@supacloud/cli 0.62.1 → 0.64.0

package/dist/index.js

@@ -206727,7 +206727,7 @@ var ACTION_POLICY = {
   },
   ai: { local: ["show_skill", "install_skill"] },
   app: {
-    local: ["init", "generate", "dev", "compile", "check", "graph", "explain", "export-tools", "context", "doctor", "fix", "plan", "build"],
+    local: ["init", "generate", "dev", "watch", "verify-plan", "compile", "check", "graph", "explain", "export-tools", "context", "doctor", "fix", "plan", "build"],
     read: ["status"],
     write: ["upload", "configure", "deploy", "rollback", "reconcile", "retire"]
   },
@@ -217356,6 +217356,7 @@ function confirmedFunctionDeletion(payload, expectation) {
 var execFileAsync = promisify(execFile);
 var SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/;
 var FORBIDDEN_BUNDLE_SEGMENTS = new Set(["node_modules", ".git"]);
+var EDGE_FUNCTION_DEPLOY_TIMEOUT_MS = 5 * 60000;
 var FUNCTION_FRAMEWORKS2 = ["fetch", "elysia", "hono", "sveltekit-function"];
 function scaffoldFiles(framework, slug) {
   if (framework === "elysia") {
@@ -218217,7 +218218,7 @@ ${deployCheck.err}`;
           expected_active_version: expectedActiveVersion,
           expected_activation_id: expectedActivationId,
           ...functionConfig()
-        });
+        }, { timeoutMs: EDGE_FUNCTION_DEPLOY_TIMEOUT_MS });
         return functionMutationResponse({
           operation: "edge_functions.deploy",
           projectRef: ref,
@@ -218236,7 +218237,7 @@ ${deployCheck.err}`;
           expected_active_version: expectedActiveVersion,
           expected_activation_id: expectedActivationId,
           ...functionConfig()
-        });
+        }, { timeoutMs: EDGE_FUNCTION_DEPLOY_TIMEOUT_MS });
         return functionMutationResponse({
           operation: "edge_functions.deploy_bundle",
           projectRef: ref,
@@ -221518,9 +221519,9 @@ function registerAiTools(server2) {
 }
 
 // src/shared/tools/app-tools.ts
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "node:fs";
-import { mkdir as mkdir6, readFile as readFile8, readdir as readdir5, writeFile as writeFile5 } from "node:fs/promises";
-import { basename as basename8, dirname as dirname12, join as join15, relative as relative12, resolve as resolve17 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
+import { mkdir as mkdir6, readFile as readFile9, readdir as readdir6, writeFile as writeFile5 } from "node:fs/promises";
+import { basename as basename8, dirname as dirname13, join as join17, relative as relative13, resolve as resolve21 } from "node:path";
 
 // node_modules/@supacloud/compiler/dist/index.js
 import { dirname as dirname22, relative as relative6, sep as sep4 } from "node:path";
@@ -229355,7 +229356,7 @@ function renderClient(graph, options) {
     "",
     "export interface ApiClientConfig {",
     "  baseUrl?: string;",
-    "  fetch?: typeof fetch;",
+    "  fetch?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;",
     "  headers?: Record<string, string> | (() => Record<string, string> | Promise<Record<string, string>>);",
     "  interceptors?: HttpInterceptorFn[];",
     "  /** Normalize response objects like Elysia's default schema validator. */",
@@ -246659,6 +246660,46 @@ function buildToolDefinitions(manifest) {
   }
   return { openai, mcp };
 }
+// src/shared/tools/starter-metadata.json
+var starter_metadata_default = {
+  schemaVersion: 1,
+  generatedBy: "supacloud/starter-metadata-v1",
+  packages: {
+    compiler: {
+      version: "0.31.1"
+    },
+    app: {
+      version: "0.22.0",
+      dependencies: {
+        rxjs: "7.8.2"
+      }
+    },
+    elysia: {
+      version: "0.23.1"
+    },
+    commands: {
+      version: "0.9.0"
+    },
+    contracts: {
+      version: "0.8.0"
+    },
+    db: {
+      version: "0.13.0",
+      peerDependencies: {
+        "drizzle-orm": "1.0.0-rc.4"
+      },
+      devDependencies: {
+        "drizzle-kit": "1.0.0-rc.4"
+      }
+    },
+    sdk: {
+      version: "0.36.1",
+      peerDependencies: {
+        "@supabase/supabase-js": "^2.115.0"
+      }
+    }
+  }
+};
 
 // src/shared/tools/app-starter-reactive.ts
 var STARTER_REACTIVE_GUIDE = `# Reactive development / 响应式开发
@@ -246884,259 +246925,9 @@ test("partial and untagged inherited remote profiles cannot mix with selected fi
   expect(() => loadEnvironment("staging", root, {})).toThrow("Each remote file profile");
 });
 `;
-// ../compiler/package.json
-var package_default = {
-  name: "@supacloud/compiler",
-  version: "0.31.0",
-  description: "Static compiler for @supacloud/app metadata: builds the application graph from AST, validates it, and generates reflection-free factory code",
-  type: "module",
-  main: "./dist/index.js",
-  module: "./dist/index.js",
-  types: "./dist/index.d.ts",
-  bin: {
-    "supacloud-compiler": "./dist/cli.js"
-  },
-  exports: {
-    ".": {
-      types: "./dist/index.d.ts",
-      import: "./dist/index.js",
-      default: "./dist/index.js"
-    },
-    "./diagnostics": {
-      types: "./dist/diagnostics.d.ts",
-      import: "./dist/diagnostics.js",
-      default: "./dist/diagnostics.js"
-    }
-  },
-  files: [
-    "NOTICE",
-    "LICENSE-APACHE-2.0.txt",
-    "dist",
-    "README.md",
-    "DELIVERY.md"
-  ],
-  scripts: {
-    build: "bun run clean && bun run build:js && bun run build:types",
-    "build:js": "bun build src/index.ts src/diagnostics.ts src/cli.ts src/delivery-bundle-worker.ts --outdir dist --target node --conditions=supacloud-source --external @typescript/typescript6 --external graphql --external '@graphql-codegen/*'",
-    "build:types": "tsc -p tsconfig.json --emitDeclarationOnly",
-    clean: "rm -rf dist",
-    prepublishOnly: "bun run build && bun run test:package",
-    test: "bun test",
-    "test:package": 'SUPACLOUD_COMPILER_TEST_CLI="$PWD/dist/cli.js" bun test src/graphql-package.test.ts',
-    benchmark: "bun run src/benchmark.ts",
-    typecheck: "tsc -p tsconfig.json --noEmit",
-    "typecheck:test": "tsc -p tsconfig.test.json --noEmit"
-  },
-  keywords: [
-    "supacloud",
-    "compiler",
-    "di",
-    "codegen",
-    "elysia"
-  ],
-  license: "Apache-2.0",
-  repository: {
-    type: "git",
-    url: "https://github.com/vibeunion/supacloud.git",
-    directory: "packages/compiler"
-  },
-  dependencies: {
-    "@supacloud/delivery": "0.4.0",
-    typebox: "1.3.34",
-    "@graphql-codegen/core": "^6.2.0",
-    "@graphql-codegen/typed-document-node": "^7.1.0",
-    "@graphql-codegen/typescript-operations": "^6.1.6",
-    "@graphql-typed-document-node/core": "^3.2.0",
-    "@typescript/typescript6": "^6.0.2",
-    graphql: "^16"
-  },
-  devDependencies: {
-    "@supabase/supabase-js": "2.115.0",
-    "drizzle-orm": "1.0.0-rc.4",
-    "@types/bun": "^1.4.2",
-    typescript: "^7.0.2"
-  }
-};
-// ../app/package.json
-var package_default2 = {
-  name: "@supacloud/app",
-  version: "0.21.1",
-  description: "Angular-style application metadata for SupaCloud: modules, DI tokens, providers, scopes, controllers and commands",
-  type: "module",
-  main: "./dist/index.js",
-  module: "./dist/index.js",
-  types: "./dist/index.d.ts",
-  exports: {
-    "./contracts": {
-      types: "./dist/contract_client.d.ts",
-      import: "./dist/contract_client.js",
-      default: "./dist/contract_client.js"
-    },
-    "./browser": {
-      types: "./dist/browser.d.ts",
-      import: "./dist/browser.js",
-      default: "./dist/browser.js"
-    },
-    ".": {
-      types: "./dist/index.d.ts",
-      import: "./dist/index.js",
-      default: "./dist/index.js"
-    },
-    "./execution": {
-      types: "./dist/execution.d.ts",
-      import: "./dist/execution.js",
-      default: "./dist/execution.js"
-    },
-    "./reactive": {
-      types: "./dist/reactive.d.ts",
-      import: "./dist/reactive.js",
-      default: "./dist/reactive.js"
-    },
-    "./rxjs": {
-      types: "./dist/rxjs.d.ts",
-      import: "./dist/rxjs.js",
-      default: "./dist/rxjs.js"
-    },
-    "./angular": {
-      types: "./dist/angular.d.ts",
-      import: "./dist/angular.js",
-      default: "./dist/angular.js"
-    },
-    "./http": {
-      types: "./dist/http.d.ts",
-      import: "./dist/http.js",
-      default: "./dist/http.js"
-    },
-    "./runtime": {
-      types: "./dist/runtime.d.ts",
-      import: "./dist/runtime.js",
-      default: "./dist/runtime.js"
-    }
-  },
-  files: [
-    "NOTICE",
-    "LICENSE-APACHE-2.0.txt",
-    "dist",
-    "README.md",
-    "EXECUTION.md",
-    "REACTIVE.md",
-    "ANGULAR.md"
-  ],
-  scripts: {
-    build: "bun run clean && bun run build:js && bun run build:types",
-    "build:js": "bun build src/index.ts src/execution.ts --outdir dist --target node --external @supacloud/contracts --external '@angular/*' --external rxjs --format esm && bun build src/contract_client.ts src/browser.ts --outdir dist --target browser --external @supacloud/contracts --format esm && bun build src/reactive.ts --outdir dist --target browser --external rxjs --format esm && bun build src/angular.ts src/rxjs.ts --outdir dist --target browser --external '@angular/*' --external rxjs --format esm && bun build src/http.ts --outdir dist --target node --external @supacloud/app --format esm && bun build src/runtime.ts --outdir dist --target browser --format esm",
-    "build:types": "tsc -p tsconfig.json --emitDeclarationOnly",
-    clean: "rm -rf dist",
-    "check:package": "node ../../.github/scripts/esm-package-policy.mjs --pack .",
-    prepublishOnly: "bun run build && bun run check:package",
-    test: "bun test",
-    typecheck: "tsc -p tsconfig.json --noEmit",
-    "typecheck:test": "tsc -p tsconfig.test.json --noEmit"
-  },
-  keywords: [
-    "supacloud",
-    "di",
-    "dependency-injection",
-    "module",
-    "elysia"
-  ],
-  license: "Apache-2.0",
-  repository: {
-    type: "git",
-    url: "https://github.com/vibeunion/supacloud.git",
-    directory: "packages/app"
-  },
-  dependencies: {
-    "@angular/core": "^22.1.5",
-    "@supacloud/contracts": "0.8.0",
-    rxjs: "7.8.2",
-    typebox: "1.3.34"
-  },
-  devDependencies: {
-    "@types/bun": "^1.4.2",
-    "@types/node": "^26.5.0",
-    typescript: "^7.0.2",
-    "@angular/compiler": "22.1.5"
-  }
-};
-// ../elysia/package.json
-var package_default3 = {
-  name: "@supacloud/elysia",
-  version: "0.23.1",
-  description: "Elysia runtime adapter for SupaCloud compiled modules: application/request scopes, route registration and validation",
-  type: "module",
-  main: "./dist/index.js",
-  module: "./dist/index.js",
-  types: "./dist/index.d.ts",
-  exports: {
-    ".": {
-      types: "./dist/index.d.ts",
-      import: "./dist/index.js",
-      default: "./dist/index.js"
-    }
-  },
-  files: [
-    "NOTICE",
-    "LICENSE-APACHE-2.0.txt",
-    "dist",
-    "README.md",
-    "compatibility.json"
-  ],
-  scripts: {
-    "generate:example": "bun src/generate-webhook-example.ts",
-    build: "bun run clean && bun run build:js && bun run build:types",
-    "build:js": "bun build src/index.ts --outdir dist --target node --external elysia --external jose --external @supacloud/app --external @supacloud/db --external @supacloud/contracts",
-    "build:types": "tsc -p tsconfig.json --emitDeclarationOnly",
-    clean: "rm -rf dist",
-    prepublishOnly: "bun run build",
-    test: "bun test",
-    "test:conformance": "bun test src/conformance.test.ts src/application-execution.test.ts ../app/src/execution.test.ts ../app/src/execution_bundle.test.ts",
-    "test:runtime-safety": "SUPACLOUD_REQUIRE_RUNTIME_SAFETY=1 bun test src/runtime-safety.test.ts",
-    "test:contract-upgrade": "bun test src/contract-upgrade.test.ts",
-    "bench:http-policy": "bun bench/http-policy.ts",
-    typecheck: "tsc -p tsconfig.json --noEmit",
-    "typecheck:test": "tsc -p tsconfig.test.json --noEmit"
-  },
-  keywords: [
-    "supacloud",
-    "elysia",
-    "adapter",
-    "dependency-injection",
-    "module"
-  ],
-  license: "Apache-2.0",
-  repository: {
-    type: "git",
-    url: "https://github.com/vibeunion/supacloud.git",
-    directory: "packages/elysia"
-  },
-  dependencies: {
-    "@supacloud/app": "file:../app",
-    "@supacloud/contracts": "file:../contracts",
-    "exact-mirror": "1.2.6",
-    jose: "^6.2.11",
-    typebox: "1.3.34"
-  },
-  overrides: {
-    "@supacloud/delivery": "file:../delivery",
-    "@supacloud/contracts": "file:../contracts",
-    "@supacloud/commands": "file:../commands"
-  },
-  peerDependencies: {
-    elysia: "2.0.0-beta.19"
-  },
-  devDependencies: {
-    "@supacloud/compiler": "file:../compiler",
-    "@supacloud/delivery": "file:../delivery",
-    "@supacloud/commands": "file:../commands",
-    "@supacloud/db": "file:../db",
-    "@types/bun": "^1.4.2",
-    elysia: "2.0.0-beta.19",
-    typescript: "^7.0.2"
-  }
-};
 
 // src/shared/tools/app-starter-templates.ts
+var { compiler: compilerMetadata, app: appMetadata, elysia: elysiaMetadata } = starter_metadata_default.packages;
 var json = (value) => `${JSON.stringify(value, null, 2)}
 `;
 var DEV_SCRIPT = `import { watchProject, compileOptionsFromConfig, loadSupacloudConfig } from "@supacloud/compiler";
@@ -247212,7 +247003,8 @@ export function createCompiledModules(): never {
   throw new Error("Run bun run compile before starting the application");
 }
 `;
-function baseFiles(name) {
+function baseFiles(name, sdkDependencies) {
+  const minimal = sdkDependencies !== undefined;
   return {
     "package.json": json({
       name,
@@ -247235,13 +247027,13 @@ function baseFiles(name) {
         "env:production": "bun --no-env-file scripts/environment.ts production"
       },
       dependencies: {
-        "@supacloud/app": `^${package_default2.version}`,
-        "@supacloud/elysia": `^${package_default3.version}`,
+        "@supacloud/app": `^${appMetadata.version}`,
+        "@supacloud/elysia": `^${elysiaMetadata.version}`,
         elysia: "2.0.0-beta.19",
-        rxjs: package_default2.dependencies.rxjs
+        ...sdkDependencies ?? { rxjs: appMetadata.dependencies.rxjs }
       },
       devDependencies: {
-        "@supacloud/compiler": `^${package_default.version}`,
+        "@supacloud/compiler": `^${compilerMetadata.version}`,
         "@types/bun": "^1.4.2",
         typescript: "^7.0.2"
       }
@@ -247289,9 +247081,11 @@ export default defineSupacloudConfig({
 `,
     "src/application.ts": APPLICATION_SOURCE(name),
     "generated/application.ts": GENERATED_BOOTSTRAP,
-    "REACTIVE.md": STARTER_REACTIVE_GUIDE,
-    "AGENTS.md": STARTER_REACTIVE_AGENTS,
-    "tests/reactive.test.ts": STARTER_REACTIVE_TEST,
+    ...minimal ? {} : {
+      "REACTIVE.md": STARTER_REACTIVE_GUIDE,
+      "AGENTS.md": STARTER_REACTIVE_AGENTS,
+      "tests/reactive.test.ts": STARTER_REACTIVE_TEST
+    },
     "scripts/environment.ts": STARTER_ENVIRONMENT,
     "tests/environment.test.ts": STARTER_ENVIRONMENT_TEST,
     "scripts/dev.ts": DEV_SCRIPT,
@@ -247487,7 +247281,111 @@ supacloud doctor --root .
 `
   };
 }
-function appTemplateFiles(name, template) {
+function minimalTemplate(name, sdkDependencies) {
+  return {
+    ...baseFiles(name, sdkDependencies),
+    "src/features/health/health.ts": `import { Controller, Get, Module } from "@supacloud/app/core";
+import { t } from "elysia";
+
+export const HealthResult = t.Object({ ok: t.Boolean() });
+
+@Controller("/health")
+export class HealthController {
+  @Get("/", { responses: { 200: HealthResult } })
+  health(): { ok: boolean } { return { ok: true }; }
+}
+
+@Module({ name: "health", tags: ["type:feature"], controllers: [HealthController] })
+export class HealthModule {}
+`,
+    "src/features/health/health.test.ts": `import { expect, test } from "bun:test";
+import { HealthController } from "./health";
+
+test("health is a public, side-effect-free operation", () => {
+  expect(new HealthController().health()).toEqual({ ok: true });
+});
+`,
+    "src/app.module.ts": `import { Module } from "@supacloud/app/core";
+import { HealthModule } from "./features/health/health";
+
+@Module({ name: "application-root", tags: ["type:app"], imports: [HealthModule] })
+export class AppModule {}
+`,
+    "scripts/sandbox.ts": `import { createMemorySandbox } from "@supacloud/elysia";
+import { createCompiledModules } from "../generated/application";
+
+export function createDemo() {
+  if (process.env.APP_ENV !== "development" && process.env.APP_ENV !== "test") {
+    throw new Error("Local adapters are restricted to development and test");
+  }
+  return createMemorySandbox({ modules: createCompiledModules() });
+}
+`,
+    "AGENTS.md": `# Application changes
+
+- Business code and its tests belong in src/features/<feature>.
+- Use @supacloud/app/core for metadata; keep UI in the selected frontend framework.
+- Reuse @supacloud/js and the existing Supabase session for platform access.
+- Ordinary reads use the RLS-protected Supabase client. GraphQL is opt-in.
+- Cross-table business writes require trusted authorization, transactions,
+  idempotency and audit. Never put service-role or Management tokens in a browser.
+- Do not edit generated/. Do not rewrite historical migrations.
+- Run the directly related single test file and git diff --check for daily changes.
+- Use app verify-plan --target <module> to inspect the focused verification plan.
+- Do not introduce another workflow engine, DI container or session store.
+`,
+    "README.md": `# ${name}
+
+## Local development
+
+\`\`\`sh
+bun install
+bun run compile
+bun test src/features/health/health.test.ts
+bun run dev
+\`\`\`
+
+The local server binds to 127.0.0.1:3000 and exposes GET /health.
+The dev script compiles, watches and restarts after successful compilation.
+Memory adapters are local-only; this is not production identity or persistence.
+
+## Add a feature
+
+Keep code, contracts and tests in src/features/<feature>; register modules in
+src/app.module.ts. Use @supacloud/app/core, not a frontend compatibility API.
+Use app generate --kind resource for an authorized read-port skeleton.
+It fails closed until the application supplies its data adapter.
+
+## Frontend and database
+
+@supacloud/js wraps your existing @supabase/supabase-js client. Reuse its session,
+Storage and RLS-protected PostgREST reads. Generated business clients can use
+createAuthenticatedFetch from @supacloud/js/contracts with that same session.
+Use fixed trusted HTTPS endpoints and never retry an uncertain write.
+
+GraphQL is optional; this starter has no synthetic GraphQL schema.
+For a complete persistent command/attachment example, create a separate reference
+project with app init --template command. The http and edge recipes also remain
+explicit options; do not install every recipe into this application.
+
+## Integration and delivery
+
+createApp requires application-owned trusted identity and durable adapters.
+Database migrations and seed data require an explicitly selected development
+database and a reviewed application script; the CLI never infers a production target.
+Commit generated/ after compilation. At release, check generated drift before
+regeneration, then validate types, database permissions and authenticated behavior.
+`
+  };
+}
+function appTemplateFiles(name, template, sdkDependencies) {
+  if (template === "minimal") {
+    if (!sdkDependencies)
+      throw new Error("Minimal template requires the initializer's SDK dependency versions");
+    return minimalTemplate(name, sdkDependencies);
+  }
+  if (template !== "http" && template !== "edge")
+    throw new Error("Use appStarterFiles for the command recipe");
   const files = template === "http" ? httpTemplate(name) : edgeTemplate(name);
   const feature = template === "http" ? "OrdersFeature" : "SyncFeature";
   const source = template === "http" ? "./orders/orders" : "./sync/sync";
@@ -248521,329 +248419,135 @@ export async function createDeliveryApplication(modules: CompiledModule[], lifec
   }
 }
 `;
-// ../commands/package.json
-var package_default4 = {
-  name: "@supacloud/commands",
-  version: "0.9.0",
-  description: "Storage-independent durable command execution and recovery",
-  type: "module",
-  main: "./dist/index.js",
-  types: "./dist/index.d.ts",
-  exports: {
-    "./typebox": {
-      types: "./dist/typebox.d.ts",
-      import: "./dist/typebox.js"
-    },
-    ".": {
-      types: "./dist/index.d.ts",
-      import: "./dist/index.js"
-    }
-  },
-  files: [
-    "NOTICE",
-    "LICENSE-APACHE-2.0.txt",
-    "dist",
-    "README.md"
-  ],
-  scripts: {
-    build: "bun run build:js && bun run build:types",
-    "build:js": "bun build src/index.ts src/typebox.ts --outdir dist --target node --external @supacloud/contracts --external @sinclair/typebox",
-    "build:types": "tsc -p tsconfig.json --emitDeclarationOnly",
-    typecheck: "tsc -p tsconfig.json --noEmit",
-    "typecheck:test": "tsc -p tsconfig.test.json --noEmit",
-    test: "bun test",
-    prepublishOnly: "bun run build"
-  },
-  dependencies: {
-    "@supacloud/contracts": "file:../contracts"
-  },
-  devDependencies: {
-    "@sinclair/typebox": "0.34.52",
-    "@types/bun": "1.4.2",
-    typescript: "7.0.2"
-  },
-  peerDependencies: {
-    "@sinclair/typebox": "0.34.52"
-  },
-  peerDependenciesMeta: {
-    "@sinclair/typebox": {
-      optional: true
-    }
-  },
-  license: "Apache-2.0",
-  repository: {
-    type: "git",
-    url: "https://github.com/vibeunion/supacloud.git",
-    directory: "packages/commands"
-  }
-};
-// ../contracts/package.json
-var package_default5 = {
-  name: "@supacloud/contracts",
-  version: "0.8.0",
-  description: "SupaCloud command protocol with optional client and browser entrypoints",
-  type: "module",
-  main: "./dist/index.cjs",
-  types: "./dist/index.d.mts",
-  exports: {
-    ".": {
-      import: {
-        types: "./dist/index.d.mts",
-        default: "./dist/index.mjs"
-      },
-      require: {
-        types: "./dist/index.d.cts",
-        default: "./dist/index.cjs"
-      }
-    },
-    "./client": {
-      import: {
-        types: "./dist/client.d.mts",
-        default: "./dist/client.mjs"
-      },
-      require: {
-        types: "./dist/client.d.cts",
-        default: "./dist/client.cjs"
-      }
-    },
-    "./browser": {
-      import: {
-        types: "./dist/browser.d.mts",
-        default: "./dist/browser.mjs"
-      },
-      require: {
-        types: "./dist/browser.d.cts",
-        default: "./dist/browser.cjs"
-      }
-    }
-  },
-  files: [
-    "NOTICE",
-    "LICENSE-APACHE-2.0.txt",
-    "dist",
-    "README.md"
-  ],
-  scripts: {
-    build: "bun run clean && bun run build:js && bun run build:types",
-    "build:js": "bun run build:js:esm && bun run build:js:cjs",
-    "build:types": "tsc -p tsconfig.json --emitDeclarationOnly && node ../../scripts/copy-dual-declarations.mjs dist",
-    typecheck: "tsc -p tsconfig.json --noEmit",
-    "typecheck:test": "tsc -p tsconfig.test.json --noEmit",
-    test: "bun test",
-    prepublishOnly: "bun run build",
-    "build:js:esm": 'bun build src/index.ts src/client.ts src/browser.ts --outdir dist --format esm --entry-naming "[name].mjs" --chunk-naming "[name]-[hash].mjs" --target browser --splitting',
-    "build:js:cjs": 'bun build src/index.ts src/client.ts src/browser.ts --outdir dist --format cjs --entry-naming "[name].cjs" --chunk-naming "[name]-[hash].cjs" --target browser',
-    clean: "rm -rf dist"
-  },
-  devDependencies: {
-    "@types/bun": "1.4.2",
-    typescript: "7.0.2"
-  },
-  license: "Apache-2.0",
-  repository: {
-    type: "git",
-    url: "https://github.com/vibeunion/supacloud.git",
-    directory: "packages/contracts"
-  },
-  module: "./dist/index.mjs"
-};
-// ../db/package.json
-var package_default6 = {
-  name: "@supacloud/db",
-  version: "0.11.0",
-  description: "Database governance layer for SupaCloud: RLS policies, RPC functions and grants as first-class resources, with manifest/catalog reconciliation",
-  type: "module",
-  main: "./dist/index.js",
-  module: "./dist/index.js",
-  types: "./dist/index.d.ts",
-  bin: {
-    "supacloud-sql-impact": "./dist/sql-impact-cli.js"
-  },
-  exports: {
-    "./sql-analysis": {
-      types: "./dist/sql-analysis.d.ts",
-      import: "./dist/sql-analysis.js"
-    },
-    "./drizzle": {
-      types: "./dist/drizzle.d.ts",
-      import: "./dist/drizzle.js"
-    },
-    "./drizzle-bun": {
-      types: "./dist/drizzle-bun.d.ts",
-      import: "./dist/drizzle-bun.js"
-    },
-    "./bun": {
-      types: "./dist/command-bun.d.ts",
-      import: "./dist/command-bun.js"
-    },
-    ".": {
-      types: "./dist/index.d.ts",
-      import: "./dist/index.js",
-      default: "./dist/index.js"
-    }
-  },
-  files: [
-    "NOTICE",
-    "LICENSE-APACHE-2.0.txt",
-    "dist",
-    "README.md",
-    "MIGRATION_BINDINGS.md"
-  ],
-  scripts: {
-    build: "bun run clean && bun run build:js && bun run build:types",
-    "build:js": "bun build src/index.ts src/command-bun.ts src/drizzle.ts src/drizzle-bun.ts src/sql-analysis.ts src/sql-impact-cli.ts --outdir dist --target node --external bun --external @supacloud/contracts --external drizzle-orm --external libpg-query",
-    "build:types": "tsc -p tsconfig.json --emitDeclarationOnly",
-    clean: "rm -rf dist",
-    prepublishOnly: "bun run build",
-    test: "bun test",
-    typecheck: "tsc -p tsconfig.json --noEmit",
-    "typecheck:test": "tsc -p tsconfig.test.json --noEmit",
-    "typecheck:drizzle": "tsc -p tsconfig.drizzle.json --noEmit"
-  },
-  keywords: [
-    "supacloud",
-    "database",
-    "governance",
-    "rls",
-    "postgresql"
-  ],
-  license: "Apache-2.0",
-  repository: {
-    type: "git",
-    url: "https://github.com/vibeunion/supacloud.git",
-    directory: "packages/db"
-  },
-  devDependencies: {
-    "@sinclair/typebox": "0.34.52",
-    "@typescript/typescript6": "^6.0.2",
-    "drizzle-orm": "1.0.0-rc.4",
-    "@types/bun": "^1.4.2",
-    typescript: "^7.0.2"
-  },
-  dependencies: {
-    "libpg-query": "18.1.4",
-    "@supacloud/contracts": "file:../contracts"
-  },
-  peerDependencies: {
-    "drizzle-orm": "1.0.0-rc.4"
-  },
-  peerDependenciesMeta: {
-    "drizzle-orm": {
-      optional: true
-    }
-  },
-  overrides: {
-    "@supacloud/contracts": "file:../contracts"
-  }
-};
-// ../supacloud-js/package.json
-var package_default7 = {
-  name: "@supacloud/js",
-  version: "0.36.0",
-  description: "Platform SDK for SupaCloud, built on top of supabase-js",
-  type: "module",
-  main: "./dist/index.cjs",
-  module: "./dist/index.mjs",
-  types: "./dist/index.d.mts",
-  exports: {
-    ".": {
-      import: {
-        types: "./dist/index.d.mts",
-        default: "./dist/index.mjs"
-      },
-      require: {
-        types: "./dist/index.d.cts",
-        default: "./dist/index.cjs"
-      }
-    },
-    "./task-events": {
-      import: {
-        types: "./dist/task-events.d.mts",
-        default: "./dist/task-events.mjs"
-      },
-      require: {
-        types: "./dist/task-events.d.cts",
-        default: "./dist/task-events.cjs"
-      }
-    },
-    "./contracts": {
-      import: {
-        types: "./dist/contracts.d.mts",
-        default: "./dist/contracts.mjs"
-      },
-      require: {
-        types: "./dist/contracts.d.cts",
-        default: "./dist/contracts.cjs"
-      }
-    },
-    "./reactive": {
-      import: {
-        types: "./dist/reactive.d.mts",
-        default: "./dist/reactive.mjs"
-      },
-      require: {
-        types: "./dist/reactive.d.cts",
-        default: "./dist/reactive.cjs"
-      }
-    }
-  },
-  files: [
-    "NOTICE",
-    "LICENSE-APACHE-2.0.txt",
-    "dist",
-    "README.md",
-    "COMPATIBILITY.md",
-    "REACTIVE.md"
-  ],
-  scripts: {
-    test: "bun test",
-    build: "bun run clean && bun run build:js && bun run build:types",
-    "build:js": "bun run build:js:esm && bun run build:js:cjs",
-    "build:types": "tsc -p tsconfig.json --emitDeclarationOnly && node ../../scripts/copy-dual-declarations.mjs dist",
-    clean: "rm -rf dist",
-    prepublishOnly: "bun run build && bun run check:package",
-    "typecheck:consumer": "tsc -p tsconfig.consumer.json --noEmit",
-    typecheck: "tsc -p tsconfig.json --noEmit",
-    "typecheck:test": "tsc -p tsconfig.test.json --noEmit",
-    "check:package": "node ../../.github/scripts/esm-package-policy.mjs --pack .",
-    "build:js:esm": 'bun build src/index.ts src/task-events.ts --outdir dist --format esm --entry-naming "[name].mjs" --chunk-naming "[name]-[hash].mjs" --target node --external @supabase/supabase-js --external @supacloud/contracts && bun build src/contracts.ts --outdir dist --format esm --entry-naming "[name].mjs" --chunk-naming "[name]-[hash].mjs" --target browser --external @supacloud/contracts && bun build src/reactive.ts --outdir dist --format esm --entry-naming "[name].mjs" --chunk-naming "[name]-[hash].mjs" --target browser --external rxjs',
-    "build:js:cjs": 'bun build src/index.ts src/task-events.ts --outdir dist --format cjs --entry-naming "[name].cjs" --chunk-naming "[name]-[hash].cjs" --target node --external @supabase/supabase-js --external @supacloud/contracts && bun build src/contracts.ts --outdir dist --format cjs --entry-naming "[name].cjs" --chunk-naming "[name]-[hash].cjs" --target browser --external @supacloud/contracts && bun build src/reactive.ts --outdir dist --format cjs --entry-naming "[name].cjs" --chunk-naming "[name]-[hash].cjs" --target browser --external rxjs'
-  },
-  keywords: [
-    "supacloud",
-    "supabase",
-    "sdk",
-    "background-tasks",
-    "realtime"
-  ],
-  license: "Apache-2.0",
-  repository: {
-    type: "git",
-    url: "https://github.com/vibeunion/supacloud.git",
-    directory: "packages/supacloud-js"
-  },
-  peerDependencies: {
-    "@supabase/supabase-js": "^2.115.0"
-  },
-  dependencies: {
-    "@supacloud/contracts": "file:../contracts",
-    rxjs: "7.8.2"
-  },
-  devDependencies: {
-    "@types/bun": "^1.4.2",
-    "@supabase/supabase-js": "^2.115.0",
-    typescript: "^7.0.2"
-  },
-  engines: {
-    node: ">=22.12.0"
-  }
+
+// src/shared/tools/app-starter-database.ts
+var STARTER_DATABASE_CONFIG = {
+  version: 1,
+  schema: ["db/schema.ts"],
+  functions: "db/functions",
+  migrations: "migrations",
+  contracts: "db/contracts",
+  audit: "output/database-audit",
+  consumers: ["src", "scripts", "tests"],
+  auditConsumers: [],
+  role: "starter_review_http"
 };
+var STARTER_DATABASE_SCHEMA = `import { sql } from "drizzle-orm";
+import { boolean, check, integer, jsonb, pgTable, primaryKey, text, uuid } from "drizzle-orm/pg-core";
+
+// Structure for the reviewed starter migrations. Grants/policies stay in those migrations.
+export const application = pgTable.withRLS("starter_application", {
+  singleton: boolean().default(true).primaryKey(),
+  projectId: text("project_id").notNull(),
+  tenantId: text("tenant_id").notNull(),
+}, table => [
+  check("starter_application_singleton_check", sql\`\${table.singleton}\`),
+  check("starter_application_project_id_check", sql\`length(\${table.projectId}) > 0\`),
+  check("starter_application_tenant_id_check", sql\`length(\${table.tenantId}) > 0\`),
+]);
+
+export const reviews = pgTable.withRLS("starter_reviews", {
+  id: text().primaryKey(),
+  ownerId: text("owner_id").notNull(),
+  state: text({ enum: ["draft", "approved"] }).notNull(),
+  version: integer().notNull(),
+}, table => [
+  check("starter_reviews_state_check", sql\`\${table.state} IN ('draft', 'approved')\`),
+  check("starter_reviews_version_check", sql\`\${table.version} > 0\`),
+]);
+
+export const members = pgTable.withRLS("starter_members", {
+  subject: text().primaryKey(),
+  enabled: boolean().default(true).notNull(),
+  canApprove: boolean("can_approve").default(false).notNull(),
+  storageSubject: uuid("storage_subject").unique(),
+});
+
+export const attachments = pgTable.withRLS("starter_attachments", {
+  reviewId: text("review_id").primaryKey().references(() => reviews.id),
+  artifactId: uuid("artifact_id").notNull().unique(),
+  ownerId: text("owner_id").notNull(),
+  runId: uuid("run_id").notNull().unique(),
+  objectPath: text("object_path").notNull().unique(),
+});
+
+export const attachmentResults = pgTable.withRLS("starter_attachment_results", {
+  reviewId: text("review_id").notNull().references(() => reviews.id),
+  version: integer().notNull(),
+  artifactId: uuid("artifact_id").notNull(),
+  result: jsonb().$type<unknown>().notNull(),
+}, table => [
+  primaryKey({ columns: [table.reviewId, table.version, table.artifactId] }),
+  check("starter_attachment_results_version_check", sql\`\${table.version} >= 2\`),
+]);
+
+export type ReviewRow = typeof reviews.$inferSelect;
+export type NewReview = typeof reviews.$inferInsert;
+`;
+var STARTER_DATABASE_GUIDE = `
+## Database Source Workflow
+
+Drizzle owns table declarations and inferred row types in db/schema.ts.
+Use the existing @supacloud/db/drizzle-bun adapters for typed queries and governed
+transactions; never replace permission, idempotency or audit checks with plain CRUD.
+Opaque JSON still needs runtime decoding.
+
+After installing dependencies, run \`bun run db:generate\` once and commit db/contracts/.
+The default \`bun run check\` and build fail on stale database contracts before any
+compiler regeneration. After an intentional source change, run db:generate again,
+review the diff, then run check. Ordinary checks are offline.
+
+- Maintain one schema-qualified function with explicit grants per db/functions/*.sql.
+- Preserve migrations/ and its existing executor/ledger. Add forward migrations only.
+- \`bun run db:diff\` generates Drizzle drafts under db/migration-candidates/, never
+  into the deployment directory. The starter has existing SQL history, so establish
+  and review a matching Drizzle baseline before promoting any draft; the first
+  draft is not automatically an incremental production migration.
+- \`bun run db:pull\` requires an explicitly selected DATABASE_URL and writes only
+  output/database-audit/drizzle-candidate/. Review candidates; never overwrite source blindly.
+- Full SQL dumps belong under the ignored output/database-audit/ directory. They are
+  audit/recovery artifacts, never ordinary type, application or test inputs.
+- \`bun run db:assess\` explains adoption/findings without writing or connecting.
+- GraphQL/PostgREST exports remain legitimate protocol contracts. This check is not
+  proof of deployed schema, effective role permissions or complete RLS equivalence.
+
+Do not introduce any/@ts-ignore to bypass a contract. Use Drizzle-inferred types,
+preserve bigint/numeric precision and decode unknown results at the boundary.
+`;
+function starterDatabaseFiles() {
+  return {
+    "database.sources.json": JSON.stringify(STARTER_DATABASE_CONFIG, null, 2) + `
+`,
+    "db/schema.ts": STARTER_DATABASE_SCHEMA,
+    "db/functions/README.md": `Maintain one schema-qualified function and its explicit EXECUTE ACL per SQL file. No RPC functions are needed by the initial transactional starter.
+`,
+    "drizzle.config.ts": `import { defineConfig } from "drizzle-kit";
+export default defineConfig({
+  dialect: "postgresql",
+  schema: "./db/schema.ts",
+  out: "./db/migration-candidates",
+});
+`,
+    "drizzle.pull.config.ts": `import { defineConfig } from "drizzle-kit";
+const url = process.env.DATABASE_URL;
+if (!url) throw new Error("Select an explicit DATABASE_URL for introspection");
+export default defineConfig({
+  dialect: "postgresql",
+  schema: "./db/schema.ts",
+  out: "./output/database-audit/drizzle-candidate",
+  dbCredentials: { url },
+});
+`
+  };
+}
 
 // src/shared/tools/app-starter.ts
+var { compiler: compilerMetadata2, app: appMetadata2, elysia: elysiaMetadata2, commands: commandsMetadata, contracts: contractsMetadata, db: dbMetadata, sdk: sdkMetadata } = starter_metadata_default.packages;
 var json2 = (value) => `${JSON.stringify(value, null, 2)}
 `;
 function appStarterFiles(name) {
   return {
+    ...starterDatabaseFiles(),
     "package.json": json2({
       name,
       version: "0.0.0",
@@ -248854,28 +248558,36 @@ function appStarterFiles(name) {
         compile: "bun --no-env-file node_modules/@supacloud/compiler/dist/cli.js compile",
         "check:generated": "bun --no-env-file node_modules/@supacloud/compiler/dist/cli.js check",
         typecheck: "tsc --noEmit",
-        check: "bun run compile && bun run check:generated && bun run typecheck && bun run test",
+        "db:generate": "supacloud-db generate",
+        "db:check": "supacloud-db check",
+        "db:assess": "supacloud-db assess",
+        "db:diff": "drizzle-kit generate --config drizzle.config.ts",
+        "db:pull": "drizzle-kit pull --config drizzle.pull.config.ts",
+        check: "bun run db:check && bun run compile && bun run check:generated && bun run typecheck && bun run test",
         test: "bun run compile && bun --no-env-file scripts/environment.ts test bun test",
         dev: "bun --no-env-file scripts/environment.ts development bun scripts/dev.ts",
-        build: "bun run compile && bun run typecheck && bun build src/application.ts --target bun --minify --outdir dist",
+        "dev:integration": "bun --no-env-file scripts/environment.ts development bun scripts/integration.ts",
+        build: "bun run db:check && bun run compile && bun run typecheck && bun build src/application.ts --target bun --minify --outdir dist",
         "env:development": "bun --no-env-file scripts/environment.ts development",
         "env:test": "bun --no-env-file scripts/environment.ts test",
         "env:staging": "bun --no-env-file scripts/environment.ts staging",
         "env:production": "bun --no-env-file scripts/environment.ts production"
       },
       dependencies: {
-        "@supacloud/app": `^${package_default2.version}`,
-        "@supacloud/elysia": `^${package_default3.version}`,
-        "@supacloud/commands": `^${package_default4.version}`,
-        "@supacloud/contracts": `^${package_default5.version}`,
-        "@supacloud/db": `^${package_default6.version}`,
-        "@supacloud/js": `^${package_default7.version}`,
-        "@supabase/supabase-js": package_default7.peerDependencies["@supabase/supabase-js"],
+        "@supacloud/app": `^${appMetadata2.version}`,
+        "@supacloud/elysia": `^${elysiaMetadata2.version}`,
+        "@supacloud/commands": `^${commandsMetadata.version}`,
+        "@supacloud/contracts": `^${contractsMetadata.version}`,
+        "@supacloud/db": `^${dbMetadata.version}`,
+        "drizzle-orm": dbMetadata.peerDependencies["drizzle-orm"],
+        "@supacloud/js": `^${sdkMetadata.version}`,
+        "@supabase/supabase-js": sdkMetadata.peerDependencies["@supabase/supabase-js"],
         elysia: "2.0.0-beta.19",
-        rxjs: package_default2.dependencies.rxjs
+        rxjs: appMetadata2.dependencies.rxjs
       },
       devDependencies: {
-        "@supacloud/compiler": `^${package_default.version}`,
+        "@supacloud/compiler": `^${compilerMetadata2.version}`,
+        "drizzle-kit": dbMetadata.devDependencies["drizzle-kit"],
         "@types/bun": "^1.4.2",
         typescript: "^7.0.2"
       }
@@ -248891,13 +248603,15 @@ function appStarterFiles(name) {
         noEmit: true,
         types: ["bun"]
       },
-      include: ["src/**/*.ts", "scripts/**/*.ts", "tests/**/*.ts", "generated/**/*.ts", "supacloud.config.ts"]
+      include: ["src/**/*.ts", "scripts/**/*.ts", "tests/**/*.ts", "generated/**/*.ts", "db/schema.ts", "db/contracts/**/*.ts", "supacloud.config.ts", "drizzle*.config.ts"]
     }),
     "bunfig.toml": `env = false
 `,
     ".gitignore": [
       "node_modules/",
       "dist/",
+      "output/database-audit/",
+      "db/migration-candidates/",
       ".env",
       ".env.*",
       "!.env.*.example",
@@ -248986,7 +248700,7 @@ test("generated query client preserves its read contract without a live database
 });
 `,
     "REACTIVE.md": STARTER_REACTIVE_GUIDE,
-    "AGENTS.md": STARTER_REACTIVE_AGENTS,
+    "AGENTS.md": STARTER_REACTIVE_AGENTS + STARTER_DATABASE_GUIDE,
     "tests/reactive.test.ts": STARTER_REACTIVE_TEST,
     "scripts/environment.ts": STARTER_ENVIRONMENT,
     "tests/environment.test.ts": STARTER_ENVIRONMENT_TEST,
@@ -249005,7 +248719,8 @@ const watcher = watchProject({
     restarts = restarts.then(async () => {
       if (server) { server.kill(); await server.exited; }
       if (closing) return;
-      server = Bun.spawn([process.execPath, "--no-env-file", "scripts/serve.ts"], {
+      const entry = process.env.SUPACLOUD_DEV_PROFILE === "integration" ? "scripts/serve-integration.ts" : "scripts/serve.ts";
+      server = Bun.spawn([process.execPath, "--no-env-file", entry], {
         stdin: "inherit", stdout: "inherit", stderr: "inherit", env: process.env,
       });
     }).catch((error) => { console.error(error); process.exitCode = 1; });
@@ -249021,6 +248736,48 @@ const close = async () => {
 process.once("SIGINT", close);
 process.once("SIGTERM", close);
 await watcher.ready;
+`,
+    "scripts/integration.ts": `if (process.env.APP_ENV !== "development") throw new Error("Integration is development-only");
+process.env.SUPACLOUD_DEV_PROFILE = "integration";
+await import("./dev");
+export {};
+`,
+    "scripts/serve-integration.ts": `import { createCompiledModules } from "../generated/application";
+import { createDeliveryApplication } from "../src/delivery-host";
+
+if (process.env.APP_ENV !== "development") throw new Error("Integration is development-only");
+const databaseUrl = process.env.SUPACLOUD_DEV_DATABASE_URL;
+try {
+  if (!databaseUrl) throw new Error();
+  const url = new URL(databaseUrl);
+  if (!["postgres:", "postgresql:"].includes(url.protocol)
+    || !["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)
+    || url.pathname.length <= 1 || url.search || url.hash) throw new Error();
+} catch {
+  throw new Error("Integration requires an explicit loopback PostgreSQL database");
+}
+if (process.env.DATABASE_SOCKET_PATH
+  || (process.env.DATABASE_URL && process.env.DATABASE_URL !== databaseUrl)) {
+  throw new Error("Conflicting integration database settings");
+}
+process.env.DATABASE_URL = databaseUrl;
+const port = Number(process.env.PORT ?? "3000");
+if (!Number.isInteger(port) || port < 0 || port > 65535) throw new Error("Invalid PORT");
+const abort = new AbortController();
+const stopStartup = () => abort.abort();
+process.once("SIGINT", stopStartup);
+process.once("SIGTERM", stopStartup);
+const application = await createDeliveryApplication(createCompiledModules(), { signal: abort.signal });
+if (abort.signal.aborted) { await application.close(); throw new Error("Integration startup cancelled"); }
+const server = Bun.serve({ hostname: "127.0.0.1", port, fetch: application.fetch });
+const close = async () => {
+  abort.abort();
+  server.stop(true);
+  await application.close();
+};
+process.once("SIGINT", close);
+process.once("SIGTERM", close);
+console.log("Local integration: " + server.url);
 `,
     "scripts/serve.ts": `import { createDemo } from "./sandbox";
 
@@ -249088,6 +248845,7 @@ import { ApplicationError, assertFeatureTransition } from "@supacloud/elysia";
 import { t } from "elysia";
 import { VerifyReviewAttachment } from "./attachment";
 import { ReviewUploads, ReviewUploadsController, type ReviewUploadPort } from "./uploads";
+import type { ReviewRow } from "../../db/schema";
 
 export const reviewSpec = defineFeatureSpec({
   name: "review",
@@ -249102,7 +248860,7 @@ export const reviewSpec = defineFeatureSpec({
   },
 });
 
-interface Review { state: string; version: number }
+type Review = Pick<ReviewRow, "state" | "version">;
 // Production implementations must bind both operations to the current transaction.
 export interface ReviewStore extends Partial<ReviewUploadPort> {
   get(table: string, key: string): unknown;
@@ -249125,7 +248883,7 @@ export const requireRequest: Aspect = (context, next) => {
 
 function readReview(value: unknown): Review {
   if (typeof value !== "object" || value === null ||
-      !("state" in value) || typeof value.state !== "string" ||
+      !("state" in value) || (value.state !== "draft" && value.state !== "approved") ||
       !("version" in value) || typeof value.version !== "number") {
     throw new ApplicationError("Review not found", { status: 404, code: "REVIEW_NOT_FOUND" });
   }
@@ -249252,6 +249010,7 @@ test("the production composition root rejects missing governance adapters", () =
 
 \`\`\`sh
 bun install
+bun run db:generate
 bun run check
 bun run dev
 \`\`\`
@@ -249273,6 +249032,28 @@ compiler-checked command/route/governance bindings, an explicit AOP function,
 HTTP schemas, permission denial, transaction rollback, idempotency and audit.
 It is not a complete Maker-Checker workflow or a production authorization policy.
 
+## Frontend SDK Boundary
+
+Use @supacloud/js as the platform SDK around your existing user-scoped
+@supabase/supabase-js client. Pass that same client to existing UI providers;
+supacloud.supabase exposes it unchanged. Keep UI routing, forms and query
+caches in your frontend framework or svadmin, not in a new DI container.
+
+For generated/client.ts, supply createAuthenticatedFetch from
+@supacloud/js/contracts as its fetch option. Resolve the current user token
+from the same Supabase session for each request; do not capture a token at
+startup or introduce a second session store. Use a fixed trusted HTTPS API
+origin. The authenticated transport rejects missing credentials and redirects
+and does not replay a write after 401. Its underlying fetch must also be
+single-attempt.
+
+Reuse the same session resolver for generated/graphql.ts when adopting queries.
+The local memory demo is not this authenticated production integration.
+Never use supacloud.commands or supacloud.workflows from a browser action:
+those RPCs require service-role credentials. Browser business commands use
+application endpoints, optionally composed through @supacloud/js/contracts.
+Management API tokens and service-role keys remain on trusted servers.
+
 ## Typed Queries
 
 This starter uses Database First as its only GraphQL server-schema model.
@@ -249541,6 +249322,8 @@ policy. Invalid transaction/idempotency modes fail compilation instead of
 silently disabling governance. onExecution receives metadata-only trace events;
 durable audit still belongs to the command governance adapter.
 
+${STARTER_DATABASE_GUIDE}
+
 ## CI
 
 After the first compilation, commit generated/. In CI run
@@ -249564,8 +249347,11 @@ async function initializeAppProject(options) {
   if ((await readdir4(root)).some((entry) => entry !== ".git")) {
     throw new Error("app init requires an empty directory (an existing .git directory is allowed)");
   }
-  const template = options.template ?? "command";
-  const files = template === "command" ? appStarterFiles(name) : appTemplateFiles(name, template);
+  const template = options.template ?? "minimal";
+  const files = template === "command" ? appStarterFiles(name) : appTemplateFiles(name, template, {
+    "@supacloud/js": `^${sdkMetadata.version}`,
+    "@supabase/supabase-js": sdkMetadata.peerDependencies["@supabase/supabase-js"]
+  });
   for (const [relativePath, content] of Object.entries(files)) {
     const path = join13(root, relativePath);
     await mkdir4(dirname10(path), { recursive: true });
@@ -249574,26 +249360,83 @@ async function initializeAppProject(options) {
   return { root, name, files: Object.keys(files) };
 }
 
+// src/shared/tools/app-database-check.ts
+import { spawnSync } from "node:child_process";
+import { existsSync as existsSync11 } from "node:fs";
+import { join as join14, resolve as resolve16 } from "node:path";
+var CHECK_ENTRY = `
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+const root = process.argv[1];
+const cli = createRequire(join(root, "package.json")).resolve("@supacloud/db/source-contracts-cli");
+process.argv = [process.execPath, cli, "check", "--root", root];
+await import(pathToFileURL(cli).href);
+`;
+function checkAppDatabaseSources(projectRoot) {
+  const root = resolve16(projectRoot);
+  if (!existsSync11(join14(root, "database.sources.json")))
+    return;
+  const name = "database-source-contracts";
+  try {
+    const result = spawnSync(process.versions.bun ? "bun" : process.execPath, [
+      ...process.versions.bun ? ["--no-env-file"] : ["--input-type=module"],
+      "--eval",
+      CHECK_ENTRY,
+      "--",
+      root
+    ], { cwd: root, encoding: "utf8", timeout: 30000, maxBuffer: 4 * 1024 * 1024 });
+    if (result.error)
+      throw result.error;
+    const report = JSON.parse(result.stdout);
+    if (!report || typeof report !== "object" || !("scope" in report) || report.scope !== "local-source-contracts" || !("ok" in report) || typeof report.ok !== "boolean" || !("findings" in report) || !Array.isArray(report.findings)) {
+      throw new Error("Invalid database source check response");
+    }
+    const messages = [];
+    for (const finding of report.findings) {
+      if (!finding || typeof finding !== "object" || !("file" in finding) || typeof finding.file !== "string" || !("message" in finding) || typeof finding.message !== "string")
+        throw new Error("Invalid source finding");
+      messages.push(`${finding.file}: ${finding.message}`);
+    }
+    return {
+      name,
+      ok: result.status === 0 && report.ok && !messages.length,
+      detail: messages.join(`
+`) || (result.status === 0 && report.ok ? "Offline database contracts and boundaries are current" : "Database source check failed")
+    };
+  } catch {
+    return { name, ok: false, detail: "Cannot run the project database checker. Install the project runtime and @supacloud/db with source-contracts support, then run `supacloud-db check --root .` for diagnostics." };
+  }
+}
+
 // src/shared/tools/app-resource.ts
 function resourceScaffold(name, className) {
   return {
     [`${name}.model.ts`]: `import { t } from "elysia";
-import type { RouteHandlerOutput } from "@supacloud/app";
+import { InjectionToken, type RouteHandlerOutput } from "@supacloud/app";
 
 // HTTP contracts are the single source of field types. Services import types only.
 export const ${className}Params = t.Object({ id: t.String({ minLength: 1, maxLength: 128, pattern: "^[A-Za-z0-9_-]+$" }) });
 export const ${className}Response = t.Object({ id: t.String() });
 export type ${className}Result = RouteHandlerOutput<{ responses: { 200: typeof ${className}Response } }>;
+
+// Bind a request-scoped adapter using the verified user and RLS. It must reject
+// denied/not-found reads; never bind a browser-supplied identity or service-role fallback.
+export interface ${className}ReadPort {
+    readAuthorized(id: string): Promise<${className}Result>;
+}
+export const ${className}Reader = new InjectionToken<${className}ReadPort>("${name}.reader", { scope: "request" });
 `,
-    [`${name}.service.ts`]: `import { Injectable } from "@supacloud/app";
-import type { ${className}Result } from "./${name}.model";
+    [`${name}.service.ts`]: `import { Inject, Injectable, Optional } from "@supacloud/app";
+import { ${className}Reader, type ${className}ReadPort, type ${className}Result } from "./${name}.model";
 
-@Injectable()
+@Injectable({ scope: "request" })
 export class ${className}Service {
-    async find(_id: string): Promise<${className}Result> {
-        // Supply your project's authorized read port before exposing this route.
-        // Writes must use a governed Command; this scaffold never fakes persistence.
-        throw new Error("Implement ${className}Service.find before exposing this resource");
+    constructor(@Inject(${className}Reader) @Optional() readonly reader?: ${className}ReadPort) {}
+
+    async find(id: string): Promise<${className}Result> {
+        if (!this.reader) throw new Error("Bind ${className}Reader before exposing this resource");
+        return this.reader.readAuthorized(id);
     }
 }
 `,
@@ -249603,7 +249446,7 @@ import { ${className}Service } from "./${name}.service";
 
 @Controller("/${name}")
 export class ${className}Controller {
-    constructor(@Inject(${className}Service) readonly service: ${className}Service) {}
+    constructor(@Inject(${className}Service) readonly service: Pick<${className}Service, "find">) {}
 
     @Get("/:id", { params: ${className}Params, responses: { 200: ${className}Response } })
     find(@Param("id") id: string): Promise<${className}Result> {
@@ -249628,7 +249471,18 @@ import { ${className}Service } from "./${name}.service";
 
 test("${name} does not claim a read adapter has been implemented", async () => {
     await expect(new ${className}Service().find("example"))
-        .rejects.toThrow("Implement ${className}Service.find");
+        .rejects.toThrow("Bind ${className}Reader");
+});
+
+test("${name} returns only the supplied authorized read result", async () => {
+    const service = new ${className}Service({ readAuthorized: async id => ({ id }) });
+    expect(await service.find("example")).toEqual({ id: "example" });
+});
+
+test("${name} preserves permission denial without a privileged fallback", async () => {
+    const denied = new Error("denied");
+    const service = new ${className}Service({ readAuthorized: async () => { throw denied; } });
+    await expect(service.find("example")).rejects.toBe(denied);
 });
 `,
     [`${name}.controller.test.ts`]: `import { expect, test } from "bun:test";
@@ -249649,10 +249503,220 @@ test("${name} controller preserves an asynchronous read failure", async () => {
   };
 }
 
+// src/shared/tools/app-local-dev.ts
+import { execFile as execFile2, spawn as spawn3 } from "node:child_process";
+import { readFile as readFile4 } from "node:fs/promises";
+import { join as join15, resolve as resolve17 } from "node:path";
+function localDatabaseUrl(value) {
+  try {
+    if (!value || /[\x00-\x20\x7f]/.test(value))
+      throw new Error;
+    const url = new URL(value);
+    if (!["postgres:", "postgresql:"].includes(url.protocol) || !["127.0.0.1", "localhost", "[::1]"].includes(url.hostname) || url.pathname.length <= 1 || url.search || url.hash)
+      throw new Error;
+    return value;
+  } catch {
+    throw new Error("Integration requires an explicit loopback PostgreSQL URL with a database name and no query or fragment");
+  }
+}
+async function probeDatabase(url, signal) {
+  const source = `const database = new Bun.SQL(process.env.SUPACLOUD_DEV_DATABASE_URL, {
+    max: 1, connectionTimeout: 5,
+  });
+  try {
+    const rows = await database\`SELECT current_database() AS name,
+      r.rolsuper AS superuser, r.rolbypassrls AS bypass_rls
+      FROM pg_roles r WHERE r.rolname = current_user\`;
+    console.log(JSON.stringify(rows));
+  } finally {
+    await database.close({ timeout: 1 });
+  }`;
+  try {
+    const stdout = await new Promise((resolveOutput, reject) => {
+      execFile2(process.versions.bun ? process.execPath : "bun", ["--no-env-file", "-e", source], {
+        env: { ...process.env, SUPACLOUD_DEV_DATABASE_URL: url },
+        timeout: 12000,
+        killSignal: "SIGKILL",
+        maxBuffer: 4096,
+        encoding: "utf8",
+        signal
+      }, (error, output) => error ? reject(error) : resolveOutput(output));
+    });
+    const rows = JSON.parse(stdout);
+    const expected = decodeURIComponent(new URL(url).pathname.slice(1));
+    if (!Array.isArray(rows) || rows.length !== 1)
+      throw new Error;
+    const row = rows[0];
+    if (!row || typeof row !== "object" || !("name" in row) || row.name !== expected || !("superuser" in row) || row.superuser !== false || !("bypass_rls" in row) || row.bypass_rls !== false)
+      throw new Error;
+  } catch {
+    throw new Error("Integration database verification failed; check connectivity, database identity and non-privileged application role");
+  }
+}
+async function runLocalDevelopment(options) {
+  const root = resolve17(options.root);
+  const profile = options.profile ?? "fast";
+  if (profile !== "fast" && profile !== "integration")
+    throw new Error("Unknown development profile");
+  if (["production", "staging"].includes(process.env.APP_ENV ?? "") || process.env.SUPACLOUD_ENV === "production") {
+    throw new Error("Local development refuses production or staging environment selectors");
+  }
+  const remoteKeys = ["SUPACLOUD_API_URL", "SUPACLOUD_API_TOKEN", "SUPACLOUD_PROJECT_REF"];
+  if (remoteKeys.some((key) => process.env[key] !== undefined) && (process.env.SUPACLOUD_ENV !== "test" || remoteKeys.some((key) => !process.env[key]?.trim()))) {
+    throw new Error("Inherited remote context must be complete and explicitly tagged with SUPACLOUD_ENV=test");
+  }
+  const script = profile === "integration" ? "dev:integration" : "dev";
+  const manifest = JSON.parse(await readFile4(join15(root, "package.json"), "utf8"));
+  const scripts = manifest && typeof manifest === "object" && "scripts" in manifest ? manifest.scripts : undefined;
+  const command = scripts && typeof scripts === "object" ? Reflect.get(scripts, script) : undefined;
+  if (typeof command !== "string" || !command.trim()) {
+    throw new Error(`Project must declare ${script}; use app watch for compile-only inspection`);
+  }
+  let databaseUrl;
+  if (profile === "integration") {
+    databaseUrl = localDatabaseUrl(options.databaseUrl ?? process.env.SUPACLOUD_DEV_DATABASE_URL);
+  } else if (options.databaseUrl !== undefined) {
+    throw new Error("A database URL requires the integration profile");
+  }
+  if (options.signal?.aborted)
+    return { profile, script, exitCode: 0, state: "stopped" };
+  if (databaseUrl)
+    await probeDatabase(databaseUrl, options.signal);
+  if (options.signal?.aborted)
+    return { profile, script, exitCode: 0, state: "stopped" };
+  const env = {
+    ...process.env,
+    APP_ENV: "development",
+    SUPACLOUD_ENV: "test",
+    SUPACLOUD_DEV_PROFILE: profile
+  };
+  delete env.SUPACLOUD_DEV_DATABASE_URL;
+  if (databaseUrl)
+    env.SUPACLOUD_DEV_DATABASE_URL = databaseUrl;
+  const executable = process.versions.bun ? process.execPath : "bun";
+  const child = spawn3(executable, ["--no-env-file", "run", script], {
+    cwd: root,
+    env,
+    detached: process.platform !== "win32",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  let timer;
+  let outputError;
+  let stopping = false;
+  const kill = (signal) => {
+    try {
+      if (process.platform !== "win32" && child.pid)
+        process.kill(-child.pid, signal);
+      else
+        child.kill(signal);
+    } catch (error) {
+      if (!(error instanceof Error) || !("code" in error) || error.code !== "ESRCH")
+        throw error;
+    }
+  };
+  const stop = () => {
+    if (stopping)
+      return;
+    stopping = true;
+    kill("SIGTERM");
+    timer = setTimeout(() => kill("SIGKILL"), 1500);
+  };
+  const output = (chunk) => {
+    try {
+      options.onOutput?.(chunk.toString("utf8"));
+    } catch (error) {
+      outputError = { error };
+      stop();
+    }
+  };
+  child.stdout.on("data", output);
+  child.stderr.on("data", output);
+  options.signal?.addEventListener("abort", stop, { once: true });
+  process.once("SIGINT", stop);
+  process.once("SIGTERM", stop);
+  if (options.signal?.aborted)
+    stop();
+  try {
+    const exitCode = await new Promise((resolveExit, reject) => {
+      child.once("error", reject);
+      child.once("close", (code) => resolveExit(stopping ? 0 : code ?? 1));
+    });
+    if (outputError)
+      throw outputError.error;
+    return { profile, script, exitCode, state: "stopped" };
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+    options.signal?.removeEventListener("abort", stop);
+    process.removeListener("SIGINT", stop);
+    process.removeListener("SIGTERM", stop);
+  }
+}
+
+// src/shared/tools/app-verification-plan.ts
+import { readdir as readdir5, realpath as realpath5 } from "node:fs/promises";
+import { dirname as dirname11, isAbsolute as isAbsolute6, relative as relative11, resolve as resolve18 } from "node:path";
+function inside3(root, file) {
+  const path = relative11(root, file).replaceAll("\\", "/");
+  return path !== ".." && !path.startsWith("../") && !isAbsolute6(path);
+}
+async function createVerificationPlan(root, graph, target, sourceRoot = root) {
+  const owners = graph.modules.filter((module) => module.name === target || module.className === target || [...module.providers, ...module.controllers, ...module.commands, ...module.jobs ?? [], ...module.queries ?? []].some((item) => ("className" in item) && item.className === target || ("name" in item) && item.name === target || ("token" in item) && item.token === target || ("useClass" in item) && item.useClass === target));
+  if (owners.length !== 1)
+    throw new Error("Select one unambiguous module or owned symbol for verification");
+  const owner = owners[0];
+  const project = await realpath5(root);
+  const requestedRoot = resolve18(root);
+  const sources = [
+    owner.file,
+    ...owner.providers.map((item) => item.file),
+    ...owner.controllers.map((item) => item.file)
+  ].filter((file) => typeof file === "string");
+  const directories = [...new Set(sources.map((file) => dirname11(resolve18(sourceRoot, file))))].sort();
+  const tests = new Set;
+  const manual = [];
+  for (const directory of directories) {
+    if (!inside3(requestedRoot, directory)) {
+      manual.push("A source directory is outside the project; select its owning project explicitly");
+      continue;
+    }
+    const actual = await realpath5(directory);
+    if (!inside3(project, actual)) {
+      manual.push("A source directory is outside the project; select its owning project explicitly");
+      continue;
+    }
+    for (const entry of await readdir5(actual, { withFileTypes: true })) {
+      if (entry.isFile() && /\.(test|spec)\.[cm]?[jt]sx?$/.test(entry.name)) {
+        tests.add(relative11(project, resolve18(actual, entry.name)).replaceAll("\\", "/"));
+      }
+    }
+  }
+  const selected = [...tests].sort();
+  if (!selected.length)
+    manual.push("No colocated tests found; declare a focused test before changing this module");
+  if (selected.length > 32)
+    manual.push("More than 32 local tests; narrow module ownership before execution");
+  return {
+    version: 1,
+    source: "declaration",
+    target: owner.name,
+    ready: manual.length === 0,
+    files: [...new Set(sources.map((file) => relative11(requestedRoot, resolve18(sourceRoot, file)).replaceAll("\\", "/")))].sort(),
+    tests: selected.slice(0, 32),
+    commands: selected.length <= 32 ? [
+      ...selected.map((file) => ["bun", "test", `./${file}`]),
+      ["git", "diff", "--check"]
+    ] : [],
+    manual,
+    releaseOnly: ["generated artifact drift", "consumer types", "database/RLS and authenticated integration", "delivery read-back"],
+    executed: false
+  };
+}
+
 // src/shared/tools/app-scaffold-writes.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { link, lstat as lstat4, mkdir as mkdir5, open as open4, readFile as readFile4, realpath as realpath5, rename as rename5, rmdir, unlink as unlink3 } from "node:fs/promises";
-import { dirname as dirname11, isAbsolute as isAbsolute6, join as join14, relative as relative11, resolve as resolve16, sep as sep11, win32 } from "node:path";
+import { link, lstat as lstat4, mkdir as mkdir5, open as open4, readFile as readFile8, realpath as realpath6, rename as rename5, rmdir, unlink as unlink3 } from "node:fs/promises";
+import { dirname as dirname12, isAbsolute as isAbsolute7, join as join16, relative as relative12, resolve as resolve20, sep as sep11, win32 } from "node:path";
 
 class ScaffoldError extends Error {
   code;
@@ -249666,26 +249730,26 @@ function fsCode(error) {
   return error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : undefined;
 }
 function scaffoldPath(root, path) {
-  if (!path || path.includes("\x00") || path.includes("\\") || isAbsolute6(path) || win32.isAbsolute(path)) {
+  if (!path || path.includes("\x00") || path.includes("\\") || isAbsolute7(path) || win32.isAbsolute(path)) {
     throw new ScaffoldError("SCAFFOLD_PATH_INVALID", "Scaffold paths must be relative to the project root");
   }
   const parts = path.split("/");
   if (parts.some((part) => /[<>:"|?*\u0000-\u001f]/.test(part) || /[ .]$/.test(part) && part !== "." && part !== ".." || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part) || part.toLowerCase() === ".git" || part.toLowerCase() === ".supacloud-generate.lock")) {
     throw new ScaffoldError("SCAFFOLD_PATH_INVALID", "Scaffold path is reserved or not portable");
   }
-  const target = resolve16(root, path);
-  const local = relative11(root, target);
-  if (!local || local === ".." || local.startsWith(`..${sep11}`) || isAbsolute6(local)) {
+  const target = resolve20(root, path);
+  const local = relative12(root, target);
+  if (!local || local === ".." || local.startsWith(`..${sep11}`) || isAbsolute7(local)) {
     throw new ScaffoldError("SCAFFOLD_PATH_INVALID", "Scaffold path is outside the project root");
   }
   return target;
 }
 async function snapshot(root, path) {
   const target = scaffoldPath(root, path);
-  const parts = relative11(root, target).split(sep11);
+  const parts = relative12(root, target).split(sep11);
   let current = root;
   for (const [index, part] of parts.entries()) {
-    current = join14(current, part);
+    current = join16(current, part);
     let stat;
     try {
       stat = await lstat4(current);
@@ -249703,7 +249767,7 @@ async function snapshot(root, path) {
       if (!stat.isFile() || stat.nlink !== 1) {
         throw new ScaffoldError("SCAFFOLD_PATH_INVALID", `Scaffold target must be a regular, unlinked file: ${current}`);
       }
-      return { content: await readFile4(current, "utf8"), mode: stat.mode, dev: stat.dev, ino: stat.ino };
+      return { content: await readFile8(current, "utf8"), mode: stat.mode, dev: stat.dev, ino: stat.ino };
     }
   }
   return null;
@@ -249712,7 +249776,7 @@ function sameFile(a, b) {
   return a === null ? b === null : b !== null && a.content === b.content && a.dev === b.dev && a.ino === b.ino && a.mode === b.mode;
 }
 async function planScaffoldWrites(root, writes) {
-  const canonical = await realpath5(resolve16(root));
+  const canonical = await realpath6(resolve20(root));
   const targets = new Set;
   const planned = [];
   for (const write of writes) {
@@ -249735,7 +249799,7 @@ async function planScaffoldWrites(root, writes) {
   return Object.freeze({ root: canonical, writes: Object.freeze(planned) });
 }
 async function applyScaffoldWrites(plan) {
-  const lockPath = join14(plan.root, ".supacloud-generate.lock");
+  const lockPath = join16(plan.root, ".supacloud-generate.lock");
   const lock = await open4(lockPath, "wx").catch((error) => {
     if (fsCode(error) === "EEXIST")
       throw new ScaffoldError("SCAFFOLD_BUSY", "Another generator owns .supacloud-generate.lock; no files written");
@@ -249745,7 +249809,7 @@ async function applyScaffoldWrites(plan) {
   const applied = [];
   const temporary = [];
   try {
-    if (await realpath5(plan.root) !== plan.root)
+    if (await realpath6(plan.root) !== plan.root)
       throw new ScaffoldError("SCAFFOLD_CHANGED", "Project root changed");
     for (const write of plan.writes) {
       if (!sameFile(write.before, await snapshot(plan.root, write.path))) {
@@ -249755,8 +249819,8 @@ async function applyScaffoldWrites(plan) {
     for (const write of plan.writes) {
       const target = scaffoldPath(plan.root, write.path);
       let current = plan.root;
-      for (const part of relative11(plan.root, dirname11(target)).split(sep11).filter(Boolean)) {
-        current = join14(current, part);
+      for (const part of relative12(plan.root, dirname12(target)).split(sep11).filter(Boolean)) {
+        current = join16(current, part);
         try {
           await mkdir5(current);
           directories.push(current);
@@ -249859,12 +249923,13 @@ var REMOTE_APP_SCHEMA = Object.fromEntries(Object.entries(APPLICATION_TOOL_SCHEM
 async function initProject(args) {
   if (args.force)
     throw new Error("app init never overwrites files; choose an empty directory");
-  const template = args.template ?? "command";
+  const template = args.template ?? "minimal";
   const { root, name, files } = await initializeAppProject({ root: args.root, name: args.name, template });
   return textResult([
     `Initialized ${name} in ${root} (${files.length} files, template: ${template}).`,
     `cd '${root.replaceAll("'", "'\\''")}'`,
     "bun install",
+    ...template === "command" ? ["bun run db:generate"] : [],
     "bun run check",
     "bun run dev",
     "Local demo only. Production requires persistent governance and identity adapters; see README.md."
@@ -249971,7 +250036,7 @@ async function generateScaffold(args) {
       throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", `--${flag.replaceAll("_", "-")} must be boolean`);
     }
   }
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve21(args.root || process.cwd());
   const dir = args.dir ?? "src/features";
   if (dir !== ".")
     scaffoldPath(root, dir);
@@ -249987,20 +250052,20 @@ async function generateScaffold(args) {
   let contractName;
   if (kind === "module" || kind === "resource") {
     const name = requireIdentifier(args.name, "name");
-    modulePath = join15(dir, name, `${name}.module.ts`).replaceAll("\\", "/");
+    modulePath = join17(dir, name, `${name}.module.ts`).replaceAll("\\", "/");
     moduleSymbol = `${pascalName2(name)}Module`;
     if (kind === "module")
       writes.push({ path: modulePath, content: moduleScaffold(name), overwrite: args.force === true });
     else
       for (const [file, content] of Object.entries(resourceScaffold(name, pascalName2(name)))) {
-        writes.push({ path: join15(dir, name, file).replaceAll("\\", "/"), content });
+        writes.push({ path: join17(dir, name, file).replaceAll("\\", "/"), content });
       }
   } else {
     const moduleName = requireIdentifier(args.module, "module");
     const name = kind === "controller" ? moduleName : requireIdentifier(args.name, "name");
     const subdir = kind === "command" ? "commands" : kind === "query" ? "queries" : kind === "job" ? "jobs" : kind === "contract" ? "contracts" : "";
-    const path = join15(dir, moduleName, subdir, `${name}.${kind}.ts`).replaceAll("\\", "/");
-    if (kind === "controller" && existsSync11(scaffoldPath(root, path))) {
+    const path = join17(dir, moduleName, subdir, `${name}.${kind}.ts`).replaceAll("\\", "/");
+    if (kind === "controller" && existsSync12(scaffoldPath(root, path))) {
       throw new ScaffoldError("SCAFFOLD_EXISTS", `Controller already exists: ${path}（请手工合并路由到现有 controller）`);
     }
     const content = kind === "command" ? commandScaffold(moduleName, name) : kind === "query" ? queryScaffold(moduleName, name) : kind === "job" ? jobScaffold(moduleName, name) : kind === "contract" ? contractScaffold(moduleName, name) : controllerScaffold(moduleName);
@@ -250018,7 +250083,7 @@ async function generateScaffold(args) {
     if (new RegExp(`\\b${moduleSymbol}\\b`).test(original)) {
       throw new ScaffoldError("SCAFFOLD_REGISTRATION_CONFLICT", `Registration target already references ${moduleSymbol}; review the import manually`);
     }
-    let importPath = relative12(dirname12(target), resolve17(root, modulePath)).replaceAll("\\", "/").replace(/\.ts$/, "");
+    let importPath = relative13(dirname13(target), resolve21(root, modulePath)).replaceAll("\\", "/").replace(/\.ts$/, "");
     if (!importPath.startsWith("."))
       importPath = `./${importPath}`;
     const edit = await applyDiagnosticFix({
@@ -250028,7 +250093,7 @@ async function generateScaffold(args) {
       importPath,
       symbol: moduleSymbol
     }, { rootDir: root, dryRun: true });
-    if (await readFile8(target, "utf8") !== original)
+    if (await readFile9(target, "utf8") !== original)
       throw new ScaffoldError("SCAFFOLD_CHANGED", "Registration source changed during planning");
     writes.push({ path: args.register_in, content: edit.content, expected: original });
   }
@@ -250049,7 +250114,7 @@ async function generateScaffold(args) {
       written: !args.dry_run,
       changes
     }, null, 2));
-  const lines = changes.map((change) => `${args.dry_run ? "PREVIEW" : "✅"} ${change.action}: ${join15(plan.root, change.path)}`);
+  const lines = changes.map((change) => `${args.dry_run ? "PREVIEW" : "✅"} ${change.action}: ${join17(plan.root, change.path)}`);
   if (args.dry_run)
     lines.push("No files written. Omit --dry-run to apply this generation.");
   if (kind === "resource")
@@ -250085,32 +250150,33 @@ function parseInclude(include) {
   return patterns && patterns.length > 0 ? patterns : undefined;
 }
 function sourceRoot(args, root, configured) {
-  const hasConfig = ["ts", "mts", "js", "mjs"].some((extension) => existsSync11(join15(root, `supacloud.config.${extension}`)));
+  const hasConfig = ["ts", "mts", "js", "mjs"].some((extension) => existsSync12(join17(root, `supacloud.config.${extension}`)));
   return args.root && !hasConfig ? "." : configured;
 }
 async function projectCompileConfig(args) {
-  const root = resolve17(args.root || process.cwd());
-  const configFile = ["ts", "mts", "js", "mjs"].map((extension) => join15(root, `supacloud.config.${extension}`)).find((candidate) => existsSync11(candidate)) ?? null;
+  const root = resolve21(args.root || process.cwd());
+  const configFile = ["ts", "mts", "js", "mjs"].map((extension) => join17(root, `supacloud.config.${extension}`)).find((candidate) => existsSync12(candidate)) ?? null;
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
   const configuredRoot = sourceRoot(args, root, loadedConfig.root);
   const include = parseInclude(args.include) ?? loadedConfig.include;
-  const outDir = args.out_dir ? resolve17(root, args.out_dir) : defaults.outDir;
-  const result = await checkProject(compileOptionsFromConfig({
+  const outDir = args.out_dir ? resolve21(root, args.out_dir) : defaults.outDir;
+  const compileOptions = compileOptionsFromConfig({
     ...loadedConfig,
     ...configuredRoot === undefined ? {} : { root: configuredRoot },
     outDir,
     ...include === undefined ? {} : { include },
     strict: args.strict ?? loadedConfig.strict ?? false
-  }, root));
-  return { root, configFile, outDir, result };
+  }, root);
+  const result = await checkProject(compileOptions);
+  return { root, sourceDir: compileOptions.rootDir, configFile, outDir, result };
 }
 async function readAllowedDependencies(root) {
-  const path = join15(root, "package.json");
-  if (!existsSync11(path))
+  const path = join17(root, "package.json");
+  if (!existsSync12(path))
     return { dependencies: [], devDependencies: [] };
   try {
-    const parsed = JSON.parse(await readFile8(path, "utf8"));
+    const parsed = JSON.parse(await readFile9(path, "utf8"));
     return {
       dependencies: Object.keys(parsed.dependencies ?? {}).sort(),
       devDependencies: Object.keys(parsed.devDependencies ?? {}).sort()
@@ -250187,14 +250253,14 @@ async function findUnwiredContracts(rootDir) {
   async function walk(directory) {
     let entries;
     try {
-      entries = await readdir5(directory, { withFileTypes: true });
+      entries = await readdir6(directory, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (skip.has(entry.name))
         continue;
-      const path = join15(directory, entry.name);
+      const path = join17(directory, entry.name);
       if (entry.isDirectory())
         await walk(path);
       else if (entry.isFile() && entry.name.endsWith(".ts"))
@@ -250205,23 +250271,29 @@ async function findUnwiredContracts(rootDir) {
   const contracts = files.filter((file) => file.endsWith(".contract.ts"));
   if (contracts.length === 0)
     return [];
-  const otherSources = await Promise.all(files.filter((file) => !contracts.includes(file)).map(async (file) => await readFile8(file, "utf8").catch(() => "")));
+  const otherSources = await Promise.all(files.filter((file) => !contracts.includes(file)).map(async (file) => await readFile9(file, "utf8").catch(() => "")));
   const unwired = [];
   for (const contract of contracts) {
-    const source = await readFile8(contract, "utf8").catch(() => "");
+    const source = await readFile9(contract, "utf8").catch(() => "");
     const symbols = [...source.matchAll(/export\s+const\s+([A-Za-z_$][A-Za-z0-9_$]*)/g)].map((match) => match[1]);
     if (symbols.length === 0)
       continue;
     const moduleName = basename8(contract).replace(/\.ts$/, "");
     const wired = otherSources.some((text) => text.includes(moduleName) || symbols.some((symbol) => new RegExp(`\\b${symbol}\\b`).test(text)));
     if (!wired)
-      unwired.push({ file: relative12(rootDir, contract), symbols });
+      unwired.push({ file: relative13(rootDir, contract), symbols });
   }
   return unwired;
 }
 async function runDoctor(args) {
   const { root, outDir, result } = await projectCompileConfig(args);
   const doctor = doctorProject(root, outDir, result.graph, result.upToDate, result.diagnostics);
+  const database = checkAppDatabaseSources(root);
+  if (database) {
+    doctor.checks.push(database);
+    if (!database.ok)
+      doctor.errors += 1;
+  }
   const fixPlan = doctorFixPlan(doctor);
   const autoFixable = fixPlan.filter((repair) => repair.readiness === "preview").length;
   const inputRequired = fixPlan.filter((repair) => repair.readiness === "input-required").length;
@@ -250252,11 +250324,11 @@ async function runDoctor(args) {
 `), doctor.errors > 0);
 }
 async function runFix(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve21(args.root || process.cwd());
   const fixPath = args.fix?.trim();
   if (!fixPath)
     throw new Error("app fix requires --fix <path-to-diagnostic-fix.json>");
-  const parsed = JSON.parse(await readFile8(resolve17(root, fixPath), "utf8"));
+  const parsed = JSON.parse(await readFile9(resolve21(root, fixPath), "utf8"));
   const write = args.write === true;
   const applied = await applyDiagnosticFix(parsed, { rootDir: root, dryRun: !write });
   return textResult(JSON.stringify({
@@ -250299,7 +250371,7 @@ function devDatabase(profile, explicit) {
 }
 function readManifestModules(outDir) {
   try {
-    const parsed = JSON.parse(readFileSync9(join15(outDir, "app.manifest.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync9(join17(outDir, "app.manifest.json"), "utf8"));
     return Array.isArray(parsed.modules) ? parsed.modules.map((module) => module.name) : [];
   } catch {
     return [];
@@ -250327,17 +250399,27 @@ function shutdownWaiter(signal) {
   return { done, stop, dispose };
 }
 async function runAppDev(args, options) {
+  if (args.action === "dev" && args.once !== true && args.watch !== false) {
+    const result = await runLocalDevelopment({
+      root: args.root || process.cwd(),
+      profile: args.profile,
+      databaseUrl: args.database_url,
+      signal: options.signal,
+      onOutput: (text) => options.onDevProgress?.(textResult(args.format === "json" ? JSON.stringify({ version: 1, source: "application", output: text }) : text))
+    });
+    return textResult(JSON.stringify({ version: 1, ok: result.exitCode === 0, ...result }), result.exitCode !== 0);
+  }
   const profile = args.profile ?? "fast";
   if (profile !== "fast" && profile !== "integration") {
     throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "app dev --profile must be fast or integration");
   }
   const database = devDatabase(profile, args.database_url);
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve21(args.root || process.cwd());
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
   const configuredRoot = sourceRoot(args, root, loadedConfig.root);
   const include = parseInclude(args.include) ?? loadedConfig.include;
-  const outDir = args.out_dir ? resolve17(root, args.out_dir) : defaults.outDir;
+  const outDir = args.out_dir ? resolve21(root, args.out_dir) : defaults.outDir;
   const watch = args.once !== true && args.watch !== false;
   const compileOptions = compileOptionsFromConfig({
     ...loadedConfig,
@@ -250369,7 +250451,7 @@ async function runAppDev(args, options) {
       }, null, progress ? undefined : 2), hasError);
     }
     return textResult([
-      `app dev (profile: ${profile}, watch: ${watch ? "on" : "off"}, state: ${state})`,
+      `app watch (compile-only, profile: ${profile}, watch: ${watch ? "on" : "off"}, state: ${state})`,
       `  root:     ${root}`,
       `  outDir:   ${outDir}`,
       `  database: ${profile === "fast" ? "local profile (no database provisioned or connected)" : `explicit ${database.url} (credentials omitted; not connected)`}`,
@@ -250423,7 +250505,7 @@ async function runAppDev(args, options) {
   return report(lastEvent, "stopped");
 }
 async function runCompile(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve21(args.root || process.cwd());
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
   const configuredRoot = sourceRoot(args, root, loadedConfig.root);
@@ -250432,7 +250514,7 @@ async function runCompile(args) {
     ...compileOptionsFromConfig({
       ...loadedConfig,
       ...configuredRoot === undefined ? {} : { root: configuredRoot },
-      outDir: args.out_dir ? resolve17(root, args.out_dir) : defaults.outDir,
+      outDir: args.out_dir ? resolve21(root, args.out_dir) : defaults.outDir,
       ...include === undefined ? {} : { include },
       strict: args.strict ?? loadedConfig.strict ?? false
     }, root),
@@ -250456,7 +250538,8 @@ async function runCompile(args) {
   return textResult(text, hasError);
 }
 async function runCheck(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve21(args.root || process.cwd());
+  const database = checkAppDatabaseSources(root);
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
   const configuredRoot = sourceRoot(args, root, loadedConfig.root);
@@ -250464,12 +250547,12 @@ async function runCheck(args) {
   const config = compileOptionsFromConfig({
     ...loadedConfig,
     ...configuredRoot === undefined ? {} : { root: configuredRoot },
-    outDir: args.out_dir ? resolve17(root, args.out_dir) : defaults.outDir,
+    outDir: args.out_dir ? resolve21(root, args.out_dir) : defaults.outDir,
     ...include === undefined ? {} : { include },
     strict: args.strict ?? loadedConfig.strict ?? false
   }, root);
   const result = await checkProject(config);
-  const hasError = result.diagnostics.some((diagnostic) => diagnostic.severity === "error") || result.mismatches.length > 0;
+  const hasError = result.diagnostics.some((diagnostic) => diagnostic.severity === "error") || result.mismatches.length > 0 || database?.ok === false;
   if (args.format === "json")
     return textResult(JSON.stringify({
       version: 1,
@@ -250479,12 +250562,14 @@ async function runCheck(args) {
       mismatches: result.mismatches,
       upToDate: result.upToDate,
       written: [],
-      modules: result.graph.modules.map((module) => module.name)
+      modules: result.graph.modules.map((module) => module.name),
+      ...database ? { database } : {}
     }, null, 2), hasError);
   const summary = `checked ${result.graph.modules.length} module(s), no files written`;
   return textResult([
     formatDiagnostics(result.diagnostics),
     ...result.mismatches.map((path) => `generated artifact mismatch: ${path}`),
+    ...database ? [`${database.ok ? "OK" : "FAIL"} ${database.name}: ${database.detail}`] : [],
     "",
     summary
   ].join(`
@@ -250492,12 +250577,12 @@ async function runCheck(args) {
 }
 async function readManifest(root, args) {
   const config = await loadSupacloudConfig(root);
-  const outDir = args.out_dir ? resolve17(root, args.out_dir) : resolveSupacloudConfig(config, root).outDir;
-  const manifestPath = join15(outDir, "app.manifest.json");
-  if (!existsSync11(manifestPath)) {
+  const outDir = args.out_dir ? resolve21(root, args.out_dir) : resolveSupacloudConfig(config, root).outDir;
+  const manifestPath = join17(outDir, "app.manifest.json");
+  if (!existsSync12(manifestPath)) {
     throw new Error(`Manifest not found: ${manifestPath}（先运行 app compile 生成）`);
   }
-  const parsed = JSON.parse(await readFile8(manifestPath, "utf8"));
+  const parsed = JSON.parse(await readFile9(manifestPath, "utf8"));
   if (!Array.isArray(parsed.modules)) {
     throw new Error(`Invalid manifest: ${manifestPath}`);
   }
@@ -250537,7 +250622,7 @@ function formatGraphText(manifest) {
 `);
 }
 async function runGraph(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve21(args.root || process.cwd());
   const manifest = await readManifest(root, args);
   if (args.format === "json")
     return textResult(JSON.stringify(manifest, null, 2));
@@ -250605,7 +250690,7 @@ async function runExplain(args) {
   const target = args.target?.trim();
   if (!target)
     throw new Error("app explain requires --target（provider 类名 / token 名 / command 名 / job 名）");
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve21(args.root || process.cwd());
   const manifest = await readManifest(root, args);
   for (const module of manifest.modules) {
     const job = module.jobs?.find((entry) => entry.name === target || entry.className === target);
@@ -250680,16 +250765,16 @@ async function runExplain(args) {
   return textResult(`未找到对象: ${target}`, true);
 }
 async function runExportTools(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve21(args.root || process.cwd());
   const manifest = await readManifest(root, { ...args, out_dir: undefined });
   const definitions = buildToolDefinitions(manifest);
-  const outDir = resolve17(args.out_dir || join15(root, "generated"));
+  const outDir = resolve21(args.out_dir || join17(root, "generated"));
   if (args.format === "json") {
     return textResult(JSON.stringify(definitions, null, 2));
   }
   await mkdir6(outDir, { recursive: true });
-  const openaiPath = join15(outDir, "tool-definitions.openai.json");
-  const mcpPath = join15(outDir, "tool-definitions.mcp.json");
+  const openaiPath = join17(outDir, "tool-definitions.openai.json");
+  const mcpPath = join17(outDir, "tool-definitions.mcp.json");
   await writeFile5(openaiPath, JSON.stringify(definitions.openai, null, 2), "utf8");
   await writeFile5(mcpPath, JSON.stringify(definitions.mcp, null, 2), "utf8");
   const summary = [
@@ -250704,11 +250789,17 @@ async function runExportTools(args) {
   return textResult(summary);
 }
 async function runDelivery(args) {
-  const root = resolve17(args.root || process.cwd());
+  const root = resolve21(args.root || process.cwd());
+  if (args.action === "build") {
+    const database = checkAppDatabaseSources(root);
+    if (database && !database.ok) {
+      return textResult(JSON.stringify({ ok: false, database, written: [] }, null, 2), true);
+    }
+  }
   const loaded = await loadSupacloudConfig(root);
   const options = compileOptionsFromConfig({
     ...loaded,
-    ...args.out_dir === undefined ? {} : { outDir: resolve17(root, args.out_dir) },
+    ...args.out_dir === undefined ? {} : { outDir: resolve21(root, args.out_dir) },
     ...args.include === undefined ? {} : { include: parseInclude(args.include) },
     ...args.strict === undefined ? {} : { strict: args.strict }
   }, root);
@@ -250732,7 +250823,7 @@ async function runAppTool(request, options = {}) {
   if ((request.dry_run !== undefined || request.register_in !== undefined) && request.action !== "generate") {
     throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "--dry-run and --register-in apply only to app generate");
   }
-  if (request.database_url !== undefined && request.action !== "dev") {
+  if (request.database_url !== undefined && request.action !== "dev" && request.action !== "watch") {
     throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "--database-url applies only to app dev --profile integration");
   }
   if (Object.hasOwn(REMOTE_APP_ACTIONS, request.action)) {
@@ -250748,7 +250839,16 @@ async function runAppTool(request, options = {}) {
     return delegate(args);
   }
   switch (request.action) {
+    case "verify-plan": {
+      if (!request.target?.trim())
+        throw new Error("verify-plan requires --target; it never defaults to a full test suite");
+      const { root, sourceDir, result } = await projectCompileConfig(request);
+      const plan = await createVerificationPlan(root, result.graph, request.target.trim(), sourceDir);
+      const ready = plan.ready && !result.diagnostics.some((item) => item.severity === "error");
+      return textResult(JSON.stringify({ ...plan, ready, diagnostics: result.diagnostics }, null, 2), !ready);
+    }
     case "dev":
+    case "watch":
       return runAppDev(request, options);
     case "plan":
     case "build":
@@ -250796,6 +250896,8 @@ function registerAppTools(server2, options = {}) {
       "init",
       "generate",
       "dev",
+      "watch",
+      "verify-plan",
       "compile",
       "check",
       "graph",
@@ -250815,7 +250917,7 @@ function registerAppTools(server2, options = {}) {
       "retire"
     ]), "App action; upload/configure only prepare, rollback activates an explicit old release without schema downgrade"),
     kind: optional(stringEnum(["module", "command", "query", "controller", "job", "contract", "resource"]), "[generate] Scaffold kind"),
-    template: optional(stringEnum(["http", "command", "edge"]), "[init] Golden-path template (default: command)"),
+    template: optional(stringEnum(["minimal", "http", "command", "edge"]), "[init] Minimal application by default; explicit http/command/edge recipes"),
     name: optional(Type.String(), "[init/generate] Project or object name"),
     module: optional(Type.String(), "[generate] Target feature module (required for command/query/controller)"),
     dir: optional(Type.String(), "[generate] Feature root directory (default: src/features)"),
@@ -250829,12 +250931,12 @@ function registerAppTools(server2, options = {}) {
     out_dir: optional(Type.String(), "[dev/compile/plan/build/export-tools] Output directory (default: configured outDir)"),
     strict: optional(Type.Boolean(), "[dev/compile/check] Promote warnings to errors"),
     format: optional(stringEnum(["text", "json"]), "[dev/generate/compile/check/plan/graph/export-tools] Output format (default: text)"),
-    profile: optional(stringEnum(["fast", "integration"]), "[dev] Local development profile (default: fast); integration requires an explicit database URL"),
+    profile: optional(stringEnum(["fast", "integration"]), "[dev] Run dev or dev:integration; integration verifies an explicit loopback database"),
     once: optional(Type.Boolean(), "[dev] Validate and report once without watching"),
     watch: optional(Type.Boolean(), "[dev] Watch for changes (default: true; --once disables)"),
-    database_url: optional(Type.String(), "[dev] Explicit integration database URL (validated shape only; never connected)"),
+    database_url: optional(Type.String(), "[dev] Explicit loopback integration URL; watch/once only inspect its shape"),
     "database-url": optional(Type.String(), "[dev] CLI alias of database_url"),
-    target: optional(Type.String(), "[explain/context] Provider class name / token name / command name / job name / module name"),
+    target: optional(Type.String(), "[explain/context/verify-plan] Provider class name / token name / command name / job name / module name"),
     fix: optional(Type.String(), "[fix] Path to a DiagnosticFix JSON file produced by `doctor --format json`"),
     write: optional(Type.Boolean(), "[fix] Write the fix to disk (default: preview only)")
   }, (request) => runAppTool(request, options));
@@ -250866,8 +250968,8 @@ function registerAppAliases(server2) {
 }
 
 // src/shared/tools/db-governance-tools.ts
-import { existsSync as existsSync12 } from "node:fs";
-import { join as join16, resolve as resolve18 } from "node:path";
+import { existsSync as existsSync13 } from "node:fs";
+import { join as join18, resolve as resolve23 } from "node:path";
 
 // node_modules/@supacloud/db/dist/index.js
 var TABLES_SQL = `
@@ -251319,8 +251421,8 @@ function normalizeModule(candidate, sourcePath) {
   };
 }
 async function loadDatabaseModules(root, moduleFile) {
-  const filePath = moduleFile ? resolve18(root, moduleFile) : join16(root, "db", "modules.ts");
-  if (!existsSync12(filePath)) {
+  const filePath = moduleFile ? resolve23(root, moduleFile) : join18(root, "db", "modules.ts");
+  if (!existsSync13(filePath)) {
     throw new Error(moduleFile ? `Module file not found: ${filePath}` : `Module file not found: ${filePath}（用 --module_file 指定一个导出 defineDatabaseModule(...) 的文件）`);
   }
   let imported;
@@ -251368,7 +251470,7 @@ async function runLint(args, root) {
   const issues = [];
   for (const module of selected) {
     const readSqlFile = async (path) => {
-      const absolute = resolve18(root, path);
+      const absolute = resolve23(root, path);
       try {
         return await Bun.file(absolute).text();
       } catch (error) {
@@ -251404,14 +251506,14 @@ var defaultLiteSpawn = async (command, cwd) => {
   return { exitCode, stdout, stderr };
 };
 async function runModuleCheckLite(args, root, spawn, liteBinary) {
-  const projectDir = resolve18(args.project_dir?.trim() || root);
+  const projectDir = resolve23(args.project_dir?.trim() || root);
   const binary = liteBinary === undefined ? Bun.which("supacloud-lite") : liteBinary;
   if (!binary) {
     throw new Error("db module_check --lite 需要本机可用的 supacloud-lite（npm i -g @supacloud/lite，或加入 PATH）");
   }
   const command = [binary, "db", "check", "--project-dir", projectDir];
   if (args.module_file?.trim())
-    command.push("--module-file", resolve18(root, args.module_file.trim()));
+    command.push("--module-file", resolve23(root, args.module_file.trim()));
   const result = await spawn(command, projectDir);
   const output = [result.stdout.trim(), result.stderr.trim()].filter(Boolean).join(`
 `);
@@ -251462,7 +251564,7 @@ function registerDbGovernanceTools(server2, options = {}) {
     lite: optional(Type.Boolean(), "[module_check] Reconcile against a local SupaCloud Lite project (runs supacloud-lite db check)"),
     project_dir: optional(Type.String(), "[module_check] Lite project directory (with --lite; default: --root)")
   }, async (request) => {
-    const root = resolve18(request.root || fallbackRoot);
+    const root = resolve23(request.root || fallbackRoot);
     switch (request.action) {
       case "lint":
         return runLint(request, root);
@@ -251479,7 +251581,7 @@ function registerDbGovernanceTools(server2, options = {}) {
 // src/shared/tools/scheduled-function-tools.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { readFileSync as readFileSync10, statSync as statSync7 } from "node:fs";
-import { resolve as resolve20 } from "node:path";
+import { resolve as resolve24 } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 var HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/;
 var ENVIRONMENT_NAME_PATTERN2 = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
@@ -251563,7 +251665,7 @@ function validScheduledFunctionCron(expression) {
 function readScheduleBodyFile(bodyPathInput) {
   if (!bodyPathInput.trim())
     throw new Error("'body_file' must be a path");
-  const bodyPath = resolve20(bodyPathInput);
+  const bodyPath = resolve24(bodyPathInput);
   const bodyStat = statSync7(bodyPath);
   if (!bodyStat.isFile() || bodyStat.size > MAX_BODY_FILE_BYTES) {
     throw new Error("Scheduled Function body file must be a regular file no larger than 1 MiB");
@@ -252146,8 +252248,8 @@ var MUTATION_TOOL_SCHEMA = {
 // src/shared/tools/release-tools.ts
 import { execFileSync } from "node:child_process";
 import { createHash as createHash10 } from "node:crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname13, join as join17, relative as relative13, resolve as resolve21 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname14, join as join19, relative as relative14, resolve as resolve25 } from "node:path";
 var SAFE_PROJECT_REF = /^[A-Za-z0-9_-]{1,64}$/;
 var BACKUP_ID = /^logical-full_[A-Za-z0-9_-]{1,64}_[a-f0-9]{32}$/;
 var SHA256 = /^[a-f0-9]{64}$/;
@@ -252441,15 +252543,15 @@ function collectScopeFiles(cwd, file, files, dir, task) {
   const results = [];
   const resolvePathWithFallbacks = (filePath) => {
     const trimmed = filePath.trim();
-    const resolved = resolve21(cwd, trimmed);
-    if (existsSync13(resolved))
+    const resolved = resolve25(cwd, trimmed);
+    if (existsSync14(resolved))
       return resolved;
     const candidates = [
-      resolve21(cwd, "supacloud/fa/release-scopes", trimmed),
-      resolve21(cwd, "release-scopes", trimmed),
-      resolve21(cwd, "scopes", trimmed)
+      resolve25(cwd, "supacloud/fa/release-scopes", trimmed),
+      resolve25(cwd, "release-scopes", trimmed),
+      resolve25(cwd, "scopes", trimmed)
     ];
-    const found = candidates.find(existsSync13);
+    const found = candidates.find(existsSync14);
     if (found)
       return found;
     throw new Error(`Scope file not found: ${filePath}`);
@@ -252470,18 +252572,18 @@ function collectScopeFiles(cwd, file, files, dir, task) {
   if (!taskFilter && (!dir || typeof dir !== "string" || !dir.trim())) {
     throw new Error("At least one of --file, --files, or --task is required for scope_rebind");
   }
-  const candidates = typeof dir === "string" && dir.trim() ? [resolve21(cwd, dir.trim())] : [
-    resolve21(cwd, "supacloud/fa/release-scopes"),
-    resolve21(cwd, "release-scopes"),
-    resolve21(cwd, "scopes")
+  const candidates = typeof dir === "string" && dir.trim() ? [resolve25(cwd, dir.trim())] : [
+    resolve25(cwd, "supacloud/fa/release-scopes"),
+    resolve25(cwd, "release-scopes"),
+    resolve25(cwd, "scopes")
   ];
   for (const directory of candidates) {
-    if (existsSync13(directory)) {
+    if (existsSync14(directory)) {
       try {
         const entries = readdirSync4(directory, { withFileTypes: true });
         for (const entry of entries) {
           if (entry.isFile() && entry.name.endsWith(".json")) {
-            const fullPath = join17(directory, entry.name);
+            const fullPath = join19(directory, entry.name);
             if (!taskFilter) {
               results.push(fullPath);
             } else if (entry.name.toLowerCase().includes(taskFilter)) {
@@ -252507,7 +252609,7 @@ function collectScopeFiles(cwd, file, files, dir, task) {
   return [...new Set(results)];
 }
 function handleScopeRebind(args) {
-  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve21(args.cwd.trim()) : process.cwd();
+  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve25(args.cwd.trim()) : process.cwd();
   const targetBaseCommit = resolveGitBaseCommit(cwd, args.base_commit);
   const scopeFiles = collectScopeFiles(cwd, args.file, args.files, args.dir, args.task);
   const dryRun = args.dry_run === true;
@@ -252541,7 +252643,7 @@ function handleScopeRebind(args) {
       writeFileSync3(filePath, formatted, "utf8");
     }
     scopes.push({
-      file: relative13(cwd, filePath),
+      file: relative14(cwd, filePath),
       task_id: typeof parsed.taskId === "string" ? parsed.taskId : "",
       target_project_ref: typeof parsed.targetProjectRef === "string" ? parsed.targetProjectRef : "",
       previous_base_commit: previousBaseCommit,
@@ -252559,19 +252661,19 @@ function handleScopeRebind(args) {
   });
 }
 function handleScopeInspect(args) {
-  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve21(args.cwd.trim()) : process.cwd();
+  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve25(args.cwd.trim()) : process.cwd();
   if (typeof args.file !== "string" || !args.file.trim()) {
     throw new Error("'file' is required for scope_inspect");
   }
   const trimmed = args.file.trim();
-  let filePath = resolve21(cwd, trimmed);
-  if (!existsSync13(filePath)) {
+  let filePath = resolve25(cwd, trimmed);
+  if (!existsSync14(filePath)) {
     const candidates = [
-      resolve21(cwd, "supacloud/fa/release-scopes", trimmed),
-      resolve21(cwd, "release-scopes", trimmed),
-      resolve21(cwd, "scopes", trimmed)
+      resolve25(cwd, "supacloud/fa/release-scopes", trimmed),
+      resolve25(cwd, "release-scopes", trimmed),
+      resolve25(cwd, "scopes", trimmed)
     ];
-    const found = candidates.find(existsSync13);
+    const found = candidates.find(existsSync14);
     if (found)
       filePath = found;
     else
@@ -252595,7 +252697,7 @@ function handleScopeInspect(args) {
   const scopeSha256 = genericScopedReleaseScopeSha256(parsed);
   const git = gitCommitInfo(cwd);
   return releaseControlSuccess("release.scope_inspect", {
-    file: relative13(cwd, filePath),
+    file: relative14(cwd, filePath),
     scope: {
       task_id: parsed.taskId,
       target_project_ref: parsed.targetProjectRef,
@@ -252629,7 +252731,7 @@ function parseCommaList(value) {
   return [];
 }
 function handleScopeCreate(args, fallbackRef) {
-  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve21(args.cwd.trim()) : process.cwd();
+  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve25(args.cwd.trim()) : process.cwd();
   if (typeof args.file !== "string" || !args.file.trim()) {
     throw new Error("'file' is required for scope_create");
   }
@@ -252644,8 +252746,8 @@ function handleScopeCreate(args, fallbackRef) {
     throw new Error("'ref' is invalid for release controls");
   }
   const targetBaseCommit = resolveGitBaseCommit(cwd, args.base_commit);
-  const filePath = resolve21(cwd, args.file.trim());
-  mkdirSync4(dirname13(filePath), { recursive: true });
+  const filePath = resolve25(cwd, args.file.trim());
+  mkdirSync4(dirname14(filePath), { recursive: true });
   const scope = {
     baseCommit: targetBaseCommit,
     excludedFunctions: parseCommaList(args.excluded_functions),
@@ -252661,7 +252763,7 @@ function handleScopeCreate(args, fallbackRef) {
 `;
   writeFileSync3(filePath, formatted, "utf8");
   return releaseControlSuccess("release.scope_create", {
-    file: relative13(cwd, filePath),
+    file: relative14(cwd, filePath),
     task_id: scope.taskId,
     target_project_ref: projectRef,
     base_commit: targetBaseCommit,
@@ -252866,11 +252968,11 @@ function registerReleaseTools(server2, http, options = {}) {
 }
 
 // src/shared/tools/deploy-tools.ts
-import { access as access4, lstat as lstat5, mkdtemp as mkdtemp2, opendir, readFile as readFile9, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
+import { access as access4, lstat as lstat5, mkdtemp as mkdtemp2, opendir, readFile as readFile10, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
 import { createHash as createHash11 } from "node:crypto";
 import { tmpdir as tmpdir2 } from "node:os";
-import { basename as basename9, dirname as dirname14, join as join18, relative as relative14, resolve as resolve23, sep as sep12 } from "node:path";
-import { spawn as spawn3 } from "node:child_process";
+import { basename as basename9, dirname as dirname15, join as join20, relative as relative15, resolve as resolve26, sep as sep12 } from "node:path";
+import { spawn as spawn4 } from "node:child_process";
 
 // node_modules/fflate/esm/index.mjs
 import { createRequire as createRequire3 } from "module";
@@ -253553,7 +253655,7 @@ function frontendDeployment(candidate) {
 }
 async function readJson(path) {
   try {
-    return JSON.parse(await readFile9(path, "utf8"));
+    return JSON.parse(await readFile10(path, "utf8"));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
       return null;
@@ -253561,13 +253663,13 @@ async function readJson(path) {
   }
 }
 async function findDeployConfigRoot(startDirectory) {
-  let directory = resolve23(startDirectory);
+  let directory = resolve26(startDirectory);
   while (true) {
-    if (await pathExists(join18(directory, "supacloud.json")))
+    if (await pathExists(join20(directory, "supacloud.json")))
       return directory;
-    const parent = dirname14(directory);
+    const parent = dirname15(directory);
     if (parent === directory)
-      return resolve23(startDirectory);
+      return resolve26(startDirectory);
     directory = parent;
   }
 }
@@ -253610,7 +253712,7 @@ function deployTargetConfig(candidate, name) {
   };
 }
 async function readDeployConfig(configRoot) {
-  const configPath = join18(configRoot, "supacloud.json");
+  const configPath = join20(configRoot, "supacloud.json");
   const candidate = await readJson(configPath);
   if (candidate === null)
     return {};
@@ -253632,29 +253734,29 @@ async function readDeployConfig(configRoot) {
   };
 }
 async function packageName(projectDirectory) {
-  const candidate = record4(await readJson(join18(projectDirectory, "package.json")));
+  const candidate = record4(await readJson(join20(projectDirectory, "package.json")));
   return typeof candidate?.name === "string" && candidate.name.trim() ? candidate.name.trim() : null;
 }
 async function pathExists(path) {
   return access4(path).then(() => true, () => false);
 }
 async function defaultBuildCommand(projectDirectory, configRoot) {
-  const packageJson = record4(await readJson(join18(projectDirectory, "package.json")));
+  const packageJson = record4(await readJson(join20(projectDirectory, "package.json")));
   const scripts = record4(packageJson?.scripts);
   if (typeof scripts?.build !== "string" || !scripts.build.trim()) {
     throw new Error("No build command was configured and package.json has no build script");
   }
   let directory = projectDirectory;
   while (true) {
-    if (await pathExists(join18(directory, "bun.lock")) || await pathExists(join18(directory, "bun.lockb")))
+    if (await pathExists(join20(directory, "bun.lock")) || await pathExists(join20(directory, "bun.lockb")))
       return "bun run build";
-    if (await pathExists(join18(directory, "pnpm-lock.yaml")))
+    if (await pathExists(join20(directory, "pnpm-lock.yaml")))
       return "pnpm run build";
-    if (await pathExists(join18(directory, "yarn.lock")))
+    if (await pathExists(join20(directory, "yarn.lock")))
       return "yarn build";
     if (directory === configRoot)
       break;
-    const parent = dirname14(directory);
+    const parent = dirname15(directory);
     if (parent === directory || !directory.startsWith(`${configRoot}${sep12}`))
       break;
     directory = parent;
@@ -253685,9 +253787,9 @@ function selectDeployment(deployments, requestedId, projectName) {
   throw new Error(deployments.length === 0 ? "No frontend deployments exist for this project" : `Multiple frontend deployments found (${ids}). Set frontend.id in supacloud.json or pass --id`);
 }
 function targetRoot(configRoot, target, name) {
-  const root = resolve23(configRoot, target.root || (name === "frontend" ? "." : name));
-  const prefix = `${resolve23(configRoot)}${sep12}`;
-  if (root !== resolve23(configRoot) && !root.startsWith(prefix)) {
+  const root = resolve26(configRoot, target.root || (name === "frontend" ? "." : name));
+  const prefix = `${resolve26(configRoot)}${sep12}`;
+  if (root !== resolve26(configRoot) && !root.startsWith(prefix)) {
     throw new Error(`Deploy target '${name}' root must stay inside the repository root`);
   }
   return root;
@@ -253738,8 +253840,8 @@ function defaultOutputDirectory(framework) {
   }
 }
 function resolveInsideProject(projectDirectory, candidate, allowRoot = false) {
-  const resolved = resolve23(projectDirectory, candidate);
-  const projectRoot = resolve23(projectDirectory);
+  const resolved = resolve26(projectDirectory, candidate);
+  const projectRoot = resolve26(projectDirectory);
   const projectPrefix = `${projectRoot}${sep12}`;
   if (!allowRoot && resolved === projectRoot || resolved !== projectRoot && !resolved.startsWith(projectPrefix)) {
     throw new Error("Frontend output directory must stay inside the project directory");
@@ -253748,7 +253850,7 @@ function resolveInsideProject(projectDirectory, candidate, allowRoot = false) {
 }
 async function runBuild(command, cwd) {
   await new Promise((resolvePromise, reject) => {
-    const child = spawn3(command, { cwd, env: process.env, shell: true, stdio: "inherit" });
+    const child = spawn4(command, { cwd, env: process.env, shell: true, stdio: "inherit" });
     child.once("error", reject);
     child.once("exit", (code, signal) => {
       if (code === 0)
@@ -253770,7 +253872,7 @@ async function collectArchiveFiles(root) {
       entries.push(entry);
     entries.sort((left, right) => left.name.localeCompare(right.name, "en"));
     for (const entry of entries) {
-      const path = join18(directory, entry.name);
+      const path = join20(directory, entry.name);
       const stats = await lstat5(path);
       if (stats.isSymbolicLink())
         throw new Error(`Frontend output cannot contain symbolic links: ${path}`);
@@ -253788,19 +253890,19 @@ async function collectArchiveFiles(root) {
   let bytes = 0;
   const files = {};
   for (const path of paths) {
-    const data = new Uint8Array(await readFile9(path));
+    const data = new Uint8Array(await readFile10(path));
     bytes += data.byteLength;
     if (bytes > MAX_SOURCE_BYTES)
       throw new Error(`Frontend output exceeds ${MAX_SOURCE_BYTES} bytes`);
-    const archivePath = relative14(root, path).split(sep12).join("/");
+    const archivePath = relative15(root, path).split(sep12).join("/");
     files[archivePath] = [data, { mtime: FIXED_ZIP_MTIME }];
   }
   return { files, bytes, count: paths.length };
 }
 async function createFrontendArchive(outputDirectory) {
   const collected = await collectArchiveFiles(outputDirectory);
-  const temporaryDirectory = await mkdtemp2(join18(tmpdir2(), "supacloud-deploy-"));
-  const archivePath = join18(temporaryDirectory, `${basename9(outputDirectory)}.zip`);
+  const temporaryDirectory = await mkdtemp2(join20(tmpdir2(), "supacloud-deploy-"));
+  const archivePath = join20(temporaryDirectory, `${basename9(outputDirectory)}.zip`);
   try {
     const archiveBytes = zipSync(collected.files, { level: 6, mtime: FIXED_ZIP_MTIME });
     await writeFile6(archivePath, archiveBytes);
@@ -253850,7 +253952,7 @@ function deployResponse(result, json) {
 }
 function registerDeployTools(server2, http, options = {}) {
   server2.tool("deploy", "Build and publish the linked frontend with one command", deployToolSchema, async (args) => {
-    const invocationDirectory = resolve23(String(args.cwd || options.cwd || process.cwd()));
+    const invocationDirectory = resolve26(String(args.cwd || options.cwd || process.cwd()));
     const projectRef = String(args.ref || options.projectRef || "").trim();
     if (!projectRef)
       throw new Error("A linked project ref is required. Set SUPACLOUD_PROJECT_REF or pass --ref");
@@ -253964,7 +254066,7 @@ function registerDeployTools(server2, http, options = {}) {
     } else {
       report("build", "skipped");
     }
-    report("package", relative14(projectDirectory, outputDirectory) || ".");
+    report("package", relative15(projectDirectory, outputDirectory) || ".");
     const archive = await createFrontendArchive(outputDirectory);
     try {
       const inventory = payload(await listFrontendReleases(http, projectRef, selected.id, undefined, 100));
@@ -254022,12 +254124,12 @@ function registerDeployTools(server2, http, options = {}) {
 }
 
 // src/shared/tools/remote-dev-tools.ts
-import { spawn as spawn4 } from "node:child_process";
-import { existsSync as existsSync14 } from "node:fs";
-import { readFile as readFile10 } from "node:fs/promises";
-import { readdir as readdir6 } from "node:fs/promises";
+import { spawn as spawn5 } from "node:child_process";
+import { existsSync as existsSync15 } from "node:fs";
+import { readFile as readFile11 } from "node:fs/promises";
+import { readdir as readdir7 } from "node:fs/promises";
 import { createHash as createHash12 } from "node:crypto";
-import { join as join19, resolve as resolve24 } from "node:path";
+import { join as join21, resolve as resolve27 } from "node:path";
 var SAFE_TOKEN = /^[A-Za-z0-9._:@/+,-]+$/;
 var SAFE_REMOTE_ROOT = /^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+\/?$/;
 var remoteDevToolSchema = {
@@ -254051,7 +254153,7 @@ var remoteDevToolSchema = {
 };
 function runProcess(executable, args, cwd) {
   return new Promise((resolveResult, reject) => {
-    const child = spawn4(executable, args, { cwd, shell: false, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn5(executable, args, { cwd, shell: false, stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     child.stdout?.setEncoding("utf8");
@@ -254069,21 +254171,21 @@ function runProcess(executable, args, cwd) {
 function resolveDrizzleCommand(root, configured) {
   if (configured?.trim())
     return configured.trim();
-  const local = join19(root, "node_modules", ".bin", "drizzle-kit");
-  return existsSync14(local) ? local : "drizzle-kit";
+  const local = join21(root, "node_modules", ".bin", "drizzle-kit");
+  return existsSync15(local) ? local : "drizzle-kit";
 }
 function toolFailed(value) {
   return value?.isError === true || value?.content?.some((chunk) => typeof chunk?.text === "string" && chunk.text.trimStart().startsWith("❌"));
 }
 async function migrateDatabase(args, options) {
-  const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
+  const root = resolve27(String(args.project_dir || options.cwd || process.cwd()));
   const projectConfig = await readProjectConfig3(root);
   const config = projectConfig.dev || {};
   const database = config.database || {};
   const execute = options.execute || ((command, commandArgs, cwd) => runProcess(command, commandArgs, cwd));
-  const drizzleConfig = resolve24(root, String(args.drizzle_config || database.drizzleConfig || "drizzle.config.ts"));
+  const drizzleConfig = resolve27(root, String(args.drizzle_config || database.drizzleConfig || "drizzle.config.ts"));
   const migrationsDir = String(args.migrations_dir || database.migrationsDir || "supabase/migrations");
-  if (!existsSync14(drizzleConfig))
+  if (!existsSync15(drizzleConfig))
     throw new Error(`Drizzle config not found: ${drizzleConfig}`);
   const generated = await execute(resolveDrizzleCommand(root, typeof args.drizzle_bin === "string" ? args.drizzle_bin : database.drizzleBin), ["generate", "--config", drizzleConfig], root);
   if (generated.exitCode !== 0)
@@ -254101,11 +254203,11 @@ async function migrateDatabase(args, options) {
   return { ok: true, mode: "dev", action: "migrate", generated: true, applied: true, migrations_dir: migrationsDir, result: applied };
 }
 async function readProjectConfig3(root) {
-  const file = join19(root, "supacloud.json");
-  if (!existsSync14(file))
+  const file = join21(root, "supacloud.json");
+  if (!existsSync15(file))
     return {};
   try {
-    const parsed = JSON.parse(await readFile10(file, "utf8"));
+    const parsed = JSON.parse(await readFile11(file, "utf8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch (error) {
     throw new Error(`Invalid supacloud.json: ${error instanceof Error ? error.message : String(error)}`);
@@ -254118,9 +254220,9 @@ async function readDevConfig(root) {
 async function sourceFingerprint(root) {
   const files = [];
   const visit = async (directory) => {
-    const entries = await readdir6(directory, { withFileTypes: true });
+    const entries = await readdir7(directory, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-      const path = join19(directory, entry.name);
+      const path = join21(directory, entry.name);
       if (entry.isDirectory() && ![".git", "node_modules", "dist", "generated", ".supacloud"].includes(entry.name))
         await visit(path);
       else if (entry.isFile())
@@ -254131,7 +254233,7 @@ async function sourceFingerprint(root) {
   const hash = createHash12("sha256");
   for (const file of files) {
     hash.update(file.slice(root.length).replace(/\\/g, "/"));
-    hash.update(await readFile10(file));
+    hash.update(await readFile11(file));
   }
   return hash.digest("hex");
 }
@@ -254148,17 +254250,17 @@ function remoteRoot(value) {
 }
 function targetDirectory(root, target, functionSlug, config = {}) {
   if (target === "db")
-    return join19(root, "supabase", "migrations");
+    return join21(root, "supabase", "migrations");
   if (target === "functions") {
     const targets = config.targets && typeof config.targets === "object" ? config.targets : {};
     const match = Object.values(targets).find((entry) => entry?.type === "edge_function" && (!functionSlug || String(entry.slug || "") === functionSlug));
-    const base = match?.root ? resolve24(root, String(match.root)) : join19(root, "supabase", "functions");
-    return match?.root ? base : functionSlug ? join19(base, safeToken(functionSlug, "function")) : base;
+    const base = match?.root ? resolve27(root, String(match.root)) : join21(root, "supabase", "functions");
+    return match?.root ? base : functionSlug ? join21(base, safeToken(functionSlug, "function")) : base;
   }
   if (target === "frontend") {
     const targets = config.targets && typeof config.targets === "object" ? config.targets : {};
     const match = Object.values(targets).find((entry) => entry?.type === "frontend");
-    return match?.root ? resolve24(root, String(match.root)) : join19(root, "apps", "web");
+    return match?.root ? resolve27(root, String(match.root)) : join21(root, "apps", "web");
   }
   return root;
 }
@@ -254197,10 +254299,10 @@ function reloadCommand(config, target, projectRef, functionSlug) {
   return [...command.split(" "), "--project-ref", safeToken(projectRef || "test", "project_ref"), "--target", targetConfigPath(target), ...functionSlug ? ["--function", safeToken(functionSlug, "function")] : []];
 }
 function sshArgs(connection, remoteCommand) {
-  return ["-p", String(connection.port), "-i", resolve24(connection.key), "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=yes", `${connection.user}@${connection.host}`, ...remoteCommand];
+  return ["-p", String(connection.port), "-i", resolve27(connection.key), "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=yes", `${connection.user}@${connection.host}`, ...remoteCommand];
 }
 function rsyncArgs(connection, source, destination, excludes, deleteRemote) {
-  const args = ["-az", "--checksum", "--partial", "--protect-args", "-e", `ssh -p ${connection.port} -i ${resolve24(connection.key)} -o BatchMode=yes -o StrictHostKeyChecking=yes`];
+  const args = ["-az", "--checksum", "--partial", "--protect-args", "-e", `ssh -p ${connection.port} -i ${resolve27(connection.key)} -o BatchMode=yes -o StrictHostKeyChecking=yes`];
   if (deleteRemote)
     args.push("--delete-delay");
   for (const exclude of excludes) {
@@ -254212,17 +254314,17 @@ function rsyncArgs(connection, source, destination, excludes, deleteRemote) {
   return args;
 }
 async function syncOnce(args, options) {
-  const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
+  const root = resolve27(String(args.project_dir || options.cwd || process.cwd()));
   const projectConfig = await readProjectConfig3(root);
   const config = projectConfig.dev || {};
   const target = String(args.target || "project");
   const source = targetDirectory(root, target, typeof args.function === "string" ? args.function : undefined, projectConfig);
-  if (!existsSync14(source))
+  if (!existsSync15(source))
     throw new Error(`Dev source directory not found: ${source}`);
   let compiled = false;
   if (config.compile === true && target !== "db") {
-    const compileRoot = resolve24(root, config.compileRoot || ".");
-    const compileOutDir = resolve24(root, config.compileOutDir || "generated");
+    const compileRoot = resolve27(root, config.compileRoot || ".");
+    const compileOutDir = resolve27(root, config.compileOutDir || "generated");
     const compilation = await compileProject({
       rootDir: compileRoot,
       outDir: compileOutDir,
@@ -254260,7 +254362,7 @@ function registerRemoteDevTools(server2, options = {}) {
     if (["production", "prod"].includes((options.environment || "").toLowerCase()))
       throw new Error("Remote dev mode is forbidden for production environments");
     if (args.action === "status") {
-      const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
+      const root = resolve27(String(args.project_dir || options.cwd || process.cwd()));
       const config = await readDevConfig(root);
       const connection = connectionArgs(options, config, args);
       const execute = options.execute || ((command, commandArgs, cwd) => runProcess(command, commandArgs, cwd));
@@ -254274,7 +254376,7 @@ function registerRemoteDevTools(server2, options = {}) {
       return { content: [{ type: "text", text: JSON.stringify(await migrateDatabase(args, options), null, 2) }] };
     }
     if (args.action === "watch") {
-      const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
+      const root = resolve27(String(args.project_dir || options.cwd || process.cwd()));
       const interval = Math.max(100, Math.min(1e4, Number(args.interval_ms || 300)));
       let fingerprint = "";
       let lastSync = null;
@@ -254293,9 +254395,9 @@ function registerRemoteDevTools(server2, options = {}) {
   });
 }
 // package.json
-var package_default8 = {
+var package_default = {
   name: "@supacloud/cli",
-  version: "0.62.1",
+  version: "0.64.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -254330,7 +254432,7 @@ var package_default8 = {
   },
   dependencies: {
     "@sinclair/typebox": "^0.34.52",
-    "@supacloud/compiler": "^0.31.0",
+    "@supacloud/compiler": "^0.31.1",
     "@supacloud/delivery": "0.4.0",
     "@supacloud/db": "^0.2.0",
     fflate: "^0.8.3",
@@ -254340,7 +254442,9 @@ var package_default8 = {
     "@supacloud/delivery": "0.4.0"
   },
   devDependencies: {
+    "@supacloud/elysia": "^0.23.1",
     "@types/bun": "^1.4.2",
+    elysia: "2.0.0-beta.19",
     typescript: "^7.0.2"
   }
 };
@@ -254879,7 +254983,7 @@ function createCliTools(context, confirmProduction) {
 async function main() {
   const rawArgs = process.argv.slice(2);
   if (rawArgs.length === 1 && rawArgs[0] === "--version") {
-    console.log(package_default8.version);
+    console.log(package_default.version);
     return;
   }
   const globalOptions = parseGlobalOptions(rawArgs);