@supacloud/cli 0.62.1 → 0.63.0

package/dist/index.js

@@ -217356,6 +217356,7 @@ function confirmedFunctionDeletion(payload, expectation) {
 var execFileAsync = promisify(execFile);
 var SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/;
 var FORBIDDEN_BUNDLE_SEGMENTS = new Set(["node_modules", ".git"]);
+var EDGE_FUNCTION_DEPLOY_TIMEOUT_MS = 5 * 60000;
 var FUNCTION_FRAMEWORKS2 = ["fetch", "elysia", "hono", "sveltekit-function"];
 function scaffoldFiles(framework, slug) {
   if (framework === "elysia") {
@@ -218217,7 +218218,7 @@ ${deployCheck.err}`;
           expected_active_version: expectedActiveVersion,
           expected_activation_id: expectedActivationId,
           ...functionConfig()
-        });
+        }, { timeoutMs: EDGE_FUNCTION_DEPLOY_TIMEOUT_MS });
         return functionMutationResponse({
           operation: "edge_functions.deploy",
           projectRef: ref,
@@ -218236,7 +218237,7 @@ ${deployCheck.err}`;
           expected_active_version: expectedActiveVersion,
           expected_activation_id: expectedActivationId,
           ...functionConfig()
-        });
+        }, { timeoutMs: EDGE_FUNCTION_DEPLOY_TIMEOUT_MS });
         return functionMutationResponse({
           operation: "edge_functions.deploy_bundle",
           projectRef: ref,
@@ -221518,9 +221519,9 @@ function registerAiTools(server2) {
 }
 
 // src/shared/tools/app-tools.ts
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
 import { mkdir as mkdir6, readFile as readFile8, readdir as readdir5, writeFile as writeFile5 } from "node:fs/promises";
-import { basename as basename8, dirname as dirname12, join as join15, relative as relative12, resolve as resolve17 } from "node:path";
+import { basename as basename8, dirname as dirname12, join as join16, relative as relative12, resolve as resolve18 } from "node:path";
 
 // node_modules/@supacloud/compiler/dist/index.js
 import { dirname as dirname22, relative as relative6, sep as sep4 } from "node:path";
@@ -229355,7 +229356,7 @@ function renderClient(graph, options) {
     "",
     "export interface ApiClientConfig {",
     "  baseUrl?: string;",
-    "  fetch?: typeof fetch;",
+    "  fetch?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;",
     "  headers?: Record<string, string> | (() => Record<string, string> | Promise<Record<string, string>>);",
     "  interceptors?: HttpInterceptorFn[];",
     "  /** Normalize response objects like Elysia's default schema validator. */",
@@ -246887,7 +246888,7 @@ test("partial and untagged inherited remote profiles cannot mix with selected fi
 // ../compiler/package.json
 var package_default = {
   name: "@supacloud/compiler",
-  version: "0.31.0",
+  version: "0.31.1",
   description: "Static compiler for @supacloud/app metadata: builds the application graph from AST, validates it, and generates reflection-free factory code",
   type: "module",
   main: "./dist/index.js",
@@ -247048,7 +247049,7 @@ var package_default2 = {
   },
   dependencies: {
     "@angular/core": "^22.1.5",
-    "@supacloud/contracts": "0.8.0",
+    "@supacloud/contracts": "file:../contracts",
     rxjs: "7.8.2",
     typebox: "1.3.34"
   },
@@ -248650,16 +248651,22 @@ var package_default5 = {
 // ../db/package.json
 var package_default6 = {
   name: "@supacloud/db",
-  version: "0.11.0",
+  version: "0.12.0",
   description: "Database governance layer for SupaCloud: RLS policies, RPC functions and grants as first-class resources, with manifest/catalog reconciliation",
   type: "module",
   main: "./dist/index.js",
   module: "./dist/index.js",
   types: "./dist/index.d.ts",
   bin: {
-    "supacloud-sql-impact": "./dist/sql-impact-cli.js"
+    "supacloud-sql-impact": "./dist/sql-impact-cli.js",
+    "supacloud-db": "./dist/source-contracts-cli.js"
   },
   exports: {
+    "./source-contracts": {
+      types: "./dist/source-contracts.d.ts",
+      import: "./dist/source-contracts.js"
+    },
+    "./source-contracts-cli": "./dist/source-contracts-cli.js",
     "./sql-analysis": {
       types: "./dist/sql-analysis.d.ts",
       import: "./dist/sql-analysis.js"
@@ -248691,7 +248698,7 @@ var package_default6 = {
   ],
   scripts: {
     build: "bun run clean && bun run build:js && bun run build:types",
-    "build:js": "bun build src/index.ts src/command-bun.ts src/drizzle.ts src/drizzle-bun.ts src/sql-analysis.ts src/sql-impact-cli.ts --outdir dist --target node --external bun --external @supacloud/contracts --external drizzle-orm --external libpg-query",
+    "build:js": "bun build src/index.ts src/command-bun.ts src/drizzle.ts src/drizzle-bun.ts src/sql-analysis.ts src/sql-impact-cli.ts src/source-contracts.ts src/source-contracts-cli.ts --outdir dist --target node --external bun --external @supacloud/contracts --external drizzle-orm --external libpg-query --external @typescript/typescript6",
     "build:types": "tsc -p tsconfig.json --emitDeclarationOnly",
     clean: "rm -rf dist",
     prepublishOnly: "bun run build",
@@ -248715,14 +248722,15 @@ var package_default6 = {
   },
   devDependencies: {
     "@sinclair/typebox": "0.34.52",
-    "@typescript/typescript6": "^6.0.2",
     "drizzle-orm": "1.0.0-rc.4",
+    "drizzle-kit": "1.0.0-rc.4",
     "@types/bun": "^1.4.2",
     typescript: "^7.0.2"
   },
   dependencies: {
+    "@typescript/typescript6": "^6.0.2",
     "libpg-query": "18.1.4",
-    "@supacloud/contracts": "file:../contracts"
+    "@supacloud/contracts": "0.8.0"
   },
   peerDependencies: {
     "drizzle-orm": "1.0.0-rc.4"
@@ -248733,13 +248741,13 @@ var package_default6 = {
     }
   },
   overrides: {
-    "@supacloud/contracts": "file:../contracts"
+    "@supacloud/contracts": "0.8.0"
   }
 };
 // ../supacloud-js/package.json
 var package_default7 = {
   name: "@supacloud/js",
-  version: "0.36.0",
+  version: "0.36.1",
   description: "Platform SDK for SupaCloud, built on top of supabase-js",
   type: "module",
   main: "./dist/index.cjs",
@@ -248826,7 +248834,7 @@ var package_default7 = {
     "@supabase/supabase-js": "^2.115.0"
   },
   dependencies: {
-    "@supacloud/contracts": "file:../contracts",
+    "@supacloud/contracts": "0.8.0",
     rxjs: "7.8.2"
   },
   devDependencies: {
@@ -248839,11 +248847,133 @@ var package_default7 = {
   }
 };
 
+// src/shared/tools/app-starter-database.ts
+var STARTER_DATABASE_CONFIG = {
+  version: 1,
+  schema: ["db/schema.ts"],
+  functions: "db/functions",
+  migrations: "migrations",
+  contracts: "db/contracts",
+  audit: "output/database-audit",
+  consumers: ["src", "scripts", "tests"],
+  auditConsumers: [],
+  role: "starter_review_http"
+};
+var STARTER_DATABASE_SCHEMA = `import { sql } from "drizzle-orm";
+import { boolean, check, integer, jsonb, pgTable, primaryKey, text, uuid } from "drizzle-orm/pg-core";
+
+// Structure for the reviewed starter migrations. Grants/policies stay in those migrations.
+export const application = pgTable.withRLS("starter_application", {
+  singleton: boolean().default(true).primaryKey(),
+  projectId: text("project_id").notNull(),
+  tenantId: text("tenant_id").notNull(),
+}, table => [
+  check("starter_application_singleton_check", sql\`\${table.singleton}\`),
+  check("starter_application_project_id_check", sql\`length(\${table.projectId}) > 0\`),
+  check("starter_application_tenant_id_check", sql\`length(\${table.tenantId}) > 0\`),
+]);
+
+export const reviews = pgTable.withRLS("starter_reviews", {
+  id: text().primaryKey(),
+  ownerId: text("owner_id").notNull(),
+  state: text({ enum: ["draft", "approved"] }).notNull(),
+  version: integer().notNull(),
+}, table => [
+  check("starter_reviews_state_check", sql\`\${table.state} IN ('draft', 'approved')\`),
+  check("starter_reviews_version_check", sql\`\${table.version} > 0\`),
+]);
+
+export const members = pgTable.withRLS("starter_members", {
+  subject: text().primaryKey(),
+  enabled: boolean().default(true).notNull(),
+  canApprove: boolean("can_approve").default(false).notNull(),
+  storageSubject: uuid("storage_subject").unique(),
+});
+
+export const attachments = pgTable.withRLS("starter_attachments", {
+  reviewId: text("review_id").primaryKey().references(() => reviews.id),
+  artifactId: uuid("artifact_id").notNull().unique(),
+  ownerId: text("owner_id").notNull(),
+  runId: uuid("run_id").notNull().unique(),
+  objectPath: text("object_path").notNull().unique(),
+});
+
+export const attachmentResults = pgTable.withRLS("starter_attachment_results", {
+  reviewId: text("review_id").notNull().references(() => reviews.id),
+  version: integer().notNull(),
+  artifactId: uuid("artifact_id").notNull(),
+  result: jsonb().$type<unknown>().notNull(),
+}, table => [
+  primaryKey({ columns: [table.reviewId, table.version, table.artifactId] }),
+  check("starter_attachment_results_version_check", sql\`\${table.version} >= 2\`),
+]);
+
+export type ReviewRow = typeof reviews.$inferSelect;
+export type NewReview = typeof reviews.$inferInsert;
+`;
+var STARTER_DATABASE_GUIDE = `
+## Database Source Workflow
+
+Drizzle owns table declarations and inferred row types in db/schema.ts.
+Use the existing @supacloud/db/drizzle-bun adapters for typed queries and governed
+transactions; never replace permission, idempotency or audit checks with plain CRUD.
+Opaque JSON still needs runtime decoding.
+
+After installing dependencies, run \`bun run db:generate\` once and commit db/contracts/.
+The default \`bun run check\` and build fail on stale database contracts before any
+compiler regeneration. After an intentional source change, run db:generate again,
+review the diff, then run check. Ordinary checks are offline.
+
+- Maintain one schema-qualified function with explicit grants per db/functions/*.sql.
+- Preserve migrations/ and its existing executor/ledger. Add forward migrations only.
+- \`bun run db:diff\` generates Drizzle drafts under db/migration-candidates/, never
+  into the deployment directory. The starter has existing SQL history, so establish
+  and review a matching Drizzle baseline before promoting any draft; the first
+  draft is not automatically an incremental production migration.
+- \`bun run db:pull\` requires an explicitly selected DATABASE_URL and writes only
+  output/database-audit/drizzle-candidate/. Review candidates; never overwrite source blindly.
+- Full SQL dumps belong under the ignored output/database-audit/ directory. They are
+  audit/recovery artifacts, never ordinary type, application or test inputs.
+- \`bun run db:assess\` explains adoption/findings without writing or connecting.
+- GraphQL/PostgREST exports remain legitimate protocol contracts. This check is not
+  proof of deployed schema, effective role permissions or complete RLS equivalence.
+
+Do not introduce any/@ts-ignore to bypass a contract. Use Drizzle-inferred types,
+preserve bigint/numeric precision and decode unknown results at the boundary.
+`;
+function starterDatabaseFiles() {
+  return {
+    "database.sources.json": JSON.stringify(STARTER_DATABASE_CONFIG, null, 2) + `
+`,
+    "db/schema.ts": STARTER_DATABASE_SCHEMA,
+    "db/functions/README.md": `Maintain one schema-qualified function and its explicit EXECUTE ACL per SQL file. No RPC functions are needed by the initial transactional starter.
+`,
+    "drizzle.config.ts": `import { defineConfig } from "drizzle-kit";
+export default defineConfig({
+  dialect: "postgresql",
+  schema: "./db/schema.ts",
+  out: "./db/migration-candidates",
+});
+`,
+    "drizzle.pull.config.ts": `import { defineConfig } from "drizzle-kit";
+const url = process.env.DATABASE_URL;
+if (!url) throw new Error("Select an explicit DATABASE_URL for introspection");
+export default defineConfig({
+  dialect: "postgresql",
+  schema: "./db/schema.ts",
+  out: "./output/database-audit/drizzle-candidate",
+  dbCredentials: { url },
+});
+`
+  };
+}
+
 // src/shared/tools/app-starter.ts
 var json2 = (value) => `${JSON.stringify(value, null, 2)}
 `;
 function appStarterFiles(name) {
   return {
+    ...starterDatabaseFiles(),
     "package.json": json2({
       name,
       version: "0.0.0",
@@ -248854,10 +248984,15 @@ function appStarterFiles(name) {
         compile: "bun --no-env-file node_modules/@supacloud/compiler/dist/cli.js compile",
         "check:generated": "bun --no-env-file node_modules/@supacloud/compiler/dist/cli.js check",
         typecheck: "tsc --noEmit",
-        check: "bun run compile && bun run check:generated && bun run typecheck && bun run test",
+        "db:generate": "supacloud-db generate",
+        "db:check": "supacloud-db check",
+        "db:assess": "supacloud-db assess",
+        "db:diff": "drizzle-kit generate --config drizzle.config.ts",
+        "db:pull": "drizzle-kit pull --config drizzle.pull.config.ts",
+        check: "bun run db:check && bun run compile && bun run check:generated && bun run typecheck && bun run test",
         test: "bun run compile && bun --no-env-file scripts/environment.ts test bun test",
         dev: "bun --no-env-file scripts/environment.ts development bun scripts/dev.ts",
-        build: "bun run compile && bun run typecheck && bun build src/application.ts --target bun --minify --outdir dist",
+        build: "bun run db:check && bun run compile && bun run typecheck && bun build src/application.ts --target bun --minify --outdir dist",
         "env:development": "bun --no-env-file scripts/environment.ts development",
         "env:test": "bun --no-env-file scripts/environment.ts test",
         "env:staging": "bun --no-env-file scripts/environment.ts staging",
@@ -248869,6 +249004,7 @@ function appStarterFiles(name) {
         "@supacloud/commands": `^${package_default4.version}`,
         "@supacloud/contracts": `^${package_default5.version}`,
         "@supacloud/db": `^${package_default6.version}`,
+        "drizzle-orm": package_default6.peerDependencies["drizzle-orm"],
         "@supacloud/js": `^${package_default7.version}`,
         "@supabase/supabase-js": package_default7.peerDependencies["@supabase/supabase-js"],
         elysia: "2.0.0-beta.19",
@@ -248876,6 +249012,7 @@ function appStarterFiles(name) {
       },
       devDependencies: {
         "@supacloud/compiler": `^${package_default.version}`,
+        "drizzle-kit": package_default6.devDependencies["drizzle-kit"],
         "@types/bun": "^1.4.2",
         typescript: "^7.0.2"
       }
@@ -248891,13 +249028,15 @@ function appStarterFiles(name) {
         noEmit: true,
         types: ["bun"]
       },
-      include: ["src/**/*.ts", "scripts/**/*.ts", "tests/**/*.ts", "generated/**/*.ts", "supacloud.config.ts"]
+      include: ["src/**/*.ts", "scripts/**/*.ts", "tests/**/*.ts", "generated/**/*.ts", "db/schema.ts", "db/contracts/**/*.ts", "supacloud.config.ts", "drizzle*.config.ts"]
     }),
     "bunfig.toml": `env = false
 `,
     ".gitignore": [
       "node_modules/",
       "dist/",
+      "output/database-audit/",
+      "db/migration-candidates/",
       ".env",
       ".env.*",
       "!.env.*.example",
@@ -248986,7 +249125,7 @@ test("generated query client preserves its read contract without a live database
 });
 `,
     "REACTIVE.md": STARTER_REACTIVE_GUIDE,
-    "AGENTS.md": STARTER_REACTIVE_AGENTS,
+    "AGENTS.md": STARTER_REACTIVE_AGENTS + STARTER_DATABASE_GUIDE,
     "tests/reactive.test.ts": STARTER_REACTIVE_TEST,
     "scripts/environment.ts": STARTER_ENVIRONMENT,
     "tests/environment.test.ts": STARTER_ENVIRONMENT_TEST,
@@ -249088,6 +249227,7 @@ import { ApplicationError, assertFeatureTransition } from "@supacloud/elysia";
 import { t } from "elysia";
 import { VerifyReviewAttachment } from "./attachment";
 import { ReviewUploads, ReviewUploadsController, type ReviewUploadPort } from "./uploads";
+import type { ReviewRow } from "../../db/schema";
 
 export const reviewSpec = defineFeatureSpec({
   name: "review",
@@ -249102,7 +249242,7 @@ export const reviewSpec = defineFeatureSpec({
   },
 });
 
-interface Review { state: string; version: number }
+type Review = Pick<ReviewRow, "state" | "version">;
 // Production implementations must bind both operations to the current transaction.
 export interface ReviewStore extends Partial<ReviewUploadPort> {
   get(table: string, key: string): unknown;
@@ -249125,7 +249265,7 @@ export const requireRequest: Aspect = (context, next) => {
 
 function readReview(value: unknown): Review {
   if (typeof value !== "object" || value === null ||
-      !("state" in value) || typeof value.state !== "string" ||
+      !("state" in value) || (value.state !== "draft" && value.state !== "approved") ||
       !("version" in value) || typeof value.version !== "number") {
     throw new ApplicationError("Review not found", { status: 404, code: "REVIEW_NOT_FOUND" });
   }
@@ -249252,6 +249392,7 @@ test("the production composition root rejects missing governance adapters", () =
 
 \`\`\`sh
 bun install
+bun run db:generate
 bun run check
 bun run dev
 \`\`\`
@@ -249273,6 +249414,28 @@ compiler-checked command/route/governance bindings, an explicit AOP function,
 HTTP schemas, permission denial, transaction rollback, idempotency and audit.
 It is not a complete Maker-Checker workflow or a production authorization policy.
 
+## Frontend SDK Boundary
+
+Use @supacloud/js as the platform SDK around your existing user-scoped
+@supabase/supabase-js client. Pass that same client to existing UI providers;
+supacloud.supabase exposes it unchanged. Keep UI routing, forms and query
+caches in your frontend framework or svadmin, not in a new DI container.
+
+For generated/client.ts, supply createAuthenticatedFetch from
+@supacloud/js/contracts as its fetch option. Resolve the current user token
+from the same Supabase session for each request; do not capture a token at
+startup or introduce a second session store. Use a fixed trusted HTTPS API
+origin. The authenticated transport rejects missing credentials and redirects
+and does not replay a write after 401. Its underlying fetch must also be
+single-attempt.
+
+Reuse the same session resolver for generated/graphql.ts when adopting queries.
+The local memory demo is not this authenticated production integration.
+Never use supacloud.commands or supacloud.workflows from a browser action:
+those RPCs require service-role credentials. Browser business commands use
+application endpoints, optionally composed through @supacloud/js/contracts.
+Management API tokens and service-role keys remain on trusted servers.
+
 ## Typed Queries
 
 This starter uses Database First as its only GraphQL server-schema model.
@@ -249541,6 +249704,8 @@ policy. Invalid transaction/idempotency modes fail compilation instead of
 silently disabling governance. onExecution receives metadata-only trace events;
 durable audit still belongs to the command governance adapter.
 
+${STARTER_DATABASE_GUIDE}
+
 ## CI
 
 After the first compilation, commit generated/. In CI run
@@ -249574,6 +249739,55 @@ async function initializeAppProject(options) {
   return { root, name, files: Object.keys(files) };
 }
 
+// src/shared/tools/app-database-check.ts
+import { spawnSync } from "node:child_process";
+import { existsSync as existsSync11 } from "node:fs";
+import { join as join14, resolve as resolve16 } from "node:path";
+var CHECK_ENTRY = `
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+const root = process.argv[1];
+const cli = createRequire(join(root, "package.json")).resolve("@supacloud/db/source-contracts-cli");
+process.argv = [process.execPath, cli, "check", "--root", root];
+await import(pathToFileURL(cli).href);
+`;
+function checkAppDatabaseSources(projectRoot) {
+  const root = resolve16(projectRoot);
+  if (!existsSync11(join14(root, "database.sources.json")))
+    return;
+  const name = "database-source-contracts";
+  try {
+    const result = spawnSync(process.versions.bun ? "bun" : process.execPath, [
+      ...process.versions.bun ? ["--no-env-file"] : ["--input-type=module"],
+      "--eval",
+      CHECK_ENTRY,
+      "--",
+      root
+    ], { cwd: root, encoding: "utf8", timeout: 30000, maxBuffer: 4 * 1024 * 1024 });
+    if (result.error)
+      throw result.error;
+    const report = JSON.parse(result.stdout);
+    if (!report || typeof report !== "object" || !("scope" in report) || report.scope !== "local-source-contracts" || !("ok" in report) || typeof report.ok !== "boolean" || !("findings" in report) || !Array.isArray(report.findings)) {
+      throw new Error("Invalid database source check response");
+    }
+    const messages = [];
+    for (const finding of report.findings) {
+      if (!finding || typeof finding !== "object" || !("file" in finding) || typeof finding.file !== "string" || !("message" in finding) || typeof finding.message !== "string")
+        throw new Error("Invalid source finding");
+      messages.push(`${finding.file}: ${finding.message}`);
+    }
+    return {
+      name,
+      ok: result.status === 0 && report.ok && !messages.length,
+      detail: messages.join(`
+`) || (result.status === 0 && report.ok ? "Offline database contracts and boundaries are current" : "Database source check failed")
+    };
+  } catch {
+    return { name, ok: false, detail: "Cannot run the project database checker. Install the project runtime and @supacloud/db with source-contracts support, then run `supacloud-db check --root .` for diagnostics." };
+  }
+}
+
 // src/shared/tools/app-resource.ts
 function resourceScaffold(name, className) {
   return {
@@ -249652,7 +249866,7 @@ test("${name} controller preserves an asynchronous read failure", async () => {
 // src/shared/tools/app-scaffold-writes.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { link, lstat as lstat4, mkdir as mkdir5, open as open4, readFile as readFile4, realpath as realpath5, rename as rename5, rmdir, unlink as unlink3 } from "node:fs/promises";
-import { dirname as dirname11, isAbsolute as isAbsolute6, join as join14, relative as relative11, resolve as resolve16, sep as sep11, win32 } from "node:path";
+import { dirname as dirname11, isAbsolute as isAbsolute6, join as join15, relative as relative11, resolve as resolve17, sep as sep11, win32 } from "node:path";
 
 class ScaffoldError extends Error {
   code;
@@ -249673,7 +249887,7 @@ function scaffoldPath(root, path) {
   if (parts.some((part) => /[<>:"|?*\u0000-\u001f]/.test(part) || /[ .]$/.test(part) && part !== "." && part !== ".." || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part) || part.toLowerCase() === ".git" || part.toLowerCase() === ".supacloud-generate.lock")) {
     throw new ScaffoldError("SCAFFOLD_PATH_INVALID", "Scaffold path is reserved or not portable");
   }
-  const target = resolve16(root, path);
+  const target = resolve17(root, path);
   const local = relative11(root, target);
   if (!local || local === ".." || local.startsWith(`..${sep11}`) || isAbsolute6(local)) {
     throw new ScaffoldError("SCAFFOLD_PATH_INVALID", "Scaffold path is outside the project root");
@@ -249685,7 +249899,7 @@ async function snapshot(root, path) {
   const parts = relative11(root, target).split(sep11);
   let current = root;
   for (const [index, part] of parts.entries()) {
-    current = join14(current, part);
+    current = join15(current, part);
     let stat;
     try {
       stat = await lstat4(current);
@@ -249712,7 +249926,7 @@ function sameFile(a, b) {
   return a === null ? b === null : b !== null && a.content === b.content && a.dev === b.dev && a.ino === b.ino && a.mode === b.mode;
 }
 async function planScaffoldWrites(root, writes) {
-  const canonical = await realpath5(resolve16(root));
+  const canonical = await realpath5(resolve17(root));
   const targets = new Set;
   const planned = [];
   for (const write of writes) {
@@ -249735,7 +249949,7 @@ async function planScaffoldWrites(root, writes) {
   return Object.freeze({ root: canonical, writes: Object.freeze(planned) });
 }
 async function applyScaffoldWrites(plan) {
-  const lockPath = join14(plan.root, ".supacloud-generate.lock");
+  const lockPath = join15(plan.root, ".supacloud-generate.lock");
   const lock = await open4(lockPath, "wx").catch((error) => {
     if (fsCode(error) === "EEXIST")
       throw new ScaffoldError("SCAFFOLD_BUSY", "Another generator owns .supacloud-generate.lock; no files written");
@@ -249756,7 +249970,7 @@ async function applyScaffoldWrites(plan) {
       const target = scaffoldPath(plan.root, write.path);
       let current = plan.root;
       for (const part of relative11(plan.root, dirname11(target)).split(sep11).filter(Boolean)) {
-        current = join14(current, part);
+        current = join15(current, part);
         try {
           await mkdir5(current);
           directories.push(current);
@@ -249865,6 +250079,7 @@ async function initProject(args) {
     `Initialized ${name} in ${root} (${files.length} files, template: ${template}).`,
     `cd '${root.replaceAll("'", "'\\''")}'`,
     "bun install",
+    ...template === "command" ? ["bun run db:generate"] : [],
     "bun run check",
     "bun run dev",
     "Local demo only. Production requires persistent governance and identity adapters; see README.md."
@@ -249971,7 +250186,7 @@ async function generateScaffold(args) {
       throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", `--${flag.replaceAll("_", "-")} must be boolean`);
     }
   }
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const dir = args.dir ?? "src/features";
   if (dir !== ".")
     scaffoldPath(root, dir);
@@ -249987,20 +250202,20 @@ async function generateScaffold(args) {
   let contractName;
   if (kind === "module" || kind === "resource") {
     const name = requireIdentifier(args.name, "name");
-    modulePath = join15(dir, name, `${name}.module.ts`).replaceAll("\\", "/");
+    modulePath = join16(dir, name, `${name}.module.ts`).replaceAll("\\", "/");
     moduleSymbol = `${pascalName2(name)}Module`;
     if (kind === "module")
       writes.push({ path: modulePath, content: moduleScaffold(name), overwrite: args.force === true });
     else
       for (const [file, content] of Object.entries(resourceScaffold(name, pascalName2(name)))) {
-        writes.push({ path: join15(dir, name, file).replaceAll("\\", "/"), content });
+        writes.push({ path: join16(dir, name, file).replaceAll("\\", "/"), content });
       }
   } else {
     const moduleName = requireIdentifier(args.module, "module");
     const name = kind === "controller" ? moduleName : requireIdentifier(args.name, "name");
     const subdir = kind === "command" ? "commands" : kind === "query" ? "queries" : kind === "job" ? "jobs" : kind === "contract" ? "contracts" : "";
-    const path = join15(dir, moduleName, subdir, `${name}.${kind}.ts`).replaceAll("\\", "/");
-    if (kind === "controller" && existsSync11(scaffoldPath(root, path))) {
+    const path = join16(dir, moduleName, subdir, `${name}.${kind}.ts`).replaceAll("\\", "/");
+    if (kind === "controller" && existsSync12(scaffoldPath(root, path))) {
       throw new ScaffoldError("SCAFFOLD_EXISTS", `Controller already exists: ${path}（请手工合并路由到现有 controller）`);
     }
     const content = kind === "command" ? commandScaffold(moduleName, name) : kind === "query" ? queryScaffold(moduleName, name) : kind === "job" ? jobScaffold(moduleName, name) : kind === "contract" ? contractScaffold(moduleName, name) : controllerScaffold(moduleName);
@@ -250018,7 +250233,7 @@ async function generateScaffold(args) {
     if (new RegExp(`\\b${moduleSymbol}\\b`).test(original)) {
       throw new ScaffoldError("SCAFFOLD_REGISTRATION_CONFLICT", `Registration target already references ${moduleSymbol}; review the import manually`);
     }
-    let importPath = relative12(dirname12(target), resolve17(root, modulePath)).replaceAll("\\", "/").replace(/\.ts$/, "");
+    let importPath = relative12(dirname12(target), resolve18(root, modulePath)).replaceAll("\\", "/").replace(/\.ts$/, "");
     if (!importPath.startsWith("."))
       importPath = `./${importPath}`;
     const edit = await applyDiagnosticFix({
@@ -250049,7 +250264,7 @@ async function generateScaffold(args) {
       written: !args.dry_run,
       changes
     }, null, 2));
-  const lines = changes.map((change) => `${args.dry_run ? "PREVIEW" : "✅"} ${change.action}: ${join15(plan.root, change.path)}`);
+  const lines = changes.map((change) => `${args.dry_run ? "PREVIEW" : "✅"} ${change.action}: ${join16(plan.root, change.path)}`);
   if (args.dry_run)
     lines.push("No files written. Omit --dry-run to apply this generation.");
   if (kind === "resource")
@@ -250085,17 +250300,17 @@ function parseInclude(include) {
   return patterns && patterns.length > 0 ? patterns : undefined;
 }
 function sourceRoot(args, root, configured) {
-  const hasConfig = ["ts", "mts", "js", "mjs"].some((extension) => existsSync11(join15(root, `supacloud.config.${extension}`)));
+  const hasConfig = ["ts", "mts", "js", "mjs"].some((extension) => existsSync12(join16(root, `supacloud.config.${extension}`)));
   return args.root && !hasConfig ? "." : configured;
 }
 async function projectCompileConfig(args) {
-  const root = resolve17(args.root || process.cwd());
-  const configFile = ["ts", "mts", "js", "mjs"].map((extension) => join15(root, `supacloud.config.${extension}`)).find((candidate) => existsSync11(candidate)) ?? null;
+  const root = resolve18(args.root || process.cwd());
+  const configFile = ["ts", "mts", "js", "mjs"].map((extension) => join16(root, `supacloud.config.${extension}`)).find((candidate) => existsSync12(candidate)) ?? null;
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
   const configuredRoot = sourceRoot(args, root, loadedConfig.root);
   const include = parseInclude(args.include) ?? loadedConfig.include;
-  const outDir = args.out_dir ? resolve17(root, args.out_dir) : defaults.outDir;
+  const outDir = args.out_dir ? resolve18(root, args.out_dir) : defaults.outDir;
   const result = await checkProject(compileOptionsFromConfig({
     ...loadedConfig,
     ...configuredRoot === undefined ? {} : { root: configuredRoot },
@@ -250106,8 +250321,8 @@ async function projectCompileConfig(args) {
   return { root, configFile, outDir, result };
 }
 async function readAllowedDependencies(root) {
-  const path = join15(root, "package.json");
-  if (!existsSync11(path))
+  const path = join16(root, "package.json");
+  if (!existsSync12(path))
     return { dependencies: [], devDependencies: [] };
   try {
     const parsed = JSON.parse(await readFile8(path, "utf8"));
@@ -250194,7 +250409,7 @@ async function findUnwiredContracts(rootDir) {
     for (const entry of entries) {
       if (skip.has(entry.name))
         continue;
-      const path = join15(directory, entry.name);
+      const path = join16(directory, entry.name);
       if (entry.isDirectory())
         await walk(path);
       else if (entry.isFile() && entry.name.endsWith(".ts"))
@@ -250222,6 +250437,12 @@ async function findUnwiredContracts(rootDir) {
 async function runDoctor(args) {
   const { root, outDir, result } = await projectCompileConfig(args);
   const doctor = doctorProject(root, outDir, result.graph, result.upToDate, result.diagnostics);
+  const database = checkAppDatabaseSources(root);
+  if (database) {
+    doctor.checks.push(database);
+    if (!database.ok)
+      doctor.errors += 1;
+  }
   const fixPlan = doctorFixPlan(doctor);
   const autoFixable = fixPlan.filter((repair) => repair.readiness === "preview").length;
   const inputRequired = fixPlan.filter((repair) => repair.readiness === "input-required").length;
@@ -250252,11 +250473,11 @@ async function runDoctor(args) {
 `), doctor.errors > 0);
 }
 async function runFix(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const fixPath = args.fix?.trim();
   if (!fixPath)
     throw new Error("app fix requires --fix <path-to-diagnostic-fix.json>");
-  const parsed = JSON.parse(await readFile8(resolve17(root, fixPath), "utf8"));
+  const parsed = JSON.parse(await readFile8(resolve18(root, fixPath), "utf8"));
   const write = args.write === true;
   const applied = await applyDiagnosticFix(parsed, { rootDir: root, dryRun: !write });
   return textResult(JSON.stringify({
@@ -250299,7 +250520,7 @@ function devDatabase(profile, explicit) {
 }
 function readManifestModules(outDir) {
   try {
-    const parsed = JSON.parse(readFileSync9(join15(outDir, "app.manifest.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync9(join16(outDir, "app.manifest.json"), "utf8"));
     return Array.isArray(parsed.modules) ? parsed.modules.map((module) => module.name) : [];
   } catch {
     return [];
@@ -250332,12 +250553,12 @@ async function runAppDev(args, options) {
     throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "app dev --profile must be fast or integration");
   }
   const database = devDatabase(profile, args.database_url);
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
   const configuredRoot = sourceRoot(args, root, loadedConfig.root);
   const include = parseInclude(args.include) ?? loadedConfig.include;
-  const outDir = args.out_dir ? resolve17(root, args.out_dir) : defaults.outDir;
+  const outDir = args.out_dir ? resolve18(root, args.out_dir) : defaults.outDir;
   const watch = args.once !== true && args.watch !== false;
   const compileOptions = compileOptionsFromConfig({
     ...loadedConfig,
@@ -250423,7 +250644,7 @@ async function runAppDev(args, options) {
   return report(lastEvent, "stopped");
 }
 async function runCompile(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
   const configuredRoot = sourceRoot(args, root, loadedConfig.root);
@@ -250432,7 +250653,7 @@ async function runCompile(args) {
     ...compileOptionsFromConfig({
       ...loadedConfig,
       ...configuredRoot === undefined ? {} : { root: configuredRoot },
-      outDir: args.out_dir ? resolve17(root, args.out_dir) : defaults.outDir,
+      outDir: args.out_dir ? resolve18(root, args.out_dir) : defaults.outDir,
       ...include === undefined ? {} : { include },
       strict: args.strict ?? loadedConfig.strict ?? false
     }, root),
@@ -250456,7 +250677,8 @@ async function runCompile(args) {
   return textResult(text, hasError);
 }
 async function runCheck(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
+  const database = checkAppDatabaseSources(root);
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
   const configuredRoot = sourceRoot(args, root, loadedConfig.root);
@@ -250464,12 +250686,12 @@ async function runCheck(args) {
   const config = compileOptionsFromConfig({
     ...loadedConfig,
     ...configuredRoot === undefined ? {} : { root: configuredRoot },
-    outDir: args.out_dir ? resolve17(root, args.out_dir) : defaults.outDir,
+    outDir: args.out_dir ? resolve18(root, args.out_dir) : defaults.outDir,
     ...include === undefined ? {} : { include },
     strict: args.strict ?? loadedConfig.strict ?? false
   }, root);
   const result = await checkProject(config);
-  const hasError = result.diagnostics.some((diagnostic) => diagnostic.severity === "error") || result.mismatches.length > 0;
+  const hasError = result.diagnostics.some((diagnostic) => diagnostic.severity === "error") || result.mismatches.length > 0 || database?.ok === false;
   if (args.format === "json")
     return textResult(JSON.stringify({
       version: 1,
@@ -250479,12 +250701,14 @@ async function runCheck(args) {
       mismatches: result.mismatches,
       upToDate: result.upToDate,
       written: [],
-      modules: result.graph.modules.map((module) => module.name)
+      modules: result.graph.modules.map((module) => module.name),
+      ...database ? { database } : {}
     }, null, 2), hasError);
   const summary = `checked ${result.graph.modules.length} module(s), no files written`;
   return textResult([
     formatDiagnostics(result.diagnostics),
     ...result.mismatches.map((path) => `generated artifact mismatch: ${path}`),
+    ...database ? [`${database.ok ? "OK" : "FAIL"} ${database.name}: ${database.detail}`] : [],
     "",
     summary
   ].join(`
@@ -250492,9 +250716,9 @@ async function runCheck(args) {
 }
 async function readManifest(root, args) {
   const config = await loadSupacloudConfig(root);
-  const outDir = args.out_dir ? resolve17(root, args.out_dir) : resolveSupacloudConfig(config, root).outDir;
-  const manifestPath = join15(outDir, "app.manifest.json");
-  if (!existsSync11(manifestPath)) {
+  const outDir = args.out_dir ? resolve18(root, args.out_dir) : resolveSupacloudConfig(config, root).outDir;
+  const manifestPath = join16(outDir, "app.manifest.json");
+  if (!existsSync12(manifestPath)) {
     throw new Error(`Manifest not found: ${manifestPath}（先运行 app compile 生成）`);
   }
   const parsed = JSON.parse(await readFile8(manifestPath, "utf8"));
@@ -250537,7 +250761,7 @@ function formatGraphText(manifest) {
 `);
 }
 async function runGraph(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const manifest = await readManifest(root, args);
   if (args.format === "json")
     return textResult(JSON.stringify(manifest, null, 2));
@@ -250605,7 +250829,7 @@ async function runExplain(args) {
   const target = args.target?.trim();
   if (!target)
     throw new Error("app explain requires --target（provider 类名 / token 名 / command 名 / job 名）");
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const manifest = await readManifest(root, args);
   for (const module of manifest.modules) {
     const job = module.jobs?.find((entry) => entry.name === target || entry.className === target);
@@ -250680,16 +250904,16 @@ async function runExplain(args) {
   return textResult(`未找到对象: ${target}`, true);
 }
 async function runExportTools(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
   const manifest = await readManifest(root, { ...args, out_dir: undefined });
   const definitions = buildToolDefinitions(manifest);
-  const outDir = resolve17(args.out_dir || join15(root, "generated"));
+  const outDir = resolve18(args.out_dir || join16(root, "generated"));
   if (args.format === "json") {
     return textResult(JSON.stringify(definitions, null, 2));
   }
   await mkdir6(outDir, { recursive: true });
-  const openaiPath = join15(outDir, "tool-definitions.openai.json");
-  const mcpPath = join15(outDir, "tool-definitions.mcp.json");
+  const openaiPath = join16(outDir, "tool-definitions.openai.json");
+  const mcpPath = join16(outDir, "tool-definitions.mcp.json");
   await writeFile5(openaiPath, JSON.stringify(definitions.openai, null, 2), "utf8");
   await writeFile5(mcpPath, JSON.stringify(definitions.mcp, null, 2), "utf8");
   const summary = [
@@ -250704,11 +250928,17 @@ async function runExportTools(args) {
   return textResult(summary);
 }
 async function runDelivery(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve18(args.root || process.cwd());
+  if (args.action === "build") {
+    const database = checkAppDatabaseSources(root);
+    if (database && !database.ok) {
+      return textResult(JSON.stringify({ ok: false, database, written: [] }, null, 2), true);
+    }
+  }
   const loaded = await loadSupacloudConfig(root);
   const options = compileOptionsFromConfig({
     ...loaded,
-    ...args.out_dir === undefined ? {} : { outDir: resolve17(root, args.out_dir) },
+    ...args.out_dir === undefined ? {} : { outDir: resolve18(root, args.out_dir) },
     ...args.include === undefined ? {} : { include: parseInclude(args.include) },
     ...args.strict === undefined ? {} : { strict: args.strict }
   }, root);
@@ -250866,8 +251096,8 @@ function registerAppAliases(server2) {
 }
 
 // src/shared/tools/db-governance-tools.ts
-import { existsSync as existsSync12 } from "node:fs";
-import { join as join16, resolve as resolve18 } from "node:path";
+import { existsSync as existsSync13 } from "node:fs";
+import { join as join17, resolve as resolve20 } from "node:path";
 
 // node_modules/@supacloud/db/dist/index.js
 var TABLES_SQL = `
@@ -251319,8 +251549,8 @@ function normalizeModule(candidate, sourcePath) {
   };
 }
 async function loadDatabaseModules(root, moduleFile) {
-  const filePath = moduleFile ? resolve18(root, moduleFile) : join16(root, "db", "modules.ts");
-  if (!existsSync12(filePath)) {
+  const filePath = moduleFile ? resolve20(root, moduleFile) : join17(root, "db", "modules.ts");
+  if (!existsSync13(filePath)) {
     throw new Error(moduleFile ? `Module file not found: ${filePath}` : `Module file not found: ${filePath}（用 --module_file 指定一个导出 defineDatabaseModule(...) 的文件）`);
   }
   let imported;
@@ -251368,7 +251598,7 @@ async function runLint(args, root) {
   const issues = [];
   for (const module of selected) {
     const readSqlFile = async (path) => {
-      const absolute = resolve18(root, path);
+      const absolute = resolve20(root, path);
       try {
         return await Bun.file(absolute).text();
       } catch (error) {
@@ -251404,14 +251634,14 @@ var defaultLiteSpawn = async (command, cwd) => {
   return { exitCode, stdout, stderr };
 };
 async function runModuleCheckLite(args, root, spawn, liteBinary) {
-  const projectDir = resolve18(args.project_dir?.trim() || root);
+  const projectDir = resolve20(args.project_dir?.trim() || root);
   const binary = liteBinary === undefined ? Bun.which("supacloud-lite") : liteBinary;
   if (!binary) {
     throw new Error("db module_check --lite 需要本机可用的 supacloud-lite（npm i -g @supacloud/lite，或加入 PATH）");
   }
   const command = [binary, "db", "check", "--project-dir", projectDir];
   if (args.module_file?.trim())
-    command.push("--module-file", resolve18(root, args.module_file.trim()));
+    command.push("--module-file", resolve20(root, args.module_file.trim()));
   const result = await spawn(command, projectDir);
   const output = [result.stdout.trim(), result.stderr.trim()].filter(Boolean).join(`
 `);
@@ -251462,7 +251692,7 @@ function registerDbGovernanceTools(server2, options = {}) {
     lite: optional(Type.Boolean(), "[module_check] Reconcile against a local SupaCloud Lite project (runs supacloud-lite db check)"),
     project_dir: optional(Type.String(), "[module_check] Lite project directory (with --lite; default: --root)")
   }, async (request) => {
-    const root = resolve18(request.root || fallbackRoot);
+    const root = resolve20(request.root || fallbackRoot);
     switch (request.action) {
       case "lint":
         return runLint(request, root);
@@ -251479,7 +251709,7 @@ function registerDbGovernanceTools(server2, options = {}) {
 // src/shared/tools/scheduled-function-tools.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { readFileSync as readFileSync10, statSync as statSync7 } from "node:fs";
-import { resolve as resolve20 } from "node:path";
+import { resolve as resolve21 } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 var HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/;
 var ENVIRONMENT_NAME_PATTERN2 = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
@@ -251563,7 +251793,7 @@ function validScheduledFunctionCron(expression) {
 function readScheduleBodyFile(bodyPathInput) {
   if (!bodyPathInput.trim())
     throw new Error("'body_file' must be a path");
-  const bodyPath = resolve20(bodyPathInput);
+  const bodyPath = resolve21(bodyPathInput);
   const bodyStat = statSync7(bodyPath);
   if (!bodyStat.isFile() || bodyStat.size > MAX_BODY_FILE_BYTES) {
     throw new Error("Scheduled Function body file must be a regular file no larger than 1 MiB");
@@ -252146,8 +252376,8 @@ var MUTATION_TOOL_SCHEMA = {
 // src/shared/tools/release-tools.ts
 import { execFileSync } from "node:child_process";
 import { createHash as createHash10 } from "node:crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname13, join as join17, relative as relative13, resolve as resolve21 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname13, join as join18, relative as relative13, resolve as resolve23 } from "node:path";
 var SAFE_PROJECT_REF = /^[A-Za-z0-9_-]{1,64}$/;
 var BACKUP_ID = /^logical-full_[A-Za-z0-9_-]{1,64}_[a-f0-9]{32}$/;
 var SHA256 = /^[a-f0-9]{64}$/;
@@ -252441,15 +252671,15 @@ function collectScopeFiles(cwd, file, files, dir, task) {
   const results = [];
   const resolvePathWithFallbacks = (filePath) => {
     const trimmed = filePath.trim();
-    const resolved = resolve21(cwd, trimmed);
-    if (existsSync13(resolved))
+    const resolved = resolve23(cwd, trimmed);
+    if (existsSync14(resolved))
       return resolved;
     const candidates = [
-      resolve21(cwd, "supacloud/fa/release-scopes", trimmed),
-      resolve21(cwd, "release-scopes", trimmed),
-      resolve21(cwd, "scopes", trimmed)
+      resolve23(cwd, "supacloud/fa/release-scopes", trimmed),
+      resolve23(cwd, "release-scopes", trimmed),
+      resolve23(cwd, "scopes", trimmed)
     ];
-    const found = candidates.find(existsSync13);
+    const found = candidates.find(existsSync14);
     if (found)
       return found;
     throw new Error(`Scope file not found: ${filePath}`);
@@ -252470,18 +252700,18 @@ function collectScopeFiles(cwd, file, files, dir, task) {
   if (!taskFilter && (!dir || typeof dir !== "string" || !dir.trim())) {
     throw new Error("At least one of --file, --files, or --task is required for scope_rebind");
   }
-  const candidates = typeof dir === "string" && dir.trim() ? [resolve21(cwd, dir.trim())] : [
-    resolve21(cwd, "supacloud/fa/release-scopes"),
-    resolve21(cwd, "release-scopes"),
-    resolve21(cwd, "scopes")
+  const candidates = typeof dir === "string" && dir.trim() ? [resolve23(cwd, dir.trim())] : [
+    resolve23(cwd, "supacloud/fa/release-scopes"),
+    resolve23(cwd, "release-scopes"),
+    resolve23(cwd, "scopes")
   ];
   for (const directory of candidates) {
-    if (existsSync13(directory)) {
+    if (existsSync14(directory)) {
       try {
         const entries = readdirSync4(directory, { withFileTypes: true });
         for (const entry of entries) {
           if (entry.isFile() && entry.name.endsWith(".json")) {
-            const fullPath = join17(directory, entry.name);
+            const fullPath = join18(directory, entry.name);
             if (!taskFilter) {
               results.push(fullPath);
             } else if (entry.name.toLowerCase().includes(taskFilter)) {
@@ -252507,7 +252737,7 @@ function collectScopeFiles(cwd, file, files, dir, task) {
   return [...new Set(results)];
 }
 function handleScopeRebind(args) {
-  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve21(args.cwd.trim()) : process.cwd();
+  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve23(args.cwd.trim()) : process.cwd();
   const targetBaseCommit = resolveGitBaseCommit(cwd, args.base_commit);
   const scopeFiles = collectScopeFiles(cwd, args.file, args.files, args.dir, args.task);
   const dryRun = args.dry_run === true;
@@ -252559,19 +252789,19 @@ function handleScopeRebind(args) {
   });
 }
 function handleScopeInspect(args) {
-  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve21(args.cwd.trim()) : process.cwd();
+  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve23(args.cwd.trim()) : process.cwd();
   if (typeof args.file !== "string" || !args.file.trim()) {
     throw new Error("'file' is required for scope_inspect");
   }
   const trimmed = args.file.trim();
-  let filePath = resolve21(cwd, trimmed);
-  if (!existsSync13(filePath)) {
+  let filePath = resolve23(cwd, trimmed);
+  if (!existsSync14(filePath)) {
     const candidates = [
-      resolve21(cwd, "supacloud/fa/release-scopes", trimmed),
-      resolve21(cwd, "release-scopes", trimmed),
-      resolve21(cwd, "scopes", trimmed)
+      resolve23(cwd, "supacloud/fa/release-scopes", trimmed),
+      resolve23(cwd, "release-scopes", trimmed),
+      resolve23(cwd, "scopes", trimmed)
     ];
-    const found = candidates.find(existsSync13);
+    const found = candidates.find(existsSync14);
     if (found)
       filePath = found;
     else
@@ -252629,7 +252859,7 @@ function parseCommaList(value) {
   return [];
 }
 function handleScopeCreate(args, fallbackRef) {
-  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve21(args.cwd.trim()) : process.cwd();
+  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve23(args.cwd.trim()) : process.cwd();
   if (typeof args.file !== "string" || !args.file.trim()) {
     throw new Error("'file' is required for scope_create");
   }
@@ -252644,7 +252874,7 @@ function handleScopeCreate(args, fallbackRef) {
     throw new Error("'ref' is invalid for release controls");
   }
   const targetBaseCommit = resolveGitBaseCommit(cwd, args.base_commit);
-  const filePath = resolve21(cwd, args.file.trim());
+  const filePath = resolve23(cwd, args.file.trim());
   mkdirSync4(dirname13(filePath), { recursive: true });
   const scope = {
     baseCommit: targetBaseCommit,
@@ -252869,7 +253099,7 @@ function registerReleaseTools(server2, http, options = {}) {
 import { access as access4, lstat as lstat5, mkdtemp as mkdtemp2, opendir, readFile as readFile9, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
 import { createHash as createHash11 } from "node:crypto";
 import { tmpdir as tmpdir2 } from "node:os";
-import { basename as basename9, dirname as dirname14, join as join18, relative as relative14, resolve as resolve23, sep as sep12 } from "node:path";
+import { basename as basename9, dirname as dirname14, join as join19, relative as relative14, resolve as resolve24, sep as sep12 } from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 
 // node_modules/fflate/esm/index.mjs
@@ -253561,13 +253791,13 @@ async function readJson(path) {
   }
 }
 async function findDeployConfigRoot(startDirectory) {
-  let directory = resolve23(startDirectory);
+  let directory = resolve24(startDirectory);
   while (true) {
-    if (await pathExists(join18(directory, "supacloud.json")))
+    if (await pathExists(join19(directory, "supacloud.json")))
       return directory;
     const parent = dirname14(directory);
     if (parent === directory)
-      return resolve23(startDirectory);
+      return resolve24(startDirectory);
     directory = parent;
   }
 }
@@ -253610,7 +253840,7 @@ function deployTargetConfig(candidate, name) {
   };
 }
 async function readDeployConfig(configRoot) {
-  const configPath = join18(configRoot, "supacloud.json");
+  const configPath = join19(configRoot, "supacloud.json");
   const candidate = await readJson(configPath);
   if (candidate === null)
     return {};
@@ -253632,25 +253862,25 @@ async function readDeployConfig(configRoot) {
   };
 }
 async function packageName(projectDirectory) {
-  const candidate = record4(await readJson(join18(projectDirectory, "package.json")));
+  const candidate = record4(await readJson(join19(projectDirectory, "package.json")));
   return typeof candidate?.name === "string" && candidate.name.trim() ? candidate.name.trim() : null;
 }
 async function pathExists(path) {
   return access4(path).then(() => true, () => false);
 }
 async function defaultBuildCommand(projectDirectory, configRoot) {
-  const packageJson = record4(await readJson(join18(projectDirectory, "package.json")));
+  const packageJson = record4(await readJson(join19(projectDirectory, "package.json")));
   const scripts = record4(packageJson?.scripts);
   if (typeof scripts?.build !== "string" || !scripts.build.trim()) {
     throw new Error("No build command was configured and package.json has no build script");
   }
   let directory = projectDirectory;
   while (true) {
-    if (await pathExists(join18(directory, "bun.lock")) || await pathExists(join18(directory, "bun.lockb")))
+    if (await pathExists(join19(directory, "bun.lock")) || await pathExists(join19(directory, "bun.lockb")))
       return "bun run build";
-    if (await pathExists(join18(directory, "pnpm-lock.yaml")))
+    if (await pathExists(join19(directory, "pnpm-lock.yaml")))
       return "pnpm run build";
-    if (await pathExists(join18(directory, "yarn.lock")))
+    if (await pathExists(join19(directory, "yarn.lock")))
       return "yarn build";
     if (directory === configRoot)
       break;
@@ -253685,9 +253915,9 @@ function selectDeployment(deployments, requestedId, projectName) {
   throw new Error(deployments.length === 0 ? "No frontend deployments exist for this project" : `Multiple frontend deployments found (${ids}). Set frontend.id in supacloud.json or pass --id`);
 }
 function targetRoot(configRoot, target, name) {
-  const root = resolve23(configRoot, target.root || (name === "frontend" ? "." : name));
-  const prefix = `${resolve23(configRoot)}${sep12}`;
-  if (root !== resolve23(configRoot) && !root.startsWith(prefix)) {
+  const root = resolve24(configRoot, target.root || (name === "frontend" ? "." : name));
+  const prefix = `${resolve24(configRoot)}${sep12}`;
+  if (root !== resolve24(configRoot) && !root.startsWith(prefix)) {
     throw new Error(`Deploy target '${name}' root must stay inside the repository root`);
   }
   return root;
@@ -253738,8 +253968,8 @@ function defaultOutputDirectory(framework) {
   }
 }
 function resolveInsideProject(projectDirectory, candidate, allowRoot = false) {
-  const resolved = resolve23(projectDirectory, candidate);
-  const projectRoot = resolve23(projectDirectory);
+  const resolved = resolve24(projectDirectory, candidate);
+  const projectRoot = resolve24(projectDirectory);
   const projectPrefix = `${projectRoot}${sep12}`;
   if (!allowRoot && resolved === projectRoot || resolved !== projectRoot && !resolved.startsWith(projectPrefix)) {
     throw new Error("Frontend output directory must stay inside the project directory");
@@ -253770,7 +254000,7 @@ async function collectArchiveFiles(root) {
       entries.push(entry);
     entries.sort((left, right) => left.name.localeCompare(right.name, "en"));
     for (const entry of entries) {
-      const path = join18(directory, entry.name);
+      const path = join19(directory, entry.name);
       const stats = await lstat5(path);
       if (stats.isSymbolicLink())
         throw new Error(`Frontend output cannot contain symbolic links: ${path}`);
@@ -253799,8 +254029,8 @@ async function collectArchiveFiles(root) {
 }
 async function createFrontendArchive(outputDirectory) {
   const collected = await collectArchiveFiles(outputDirectory);
-  const temporaryDirectory = await mkdtemp2(join18(tmpdir2(), "supacloud-deploy-"));
-  const archivePath = join18(temporaryDirectory, `${basename9(outputDirectory)}.zip`);
+  const temporaryDirectory = await mkdtemp2(join19(tmpdir2(), "supacloud-deploy-"));
+  const archivePath = join19(temporaryDirectory, `${basename9(outputDirectory)}.zip`);
   try {
     const archiveBytes = zipSync(collected.files, { level: 6, mtime: FIXED_ZIP_MTIME });
     await writeFile6(archivePath, archiveBytes);
@@ -253850,7 +254080,7 @@ function deployResponse(result, json) {
 }
 function registerDeployTools(server2, http, options = {}) {
   server2.tool("deploy", "Build and publish the linked frontend with one command", deployToolSchema, async (args) => {
-    const invocationDirectory = resolve23(String(args.cwd || options.cwd || process.cwd()));
+    const invocationDirectory = resolve24(String(args.cwd || options.cwd || process.cwd()));
     const projectRef = String(args.ref || options.projectRef || "").trim();
     if (!projectRef)
       throw new Error("A linked project ref is required. Set SUPACLOUD_PROJECT_REF or pass --ref");
@@ -254023,11 +254253,11 @@ function registerDeployTools(server2, http, options = {}) {
 
 // src/shared/tools/remote-dev-tools.ts
 import { spawn as spawn4 } from "node:child_process";
-import { existsSync as existsSync14 } from "node:fs";
+import { existsSync as existsSync15 } from "node:fs";
 import { readFile as readFile10 } from "node:fs/promises";
 import { readdir as readdir6 } from "node:fs/promises";
 import { createHash as createHash12 } from "node:crypto";
-import { join as join19, resolve as resolve24 } from "node:path";
+import { join as join20, resolve as resolve25 } from "node:path";
 var SAFE_TOKEN = /^[A-Za-z0-9._:@/+,-]+$/;
 var SAFE_REMOTE_ROOT = /^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+\/?$/;
 var remoteDevToolSchema = {
@@ -254069,21 +254299,21 @@ function runProcess(executable, args, cwd) {
 function resolveDrizzleCommand(root, configured) {
   if (configured?.trim())
     return configured.trim();
-  const local = join19(root, "node_modules", ".bin", "drizzle-kit");
-  return existsSync14(local) ? local : "drizzle-kit";
+  const local = join20(root, "node_modules", ".bin", "drizzle-kit");
+  return existsSync15(local) ? local : "drizzle-kit";
 }
 function toolFailed(value) {
   return value?.isError === true || value?.content?.some((chunk) => typeof chunk?.text === "string" && chunk.text.trimStart().startsWith("❌"));
 }
 async function migrateDatabase(args, options) {
-  const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
+  const root = resolve25(String(args.project_dir || options.cwd || process.cwd()));
   const projectConfig = await readProjectConfig3(root);
   const config = projectConfig.dev || {};
   const database = config.database || {};
   const execute = options.execute || ((command, commandArgs, cwd) => runProcess(command, commandArgs, cwd));
-  const drizzleConfig = resolve24(root, String(args.drizzle_config || database.drizzleConfig || "drizzle.config.ts"));
+  const drizzleConfig = resolve25(root, String(args.drizzle_config || database.drizzleConfig || "drizzle.config.ts"));
   const migrationsDir = String(args.migrations_dir || database.migrationsDir || "supabase/migrations");
-  if (!existsSync14(drizzleConfig))
+  if (!existsSync15(drizzleConfig))
     throw new Error(`Drizzle config not found: ${drizzleConfig}`);
   const generated = await execute(resolveDrizzleCommand(root, typeof args.drizzle_bin === "string" ? args.drizzle_bin : database.drizzleBin), ["generate", "--config", drizzleConfig], root);
   if (generated.exitCode !== 0)
@@ -254101,8 +254331,8 @@ async function migrateDatabase(args, options) {
   return { ok: true, mode: "dev", action: "migrate", generated: true, applied: true, migrations_dir: migrationsDir, result: applied };
 }
 async function readProjectConfig3(root) {
-  const file = join19(root, "supacloud.json");
-  if (!existsSync14(file))
+  const file = join20(root, "supacloud.json");
+  if (!existsSync15(file))
     return {};
   try {
     const parsed = JSON.parse(await readFile10(file, "utf8"));
@@ -254120,7 +254350,7 @@ async function sourceFingerprint(root) {
   const visit = async (directory) => {
     const entries = await readdir6(directory, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-      const path = join19(directory, entry.name);
+      const path = join20(directory, entry.name);
       if (entry.isDirectory() && ![".git", "node_modules", "dist", "generated", ".supacloud"].includes(entry.name))
         await visit(path);
       else if (entry.isFile())
@@ -254148,17 +254378,17 @@ function remoteRoot(value) {
 }
 function targetDirectory(root, target, functionSlug, config = {}) {
   if (target === "db")
-    return join19(root, "supabase", "migrations");
+    return join20(root, "supabase", "migrations");
   if (target === "functions") {
     const targets = config.targets && typeof config.targets === "object" ? config.targets : {};
     const match = Object.values(targets).find((entry) => entry?.type === "edge_function" && (!functionSlug || String(entry.slug || "") === functionSlug));
-    const base = match?.root ? resolve24(root, String(match.root)) : join19(root, "supabase", "functions");
-    return match?.root ? base : functionSlug ? join19(base, safeToken(functionSlug, "function")) : base;
+    const base = match?.root ? resolve25(root, String(match.root)) : join20(root, "supabase", "functions");
+    return match?.root ? base : functionSlug ? join20(base, safeToken(functionSlug, "function")) : base;
   }
   if (target === "frontend") {
     const targets = config.targets && typeof config.targets === "object" ? config.targets : {};
     const match = Object.values(targets).find((entry) => entry?.type === "frontend");
-    return match?.root ? resolve24(root, String(match.root)) : join19(root, "apps", "web");
+    return match?.root ? resolve25(root, String(match.root)) : join20(root, "apps", "web");
   }
   return root;
 }
@@ -254197,10 +254427,10 @@ function reloadCommand(config, target, projectRef, functionSlug) {
   return [...command.split(" "), "--project-ref", safeToken(projectRef || "test", "project_ref"), "--target", targetConfigPath(target), ...functionSlug ? ["--function", safeToken(functionSlug, "function")] : []];
 }
 function sshArgs(connection, remoteCommand) {
-  return ["-p", String(connection.port), "-i", resolve24(connection.key), "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=yes", `${connection.user}@${connection.host}`, ...remoteCommand];
+  return ["-p", String(connection.port), "-i", resolve25(connection.key), "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=yes", `${connection.user}@${connection.host}`, ...remoteCommand];
 }
 function rsyncArgs(connection, source, destination, excludes, deleteRemote) {
-  const args = ["-az", "--checksum", "--partial", "--protect-args", "-e", `ssh -p ${connection.port} -i ${resolve24(connection.key)} -o BatchMode=yes -o StrictHostKeyChecking=yes`];
+  const args = ["-az", "--checksum", "--partial", "--protect-args", "-e", `ssh -p ${connection.port} -i ${resolve25(connection.key)} -o BatchMode=yes -o StrictHostKeyChecking=yes`];
   if (deleteRemote)
     args.push("--delete-delay");
   for (const exclude of excludes) {
@@ -254212,17 +254442,17 @@ function rsyncArgs(connection, source, destination, excludes, deleteRemote) {
   return args;
 }
 async function syncOnce(args, options) {
-  const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
+  const root = resolve25(String(args.project_dir || options.cwd || process.cwd()));
   const projectConfig = await readProjectConfig3(root);
   const config = projectConfig.dev || {};
   const target = String(args.target || "project");
   const source = targetDirectory(root, target, typeof args.function === "string" ? args.function : undefined, projectConfig);
-  if (!existsSync14(source))
+  if (!existsSync15(source))
     throw new Error(`Dev source directory not found: ${source}`);
   let compiled = false;
   if (config.compile === true && target !== "db") {
-    const compileRoot = resolve24(root, config.compileRoot || ".");
-    const compileOutDir = resolve24(root, config.compileOutDir || "generated");
+    const compileRoot = resolve25(root, config.compileRoot || ".");
+    const compileOutDir = resolve25(root, config.compileOutDir || "generated");
     const compilation = await compileProject({
       rootDir: compileRoot,
       outDir: compileOutDir,
@@ -254260,7 +254490,7 @@ function registerRemoteDevTools(server2, options = {}) {
     if (["production", "prod"].includes((options.environment || "").toLowerCase()))
       throw new Error("Remote dev mode is forbidden for production environments");
     if (args.action === "status") {
-      const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
+      const root = resolve25(String(args.project_dir || options.cwd || process.cwd()));
       const config = await readDevConfig(root);
       const connection = connectionArgs(options, config, args);
       const execute = options.execute || ((command, commandArgs, cwd) => runProcess(command, commandArgs, cwd));
@@ -254274,7 +254504,7 @@ function registerRemoteDevTools(server2, options = {}) {
       return { content: [{ type: "text", text: JSON.stringify(await migrateDatabase(args, options), null, 2) }] };
     }
     if (args.action === "watch") {
-      const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
+      const root = resolve25(String(args.project_dir || options.cwd || process.cwd()));
       const interval = Math.max(100, Math.min(1e4, Number(args.interval_ms || 300)));
       let fingerprint = "";
       let lastSync = null;
@@ -254295,7 +254525,7 @@ function registerRemoteDevTools(server2, options = {}) {
 // package.json
 var package_default8 = {
   name: "@supacloud/cli",
-  version: "0.62.1",
+  version: "0.63.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -254330,7 +254560,7 @@ var package_default8 = {
   },
   dependencies: {
     "@sinclair/typebox": "^0.34.52",
-    "@supacloud/compiler": "^0.31.0",
+    "@supacloud/compiler": "^0.31.1",
     "@supacloud/delivery": "0.4.0",
     "@supacloud/db": "^0.2.0",
     fflate: "^0.8.3",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.62.1",
+  "version": "0.63.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -35,7 +35,7 @@
   },
   "dependencies": {
     "@sinclair/typebox": "^0.34.52",
-    "@supacloud/compiler": "^0.31.0",
+    "@supacloud/compiler": "^0.31.1",
     "@supacloud/delivery": "0.4.0",
     "@supacloud/db": "^0.2.0",
     "fflate": "^0.8.3",