@supacloud/cli 0.20.0 → 0.21.1

package/README.md

@@ -161,11 +161,13 @@ supacloud-cli frontend list --ref abc123
 supacloud-cli branch create --name feature-orders --data_mode schema_only
 supacloud-cli branch promotion_plan --branch_ref preview123
 supacloud-cli branch promote --branch_ref preview123 --plan_checksum <sha256>
-supacloud-cli edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello --expected-active-version absent
-supacloud-cli edge_functions deploy --ref abc123 --slug hello --prebundled-path ./dist/hello.js --expected-sha256 <sha256> --expected-active-version 4
-supacloud-cli edge_functions deploy_bundle --ref abc123 --slug hello --files '{"index.ts":"export default { fetch: () => new Response(\"ok\") }"}' --expected-active-version 7
+supacloud-cli edge_functions get_config --ref abc123 --slug hello
+supacloud-cli edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello --expected-active-version absent --expected-activation-id legacy
+supacloud-cli edge_functions deploy --ref abc123 --slug hello --prebundled-path ./dist/hello.js --expected-sha256 <sha256> --expected-active-version 4 --expected-activation-id <uuid>
+supacloud-cli edge_functions deploy_bundle --ref abc123 --slug hello --files '{"index.ts":"export default { fetch: () => new Response(\"ok\") }"}' --expected-active-version 7 --expected-activation-id <uuid>
 supacloud-cli edge_functions source --ref abc123 --slug hello --version 7 --output ./hello-v7.ts
-supacloud-cli edge_functions activate --ref abc123 --slug hello --version 3 --expected-active-version 8
+supacloud-cli edge_functions activate --ref abc123 --slug hello --version 3 --expected-active-version 8 --expected-activation-id <uuid>
+supacloud-cli edge_functions delete --ref abc123 --slug hello --expected-activation-id <uuid>
 supacloud-cli scheduled_functions list --ref abc123
 supacloud-cli secrets upsert --ref abc123 --from-env API_KEY,WEBHOOK_SECRET
 supacloud-cli storage list_buckets --ref abc123
@@ -221,10 +223,17 @@ pointer; this remains correct across an active-version A→B→A transition.
 `--expected-active-version <N|absent>`. Read the current non-negative integer
 version from `edge_functions list`; use `0` for a listed legacy Function and
 `absent` only when creating a slug that does not yet exist. A stale value returns
-HTTP 409 without building, preheating, or activating another version. List output remains a JSON array with string
-`slug` and numeric `version` fields, while source output is exactly
-`{ "code": "..." }`. Release automation must use `source --version <N>` for a
-version-bound backup.
+HTTP 409 without building, preheating, or activating another version. Every
+Function mutation also requires `--expected-activation-id <uuid|legacy>` from
+the same `list` or `get_config` snapshot. Use `get_config` for a single atomic
+read of `active_version`, `activation_id`, and policy, including an `absent`
+tombstone after deletion. Use `legacy` only for a never-created slug or a listed
+legacy Function; recreating a deleted slug must use the tombstone UUID returned
+by `delete` or `get_config`. This second token prevents an A→B→A version cycle
+from satisfying a stale mutation. List output remains a JSON array with string
+`slug`, numeric `version`, and canonical `activation_id` fields, while source
+output is exactly `{ "code": "..." }`. Release automation must use
+`source --version <N>` for a version-bound backup.
 
 `edge_functions activate` restores an existing immutable Function version and
 returns a machine-readable receipt containing the activated version and JWT
@@ -234,10 +243,10 @@ server response body.
 Mutation receipts use schema `supacloud.cli.release-control.v1`. An
 `OUTCOME_UNKNOWN` error means the server may have committed the mutation before
 the response was lost or failed validation; read back current state before any
-retry. For Function deploy, bundle deploy, and activation, the CLI applies a
-separate 5-second, 64 KiB response-body boundary after receiving HTTP headers.
-A stalled, oversized, truncated, unreadable, or malformed body is always
-`OUTCOME_UNKNOWN` and its content is never included in CLI output.
+retry. For Function deploy, bundle deploy, activation, config, and delete, the
+CLI applies a separate 5-second, 64 KiB response-body boundary after receiving
+HTTP headers. A stalled, oversized, truncated, unreadable, or malformed body is
+always `OUTCOME_UNKNOWN` and its content is never included in CLI output.
 Version `0` is reserved as the active-version CAS token for legacy Functions. It
 can be passed only as `--expected-active-version`; immutable source reads and
 activation targets still require a positive version.
@@ -250,6 +259,8 @@ activation targets still require a positive version.
   "project_ref": "abc123",
   "slug": "hello",
   "previous_active_version": "7",
+  "expected_activation_id": "9dc0e8da-207f-4f25-ae74-b1de4e66784d",
+  "activation_id": "6417591d-c038-46e8-91ca-4c8080514144",
   "active_version": "8",
   "version": "8",
   "verify_jwt": true

package/dist/index.js

@@ -6478,7 +6478,7 @@ var ACTION_POLICY = {
     write: ["create_bucket", "update_bucket", "delete_bucket", "upload_base64", "delete_file"]
   },
   edge_functions: {
-    read: ["list", "source"],
+    read: ["list", "get_config", "source"],
     local: ["check"],
     write: ["deploy", "deploy_bundle", "config", "activate", "delete"]
   },
@@ -6782,10 +6782,10 @@ class HttpTransport {
       "Content-Type": "application/json"
     };
   }
-  async postWithResponseReader(path, serializedBody, responseReader) {
+  async mutationWithResponseReader(method, path, serializedBody, responseReader) {
     try {
       const response = await fetchWithRetry(`${this.baseUrl}${path}`, {
-        method: "POST",
+        method,
         headers: this.headers(),
         body: serializedBody
       });
@@ -6810,13 +6810,19 @@ class HttpTransport {
   }
   async post(path, body) {
     try {
-      return await this.postWithResponseReader(path, serializedRequestBody(body), responseJsonOrNull);
+      return await this.mutationWithResponseReader("POST", path, serializedRequestBody(body), responseJsonOrNull);
     } catch (error) {
       return transportFailure(error);
     }
   }
   async postReleaseMutation(path, body) {
-    return this.postWithResponseReader(path, serializedRequestBody(body), releaseMutationResponseJson);
+    return this.mutationWithResponseReader("POST", path, serializedRequestBody(body), releaseMutationResponseJson);
+  }
+  async patchReleaseMutation(path, body) {
+    return this.mutationWithResponseReader("PATCH", path, serializedRequestBody(body), releaseMutationResponseJson);
+  }
+  async deleteReleaseMutation(path, body) {
+    return this.mutationWithResponseReader("DELETE", path, serializedRequestBody(body), releaseMutationResponseJson);
   }
   async postMultipart(path, formData) {
     try {
@@ -6858,11 +6864,12 @@ class HttpTransport {
       return transportFailure(error);
     }
   }
-  async delete(path) {
+  async delete(path, body) {
     try {
       const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
         method: "DELETE",
-        headers: this.headers()
+        headers: this.headers(),
+        body: serializedRequestBody(body)
       });
       const data = await res.json().catch(() => null);
       return { ok: res.ok, status: res.status, data };
@@ -8436,6 +8443,155 @@ import { tmpdir } from "node:os";
 import { basename as basename2, join as join2, resolve as resolve2 } from "node:path";
 import { promisify } from "node:util";
 import { execFile } from "node:child_process";
+
+// src/shared/tools/edge-function-response.ts
+var CANONICAL_VERSION_PATTERN = /^(?:0|[1-9][0-9]*)$/;
+var SAFE_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+var ACTIVATION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var LEGACY_ACTIVATION_ID = "legacy";
+var LIST_STRING_FIELDS = [
+  "id",
+  "name",
+  "status",
+  "entrypoint_path",
+  "created_at",
+  "updated_at"
+];
+var LIST_BOOLEAN_FIELDS = ["verify_jwt", "import_map"];
+function objectRecord(candidate) {
+  return candidate !== null && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
+}
+function canonicalVersion(candidate) {
+  return typeof candidate === "string" && CANONICAL_VERSION_PATTERN.test(candidate) && Number.isSafeInteger(Number(candidate));
+}
+function stringRoutes(candidate) {
+  return Array.isArray(candidate) && candidate.every((route) => typeof route === "string");
+}
+function optionalTypedFields(source, fields, expectedType) {
+  return fields.every((field) => source[field] === undefined || typeof source[field] === expectedType);
+}
+function validObservedFunctionActivationId(candidate) {
+  return candidate === LEGACY_ACTIVATION_ID || typeof candidate === "string" && ACTIVATION_ID_PATTERN.test(candidate);
+}
+function validCommittedFunctionActivationId(candidate) {
+  return typeof candidate === "string" && ACTIVATION_ID_PATTERN.test(candidate);
+}
+function projectedFunctionListEntry(candidate) {
+  const functionRecord = objectRecord(candidate);
+  if (!functionRecord || typeof functionRecord.slug !== "string" || !SAFE_SLUG_PATTERN.test(functionRecord.slug) || typeof functionRecord.version !== "number" || !Number.isSafeInteger(functionRecord.version) || functionRecord.version < 0 || !validObservedFunctionActivationId(functionRecord.activation_id) || !optionalTypedFields(functionRecord, LIST_STRING_FIELDS, "string") || !optionalTypedFields(functionRecord, LIST_BOOLEAN_FIELDS, "boolean") || functionRecord.background_routes !== undefined && !stringRoutes(functionRecord.background_routes))
+    return null;
+  const projected = {
+    slug: functionRecord.slug,
+    version: functionRecord.version,
+    activation_id: functionRecord.activation_id
+  };
+  for (const field of [...LIST_STRING_FIELDS, ...LIST_BOOLEAN_FIELDS]) {
+    if (functionRecord[field] !== undefined)
+      projected[field] = functionRecord[field];
+  }
+  if (functionRecord.background_routes !== undefined) {
+    projected.background_routes = functionRecord.background_routes;
+  }
+  return projected;
+}
+function projectedFunctionList(payload) {
+  if (!Array.isArray(payload))
+    return null;
+  const slugs = new Set;
+  const projected = [];
+  for (const candidate of payload) {
+    const functionRecord = projectedFunctionListEntry(candidate);
+    if (!functionRecord)
+      return null;
+    const slug = functionRecord.slug;
+    if (typeof slug !== "string" || slugs.has(slug))
+      return null;
+    slugs.add(slug);
+    projected.push(functionRecord);
+  }
+  return projected;
+}
+function optionalConfigFields(response) {
+  if (response.version !== undefined && !canonicalVersion(response.version))
+    return null;
+  if (response.import_map !== undefined && typeof response.import_map !== "string")
+    return null;
+  if (response.entrypoint !== undefined && typeof response.entrypoint !== "string")
+    return null;
+  return {
+    ...response.version === undefined ? {} : { version: response.version },
+    ...response.import_map === undefined ? {} : { import_map: response.import_map },
+    ...response.entrypoint === undefined ? {} : { entrypoint: response.entrypoint }
+  };
+}
+function coherentFunctionVersion(activeVersion, version) {
+  if (activeVersion === "absent")
+    return version === undefined;
+  if (activeVersion === "0")
+    return version === undefined || version === "0";
+  return version === activeVersion;
+}
+function projectedFunctionIdentity(payload, expectedProjectRef, expectedSlug) {
+  const response = objectRecord(payload);
+  if (!response || response.project_ref !== expectedProjectRef || response.slug !== expectedSlug || response.active_version !== "absent" && !canonicalVersion(response.active_version) || !validObservedFunctionActivationId(response.activation_id) || typeof response.verify_jwt !== "boolean" || !stringRoutes(response.background_routes))
+    return null;
+  const optionalFields = optionalConfigFields(response);
+  if (!optionalFields || !coherentFunctionVersion(response.active_version, optionalFields.version))
+    return null;
+  return {
+    project_ref: expectedProjectRef,
+    slug: expectedSlug,
+    active_version: response.active_version,
+    verify_jwt: response.verify_jwt,
+    background_routes: response.background_routes,
+    ...optionalFields,
+    activation_id: response.activation_id
+  };
+}
+function mutationIdentityMatches(response, expectation) {
+  return response.success === true && response.project_ref === expectation.projectRef && response.slug === expectation.slug && response.expected_activation_id === expectation.expectedActivationId && validCommittedFunctionActivationId(response.activation_id) && response.activation_id !== expectation.expectedActivationId;
+}
+function configMatchesExpectation(response, expected) {
+  if (typeof response.verify_jwt !== "boolean" || !stringRoutes(response.background_routes)) {
+    return false;
+  }
+  if (expected.verify_jwt !== undefined && response.verify_jwt !== expected.verify_jwt)
+    return false;
+  return expected.background_routes === undefined || JSON.stringify(response.background_routes) === JSON.stringify(expected.background_routes);
+}
+function confirmedFunctionConfigMutation(payload, expectation) {
+  const response = objectRecord(payload);
+  if (!response || !mutationIdentityMatches(response, expectation) || !configMatchesExpectation(response, expectation.config))
+    return null;
+  const optionalFields = optionalConfigFields(response);
+  if (!optionalFields)
+    return null;
+  return {
+    project_ref: expectation.projectRef,
+    slug: expectation.slug,
+    expected_activation_id: expectation.expectedActivationId,
+    activation_id: response.activation_id,
+    verify_jwt: response.verify_jwt,
+    background_routes: response.background_routes,
+    ...optionalFields
+  };
+}
+function confirmedFunctionDeletion(payload, expectation) {
+  const response = objectRecord(payload);
+  const config = objectRecord(response?.config);
+  if (!response || !config || !mutationIdentityMatches(response, expectation) || response.previous_active_version !== "absent" && !canonicalVersion(response.previous_active_version) || response.active_version !== "absent" || config.version !== undefined || config.activation_id !== response.activation_id || typeof config.verify_jwt !== "boolean")
+    return null;
+  return {
+    project_ref: expectation.projectRef,
+    slug: expectation.slug,
+    expected_activation_id: expectation.expectedActivationId,
+    activation_id: response.activation_id,
+    previous_active_version: response.previous_active_version,
+    active_version: "absent"
+  };
+}
+
+// src/shared/tools/advanced-tools.ts
 var execFileAsync = promisify(execFile);
 var SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/;
 function openFileIdentity(descriptor) {
@@ -8633,12 +8789,22 @@ function activeFunctionVersionToken(input) {
 var CANONICAL_FUNCTION_VERSION_PATTERN = /^(?:0|[1-9][0-9]*)$/;
 var POSITIVE_FUNCTION_VERSION_PATTERN = /^[1-9][0-9]*$/;
 var SAFE_FUNCTION_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+var FUNCTION_ACTIVATION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var LEGACY_FUNCTION_ACTIVATION_ID = "legacy";
 var FUNCTION_ACTIVATION_ARGUMENTS = new Set([
   "action",
   "ref",
   "slug",
   "version",
-  "expected-active-version"
+  "expected-active-version",
+  "expected-activation-id"
+]);
+var FUNCTION_IDENTITY_MUTATIONS = new Set([
+  "deploy",
+  "deploy_bundle",
+  "config",
+  "activate",
+  "delete"
 ]);
 var functionVersionSchema = Type.Optional(decodedSchema(Type.Union([
   Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),
@@ -8657,6 +8823,10 @@ var expectedActiveVersionSchema = Type.Optional(decodedSchema(Type.Union([
   Type.Literal("absent"),
   Type.String({ pattern: CANONICAL_FUNCTION_VERSION_PATTERN.source, maxLength: 16 })
 ]), parseExpectedActiveVersion));
+var expectedActivationIdSchema = Type.Optional(Type.Union([
+  Type.Literal(LEGACY_FUNCTION_ACTIVATION_ID),
+  Type.String({ pattern: FUNCTION_ACTIVATION_ID_PATTERN.source, minLength: 36, maxLength: 36 })
+]));
 var secretListSchema = Type.Array(Type.Object({ name: Type.String(), value: Type.String() }));
 var ENVIRONMENT_SECRET_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
 var MAX_SECRET_COUNT = 1024;
@@ -8779,28 +8949,14 @@ var INVALID_FUNCTION_SOURCE_RESPONSE = "❌ Edge Function source response is inv
 function invalidFunctionReadResponse(message) {
   return { isError: true, content: [{ type: "text", text: message }] };
 }
-function safeFunctionList(payload) {
-  if (!Array.isArray(payload))
-    return null;
-  const functionSlugs = new Set;
-  for (const candidate of payload) {
-    const edgeFunction = objectRecord(candidate);
-    const slug = edgeFunction?.slug;
-    const version = edgeFunction?.version;
-    if (typeof slug !== "string" || !SAFE_FUNCTION_SLUG_PATTERN.test(slug) || typeof version !== "number" || !Number.isSafeInteger(version) || version < 0 || functionSlugs.has(slug))
-      return null;
-    functionSlugs.add(slug);
-  }
-  return payload;
-}
 function functionListResponse(response) {
   if (!response.ok)
     return invalidFunctionReadResponse(`❌ Failed (${response.status})`);
-  const functions = safeFunctionList(response.data);
+  const functions = projectedFunctionList(response.data);
   return functions ? { content: [{ type: "text", text: JSON.stringify(functions, null, 2) }] } : invalidFunctionReadResponse(INVALID_FUNCTION_LIST_RESPONSE);
 }
 function confirmedFunctionConfig(payload, expected) {
-  const response = objectRecord(payload);
+  const response = objectRecord2(payload);
   if (!response)
     return false;
   if (expected.verify_jwt !== undefined && response.verify_jwt !== expected.verify_jwt)
@@ -8835,7 +8991,7 @@ function functionSourceOutput(slug, sourceCode, output) {
     }]
   };
 }
-function objectRecord(candidate) {
+function objectRecord2(candidate) {
   return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
 }
 function edgeFunctionResourcePath(ref, slug) {
@@ -8857,8 +9013,31 @@ async function readFunctionSource(http, request) {
   const sourceCode = functionSourceCode(response.data, sourceVersion === undefined ? "code" : "source_code");
   return sourceCode === null ? invalidFunctionReadResponse(INVALID_FUNCTION_SOURCE_RESPONSE) : functionSourceOutput(request.slug, sourceCode, request.output);
 }
-function mutationIdentityMatches(receipt, expectation) {
-  return receipt.success === true && receipt.project_ref === expectation.projectRef && receipt.slug === expectation.slug && receipt.previous_active_version === expectation.expectedActiveVersion;
+function mutationIdentityMatches2(receipt, expectation) {
+  return receipt.success === true && receipt.project_ref === expectation.projectRef && receipt.slug === expectation.slug && receipt.previous_active_version === expectation.expectedActiveVersion && receipt.expected_activation_id === expectation.expectedActivationId;
+}
+async function readFunctionIdentity(http, projectRef, slug) {
+  const resourcePath = edgeFunctionResourcePath(projectRef, slug);
+  const response = await http.get(`${resourcePath}/config`);
+  if (!response.ok) {
+    return releaseControlFailure("edge_functions.get_config", "HTTP_ERROR", response.status);
+  }
+  const identity = projectedFunctionIdentity(response.data, projectRef, slug);
+  return identity ? { content: [{ type: "text", text: JSON.stringify(identity, null, 2) }] } : releaseControlFailure("edge_functions.get_config", "INVALID_RESPONSE", response.status);
+}
+async function updateFunctionConfiguration(http, request) {
+  const response = await http.patchReleaseMutation(`${edgeFunctionResourcePath(request.projectRef, request.slug)}/config`, { ...request.config, expected_activation_id: request.expectedActivationId });
+  if (!response.ok)
+    return releaseControlMutationFailure("edge_functions.config", response);
+  const confirmed = confirmedFunctionConfigMutation(response.data, request);
+  return confirmed ? releaseControlSuccess("edge_functions.config", confirmed) : releaseControlFailure("edge_functions.config", "OUTCOME_UNKNOWN", response.status);
+}
+async function deleteFunction(http, request) {
+  const response = await http.deleteReleaseMutation(edgeFunctionResourcePath(request.projectRef, request.slug), { expected_activation_id: request.expectedActivationId });
+  if (!response.ok)
+    return releaseControlMutationFailure("edge_functions.delete", response);
+  const confirmed = confirmedFunctionDeletion(response.data, request);
+  return confirmed ? releaseControlSuccess("edge_functions.delete", confirmed) : releaseControlFailure("edge_functions.delete", "OUTCOME_UNKNOWN", response.status);
 }
 function validReceiptVersion(activeVersion) {
   return typeof activeVersion === "string" && POSITIVE_FUNCTION_VERSION_PATTERN.test(activeVersion) && Number.isSafeInteger(Number(activeVersion));
@@ -8871,14 +9050,15 @@ function confirmedMutationVersion(receipt, config, expectation) {
   return activeVersion;
 }
 function confirmedFunctionMutation(expectation, payload) {
-  const receipt = objectRecord(payload);
-  const config = objectRecord(receipt?.config);
-  if (!receipt || !config || !mutationIdentityMatches(receipt, expectation))
+  const receipt = objectRecord2(payload);
+  const config = objectRecord2(receipt?.config);
+  if (!receipt || !config || !mutationIdentityMatches2(receipt, expectation))
     return null;
   const activeVersion = confirmedMutationVersion(receipt, config, expectation);
-  if (activeVersion === null || typeof config.verify_jwt !== "boolean" || !confirmedFunctionConfig(config, expectation.config ?? {}))
+  const activationId = receipt.activation_id;
+  if (activeVersion === null || !validCommittedFunctionActivationId(activationId) || config.activation_id !== activationId || typeof config.verify_jwt !== "boolean" || !confirmedFunctionConfig(config, expectation.config ?? {}))
     return null;
-  return { activeVersion, verifyJwt: config.verify_jwt };
+  return { activeVersion, activationId, verifyJwt: config.verify_jwt };
 }
 function functionMutationResponse(expectation, response) {
   if (!response.ok)
@@ -8891,6 +9071,8 @@ function functionMutationResponse(expectation, response) {
     project_ref: expectation.projectRef,
     slug: expectation.slug,
     previous_active_version: expectation.expectedActiveVersion,
+    expected_activation_id: expectation.expectedActivationId,
+    activation_id: confirmed.activationId,
     active_version: confirmed.activeVersion,
     version: confirmed.activeVersion,
     verify_jwt: confirmed.verifyJwt
@@ -8910,7 +9092,8 @@ function functionActivationTarget(args) {
   if (!SAFE_FUNCTION_SLUG_PATTERN.test(functionSlug))
     throw new Error("'slug' is invalid for 'activate'");
   const expectedActiveVersion = requiredExpectedActiveVersion(args, "activate");
-  return { projectRef, functionSlug, version, expectedActiveVersion };
+  const expectedActivationId = requiredExpectedActivationId(args, "activate");
+  return { projectRef, functionSlug, version, expectedActiveVersion, expectedActivationId };
 }
 function requiredExpectedActiveVersion(args, action) {
   const expected = args["expected-active-version"];
@@ -8922,28 +9105,42 @@ function requiredExpectedActiveVersion(args, action) {
     throw new Error("Expected active version is invalid");
   return parsed;
 }
+function requiredExpectedActivationId(args, action) {
+  const expected = args["expected-activation-id"];
+  if (expected === undefined) {
+    throw new Error(`'--expected-activation-id' required for '${action}'`);
+  }
+  if (!validObservedFunctionActivationId(expected)) {
+    throw new Error("Expected activation ID must be a canonical UUID or 'legacy'");
+  }
+  return expected;
+}
 async function activateFunctionVersion(http, args, readOnly = false) {
   if (readOnly)
     return readOnlyActivationResult();
   const unsupported = Object.keys(args).filter((name) => !FUNCTION_ACTIVATION_ARGUMENTS.has(name));
   if (unsupported.length > 0)
     throw new Error(`'${unsupported[0]}' is not supported for 'activate'`);
-  const { projectRef, functionSlug, version, expectedActiveVersion } = functionActivationTarget(args);
+  const { projectRef, functionSlug, version, expectedActiveVersion, expectedActivationId } = functionActivationTarget(args);
   const endpoint = edgeFunctionResourcePath(projectRef, functionSlug) + `/versions/${encodeURIComponent(version)}/activate`;
   return functionMutationResponse({
     operation: "edge_functions.activate",
     projectRef,
     slug: functionSlug,
     expectedActiveVersion,
+    expectedActivationId,
     targetVersion: version
-  }, await http.postReleaseMutation(endpoint, { expected_active_version: expectedActiveVersion }));
+  }, await http.postReleaseMutation(endpoint, {
+    expected_active_version: expectedActiveVersion,
+    expected_activation_id: expectedActivationId
+  }));
 }
 function registerAdvancedTools(server, http, environment = process.env, options = {}) {
   server.tool("edge_functions", `Edge Function management (Deno/Bun serverless). Source deploys are bundled; verified prebuilt artifacts stay byte-exact.
-Actions: list, deploy, deploy_bundle, config, source, activate, delete, check`, {
-    action: withDescription(stringEnum(["list", "deploy", "deploy_bundle", "config", "source", "activate", "delete", "check"]), "Action"),
+Actions: list, get_config, deploy, deploy_bundle, config, source, activate, delete, check`, {
+    action: withDescription(stringEnum(["list", "get_config", "deploy", "deploy_bundle", "config", "source", "activate", "delete", "check"]), "Action"),
     ref: withDescription(Type.String(), "Project ref"),
-    slug: optional(Type.String(), "[deploy/deploy_bundle/config/source/activate/delete/check] Function name"),
+    slug: optional(Type.String(), "[get_config/deploy/deploy_bundle/config/source/activate/delete/check] Function name"),
     version: withDescription(functionVersionSchema, "[source/activate] Existing immutable Function version; source requires a positive version"),
     code: optional(Type.String(), "[deploy/check] Function source code (TypeScript)"),
     path: optional(Type.String(), "[deploy/check] Local file path to read code from (alternative to code)"),
@@ -8955,13 +9152,15 @@ Actions: list, deploy, deploy_bundle, config, source, activate, delete, check`,
     minify: optional(Type.Boolean(), "[deploy/deploy_bundle] Minify bundle"),
     verify_jwt: optional(Type.Boolean(), "[deploy/deploy_bundle/config] Set JWT verification for this function"),
     background_routes: withDescription(backgroundRoutesSchema, "[deploy/deploy_bundle/config] Background route paths; pass comma-separated or JSON array in CLI"),
-    "expected-active-version": withDescription(expectedActiveVersionSchema, "[deploy/deploy_bundle/activate] Required current active version, or 'absent' when none exists")
+    "expected-active-version": withDescription(expectedActiveVersionSchema, "[deploy/deploy_bundle/activate] Required current active version, or 'absent' when none exists"),
+    "expected-activation-id": withDescription(expectedActivationIdSchema, "[deploy/deploy_bundle/config/activate/delete] Required activation ID from list, or 'legacy' for a new or legacy function")
   }, async (args) => {
     if (args.action === "activate")
       return activateFunctionVersion(http, args, options.readOnly);
     const { action, ref, slug, path: pathArg, output, files, entrypoint, minify, verify_jwt, background_routes } = args;
     rejectPrebundledFlagsOutsideDeploy(action, args);
     const expectedActiveVersion = action === "deploy" || action === "deploy_bundle" ? requiredExpectedActiveVersion(args, action) : undefined;
+    const expectedActivationId = FUNCTION_IDENTITY_MUTATIONS.has(action) ? requiredExpectedActivationId(args, action) : undefined;
     let code = args.code;
     const need = (f, v) => {
       if (!v)
@@ -8973,15 +9172,6 @@ Actions: list, deploy, deploy_bundle, config, source, activate, delete, check`,
       ...Array.isArray(background_routes) ? { background_routes } : {}
     });
     const hasFunctionConfig = () => Object.keys(functionConfig()).length > 0;
-    const updateFunctionConfig = async () => {
-      need("slug", slug);
-      if (!hasFunctionConfig()) {
-        throw new Error("'verify_jwt' or 'background_routes' required for 'config'");
-      }
-      const cr = await http.patch(`${edgeFunctionResourcePath(ref, slug)}/config`, functionConfig());
-      return cr.ok ? `✅ Function ${slug} config updated
-${JSON.stringify(cr.data, null, 2)}` : `❌ Config update failed (${cr.status}): ${JSON.stringify(cr.data)}`;
-    };
     const checkSyntax = async (sourceCode) => {
       const tmpDir = mkdtempSync(join2(tmpdir(), "supacloud-edge-check-"));
       const tmpFile = join2(tmpDir, "index.ts");
@@ -9007,6 +9197,9 @@ ${e.stderr || e.message}` };
     switch (action) {
       case "list":
         return functionListResponse(await http.get(edgeFunctionResourcePath(ref)));
+      case "get_config":
+        need("slug", slug);
+        return readFunctionIdentity(http, ref, slug);
       case "check":
         need("code (or path)", code);
         const checkRes = await checkSyntax(code);
@@ -9032,6 +9225,7 @@ ${deployCheck.err}`;
           code: deployCode.code,
           ...deployCode.prebundled ? { prebundled: true, expected_sha256: deployCode.expectedSha256 } : { minify },
           expected_active_version: expectedActiveVersion,
+          expected_activation_id: expectedActivationId,
           ...functionConfig()
         });
         return functionMutationResponse({
@@ -9039,6 +9233,7 @@ ${deployCheck.err}`;
           projectRef: ref,
           slug,
           expectedActiveVersion,
+          expectedActivationId,
           config: functionConfig()
         }, deploymentResponse);
       case "deploy_bundle":
@@ -9049,6 +9244,7 @@ ${deployCheck.err}`;
           entrypoint,
           minify,
           expected_active_version: expectedActiveVersion,
+          expected_activation_id: expectedActivationId,
           ...functionConfig()
         });
         return functionMutationResponse({
@@ -9056,11 +9252,20 @@ ${deployCheck.err}`;
           projectRef: ref,
           slug,
           expectedActiveVersion,
+          expectedActivationId,
           config: functionConfig()
         }, bundleResponse);
       case "config":
-        text = await updateFunctionConfig();
-        break;
+        need("slug", slug);
+        if (!hasFunctionConfig()) {
+          throw new Error("'verify_jwt' or 'background_routes' required for 'config'");
+        }
+        return updateFunctionConfiguration(http, {
+          projectRef: ref,
+          slug,
+          expectedActivationId,
+          config: functionConfig()
+        });
       case "source":
         need("slug", slug);
         return readFunctionSource(http, {
@@ -9071,8 +9276,11 @@ ${deployCheck.err}`;
         });
       case "delete":
         need("slug", slug);
-        text = (await http.delete(edgeFunctionResourcePath(ref, slug))).ok ? `✅ Function ${slug} deleted` : `❌ Failed`;
-        break;
+        return deleteFunction(http, {
+          projectRef: ref,
+          slug,
+          expectedActivationId
+        });
       default:
         text = `❌ Unknown action`;
     }
@@ -11188,7 +11396,7 @@ var FORBIDDEN_HEADER_NAMES = new Set([
   "x-project-ref"
 ]);
 var SCHEDULE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-var SAFE_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+var SAFE_SLUG_PATTERN2 = /^[A-Za-z0-9_-]{1,128}$/;
 var CRON_PART_PATTERN = /^(\*|([0-9]+)(?:-([0-9]+))?)(?:\/([0-9]+))?$/;
 var CRON_FIELD_BOUNDS = [[0, 59], [0, 23], [1, 31], [1, 12], [0, 7]];
 var MAX_CRON_EXPRESSION_LENGTH = 256;
@@ -11217,7 +11425,7 @@ function parseHeaderEnvironment(input) {
   }
 }
 var headerEnvironmentSchema = Type.Optional(decodedSchema(Type.Union([Type.String(), headerEnvironmentRecord]), headerEnvironmentRecord, parseHeaderEnvironment));
-function objectRecord2(candidate) {
+function objectRecord3(candidate) {
   return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
 }
 function boundedCronInteger(input, minimum, maximum) {
@@ -11262,7 +11470,7 @@ function readScheduleBodyFile(bodyPathInput) {
       throw error;
     throw new Error("Scheduled Function body file must contain exact JSON");
   }
-  const body = objectRecord2(payload);
+  const body = objectRecord3(payload);
   if (!body)
     throw new Error("Scheduled Function body file must contain a JSON object");
   return body;
@@ -11303,7 +11511,7 @@ function headerValueIsStable(name, value) {
 function scheduleHeaders(mapping, environment) {
   if (mapping === undefined)
     return;
-  const headerEnvironment = objectRecord2(mapping);
+  const headerEnvironment = objectRecord3(mapping);
   if (!headerEnvironment)
     throw new Error("'header_env' must be a JSON object");
   const entries = Object.entries(headerEnvironment).map(([headerName, environmentName]) => resolvedHeaderEntry(headerName, environmentName, environment));
@@ -11317,7 +11525,7 @@ function validSafeSchedule(schedule) {
   return validScheduleIdentity(schedule) && validScheduleDefinition(schedule) && validScheduleMetadata(schedule);
 }
 function validScheduleIdentity(schedule) {
-  return typeof schedule.id === "string" && SCHEDULE_ID_PATTERN.test(schedule.id) && typeof schedule.name === "string" && schedule.name.trim().length > 0 && schedule.name.length <= MAX_SCHEDULE_NAME_LENGTH && typeof schedule.slug === "string" && SAFE_SLUG_PATTERN.test(schedule.slug);
+  return typeof schedule.id === "string" && SCHEDULE_ID_PATTERN.test(schedule.id) && typeof schedule.name === "string" && schedule.name.trim().length > 0 && schedule.name.length <= MAX_SCHEDULE_NAME_LENGTH && typeof schedule.slug === "string" && SAFE_SLUG_PATTERN2.test(schedule.slug);
 }
 function validScheduleDefinition(schedule) {
   return typeof schedule.cron === "string" && validScheduledFunctionCron(schedule.cron) && (schedule.method === "GET" || schedule.method === "POST") && typeof schedule.enabled === "boolean";
@@ -11332,11 +11540,28 @@ function isCanonicalTimestamp(candidate) {
   return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === candidate;
 }
 function safeSchedulePayload(schedule) {
+  const hasProjectedBody = Object.hasOwn(schedule, "body_empty");
+  const hasProjectedHeaders = Object.hasOwn(schedule, "header_names");
+  if (!hasProjectedBody && !hasProjectedHeaders)
+    return legacySchedulePayload(schedule);
+  if (!hasProjectedBody || !hasProjectedHeaders)
+    return null;
   const headerNames = safeHeaderNames(schedule.header_names);
   if (typeof schedule.body_empty !== "boolean" || !headerNames)
     return null;
   return { body_empty: schedule.body_empty, header_names: headerNames };
 }
+function legacySchedulePayload(schedule) {
+  const body = objectRecord3(schedule.body);
+  const headers = objectRecord3(schedule.headers);
+  if (!body || !headers)
+    return null;
+  const headerNames = safeHeaderNames(Object.keys(headers));
+  const stableHeaderValues = Object.entries(headers).every(([name, value]) => typeof value === "string" && headerValueIsStable(name.toLowerCase(), value));
+  if (!headerNames || !stableHeaderValues)
+    return null;
+  return { body_empty: Object.keys(body).length === 0, header_names: headerNames };
+}
 function safeHeaderNames(candidate) {
   if (!Array.isArray(candidate) || candidate.length > MAX_HEADER_COUNT)
     return null;
@@ -11345,7 +11570,7 @@ function safeHeaderNames(candidate) {
   return valid && new Set(names).size === names.length ? names.sort() : null;
 }
 function safeSchedule(candidate) {
-  const schedule = objectRecord2(candidate);
+  const schedule = objectRecord3(candidate);
   if (!schedule || !validSafeSchedule(schedule))
     return null;
   const safePayload = safeSchedulePayload(schedule);
@@ -11391,7 +11616,7 @@ function listResponse(ref, response) {
   const operation = "scheduled_functions.list";
   if (!response.ok)
     return scheduleFailure(operation, response);
-  const payload = objectRecord2(response.data);
+  const payload = objectRecord3(response.data);
   const rawSchedules = payload?.schedules;
   const schedules = Array.isArray(rawSchedules) ? rawSchedules.map(safeSchedule) : null;
   if (payload?.project_ref !== ref || !schedules || schedules.some((schedule) => !schedule)) {
@@ -11406,7 +11631,7 @@ function getResponse(ref, scheduleId, response) {
   const operation = "scheduled_functions.get";
   if (!response.ok)
     return scheduleFailure(operation, response);
-  const payload = objectRecord2(response.data);
+  const payload = objectRecord3(response.data);
   const schedule = safeSchedule(payload?.schedule);
   if (payload?.project_ref !== ref || !schedule || schedule.id !== scheduleId) {
     return releaseControlFailure(operation, "INVALID_RESPONSE", null);
@@ -11419,7 +11644,7 @@ function mutationResponse(expectation, response) {
   const operation = `scheduled_functions.${action}`;
   if (!response.ok)
     return releaseControlMutationFailure(operation, response);
-  const payload = objectRecord2(response.data);
+  const payload = objectRecord3(response.data);
   const schedule = safeSchedule(payload?.schedule);
   const confirmsRequest = schedule && Object.entries(expectedFields).every(([field, expected]) => isDeepStrictEqual(schedule[field], expected));
   const confirmsRevision = action === "create" || payload?.previous_updated_at === expectation.expectedUpdatedAt && schedule !== null && schedule.updated_at > expectation.expectedUpdatedAt;
@@ -11437,7 +11662,7 @@ function deleteResponse(ref, scheduleId, expectedUpdatedAt, response) {
   const operation = "scheduled_functions.delete";
   if (!response.ok)
     return releaseControlMutationFailure(operation, response);
-  const payload = objectRecord2(response.data);
+  const payload = objectRecord3(response.data);
   if (payload?.deleted !== true || payload.project_ref !== ref || payload.schedule_id !== scheduleId || payload.deleted_updated_at !== expectedUpdatedAt) {
     return releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.status);
   }
@@ -11483,7 +11708,7 @@ function requiredName(args, action) {
 }
 function requiredSlug(args, action) {
   const slug = requiredText2(args, "slug", action);
-  if (!SAFE_SLUG_PATTERN.test(slug))
+  if (!SAFE_SLUG_PATTERN2.test(slug))
     throw new Error(`'slug' is invalid for '${action}'`);
   return slug;
 }
@@ -11620,17 +11845,17 @@ var LEASE_KEYS = ["owner", "expires_at", "fencing_epoch"];
 function isMutationId(candidate) {
   return typeof candidate === "string" && MUTATION_ID_PATTERN.test(candidate);
 }
-function objectRecord3(candidate) {
+function objectRecord4(candidate) {
   return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
 }
 function exactRecord(candidate, keys) {
-  const record = objectRecord3(candidate);
+  const record = objectRecord4(candidate);
   if (!record || Object.keys(record).length !== keys.length)
     return null;
   return keys.every((key) => Object.hasOwn(record, key)) ? record : null;
 }
 function emptyProjection(candidate) {
-  const record = objectRecord3(candidate);
+  const record = objectRecord4(candidate);
   return record && Object.keys(record).length === 0 ? record : null;
 }
 function canonicalTimestamp2(candidate) {
@@ -11814,7 +12039,7 @@ var MUTATION_TOOL_SCHEMA = {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.20.0",
+  version: "0.21.1",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -12074,12 +12299,14 @@ EXAMPLES
   ${preferredCommand} branch promote --branch_ref preview123 --plan_checksum <sha256>
   ${preferredCommand} ai show_skill
   ${preferredCommand} ai install_skill --dry_run
-  ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello --expected-active-version absent
-  ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --prebundled-path ./dist/hello.js --expected-sha256 <sha256> --expected-active-version 4
-  ${preferredCommand} edge_functions activate --ref abc123 --slug hello --version 3 --expected-active-version 4
+  ${preferredCommand} edge_functions get_config --ref abc123 --slug hello
+  ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello --expected-active-version absent --expected-activation-id legacy
+  ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --prebundled-path ./dist/hello.js --expected-sha256 <sha256> --expected-active-version 4 --expected-activation-id <uuid>
+  ${preferredCommand} edge_functions activate --ref abc123 --slug hello --version 3 --expected-active-version 4 --expected-activation-id <uuid>
   ${preferredCommand} scheduled_functions list --ref abc123
   ${preferredCommand} mutations status --ref abc123 --mutation_id 00000000-0000-4000-8000-000000000001
-  ${preferredCommand} edge_functions config --ref abc123 --slug hello --verify_jwt false --background_routes "/queue/*,/render/*"
+  ${preferredCommand} edge_functions config --ref abc123 --slug hello --verify_jwt false --background_routes "/queue/*,/render/*" --expected-activation-id <uuid>
+  ${preferredCommand} edge_functions delete --ref abc123 --slug hello --expected-activation-id <uuid>
   ${preferredCommand} secrets upsert --ref abc123 --from-env API_KEY,WEBHOOK_SECRET
   ${preferredCommand} gateway routes --ref abc123
   ${preferredCommand} gateway upsert_route --ref abc123 --route_id webhook --hosts "api.example.com" --paths "/webhook/*" --upstream 10.0.0.5:8080

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.20.0",
+  "version": "0.21.1",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",

package/skills/supacloud-cli/references/command-map.md

@@ -31,7 +31,7 @@ until a project-scoped context is resolved.
 - `supabase`: allowlisted official CLI adapter for migration authoring, local reset/diff, explicit-DSN inspection/backup/type generation, and SupaCloud-controlled migration push.
 - `auth`: provider and authentication configuration.
 - `storage`: buckets and object-management workflows.
-- `edge_functions`: list, read immutable source, deploy, activate, and configure Edge Functions. Pass the non-negative version read from `list` as `--expected-active-version`; use `absent` only for a new slug. Version `0` is a legacy CAS token and cannot be used as a source or activation target.
+- `edge_functions`: list, atomically read one active or deleted identity with `get_config`, read immutable source, deploy, activate, configure, and delete Edge Functions. For every mutation, pass the `activation_id` read from the same `list` or `get_config` snapshot as `--expected-activation-id`; use `legacy` only for a never-created or listed legacy Function, not for a deleted slug with a tombstone UUID. Deploy and activate actions also require the non-negative observed version as `--expected-active-version`; use `absent` for a never-created slug or a `get_config` tombstone. Version `0` is a legacy version token and cannot be used as a source or activation target.
 - `frontend`: list, build/deploy, domain, and deployment workflows.
 - `secrets`: project secret management; never print values after write.
 - `queue`, `task_events`, `diagnostics`: asynchronous workload operations and bounded diagnostics.