.js --expected-sha256 <sha256> --expected-active-version 4
-  ${preferredCommand} edge_functions activate --ref abc123 --slug hello --version 3 --expected-active-version 4
+  ${preferredCommand} edge_functions get_config --ref abc123 --slug hello
+  ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello --expected-active-version absent --expected-activation-id legacy
+  ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --prebundled-path ./dist/hello.js --expected-sha256 <sha256> --expected-active-version 4 --expected-activation-id <uuid>
+  ${preferredCommand} edge_functions activate --ref abc123 --slug hello --version 3 --expected-active-version 4 --expected-activation-id <uuid>
   ${preferredCommand} scheduled_functions list --ref abc123
   ${preferredCommand} mutations status --ref abc123 --mutation_id 00000000-0000-4000-8000-000000000001
-  ${preferredCommand} edge_functions config --ref abc123 --slug hello --verify_jwt false --background_routes "/queue/*,/render/*"
+  ${preferredCommand} edge_functions config --ref abc123 --slug hello --verify_jwt false --background_routes "/queue/*,/render/*" --expected-activation-id <uuid>
+  ${preferredCommand} edge_functions delete --ref abc123 --slug hello --expected-activation-id <uuid>
   ${preferredCommand} secrets upsert --ref abc123 --from-env API_KEY,WEBHOOK_SECRET
   ${preferredCommand} gateway routes --ref abc123
   ${preferredCommand} gateway upsert_route --ref abc123 --route_id webhook --hosts "api.example.com" --paths "/webhook/*" --upstream 10.0.0.5:8080

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",

package/skills/supacloud-cli/references/command-map.md

@@ -31,7 +31,7 @@ until a project-scoped context is resolved.
 - `supabase`: allowlisted official CLI adapter for migration authoring, local reset/diff, explicit-DSN inspection/backup/type generation, and SupaCloud-controlled migration push.
 - `auth`: provider and authentication configuration.
 - `storage`: buckets and object-management workflows.
-- `edge_functions`: list, read immutable source, deploy, activate, and configure Edge Functions. Pass the non-negative version read from `list` as `--expected-active-version`; use `absent` only for a new slug. Version `0` is a legacy CAS token and cannot be used as a source or activation target.
+- `edge_functions`: list, atomically read one active or deleted identity with `get_config`, read immutable source, deploy, activate, configure, and delete Edge Functions. For every mutation, pass the `activation_id` read from the same `list` or `get_config` snapshot as `--expected-activation-id`; use `legacy` only for a never-created or listed legacy Function, not for a deleted slug with a tombstone UUID. Deploy and activate actions also require the non-negative observed version as `--expected-active-version`; use `absent` for a never-created slug or a `get_config` tombstone. Version `0` is a legacy version token and cannot be used as a source or activation target.
 - `frontend`: list, build/deploy, domain, and deployment workflows.
 - `secrets`: project secret management; never print values after write.
 - `queue`, `task_events`, `diagnostics`: asynchronous workload operations and bounded diagnostics.