@supacloud/cli 0.32.0 → 0.34.0

package/README.md

@@ -106,6 +106,32 @@ loopback development origins, with the default `:80` likewise omitted. Use
 `SUPACLOUD_PROJECT_REF` when it cannot be inferred from a managed
 `<ref>.api.*` application hostname.
 
+### Immutable frontend releases
+
+The `frontend` command keeps the existing deployment, Git, and legacy ZIP
+actions and also exposes the immutable prebuilt release workflow:
+
+```bash
+supacloud-cli frontend list_releases --ref abc123 --id web
+supacloud-cli frontend get_release --ref abc123 --id web --release_id <sha256>
+supacloud-cli frontend upload_release --ref abc123 --id web --zip_path ./dist.zip
+supacloud-cli frontend activate_release --ref abc123 --id web \
+  --release_id <sha256> \
+  --expected_active_release_id absent \
+  --expected_activation_id absent \
+  --mutation_id <retry-stable-uuid-v4>
+```
+
+`upload_release` hashes and streams an existing regular ZIP file without
+buffering the full archive. The Management API binds the upload to that SHA-256,
+and the CLI reads the immutable release back before reporting success.
+`activate_release` uses both the observed active release and activation IDs as
+optimistic concurrency tokens, then verifies the authoritative active release.
+Use the values returned by `list_releases`; `absent` is valid only when no
+release has been activated. Production uploads and activations require the
+normal exact `--confirm-production <ref>` value, and
+`SUPACLOUD_READ_ONLY=true` blocks both mutations.
+
 ### Verified release controls
 
 `release` is an official CLI entry point for verified Management API controls
@@ -440,6 +466,35 @@ Use `--data_mode full_clone` only for an explicitly approved non-sensitive or
 masked debugging dataset. Whole-database replacement is an administrator-only
 break-glass API mode and is intentionally not exposed by this project CLI.
 
+## SupaCloud Lite CLI adapter
+
+Lite can be used from its standalone `supacloud-lite` CLI and from the main
+`supacloud-cli` through the local-only `lite` module. The adapter never calls
+the Management API, never invokes the official Supabase CLI, and never treats a
+PGlite data directory as a Postgres DSN.
+
+```bash
+supacloud-cli lite migrate --project_dir .
+supacloud-cli lite status --project_dir .
+supacloud-cli lite db_diff --project_dir . --file add_accounts
+supacloud-cli lite db_pull --project_dir . --file remote_schema
+supacloud-cli lite gen_types --project_dir . --output src/database.types.ts
+supacloud-cli lite snapshot_create --project_dir . --output backups/lite.tar.gz
+supacloud-cli lite doctor --project_dir . --json
+supacloud-cli lite start --project_dir . --port 54321
+```
+
+The adapter resolves the executable in this order:
+
+1. `SUPACLOUD_LITE_CLI_BIN`
+2. `<workdir>/node_modules/@supacloud/lite/dist/launcher.cjs`
+3. `supacloud-lite` on `PATH`
+
+Install `@supacloud/lite` or provide an explicit binary before using the
+adapter. Lite actions are local-only, so Management API context and project
+refs are not required. The `supabase` module remains the official CLI adapter;
+use it for upstream Supabase CLI actions and Management-backed remote pushes.
+
 ## Official Supabase CLI adapter
 
 The `supabase` command group is a thin, allowlisted adapter around the official

package/dist/index.js

@@ -6471,6 +6471,24 @@ var ACTION_POLICY = {
     local: ["version", "migration_new", "db_diff", "db_reset", "db_pull", "db_dump", "migration_list", "gen_types"],
     write: ["push"]
   },
+  lite: {
+    local: [
+      "version",
+      "start",
+      "migrate",
+      "status",
+      "keys",
+      "gen_types",
+      "db_reset",
+      "db_diff",
+      "db_pull",
+      "snapshot_create",
+      "snapshot_restore",
+      "upgrade",
+      "inspect",
+      "doctor"
+    ]
+  },
   auth: {
     read: ["list_users", "get_user", "list_providers", "get_provider", "supported_providers", "get_settings", "get_config", "get_oauth_server"],
     write: ["generate_link", "configure_provider", "update_provider", "disable_provider", "wechat_mini", "wechat_open", "update_settings", "update_config", "migrate_oauth_server"]
@@ -6496,8 +6514,8 @@ var ACTION_POLICY = {
   },
   secrets: { read: ["list"], write: ["upsert", "delete"] },
   frontend: {
-    read: ["list", "get", "build_logs", "list_frameworks", "list_records"],
-    write: ["create", "update", "delete", "deploy_git", "deploy_upload", "redeploy", "add_domain", "remove_domain", "set_env"]
+    read: ["list", "get", "build_logs", "list_frameworks", "list_records", "list_releases", "get_release"],
+    write: ["create", "update", "delete", "deploy_git", "deploy_upload", "redeploy", "add_domain", "remove_domain", "set_env", "upload_release", "activate_release"]
   },
   task_events: { read: ["inspect_webhook"], write: ["register_webhook", "unregister_webhook"] },
   diagnostics: { read: ["list_checks", "get_run"], write: ["run_checks", "repair"] },
@@ -6857,6 +6875,7 @@ class HttpTransport {
   async post(path, body, options) {
     const timeoutMs = validatedPostTimeout(options);
     const maxJsonBytes = validatedJsonResponseLimit(options?.maxJsonBytes);
+    const responseTimeoutMs = validatedResponseTimeout(options?.responseTimeoutMs);
     try {
       if (maxJsonBytes === undefined) {
         return await this.mutationWithResponseReader("POST", path, serializedRequestBody(body), responseJsonOrNull, timeoutMs);
@@ -6866,7 +6885,7 @@ class HttpTransport {
         headers: this.headers(),
         body: serializedRequestBody(body)
       }, timeoutMs);
-      const data = await boundedResponseJson(response, maxJsonBytes);
+      const data = await boundedResponseJson(response, maxJsonBytes, responseTimeoutMs);
       return data === null ? responseReadFailure(response.status) : { ok: response.ok, status: response.status, data };
     } catch (error) {
       return transportFailure(error);
@@ -6876,6 +6895,39 @@ class HttpTransport {
     const timeoutMs = validatedPostTimeout(options);
     return this.mutationWithResponseReader("POST", path, serializedRequestBody(body), releaseMutationResponseJson, timeoutMs);
   }
+  async postBinary(path, body, options) {
+    if (options.contentType !== "application/zip") {
+      throw new Error("Binary HTTP content type is invalid");
+    }
+    if (!Number.isSafeInteger(options.contentLength) || options.contentLength < 1 || options.contentLength !== body.byteLength) {
+      throw new RangeError("Binary HTTP body length is invalid");
+    }
+    if (!/^[0-9a-f]{64}$/u.test(options.contentSha256)) {
+      throw new Error("Binary HTTP body SHA-256 is invalid");
+    }
+    const maxJsonBytes = validatedJsonResponseLimit(options.maxJsonBytes);
+    const timeoutMs = validatedPostTimeout(options);
+    const responseTimeoutMs = validatedResponseTimeout(options.responseTimeoutMs);
+    try {
+      const request = {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.token}`,
+          "Content-Type": options.contentType,
+          "Content-Length": String(options.contentLength),
+          "x-supacloud-content-sha256": options.contentSha256,
+          ...this.apiKey ? { apikey: this.apiKey } : {}
+        },
+        body: body.stream,
+        duplex: "half"
+      };
+      const response = await fetchWithRetry(`${this.baseUrl}${path}`, request, timeoutMs);
+      const data = await boundedResponseJson(response, maxJsonBytes, responseTimeoutMs);
+      return data === null ? responseReadFailure(response.status) : { ok: response.ok, status: response.status, data };
+    } catch (error) {
+      return transportFailure(error);
+    }
+  }
   async patchReleaseMutation(path, body) {
     return this.mutationWithResponseReader("PATCH", path, serializedRequestBody(body), releaseMutationResponseJson);
   }
@@ -11016,9 +11068,418 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status}): ${JSON.stringif
 // src/shared/tools/frontend-tools.ts
 import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
 import { basename as basename3 } from "node:path";
+
+// src/shared/tools/frontend-release-control.ts
+import { createHash as createHash3 } from "node:crypto";
+import { constants as fsConstants2 } from "node:fs";
+import { open } from "node:fs/promises";
+import { resolve as resolve3 } from "node:path";
+var PROJECT_REF_PATTERN3 = /^[A-Za-z0-9_-]{1,20}$/u;
+var DEPLOYMENT_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/u;
+var RELEASE_ID_PATTERN = /^[0-9a-f]{64}$/u;
+var MUTATION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+var TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
+var ARCHIVE_MAX_BYTES = 100 * 1024 * 1024;
+var ARCHIVE_CHUNK_BYTES = 64 * 1024;
+var RESPONSE_MAX_BYTES = 1024 * 1024;
+var UPLOAD_REQUEST_TIMEOUT_MS = 10 * 60000;
+var MUTATION_RESPONSE_TIMEOUT_MS = 5000;
+var RELEASE_LIST_LIMIT_MAX = 100;
+function toolResponse(payload) {
+  return { content: [{ type: "text", text: JSON.stringify(payload, null, 2) }] };
+}
+function releaseFailure(operation, code, status) {
+  return {
+    isError: true,
+    content: [{
+      type: "text",
+      text: JSON.stringify({ ok: false, operation, error: { code, http_status: status } })
+    }]
+  };
+}
+function exactKeys(candidate, keys) {
+  const actual = Object.keys(candidate).sort();
+  const expected = [...keys].sort();
+  return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function releaseRecord(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const record = candidate;
+  const keys = [
+    "schema",
+    "project_ref",
+    "deployment_id",
+    "release_id",
+    "sha256",
+    "tree_sha256",
+    "size_bytes",
+    "file_count",
+    "created_at",
+    "kind"
+  ];
+  if (!exactKeys(record, keys) || record.schema !== "supacloud.frontend-release.v1" || typeof record.project_ref !== "string" || !PROJECT_REF_PATTERN3.test(record.project_ref) || typeof record.deployment_id !== "string" || !DEPLOYMENT_ID_PATTERN.test(record.deployment_id) || typeof record.release_id !== "string" || !RELEASE_ID_PATTERN.test(record.release_id) || record.sha256 !== record.release_id || typeof record.tree_sha256 !== "string" || !RELEASE_ID_PATTERN.test(record.tree_sha256) || !Number.isSafeInteger(record.size_bytes) || Number(record.size_bytes) < 1 || !Number.isSafeInteger(record.file_count) || Number(record.file_count) < 1 || !canonicalTimestamp(record.created_at) || record.kind !== "prebuilt_static")
+    return null;
+  return {
+    project_ref: record.project_ref,
+    deployment_id: record.deployment_id,
+    release_id: record.release_id,
+    sha256: record.release_id,
+    tree_sha256: record.tree_sha256,
+    size_bytes: Number(record.size_bytes),
+    file_count: Number(record.file_count),
+    created_at: record.created_at,
+    kind: "prebuilt_static"
+  };
+}
+function releaseEnvelope(candidate, expected) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const envelope = candidate;
+  const release = exactKeys(envelope, ["project_ref", "deployment_id", "release"]) ? releaseRecord(envelope.release) : null;
+  if (!release || envelope.project_ref !== expected.projectRef || envelope.deployment_id !== expected.deploymentId || release.project_ref !== expected.projectRef || release.deployment_id !== expected.deploymentId || release.release_id !== expected.releaseId)
+    return null;
+  return release;
+}
+function canonicalTimestamp(candidate) {
+  if (typeof candidate !== "string" || !TIMESTAMP_PATTERN.test(candidate))
+    return false;
+  const milliseconds = Date.parse(candidate);
+  return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === candidate;
+}
+function nullableIdentity(candidate, pattern) {
+  if (candidate === null)
+    return null;
+  return typeof candidate === "string" && pattern.test(candidate) ? candidate : undefined;
+}
+function releaseInventory(candidate, expected) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const record = candidate;
+  const keys = [
+    "project_ref",
+    "deployment_id",
+    "active_release_id",
+    "active_activation_id",
+    "releases",
+    "next_cursor"
+  ];
+  if (!exactKeys(record, keys) || typeof record.project_ref !== "string" || !PROJECT_REF_PATTERN3.test(record.project_ref) || typeof record.deployment_id !== "string" || !DEPLOYMENT_ID_PATTERN.test(record.deployment_id) || !Array.isArray(record.releases))
+    return null;
+  const activeReleaseId = nullableIdentity(record.active_release_id, RELEASE_ID_PATTERN);
+  const activeActivationId = nullableIdentity(record.active_activation_id, MUTATION_ID_PATTERN);
+  const nextCursor = nullableIdentity(record.next_cursor, RELEASE_ID_PATTERN);
+  const releases = record.releases.map(releaseRecord);
+  if (activeReleaseId === undefined || activeActivationId === undefined || nextCursor === undefined || activeReleaseId === null !== (activeActivationId === null) || releases.some((release) => release === null))
+    return null;
+  const verified = releases;
+  if (new Set(verified.map((release) => release.release_id)).size !== verified.length || verified.some((release) => release.project_ref !== record.project_ref || release.deployment_id !== record.deployment_id) || expected && (record.project_ref !== expected.projectRef || record.deployment_id !== expected.deploymentId))
+    return null;
+  return {
+    project_ref: record.project_ref,
+    deployment_id: record.deployment_id,
+    active_release_id: activeReleaseId,
+    active_activation_id: activeActivationId,
+    releases: verified,
+    next_cursor: nextCursor
+  };
+}
+function releaseEndpoint(projectRef2, deploymentId) {
+  if (!PROJECT_REF_PATTERN3.test(projectRef2))
+    throw new Error("'ref' is invalid for frontend releases");
+  if (!DEPLOYMENT_ID_PATTERN.test(deploymentId))
+    throw new Error("'id' is invalid for frontend releases");
+  return `/v1/projects/${encodeURIComponent(projectRef2)}/frontend/deployments/${encodeURIComponent(deploymentId)}/releases`;
+}
+function releasePath(projectRef2, deploymentId, releaseId) {
+  if (!RELEASE_ID_PATTERN.test(releaseId))
+    throw new Error("'release_id' must be a SHA-256 digest");
+  return `${releaseEndpoint(projectRef2, deploymentId)}/${releaseId}`;
+}
+function sameArchiveIdentity(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
+}
+async function archiveSha256(handle, sizeBytes) {
+  const hash2 = createHash3("sha256");
+  const chunk = new Uint8Array(Math.min(sizeBytes, ARCHIVE_CHUNK_BYTES));
+  for (let offset = 0;offset < sizeBytes; ) {
+    const requested = Math.min(chunk.byteLength, sizeBytes - offset);
+    const { bytesRead } = await handle.read(chunk, 0, requested, offset);
+    if (bytesRead < 1)
+      throw new Error("Frontend release archive changed while it was hashed");
+    hash2.update(chunk.subarray(0, bytesRead));
+    offset += bytesRead;
+  }
+  return hash2.digest("hex");
+}
+async function verifiedArchive(path) {
+  const archivePath = resolve3(path);
+  const handle = await open(archivePath, fsConstants2.O_RDONLY | fsConstants2.O_NOFOLLOW);
+  try {
+    const before = await handle.stat({ bigint: true });
+    const sizeBytes = Number(before.size);
+    if (!before.isFile() || sizeBytes < 1 || sizeBytes > ARCHIVE_MAX_BYTES) {
+      throw new Error(`Frontend release archive must be a 1-${ARCHIVE_MAX_BYTES} byte regular file`);
+    }
+    const sha256 = await archiveSha256(handle, sizeBytes);
+    const after = await handle.stat({ bigint: true });
+    if (!sameArchiveIdentity(before, after)) {
+      throw new Error("Frontend release archive identity changed while it was hashed");
+    }
+    return { handle, sizeBytes, sha256 };
+  } catch (error) {
+    await handle.close();
+    throw error;
+  }
+}
+function archiveStream(archive) {
+  let offset = 0;
+  return new ReadableStream({
+    async pull(controller) {
+      if (offset === archive.sizeBytes) {
+        controller.close();
+        return;
+      }
+      const length = Math.min(ARCHIVE_CHUNK_BYTES, archive.sizeBytes - offset);
+      const chunk = new Uint8Array(length);
+      const { bytesRead } = await archive.handle.read(chunk, 0, length, offset);
+      if (bytesRead < 1)
+        throw new Error("Frontend release archive changed while it was uploaded");
+      offset += bytesRead;
+      controller.enqueue(bytesRead === length ? chunk : chunk.subarray(0, bytesRead));
+    }
+  });
+}
+function releaseReadFailure(operation, response) {
+  return releaseFailure(operation, response.ok ? "INVALID_RESPONSE" : "HTTP_ERROR", response.status);
+}
+async function listFrontendReleases(http, projectRef2, deploymentId, cursor, limit = 50) {
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > RELEASE_LIST_LIMIT_MAX) {
+    throw new Error("'limit' must be 1-100");
+  }
+  if (cursor !== undefined && !RELEASE_ID_PATTERN.test(cursor))
+    throw new Error("'cursor' is invalid");
+  const query = new URLSearchParams({ limit: String(limit) });
+  if (cursor)
+    query.set("cursor", cursor);
+  const response = await http.get(`${releaseEndpoint(projectRef2, deploymentId)}?${query}`, {
+    maxJsonBytes: RESPONSE_MAX_BYTES
+  });
+  const inventory = response.ok ? releaseInventory(response.data, { projectRef: projectRef2, deploymentId }) : null;
+  if (!inventory || inventory.releases.length > limit) {
+    return releaseReadFailure("frontend.list_releases", response);
+  }
+  return toolResponse(inventory);
+}
+async function getFrontendRelease(http, projectRef2, deploymentId, releaseId) {
+  const response = await http.get(releasePath(projectRef2, deploymentId, releaseId), {
+    maxJsonBytes: RESPONSE_MAX_BYTES
+  });
+  const release = response.ok ? releaseEnvelope(response.data, { projectRef: projectRef2, deploymentId, releaseId }) : null;
+  if (!release) {
+    return releaseReadFailure("frontend.get_release", response);
+  }
+  return toolResponse({ project_ref: projectRef2, deployment_id: deploymentId, release });
+}
+async function uploadFrontendRelease(http, projectRef2, deploymentId, archivePath) {
+  const endpoint = releaseEndpoint(projectRef2, deploymentId);
+  const archive = await verifiedArchive(archivePath);
+  let response;
+  try {
+    response = await http.postBinary(endpoint, {
+      stream: archiveStream(archive),
+      byteLength: archive.sizeBytes
+    }, {
+      contentType: "application/zip",
+      contentLength: archive.sizeBytes,
+      contentSha256: archive.sha256,
+      maxJsonBytes: RESPONSE_MAX_BYTES,
+      timeoutMs: UPLOAD_REQUEST_TIMEOUT_MS,
+      responseTimeoutMs: MUTATION_RESPONSE_TIMEOUT_MS
+    });
+  } finally {
+    await archive.handle.close();
+  }
+  const release = response.ok ? releaseEnvelope(response.data, { projectRef: projectRef2, deploymentId, releaseId: archive.sha256 }) : null;
+  if (!release) {
+    if (response.status >= 400 && response.status < 500 && response.status !== 408 && !response.transportError) {
+      return releaseFailure("frontend.upload_release", "HTTP_ERROR", response.status);
+    }
+    return uploadReadback(http, projectRef2, deploymentId, archive.sha256, response.status);
+  }
+  const readback = await http.get(`${endpoint}/${release.release_id}`, { maxJsonBytes: RESPONSE_MAX_BYTES });
+  const verified = readback.ok ? releaseEnvelope(readback.data, { projectRef: projectRef2, deploymentId, releaseId: release.release_id }) : null;
+  if (!verified || verified.tree_sha256 !== release.tree_sha256) {
+    return releaseFailure("frontend.upload_release", "OUTCOME_UNKNOWN", readback.status);
+  }
+  return toolResponse({ project_ref: projectRef2, deployment_id: deploymentId, release: verified });
+}
+async function uploadReadback(http, projectRef2, deploymentId, releaseId, uploadStatus) {
+  const response = await http.get(releasePath(projectRef2, deploymentId, releaseId), {
+    maxJsonBytes: RESPONSE_MAX_BYTES
+  });
+  const release = response.ok ? releaseEnvelope(response.data, { projectRef: projectRef2, deploymentId, releaseId }) : null;
+  if (!release) {
+    return releaseFailure("frontend.upload_release", "OUTCOME_UNKNOWN", uploadStatus);
+  }
+  return toolResponse({ project_ref: projectRef2, deployment_id: deploymentId, release });
+}
+function stableJson(candidate) {
+  if (candidate === null || typeof candidate !== "object")
+    return JSON.stringify(candidate);
+  if (Array.isArray(candidate))
+    return `[${candidate.map(stableJson).join(",")}]`;
+  const record = candidate;
+  return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
+}
+function activationFingerprint(identity) {
+  return createHash3("sha256").update(stableJson({
+    project_ref: identity.projectRef,
+    deployment_id: identity.deploymentId,
+    release_id: identity.releaseId,
+    expected_active_release_id: identity.expectedActiveReleaseId,
+    activation_id: identity.mutationId,
+    expected_activation_id: identity.expectedActivationId
+  })).digest("hex");
+}
+function activationResourceKey(deploymentId) {
+  return `v1/frontend_release/${Buffer.from(deploymentId, "utf8").toString("base64url")}`;
+}
+function publicMutationReceipt(candidate, expected) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const envelope = candidate;
+  const mutation = envelope.mutation;
+  const expectedKeys = [
+    "project_ref",
+    "mutation_id",
+    "operation",
+    "resource_key",
+    "request_fingerprint",
+    "principal",
+    "status",
+    "checkpoint",
+    "receipt",
+    "response_status",
+    "failure_code",
+    "lease",
+    "completed_at",
+    "created_at",
+    "updated_at"
+  ];
+  if (!mutation || !exactKeys(envelope, ["project_ref", "mutation"]) || !exactKeys(mutation, expectedKeys) || envelope.project_ref !== expected.projectRef || mutation.project_ref !== expected.projectRef || mutation.mutation_id !== expected.mutationId || mutation.resource_key !== expected.resourceKey || mutation.request_fingerprint !== expected.requestFingerprint || typeof mutation.operation !== "string" || typeof mutation.status !== "string" || !(mutation.response_status === null || Number.isSafeInteger(mutation.response_status)) || !(mutation.failure_code === null || typeof mutation.failure_code === "string"))
+    return null;
+  return {
+    operation: mutation.operation,
+    status: mutation.status,
+    responseStatus: mutation.response_status,
+    failureCode: mutation.failure_code
+  };
+}
+function activationReceipt(candidate, input) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const record = candidate;
+  const release = releaseRecord(record.release);
+  const mutation = record.mutation;
+  if (!release || !mutation || !exactKeys(record, [
+    "project_ref",
+    "deployment_id",
+    "active_release_id",
+    "activation_id",
+    "release",
+    "mutation"
+  ]) || !exactKeys(mutation, ["mutation_id", "status", "replayed"]) || record.project_ref !== input.projectRef || record.deployment_id !== input.deploymentId || record.active_release_id !== input.releaseId || record.activation_id !== input.mutationId || release.project_ref !== input.projectRef || release.deployment_id !== input.deploymentId || release.release_id !== input.releaseId || mutation.mutation_id !== input.mutationId || mutation.status !== "succeeded" || typeof mutation.replayed !== "boolean")
+    return null;
+  return release;
+}
+async function activeReleaseReadback(http, identity) {
+  const endpoint = releaseEndpoint(identity.projectRef, identity.deploymentId);
+  const inventoryRead = await http.get(`${endpoint}?limit=${RELEASE_LIST_LIMIT_MAX}`, {
+    maxJsonBytes: RESPONSE_MAX_BYTES
+  });
+  const inventory = inventoryRead.ok ? releaseInventory(inventoryRead.data, {
+    projectRef: identity.projectRef,
+    deploymentId: identity.deploymentId
+  }) : null;
+  if (!inventory || inventory.releases.length > RELEASE_LIST_LIMIT_MAX || inventory.active_release_id !== identity.releaseId || inventory.active_activation_id !== identity.mutationId) {
+    return { release: null, status: inventoryRead.status };
+  }
+  const releaseRead = await http.get(releasePath(identity.projectRef, identity.deploymentId, identity.releaseId), { maxJsonBytes: RESPONSE_MAX_BYTES });
+  const release = releaseRead.ok ? releaseEnvelope(releaseRead.data, {
+    projectRef: identity.projectRef,
+    deploymentId: identity.deploymentId,
+    releaseId: identity.releaseId
+  }) : null;
+  return { release, status: releaseRead.status };
+}
+async function activateFrontendRelease(http, input) {
+  const mutationId = input.mutationId;
+  if (!MUTATION_ID_PATTERN.test(mutationId))
+    throw new Error("'mutation_id' must be a UUIDv4");
+  if (input.expectedActiveReleaseId !== "absent" && !RELEASE_ID_PATTERN.test(input.expectedActiveReleaseId)) {
+    throw new Error("'expected_active_release_id' is invalid");
+  }
+  if (input.expectedActivationId !== "absent" && !MUTATION_ID_PATTERN.test(input.expectedActivationId)) {
+    throw new Error("'expected_activation_id' is invalid");
+  }
+  const endpoint = `${releasePath(input.projectRef, input.deploymentId, input.releaseId)}/activate`;
+  const response = await http.post(endpoint, {
+    expected_active_release_id: input.expectedActiveReleaseId,
+    expected_activation_id: input.expectedActivationId,
+    mutation_id: mutationId
+  }, {
+    maxJsonBytes: RESPONSE_MAX_BYTES,
+    responseTimeoutMs: MUTATION_RESPONSE_TIMEOUT_MS
+  });
+  const release = activationReceipt(response.data, { ...input, mutationId });
+  if (!response.ok || !release) {
+    if (response.status >= 400 && response.status < 500 && response.status !== 408 && !response.transportError) {
+      return releaseFailure("frontend.activate_release", "HTTP_ERROR", response.status);
+    }
+    return activationReadback(http, input, mutationId, response.status);
+  }
+  const readback = await activeReleaseReadback(http, { ...input, mutationId });
+  if (!readback.release || readback.release.tree_sha256 !== release.tree_sha256) {
+    return releaseFailure("frontend.activate_release", "OUTCOME_UNKNOWN", readback.status);
+  }
+  return toolResponse({
+    project_ref: input.projectRef,
+    deployment_id: input.deploymentId,
+    active_release_id: input.releaseId,
+    activation_id: mutationId,
+    release: readback.release
+  });
+}
+async function activationReadback(http, input, mutationId, activationStatus) {
+  const mutationRead = await http.get(`/v1/projects/${encodeURIComponent(input.projectRef)}/mutations/${mutationId}`, { maxJsonBytes: RESPONSE_MAX_BYTES });
+  const mutationEnvelope = mutationRead.data;
+  const mutation = mutationRead.ok ? publicMutationReceipt(mutationRead.data, {
+    projectRef: input.projectRef,
+    mutationId,
+    resourceKey: activationResourceKey(input.deploymentId),
+    requestFingerprint: activationFingerprint({ ...input, mutationId })
+  }) : null;
+  if (!mutation || mutationEnvelope?.project_ref !== input.projectRef || mutation.operation !== "frontend.release.activate" || mutation.status !== "succeeded" || mutation.responseStatus !== 200 || mutation.failureCode !== null) {
+    return releaseFailure("frontend.activate_release", "OUTCOME_UNKNOWN", activationStatus);
+  }
+  const readback = await activeReleaseReadback(http, { ...input, mutationId });
+  if (!readback.release) {
+    return releaseFailure("frontend.activate_release", "OUTCOME_UNKNOWN", activationStatus);
+  }
+  return toolResponse({
+    project_ref: input.projectRef,
+    deployment_id: input.deploymentId,
+    active_release_id: input.releaseId,
+    activation_id: mutationId,
+    release: readback.release
+  });
+}
+
+// src/shared/tools/frontend-tools.ts
 function registerFrontendTools(server, http) {
-  server.tool("frontend", `Frontend hosting (static sites & SSR). Supports: static, react, vue, svelte, sveltekit, sveltekit-static, nextjs, nuxt, astro.
-Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy, build_logs, add_domain, remove_domain, set_env, list_frameworks, list_records`, {
+  server.tool("frontend", `Frontend hosting and immutable prebuilt releases. Supports: static, react, vue, svelte, sveltekit, sveltekit-static, nextjs, nuxt, astro.
+Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy, build_logs, add_domain, remove_domain, set_env, list_frameworks, list_records, list_releases, get_release, upload_release, activate_release`, {
     action: withDescription(stringEnum([
       "list",
       "get",
@@ -11033,7 +11494,11 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
       "remove_domain",
       "set_env",
       "list_frameworks",
-      "list_records"
+      "list_records",
+      "list_releases",
+      "get_release",
+      "upload_release",
+      "activate_release"
     ]), "Action"),
     ref: optional(Type.String(), "Project ref"),
     id: optional(Type.String(), "Deployment ID"),
@@ -11048,9 +11513,37 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
     env_vars: optional(Type.Record(Type.String(), Type.String()), "[create/update/set_env] Environment variables"),
     git_url: optional(Type.String(), "[deploy_git] Git repository URL"),
     branch: optional(Type.String(), "[deploy_git] Branch (default: main)"),
-    zip_path: optional(Type.String(), "[deploy_upload] Local zip file path")
+    zip_path: optional(Type.String(), "[deploy_upload/upload_release] Local ZIP file path"),
+    release_id: optional(Type.String(), "[get_release/activate_release] SHA-256 release ID"),
+    expected_active_release_id: optional(Type.String(), "[activate_release] Current release SHA-256 or absent"),
+    expected_activation_id: optional(Type.String(), "[activate_release] Current activation UUIDv4 or absent"),
+    mutation_id: optional(Type.String(), "[activate_release] Required retry-stable UUIDv4"),
+    cursor: optional(Type.String(), "[list_releases] Last release SHA-256 cursor"),
+    limit: optional(Type.Number(), "[list_releases] Page size, 1-100 (default 50)")
   }, async (args) => {
-    const { action, ref, id, name, framework, domain, build_command, output_dir, install_command, node_version, health_check_path, env_vars, git_url, branch, zip_path } = args;
+    const {
+      action,
+      ref,
+      id,
+      name,
+      framework,
+      domain,
+      build_command,
+      output_dir,
+      install_command,
+      node_version,
+      health_check_path,
+      env_vars,
+      git_url,
+      branch,
+      zip_path,
+      release_id,
+      expected_active_release_id,
+      expected_activation_id,
+      mutation_id,
+      cursor,
+      limit
+    } = args;
     const need = (f, v) => {
       if (!v)
         throw new Error(`'${f}' required for '${action}'`);
@@ -11157,6 +11650,35 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
         need("id", id);
         text = ok(await http.get(`/v1/projects/${ref}/frontend/deployments/${id}/records`));
         break;
+      case "list_releases":
+        need("ref", ref);
+        need("id", id);
+        return listFrontendReleases(http, ref, id, cursor, limit);
+      case "get_release":
+        need("ref", ref);
+        need("id", id);
+        need("release_id", release_id);
+        return getFrontendRelease(http, ref, id, release_id);
+      case "upload_release":
+        need("ref", ref);
+        need("id", id);
+        need("zip_path", zip_path);
+        return uploadFrontendRelease(http, ref, id, zip_path);
+      case "activate_release":
+        need("ref", ref);
+        need("id", id);
+        need("release_id", release_id);
+        need("expected_active_release_id", expected_active_release_id);
+        need("expected_activation_id", expected_activation_id);
+        need("mutation_id", mutation_id);
+        return activateFrontendRelease(http, {
+          projectRef: ref,
+          deploymentId: id,
+          releaseId: release_id,
+          expectedActiveReleaseId: expected_active_release_id,
+          expectedActivationId: expected_activation_id,
+          mutationId: mutation_id
+        });
       default:
         text = `❌ Unknown action`;
     }
@@ -11166,7 +11688,7 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
 
 // src/shared/tools/project-read-projection.ts
 var PROJECT_READ_RESPONSE_MAX_BYTES = 1048576;
-var PROJECT_REF_PATTERN3 = /^[a-z0-9-]{1,20}$/;
+var PROJECT_REF_PATTERN4 = /^[a-z0-9-]{1,20}$/;
 var SAFE_IDENTIFIER_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 var REGION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
 var STATUS_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
@@ -11230,7 +11752,7 @@ function matchingText(candidate, maxLength, pattern) {
   const candidateText = boundedText2(candidate, maxLength);
   return candidateText && pattern.test(candidateText) ? candidateText : null;
 }
-function canonicalTimestamp(candidate) {
+function canonicalTimestamp2(candidate) {
   const timestamp = boundedText2(candidate, 64);
   if (!timestamp)
     return null;
@@ -11240,12 +11762,12 @@ function canonicalTimestamp(candidate) {
 function projectedSummary(project) {
   const summary = {
     id: matchingText(project.id, 128, SAFE_IDENTIFIER_PATTERN),
-    ref: matchingText(project.ref, 20, PROJECT_REF_PATTERN3),
+    ref: matchingText(project.ref, 20, PROJECT_REF_PATTERN4),
     organization_id: matchingText(project.organization_id, 128, SAFE_IDENTIFIER_PATTERN),
     organization_slug: matchingText(project.organization_slug, 128, SAFE_IDENTIFIER_PATTERN),
     name: boundedText2(project.name, 100),
     region: matchingText(project.region, 64, REGION_PATTERN),
-    created_at: canonicalTimestamp(project.created_at),
+    created_at: canonicalTimestamp2(project.created_at),
     status: matchingText(project.status, 64, STATUS_PATTERN)
   };
   return Object.values(summary).every((field) => field !== null) ? summary : null;
@@ -11364,7 +11886,7 @@ function projectGetRead(response, expectedRef) {
 // src/shared/tools/project-endpoint-read.ts
 var PROJECT_ENDPOINT_RESPONSE_MAX_BYTES = 256 * 1024;
 var PROJECT_ENDPOINT_LIST_RESPONSE_MAX_BYTES = 1024 * 1024;
-var PROJECT_REF_PATTERN4 = /^[a-z0-9-]{1,20}$/;
+var PROJECT_REF_PATTERN5 = /^[a-z0-9-]{1,20}$/;
 var PROJECT_ENDPOINTS_SCHEMA = "supacloud.project-endpoints.v1";
 var PROJECT_ENDPOINT_SOURCES = new Set([
   "explicit_api_domain",
@@ -11434,7 +11956,7 @@ function projectEndpoint2(candidate) {
 }
 function projectEndpointProjection(candidate) {
   const projection = plainRecord2(candidate);
-  if (!projection || !hasOnlyKeys2(projection, ROOT_KEYS) || projection.schema !== PROJECT_ENDPOINTS_SCHEMA || typeof projection.project_ref !== "string" || !PROJECT_REF_PATTERN4.test(projection.project_ref))
+  if (!projection || !hasOnlyKeys2(projection, ROOT_KEYS) || projection.schema !== PROJECT_ENDPOINTS_SCHEMA || typeof projection.project_ref !== "string" || !PROJECT_REF_PATTERN5.test(projection.project_ref))
     return null;
   const endpoints = plainRecord2(projection.endpoints);
   if (!endpoints || !hasOnlyKeys2(endpoints, ENDPOINTS_KEYS))
@@ -12513,7 +13035,7 @@ function registerBranchTools(server, http, options = {}) {
 // src/shared/tools/supabase-cli-tools.ts
 import { spawn } from "node:child_process";
 import { chmodSync, existsSync as existsSync5, mkdirSync, statSync as statSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname, isAbsolute, join as join3, resolve as resolve3 } from "node:path";
+import { dirname, isAbsolute, join as join3, resolve as resolve4 } from "node:path";
 var SENSITIVE_ENV_KEY = /(?:^|_)(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIALS?|AUTHORIZATION|AUTH|SESSION|COOKIE|BEARER|DB_URI|DB_URL|DSN|DATABASE_URL|DATABASE_URI|CONNECTION_STRING|CONNECTION_URI)(?:_|$)/i;
 var VALID_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 var VALID_MIGRATION_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]{0,100}$/;
@@ -12557,12 +13079,12 @@ function schemaArguments(schema) {
 function workdirArguments(workdir) {
   if (!workdir)
     throw new Error("A workdir is required");
-  return ["--workdir", resolve3(workdir)];
+  return ["--workdir", resolve4(workdir)];
 }
 function resolveOutputPath(workdir, file, label) {
   if (!file || /[\r\n\0]/.test(file))
     throw new Error(`${label} file is required`);
-  return isAbsolute(file) ? resolve3(file) : resolve3(workdir, file);
+  return isAbsolute(file) ? resolve4(file) : resolve4(workdir, file);
 }
 function databaseTargetArguments(databaseUrl) {
   return databaseUrl ? ["--db-url", requirePostgresUrl(databaseUrl)] : ["--local"];
@@ -12647,7 +13169,7 @@ function actionArguments(request, workdir) {
 function buildOfficialSupabaseArgs(request) {
   if (request.action === "version")
     return ["--version"];
-  const workdir = request.workdir ? resolve3(request.workdir) : undefined;
+  const workdir = request.workdir ? resolve4(request.workdir) : undefined;
   if (!workdir)
     throw new Error("A workdir is required");
   return [...actionArguments(request, workdir), ...workdirArguments(workdir)];
@@ -12693,13 +13215,13 @@ function resolveOfficialSupabaseCommand(workdir, environment = process.env) {
     }
     return ["npx", "--yes", `supabase@${version}`];
   }
-  const localPackageEntry = join3(resolve3(workdir), "node_modules", "supabase", "dist", "supabase.js");
+  const localPackageEntry = join3(resolve4(workdir), "node_modules", "supabase", "dist", "supabase.js");
   if (existsSync5(localPackageEntry))
     return [process.execPath, localPackageEntry];
   return ["supabase"];
 }
 function resolveExistingWorkdir(workdirInput, fallback) {
-  const workdir = resolve3(workdirInput || fallback);
+  const workdir = resolve4(workdirInput || fallback);
   if (!existsSync5(workdir) || !statSync3(workdir).isDirectory()) {
     throw new Error(`Supabase workdir not found: ${workdir}`);
   }
@@ -12813,7 +13335,7 @@ async function executeMigrationPush(request, runtime) {
   if (!projectRef2)
     return missingProjectRefResult();
   const workdir = resolveExistingWorkdir(request.workdir, runtime.fallbackWorkdir);
-  const migrationDirectory = resolve3(workdir, request.dir || "supabase/migrations");
+  const migrationDirectory = resolve4(workdir, request.dir || "supabase/migrations");
   const migrationResponse = await pushMigrations({
     action: "push_migrations",
     ref: projectRef2,
@@ -12894,10 +13416,236 @@ function registerSupabaseCliTools(server, options = {}) {
   }, (request) => executeSupabaseAction(request, runtime));
 }
 
+// src/shared/tools/lite-cli-tools.ts
+import { spawn as spawn2 } from "node:child_process";
+import { existsSync as existsSync6, statSync as statSync4 } from "node:fs";
+import { join as join4, resolve as resolve5 } from "node:path";
+function requireWorkdir(workdir, fallback) {
+  const resolved = resolve5(workdir || fallback);
+  if (!existsSync6(resolved) || !statSync4(resolved).isDirectory()) {
+    throw new Error(`Lite workdir not found: ${resolved}`);
+  }
+  return resolved;
+}
+function optionalFlag(args, flag, value) {
+  if (value !== undefined)
+    args.push(flag, String(value));
+}
+function booleanFlag(args, flag, value) {
+  if (value === true)
+    args.push(flag);
+}
+function buildLiteArgs(request) {
+  const args = [];
+  if (request.action === "version")
+    return ["--version"];
+  switch (request.action) {
+    case "start":
+    case "migrate":
+    case "status":
+    case "keys":
+    case "upgrade":
+    case "inspect":
+    case "doctor":
+      args.push(request.action);
+      break;
+    case "gen_types":
+      args.push("gen", "types");
+      break;
+    case "db_reset":
+      args.push("db", "reset");
+      break;
+    case "db_diff":
+      args.push("db", "diff");
+      break;
+    case "db_pull":
+      args.push("db", "pull");
+      if (request.file)
+        args.push(request.file);
+      break;
+    case "snapshot_create":
+      args.push("snapshot", "create");
+      break;
+    case "snapshot_restore":
+      if (!request.snapshot_file)
+        throw new Error("snapshot_restore requires --snapshot_file");
+      args.push("snapshot", "restore", request.snapshot_file);
+      break;
+    default:
+      throw new Error(`Unsupported Lite CLI action: ${String(request.action)}`);
+  }
+  optionalFlag(args, "--project-dir", request.project_dir);
+  optionalFlag(args, "--state-dir", request.state_dir);
+  optionalFlag(args, "--data-dir", request.data_dir);
+  optionalFlag(args, "--storage-dir", request.storage_dir);
+  optionalFlag(args, "--storage-backend", request.storage_backend);
+  optionalFlag(args, "--s3-prefix", request.s3_prefix);
+  optionalFlag(args, "--engine", request.engine);
+  optionalFlag(args, "--host", request.host);
+  optionalFlag(args, "--port", request.port);
+  optionalFlag(args, "--api-url", request.api_url);
+  optionalFlag(args, "--site-url", request.site_url);
+  optionalFlag(args, "--replication-profile", request.replication_profile);
+  optionalFlag(args, "--replication-host", request.replication_host);
+  optionalFlag(args, "--replication-port", request.replication_port);
+  optionalFlag(args, "--replication-allow-cidrs", request.replication_allow_cidrs);
+  optionalFlag(args, "--powersync-tables", request.powersync_tables);
+  optionalFlag(args, "--replication-tls-cert", request.replication_tls_cert);
+  optionalFlag(args, "--replication-tls-key", request.replication_tls_key);
+  optionalFlag(args, "--output", request.output);
+  optionalFlag(args, "--file", request.action === "db_diff" ? request.file : undefined);
+  booleanFlag(args, "--service-role", request.service_role);
+  booleanFlag(args, "--force", request.force);
+  booleanFlag(args, "--memory", request.memory);
+  booleanFlag(args, "--json", request.json);
+  return args;
+}
+function resolveLiteCommand(workdir, environment = process.env) {
+  const explicitBinary = environment.SUPACLOUD_LITE_CLI_BIN?.trim();
+  if (explicitBinary) {
+    if (explicitBinary.includes("\x00"))
+      throw new Error("Invalid SUPACLOUD_LITE_CLI_BIN");
+    return [explicitBinary];
+  }
+  const localPackageEntry = join4(resolve5(workdir), "node_modules", "@supacloud", "lite", "dist", "launcher.cjs");
+  if (existsSync6(localPackageEntry))
+    return [process.execPath, localPackageEntry];
+  return ["supacloud-lite"];
+}
+function spawnLiteCommand(command, workdir, environment, inheritOutput) {
+  const [executable, ...commandArguments] = command;
+  return new Promise((resolveExecution, rejectExecution) => {
+    const child = spawn2(executable, commandArguments, {
+      cwd: workdir,
+      env: { ...environment, NO_COLOR: "1" },
+      shell: false,
+      stdio: inheritOutput ? ["inherit", "inherit", "inherit"] : ["ignore", "pipe", "pipe"],
+      windowsHide: true
+    });
+    const forwardSignal = (signal) => child.kill(signal);
+    process.once("SIGINT", forwardSignal);
+    process.once("SIGTERM", forwardSignal);
+    const cleanup = () => {
+      process.off("SIGINT", forwardSignal);
+      process.off("SIGTERM", forwardSignal);
+    };
+    if (inheritOutput) {
+      child.once("error", (error) => {
+        cleanup();
+        rejectExecution(error);
+      });
+      child.once("close", (exitCode) => {
+        cleanup();
+        resolveExecution({ exitCode: exitCode ?? 1, stdout: "", stderr: "" });
+      });
+      return;
+    }
+    if (!child.stdout || !child.stderr) {
+      cleanup();
+      rejectExecution(new Error("Lite CLI child process did not expose piped output"));
+      return;
+    }
+    let standardOutput = "";
+    let standardError = "";
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      standardOutput += chunk;
+    });
+    child.stderr.on("data", (chunk) => {
+      standardError += chunk;
+    });
+    child.once("error", (error) => {
+      cleanup();
+      rejectExecution(error);
+    });
+    child.once("close", (exitCode) => {
+      cleanup();
+      resolveExecution({ exitCode: exitCode ?? 1, stdout: standardOutput, stderr: standardError });
+    });
+  });
+}
+async function executeLiteCli(request, environment, fallbackWorkdir) {
+  const workdir = requireWorkdir(request.workdir, fallbackWorkdir);
+  const command = [...resolveLiteCommand(workdir, environment), ...buildLiteArgs({ ...request, workdir })];
+  try {
+    return await spawnLiteCommand(command, workdir, environment, request.action === "start");
+  } catch (error) {
+    const failureMessage = error instanceof Error ? error.message : String(error);
+    throw new Error([
+      "SupaCloud Lite CLI could not be started.",
+      "Install @supacloud/lite, put supacloud-lite on PATH, or set SUPACLOUD_LITE_CLI_BIN.",
+      failureMessage
+    ].join(" "));
+  }
+}
+function formatExecutionText2(action, execution) {
+  const combinedOutput = [execution.stdout.trim(), execution.stderr.trim()].filter(Boolean).join(`
+`);
+  const heading = execution.exitCode === 0 ? `✅ SupaCloud Lite ${action} completed` : `❌ SupaCloud Lite ${action} failed (exit ${execution.exitCode})`;
+  return combinedOutput ? `${heading}
+${combinedOutput}` : heading;
+}
+function registerLiteCliTools(server, options = {}) {
+  const environment = options.environment || process.env;
+  const fallbackWorkdir = options.currentWorkingDirectory || process.cwd();
+  const execute = options.executeLiteCli || ((request) => executeLiteCli(request, environment, fallbackWorkdir));
+  server.tool("lite", "Controlled adapter for the local SupaCloud Lite CLI. Lite actions are local-only and never use the Management API or official Supabase CLI.", {
+    action: withDescription(stringEnum([
+      "version",
+      "start",
+      "migrate",
+      "status",
+      "keys",
+      "gen_types",
+      "db_reset",
+      "db_diff",
+      "db_pull",
+      "snapshot_create",
+      "snapshot_restore",
+      "upgrade",
+      "inspect",
+      "doctor"
+    ]), "Lite CLI action"),
+    workdir: optional(Type.String(), "[*] Process working directory (default: current directory)"),
+    project_dir: optional(Type.String(), "[*] Project containing supabase/"),
+    state_dir: optional(Type.String(), "[*] Lite state root"),
+    data_dir: optional(Type.String(), "[*] PGlite/native data directory"),
+    storage_dir: optional(Type.String(), "[*] Object storage directory"),
+    storage_backend: optional(stringEnum(["fs", "memory", "s3"]), "[*] Storage backend"),
+    s3_prefix: optional(Type.String(), "[*] S3 object key prefix"),
+    engine: optional(stringEnum(["pglite", "native"]), "[*] Database engine"),
+    host: optional(Type.String(), "[start] Listen host"),
+    port: optional(Type.Number(), "[start] Listen port"),
+    api_url: optional(Type.String(), "[start] Public API URL"),
+    site_url: optional(Type.String(), "[start] Auth site URL"),
+    replication_profile: optional(stringEnum(["powersync"]), "[start/doctor] Replication profile"),
+    replication_host: optional(Type.String(), "[start] Replication listener host"),
+    replication_port: optional(Type.Number(), "[start] Replication listener port"),
+    replication_allow_cidrs: optional(Type.String(), "[start] Replication client CIDRs"),
+    powersync_tables: optional(Type.String(), "[start] PowerSync publication tables"),
+    replication_tls_cert: optional(Type.String(), "[start] Replication TLS certificate"),
+    replication_tls_key: optional(Type.String(), "[start] Replication TLS private key"),
+    output: optional(Type.String(), "[gen_types/snapshot_create/upgrade] Output path"),
+    file: optional(Type.String(), "[db_diff/db_pull] Migration suffix or name"),
+    snapshot_file: optional(Type.String(), "[snapshot_restore] Snapshot archive"),
+    service_role: optional(Type.Boolean(), "[keys] Also print the service_role key"),
+    force: optional(Type.Boolean(), "[snapshot_restore] Replace non-empty restore targets"),
+    memory: optional(Type.Boolean(), "[*] Use an in-memory PGlite database"),
+    json: optional(Type.Boolean(), "[doctor] Emit machine-readable output")
+  }, async (request) => {
+    const execution = await execute(request);
+    return {
+      isError: execution.exitCode !== 0,
+      content: [{ type: "text", text: formatExecutionText2(request.action, execution) }]
+    };
+  });
+}
+
 // src/shared/tools/ai-tools.ts
 import {
   cpSync,
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync2,
   mkdtempSync as mkdtempSync2,
@@ -12907,13 +13655,13 @@ import {
   rmSync as rmSync2
 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname2, join as join4, relative as relative2, resolve as resolve4, sep as sep2 } from "node:path";
+import { dirname as dirname2, join as join5, relative as relative2, resolve as resolve6, sep as sep2 } from "node:path";
 import { fileURLToPath } from "node:url";
 var SKILL_NAME = "supacloud-cli";
 function regularFiles(rootDirectory, currentDirectory = rootDirectory) {
   const files = [];
   for (const directoryEntry of readdirSync3(currentDirectory, { withFileTypes: true })) {
-    const entryPath = join4(currentDirectory, directoryEntry.name);
+    const entryPath = join5(currentDirectory, directoryEntry.name);
     if (directoryEntry.isSymbolicLink())
       throw new Error(`Skill directories cannot contain symlinks: ${entryPath}`);
     if (directoryEntry.isDirectory())
@@ -12924,13 +13672,13 @@ function regularFiles(rootDirectory, currentDirectory = rootDirectory) {
   return files.sort();
 }
 function directoriesMatch(sourceDirectory, destinationDirectory) {
-  if (!existsSync6(destinationDirectory) || !lstatSync2(destinationDirectory).isDirectory())
+  if (!existsSync7(destinationDirectory) || !lstatSync2(destinationDirectory).isDirectory())
     return false;
   const sourceFiles = regularFiles(sourceDirectory);
   const destinationFiles = regularFiles(destinationDirectory);
   if (sourceFiles.join("\x00") !== destinationFiles.join("\x00"))
     return false;
-  return sourceFiles.every((file) => readFileSync5(join4(sourceDirectory, file)).equals(readFileSync5(join4(destinationDirectory, file))));
+  return sourceFiles.every((file) => readFileSync5(join5(sourceDirectory, file)).equals(readFileSync5(join5(destinationDirectory, file))));
 }
 function backupTimestamp(now) {
   return now.toISOString().replace(/[-:.]/g, "");
@@ -12939,7 +13687,7 @@ function availableBackupDirectory(destinationDirectory, now) {
   const baseDirectory = `${destinationDirectory}.backup-${backupTimestamp(now)}`;
   let candidate = baseDirectory;
   let suffix = 2;
-  while (existsSync6(candidate)) {
+  while (existsSync7(candidate)) {
     candidate = `${baseDirectory}-${suffix}`;
     suffix += 1;
   }
@@ -12947,8 +13695,8 @@ function availableBackupDirectory(destinationDirectory, now) {
 }
 function stagedSkill(sourceDirectory, targetRoot) {
   mkdirSync2(targetRoot, { recursive: true });
-  const stagingRoot = mkdtempSync2(join4(targetRoot, ".supacloud-cli-install-"));
-  const stagingSkill = join4(stagingRoot, SKILL_NAME);
+  const stagingRoot = mkdtempSync2(join5(targetRoot, ".supacloud-cli-install-"));
+  const stagingSkill = join5(stagingRoot, SKILL_NAME);
   try {
     cpSync(sourceDirectory, stagingSkill, { recursive: true, errorOnExist: true });
   } catch (error) {
@@ -12980,13 +13728,13 @@ function replaceSkill(sourceDirectory, targetRoot, destinationDirectory, backupD
   }
 }
 function skillSummary(request, action, files, backupDirectory) {
-  const sourceDirectory = resolve4(request.sourceDirectory);
-  const targetRoot = resolve4(request.targetRoot);
+  const sourceDirectory = resolve6(request.sourceDirectory);
+  const targetRoot = resolve6(request.targetRoot);
   return {
     name: SKILL_NAME,
     sourceDirectory,
     targetRoot,
-    destinationDirectory: join4(targetRoot, SKILL_NAME),
+    destinationDirectory: join5(targetRoot, SKILL_NAME),
     action,
     mode: request.mode,
     changed: action !== "none",
@@ -12995,14 +13743,14 @@ function skillSummary(request, action, files, backupDirectory) {
   };
 }
 function installSkill(request) {
-  const sourceDirectory = resolve4(request.sourceDirectory);
-  const targetRoot = resolve4(request.targetRoot);
-  const destinationDirectory = join4(targetRoot, SKILL_NAME);
-  if (!existsSync6(join4(sourceDirectory, "SKILL.md"))) {
+  const sourceDirectory = resolve6(request.sourceDirectory);
+  const targetRoot = resolve6(request.targetRoot);
+  const destinationDirectory = join5(targetRoot, SKILL_NAME);
+  if (!existsSync7(join5(sourceDirectory, "SKILL.md"))) {
     throw new Error(`Bundled SupaCloud CLI skill not found: ${sourceDirectory}`);
   }
   const files = regularFiles(sourceDirectory);
-  if (!existsSync6(destinationDirectory))
+  if (!existsSync7(destinationDirectory))
     return installNewSkill(request, files);
   if (directoriesMatch(sourceDirectory, destinationDirectory)) {
     return skillSummary(request, "none", files, null);
@@ -13013,17 +13761,17 @@ function installSkill(request) {
   return installReplacementSkill(request, files);
 }
 function installNewSkill(request, files) {
-  const sourceDirectory = resolve4(request.sourceDirectory);
-  const targetRoot = resolve4(request.targetRoot);
+  const sourceDirectory = resolve6(request.sourceDirectory);
+  const targetRoot = resolve6(request.targetRoot);
   if (request.mode === "write") {
-    createSkill(sourceDirectory, targetRoot, join4(targetRoot, SKILL_NAME));
+    createSkill(sourceDirectory, targetRoot, join5(targetRoot, SKILL_NAME));
   }
   return skillSummary(request, "create", files, null);
 }
 function installReplacementSkill(request, files) {
-  const sourceDirectory = resolve4(request.sourceDirectory);
-  const targetRoot = resolve4(request.targetRoot);
-  const destinationDirectory = join4(targetRoot, SKILL_NAME);
+  const sourceDirectory = resolve6(request.sourceDirectory);
+  const targetRoot = resolve6(request.targetRoot);
+  const destinationDirectory = join5(targetRoot, SKILL_NAME);
   const backupDirectory = availableBackupDirectory(destinationDirectory, request.now);
   if (request.mode === "write") {
     replaceSkill(sourceDirectory, targetRoot, destinationDirectory, backupDirectory);
@@ -13032,15 +13780,15 @@ function installReplacementSkill(request, files) {
 }
 function resolveDefaultCodexSkillRoot(environment = process.env, homeDirectory = homedir2()) {
   const codexHome = environment.CODEX_HOME?.trim();
-  return join4(resolve4(codexHome || join4(homeDirectory, ".codex")), "skills");
+  return join5(resolve6(codexHome || join5(homeDirectory, ".codex")), "skills");
 }
 function resolveBundledSkillDirectory(moduleUrl = import.meta.url) {
   const moduleDirectory = dirname2(fileURLToPath(moduleUrl));
   const candidates = [
-    resolve4(moduleDirectory, "../../../skills", SKILL_NAME),
-    resolve4(moduleDirectory, "../skills", SKILL_NAME)
+    resolve6(moduleDirectory, "../../../skills", SKILL_NAME),
+    resolve6(moduleDirectory, "../skills", SKILL_NAME)
   ];
-  const skillDirectory = candidates.find((candidate) => existsSync6(join4(candidate, "SKILL.md")));
+  const skillDirectory = candidates.find((candidate) => existsSync7(join5(candidate, "SKILL.md")));
   if (!skillDirectory)
     throw new Error("Bundled SupaCloud CLI skill is missing from this installation");
   return skillDirectory;
@@ -13062,7 +13810,7 @@ function registerAiTools(server) {
         name: SKILL_NAME,
         sourceDirectory,
         defaultTargetRoot,
-        defaultDestination: join4(defaultTargetRoot, SKILL_NAME)
+        defaultDestination: join5(defaultTargetRoot, SKILL_NAME)
       });
     }
     return textResponse(installSkill({
@@ -13077,8 +13825,8 @@ function registerAiTools(server) {
 
 // src/shared/tools/scheduled-function-tools.ts
 import { randomUUID } from "node:crypto";
-import { readFileSync as readFileSync6, statSync as statSync4 } from "node:fs";
-import { resolve as resolve5 } from "node:path";
+import { readFileSync as readFileSync6, statSync as statSync5 } from "node:fs";
+import { resolve as resolve7 } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 var HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/;
 var ENVIRONMENT_NAME_PATTERN2 = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
@@ -13162,8 +13910,8 @@ function validScheduledFunctionCron(expression) {
 function readScheduleBodyFile(bodyPathInput) {
   if (!bodyPathInput.trim())
     throw new Error("'body_file' must be a path");
-  const bodyPath = resolve5(bodyPathInput);
-  const bodyStat = statSync4(bodyPath);
+  const bodyPath = resolve7(bodyPathInput);
+  const bodyStat = statSync5(bodyPath);
   if (!bodyStat.isFile() || bodyStat.size > MAX_BODY_FILE_BYTES) {
     throw new Error("Scheduled Function body file must be a regular file no larger than 1 MiB");
   }
@@ -13508,14 +14256,14 @@ var SCHEDULE_TOOL_SCHEMA = {
 };
 
 // src/shared/mutation-protocol.ts
-var MUTATION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var MUTATION_ID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/;
 var OPERATION_PATTERN = /^[a-z0-9][a-z0-9._:-]{0,127}$/;
 var RESOURCE_KEY_PATTERN = /^v1\/(?:[a-z0-9][a-z0-9._-]{0,63})\/([A-Za-z0-9_-]{2,171})$/;
 var RESOURCE_ID_CONTROL_PATTERN = /[\u0000-\u001f\u007f-\u009f]/u;
 var FAILURE_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
 var LEASE_OWNER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,254}$/;
-var TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+var TIMESTAMP_PATTERN2 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
 var MAX_STATUS_RESPONSE_BYTES = 196608;
 var MAX_RESOURCE_ID_BYTES = 128;
 var FATAL_UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
@@ -13548,7 +14296,7 @@ var MUTATION_KEYS = [
 var PRINCIPAL_KEYS = ["type", "id"];
 var LEASE_KEYS = ["owner", "expires_at", "fencing_epoch"];
 function isMutationId(candidate) {
-  return typeof candidate === "string" && MUTATION_ID_PATTERN.test(candidate);
+  return typeof candidate === "string" && MUTATION_ID_PATTERN2.test(candidate);
 }
 function objectRecord4(candidate) {
   return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
@@ -13563,14 +14311,14 @@ function emptyProjection(candidate) {
   const record = objectRecord4(candidate);
   return record && Object.keys(record).length === 0 ? record : null;
 }
-function canonicalTimestamp2(candidate) {
-  if (typeof candidate !== "string" || !TIMESTAMP_PATTERN.test(candidate))
+function canonicalTimestamp3(candidate) {
+  if (typeof candidate !== "string" || !TIMESTAMP_PATTERN2.test(candidate))
     return false;
   const milliseconds = Date.parse(candidate);
   return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === candidate;
 }
 function nullableTimestamp(candidate) {
-  return candidate === null || canonicalTimestamp2(candidate);
+  return candidate === null || canonicalTimestamp3(candidate);
 }
 function safePrincipal(candidate) {
   const principal = exactRecord(candidate, PRINCIPAL_KEYS);
@@ -13653,7 +14401,7 @@ function validMutationTerminalFields(mutation) {
     return false;
   if (mutation.failure_code !== null && (typeof mutation.failure_code !== "string" || !FAILURE_CODE_PATTERN.test(mutation.failure_code)))
     return false;
-  return nullableTimestamp(mutation.completed_at) && canonicalTimestamp2(mutation.created_at) && canonicalTimestamp2(mutation.updated_at);
+  return nullableTimestamp(mutation.completed_at) && canonicalTimestamp3(mutation.created_at) && canonicalTimestamp3(mutation.updated_at);
 }
 function safeMutationStatus(candidate) {
   const mutation = exactRecord(candidate, MUTATION_KEYS);
@@ -13761,7 +14509,7 @@ var RELEASE_CANARY_CLAIM_MAX_LENGTH = 2048;
 function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function canonicalTimestamp3(value) {
+function canonicalTimestamp4(value) {
   if (typeof value !== "string")
     return false;
   const parsed = new Date(value);
@@ -13774,7 +14522,7 @@ function backupBelongsToProject(backupId, projectRef2) {
   return BACKUP_ID.test(backupId) && backupId.startsWith(`logical-full_${projectRef2}_`);
 }
 function verifiedBackup(value, projectRef2) {
-  if (!isRecord3(value) || typeof value.backup_id !== "string" || !backupBelongsToProject(value.backup_id, projectRef2) || value.project_ref !== projectRef2 || typeof value.database !== "string" || !SAFE_DATABASE.test(value.database) || value.kind !== "logical-full" || !canonicalTimestamp3(value.created_at) || !canonicalTimestamp3(value.completed_at) || new Date(value.completed_at).valueOf() < new Date(value.created_at).valueOf() || typeof value.bytes !== "number" || !Number.isSafeInteger(value.bytes) || value.bytes <= 0 || typeof value.sha256 !== "string" || !SHA256.test(value.sha256))
+  if (!isRecord3(value) || typeof value.backup_id !== "string" || !backupBelongsToProject(value.backup_id, projectRef2) || value.project_ref !== projectRef2 || typeof value.database !== "string" || !SAFE_DATABASE.test(value.database) || value.kind !== "logical-full" || !canonicalTimestamp4(value.created_at) || !canonicalTimestamp4(value.completed_at) || new Date(value.completed_at).valueOf() < new Date(value.created_at).valueOf() || typeof value.bytes !== "number" || !Number.isSafeInteger(value.bytes) || value.bytes <= 0 || typeof value.sha256 !== "string" || !SHA256.test(value.sha256))
     return null;
   return {
     backup_id: value.backup_id,
@@ -14121,7 +14869,7 @@ function registerReleaseTools(server, http, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.32.0",
+  version: "0.34.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -14386,6 +15134,9 @@ EXAMPLES
   ${preferredCommand} supabase db_diff --schema public --name add_accounts
   ${preferredCommand} supabase push --ref abc123 --dir supabase/migrations --dry_run
   ${preferredCommand} supabase db_dump --db_url "postgresql://..." --file backups/schema.sql
+  ${preferredCommand} lite migrate --project_dir .
+  ${preferredCommand} lite start --project_dir . --port 54321
+  ${preferredCommand} lite doctor --project_dir . --json
   ${preferredCommand} branch create --name feature-auth --data_mode schema_only
   ${preferredCommand} branch promotion_plan --branch_ref preview123
   ${preferredCommand} branch promote --branch_ref preview123 --plan_checksum <sha256>
@@ -14438,6 +15189,7 @@ function createCliTools(context, confirmProduction) {
     projectRef: context.projectRef || undefined,
     readOnly: context.readOnly
   })));
+  Object.assign(tools, captureTools((server) => registerLiteCliTools(server)));
   Object.assign(tools, captureTools((server) => registerAiTools(server)));
   const registerContextAwareHelp = () => {
     tools.project = {
@@ -14494,6 +15246,11 @@ function createCliTools(context, confirmProduction) {
     if (branchHelpTool) {
       tools.branch = { schema: branchHelpTool.schema, callback: branchContextCallback };
     }
+    const frontendContextCallback = tools.frontend.callback;
+    const frontendHelpTool = captureTools((server) => registerFrontendTools(server, {})).frontend;
+    if (frontendHelpTool) {
+      tools.frontend = { schema: frontendHelpTool.schema, callback: frontendContextCallback };
+    }
   };
   if (context.credentialScope !== "management" || !context.apiUrl || !context.apiToken) {
     registerContextAwareHelp();
@@ -14599,7 +15356,7 @@ async function main() {
     return;
   }
   const cliTools = createCliTools(context, globalOptions.confirmProduction);
-  if (args.length === 1 && !["ai", "supabase"].includes(args[0]) && cliTools[args[0]]) {
+  if (args.length === 1 && !["ai", "supabase", "lite"].includes(args[0]) && cliTools[args[0]]) {
     const result = await cliTools[args[0]].callback({});
     if (result?.content && Array.isArray(result.content)) {
       for (const chunk of result.content) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",