@supacloud/cli 0.29.0 → 0.31.0

package/dist/index.js

@@ -6464,6 +6464,7 @@ var ACTION_POLICY = {
   },
   database: {
     read: ["list_tables", "describe_columns", "list_indexes", "list_constraints", "list_extensions", "rls_status", "rls_policies", "list_auth_users", "get_auth_user", "connections", "stats", "slow_queries", "list_migrations", "migration_inventory", "project_url", "generate_types"],
+    local: ["lint_migrations", "lint"],
     write: ["query", "apply_migration", "push_migrations", "baseline_migrations", "create_table_rls"]
   },
   supabase: {
@@ -6471,8 +6472,8 @@ var ACTION_POLICY = {
     write: ["push"]
   },
   auth: {
-    read: ["list_users", "get_user", "list_providers", "get_provider", "supported_providers", "get_settings", "get_config"],
-    write: ["generate_link", "configure_provider", "update_provider", "disable_provider", "wechat_mini", "wechat_open", "update_settings", "update_config"]
+    read: ["list_users", "get_user", "list_providers", "get_provider", "supported_providers", "get_settings", "get_config", "get_oauth_server"],
+    write: ["generate_link", "configure_provider", "update_provider", "disable_provider", "wechat_mini", "wechat_open", "update_settings", "update_config", "migrate_oauth_server"]
   },
   oauth_clients: {
     read: ["list", "get"],
@@ -6491,7 +6492,7 @@ var ACTION_POLICY = {
   mutations: { read: ["status"] },
   release: {
     read: ["logical_backup_list", "postgrest_status"],
-    write: ["logical_backup_create", "logical_backup_restore", "postgrest_restart", "release_canary_fixture_stage_replay"]
+    write: ["logical_backup_create", "logical_backup_restore", "postgrest_restart", "release_canary_fixture_stage_replay", "release_canary_fixture_disable_replay"]
   },
   secrets: { read: ["list"], write: ["upsert", "delete"] },
   frontend: {
@@ -6986,12 +6987,643 @@ function releaseControlErrorResponse(payload) {
   return { ...releaseControlResponse(payload), isError: true };
 }
 
+// src/shared/tools/migration-risk.ts
+function startsEscapeString(sql, quoteIndex) {
+  const prefixIndex = quoteIndex - 1;
+  const prefix = sql[prefixIndex] || "";
+  const preceding = sql[prefixIndex - 1] || "";
+  return /[eE]/.test(prefix) && !/[A-Za-z0-9_$]/.test(preceding);
+}
+function dollarQuoteTagAt(sql, index) {
+  const previous = sql[index - 1] || "";
+  if (/[A-Za-z0-9_$]/.test(previous))
+    return "";
+  return sql.slice(index).match(/^\$[A-Za-z_][A-Za-z0-9_]*\$|^\$\$/)?.[0] || "";
+}
+function maskSingleQuotedString(sql, start) {
+  const usesBackslashEscapes = startsEscapeString(sql, start);
+  let end = start + 1;
+  while (end < sql.length) {
+    if (usesBackslashEscapes && sql[end] === "\\" && sql[end + 1]) {
+      end += 2;
+    } else if (sql[end] === "'" && sql[end + 1] === "'") {
+      end += 2;
+    } else if (sql[end] === "'") {
+      end += 1;
+      return { masked: " ".repeat(end - start), end };
+    } else {
+      end += 1;
+    }
+  }
+  throw new Error("Unterminated SQL single-quoted string");
+}
+function maskDoubleQuotedIdentifier(sql, start) {
+  let end = start + 1;
+  while (end < sql.length) {
+    if (sql[end] === '"' && sql[end + 1] === '"') {
+      end += 2;
+    } else if (sql[end] === '"') {
+      end += 1;
+      return { masked: `"${"_".repeat(Math.max(0, end - start - 2))}"`, end };
+    } else {
+      end += 1;
+    }
+  }
+  throw new Error("Unterminated SQL double-quoted identifier");
+}
+function preserveDoubleQuotedIdentifier(sql, start) {
+  const identifier = maskDoubleQuotedIdentifier(sql, start);
+  return { masked: sql.slice(start, identifier.end), end: identifier.end };
+}
+function lineCommentEnd(sql, start) {
+  const end = sql.indexOf(`
+`, start + 2);
+  return end === -1 ? sql.length : end;
+}
+function blockCommentEnd(sql, start) {
+  let depth = 1;
+  let cursor = start + 2;
+  while (cursor < sql.length && depth > 0) {
+    if (sql.startsWith("/*", cursor)) {
+      depth++;
+      cursor += 2;
+    } else if (sql.startsWith("*/", cursor)) {
+      depth--;
+      cursor += 2;
+    } else {
+      cursor++;
+    }
+  }
+  if (depth > 0)
+    throw new Error("Unterminated SQL block comment");
+  return cursor;
+}
+function maskDollarQuotedString(sql, start) {
+  const tag = dollarQuoteTagAt(sql, start);
+  if (!tag)
+    return null;
+  const closingTag = sql.indexOf(tag, start + tag.length);
+  if (closingTag === -1)
+    throw new Error("Unterminated SQL dollar-quoted body");
+  const end = closingTag + tag.length;
+  return { masked: " ".repeat(end - start), end };
+}
+function maskSqlSpan(sql, start, quotedIdentifier) {
+  if (sql.startsWith("--", start)) {
+    const end = lineCommentEnd(sql, start);
+    return { masked: " ".repeat(end - start), end };
+  }
+  if (sql.startsWith("/*", start)) {
+    const end = blockCommentEnd(sql, start);
+    return { masked: " ".repeat(end - start), end };
+  }
+  if (sql[start] === "'")
+    return maskSingleQuotedString(sql, start);
+  if (sql[start] === '"')
+    return quotedIdentifier(sql, start);
+  if (sql[start] === "$")
+    return maskDollarQuotedString(sql, start);
+  return null;
+}
+function maskSql(sql, quotedIdentifier) {
+  let masked = "";
+  let cursor = 0;
+  while (cursor < sql.length) {
+    const protectedSpan = maskSqlSpan(sql, cursor, quotedIdentifier);
+    if (protectedSpan) {
+      masked += protectedSpan.masked;
+      cursor = protectedSpan.end;
+    } else {
+      masked += sql[cursor];
+      cursor++;
+    }
+  }
+  return masked;
+}
+function maskSqlNoise(sql) {
+  return maskSql(sql, maskDoubleQuotedIdentifier);
+}
+function maskSqlPolicyNoise(sql) {
+  return maskSql(sql, preserveDoubleQuotedIdentifier);
+}
+function splitSqlStatements(sql) {
+  const masked = maskSqlNoise(sql);
+  const statements = [];
+  let lastIndex = 0;
+  let cursor = 0;
+  while (cursor < masked.length) {
+    if (masked[cursor] === ";") {
+      const rawStatement = sql.slice(lastIndex, cursor).trim();
+      if (rawStatement.length > 0) {
+        statements.push(rawStatement);
+      }
+      lastIndex = cursor + 1;
+    }
+    cursor++;
+  }
+  const trailing = sql.slice(lastIndex).trim();
+  if (trailing.length > 0) {
+    statements.push(trailing);
+  }
+  return statements;
+}
+function normalizedTransactionStatement(statement) {
+  return maskSqlNoise(statement).replace(/\s+/g, " ").trim();
+}
+function migrationExecutionStatements(statements) {
+  if (statements.length < 2)
+    return [...statements];
+  const first = normalizedTransactionStatement(statements[0]);
+  const last = normalizedTransactionStatement(statements[statements.length - 1]);
+  const hasOuterTransaction = /^(?:BEGIN(?:\s+(?:WORK|TRANSACTION))?|START\s+TRANSACTION)$/i.test(first) && /^(?:COMMIT|END)(?:\s+(?:WORK|TRANSACTION))?$/i.test(last);
+  return hasOuterTransaction ? statements.slice(1, -1) : [...statements];
+}
+function splitTopLevelClauses(sql) {
+  const masked = maskSqlNoise(sql);
+  const clauses = [];
+  let parenthesisDepth = 0;
+  let bracketDepth = 0;
+  let clauseStart = 0;
+  for (let cursor = 0;cursor < masked.length; cursor += 1) {
+    const character = masked[cursor];
+    if (character === "(")
+      parenthesisDepth += 1;
+    else if (character === ")")
+      parenthesisDepth -= 1;
+    else if (character === "[")
+      bracketDepth += 1;
+    else if (character === "]")
+      bracketDepth -= 1;
+    if (parenthesisDepth < 0 || bracketDepth < 0)
+      throw new Error("Unbalanced SQL delimiters");
+    if (character === "," && parenthesisDepth === 0 && bracketDepth === 0) {
+      clauses.push(sql.slice(clauseStart, cursor).trim());
+      clauseStart = cursor + 1;
+    }
+  }
+  if (parenthesisDepth !== 0 || bracketDepth !== 0)
+    throw new Error("Unbalanced SQL delimiters");
+  clauses.push(sql.slice(clauseStart).trim());
+  return clauses.filter(Boolean);
+}
+var RISK_RULES = [
+  {
+    type: "destructive_drop_database",
+    level: "HIGH",
+    pattern: /\bDROP\s+DATABASE\b/i,
+    description: "Drops entire database.",
+    recommendation: "Never drop databases in automated migrations.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "destructive_drop_schema",
+    level: "HIGH",
+    pattern: /\bDROP\s+SCHEMA\b/i,
+    description: "Drops entire schema and all contained objects.",
+    recommendation: "Ensure schema objects are migrated or deleted in contract phase before dropping schema."
+  },
+  {
+    type: "destructive_drop_table",
+    level: "HIGH",
+    pattern: /\bDROP\s+TABLE\b/i,
+    description: "Drops table and permanently removes data. Old code referencing this table will break.",
+    recommendation: "Follow Expand-Contract: Deprecate usage in application code before dropping table."
+  },
+  {
+    type: "destructive_drop_column",
+    level: "HIGH",
+    pattern: /\bALTER\s+TABLE\b[\s\S]*?\bDROP\s+(?:COLUMN\s+)?[a-z0-9_"]+/i,
+    excludePattern: /\bDROP\s+CONSTRAINT\b|\bALTER\s+(?:COLUMN\s+)?[a-z0-9_"]+\s+DROP\s+(?:DEFAULT|NOT\s+NULL|IDENTITY|EXPRESSION)\b/i,
+    description: "Drops column. Running application code selecting or writing this column will fail immediately.",
+    recommendation: "Follow Expand-Contract: Ensure all running application versions have stopped accessing this column before dropping."
+  },
+  {
+    type: "destructive_drop_constraint",
+    level: "HIGH",
+    pattern: /\bALTER\s+TABLE\b[\s\S]*?\bDROP\s+CONSTRAINT\b/i,
+    description: "Drops constraint. Dropping constraints may break uniqueness guarantees or foreign key integrity.",
+    recommendation: "Ensure application code and data no longer depend on this constraint before dropping."
+  },
+  {
+    type: "destructive_drop_view",
+    level: "HIGH",
+    pattern: /\bDROP\s+(?:MATERIALIZED\s+)?VIEW\b/i,
+    description: "Drops view or materialized view. Queries or API endpoints selecting from this view will break.",
+    recommendation: "Follow Expand-Contract: Deprecate client/API dependencies on this view before dropping."
+  },
+  {
+    type: "destructive_truncate",
+    level: "HIGH",
+    pattern: /\bTRUNCATE(?:\s+TABLE)?\b/i,
+    description: "Truncates table data permanently.",
+    recommendation: "Avoid TRUNCATE in schema migrations; use soft deletes or targeted archived data cleanup."
+  },
+  {
+    type: "destructive_rename_column",
+    level: "HIGH",
+    pattern: /\bALTER\s+TABLE\b[\s\S]*?\bRENAME\s+(?:COLUMN\s+)?[a-z0-9_"]+\s+TO\b/i,
+    description: "Renames column. Causes immediate downtime for old application code expecting the previous column name.",
+    recommendation: "Follow Expand-Contract: Add new column, dual-write, backfill, migrate reads, then drop old column."
+  },
+  {
+    type: "destructive_rename_table",
+    level: "HIGH",
+    pattern: /\bALTER\s+TABLE\b[\s\S]*?\bRENAME\s+TO\b/i,
+    description: "Renames table. Causes immediate downtime for application code.",
+    recommendation: "Follow Expand-Contract: Create a view or alias table during transition."
+  },
+  {
+    type: "manual_review_do_block",
+    level: "HIGH",
+    pattern: /^\s*DO\b/i,
+    description: "DO blocks can execute dynamic or procedural DDL that static rules cannot inspect safely.",
+    recommendation: "Move schema changes into explicit SQL statements; push_migrations rejects opaque procedural SQL.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "manual_review_procedural_definition",
+    level: "HIGH",
+    pattern: /^\s*CREATE\s+(?:OR\s+REPLACE\s+)?(?:FUNCTION|PROCEDURE)\b/i,
+    description: "Defines procedural SQL whose body can hide data, privilege, or schema side effects from static rules.",
+    recommendation: "Review the complete function or procedure body and require strict migration approval."
+  },
+  {
+    type: "manual_review_procedure_call",
+    level: "HIGH",
+    pattern: /^\s*CALL\b/i,
+    description: "Calls a stored procedure whose side effects cannot be determined statically.",
+    recommendation: "Replace the call with explicit migration SQL or require strict manual approval."
+  },
+  {
+    type: "locking_vacuum_full",
+    level: "HIGH",
+    pattern: /^\s*VACUUM\b/i,
+    description: "VACUUM cannot run inside the transactional migration executor; VACUUM FULL also locks and rewrites the table.",
+    recommendation: "Run VACUUM through an approved non-transactional maintenance path; do not place it in push_migrations files.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "locking_cluster",
+    level: "HIGH",
+    pattern: /^\s*CLUSTER\s+[a-z0-9_"]+/i,
+    description: "CLUSTER acquires an ACCESS EXCLUSIVE lock on the table, blocking all concurrent access.",
+    recommendation: "Avoid CLUSTER on active production tables; consider pg_repack for online table reordering."
+  },
+  {
+    type: "unsupported_concurrent_index_migration",
+    level: "HIGH",
+    pattern: /\b(?:CREATE\s+(?:UNIQUE\s+)?INDEX|DROP\s+INDEX|REINDEX\b[\s\S]*?)\s+CONCURRENTLY\b/i,
+    description: "CONCURRENTLY operations cannot run inside the transactional migration executor.",
+    recommendation: "Run the concurrent index operation through an approved non-transactional maintenance path, outside push_migrations.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "unsupported_non_transactional_migration",
+    level: "HIGH",
+    pattern: /\b(?:CREATE\s+DATABASE|CREATE\s+TABLESPACE|DROP\s+TABLESPACE|CREATE\s+SUBSCRIPTION|DROP\s+SUBSCRIPTION|ALTER\s+SYSTEM)\b/i,
+    description: "This operation cannot run inside the transactional, project-scoped migration executor.",
+    recommendation: "Use an approved platform maintenance path instead of push_migrations.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "locking_non_concurrent_index",
+    level: "MEDIUM",
+    pattern: /\bCREATE\s+(?:UNIQUE\s+)?INDEX\s+(?!CONCURRENTLY\b)/i,
+    description: "Creates index non-concurrently. Acquires SHARE lock and blocks concurrent writes (INSERT/UPDATE/DELETE) on the table until index build completes.",
+    recommendation: "For a live large table, use the approved non-transactional maintenance path for CREATE INDEX CONCURRENTLY; push_migrations cannot execute it."
+  },
+  {
+    type: "locking_drop_index_non_concurrent",
+    level: "MEDIUM",
+    pattern: /\bDROP\s+INDEX\s+(?!CONCURRENTLY\b)/i,
+    description: "Drops index non-concurrently. Acquires ACCESS EXCLUSIVE lock on the table, blocking concurrent reads and writes.",
+    recommendation: "For a live table, use the approved non-transactional maintenance path for DROP INDEX CONCURRENTLY; push_migrations cannot execute it."
+  },
+  {
+    type: "locking_alter_column_set_not_null",
+    level: "MEDIUM",
+    pattern: /\bALTER\s+TABLE\b[\s\S]*?\bALTER\s+(?:COLUMN\s+)?[a-z0-9_"]+\s+SET\s+NOT\s+NULL\b/i,
+    description: "Setting NOT NULL on an existing column scans the entire table under an ACCESS EXCLUSIVE lock unless a validated CHECK constraint already exists.",
+    recommendation: "Add a CHECK (column IS NOT NULL) NOT VALID constraint first, validate it with VALIDATE CONSTRAINT, then SET NOT NULL."
+  },
+  {
+    type: "locking_alter_type",
+    level: "MEDIUM",
+    pattern: /\bALTER\s+TABLE\b[\s\S]*?\bALTER\s+(?:COLUMN\s+)?[a-z0-9_"]+\s+(?:SET\s+DATA\s+)?TYPE\b/i,
+    description: "Altering column type acquires ACCESS EXCLUSIVE lock and may trigger a full table rewrite.",
+    recommendation: "Add a new column with the target type, dual-write, copy data, switch reads, then drop old column."
+  },
+  {
+    type: "locking_unique_constraint_without_index",
+    level: "MEDIUM",
+    pattern: /\bALTER\s+TABLE\b[\s\S]*?\bADD\s+CONSTRAINT\b[\s\S]*?\bUNIQUE\b/i,
+    excludePattern: /\bUNIQUE\s+USING\s+INDEX\b/i,
+    description: "Adding UNIQUE constraint directly acquires an ACCESS EXCLUSIVE lock while creating the index.",
+    recommendation: "Build the unique index through the approved non-transactional maintenance path, then attach it with ADD CONSTRAINT ... UNIQUE USING INDEX in a migration."
+  },
+  {
+    type: "locking_foreign_key_without_not_valid",
+    level: "MEDIUM",
+    pattern: /\bALTER\s+TABLE\b[\s\S]*?\bADD\s+CONSTRAINT\b[\s\S]*?\bFOREIGN\s+KEY\b(?!\s*[^;]*?\bNOT\s+VALID\b)/i,
+    description: "Adding a FOREIGN KEY constraint without NOT VALID locks the table for a full scan to validate existing rows.",
+    recommendation: "Add foreign key constraint with 'NOT VALID' first, then run 'ALTER TABLE ... VALIDATE CONSTRAINT' separately."
+  },
+  {
+    type: "locking_check_constraint_without_not_valid",
+    level: "MEDIUM",
+    pattern: /\bALTER\s+TABLE\b[\s\S]*?\bADD\s+CONSTRAINT\b[\s\S]*?\bCHECK\b(?!\s*[^;]*?\bNOT\s+VALID\b)/i,
+    description: "Adding a CHECK constraint without NOT VALID scans the entire table under an ACCESS EXCLUSIVE lock.",
+    recommendation: "Add constraint with 'NOT VALID' first, then validate with 'ALTER TABLE ... VALIDATE CONSTRAINT'."
+  }
+];
+var MIGRATION_LEDGER_RELATION = String.raw`(?:(?:"?(?:supabase_migrations|public)"?)\s*\.\s*)?"?schema_migrations"?`;
+var MIGRATION_LEDGER_RELATION_END = String.raw`(?=$|[\s,;(*])`;
+var MIGRATION_LEDGER_DDL_OR_MAINTENANCE_PREFIX = String.raw`(?:CREATE\s+(?:UNIQUE\s+)?INDEX\b[^;]*\bON\s+(?:ONLY\s+)?|CREATE\s+(?:CONSTRAINT\s+)?TRIGGER\b[^;]*\bON\s+|DROP\s+TRIGGER\s+(?:IF\s+EXISTS\s+)?[^;]*\bON\s+|CREATE\s+RULE\b[^;]*\bTO\s+|DROP\s+RULE\s+(?:IF\s+EXISTS\s+)?[^;]*\bON\s+|CREATE\s+POLICY\b[^;]*\bON\s+|ALTER\s+POLICY\b[^;]*\bON\s+|DROP\s+POLICY\s+(?:IF\s+EXISTS\s+)?[^;]*\bON\s+|COMMENT\s+ON\s+TABLE\s+|SECURITY\s+LABEL(?:\s+FOR\s+[^;\s]+)?\s+ON\s+TABLE\s+|REINDEX(?:\s*\([^;)]*\))?\s+TABLE\s+(?:CONCURRENTLY\s+)?|CLUSTER(?:\s+VERBOSE)?\s+|VACUUM(?:\s*\([^;)]*\))?(?:\s+(?:FULL|FREEZE|VERBOSE|ANALYZE))*\s+|ANALYZE(?:\s*\([^;)]*\))?(?:\s+VERBOSE)?\s+)`;
+var MIGRATION_LEDGER_MODIFICATION_PATTERN = new RegExp(String.raw`\b(?:(?:CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?|INSERT\s+INTO\s+(?:ONLY\s+)?|UPDATE\s+(?:ONLY\s+)?|DELETE\s+FROM\s+(?:ONLY\s+)?|MERGE\s+INTO\s+(?:ONLY\s+)?|ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?|COPY\s+)` + MIGRATION_LEDGER_RELATION + MIGRATION_LEDGER_RELATION_END + String.raw`|(?:DROP\s+TABLE\s+(?:IF\s+EXISTS\s+)?|TRUNCATE(?:\s+TABLE)?\s+|LOCK\s+(?:TABLE\s+)?)[^;]*` + MIGRATION_LEDGER_RELATION + MIGRATION_LEDGER_RELATION_END + String.raw`|` + MIGRATION_LEDGER_DDL_OR_MAINTENANCE_PREFIX + MIGRATION_LEDGER_RELATION + MIGRATION_LEDGER_RELATION_END + String.raw`)`, "i");
+var NON_TABLE_PRIVILEGE_TARGET = String.raw`(?:ALL\s+(?:FUNCTIONS|PROCEDURES|ROUTINES|SEQUENCES)\s+IN\s+SCHEMA|DATABASE|DOMAIN|FOREIGN\s+DATA\s+WRAPPER|FOREIGN\s+SERVER|FUNCTION|LANGUAGE|LARGE\s+OBJECT|PARAMETER|PROCEDURE|ROUTINE|SCHEMA|SEQUENCE|TABLESPACE|TYPE)\b`;
+var MIGRATION_LEDGER_PRIVILEGE_PATTERN = new RegExp(String.raw`\b(?:GRANT|REVOKE)\b[^;]*\bON\s+(?:(?:TABLE\s+)?(?!` + NON_TABLE_PRIVILEGE_TARGET + String.raw`)(?:(?!\b(?:TO|FROM)\b)[^;])*?` + MIGRATION_LEDGER_RELATION + MIGRATION_LEDGER_RELATION_END + String.raw`(?=[^;]*\b(?:TO|FROM)\b)|ALL\s+TABLES\s+IN\s+SCHEMA\s+"?(?:supabase_migrations|public)"?(?=$|[\s,;]))`, "i");
+var PUSH_BLOCKER_RULES = [
+  {
+    type: "unsupported_project_scope_management",
+    level: "HIGH",
+    pattern: /\b(?:ALTER\s+DATABASE|DROP\s+SCHEMA\s+(?:IF\s+EXISTS\s+)?(?:[^;]*,\s*)?public(?=\s*(?:,|CASCADE\b|RESTRICT\b|$))|(?:DROP|REASSIGN)\s+OWNED\b|(?:CREATE|ALTER|DROP)\s+(?:ROLE|USER)\b|ALTER\s+SUBSCRIPTION\b)\b/i,
+    description: "Attempts cluster-wide or platform-owned database management outside the project migration boundary.",
+    recommendation: "Use an approved platform administration path instead of push_migrations.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "unsupported_platform_schema_management",
+    level: "HIGH",
+    pattern: /\b(?:ALTER\s+SCHEMA\s+"?public"?|(?:CREATE\s+SCHEMA\s+(?:IF\s+NOT\s+EXISTS\s+)?|ALTER\s+SCHEMA\s+)"?supabase_migrations"?|DROP\s+SCHEMA\s+(?:IF\s+EXISTS\s+)?(?:[^;]*,\s*)?"?supabase_migrations"?(?=\s*(?:,|CASCADE\b|RESTRICT\b|$)))\b/i,
+    description: "Attempts to rename or re-own the public API schema, or to manage the platform migration schema.",
+    recommendation: "Keep public and supabase_migrations under platform ownership; change project-owned schemas instead.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "unsupported_unicode_escaped_identifier",
+    level: "HIGH",
+    pattern: /\bU&"/i,
+    description: "Uses a Unicode-escaped identifier that cannot be safely canonicalized by the migration policy.",
+    recommendation: "Use a plain or directly quoted PostgreSQL identifier in controlled migrations.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "unsupported_server_access",
+    level: "HIGH",
+    pattern: /^\s*COPY\b|\b(?:(?:lo_import|lo_export|pg_read_file|pg_write_file|pg_ls_dir|pg_stat_file|pg_execute_server_program)\s*\(|pg_(?:terminate|cancel)_backend\s*\(|LOAD\b)/i,
+    description: "Attempts server file, process, backend, or dynamic-library access from a project migration.",
+    recommendation: "Run host-level maintenance through an approved platform administration path.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "unsupported_external_database_access",
+    level: "HIGH",
+    pattern: /\bdblink(?:_[a-z_]+)?\s*\(|\b(?:CREATE|ALTER|DROP)\s+(?:SERVER|USER\s+MAPPING|FOREIGN\s+DATA\s+WRAPPER)\b|\bIMPORT\s+FOREIGN\s+SCHEMA\b|\bCREATE\s+FOREIGN\s+TABLE\b/i,
+    description: "Attempts external database or foreign-data-wrapper access outside the project migration boundary.",
+    recommendation: "Provision external connectivity through an approved platform administration path.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "unsupported_transaction_control",
+    level: "HIGH",
+    pattern: /^\s*(?:BEGIN|START\s+TRANSACTION|COMMIT|END|ROLLBACK|ABORT|SAVEPOINT|RELEASE\s+SAVEPOINT|PREPARE\s+TRANSACTION)\b/i,
+    description: "Contains transaction control inside a migration whose atomic transaction is owned by the platform.",
+    recommendation: "Remove internal transaction control; one matching outer BEGIN/COMMIT wrapper is stripped automatically.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "unsupported_session_control",
+    level: "HIGH",
+    pattern: /\b(?:SET\s+(?:(?:LOCAL|SESSION)\s+)?(?:ROLE|SESSION\s+AUTHORIZATION)|RESET\s+(?:ROLE|SESSION\s+AUTHORIZATION)|DISCARD\s+ALL)\b/i,
+    description: "Attempts to change the database session identity or discard platform-managed session state.",
+    recommendation: "Keep migrations within the delegated project role and remove session identity control.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "unsupported_advisory_lock_control",
+    level: "HIGH",
+    pattern: /\bpg_(?:try_)?advisory_(?:xact_)?(?:lock|unlock)(?:_shared|_all)?\s*\(/i,
+    description: "Attempts advisory lock control that can conflict with the platform migration lock.",
+    recommendation: "Remove custom advisory lock operations; push_migrations already serializes project migrations.",
+    blocksTransactionalPush: true
+  }
+];
+var QUOTED_FUNCTION_BLOCKER_RULES = [
+  {
+    type: "unsupported_server_access",
+    level: "HIGH",
+    pattern: /"(?:lo_import|lo_export|pg_read_file|pg_write_file|pg_ls_dir|pg_stat_file|pg_execute_server_program|pg_terminate_backend|pg_cancel_backend)"\s*\(/,
+    description: "Attempts server file, process, backend, or dynamic-library access from a project migration.",
+    recommendation: "Run host-level maintenance through an approved platform administration path.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "unsupported_external_database_access",
+    level: "HIGH",
+    pattern: /"dblink(?:_[a-z_]+)?"\s*\(/,
+    description: "Attempts external database or foreign-data-wrapper access outside the project migration boundary.",
+    recommendation: "Provision external connectivity through an approved platform administration path.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "unsupported_advisory_lock_control",
+    level: "HIGH",
+    pattern: /"pg_(?:try_)?advisory_(?:xact_)?(?:lock|unlock)(?:_shared|_all)?"\s*\(/,
+    description: "Attempts advisory lock control that can conflict with the platform migration lock.",
+    recommendation: "Remove custom advisory lock operations; push_migrations already serializes project migrations.",
+    blocksTransactionalPush: true
+  }
+];
+var MIGRATION_LEDGER_BLOCKER_RULES = [
+  {
+    type: "unsupported_public_schema_removal",
+    level: "HIGH",
+    pattern: /\bDROP\s+SCHEMA\s+(?:IF\s+EXISTS\s+)?(?:[^;]*,\s*)?"?public"?(?=\s*(?:,|CASCADE\b|RESTRICT\b|$))/i,
+    description: "Attempts to remove the platform-required public schema.",
+    recommendation: "Drop project objects individually through an approved contract migration; do not remove public.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "unsupported_migration_ledger_access",
+    level: "HIGH",
+    pattern: MIGRATION_LEDGER_MODIFICATION_PATTERN,
+    description: "Attempts to modify or bypass the platform-owned migration ledger.",
+    recommendation: "Let push_migrations record the ledger entry after the migration transaction commits.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "unsupported_migration_ledger_privileges",
+    level: "HIGH",
+    pattern: MIGRATION_LEDGER_PRIVILEGE_PATTERN,
+    description: "Attempts to change privileges on the platform-owned migration ledger.",
+    recommendation: "Keep migration ledger privileges under platform control.",
+    blocksTransactionalPush: true
+  },
+  {
+    type: "unsupported_migration_ledger_recorder_access",
+    level: "HIGH",
+    pattern: /"?supabase_migrations"?\s*\.\s*"?record_schema_migration"?\s*\(/i,
+    description: "Attempts to call or redefine the platform migration ledger recorder.",
+    recommendation: "Let push_migrations invoke the recorder with a platform-issued lease.",
+    blocksTransactionalPush: true
+  }
+];
+function matchingRisks(rawStatement, maskedStatement, rules) {
+  return rules.filter((rule) => rule.pattern.test(maskedStatement) && !rule.excludePattern?.test(maskedStatement)).map((rule) => ({
+    level: rule.level,
+    type: rule.type,
+    description: rule.description,
+    recommendation: rule.recommendation,
+    statementSnippet: rawStatement.replace(/\s+/g, " ").slice(0, 100),
+    ...rule.blocksTransactionalPush ? { blocksTransactionalPush: true } : {}
+  }));
+}
+function defaultExpression(maskedClause) {
+  const defaultIndex = maskedClause.search(/\bDEFAULT\b/i);
+  if (defaultIndex === -1)
+    return "";
+  const expression = maskedClause.slice(defaultIndex + "DEFAULT".length);
+  const constraintIndex = expression.search(/\b(?:COLLATE|CONSTRAINT|GENERATED|NOT\s+NULL|NULL|PRIMARY\s+KEY|REFERENCES|UNIQUE|CHECK)\b/i);
+  return (constraintIndex === -1 ? expression : expression.slice(0, constraintIndex)).trim();
+}
+function defaultMayRequireTableRewrite(maskedClause) {
+  const expression = defaultExpression(maskedClause);
+  if (!expression)
+    return false;
+  const withoutKnownStableCalls = expression.replace(/\b(?:now|transaction_timestamp|statement_timestamp)\s*\(\s*\)/gi, "");
+  return /\b[A-Za-z_][A-Za-z0-9_$]*(?:\s*\.\s*[A-Za-z_][A-Za-z0-9_$]*)?\s*\(/.test(withoutKnownStableCalls);
+}
+function addedNotNullColumnRisks(rawStatement) {
+  const maskedStatement = maskSqlNoise(rawStatement);
+  if (!/^\s*ALTER\s+TABLE\b/i.test(maskedStatement))
+    return [];
+  const risks = [];
+  for (const clause of splitTopLevelClauses(rawStatement)) {
+    const maskedClause = maskSqlNoise(clause);
+    if (!/\bADD\s+(?!CONSTRAINT\b)(?:COLUMN\s+)?[a-z0-9_"]+\s+[\s\S]*\bNOT\s+NULL\b/i.test(maskedClause))
+      continue;
+    const snippet = clause.replace(/\s+/g, " ").slice(0, 100);
+    if (!/\bDEFAULT\b/i.test(maskedClause)) {
+      risks.push({
+        level: "MEDIUM",
+        type: "locking_not_null_no_default",
+        description: "Adding a NOT NULL column without a DEFAULT value requires full table verification and fails when existing rows cannot satisfy it.",
+        recommendation: "Follow Expand-Contract: add the column as nullable, backfill it, then add NOT NULL separately.",
+        statementSnippet: snippet
+      });
+    } else if (defaultMayRequireTableRewrite(maskedClause)) {
+      risks.push({
+        level: "MEDIUM",
+        type: "locking_not_null_expression_default",
+        description: "Adding a NOT NULL column with a function-based DEFAULT may rewrite the table while holding a strong lock.",
+        recommendation: "Use a literal or known stable default, or add the column nullable and backfill in a separate step.",
+        statementSnippet: snippet
+      });
+    }
+  }
+  return risks;
+}
+function analyzeMigrationSql(sql) {
+  const statements = migrationExecutionStatements(splitSqlStatements(sql));
+  if (statements.length === 0) {
+    return [{
+      level: "HIGH",
+      type: "unsupported_empty_migration",
+      description: "Contains no executable SQL after removing the platform-managed outer transaction wrapper.",
+      recommendation: "Remove the empty migration file or add the intended project-scoped SQL statement.",
+      statementSnippet: sql.replace(/\s+/g, " ").slice(0, 100),
+      blocksTransactionalPush: true
+    }];
+  }
+  const risks = [];
+  for (const rawStatement of statements) {
+    const masked = maskSqlNoise(rawStatement);
+    const policyMasked = maskSqlPolicyNoise(rawStatement);
+    risks.push(...matchingRisks(rawStatement, masked, RISK_RULES));
+    risks.push(...addedNotNullColumnRisks(rawStatement));
+    risks.push(...matchingRisks(rawStatement, masked, PUSH_BLOCKER_RULES));
+    risks.push(...matchingRisks(rawStatement, policyMasked, QUOTED_FUNCTION_BLOCKER_RULES));
+    risks.push(...matchingRisks(rawStatement, policyMasked, MIGRATION_LEDGER_BLOCKER_RULES));
+  }
+  return risks;
+}
+function analyzeMigrationFiles(files) {
+  const fileRisks = [];
+  let highCount = 0;
+  let mediumCount = 0;
+  let lowCount = 0;
+  let transactionalPushBlockerCount = 0;
+  for (const { file, sql } of files) {
+    const risks = analyzeMigrationSql(sql);
+    transactionalPushBlockerCount += risks.filter((risk) => risk.blocksTransactionalPush).length;
+    let fileLevel = "LOW";
+    for (const risk of risks) {
+      if (risk.level === "HIGH") {
+        fileLevel = "HIGH";
+        highCount++;
+      } else if (risk.level === "MEDIUM") {
+        if (fileLevel !== "HIGH")
+          fileLevel = "MEDIUM";
+        mediumCount++;
+      }
+    }
+    if (fileLevel === "LOW") {
+      lowCount++;
+    }
+    fileRisks.push({
+      file,
+      overallRisk: fileLevel,
+      risks
+    });
+  }
+  let overallRisk = "LOW";
+  if (highCount > 0)
+    overallRisk = "HIGH";
+  else if (mediumCount > 0)
+    overallRisk = "MEDIUM";
+  return {
+    overallRisk,
+    highRiskCount: highCount,
+    mediumRiskCount: mediumCount,
+    lowRiskCount: lowCount,
+    transactionalPushBlockerCount,
+    files: fileRisks
+  };
+}
+function formatMigrationRiskReport(analysis) {
+  const lines = [];
+  const riskIcon = analysis.overallRisk === "HIGH" ? "\uD83D\uDD34" : analysis.overallRisk === "MEDIUM" ? "\uD83D\uDFE1" : "\uD83D\uDFE2";
+  lines.push(`${riskIcon} Migration Risk Level: ${analysis.overallRisk}`);
+  lines.push(`Total issues detected: ${analysis.highRiskCount} High (Destructive), ${analysis.mediumRiskCount} Medium (Locking/Constraint)`);
+  const filesWithRisks = analysis.files.filter((fileRisk) => fileRisk.risks.length > 0);
+  if (!filesWithRisks.length) {
+    lines.push("", "✅ All migrations follow safe, non-blocking Expand-Contract patterns.");
+    return lines.join(`
+`);
+  }
+  lines.push("", "Detailed Findings:");
+  for (const { file, overallRisk, risks } of filesWithRisks) {
+    const fileIcon = overallRisk === "HIGH" ? "\uD83D\uDD34" : "\uD83D\uDFE1";
+    lines.push(`  ${fileIcon} ${file} [${overallRisk}]`);
+    for (const risk of risks) {
+      lines.push(`    - [${risk.level}] ${risk.description}`);
+      if (risk.statementSnippet) {
+        lines.push(`      Snippet: ${risk.statementSnippet}`);
+      }
+      lines.push(`      \uD83D\uDCA1 Suggestion: ${risk.recommendation}`);
+    }
+  }
+  return lines.join(`
+`);
+}
+
 // src/shared/tools/database-tools.ts
 var MAX_MIGRATION_VERSION = 9223372036854775807n;
 var FALLBACK_MIGRATION_VERSION_BASE = 8000000000000000000n;
 var FALLBACK_MIGRATION_VERSION_RANGE = 1000000000000000000n;
 var FALLBACK_MIGRATION_VERSION_LIMIT = FALLBACK_MIGRATION_VERSION_BASE + FALLBACK_MIGRATION_VERSION_RANGE;
 var MAX_MIGRATION_INVENTORY_BYTES = 64 * 1024 * 1024;
+var GENERIC_MIGRATION_NAMES = new Set(["cli_push"]);
 function isMigrationInventoryVersion(version) {
   if (typeof version !== "string" || !/^\d{1,19}$/.test(version))
     return false;
@@ -7155,10 +7787,37 @@ function migrationIdentity(row) {
   if (!isMigrationInventoryVersion(migration.version) || !isMigrationInventoryName(migration.name)) {
     throw new Error("Invalid remote migration identity");
   }
-  return { version: migration.version, name: migration.name, statements: migration.statements };
+  return {
+    version: migration.version,
+    name: migration.name !== null && GENERIC_MIGRATION_NAMES.has(migration.name) ? null : migration.name,
+    statements: migration.statements
+  };
+}
+function historicalMigrationVersion(version) {
+  if (isMigrationInventoryVersion(version))
+    return version;
+  if (typeof version !== "number" || !Number.isSafeInteger(version))
+    return null;
+  const normalized = String(version);
+  return isMigrationInventoryVersion(normalized) ? normalized : null;
+}
+function baselineMigrationIdentity(row) {
+  if (!row || typeof row !== "object" || Array.isArray(row)) {
+    throw new Error("Invalid remote migration identity");
+  }
+  const migration = row;
+  const version = historicalMigrationVersion(migration.version);
+  if (!version || !isMigrationInventoryName(migration.name)) {
+    throw new Error("Invalid remote migration identity");
+  }
+  return {
+    version,
+    name: migration.name !== null && GENERIC_MIGRATION_NAMES.has(migration.name) ? null : migration.name,
+    statements: migration.statements
+  };
 }
-function migrationIdentities(data) {
-  const identities = migrationRows(data).map(migrationIdentity);
+function migrationIdentities(data, parseIdentity) {
+  const identities = migrationRows(data).map(parseIdentity);
   const versions = new Set;
   const names = new Set;
   for (const identity of identities) {
@@ -7201,15 +7860,21 @@ function migrationDisposition(local, remoteMigrations) {
   if (sameVersion[0] && sameName[0] && sameVersion[0] !== sameName[0])
     throw migrationIdentityConflict(local);
   const remote = sameVersion[0] ?? sameName[0];
-  const exactIdentity = remote.version === local.version && remote.name === local.name;
-  if (exactIdentity && exactIdentityIsApplied(local, remote))
+  const versionIdentity = remote.version === local.version && (remote.name === local.name || remote.name === null);
+  if (versionIdentity && exactIdentityIsApplied(local, remote))
     return "applied";
   if (!sameVersion.length && legacyIdentityIsApplied(local, remote))
     return "applied";
   throw migrationIdentityConflict(local);
 }
 function migrationPushPlan(data, migrationFiles) {
-  const remoteMigrations = migrationIdentities(data);
+  return migrationPlan(data, migrationFiles, migrationIdentity);
+}
+function migrationBaselinePlan(data, migrationFiles) {
+  return migrationPlan(data, migrationFiles, baselineMigrationIdentity);
+}
+function migrationPlan(data, migrationFiles, parseIdentity) {
+  const remoteMigrations = migrationIdentities(data, parseIdentity);
   const plan = { alreadyApplied: [], pending: [] };
   for (const migration of migrationFiles) {
     const disposition = migrationDisposition(migration, remoteMigrations);
@@ -7303,6 +7968,13 @@ function confirmedSqlBatchReceipt(payload, expectedCommands) {
     return true;
   });
 }
+function schemaReloadStatus(payload) {
+  const receipt = recordPayload(payload);
+  const schemaReload = recordPayload(receipt?.schema_reload);
+  if (schemaReload?.ddl_committed !== true)
+    return null;
+  return schemaReload.status === "notified" || schemaReload.status === "notification_failed" ? schemaReload.status : null;
+}
 function rlsStatementCommands(policyMode) {
   return [
     "CREATE",
@@ -7347,8 +8019,9 @@ function vectorWarningsForPendingMigrations(migrations, vectorEnabled) {
   return warnings;
 }
 function registerDatabaseTools(server, http, config = {}) {
-  const { readOnly = false, projectRef } = config;
-  const actions = [
+  const { localOnly = false, readOnly = false, projectRef } = config;
+  const localActions = ["lint_migrations", "lint"];
+  const readActions = [
     "query",
     "list_tables",
     "describe_columns",
@@ -7368,16 +8041,21 @@ function registerDatabaseTools(server, http, config = {}) {
     "generate_types"
   ];
   const writeActions = ["apply_migration", "push_migrations", "baseline_migrations", "create_table_rls"];
-  const allActions = readOnly ? actions : [...actions, ...writeActions];
+  const remoteActions = [...readActions, ...localActions];
+  const allActions = localOnly ? localActions : readOnly ? remoteActions : [...remoteActions, ...writeActions];
   server.tool("database", `Database operations: query, schema, RLS, migrations, stats.
-Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
+Actions: ${allActions.join(", ")}${localOnly ? " (local-only mode)" : readOnly ? " (read-only mode)" : ""}`, {
     action: withDescription(stringEnum(allActions), "Action"),
     ref: projectRef ? Type.Optional(Type.String()) : optional(Type.String(), "Project ref"),
-    sql: optional(Type.String(), "[query/apply_migration] SQL statement"),
-    file: optional(Type.String(), "[query/apply_migration] Read SQL from local file path (avoids shell escaping issues with $$ and multi-statement DDL)"),
-    dir: optional(Type.String(), "[push_migrations/baseline_migrations] Directory containing .sql migration files (default: supabase/migrations)"),
+    sql: optional(Type.String(), "[query/apply_migration/lint_migrations/lint] SQL statement"),
+    file: optional(Type.String(), "[query/apply_migration/lint_migrations/lint] Read SQL from local file path (avoids shell escaping issues with $$ and multi-statement DDL)"),
+    dir: optional(Type.String(), "[push_migrations/baseline_migrations/lint_migrations/lint] Directory containing .sql migration files (default: supabase/migrations)"),
     dry_run: optional(Type.Boolean(), "[push_migrations/baseline_migrations] Preview changes without applying them"),
-    schema: optional(Type.String(), "[*] Schema name (default: public)"),
+    strict: optional(Type.Boolean(), "[push_migrations/lint_migrations/lint] Exit with error if high-risk destructive migrations are detected"),
+    fail_on_high: optional(Type.Boolean(), "[push_migrations/lint_migrations/lint] Alias for --strict"),
+    fail_on_medium: optional(Type.Boolean(), "[push_migrations/lint_migrations/lint] Exit with error if medium-risk or high-risk migrations are detected"),
+    json: optional(Type.Boolean(), "[lint_migrations/lint] Output structured JSON analysis"),
+    schema: optional(Type.String(), "[describe_columns/list_indexes/list_constraints/rls_status/rls_policies/create_table_rls] Schema name (default: public)"),
     table: optional(Type.String(), "[describe_columns/indexes/constraints/rls_*] Table name"),
     schemas: optional(Type.Array(Type.String()), "[list_tables/generate_types] Schemas array"),
     user_id: optional(Type.String(), "[get_auth_user] User UUID"),
@@ -7388,17 +8066,25 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
     owner_column: optional(Type.String(), "[create_table_rls owner] UUID owner column matched to auth.uid()")
   }, async (args) => {
     const { action } = args;
+    if (localOnly && action !== "lint_migrations" && action !== "lint") {
+      throw new Error(`Database action '${String(action)}' requires Management API context`);
+    }
+    const managementHttp = () => {
+      if (!http)
+        throw new Error(`Database action '${String(action)}' requires Management API context`);
+      return http;
+    };
     const ref = args.ref || projectRef;
     const schema = args.schema || "public";
     const schemas = args.schemas || ["public"];
-    if (args.file && !args.sql) {
+    if (args.file && !args.sql && action !== "lint_migrations" && action !== "lint") {
       try {
         args.sql = readFileSync2(args.file, "utf-8");
       } catch (e) {
         return { content: [{ type: "text", text: `❌ Failed to read file ${args.file}: ${e.message}` }] };
       }
     }
-    const execSql = async (sql, mode) => http.post(`/v1/projects/${ref}/database/sql`, mode ? { sql, mode } : { sql });
+    const execSql = async (sql, mode) => managementHttp().post(`/v1/projects/${ref}/database/sql`, mode ? { sql, mode } : { sql });
     let text;
     switch (action) {
       case "query": {
@@ -7504,11 +8190,11 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
         break;
       }
       case "migration_inventory": {
-        const response = await http.get(migrationInventoryPath(ref), { maxResponseBytes: MAX_MIGRATION_INVENTORY_BYTES });
+        const response = await managementHttp().get(migrationInventoryPath(ref), { maxResponseBytes: MAX_MIGRATION_INVENTORY_BYTES });
         return migrationInventoryResponse(response);
       }
       case "project_url": {
-        const r = await http.get(`/v1/projects/${ref}`);
+        const r = await managementHttp().get(`/v1/projects/${ref}`);
         text = r.ok ? JSON.stringify({ url: r.data.api?.url || `https://${ref}.supabase.co` }, null, 2) : `❌ Failed (${r.status})`;
         break;
       }
@@ -7518,10 +8204,49 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
         text = r.ok ? generateTypeScriptTypes(r.data, schemas) : `❌ Failed (${r.status})`;
         break;
       }
+      case "lint_migrations":
+      case "lint": {
+        let migrationFiles = [];
+        const explicitInputs = [args.sql, args.file, args.dir].filter((input) => typeof input === "string" && input.length > 0);
+        if (explicitInputs.length > 1) {
+          throw new Error("Use only one of --sql, --file, or --dir for migration lint");
+        }
+        if (args.sql) {
+          migrationFiles = [{ file: "inline.sql", sql: args.sql }];
+        } else if (args.file) {
+          if (!existsSync2(args.file) || !statSync(args.file).isFile()) {
+            throw new Error(`Migration file not found: ${args.file}`);
+          }
+          migrationFiles = [{ file: args.file, sql: readFileSync2(args.file, "utf8") }];
+        } else {
+          const dir = args.dir || "supabase/migrations";
+          if (!existsSync2(dir) || !statSync(dir).isDirectory()) {
+            throw new Error(`Migration directory not found: ${dir}`);
+          }
+          const files = readdirSync(dir).filter((file) => file.endsWith(".sql")).sort();
+          if (!files.length) {
+            text = `No .sql migration files found in ${dir}`;
+            break;
+          }
+          migrationFiles = sortMigrationFiles(files.map((file) => readMigrationFile(dir, file)));
+        }
+        const analysis = analyzeMigrationFiles(migrationFiles);
+        if (args.json) {
+          text = JSON.stringify(analysis, null, 2);
+        } else {
+          text = formatMigrationRiskReport(analysis);
+        }
+        const strict = args.strict === true || args.fail_on_high === true;
+        const failOnMedium = args.fail_on_medium === true;
+        if (strict && analysis.highRiskCount > 0 || failOnMedium && (analysis.highRiskCount > 0 || analysis.mediumRiskCount > 0)) {
+          return { content: [{ type: "text", text }], isError: true };
+        }
+        break;
+      }
       case "apply_migration": {
         if (!args.name || !args.sql)
           throw new Error("'name' and 'sql' required");
-        const r = await http.postReleaseMutation(`/v1/projects/${ref}/database/migrations`, { name: args.name, sql: args.sql });
+        const r = await managementHttp().postReleaseMutation(`/v1/projects/${ref}/database/migrations`, { name: args.name, sql: args.sql });
         if (!r.ok)
           return releaseControlMutationFailure("database.apply_migration", r);
         if (r.status !== 200) {
@@ -7544,14 +8269,18 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
           break;
         }
         const migrationFiles = sortMigrationFiles(files.map((file) => readMigrationFile(dir, file)));
-        const migrationsResult = await http.get(`/v1/projects/${ref}/database/migrations`);
+        const migrationsResult = await managementHttp().get(`/v1/projects/${ref}/database/migrations`);
         if (!migrationsResult.ok) {
           return releaseControlFailure("database.push_migrations", "HTTP_ERROR", migrationsResult.transportError ? null : migrationsResult.status);
         }
-        const migrationPlan = migrationPushPlan(migrationsResult.data, migrationFiles);
+        const migrationPlan2 = migrationPushPlan(migrationsResult.data, migrationFiles);
+        const riskAnalysis = analyzeMigrationFiles(migrationPlan2.pending);
+        const strict = args.strict === true || args.fail_on_high === true;
+        const failOnMedium = args.fail_on_medium === true;
+        const riskPolicyFailed = strict && riskAnalysis.highRiskCount > 0 || failOnMedium && (riskAnalysis.highRiskCount > 0 || riskAnalysis.mediumRiskCount > 0);
         if (args.dry_run) {
-          const pending2 = migrationPlan.pending;
-          const alreadyApplied = migrationPlan.alreadyApplied;
+          const pending2 = migrationPlan2.pending;
+          const alreadyApplied = migrationPlan2.alreadyApplied;
           const pendingWithSql = pending2;
           let vectorEnabled = null;
           if (pendingWithSql.some(({ sql }) => sqlReferencesVector(sql) || sqlCreatesVectorExtension(sql))) {
@@ -7559,6 +8288,7 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
             vectorEnabled = extResult.ok ? extensionRows(extResult.data).some((row) => row.name === "vector" || row.extname === "vector") : null;
           }
           const warnings = vectorWarningsForPendingMigrations(pendingWithSql, vectorEnabled);
+          const riskReport = formatMigrationRiskReport(riskAnalysis);
           text = [
             `Migration dry run for ${dir}`,
             `Total: ${migrationFiles.length}`,
@@ -7568,12 +8298,43 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
             "",
             "Already applied:",
             ...alreadyApplied.length ? alreadyApplied.map(({ file, version }) => `  - ${file} (${version})`) : ["  - none"],
-            ...warnings.length ? ["", "Warnings:", ...warnings.map((warning) => `  - ${warning}`)] : []
+            ...warnings.length ? ["", "Warnings:", ...warnings.map((warning) => `  - ${warning}`)] : [],
+            "",
+            "Risk Assessment:",
+            ...riskReport.split(`
+`).map((line) => `  ${line}`)
           ].join(`
 `);
-          break;
+          return {
+            content: [{ type: "text", text }],
+            ...riskPolicyFailed || riskAnalysis.transactionalPushBlockerCount > 0 ? { isError: true } : {}
+          };
         }
-        const pending = new Set(migrationPlan.pending.map(({ file }) => file));
+        if (riskAnalysis.transactionalPushBlockerCount > 0) {
+          const riskReport = formatMigrationRiskReport(riskAnalysis);
+          return {
+            content: [{
+              type: "text",
+              text: `❌ Migration push aborted because the transactional executor cannot run one or more statements:
+
+${riskReport}`
+            }],
+            isError: true
+          };
+        }
+        if (riskPolicyFailed) {
+          const riskReport = formatMigrationRiskReport(riskAnalysis);
+          return {
+            content: [{
+              type: "text",
+              text: `❌ Migration push aborted due to strict risk policy:
+
+${riskReport}`
+            }],
+            isError: true
+          };
+        }
+        const pending = new Set(migrationPlan2.pending.map(({ file }) => file));
         const applied = [];
         const skipped = [];
         for (const { file, name, version, sql } of migrationFiles) {
@@ -7581,7 +8342,7 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
             skipped.push(file);
             continue;
           }
-          const r = await http.postReleaseMutation(`/v1/projects/${ref}/database/migrations`, { name, sql, version });
+          const r = await managementHttp().postReleaseMutation(`/v1/projects/${ref}/database/migrations`, { name, sql, version });
           if (r.ok && r.status === 200 && confirmedMigrationReceipt(r.data, { name, version, sql })) {
             applied.push(file);
           } else if (isAlreadyAppliedMigrationResponse(r, { name, version, sql })) {
@@ -7615,13 +8376,13 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
           break;
         }
         const migrationFiles = sortMigrationFiles(files.map((file) => readMigrationFile(dir, file)));
-        const r = await http.get(`/v1/projects/${ref}/database/migrations`);
+        const r = await managementHttp().get(`/v1/projects/${ref}/database/migrations`);
         if (!r.ok) {
           return releaseControlFailure("database.baseline_migrations", "HTTP_ERROR", r.transportError ? null : r.status);
         }
-        const migrationPlan = migrationPushPlan(r.data, migrationFiles);
-        const missing = migrationPlan.pending;
-        const alreadyApplied = migrationPlan.alreadyApplied;
+        const migrationPlan2 = migrationBaselinePlan(r.data, migrationFiles);
+        const missing = migrationPlan2.pending;
+        const alreadyApplied = migrationPlan2.alreadyApplied;
         if (args.dry_run) {
           text = [
             `Migration baseline dry run for ${dir}`,
@@ -7644,7 +8405,7 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
 `);
           break;
         }
-        const baselineResult = await http.postReleaseMutation(`/v1/projects/${ref}/database/migrations/baseline`, { migrations: missing.map(({ name, version }) => ({ name, version })) });
+        const baselineResult = await managementHttp().postReleaseMutation(`/v1/projects/${ref}/database/migrations/baseline`, { migrations: missing.map(({ name, version }) => ({ name, version })) });
         if (!baselineResult.ok) {
           return releaseControlMutationFailure("database.baseline_migrations", baselineResult);
         }
@@ -7655,7 +8416,7 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
         if (!receipt) {
           return releaseControlFailure("database.baseline_migrations", "OUTCOME_UNKNOWN", baselineResult.status);
         }
-        const inventoryResult = await http.get(`/v1/projects/${ref}/database/migrations`, { maxResponseBytes: MAX_MIGRATION_INVENTORY_BYTES });
+        const inventoryResult = await managementHttp().get(`/v1/projects/${ref}/database/migrations`, { maxResponseBytes: MAX_MIGRATION_INVENTORY_BYTES });
         if (!inventoryResult.ok || !baselineInventoryIsApplied(inventoryResult.data, missing)) {
           return releaseControlFailure("database.baseline_migrations", "OUTCOME_UNKNOWN", inventoryResult.transportError ? null : inventoryResult.status);
         }
@@ -7678,7 +8439,7 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
           throw new Error("Invalid RLS policy mode");
         const policySql = buildRlsPolicySql(qualifiedTable, policyMode, args.owner_column);
         const sql = `BEGIN; CREATE TABLE IF NOT EXISTS ${qualifiedTable} (${columns}); ALTER TABLE ${qualifiedTable} ENABLE ROW LEVEL SECURITY; ${policySql} COMMIT;`;
-        const r = await http.postReleaseMutation(`/v1/projects/${ref}/database/sql`, { sql, mode: "migration" });
+        const r = await managementHttp().postReleaseMutation(`/v1/projects/${ref}/database/sql`, { sql, mode: "migration" });
         if (!r.ok)
           return releaseControlMutationFailure("database.create_table_rls", r);
         if (r.status !== 200) {
@@ -7687,6 +8448,13 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
         if (!confirmedSqlBatchReceipt(r.data, rlsStatementCommands(policyMode))) {
           return releaseControlFailure("database.create_table_rls", "OUTCOME_UNKNOWN", r.status);
         }
+        const reloadStatus = schemaReloadStatus(r.data);
+        if (reloadStatus === "notification_failed") {
+          return releaseControlFailure("database.create_table_rls", "PARTIAL_SUCCESS", r.status, { ddl_committed: true, schema_reload: { status: reloadStatus } });
+        }
+        if (reloadStatus !== "notified") {
+          return releaseControlFailure("database.create_table_rls", "OUTCOME_UNKNOWN", r.status);
+        }
         text = `✅ Table '${schema}.${args.table}' created with RLS (${policyMode === "owner" ? "auth.uid() owner policy" : "deny-all by default"})`;
         break;
       }
@@ -7975,6 +8743,7 @@ var MAX_AUTH_READ_BYTES = 64 * 1024;
 var AUTH_READ_TIMEOUT_MS = 5000;
 var USER_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var AUTH_LINK_TYPES = ["magiclink", "recovery", "invite"];
+var OAUTH_AUTHORIZATION_PATH_MAX_LENGTH = 2048;
 var SAFE_USER_FIELDS = [
   "email",
   "phone",
@@ -8044,6 +8813,81 @@ function requiredRef(candidate) {
     throw new Error("'ref' is required");
   return projectRefPathSegment(candidate.trim(), "Auth");
 }
+function optionalAuthorizationPath(candidate) {
+  if (candidate === undefined)
+    return;
+  return boundedText(candidate, "authorization_path", OAUTH_AUTHORIZATION_PATH_MAX_LENGTH);
+}
+function oauthServerStatus(value, expectedRef) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const status = value;
+  if (status.project_ref !== expectedRef || typeof status.enabled !== "boolean" || typeof status.allow_dynamic_registration !== "boolean" || typeof status.issuer !== "string" || typeof status.signing_alg !== "string" || typeof status.oidc_id_token_ready !== "boolean" || typeof status.migration_status !== "string")
+    return null;
+  return {
+    project_ref: status.project_ref,
+    enabled: status.enabled,
+    allow_dynamic_registration: status.allow_dynamic_registration,
+    issuer: status.issuer,
+    authorization_path: typeof status.authorization_path === "string" ? status.authorization_path : null,
+    signing_alg: status.signing_alg,
+    key_id: typeof status.key_id === "string" ? status.key_id : null,
+    oidc_id_token_ready: status.oidc_id_token_ready,
+    migration_status: status.migration_status
+  };
+}
+function oauthServerFailure(operation, response) {
+  return {
+    isError: true,
+    content: [{
+      type: "text",
+      text: JSON.stringify({
+        ok: false,
+        operation,
+        http_status: response.transportError || response.responseReadError ? null : response.status,
+        error: response.responseReadError ? "INVALID_RESPONSE" : response.transportError ? "NETWORK_ERROR" : "HTTP_ERROR"
+      }, null, 2)
+    }]
+  };
+}
+async function getOAuthServer(http, ref) {
+  const response = await http.get(`/v1/projects/${ref}/auth/oauth-server`, {
+    maxJsonBytes: MAX_AUTH_READ_BYTES,
+    responseTimeoutMs: AUTH_READ_TIMEOUT_MS
+  });
+  if (!response.ok)
+    return oauthServerFailure("auth.get_oauth_server", response);
+  const status = oauthServerStatus(response.data, ref);
+  if (!status)
+    return oauthServerFailure("auth.get_oauth_server", { ...response, responseReadError: true });
+  return { content: [{ type: "text", text: JSON.stringify({ ok: true, operation: "auth.get_oauth_server", ...status }, null, 2) }] };
+}
+async function migrateOAuthServer(http, args) {
+  const ref = requiredRef(args.ref);
+  const body = {
+    allow_dynamic_registration: args.allow_dynamic_registration === true
+  };
+  const authorizationPath = optionalAuthorizationPath(args.authorization_path);
+  if (authorizationPath !== undefined)
+    body.authorization_path = authorizationPath;
+  const mutation = await http.postReleaseMutation(`/v1/projects/${ref}/auth/oauth-server/migrate`, body);
+  if (!mutation.ok)
+    return oauthServerFailure("auth.migrate_oauth_server", mutation);
+  const mutationStatus = oauthServerStatus(mutation.data, ref);
+  if (!mutationStatus)
+    return oauthServerFailure("auth.migrate_oauth_server", { ...mutation, responseReadError: true });
+  const read = await http.get(`/v1/projects/${ref}/auth/oauth-server`, {
+    maxJsonBytes: MAX_AUTH_READ_BYTES,
+    responseTimeoutMs: AUTH_READ_TIMEOUT_MS
+  });
+  if (!read.ok)
+    return oauthServerFailure("auth.migrate_oauth_server", read);
+  const status = oauthServerStatus(read.data, ref);
+  if (!status || status.signing_alg !== "ES256" || status.oidc_id_token_ready !== true) {
+    return oauthServerFailure("auth.migrate_oauth_server", { ...read, responseReadError: true });
+  }
+  return { content: [{ type: "text", text: JSON.stringify({ ok: true, operation: "auth.migrate_oauth_server", ...status }, null, 2) }] };
+}
 function requiredUserId(candidate) {
   if (typeof candidate !== "string" || !USER_ID_PATTERN.test(candidate.trim())) {
     throw new Error("'user_id' must be a UUID");
@@ -8300,7 +9144,7 @@ function formatProviders(data) {
 }
 function registerAuthTools(server, http) {
   server.tool("auth", `Auth & OAuth provider management, controlled user lookup, and login-link generation.
-Actions: list_users, get_user, generate_link, list_providers, get_provider, configure_provider, update_provider, disable_provider, supported_providers, wechat_mini, wechat_open, get_settings, update_settings, get_config, update_config`, {
+Actions: list_users, get_user, generate_link, list_providers, get_provider, configure_provider, update_provider, disable_provider, supported_providers, wechat_mini, wechat_open, get_settings, update_settings, get_config, update_config, get_oauth_server, migrate_oauth_server`, {
     action: withDescription(stringEnum([
       "list_users",
       "get_user",
@@ -8316,7 +9160,9 @@ Actions: list_users, get_user, generate_link, list_providers, get_provider, conf
       "get_settings",
       "update_settings",
       "get_config",
-      "update_config"
+      "update_config",
+      "get_oauth_server",
+      "migrate_oauth_server"
     ]), "Action to perform"),
     ref: optional(Type.String(), "Project ref (required for most actions)"),
     user_id: optional(Type.String(), "[get_user] Exact auth user UUID"),
@@ -8334,7 +9180,9 @@ Actions: list_users, get_user, generate_link, list_providers, get_provider, conf
     url: optional(Type.String(), "[configure] Custom OAuth URL"),
     app_id: optional(Type.String(), "[wechat_*] WeChat App ID"),
     app_secret: optional(Type.String(), "[wechat_*] WeChat App Secret"),
-    config: optional(authConfigSchema, "[update_settings/update_config] Config fields as a JSON object")
+    config: optional(authConfigSchema, "[update_settings/update_config] Config fields as a JSON object"),
+    allow_dynamic_registration: optional(Type.Boolean(), "[migrate_oauth_server] Enable dynamic client registration"),
+    authorization_path: optional(Type.String(), "[migrate_oauth_server] Hosted OAuth authorization path")
   }, async (args) => {
     const { action, ref, provider, client_id, client_secret, redirect_uri, url, app_id, app_secret, config } = args;
     const need = (f) => {
@@ -8350,6 +9198,10 @@ Actions: list_users, get_user, generate_link, list_providers, get_provider, conf
         return getUser(http, args);
       case "generate_link":
         return generateLink(http, args);
+      case "get_oauth_server":
+        return getOAuthServer(http, requiredRef(ref));
+      case "migrate_oauth_server":
+        return migrateOAuthServer(http, args);
       case "list_providers":
         need("ref");
         const lp = await http.get(`/v1/projects/${ref}/auth/providers`);
@@ -9078,15 +9930,17 @@ import {
   constants as fsConstants,
   existsSync as existsSync3,
   fstatSync,
+  lstatSync,
   mkdtempSync,
   openSync,
   readFileSync as readFileSync3,
+  readdirSync as readdirSync2,
   rmSync,
   statSync as statSync2,
   writeFileSync
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename as basename2, join as join2, resolve as resolve2 } from "node:path";
+import { basename as basename2, join as join2, relative, resolve as resolve2, sep } from "node:path";
 import { promisify } from "node:util";
 import { execFile } from "node:child_process";
 
@@ -9240,6 +10094,7 @@ function confirmedFunctionDeletion(payload, expectation) {
 // src/shared/tools/advanced-tools.ts
 var execFileAsync = promisify(execFile);
 var SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/;
+var FORBIDDEN_BUNDLE_SEGMENTS = new Set(["node_modules", ".git"]);
 function openFileIdentity(descriptor) {
   const state = fstatSync(descriptor, { bigint: true });
   if (!state.isFile())
@@ -9294,6 +10149,51 @@ function readVerifiedPrebundledCode(pathArg, expectedSha256) {
     closeSync(descriptor);
   }
 }
+function canonicalBundlePath(root, filePath) {
+  const bundlePath = relative(root, filePath).split(sep).join("/");
+  const segments = bundlePath.split("/");
+  if (!bundlePath || bundlePath.startsWith("/") || segments.some((segment) => !segment || segment === "." || segment === ".." || segment.startsWith("._") || FORBIDDEN_BUNDLE_SEGMENTS.has(segment))) {
+    throw new Error(`Bundle directory contains a forbidden path: ${bundlePath || filePath}`);
+  }
+  return bundlePath;
+}
+function readBundleDirectory(root, directory = root) {
+  const files = {};
+  const entries = readdirSync2(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
+  for (const entry of entries) {
+    const entryPath = join2(directory, entry.name);
+    const bundlePath = canonicalBundlePath(root, entryPath);
+    const entryState = lstatSync(entryPath);
+    if (entryState.isSymbolicLink())
+      throw new Error(`Bundle directory must not contain symlinks: ${bundlePath}`);
+    if (entryState.isDirectory()) {
+      Object.assign(files, readBundleDirectory(root, entryPath));
+      continue;
+    }
+    if (!entryState.isFile())
+      throw new Error(`Bundle directory must contain only regular files: ${bundlePath}`);
+    files[bundlePath] = verifiedUtf8Code(readFileSync3(entryPath));
+  }
+  return files;
+}
+function preparedBundleFiles(args) {
+  const files = args.files;
+  const bundleDirectory = args["bundle-dir"];
+  if (files === undefined === (bundleDirectory === undefined)) {
+    throw new Error("Exactly one of '--files' or '--bundle-dir' is required for 'deploy_bundle'");
+  }
+  if (typeof bundleDirectory !== "string")
+    return files;
+  const resolvedDirectory = resolve2(bundleDirectory);
+  const rootState = lstatSync(resolvedDirectory);
+  if (rootState.isSymbolicLink() || !rootState.isDirectory()) {
+    throw new Error("'--bundle-dir' must be a regular directory and must not be a symlink");
+  }
+  const bundleFiles = readBundleDirectory(resolvedDirectory);
+  if (Object.keys(bundleFiles).length === 0)
+    throw new Error("'--bundle-dir' must not be empty");
+  return bundleFiles;
+}
 async function runBunBuild(args) {
   try {
     return await execFileAsync("bun", ["build", ...args], { maxBuffer: 10 * 1024 * 1024 });
@@ -9359,12 +10259,15 @@ async function bundledDeployCode(pathArg) {
     throw new Error(`Failed to bundle/read path ${pathArg}: ${message}`);
   }
 }
-function rejectPrebundledFlagsOutsideDeploy(action, args) {
+function rejectActionSpecificFlags(action, args) {
   for (const flag of ["prebundled-path", "expected-sha256"]) {
     if (action !== "deploy" && args[flag] !== undefined) {
       throw new Error(`'--${flag}' is not supported for '${action}'`);
     }
   }
+  if (action !== "deploy_bundle" && args["bundle-dir"] !== undefined) {
+    throw new Error(`'--bundle-dir' is not supported for '${action}'`);
+  }
 }
 function resolveEntrypoint(pathArg) {
   const resolved = resolve2(pathArg);
@@ -9794,6 +10697,7 @@ Actions: list, get_config, deploy, deploy_bundle, config, source, activate, dele
     "expected-sha256": optional(Type.String({ pattern: SHA256_HEX_PATTERN.source, minLength: 64, maxLength: 64 }), "[deploy] Required lowercase SHA-256 of the exact prebundled-path bytes"),
     output: optional(Type.String(), "[source] Write source to this local file instead of stdout; the file must not already exist"),
     files: optional(functionFilesSchema, "[deploy_bundle] File map as a JSON object: { 'index.ts': '...', '_shared/x.ts': '...' }"),
+    "bundle-dir": optional(Type.String(), "[deploy_bundle] Local self-contained UTF-8 bundle directory; excludes node_modules, .git, AppleDouble, symlinks, and special files"),
     entrypoint: optional(Type.String(), "[deploy_bundle] Entrypoint file (default: index.ts)"),
     minify: optional(Type.Boolean(), "[deploy/deploy_bundle] Minify bundle"),
     verify_jwt: optional(Type.Boolean(), "[deploy/deploy_bundle/config] Set JWT verification for this function"),
@@ -9803,8 +10707,8 @@ Actions: list, get_config, deploy, deploy_bundle, config, source, activate, dele
   }, async (args) => {
     if (args.action === "activate")
       return activateFunctionVersion(http, args, options.readOnly);
-    const { action, ref, slug, path: pathArg, output, files, entrypoint, minify, verify_jwt, background_routes } = args;
-    rejectPrebundledFlagsOutsideDeploy(action, args);
+    const { action, ref, slug, path: pathArg, output, entrypoint, minify, verify_jwt, background_routes } = args;
+    rejectActionSpecificFlags(action, args);
     const expectedActiveVersion = action === "deploy" || action === "deploy_bundle" ? requiredExpectedActiveVersion(args, action) : undefined;
     const expectedActivationId = FUNCTION_IDENTITY_MUTATIONS.has(action) ? requiredExpectedActivationId(args, action) : undefined;
     let code = args.code;
@@ -9884,9 +10788,9 @@ ${deployCheck.err}`;
         }, deploymentResponse);
       case "deploy_bundle":
         need("slug", slug);
-        need("files", files);
+        const deployBundleFiles = preparedBundleFiles(args);
         const bundleResponse = await http.postReleaseMutation(`${edgeFunctionResourcePath(ref, slug)}/bundle`, {
-          files,
+          files: deployBundleFiles,
           entrypoint,
           minify,
           expected_active_version: expectedActiveVersion,
@@ -11988,33 +12892,33 @@ function registerSupabaseCliTools(server, options = {}) {
 import {
   cpSync,
   existsSync as existsSync6,
-  lstatSync,
+  lstatSync as lstatSync2,
   mkdirSync as mkdirSync2,
   mkdtempSync as mkdtempSync2,
-  readdirSync as readdirSync2,
+  readdirSync as readdirSync3,
   readFileSync as readFileSync5,
   renameSync,
   rmSync as rmSync2
 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname2, join as join4, relative, resolve as resolve4, sep } from "node:path";
+import { dirname as dirname2, join as join4, relative as relative2, resolve as resolve4, sep as sep2 } from "node:path";
 import { fileURLToPath } from "node:url";
 var SKILL_NAME = "supacloud-cli";
 function regularFiles(rootDirectory, currentDirectory = rootDirectory) {
   const files = [];
-  for (const directoryEntry of readdirSync2(currentDirectory, { withFileTypes: true })) {
+  for (const directoryEntry of readdirSync3(currentDirectory, { withFileTypes: true })) {
     const entryPath = join4(currentDirectory, directoryEntry.name);
     if (directoryEntry.isSymbolicLink())
       throw new Error(`Skill directories cannot contain symlinks: ${entryPath}`);
     if (directoryEntry.isDirectory())
       files.push(...regularFiles(rootDirectory, entryPath));
     if (directoryEntry.isFile())
-      files.push(relative(rootDirectory, entryPath).split(sep).join("/"));
+      files.push(relative2(rootDirectory, entryPath).split(sep2).join("/"));
   }
   return files.sort();
 }
 function directoriesMatch(sourceDirectory, destinationDirectory) {
-  if (!existsSync6(destinationDirectory) || !lstatSync(destinationDirectory).isDirectory())
+  if (!existsSync6(destinationDirectory) || !lstatSync2(destinationDirectory).isDirectory())
     return false;
   const sourceFiles = regularFiles(sourceDirectory);
   const destinationFiles = regularFiles(destinationDirectory);
@@ -12844,6 +13748,10 @@ var RELEASE_READ_RESPONSE_TIMEOUT_MS = 5000;
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var RELEASE_CANARY_TENANT_KEY = /^release-canary-[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var RELEASE_CANARY_STAGE_RECEIPT_KEYS = new Set(["fixtureId", "tenantKey", "state", "idempotent"]);
+var RELEASE_CANARY_DISABLE_RECEIPT_KEYS = new Set(["fixtureId", "state", "idempotent"]);
+var RELEASE_CANARY_DISABLE_RPC_PATH = "/rest/v1/rpc/fa_release_canary_fixture_disable";
+var RELEASE_CANARY_PENDING_RPC_PATH = "/rest/v1/rpc/fa_release_canary_fixture_pending";
+var RELEASE_CANARY_CLAIM_MAX_LENGTH = 2048;
 function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -12993,27 +13901,79 @@ function releaseCanaryStageReceipt(value) {
     idempotent: true
   };
 }
+function releaseCanaryIssuer(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > RELEASE_CANARY_CLAIM_MAX_LENGTH || value !== value.trim() || /[\u0000-\u001f\u007f]/u.test(value)) {
+    throw new Error("'issuer' must be a bounded absolute HTTP(S) issuer");
+  }
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error("'issuer' must be a bounded absolute HTTP(S) issuer");
+  }
+  const loopbackHttp = parsed.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname) && parsed.port.length > 0;
+  if (parsed.protocol !== "https:" && !loopbackHttp || parsed.username || parsed.password || parsed.search || parsed.hash) {
+    throw new Error("'issuer' must be a bounded absolute HTTP(S) issuer");
+  }
+  return value;
+}
+function releaseCanaryDisableInput(fixtureId, disableRequestId, issuer, subject) {
+  if (typeof fixtureId !== "string" || !UUID.test(fixtureId)) {
+    throw new Error("'fixture_id' must be a canonical UUID");
+  }
+  if (typeof disableRequestId !== "string" || !UUID.test(disableRequestId)) {
+    throw new Error("'disable_request_id' must be a canonical UUID");
+  }
+  if (typeof subject !== "string" || !UUID.test(subject)) {
+    throw new Error("'subject' must be a canonical UUID");
+  }
+  return {
+    p_fixture_id: fixtureId,
+    p_disable_request_id: disableRequestId,
+    p_issuer: releaseCanaryIssuer(issuer),
+    p_subject: subject
+  };
+}
+function releaseCanaryDisableReceipt(receiptCandidate, fixtureId) {
+  if (!isRecord3(receiptCandidate) || Object.keys(receiptCandidate).some((key) => !RELEASE_CANARY_DISABLE_RECEIPT_KEYS.has(key)) || Object.keys(receiptCandidate).length !== RELEASE_CANARY_DISABLE_RECEIPT_KEYS.size || receiptCandidate.fixtureId !== fixtureId || receiptCandidate.state !== "disabled" || typeof receiptCandidate.idempotent !== "boolean")
+    return null;
+  return { fixtureId, state: "disabled", idempotent: receiptCandidate.idempotent };
+}
+function releaseCanaryPendingPath(request) {
+  const params = new URLSearchParams({
+    p_issuer: request.p_issuer,
+    p_subject: request.p_subject
+  });
+  return `${RELEASE_CANARY_PENDING_RPC_PATH}?${params.toString()}`;
+}
+function releaseCanaryPendingReadback(readbackCandidate) {
+  return readbackCandidate === false;
+}
 async function applicationOriginMatches(http, projectRef2, applicationOrigin) {
-  const endpointRead = await http.get(`${endpoint(projectRef2)}/endpoint/projection`, { maxResponseBytes: PROJECT_ENDPOINT_RESPONSE_MAX_BYTES });
+  const endpointRead = await http.get(`${endpoint(projectRef2)}/endpoint/projection`, { maxJsonBytes: PROJECT_ENDPOINT_RESPONSE_MAX_BYTES, responseTimeoutMs: RELEASE_READ_RESPONSE_TIMEOUT_MS });
   return projectApiOrigins(endpointRead, projectRef2)?.includes(applicationOrigin) === true;
 }
 function registerReleaseTools(server, http, options = {}) {
-  server.tool("release", "Verified release controls. Management actions use the Management API; release_canary_fixture_stage_replay additionally requires the selected project's SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY.", {
+  server.tool("release", "Verified release controls. Management actions use the Management API; release canary stage/disable replay additionally require the selected project's SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY.", {
     action: withDescription(stringEnum([
       "logical_backup_list",
       "logical_backup_create",
       "logical_backup_restore",
       "postgrest_status",
       "postgrest_restart",
-      "release_canary_fixture_stage_replay"
+      "release_canary_fixture_stage_replay",
+      "release_canary_fixture_disable_replay"
     ]), "Release control action"),
     ref: optional(Type.String(), options.projectRef ? "Optional override when not auto-linked" : "Project ref"),
     backup_id: optional(Type.String(), "[logical_backup_restore] Exact verified logical-full backup ID from the selected project inventory"),
     expected_sha256: optional(Type.String(), "[logical_backup_restore] Exact lowercase SHA-256 from the selected project inventory"),
     restore_confirmation: optional(Type.String(), "[logical_backup_restore] Exact RESTORE_PROJECT:<ref>:<backup_id>:<sha256> confirmation"),
-    subject: optional(Type.String(), "[release_canary_fixture_stage_replay] Exact central subject UUID"),
-    request_id: optional(Type.String(), "[release_canary_fixture_stage_replay] Exact idempotent stage request UUID")
-  }, async ({ action, ref, backup_id, expected_sha256, restore_confirmation, subject, request_id }) => {
+    subject: optional(Type.String(), "[release_canary_fixture_stage_replay/disable_replay] Exact central subject UUID"),
+    request_id: optional(Type.String(), "[release_canary_fixture_stage_replay] Exact idempotent stage request UUID"),
+    fixture_id: optional(Type.String(), "[release_canary_fixture_disable_replay] Exact staged fixture UUID"),
+    disable_request_id: optional(Type.String(), "[release_canary_fixture_disable_replay] Exact idempotent disable request UUID"),
+    issuer: optional(Type.String(), "[release_canary_fixture_disable_replay] Exact HTTP(S) issuer")
+  }, async ({ action, ref, backup_id, expected_sha256, restore_confirmation, subject, request_id, fixture_id, disable_request_id, issuer }) => {
     const projectRef2 = typeof ref === "string" && ref || options.projectRef;
     if (!projectRef2)
       throw new Error("'ref' is required for release controls");
@@ -13105,6 +14065,36 @@ function registerReleaseTools(server, http, options = {}) {
         receipt
       });
     }
+    if (action === "release_canary_fixture_disable_replay") {
+      if (!options.applicationHttp || !options.applicationOrigin) {
+        throw new Error("release_canary_fixture_disable_replay requires SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY");
+      }
+      const request = releaseCanaryDisableInput(fixture_id, disable_request_id, issuer, subject);
+      if (!await applicationOriginMatches(http, projectRef2, options.applicationOrigin)) {
+        return releaseControlFailure("release.release_canary.fixture_disable_replay", "INVALID_RESPONSE", null);
+      }
+      const response = await options.applicationHttp.postReleaseMutation(RELEASE_CANARY_DISABLE_RPC_PATH, request);
+      if (!response.ok || response.status !== 200) {
+        return mutationFailure("release.release_canary.fixture_disable_replay", response);
+      }
+      const receipt = releaseCanaryDisableReceipt(response.data, request.p_fixture_id);
+      if (!receipt) {
+        return releaseControlFailure("release.release_canary.fixture_disable_replay", "OUTCOME_UNKNOWN", response.status);
+      }
+      const pendingRequest = {
+        p_issuer: request.p_issuer,
+        p_subject: request.p_subject
+      };
+      const pendingResponse = await options.applicationHttp.get(releaseCanaryPendingPath(pendingRequest), { maxJsonBytes: MUTATION_MAX_BYTES, responseTimeoutMs: RELEASE_READ_RESPONSE_TIMEOUT_MS });
+      if (!pendingResponse.ok || pendingResponse.status !== 200 || !releaseCanaryPendingReadback(pendingResponse.data) || !await applicationOriginMatches(http, projectRef2, options.applicationOrigin)) {
+        return releaseControlFailure("release.release_canary.fixture_disable_replay", "OUTCOME_UNKNOWN", pendingResponse.transportError ? null : pendingResponse.status);
+      }
+      return releaseControlSuccess("release.release_canary.fixture_disable_replay", {
+        project_ref: projectRef2,
+        receipt,
+        pending: false
+      });
+    }
     if (action !== "postgrest_restart")
       throw new Error("Unknown release control action");
     const mutation = await http.postReleaseMutation(`${endpoint(projectRef2)}/services/postgrest/restart`);
@@ -13125,7 +14115,7 @@ function registerReleaseTools(server, http, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.29.0",
+  version: "0.31.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -13354,8 +14344,8 @@ DEFAULT CONTEXT
   Without a selector or project variables, runs use the current project's legacy .env.
   Application status accepts SUPABASE_URL + SUPABASE_SERVICE_ROLE_KEY.
   Management-backed project commands require SUPACLOUD_API_URL +
-  SUPACLOUD_API_TOKEN. Only release release_canary_fixture_stage_replay may additionally use
-  the selected project's SUPABASE_* pair for one application-origin RPC.
+  SUPACLOUD_API_TOKEN. Only release canary stage/disable replay actions may additionally use
+  the selected project's SUPABASE_* pair for fixed application-origin RPCs.
   SUPACLOUD_PROJECT_REF is required when it cannot be inferred from <ref>.api.*.
 
   SUPACLOUD_READ_ONLY=true blocks remote writes. Production writes require an
@@ -13377,12 +14367,14 @@ EXAMPLES
   ${preferredCommand} release postgrest_status --ref abc123
   ${preferredCommand} release postgrest_restart --ref abc123
   ${preferredCommand} release release_canary_fixture_stage_replay --ref abc123 --subject <uuid> --request_id <uuid>
+  ${preferredCommand} release release_canary_fixture_disable_replay --ref abc123 --fixture_id <uuid> --disable_request_id <uuid> --issuer <issuer-url> --subject <uuid>
   ${preferredCommand} queue stats --queue emails
   ${preferredCommand} queue dlq --queue emails --limit 20
   ${preferredCommand} frontend list --ref abc123
   ${preferredCommand} database query --sql "select now()"
   ${preferredCommand} database query --ref abc123 --file ./queries/vector-search.sql
   ${preferredCommand} database migration_inventory --ref abc123
+  ${preferredCommand} database lint_migrations --dir supabase/migrations
   ${preferredCommand} database push_migrations --ref abc123 --dir supabase/migrations --dry_run
   ${preferredCommand} supabase migration_new --name add_accounts
   ${preferredCommand} supabase db_diff --schema public --name add_accounts
@@ -13396,6 +14388,7 @@ EXAMPLES
   ${preferredCommand} edge_functions get_config --ref abc123 --slug hello
   ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello --expected-active-version absent --expected-activation-id legacy
   ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --prebundled-path ./dist/hello.js --expected-sha256 <sha256> --expected-active-version 4 --expected-activation-id <uuid>
+  ${preferredCommand} edge_functions deploy_bundle --ref abc123 --slug supauth --bundle-dir ./artifacts/supacloud-app/function-bundle --entrypoint index.ts --expected-active-version 4 --expected-activation-id <uuid>
   ${preferredCommand} edge_functions activate --ref abc123 --slug hello --version 3 --expected-active-version 4 --expected-activation-id <uuid>
   ${preferredCommand} scheduled_functions list --ref abc123
   ${preferredCommand} mutations status --ref abc123 --mutation_id 00000000-0000-4000-8000-000000000001
@@ -13498,6 +14491,9 @@ function createCliTools(context, confirmProduction) {
   };
   if (context.credentialScope !== "management" || !context.apiUrl || !context.apiToken) {
     registerContextAwareHelp();
+    Object.assign(tools, captureTools((server) => registerDatabaseTools(server, undefined, {
+      localOnly: true
+    })));
     tools.setup_help = {
       schema: {},
       callback: async () => ({