@supacloud/cli 0.33.0 → 0.34.0

package/README.md

@@ -106,6 +106,32 @@ loopback development origins, with the default `:80` likewise omitted. Use
 `SUPACLOUD_PROJECT_REF` when it cannot be inferred from a managed
 `<ref>.api.*` application hostname.
 
+### Immutable frontend releases
+
+The `frontend` command keeps the existing deployment, Git, and legacy ZIP
+actions and also exposes the immutable prebuilt release workflow:
+
+```bash
+supacloud-cli frontend list_releases --ref abc123 --id web
+supacloud-cli frontend get_release --ref abc123 --id web --release_id <sha256>
+supacloud-cli frontend upload_release --ref abc123 --id web --zip_path ./dist.zip
+supacloud-cli frontend activate_release --ref abc123 --id web \
+  --release_id <sha256> \
+  --expected_active_release_id absent \
+  --expected_activation_id absent \
+  --mutation_id <retry-stable-uuid-v4>
+```
+
+`upload_release` hashes and streams an existing regular ZIP file without
+buffering the full archive. The Management API binds the upload to that SHA-256,
+and the CLI reads the immutable release back before reporting success.
+`activate_release` uses both the observed active release and activation IDs as
+optimistic concurrency tokens, then verifies the authoritative active release.
+Use the values returned by `list_releases`; `absent` is valid only when no
+release has been activated. Production uploads and activations require the
+normal exact `--confirm-production <ref>` value, and
+`SUPACLOUD_READ_ONLY=true` blocks both mutations.
+
 ### Verified release controls
 
 `release` is an official CLI entry point for verified Management API controls

package/dist/index.js

@@ -6514,8 +6514,8 @@ var ACTION_POLICY = {
   },
   secrets: { read: ["list"], write: ["upsert", "delete"] },
   frontend: {
-    read: ["list", "get", "build_logs", "list_frameworks", "list_records"],
-    write: ["create", "update", "delete", "deploy_git", "deploy_upload", "redeploy", "add_domain", "remove_domain", "set_env"]
+    read: ["list", "get", "build_logs", "list_frameworks", "list_records", "list_releases", "get_release"],
+    write: ["create", "update", "delete", "deploy_git", "deploy_upload", "redeploy", "add_domain", "remove_domain", "set_env", "upload_release", "activate_release"]
   },
   task_events: { read: ["inspect_webhook"], write: ["register_webhook", "unregister_webhook"] },
   diagnostics: { read: ["list_checks", "get_run"], write: ["run_checks", "repair"] },
@@ -6875,6 +6875,7 @@ class HttpTransport {
   async post(path, body, options) {
     const timeoutMs = validatedPostTimeout(options);
     const maxJsonBytes = validatedJsonResponseLimit(options?.maxJsonBytes);
+    const responseTimeoutMs = validatedResponseTimeout(options?.responseTimeoutMs);
     try {
       if (maxJsonBytes === undefined) {
         return await this.mutationWithResponseReader("POST", path, serializedRequestBody(body), responseJsonOrNull, timeoutMs);
@@ -6884,7 +6885,7 @@ class HttpTransport {
         headers: this.headers(),
         body: serializedRequestBody(body)
       }, timeoutMs);
-      const data = await boundedResponseJson(response, maxJsonBytes);
+      const data = await boundedResponseJson(response, maxJsonBytes, responseTimeoutMs);
       return data === null ? responseReadFailure(response.status) : { ok: response.ok, status: response.status, data };
     } catch (error) {
       return transportFailure(error);
@@ -6894,6 +6895,39 @@ class HttpTransport {
     const timeoutMs = validatedPostTimeout(options);
     return this.mutationWithResponseReader("POST", path, serializedRequestBody(body), releaseMutationResponseJson, timeoutMs);
   }
+  async postBinary(path, body, options) {
+    if (options.contentType !== "application/zip") {
+      throw new Error("Binary HTTP content type is invalid");
+    }
+    if (!Number.isSafeInteger(options.contentLength) || options.contentLength < 1 || options.contentLength !== body.byteLength) {
+      throw new RangeError("Binary HTTP body length is invalid");
+    }
+    if (!/^[0-9a-f]{64}$/u.test(options.contentSha256)) {
+      throw new Error("Binary HTTP body SHA-256 is invalid");
+    }
+    const maxJsonBytes = validatedJsonResponseLimit(options.maxJsonBytes);
+    const timeoutMs = validatedPostTimeout(options);
+    const responseTimeoutMs = validatedResponseTimeout(options.responseTimeoutMs);
+    try {
+      const request = {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.token}`,
+          "Content-Type": options.contentType,
+          "Content-Length": String(options.contentLength),
+          "x-supacloud-content-sha256": options.contentSha256,
+          ...this.apiKey ? { apikey: this.apiKey } : {}
+        },
+        body: body.stream,
+        duplex: "half"
+      };
+      const response = await fetchWithRetry(`${this.baseUrl}${path}`, request, timeoutMs);
+      const data = await boundedResponseJson(response, maxJsonBytes, responseTimeoutMs);
+      return data === null ? responseReadFailure(response.status) : { ok: response.ok, status: response.status, data };
+    } catch (error) {
+      return transportFailure(error);
+    }
+  }
   async patchReleaseMutation(path, body) {
     return this.mutationWithResponseReader("PATCH", path, serializedRequestBody(body), releaseMutationResponseJson);
   }
@@ -11034,9 +11068,418 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status}): ${JSON.stringif
 // src/shared/tools/frontend-tools.ts
 import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
 import { basename as basename3 } from "node:path";
+
+// src/shared/tools/frontend-release-control.ts
+import { createHash as createHash3 } from "node:crypto";
+import { constants as fsConstants2 } from "node:fs";
+import { open } from "node:fs/promises";
+import { resolve as resolve3 } from "node:path";
+var PROJECT_REF_PATTERN3 = /^[A-Za-z0-9_-]{1,20}$/u;
+var DEPLOYMENT_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/u;
+var RELEASE_ID_PATTERN = /^[0-9a-f]{64}$/u;
+var MUTATION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+var TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
+var ARCHIVE_MAX_BYTES = 100 * 1024 * 1024;
+var ARCHIVE_CHUNK_BYTES = 64 * 1024;
+var RESPONSE_MAX_BYTES = 1024 * 1024;
+var UPLOAD_REQUEST_TIMEOUT_MS = 10 * 60000;
+var MUTATION_RESPONSE_TIMEOUT_MS = 5000;
+var RELEASE_LIST_LIMIT_MAX = 100;
+function toolResponse(payload) {
+  return { content: [{ type: "text", text: JSON.stringify(payload, null, 2) }] };
+}
+function releaseFailure(operation, code, status) {
+  return {
+    isError: true,
+    content: [{
+      type: "text",
+      text: JSON.stringify({ ok: false, operation, error: { code, http_status: status } })
+    }]
+  };
+}
+function exactKeys(candidate, keys) {
+  const actual = Object.keys(candidate).sort();
+  const expected = [...keys].sort();
+  return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function releaseRecord(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const record = candidate;
+  const keys = [
+    "schema",
+    "project_ref",
+    "deployment_id",
+    "release_id",
+    "sha256",
+    "tree_sha256",
+    "size_bytes",
+    "file_count",
+    "created_at",
+    "kind"
+  ];
+  if (!exactKeys(record, keys) || record.schema !== "supacloud.frontend-release.v1" || typeof record.project_ref !== "string" || !PROJECT_REF_PATTERN3.test(record.project_ref) || typeof record.deployment_id !== "string" || !DEPLOYMENT_ID_PATTERN.test(record.deployment_id) || typeof record.release_id !== "string" || !RELEASE_ID_PATTERN.test(record.release_id) || record.sha256 !== record.release_id || typeof record.tree_sha256 !== "string" || !RELEASE_ID_PATTERN.test(record.tree_sha256) || !Number.isSafeInteger(record.size_bytes) || Number(record.size_bytes) < 1 || !Number.isSafeInteger(record.file_count) || Number(record.file_count) < 1 || !canonicalTimestamp(record.created_at) || record.kind !== "prebuilt_static")
+    return null;
+  return {
+    project_ref: record.project_ref,
+    deployment_id: record.deployment_id,
+    release_id: record.release_id,
+    sha256: record.release_id,
+    tree_sha256: record.tree_sha256,
+    size_bytes: Number(record.size_bytes),
+    file_count: Number(record.file_count),
+    created_at: record.created_at,
+    kind: "prebuilt_static"
+  };
+}
+function releaseEnvelope(candidate, expected) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const envelope = candidate;
+  const release = exactKeys(envelope, ["project_ref", "deployment_id", "release"]) ? releaseRecord(envelope.release) : null;
+  if (!release || envelope.project_ref !== expected.projectRef || envelope.deployment_id !== expected.deploymentId || release.project_ref !== expected.projectRef || release.deployment_id !== expected.deploymentId || release.release_id !== expected.releaseId)
+    return null;
+  return release;
+}
+function canonicalTimestamp(candidate) {
+  if (typeof candidate !== "string" || !TIMESTAMP_PATTERN.test(candidate))
+    return false;
+  const milliseconds = Date.parse(candidate);
+  return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === candidate;
+}
+function nullableIdentity(candidate, pattern) {
+  if (candidate === null)
+    return null;
+  return typeof candidate === "string" && pattern.test(candidate) ? candidate : undefined;
+}
+function releaseInventory(candidate, expected) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const record = candidate;
+  const keys = [
+    "project_ref",
+    "deployment_id",
+    "active_release_id",
+    "active_activation_id",
+    "releases",
+    "next_cursor"
+  ];
+  if (!exactKeys(record, keys) || typeof record.project_ref !== "string" || !PROJECT_REF_PATTERN3.test(record.project_ref) || typeof record.deployment_id !== "string" || !DEPLOYMENT_ID_PATTERN.test(record.deployment_id) || !Array.isArray(record.releases))
+    return null;
+  const activeReleaseId = nullableIdentity(record.active_release_id, RELEASE_ID_PATTERN);
+  const activeActivationId = nullableIdentity(record.active_activation_id, MUTATION_ID_PATTERN);
+  const nextCursor = nullableIdentity(record.next_cursor, RELEASE_ID_PATTERN);
+  const releases = record.releases.map(releaseRecord);
+  if (activeReleaseId === undefined || activeActivationId === undefined || nextCursor === undefined || activeReleaseId === null !== (activeActivationId === null) || releases.some((release) => release === null))
+    return null;
+  const verified = releases;
+  if (new Set(verified.map((release) => release.release_id)).size !== verified.length || verified.some((release) => release.project_ref !== record.project_ref || release.deployment_id !== record.deployment_id) || expected && (record.project_ref !== expected.projectRef || record.deployment_id !== expected.deploymentId))
+    return null;
+  return {
+    project_ref: record.project_ref,
+    deployment_id: record.deployment_id,
+    active_release_id: activeReleaseId,
+    active_activation_id: activeActivationId,
+    releases: verified,
+    next_cursor: nextCursor
+  };
+}
+function releaseEndpoint(projectRef2, deploymentId) {
+  if (!PROJECT_REF_PATTERN3.test(projectRef2))
+    throw new Error("'ref' is invalid for frontend releases");
+  if (!DEPLOYMENT_ID_PATTERN.test(deploymentId))
+    throw new Error("'id' is invalid for frontend releases");
+  return `/v1/projects/${encodeURIComponent(projectRef2)}/frontend/deployments/${encodeURIComponent(deploymentId)}/releases`;
+}
+function releasePath(projectRef2, deploymentId, releaseId) {
+  if (!RELEASE_ID_PATTERN.test(releaseId))
+    throw new Error("'release_id' must be a SHA-256 digest");
+  return `${releaseEndpoint(projectRef2, deploymentId)}/${releaseId}`;
+}
+function sameArchiveIdentity(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
+}
+async function archiveSha256(handle, sizeBytes) {
+  const hash2 = createHash3("sha256");
+  const chunk = new Uint8Array(Math.min(sizeBytes, ARCHIVE_CHUNK_BYTES));
+  for (let offset = 0;offset < sizeBytes; ) {
+    const requested = Math.min(chunk.byteLength, sizeBytes - offset);
+    const { bytesRead } = await handle.read(chunk, 0, requested, offset);
+    if (bytesRead < 1)
+      throw new Error("Frontend release archive changed while it was hashed");
+    hash2.update(chunk.subarray(0, bytesRead));
+    offset += bytesRead;
+  }
+  return hash2.digest("hex");
+}
+async function verifiedArchive(path) {
+  const archivePath = resolve3(path);
+  const handle = await open(archivePath, fsConstants2.O_RDONLY | fsConstants2.O_NOFOLLOW);
+  try {
+    const before = await handle.stat({ bigint: true });
+    const sizeBytes = Number(before.size);
+    if (!before.isFile() || sizeBytes < 1 || sizeBytes > ARCHIVE_MAX_BYTES) {
+      throw new Error(`Frontend release archive must be a 1-${ARCHIVE_MAX_BYTES} byte regular file`);
+    }
+    const sha256 = await archiveSha256(handle, sizeBytes);
+    const after = await handle.stat({ bigint: true });
+    if (!sameArchiveIdentity(before, after)) {
+      throw new Error("Frontend release archive identity changed while it was hashed");
+    }
+    return { handle, sizeBytes, sha256 };
+  } catch (error) {
+    await handle.close();
+    throw error;
+  }
+}
+function archiveStream(archive) {
+  let offset = 0;
+  return new ReadableStream({
+    async pull(controller) {
+      if (offset === archive.sizeBytes) {
+        controller.close();
+        return;
+      }
+      const length = Math.min(ARCHIVE_CHUNK_BYTES, archive.sizeBytes - offset);
+      const chunk = new Uint8Array(length);
+      const { bytesRead } = await archive.handle.read(chunk, 0, length, offset);
+      if (bytesRead < 1)
+        throw new Error("Frontend release archive changed while it was uploaded");
+      offset += bytesRead;
+      controller.enqueue(bytesRead === length ? chunk : chunk.subarray(0, bytesRead));
+    }
+  });
+}
+function releaseReadFailure(operation, response) {
+  return releaseFailure(operation, response.ok ? "INVALID_RESPONSE" : "HTTP_ERROR", response.status);
+}
+async function listFrontendReleases(http, projectRef2, deploymentId, cursor, limit = 50) {
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > RELEASE_LIST_LIMIT_MAX) {
+    throw new Error("'limit' must be 1-100");
+  }
+  if (cursor !== undefined && !RELEASE_ID_PATTERN.test(cursor))
+    throw new Error("'cursor' is invalid");
+  const query = new URLSearchParams({ limit: String(limit) });
+  if (cursor)
+    query.set("cursor", cursor);
+  const response = await http.get(`${releaseEndpoint(projectRef2, deploymentId)}?${query}`, {
+    maxJsonBytes: RESPONSE_MAX_BYTES
+  });
+  const inventory = response.ok ? releaseInventory(response.data, { projectRef: projectRef2, deploymentId }) : null;
+  if (!inventory || inventory.releases.length > limit) {
+    return releaseReadFailure("frontend.list_releases", response);
+  }
+  return toolResponse(inventory);
+}
+async function getFrontendRelease(http, projectRef2, deploymentId, releaseId) {
+  const response = await http.get(releasePath(projectRef2, deploymentId, releaseId), {
+    maxJsonBytes: RESPONSE_MAX_BYTES
+  });
+  const release = response.ok ? releaseEnvelope(response.data, { projectRef: projectRef2, deploymentId, releaseId }) : null;
+  if (!release) {
+    return releaseReadFailure("frontend.get_release", response);
+  }
+  return toolResponse({ project_ref: projectRef2, deployment_id: deploymentId, release });
+}
+async function uploadFrontendRelease(http, projectRef2, deploymentId, archivePath) {
+  const endpoint = releaseEndpoint(projectRef2, deploymentId);
+  const archive = await verifiedArchive(archivePath);
+  let response;
+  try {
+    response = await http.postBinary(endpoint, {
+      stream: archiveStream(archive),
+      byteLength: archive.sizeBytes
+    }, {
+      contentType: "application/zip",
+      contentLength: archive.sizeBytes,
+      contentSha256: archive.sha256,
+      maxJsonBytes: RESPONSE_MAX_BYTES,
+      timeoutMs: UPLOAD_REQUEST_TIMEOUT_MS,
+      responseTimeoutMs: MUTATION_RESPONSE_TIMEOUT_MS
+    });
+  } finally {
+    await archive.handle.close();
+  }
+  const release = response.ok ? releaseEnvelope(response.data, { projectRef: projectRef2, deploymentId, releaseId: archive.sha256 }) : null;
+  if (!release) {
+    if (response.status >= 400 && response.status < 500 && response.status !== 408 && !response.transportError) {
+      return releaseFailure("frontend.upload_release", "HTTP_ERROR", response.status);
+    }
+    return uploadReadback(http, projectRef2, deploymentId, archive.sha256, response.status);
+  }
+  const readback = await http.get(`${endpoint}/${release.release_id}`, { maxJsonBytes: RESPONSE_MAX_BYTES });
+  const verified = readback.ok ? releaseEnvelope(readback.data, { projectRef: projectRef2, deploymentId, releaseId: release.release_id }) : null;
+  if (!verified || verified.tree_sha256 !== release.tree_sha256) {
+    return releaseFailure("frontend.upload_release", "OUTCOME_UNKNOWN", readback.status);
+  }
+  return toolResponse({ project_ref: projectRef2, deployment_id: deploymentId, release: verified });
+}
+async function uploadReadback(http, projectRef2, deploymentId, releaseId, uploadStatus) {
+  const response = await http.get(releasePath(projectRef2, deploymentId, releaseId), {
+    maxJsonBytes: RESPONSE_MAX_BYTES
+  });
+  const release = response.ok ? releaseEnvelope(response.data, { projectRef: projectRef2, deploymentId, releaseId }) : null;
+  if (!release) {
+    return releaseFailure("frontend.upload_release", "OUTCOME_UNKNOWN", uploadStatus);
+  }
+  return toolResponse({ project_ref: projectRef2, deployment_id: deploymentId, release });
+}
+function stableJson(candidate) {
+  if (candidate === null || typeof candidate !== "object")
+    return JSON.stringify(candidate);
+  if (Array.isArray(candidate))
+    return `[${candidate.map(stableJson).join(",")}]`;
+  const record = candidate;
+  return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
+}
+function activationFingerprint(identity) {
+  return createHash3("sha256").update(stableJson({
+    project_ref: identity.projectRef,
+    deployment_id: identity.deploymentId,
+    release_id: identity.releaseId,
+    expected_active_release_id: identity.expectedActiveReleaseId,
+    activation_id: identity.mutationId,
+    expected_activation_id: identity.expectedActivationId
+  })).digest("hex");
+}
+function activationResourceKey(deploymentId) {
+  return `v1/frontend_release/${Buffer.from(deploymentId, "utf8").toString("base64url")}`;
+}
+function publicMutationReceipt(candidate, expected) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const envelope = candidate;
+  const mutation = envelope.mutation;
+  const expectedKeys = [
+    "project_ref",
+    "mutation_id",
+    "operation",
+    "resource_key",
+    "request_fingerprint",
+    "principal",
+    "status",
+    "checkpoint",
+    "receipt",
+    "response_status",
+    "failure_code",
+    "lease",
+    "completed_at",
+    "created_at",
+    "updated_at"
+  ];
+  if (!mutation || !exactKeys(envelope, ["project_ref", "mutation"]) || !exactKeys(mutation, expectedKeys) || envelope.project_ref !== expected.projectRef || mutation.project_ref !== expected.projectRef || mutation.mutation_id !== expected.mutationId || mutation.resource_key !== expected.resourceKey || mutation.request_fingerprint !== expected.requestFingerprint || typeof mutation.operation !== "string" || typeof mutation.status !== "string" || !(mutation.response_status === null || Number.isSafeInteger(mutation.response_status)) || !(mutation.failure_code === null || typeof mutation.failure_code === "string"))
+    return null;
+  return {
+    operation: mutation.operation,
+    status: mutation.status,
+    responseStatus: mutation.response_status,
+    failureCode: mutation.failure_code
+  };
+}
+function activationReceipt(candidate, input) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const record = candidate;
+  const release = releaseRecord(record.release);
+  const mutation = record.mutation;
+  if (!release || !mutation || !exactKeys(record, [
+    "project_ref",
+    "deployment_id",
+    "active_release_id",
+    "activation_id",
+    "release",
+    "mutation"
+  ]) || !exactKeys(mutation, ["mutation_id", "status", "replayed"]) || record.project_ref !== input.projectRef || record.deployment_id !== input.deploymentId || record.active_release_id !== input.releaseId || record.activation_id !== input.mutationId || release.project_ref !== input.projectRef || release.deployment_id !== input.deploymentId || release.release_id !== input.releaseId || mutation.mutation_id !== input.mutationId || mutation.status !== "succeeded" || typeof mutation.replayed !== "boolean")
+    return null;
+  return release;
+}
+async function activeReleaseReadback(http, identity) {
+  const endpoint = releaseEndpoint(identity.projectRef, identity.deploymentId);
+  const inventoryRead = await http.get(`${endpoint}?limit=${RELEASE_LIST_LIMIT_MAX}`, {
+    maxJsonBytes: RESPONSE_MAX_BYTES
+  });
+  const inventory = inventoryRead.ok ? releaseInventory(inventoryRead.data, {
+    projectRef: identity.projectRef,
+    deploymentId: identity.deploymentId
+  }) : null;
+  if (!inventory || inventory.releases.length > RELEASE_LIST_LIMIT_MAX || inventory.active_release_id !== identity.releaseId || inventory.active_activation_id !== identity.mutationId) {
+    return { release: null, status: inventoryRead.status };
+  }
+  const releaseRead = await http.get(releasePath(identity.projectRef, identity.deploymentId, identity.releaseId), { maxJsonBytes: RESPONSE_MAX_BYTES });
+  const release = releaseRead.ok ? releaseEnvelope(releaseRead.data, {
+    projectRef: identity.projectRef,
+    deploymentId: identity.deploymentId,
+    releaseId: identity.releaseId
+  }) : null;
+  return { release, status: releaseRead.status };
+}
+async function activateFrontendRelease(http, input) {
+  const mutationId = input.mutationId;
+  if (!MUTATION_ID_PATTERN.test(mutationId))
+    throw new Error("'mutation_id' must be a UUIDv4");
+  if (input.expectedActiveReleaseId !== "absent" && !RELEASE_ID_PATTERN.test(input.expectedActiveReleaseId)) {
+    throw new Error("'expected_active_release_id' is invalid");
+  }
+  if (input.expectedActivationId !== "absent" && !MUTATION_ID_PATTERN.test(input.expectedActivationId)) {
+    throw new Error("'expected_activation_id' is invalid");
+  }
+  const endpoint = `${releasePath(input.projectRef, input.deploymentId, input.releaseId)}/activate`;
+  const response = await http.post(endpoint, {
+    expected_active_release_id: input.expectedActiveReleaseId,
+    expected_activation_id: input.expectedActivationId,
+    mutation_id: mutationId
+  }, {
+    maxJsonBytes: RESPONSE_MAX_BYTES,
+    responseTimeoutMs: MUTATION_RESPONSE_TIMEOUT_MS
+  });
+  const release = activationReceipt(response.data, { ...input, mutationId });
+  if (!response.ok || !release) {
+    if (response.status >= 400 && response.status < 500 && response.status !== 408 && !response.transportError) {
+      return releaseFailure("frontend.activate_release", "HTTP_ERROR", response.status);
+    }
+    return activationReadback(http, input, mutationId, response.status);
+  }
+  const readback = await activeReleaseReadback(http, { ...input, mutationId });
+  if (!readback.release || readback.release.tree_sha256 !== release.tree_sha256) {
+    return releaseFailure("frontend.activate_release", "OUTCOME_UNKNOWN", readback.status);
+  }
+  return toolResponse({
+    project_ref: input.projectRef,
+    deployment_id: input.deploymentId,
+    active_release_id: input.releaseId,
+    activation_id: mutationId,
+    release: readback.release
+  });
+}
+async function activationReadback(http, input, mutationId, activationStatus) {
+  const mutationRead = await http.get(`/v1/projects/${encodeURIComponent(input.projectRef)}/mutations/${mutationId}`, { maxJsonBytes: RESPONSE_MAX_BYTES });
+  const mutationEnvelope = mutationRead.data;
+  const mutation = mutationRead.ok ? publicMutationReceipt(mutationRead.data, {
+    projectRef: input.projectRef,
+    mutationId,
+    resourceKey: activationResourceKey(input.deploymentId),
+    requestFingerprint: activationFingerprint({ ...input, mutationId })
+  }) : null;
+  if (!mutation || mutationEnvelope?.project_ref !== input.projectRef || mutation.operation !== "frontend.release.activate" || mutation.status !== "succeeded" || mutation.responseStatus !== 200 || mutation.failureCode !== null) {
+    return releaseFailure("frontend.activate_release", "OUTCOME_UNKNOWN", activationStatus);
+  }
+  const readback = await activeReleaseReadback(http, { ...input, mutationId });
+  if (!readback.release) {
+    return releaseFailure("frontend.activate_release", "OUTCOME_UNKNOWN", activationStatus);
+  }
+  return toolResponse({
+    project_ref: input.projectRef,
+    deployment_id: input.deploymentId,
+    active_release_id: input.releaseId,
+    activation_id: mutationId,
+    release: readback.release
+  });
+}
+
+// src/shared/tools/frontend-tools.ts
 function registerFrontendTools(server, http) {
-  server.tool("frontend", `Frontend hosting (static sites & SSR). Supports: static, react, vue, svelte, sveltekit, sveltekit-static, nextjs, nuxt, astro.
-Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy, build_logs, add_domain, remove_domain, set_env, list_frameworks, list_records`, {
+  server.tool("frontend", `Frontend hosting and immutable prebuilt releases. Supports: static, react, vue, svelte, sveltekit, sveltekit-static, nextjs, nuxt, astro.
+Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy, build_logs, add_domain, remove_domain, set_env, list_frameworks, list_records, list_releases, get_release, upload_release, activate_release`, {
     action: withDescription(stringEnum([
       "list",
       "get",
@@ -11051,7 +11494,11 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
       "remove_domain",
       "set_env",
       "list_frameworks",
-      "list_records"
+      "list_records",
+      "list_releases",
+      "get_release",
+      "upload_release",
+      "activate_release"
     ]), "Action"),
     ref: optional(Type.String(), "Project ref"),
     id: optional(Type.String(), "Deployment ID"),
@@ -11066,9 +11513,37 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
     env_vars: optional(Type.Record(Type.String(), Type.String()), "[create/update/set_env] Environment variables"),
     git_url: optional(Type.String(), "[deploy_git] Git repository URL"),
     branch: optional(Type.String(), "[deploy_git] Branch (default: main)"),
-    zip_path: optional(Type.String(), "[deploy_upload] Local zip file path")
+    zip_path: optional(Type.String(), "[deploy_upload/upload_release] Local ZIP file path"),
+    release_id: optional(Type.String(), "[get_release/activate_release] SHA-256 release ID"),
+    expected_active_release_id: optional(Type.String(), "[activate_release] Current release SHA-256 or absent"),
+    expected_activation_id: optional(Type.String(), "[activate_release] Current activation UUIDv4 or absent"),
+    mutation_id: optional(Type.String(), "[activate_release] Required retry-stable UUIDv4"),
+    cursor: optional(Type.String(), "[list_releases] Last release SHA-256 cursor"),
+    limit: optional(Type.Number(), "[list_releases] Page size, 1-100 (default 50)")
   }, async (args) => {
-    const { action, ref, id, name, framework, domain, build_command, output_dir, install_command, node_version, health_check_path, env_vars, git_url, branch, zip_path } = args;
+    const {
+      action,
+      ref,
+      id,
+      name,
+      framework,
+      domain,
+      build_command,
+      output_dir,
+      install_command,
+      node_version,
+      health_check_path,
+      env_vars,
+      git_url,
+      branch,
+      zip_path,
+      release_id,
+      expected_active_release_id,
+      expected_activation_id,
+      mutation_id,
+      cursor,
+      limit
+    } = args;
     const need = (f, v) => {
       if (!v)
         throw new Error(`'${f}' required for '${action}'`);
@@ -11175,6 +11650,35 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
         need("id", id);
         text = ok(await http.get(`/v1/projects/${ref}/frontend/deployments/${id}/records`));
         break;
+      case "list_releases":
+        need("ref", ref);
+        need("id", id);
+        return listFrontendReleases(http, ref, id, cursor, limit);
+      case "get_release":
+        need("ref", ref);
+        need("id", id);
+        need("release_id", release_id);
+        return getFrontendRelease(http, ref, id, release_id);
+      case "upload_release":
+        need("ref", ref);
+        need("id", id);
+        need("zip_path", zip_path);
+        return uploadFrontendRelease(http, ref, id, zip_path);
+      case "activate_release":
+        need("ref", ref);
+        need("id", id);
+        need("release_id", release_id);
+        need("expected_active_release_id", expected_active_release_id);
+        need("expected_activation_id", expected_activation_id);
+        need("mutation_id", mutation_id);
+        return activateFrontendRelease(http, {
+          projectRef: ref,
+          deploymentId: id,
+          releaseId: release_id,
+          expectedActiveReleaseId: expected_active_release_id,
+          expectedActivationId: expected_activation_id,
+          mutationId: mutation_id
+        });
       default:
         text = `❌ Unknown action`;
     }
@@ -11184,7 +11688,7 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
 
 // src/shared/tools/project-read-projection.ts
 var PROJECT_READ_RESPONSE_MAX_BYTES = 1048576;
-var PROJECT_REF_PATTERN3 = /^[a-z0-9-]{1,20}$/;
+var PROJECT_REF_PATTERN4 = /^[a-z0-9-]{1,20}$/;
 var SAFE_IDENTIFIER_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 var REGION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
 var STATUS_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
@@ -11248,7 +11752,7 @@ function matchingText(candidate, maxLength, pattern) {
   const candidateText = boundedText2(candidate, maxLength);
   return candidateText && pattern.test(candidateText) ? candidateText : null;
 }
-function canonicalTimestamp(candidate) {
+function canonicalTimestamp2(candidate) {
   const timestamp = boundedText2(candidate, 64);
   if (!timestamp)
     return null;
@@ -11258,12 +11762,12 @@ function canonicalTimestamp(candidate) {
 function projectedSummary(project) {
   const summary = {
     id: matchingText(project.id, 128, SAFE_IDENTIFIER_PATTERN),
-    ref: matchingText(project.ref, 20, PROJECT_REF_PATTERN3),
+    ref: matchingText(project.ref, 20, PROJECT_REF_PATTERN4),
     organization_id: matchingText(project.organization_id, 128, SAFE_IDENTIFIER_PATTERN),
     organization_slug: matchingText(project.organization_slug, 128, SAFE_IDENTIFIER_PATTERN),
     name: boundedText2(project.name, 100),
     region: matchingText(project.region, 64, REGION_PATTERN),
-    created_at: canonicalTimestamp(project.created_at),
+    created_at: canonicalTimestamp2(project.created_at),
     status: matchingText(project.status, 64, STATUS_PATTERN)
   };
   return Object.values(summary).every((field) => field !== null) ? summary : null;
@@ -11382,7 +11886,7 @@ function projectGetRead(response, expectedRef) {
 // src/shared/tools/project-endpoint-read.ts
 var PROJECT_ENDPOINT_RESPONSE_MAX_BYTES = 256 * 1024;
 var PROJECT_ENDPOINT_LIST_RESPONSE_MAX_BYTES = 1024 * 1024;
-var PROJECT_REF_PATTERN4 = /^[a-z0-9-]{1,20}$/;
+var PROJECT_REF_PATTERN5 = /^[a-z0-9-]{1,20}$/;
 var PROJECT_ENDPOINTS_SCHEMA = "supacloud.project-endpoints.v1";
 var PROJECT_ENDPOINT_SOURCES = new Set([
   "explicit_api_domain",
@@ -11452,7 +11956,7 @@ function projectEndpoint2(candidate) {
 }
 function projectEndpointProjection(candidate) {
   const projection = plainRecord2(candidate);
-  if (!projection || !hasOnlyKeys2(projection, ROOT_KEYS) || projection.schema !== PROJECT_ENDPOINTS_SCHEMA || typeof projection.project_ref !== "string" || !PROJECT_REF_PATTERN4.test(projection.project_ref))
+  if (!projection || !hasOnlyKeys2(projection, ROOT_KEYS) || projection.schema !== PROJECT_ENDPOINTS_SCHEMA || typeof projection.project_ref !== "string" || !PROJECT_REF_PATTERN5.test(projection.project_ref))
     return null;
   const endpoints = plainRecord2(projection.endpoints);
   if (!endpoints || !hasOnlyKeys2(endpoints, ENDPOINTS_KEYS))
@@ -12531,7 +13035,7 @@ function registerBranchTools(server, http, options = {}) {
 // src/shared/tools/supabase-cli-tools.ts
 import { spawn } from "node:child_process";
 import { chmodSync, existsSync as existsSync5, mkdirSync, statSync as statSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname, isAbsolute, join as join3, resolve as resolve3 } from "node:path";
+import { dirname, isAbsolute, join as join3, resolve as resolve4 } from "node:path";
 var SENSITIVE_ENV_KEY = /(?:^|_)(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIALS?|AUTHORIZATION|AUTH|SESSION|COOKIE|BEARER|DB_URI|DB_URL|DSN|DATABASE_URL|DATABASE_URI|CONNECTION_STRING|CONNECTION_URI)(?:_|$)/i;
 var VALID_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 var VALID_MIGRATION_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]{0,100}$/;
@@ -12575,12 +13079,12 @@ function schemaArguments(schema) {
 function workdirArguments(workdir) {
   if (!workdir)
     throw new Error("A workdir is required");
-  return ["--workdir", resolve3(workdir)];
+  return ["--workdir", resolve4(workdir)];
 }
 function resolveOutputPath(workdir, file, label) {
   if (!file || /[\r\n\0]/.test(file))
     throw new Error(`${label} file is required`);
-  return isAbsolute(file) ? resolve3(file) : resolve3(workdir, file);
+  return isAbsolute(file) ? resolve4(file) : resolve4(workdir, file);
 }
 function databaseTargetArguments(databaseUrl) {
   return databaseUrl ? ["--db-url", requirePostgresUrl(databaseUrl)] : ["--local"];
@@ -12665,7 +13169,7 @@ function actionArguments(request, workdir) {
 function buildOfficialSupabaseArgs(request) {
   if (request.action === "version")
     return ["--version"];
-  const workdir = request.workdir ? resolve3(request.workdir) : undefined;
+  const workdir = request.workdir ? resolve4(request.workdir) : undefined;
   if (!workdir)
     throw new Error("A workdir is required");
   return [...actionArguments(request, workdir), ...workdirArguments(workdir)];
@@ -12711,13 +13215,13 @@ function resolveOfficialSupabaseCommand(workdir, environment = process.env) {
     }
     return ["npx", "--yes", `supabase@${version}`];
   }
-  const localPackageEntry = join3(resolve3(workdir), "node_modules", "supabase", "dist", "supabase.js");
+  const localPackageEntry = join3(resolve4(workdir), "node_modules", "supabase", "dist", "supabase.js");
   if (existsSync5(localPackageEntry))
     return [process.execPath, localPackageEntry];
   return ["supabase"];
 }
 function resolveExistingWorkdir(workdirInput, fallback) {
-  const workdir = resolve3(workdirInput || fallback);
+  const workdir = resolve4(workdirInput || fallback);
   if (!existsSync5(workdir) || !statSync3(workdir).isDirectory()) {
     throw new Error(`Supabase workdir not found: ${workdir}`);
   }
@@ -12831,7 +13335,7 @@ async function executeMigrationPush(request, runtime) {
   if (!projectRef2)
     return missingProjectRefResult();
   const workdir = resolveExistingWorkdir(request.workdir, runtime.fallbackWorkdir);
-  const migrationDirectory = resolve3(workdir, request.dir || "supabase/migrations");
+  const migrationDirectory = resolve4(workdir, request.dir || "supabase/migrations");
   const migrationResponse = await pushMigrations({
     action: "push_migrations",
     ref: projectRef2,
@@ -12915,9 +13419,9 @@ function registerSupabaseCliTools(server, options = {}) {
 // src/shared/tools/lite-cli-tools.ts
 import { spawn as spawn2 } from "node:child_process";
 import { existsSync as existsSync6, statSync as statSync4 } from "node:fs";
-import { join as join4, resolve as resolve4 } from "node:path";
+import { join as join4, resolve as resolve5 } from "node:path";
 function requireWorkdir(workdir, fallback) {
-  const resolved = resolve4(workdir || fallback);
+  const resolved = resolve5(workdir || fallback);
   if (!existsSync6(resolved) || !statSync4(resolved).isDirectory()) {
     throw new Error(`Lite workdir not found: ${resolved}`);
   }
@@ -13003,7 +13507,7 @@ function resolveLiteCommand(workdir, environment = process.env) {
       throw new Error("Invalid SUPACLOUD_LITE_CLI_BIN");
     return [explicitBinary];
   }
-  const localPackageEntry = join4(resolve4(workdir), "node_modules", "@supacloud", "lite", "dist", "launcher.cjs");
+  const localPackageEntry = join4(resolve5(workdir), "node_modules", "@supacloud", "lite", "dist", "launcher.cjs");
   if (existsSync6(localPackageEntry))
     return [process.execPath, localPackageEntry];
   return ["supacloud-lite"];
@@ -13151,7 +13655,7 @@ import {
   rmSync as rmSync2
 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname2, join as join5, relative as relative2, resolve as resolve5, sep as sep2 } from "node:path";
+import { dirname as dirname2, join as join5, relative as relative2, resolve as resolve6, sep as sep2 } from "node:path";
 import { fileURLToPath } from "node:url";
 var SKILL_NAME = "supacloud-cli";
 function regularFiles(rootDirectory, currentDirectory = rootDirectory) {
@@ -13224,8 +13728,8 @@ function replaceSkill(sourceDirectory, targetRoot, destinationDirectory, backupD
   }
 }
 function skillSummary(request, action, files, backupDirectory) {
-  const sourceDirectory = resolve5(request.sourceDirectory);
-  const targetRoot = resolve5(request.targetRoot);
+  const sourceDirectory = resolve6(request.sourceDirectory);
+  const targetRoot = resolve6(request.targetRoot);
   return {
     name: SKILL_NAME,
     sourceDirectory,
@@ -13239,8 +13743,8 @@ function skillSummary(request, action, files, backupDirectory) {
   };
 }
 function installSkill(request) {
-  const sourceDirectory = resolve5(request.sourceDirectory);
-  const targetRoot = resolve5(request.targetRoot);
+  const sourceDirectory = resolve6(request.sourceDirectory);
+  const targetRoot = resolve6(request.targetRoot);
   const destinationDirectory = join5(targetRoot, SKILL_NAME);
   if (!existsSync7(join5(sourceDirectory, "SKILL.md"))) {
     throw new Error(`Bundled SupaCloud CLI skill not found: ${sourceDirectory}`);
@@ -13257,16 +13761,16 @@ function installSkill(request) {
   return installReplacementSkill(request, files);
 }
 function installNewSkill(request, files) {
-  const sourceDirectory = resolve5(request.sourceDirectory);
-  const targetRoot = resolve5(request.targetRoot);
+  const sourceDirectory = resolve6(request.sourceDirectory);
+  const targetRoot = resolve6(request.targetRoot);
   if (request.mode === "write") {
     createSkill(sourceDirectory, targetRoot, join5(targetRoot, SKILL_NAME));
   }
   return skillSummary(request, "create", files, null);
 }
 function installReplacementSkill(request, files) {
-  const sourceDirectory = resolve5(request.sourceDirectory);
-  const targetRoot = resolve5(request.targetRoot);
+  const sourceDirectory = resolve6(request.sourceDirectory);
+  const targetRoot = resolve6(request.targetRoot);
   const destinationDirectory = join5(targetRoot, SKILL_NAME);
   const backupDirectory = availableBackupDirectory(destinationDirectory, request.now);
   if (request.mode === "write") {
@@ -13276,13 +13780,13 @@ function installReplacementSkill(request, files) {
 }
 function resolveDefaultCodexSkillRoot(environment = process.env, homeDirectory = homedir2()) {
   const codexHome = environment.CODEX_HOME?.trim();
-  return join5(resolve5(codexHome || join5(homeDirectory, ".codex")), "skills");
+  return join5(resolve6(codexHome || join5(homeDirectory, ".codex")), "skills");
 }
 function resolveBundledSkillDirectory(moduleUrl = import.meta.url) {
   const moduleDirectory = dirname2(fileURLToPath(moduleUrl));
   const candidates = [
-    resolve5(moduleDirectory, "../../../skills", SKILL_NAME),
-    resolve5(moduleDirectory, "../skills", SKILL_NAME)
+    resolve6(moduleDirectory, "../../../skills", SKILL_NAME),
+    resolve6(moduleDirectory, "../skills", SKILL_NAME)
   ];
   const skillDirectory = candidates.find((candidate) => existsSync7(join5(candidate, "SKILL.md")));
   if (!skillDirectory)
@@ -13322,7 +13826,7 @@ function registerAiTools(server) {
 // src/shared/tools/scheduled-function-tools.ts
 import { randomUUID } from "node:crypto";
 import { readFileSync as readFileSync6, statSync as statSync5 } from "node:fs";
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve7 } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 var HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/;
 var ENVIRONMENT_NAME_PATTERN2 = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
@@ -13406,7 +13910,7 @@ function validScheduledFunctionCron(expression) {
 function readScheduleBodyFile(bodyPathInput) {
   if (!bodyPathInput.trim())
     throw new Error("'body_file' must be a path");
-  const bodyPath = resolve6(bodyPathInput);
+  const bodyPath = resolve7(bodyPathInput);
   const bodyStat = statSync5(bodyPath);
   if (!bodyStat.isFile() || bodyStat.size > MAX_BODY_FILE_BYTES) {
     throw new Error("Scheduled Function body file must be a regular file no larger than 1 MiB");
@@ -13752,14 +14256,14 @@ var SCHEDULE_TOOL_SCHEMA = {
 };
 
 // src/shared/mutation-protocol.ts
-var MUTATION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var MUTATION_ID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/;
 var OPERATION_PATTERN = /^[a-z0-9][a-z0-9._:-]{0,127}$/;
 var RESOURCE_KEY_PATTERN = /^v1\/(?:[a-z0-9][a-z0-9._-]{0,63})\/([A-Za-z0-9_-]{2,171})$/;
 var RESOURCE_ID_CONTROL_PATTERN = /[\u0000-\u001f\u007f-\u009f]/u;
 var FAILURE_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
 var LEASE_OWNER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,254}$/;
-var TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+var TIMESTAMP_PATTERN2 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
 var MAX_STATUS_RESPONSE_BYTES = 196608;
 var MAX_RESOURCE_ID_BYTES = 128;
 var FATAL_UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
@@ -13792,7 +14296,7 @@ var MUTATION_KEYS = [
 var PRINCIPAL_KEYS = ["type", "id"];
 var LEASE_KEYS = ["owner", "expires_at", "fencing_epoch"];
 function isMutationId(candidate) {
-  return typeof candidate === "string" && MUTATION_ID_PATTERN.test(candidate);
+  return typeof candidate === "string" && MUTATION_ID_PATTERN2.test(candidate);
 }
 function objectRecord4(candidate) {
   return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
@@ -13807,14 +14311,14 @@ function emptyProjection(candidate) {
   const record = objectRecord4(candidate);
   return record && Object.keys(record).length === 0 ? record : null;
 }
-function canonicalTimestamp2(candidate) {
-  if (typeof candidate !== "string" || !TIMESTAMP_PATTERN.test(candidate))
+function canonicalTimestamp3(candidate) {
+  if (typeof candidate !== "string" || !TIMESTAMP_PATTERN2.test(candidate))
     return false;
   const milliseconds = Date.parse(candidate);
   return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === candidate;
 }
 function nullableTimestamp(candidate) {
-  return candidate === null || canonicalTimestamp2(candidate);
+  return candidate === null || canonicalTimestamp3(candidate);
 }
 function safePrincipal(candidate) {
   const principal = exactRecord(candidate, PRINCIPAL_KEYS);
@@ -13897,7 +14401,7 @@ function validMutationTerminalFields(mutation) {
     return false;
   if (mutation.failure_code !== null && (typeof mutation.failure_code !== "string" || !FAILURE_CODE_PATTERN.test(mutation.failure_code)))
     return false;
-  return nullableTimestamp(mutation.completed_at) && canonicalTimestamp2(mutation.created_at) && canonicalTimestamp2(mutation.updated_at);
+  return nullableTimestamp(mutation.completed_at) && canonicalTimestamp3(mutation.created_at) && canonicalTimestamp3(mutation.updated_at);
 }
 function safeMutationStatus(candidate) {
   const mutation = exactRecord(candidate, MUTATION_KEYS);
@@ -14005,7 +14509,7 @@ var RELEASE_CANARY_CLAIM_MAX_LENGTH = 2048;
 function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function canonicalTimestamp3(value) {
+function canonicalTimestamp4(value) {
   if (typeof value !== "string")
     return false;
   const parsed = new Date(value);
@@ -14018,7 +14522,7 @@ function backupBelongsToProject(backupId, projectRef2) {
   return BACKUP_ID.test(backupId) && backupId.startsWith(`logical-full_${projectRef2}_`);
 }
 function verifiedBackup(value, projectRef2) {
-  if (!isRecord3(value) || typeof value.backup_id !== "string" || !backupBelongsToProject(value.backup_id, projectRef2) || value.project_ref !== projectRef2 || typeof value.database !== "string" || !SAFE_DATABASE.test(value.database) || value.kind !== "logical-full" || !canonicalTimestamp3(value.created_at) || !canonicalTimestamp3(value.completed_at) || new Date(value.completed_at).valueOf() < new Date(value.created_at).valueOf() || typeof value.bytes !== "number" || !Number.isSafeInteger(value.bytes) || value.bytes <= 0 || typeof value.sha256 !== "string" || !SHA256.test(value.sha256))
+  if (!isRecord3(value) || typeof value.backup_id !== "string" || !backupBelongsToProject(value.backup_id, projectRef2) || value.project_ref !== projectRef2 || typeof value.database !== "string" || !SAFE_DATABASE.test(value.database) || value.kind !== "logical-full" || !canonicalTimestamp4(value.created_at) || !canonicalTimestamp4(value.completed_at) || new Date(value.completed_at).valueOf() < new Date(value.created_at).valueOf() || typeof value.bytes !== "number" || !Number.isSafeInteger(value.bytes) || value.bytes <= 0 || typeof value.sha256 !== "string" || !SHA256.test(value.sha256))
     return null;
   return {
     backup_id: value.backup_id,
@@ -14365,7 +14869,7 @@ function registerReleaseTools(server, http, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.33.0",
+  version: "0.34.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -14742,6 +15246,11 @@ function createCliTools(context, confirmProduction) {
     if (branchHelpTool) {
       tools.branch = { schema: branchHelpTool.schema, callback: branchContextCallback };
     }
+    const frontendContextCallback = tools.frontend.callback;
+    const frontendHelpTool = captureTools((server) => registerFrontendTools(server, {})).frontend;
+    if (frontendHelpTool) {
+      tools.frontend = { schema: frontendHelpTool.schema, callback: frontendContextCallback };
+    }
   };
   if (context.credentialScope !== "management" || !context.apiUrl || !context.apiToken) {
     registerContextAwareHelp();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",