@supacloud/cli 0.70.1 → 0.71.0

package/dist/index.js

@@ -185129,7 +185129,7 @@ function printComment(comment) {
 # ` + comment.replace(/\n/g, `
 # `);
 }
-function join9(maybeArray, separator) {
+function join10(maybeArray, separator) {
   return maybeArray ? maybeArray.filter((x) => x).join(separator || "") : "";
 }
 function hasMultilineItems(maybeArray) {
@@ -185150,7 +185150,7 @@ function addDescription(cb) {
     if (node.kind.includes("Definition") && commentsRegistry[key]) {
       items.push(...commentsRegistry[key]);
     }
-    return join9([...items.map(printComment), node.description, cb(node, _key, _parent, path, ancestors)], `
+    return join10([...items.map(printComment), node.description, cb(node, _key, _parent, path, ancestors)], `
 `);
   };
 }
@@ -185160,7 +185160,7 @@ function indent(maybeString) {
 }
 function block(array) {
   return array && array.length !== 0 ? `{
-${indent(join9(array, `
+${indent(join10(array, `
 `))}
 }` : "";
 }
@@ -185255,43 +185255,43 @@ var init_comments = __esm(() => {
     Name: { leave: (node) => node.value },
     Variable: { leave: (node) => "$" + node.name },
     Document: {
-      leave: (node) => join9(node.definitions, `
+      leave: (node) => join10(node.definitions, `
 
 `)
     },
     OperationDefinition: {
       leave: (node) => {
-        const varDefs = wrap("(", join9(node.variableDefinitions, ", "), ")");
-        const prefix = join9([node.operation, join9([node.name, varDefs]), join9(node.directives, " ")], " ");
+        const varDefs = wrap("(", join10(node.variableDefinitions, ", "), ")");
+        const prefix = join10([node.operation, join10([node.name, varDefs]), join10(node.directives, " ")], " ");
         return prefix + " " + node.selectionSet;
       }
     },
     VariableDefinition: {
-      leave: ({ variable, type, defaultValue, directives }) => variable + ": " + type + wrap(" = ", defaultValue) + wrap(" ", join9(directives, " "))
+      leave: ({ variable, type, defaultValue, directives }) => variable + ": " + type + wrap(" = ", defaultValue) + wrap(" ", join10(directives, " "))
     },
     SelectionSet: { leave: ({ selections }) => block(selections) },
     Field: {
       leave({ alias, name, arguments: args, directives, selectionSet }) {
         const prefix = wrap("", alias, ": ") + name;
-        let argsLine = prefix + wrap("(", join9(args, ", "), ")");
+        let argsLine = prefix + wrap("(", join10(args, ", "), ")");
         if (argsLine.length > MAX_LINE_LENGTH) {
           argsLine = prefix + wrap(`(
-`, indent(join9(args, `
+`, indent(join10(args, `
 `)), `
 )`);
         }
-        return join9([argsLine, join9(directives, " "), selectionSet], " ");
+        return join10([argsLine, join10(directives, " "), selectionSet], " ");
       }
     },
     Argument: { leave: ({ name, value }) => name + ": " + value },
     FragmentSpread: {
-      leave: ({ name, directives }) => "..." + name + wrap(" ", join9(directives, " "))
+      leave: ({ name, directives }) => "..." + name + wrap(" ", join10(directives, " "))
     },
     InlineFragment: {
-      leave: ({ typeCondition, directives, selectionSet }) => join9(["...", wrap("on ", typeCondition), join9(directives, " "), selectionSet], " ")
+      leave: ({ typeCondition, directives, selectionSet }) => join10(["...", wrap("on ", typeCondition), join10(directives, " "), selectionSet], " ")
     },
     FragmentDefinition: {
-      leave: ({ name, typeCondition, variableDefinitions, directives, selectionSet }) => `fragment ${name}${wrap("(", join9(variableDefinitions, ", "), ")")} ` + `on ${typeCondition} ${wrap("", join9(directives, " "), " ")}` + selectionSet
+      leave: ({ name, typeCondition, variableDefinitions, directives, selectionSet }) => `fragment ${name}${wrap("(", join10(variableDefinitions, ", "), ")")} ` + `on ${typeCondition} ${wrap("", join10(directives, " "), " ")}` + selectionSet
     },
     IntValue: { leave: ({ value }) => value },
     FloatValue: { leave: ({ value }) => value },
@@ -185306,101 +185306,101 @@ var init_comments = __esm(() => {
     BooleanValue: { leave: ({ value }) => value ? "true" : "false" },
     NullValue: { leave: () => "null" },
     EnumValue: { leave: ({ value }) => value },
-    ListValue: { leave: ({ values }) => "[" + join9(values, ", ") + "]" },
-    ObjectValue: { leave: ({ fields }) => "{" + join9(fields, ", ") + "}" },
+    ListValue: { leave: ({ values }) => "[" + join10(values, ", ") + "]" },
+    ObjectValue: { leave: ({ fields }) => "{" + join10(fields, ", ") + "}" },
     ObjectField: { leave: ({ name, value }) => name + ": " + value },
     Directive: {
-      leave: ({ name, arguments: args }) => "@" + name + wrap("(", join9(args, ", "), ")")
+      leave: ({ name, arguments: args }) => "@" + name + wrap("(", join10(args, ", "), ")")
     },
     NamedType: { leave: ({ name }) => name },
     ListType: { leave: ({ type }) => "[" + type + "]" },
     NonNullType: { leave: ({ type }) => type + "!" },
     SchemaDefinition: {
-      leave: ({ directives, operationTypes }) => join9(["schema", join9(directives, " "), block(operationTypes)], " ")
+      leave: ({ directives, operationTypes }) => join10(["schema", join10(directives, " "), block(operationTypes)], " ")
     },
     OperationTypeDefinition: {
       leave: ({ operation, type }) => operation + ": " + type
     },
     ScalarTypeDefinition: {
-      leave: ({ name, directives }) => join9(["scalar", name, join9(directives, " ")], " ")
+      leave: ({ name, directives }) => join10(["scalar", name, join10(directives, " ")], " ")
     },
     ObjectTypeDefinition: {
-      leave: ({ name, interfaces, directives, fields }) => join9([
+      leave: ({ name, interfaces, directives, fields }) => join10([
         "type",
         name,
-        wrap("implements ", join9(interfaces, " & ")),
-        join9(directives, " "),
+        wrap("implements ", join10(interfaces, " & ")),
+        join10(directives, " "),
         block(fields)
       ], " ")
     },
     FieldDefinition: {
       leave: ({ name, arguments: args, type, directives }) => name + (hasMultilineItems(args) ? wrap(`(
-`, indent(join9(args, `
+`, indent(join10(args, `
 `)), `
-)`) : wrap("(", join9(args, ", "), ")")) + ": " + type + wrap(" ", join9(directives, " "))
+)`) : wrap("(", join10(args, ", "), ")")) + ": " + type + wrap(" ", join10(directives, " "))
     },
     InputValueDefinition: {
-      leave: ({ name, type, defaultValue, directives }) => join9([name + ": " + type, wrap("= ", defaultValue), join9(directives, " ")], " ")
+      leave: ({ name, type, defaultValue, directives }) => join10([name + ": " + type, wrap("= ", defaultValue), join10(directives, " ")], " ")
     },
     InterfaceTypeDefinition: {
-      leave: ({ name, interfaces, directives, fields }) => join9([
+      leave: ({ name, interfaces, directives, fields }) => join10([
         "interface",
         name,
-        wrap("implements ", join9(interfaces, " & ")),
-        join9(directives, " "),
+        wrap("implements ", join10(interfaces, " & ")),
+        join10(directives, " "),
         block(fields)
       ], " ")
     },
     UnionTypeDefinition: {
-      leave: ({ name, directives, types }) => join9(["union", name, join9(directives, " "), wrap("= ", join9(types, " | "))], " ")
+      leave: ({ name, directives, types }) => join10(["union", name, join10(directives, " "), wrap("= ", join10(types, " | "))], " ")
     },
     EnumTypeDefinition: {
-      leave: ({ name, directives, values }) => join9(["enum", name, join9(directives, " "), block(values)], " ")
+      leave: ({ name, directives, values }) => join10(["enum", name, join10(directives, " "), block(values)], " ")
     },
     EnumValueDefinition: {
-      leave: ({ name, directives }) => join9([name, join9(directives, " ")], " ")
+      leave: ({ name, directives }) => join10([name, join10(directives, " ")], " ")
     },
     InputObjectTypeDefinition: {
-      leave: ({ name, directives, fields }) => join9(["input", name, join9(directives, " "), block(fields)], " ")
+      leave: ({ name, directives, fields }) => join10(["input", name, join10(directives, " "), block(fields)], " ")
     },
     DirectiveDefinition: {
       leave: ({ name, arguments: args, repeatable, locations }) => "directive @" + name + (hasMultilineItems(args) ? wrap(`(
-`, indent(join9(args, `
+`, indent(join10(args, `
 `)), `
-)`) : wrap("(", join9(args, ", "), ")")) + (repeatable ? " repeatable" : "") + " on " + join9(locations, " | ")
+)`) : wrap("(", join10(args, ", "), ")")) + (repeatable ? " repeatable" : "") + " on " + join10(locations, " | ")
     },
     SchemaExtension: {
-      leave: ({ directives, operationTypes }) => join9(["extend schema", join9(directives, " "), block(operationTypes)], " ")
+      leave: ({ directives, operationTypes }) => join10(["extend schema", join10(directives, " "), block(operationTypes)], " ")
     },
     ScalarTypeExtension: {
-      leave: ({ name, directives }) => join9(["extend scalar", name, join9(directives, " ")], " ")
+      leave: ({ name, directives }) => join10(["extend scalar", name, join10(directives, " ")], " ")
     },
     ObjectTypeExtension: {
-      leave: ({ name, interfaces, directives, fields }) => join9([
+      leave: ({ name, interfaces, directives, fields }) => join10([
         "extend type",
         name,
-        wrap("implements ", join9(interfaces, " & ")),
-        join9(directives, " "),
+        wrap("implements ", join10(interfaces, " & ")),
+        join10(directives, " "),
         block(fields)
       ], " ")
     },
     InterfaceTypeExtension: {
-      leave: ({ name, interfaces, directives, fields }) => join9([
+      leave: ({ name, interfaces, directives, fields }) => join10([
         "extend interface",
         name,
-        wrap("implements ", join9(interfaces, " & ")),
-        join9(directives, " "),
+        wrap("implements ", join10(interfaces, " & ")),
+        join10(directives, " "),
         block(fields)
       ], " ")
     },
     UnionTypeExtension: {
-      leave: ({ name, directives, types }) => join9(["extend union", name, join9(directives, " "), wrap("= ", join9(types, " | "))], " ")
+      leave: ({ name, directives, types }) => join10(["extend union", name, join10(directives, " "), wrap("= ", join10(types, " | "))], " ")
     },
     EnumTypeExtension: {
-      leave: ({ name, directives, values }) => join9(["extend enum", name, join9(directives, " "), block(values)], " ")
+      leave: ({ name, directives, values }) => join10(["extend enum", name, join10(directives, " "), block(values)], " ")
     },
     InputObjectTypeExtension: {
-      leave: ({ name, directives, fields }) => join9(["extend input", name, join9(directives, " "), block(fields)], " ")
+      leave: ({ name, directives, fields }) => join10(["extend input", name, join10(directives, " "), block(fields)], " ")
     }
   };
   printDocASTReducerWithComments = Object.keys(printDocASTReducer).reduce((prev, key) => ({
@@ -188960,7 +188960,7 @@ var require_parse_filepath = __commonJS(function(exports, module) {
 });
 
 // node_modules/@graphql-codegen/visitor-plugin-common/esm/imports.js
-import { dirname as dirname5, isAbsolute as isAbsolute4, join as join10, relative as relative5, resolve as resolve12 } from "path";
+import { dirname as dirname5, isAbsolute as isAbsolute4, join as join11, relative as relative5, resolve as resolve13 } from "path";
 function generateFragmentImportStatement(statement, kind) {
   const { importSource: fragmentImportSource, ...rest } = statement;
   const { identifiers, path, namespace } = fragmentImportSource;
@@ -188994,8 +188994,8 @@ function generateImportStatement(statement) {
 function resolveImportPath(baseDir, outputPath, sourcePath) {
   const shouldAbsolute = !sourcePath.startsWith("~");
   if (shouldAbsolute) {
-    const absGeneratedFilePath = resolve12(baseDir, outputPath);
-    const absImportFilePath = resolve12(baseDir, sourcePath);
+    const absGeneratedFilePath = resolve13(baseDir, outputPath);
+    const absImportFilePath = resolve13(baseDir, sourcePath);
     return resolveRelativeImport(absGeneratedFilePath, absImportFilePath);
   }
   return sourcePath.replace(`~`, "");
@@ -189011,7 +189011,7 @@ function resolveRelativeImport(from, to) {
 }
 function clearExtension(path) {
   const parsedPath = import_parse_filepath.default(path);
-  return join10(parsedPath.dir, parsedPath.name).replace(/\\/g, "/");
+  return join11(parsedPath.dir, parsedPath.name).replace(/\\/g, "/");
 }
 function fixLocalFilePath(path) {
   return path.startsWith("..") ? path : `./${path}`;
@@ -190212,7 +190212,7 @@ var init_esm4 = __esm(() => {
 });
 
 // node_modules/@graphql-codegen/visitor-plugin-common/esm/client-side-base-visitor.js
-import { basename as basename7, extname } from "path";
+import { basename as basename8, extname } from "path";
 var import_dependency_graph, import_graphql54, import_graphql_tag, DocumentMode, EXTENSIONS_TO_REMOVE, ClientSideBaseVisitor;
 var init_client_side_base_visitor = __esm(() => {
   init_dist();
@@ -190534,7 +190534,7 @@ var init_client_side_base_visitor = __esm(() => {
         case DocumentMode.external: {
           if (this._collectedOperations.length > 0) {
             if (this.config.importDocumentNodeExternallyFrom === "near-operation-file" && this._documents.length === 1) {
-              let documentPath = `./${this.clearExtension(basename7(this._documents[0].location || ""))}`;
+              let documentPath = `./${this.clearExtension(basename8(this._documents[0].location || ""))}`;
               documentPath += normalizeImportExtension({
                 emitLegacyCommonJSImports: this.config.emitLegacyCommonJSImports,
                 importExtension: this.config.importExtension
@@ -207626,7 +207626,7 @@ var ACTION_POLICY = {
   },
   database: {
     read: ["list_tables", "describe_columns", "list_indexes", "list_constraints", "list_extensions", "extension_catalog", "rls_status", "rls_policies", "list_auth_users", "get_auth_user", "connections", "stats", "slow_queries", "list_migrations", "migration_inventory", "migration_import", "delivery_migration_plan", "project_url", "generate_types", "database_lint", "db_lint", "rpc_catalog", "list_rpcs"],
-    local: ["lint_migrations", "lint"],
+    local: ["lint_migrations", "lint", "rebase_migrations"],
     write: ["query", "execute", "apply_migration", "push_migrations", "baseline_migrations", "create_table_rls", "enable_extension", "disable_extension"]
   },
   supabase: {
@@ -208205,7 +208205,7 @@ class HttpTransport {
 // src/shared/tools/database-tools.ts
 import { createHash as createHash3 } from "node:crypto";
 import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
-import { basename as basename3, join as join4 } from "node:path";
+import { basename as basename4, join as join5 } from "node:path";
 
 // node_modules/@supacloud/delivery/src/delivery-artifact.ts
 import { readdir as readdir2, realpath as realpath2 } from "node:fs/promises";
@@ -209054,6 +209054,748 @@ async function readDeliveryExecutableArchive(manifestPath) {
   return { manifest, objects };
 }
 
+// node_modules/@supacloud/db/dist/index.js
+import { createHash as createHash22 } from "node:crypto";
+import { mkdir as mkdir2, readFile as readFile2, readdir as readdir3, stat, writeFile as writeFile2 } from "node:fs/promises";
+import { basename as basename2, join as join3, resolve as resolve5 } from "node:path";
+var TABLES_SQL = `
+SELECT n.nspname AS schema,
+       c.relname AS name,
+       c.relrowsecurity AS rls_enabled,
+       c.relforcerowsecurity AS rls_forced
+FROM pg_class c
+JOIN pg_namespace n ON n.oid = c.relnamespace
+WHERE c.relkind = 'r'
+  AND n.nspname = ANY($1)
+ORDER BY n.nspname, c.relname
+`;
+var POLICIES_SQL = `
+SELECT n.nspname AS schema,
+       c.relname AS table,
+       p.polname AS name,
+       p.polcmd AS command,
+       ARRAY(
+         SELECT CASE WHEN r = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(r) END
+         FROM unnest(p.polroles) AS r
+       ) AS roles,
+       pg_get_expr(p.polqual, p.polrelid) AS using_expr,
+       pg_get_expr(p.polwithcheck, p.polrelid) AS check_expr
+FROM pg_policy p
+JOIN pg_class c ON c.oid = p.polrelid
+JOIN pg_namespace n ON n.oid = c.relnamespace
+WHERE n.nspname = ANY($1)
+ORDER BY n.nspname, c.relname, p.polname
+`;
+var FUNCTIONS_SQL = `
+SELECT n.nspname AS schema,
+       p.proname AS name,
+       p.prosecdef AS security_definer,
+       p.proconfig AS config,
+       l.lanname AS language
+FROM pg_proc p
+JOIN pg_namespace n ON n.oid = p.pronamespace
+JOIN pg_language l ON l.oid = p.prolang
+WHERE n.nspname = ANY($1)
+ORDER BY n.nspname, p.proname
+`;
+var TRIGGERS_SQL = `
+SELECT n.nspname AS schema,
+       c.relname AS table,
+       t.tgname AS name,
+       t.tgenabled <> 'D' AS enabled
+FROM pg_trigger t
+JOIN pg_class c ON c.oid = t.tgrelid
+JOIN pg_namespace n ON n.oid = c.relnamespace
+WHERE NOT t.tgisinternal
+  AND n.nspname = ANY($1)
+ORDER BY n.nspname, c.relname, t.tgname
+`;
+var GRANTS_SQL = `
+SELECT table_schema AS object_schema,
+       table_name AS object_name,
+       privilege_type AS privilege,
+       grantee
+FROM information_schema.role_table_grants
+WHERE table_schema = ANY($1)
+UNION ALL
+SELECT routine_schema AS object_schema,
+       routine_name AS object_name,
+       privilege_type AS privilege,
+       grantee
+FROM information_schema.routine_privileges
+WHERE routine_schema = ANY($1)
+`;
+var POLCMD_MAP = {
+  r: "select",
+  a: "insert",
+  w: "update",
+  d: "delete",
+  "*": "all"
+};
+function extractSearchPath(config) {
+  if (!config)
+    return null;
+  const entry = config.find((item) => item.startsWith("search_path="));
+  if (!entry)
+    return null;
+  return entry.slice("search_path=".length);
+}
+async function readCatalog(executor, schemas = ["public"]) {
+  const params = [schemas];
+  const [tableRows, policyRows, functionRows, triggerRows, grantRows] = await Promise.all([
+    executor.query(TABLES_SQL, params),
+    executor.query(POLICIES_SQL, params),
+    executor.query(FUNCTIONS_SQL, params),
+    executor.query(TRIGGERS_SQL, params),
+    executor.query(GRANTS_SQL, params)
+  ]);
+  return {
+    tables: tableRows.map((row) => ({
+      schema: row.schema,
+      name: row.name,
+      rlsEnabled: row.rls_enabled,
+      rlsForced: row.rls_forced
+    })),
+    policies: policyRows.map((row) => ({
+      schema: row.schema,
+      table: row.table,
+      name: row.name,
+      command: POLCMD_MAP[row.command] ?? "all",
+      roles: row.roles ?? [],
+      usingExpr: row.using_expr ?? undefined,
+      checkExpr: row.check_expr ?? undefined
+    })),
+    functions: functionRows.map((row) => ({
+      schema: row.schema,
+      name: row.name,
+      security: row.security_definer ? "definer" : "invoker",
+      searchPath: extractSearchPath(row.config),
+      language: row.language
+    })),
+    triggers: triggerRows.map((row) => ({
+      schema: row.schema,
+      table: row.table,
+      name: row.name,
+      enabled: row.enabled
+    })),
+    grants: grantRows.map((row) => ({
+      objectSchema: row.object_schema,
+      objectName: row.object_name,
+      privilege: row.privilege,
+      grantee: row.grantee
+    }))
+  };
+}
+function splitQualifiedName(name) {
+  const dot = name.indexOf(".");
+  if (dot === -1)
+    return ["public", name];
+  return [name.slice(0, dot), name.slice(dot + 1)];
+}
+function isFixedSearchPath(searchPath) {
+  if (searchPath === null)
+    return false;
+  const parts = searchPath.split(",").map((part) => part.trim().replace(/^"|"$/g, ""));
+  return parts.every((part) => part !== "" && part.toLowerCase() !== "pg_temp");
+}
+function reconcileModule(module, catalog) {
+  const issues = [];
+  const ownedTables = new Set(module.tables);
+  const push = (severity, code, object, message) => issues.push({ severity, code, object, message });
+  for (const policy of module.policies) {
+    const [schema, table] = splitQualifiedName(policy.table);
+    const found = catalog.policies.some((cp) => cp.schema === schema && cp.table === table && cp.name === policy.name);
+    if (!found) {
+      push("error", "missing-policy", `${policy.table}.${policy.name}`, `声明的策略 ${policy.name} 在表 ${policy.table} 的 catalog 中不存在`);
+    }
+  }
+  const declaredPolicyKeys = new Set(module.policies.map((p) => `${p.table}::${p.name}`));
+  for (const cp of catalog.policies) {
+    const qualified = `${cp.schema}.${cp.table}`;
+    if (ownedTables.has(qualified) && !declaredPolicyKeys.has(`${qualified}::${cp.name}`)) {
+      push("warn", "undeclared-policy", `${qualified}.${cp.name}`, `归属表 ${qualified} 上存在未声明的策略 ${cp.name}，可能发生漂移`);
+    }
+  }
+  for (const fn of module.functions) {
+    const [schema, name] = splitQualifiedName(fn.name);
+    const cf = catalog.functions.find((f) => f.schema === schema && f.name === name);
+    if (!cf) {
+      push("error", "missing-function", fn.name, `声明的函数 ${fn.name} 在 catalog 中不存在`);
+      continue;
+    }
+    if (cf.security !== fn.security) {
+      push("warn", "security-mismatch", fn.name, `函数 ${fn.name} 声明为 security ${fn.security}，catalog 实际为 ${cf.security}`);
+    }
+    const effectiveDefiner = fn.security === "definer" || cf.security === "definer";
+    if (effectiveDefiner && !isFixedSearchPath(cf.searchPath)) {
+      push("error", "definer-without-search-path", fn.name, `security definer 函数 ${fn.name} 未设置固定 search_path（当前: ${cf.searchPath ?? "未设置"}）`);
+    }
+  }
+  for (const trigger of module.triggers) {
+    const [schema, table] = splitQualifiedName(trigger.table);
+    const found = catalog.triggers.some((ct) => ct.schema === schema && ct.table === table && ct.name === trigger.name);
+    if (!found) {
+      push("error", "missing-trigger", `${trigger.table}.${trigger.name}`, `声明的触发器 ${trigger.name} 在表 ${trigger.table} 的 catalog 中不存在`);
+    }
+  }
+  const declaredTriggerKeys = new Set(module.triggers.map((t) => `${t.table}::${t.name}`));
+  for (const ct of catalog.triggers) {
+    const qualified = `${ct.schema}.${ct.table}`;
+    if (ownedTables.has(qualified) && !declaredTriggerKeys.has(`${qualified}::${ct.name}`)) {
+      push("warn", "undeclared-trigger", `${qualified}.${ct.name}`, `归属表 ${qualified} 上存在未声明的触发器 ${ct.name}${ct.enabled ? "" : "（已禁用）"}，可能发生漂移`);
+    }
+  }
+  for (const table of module.tables) {
+    const [schema, name] = splitQualifiedName(table);
+    const ct = catalog.tables.find((t) => t.schema === schema && t.name === name);
+    if (ct && !ct.rlsEnabled) {
+      push("error", "rls-disabled", table, `归属表 ${table} 未开启行级安全（relrowsecurity = false）`);
+    }
+  }
+  for (const grant of catalog.grants) {
+    const qualified = `${grant.objectSchema}.${grant.objectName}`;
+    if (ownedTables.has(qualified) && grant.grantee.toUpperCase() === "PUBLIC") {
+      push("error", "wildcard-grant", qualified, `归属表 ${qualified} 存在授予 PUBLIC 的 ${grant.privilege} 权限`);
+    }
+  }
+  for (const grant of module.grants) {
+    const [schema, name] = splitQualifiedName(grant.object);
+    const found = catalog.grants.some((cg) => cg.objectSchema === schema && cg.objectName === name && cg.privilege.toLowerCase() === grant.privilege.toLowerCase() && cg.grantee.toLowerCase() === grant.role.toLowerCase());
+    if (!found) {
+      push("warn", "grant-drift", grant.object, `声明的授权 ${grant.privilege} ON ${grant.object} TO ${grant.role} 在 catalog 中不存在`);
+    }
+  }
+  return {
+    module: module.name,
+    issues,
+    ok: !issues.some((issue) => issue.severity === "error")
+  };
+}
+var SECURITY_DEFINER_RE = /\bsecurity\s+definer\b/i;
+var SET_SEARCH_PATH_RE = /\bset\s+search_path\b/i;
+var GRANT_TO_PUBLIC_RE = /\bgrant\b[^;]*\bto\s+public\b/i;
+var DROP_WITHOUT_IF_EXISTS_RE = /\bdrop\s+(?:table|column)\s+(?!if\s+exists\b)/i;
+var ENABLE_RLS_RE = /\benable\s+row\s+level\s+security\b/i;
+var CREATE_POLICY_RE = /\bcreate\s+policy\b/i;
+var DROP_POLICY_IF_EXISTS_RE = /\bdrop\s+policy\s+if\s+exists\b/i;
+function lineOf(sql, index) {
+  let line = 1;
+  for (let i = 0;i < index; i += 1) {
+    if (sql.charCodeAt(i) === 10)
+      line += 1;
+  }
+  return line;
+}
+function lintSql(sql, file) {
+  const issues = [];
+  const definer = SECURITY_DEFINER_RE.exec(sql);
+  if (definer && !SET_SEARCH_PATH_RE.test(sql)) {
+    issues.push({
+      severity: "error",
+      code: "definer-no-search-path",
+      message: "security definer 函数必须显式 set search_path，避免 search_path 劫持",
+      file,
+      line: lineOf(sql, definer.index)
+    });
+  }
+  const grantPublic = GRANT_TO_PUBLIC_RE.exec(sql);
+  if (grantPublic) {
+    issues.push({
+      severity: "error",
+      code: "grant-to-public",
+      message: "禁止将权限授予 PUBLIC 角色",
+      file,
+      line: lineOf(sql, grantPublic.index)
+    });
+  }
+  const drop = DROP_WITHOUT_IF_EXISTS_RE.exec(sql);
+  if (drop) {
+    issues.push({
+      severity: "warn",
+      code: "drop-without-if-exists",
+      message: "drop table/column 建议使用 if exists，保证迁移可重入",
+      file,
+      line: lineOf(sql, drop.index)
+    });
+  }
+  const createPolicy = CREATE_POLICY_RE.exec(sql);
+  if (createPolicy) {
+    const dropPolicy = DROP_POLICY_IF_EXISTS_RE.exec(sql);
+    if (!dropPolicy || dropPolicy.index > createPolicy.index) {
+      issues.push({
+        severity: "warn",
+        code: "non-idempotent-policy",
+        message: "create policy 前缺少 drop policy if exists，策略不可重复执行",
+        file,
+        line: lineOf(sql, createPolicy.index)
+      });
+    }
+  }
+  return issues;
+}
+async function lintModule(module, readFile) {
+  const issues = [];
+  const sources = new Set;
+  for (const decl of [
+    ...module.policies,
+    ...module.functions,
+    ...module.triggers,
+    ...module.grants
+  ]) {
+    sources.add(decl.source);
+  }
+  const contents = new Map;
+  await Promise.all([...sources].map(async (path) => {
+    contents.set(path, await readFile(path));
+  }));
+  for (const [file, sql] of contents) {
+    issues.push(...lintSql(sql, file));
+  }
+  if (module.policies.length > 0) {
+    const anyEnable = module.policies.some((policy) => ENABLE_RLS_RE.test(contents.get(policy.source) ?? ""));
+    if (!anyEnable) {
+      issues.push({
+        severity: "warn",
+        code: "missing-rls-enable",
+        message: `模块 ${module.name} 声明了 ${module.policies.length} 条策略，但所有策略源文件都没有 enable row level security`,
+        file: module.policies[0].source
+      });
+    }
+  }
+  for (const policy of module.policies) {
+    if (!policy.tests || policy.tests.length === 0) {
+      issues.push({
+        severity: "warn",
+        code: "policy-without-test",
+        message: `策略 ${policy.name} 未声明测试文件`,
+        file: policy.source
+      });
+    }
+  }
+  for (const fn of module.functions) {
+    if (!fn.tests || fn.tests.length === 0) {
+      issues.push({
+        severity: "warn",
+        code: "policy-without-test",
+        message: `函数 ${fn.name} 未声明测试文件`,
+        file: fn.source
+      });
+    }
+  }
+  return issues;
+}
+function buildDatabaseManifest(modules) {
+  return {
+    version: 1,
+    modules: modules.map((module) => ({
+      name: module.name,
+      tables: module.tables,
+      policies: module.policies,
+      functions: module.functions,
+      triggers: module.triggers,
+      grants: module.grants
+    }))
+  };
+}
+function describePolicy(moduleName, policy) {
+  const lines = [
+    `对象: ${policy.table}.${policy.name}`,
+    "类型: 策略 (policy)",
+    `所属模块: ${moduleName}`,
+    `表: ${policy.table}`,
+    `操作: ${policy.operation}`,
+    `角色: ${policy.roles.join(", ")}`,
+    `源文件: ${policy.source}`
+  ];
+  if (policy.tests && policy.tests.length > 0)
+    lines.push(`测试: ${policy.tests.join(", ")}`);
+  return lines.join(`
+`);
+}
+function describeFunction(moduleName, fn) {
+  const lines = [
+    `对象: ${fn.name}`,
+    "类型: 函数 (function)",
+    `所属模块: ${moduleName}`,
+    `源文件: ${fn.source}`,
+    `安全模式: ${fn.security}`
+  ];
+  if (fn.permission)
+    lines.push(`权限: ${fn.permission}`);
+  if (fn.transaction)
+    lines.push(`事务: ${fn.transaction}`);
+  if (fn.audit)
+    lines.push(`审计: ${fn.audit}`);
+  if (fn.idempotency)
+    lines.push(`幂等: ${fn.idempotency}`);
+  if (fn.tests && fn.tests.length > 0)
+    lines.push(`测试: ${fn.tests.join(", ")}`);
+  return lines.join(`
+`);
+}
+function describeTrigger(moduleName, trigger) {
+  return [
+    `对象: ${trigger.name}`,
+    "类型: 触发器 (trigger)",
+    `所属模块: ${moduleName}`,
+    `表: ${trigger.table}`,
+    `源文件: ${trigger.source}`
+  ].join(`
+`);
+}
+function describeGrant(moduleName, grant) {
+  return [
+    `对象: ${grant.object}`,
+    "类型: 授权 (grant)",
+    `所属模块: ${moduleName}`,
+    `权限: ${grant.privilege}`,
+    `角色: ${grant.role}`,
+    `源文件: ${grant.source}`
+  ].join(`
+`);
+}
+function explainObject(manifest, name) {
+  for (const module of manifest.modules) {
+    for (const policy of module.policies) {
+      if (policy.name === name || `${policy.table}.${policy.name}` === name) {
+        return describePolicy(module.name, policy);
+      }
+    }
+    for (const fn of module.functions) {
+      if (fn.name === name)
+        return describeFunction(module.name, fn);
+    }
+    for (const trigger of module.triggers) {
+      if (trigger.name === name || `${trigger.table}.${trigger.name}` === name) {
+        return describeTrigger(module.name, trigger);
+      }
+    }
+    for (const table of module.tables) {
+      if (table === name) {
+        return [
+          `对象: ${table}`,
+          "类型: 表 (table)",
+          `所属模块: ${module.name}`
+        ].join(`
+`);
+      }
+    }
+    for (const grant of module.grants) {
+      if (grant.object === name)
+        return describeGrant(module.name, grant);
+    }
+  }
+  return `未找到对象: ${name}`;
+}
+var COMMAND_PERSISTENCE_SQL = `
+DO $runtime$
+BEGIN
+  IF to_regprocedure('supacloud_workflows.start_run(uuid,text,text,text,jsonb,integer)') IS NULL
+    OR to_regprocedure('supacloud_commands.status(jsonb)') IS NULL THEN
+    RAISE EXCEPTION 'Install the SupaCloud Commands/Workflow/PGMQ runtime before command persistence';
+  END IF;
+END
+$runtime$;
+CREATE SCHEMA IF NOT EXISTS supacloud_commands;
+REVOKE ALL ON SCHEMA supacloud_commands FROM PUBLIC;
+CREATE TABLE IF NOT EXISTS supacloud_commands.execution_receipts (
+  tenant_id text NOT NULL,
+  actor_id text NOT NULL,
+  command text NOT NULL,
+  operation_key text NOT NULL,
+  kind text NOT NULL CHECK (kind IN ('transactional', 'external')),
+  input_fingerprint text NOT NULL CHECK (input_fingerprint ~ '^[a-f0-9]{64}$'),
+  input_payload text,
+  dispatch_key uuid NOT NULL DEFAULT gen_random_uuid() UNIQUE,
+  status text NOT NULL CHECK (status IN ('pending', 'unknown', 'confirmed', 'rejected')),
+  audit_state text NOT NULL CHECK (audit_state IN ('pending', 'complete')),
+  result jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, actor_id, command, operation_key),
+  CHECK ((status = 'confirmed') = (result IS NOT NULL)),
+  CONSTRAINT execution_receipts_audit_terminal_check CHECK (
+    (audit_state <> 'complete' OR status IN ('confirmed', 'rejected'))
+    AND (status <> 'rejected' OR audit_state = 'complete')),
+  CONSTRAINT execution_receipts_transactional_check CHECK (
+    kind <> 'transactional' OR (status = 'confirmed' AND audit_state = 'complete'))
+);
+CREATE TABLE IF NOT EXISTS supacloud_commands.execution_audit (
+  tenant_id text NOT NULL,
+  actor_id text NOT NULL,
+  command text NOT NULL,
+  operation_key text NOT NULL,
+  event text NOT NULL,
+  details jsonb NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, actor_id, command, operation_key),
+  FOREIGN KEY (tenant_id, actor_id, command, operation_key)
+    REFERENCES supacloud_commands.execution_receipts (tenant_id, actor_id, command, operation_key)
+);
+REVOKE ALL ON supacloud_commands.execution_receipts, supacloud_commands.execution_audit FROM PUBLIC;
+CREATE OR REPLACE FUNCTION supacloud_commands.protect_terminal_execution()
+RETURNS trigger LANGUAGE plpgsql SET search_path = '' AS $terminal$
+BEGIN
+  IF OLD.status IN ('confirmed','rejected') AND (
+    NEW.status IS DISTINCT FROM OLD.status OR NEW.result IS DISTINCT FROM OLD.result
+    OR (OLD.audit_state = 'complete' AND NEW.audit_state IS DISTINCT FROM OLD.audit_state)) THEN
+    RAISE EXCEPTION 'SUPACLOUD_COMMAND_TERMINAL_RECEIPT';
+  END IF;
+  RETURN NEW;
+END
+$terminal$;
+CREATE OR REPLACE TRIGGER execution_terminal_guard
+BEFORE UPDATE ON supacloud_commands.execution_receipts
+FOR EACH ROW EXECUTE FUNCTION supacloud_commands.protect_terminal_execution();
+
+CREATE OR REPLACE FUNCTION supacloud_commands.require_rejection_audit()
+RETURNS trigger LANGUAGE plpgsql SET search_path = '' AS $rejection$
+BEGIN
+  IF NEW.status = 'rejected' AND NOT EXISTS (
+    SELECT FROM supacloud_commands.execution_audit a
+    WHERE a.tenant_id=NEW.tenant_id AND a.actor_id=NEW.actor_id
+      AND a.command=NEW.command AND a.operation_key=NEW.operation_key
+  ) THEN
+    RAISE EXCEPTION 'SUPACLOUD_COMMAND_REJECTION_AUDIT_REQUIRED';
+  END IF;
+  RETURN NEW;
+END
+$rejection$;
+DROP TRIGGER IF EXISTS execution_rejection_audit ON supacloud_commands.execution_receipts;
+CREATE CONSTRAINT TRIGGER execution_rejection_audit
+AFTER INSERT OR UPDATE ON supacloud_commands.execution_receipts
+DEFERRABLE INITIALLY DEFERRED
+FOR EACH ROW WHEN (NEW.status = 'rejected')
+EXECUTE FUNCTION supacloud_commands.require_rejection_audit();
+CREATE OR REPLACE FUNCTION supacloud_commands.enqueue_execution_recovery()
+RETURNS trigger LANGUAGE plpgsql SET search_path = '' AS $recovery$
+DECLARE submission jsonb;
+BEGIN
+  PERFORM pg_advisory_xact_lock(hashtextextended(NEW.dispatch_key::text,0));
+  SELECT supacloud_commands.snapshot(NEW.dispatch_key,false) INTO submission;
+  IF submission IS NOT NULL THEN
+    IF submission->>'commandType' IS DISTINCT FROM NEW.command
+      OR submission->>'actorId' IS DISTINCT FROM NEW.actor_id
+      OR submission->>'tenantId' IS DISTINCT FROM NEW.tenant_id
+      OR NEW.operation_key <> NEW.dispatch_key::text THEN
+      RAISE EXCEPTION 'SUPACLOUD_COMMAND_IDENTITY_CONFLICT';
+    END IF;
+    RETURN NEW;
+  END IF;
+  IF NEW.kind = 'external' AND NEW.status <> 'rejected'
+    AND (NEW.status <> 'confirmed' OR NEW.audit_state <> 'complete') THEN
+    PERFORM supacloud_workflows.start_run(
+      NEW.dispatch_key, 'supacloud.command.reconcile', '1', 'reconcile',
+      jsonb_build_object('commandId', NEW.dispatch_key, 'tenantId', NEW.tenant_id,
+        'actorId', NEW.actor_id, 'command', NEW.command, 'operationId', NEW.operation_key),
+      20
+    );
+  END IF;
+  RETURN NEW;
+END
+$recovery$;
+CREATE OR REPLACE TRIGGER execution_recovery_enqueue
+AFTER INSERT ON supacloud_commands.execution_receipts
+FOR EACH ROW EXECUTE FUNCTION supacloud_commands.enqueue_execution_recovery();
+
+CREATE OR REPLACE FUNCTION supacloud_commands.execution_status(request jsonb)
+RETURNS jsonb LANGUAGE sql STABLE SECURITY DEFINER SET search_path = '' AS $status$
+  SELECT jsonb_build_object('kind','execution','commandId',r.dispatch_key,
+    'execution',jsonb_build_object('tenantId',r.tenant_id,'actorId',r.actor_id,
+      'command',r.command,'operationId',r.operation_key,'dispatchKey',r.dispatch_key,
+      'status',r.status,'audit',r.audit_state)
+      || CASE WHEN r.status='confirmed' THEN jsonb_build_object('result',r.result) ELSE '{}'::jsonb END,
+    'workflow',CASE WHEN w.id IS NULL THEN NULL ELSE jsonb_build_object('runId',w.id,'status',w.status) END)
+  FROM supacloud_commands.execution_receipts r
+  LEFT JOIN supacloud_workflows.runs w ON w.id=r.dispatch_key
+  WHERE CASE WHEN request ? 'commandId' THEN r.dispatch_key::text=request->>'commandId'
+    ELSE r.tenant_id=request->>'tenantId' AND r.actor_id=request->>'actorId'
+      AND r.command=request->>'command' AND r.operation_key=request->>'operationId' END
+$status$;
+REVOKE ALL ON FUNCTION supacloud_commands.execution_status(jsonb) FROM PUBLIC;
+`;
+var COMMAND_PERSISTENCE_UPGRADE_SQL = `
+ALTER TABLE supacloud_commands.execution_receipts
+  ADD COLUMN IF NOT EXISTS input_fingerprint text,
+  ADD COLUMN IF NOT EXISTS input_payload text;
+DO $migration$
+BEGIN
+  IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema='supacloud_commands'
+    AND table_name='execution_receipts' AND column_name='input_key') THEN
+    EXECUTE 'UPDATE supacloud_commands.execution_receipts
+      SET input_fingerprint=encode(sha256(convert_to(input_key,''UTF8'')),''hex''),input_payload=input_key
+      WHERE input_fingerprint IS NULL';
+    ALTER TABLE supacloud_commands.execution_receipts DROP COLUMN input_key;
+  END IF;
+END
+$migration$;
+ALTER TABLE supacloud_commands.execution_receipts ALTER COLUMN input_fingerprint SET NOT NULL;
+ALTER TABLE supacloud_commands.execution_receipts
+  DROP CONSTRAINT IF EXISTS execution_receipts_status_check,
+  DROP CONSTRAINT IF EXISTS execution_receipts_check1,
+  DROP CONSTRAINT IF EXISTS execution_receipts_transactional_check,
+  DROP CONSTRAINT IF EXISTS execution_receipts_audit_terminal_check;
+ALTER TABLE supacloud_commands.execution_receipts
+  ADD CONSTRAINT execution_receipts_status_check CHECK (status IN ('pending','unknown','confirmed','rejected')),
+  ADD CONSTRAINT execution_receipts_transactional_check CHECK (
+    kind <> 'transactional' OR (status = 'confirmed' AND audit_state = 'complete')),
+  ADD CONSTRAINT execution_receipts_audit_terminal_check CHECK (
+    (audit_state <> 'complete' OR status IN ('confirmed','rejected'))
+    AND (status <> 'rejected' OR audit_state = 'complete'));
+DO $constraint$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint
+    WHERE conrelid='supacloud_commands.execution_receipts'::regclass
+      AND conname='execution_receipts_input_fingerprint_check') THEN
+    ALTER TABLE supacloud_commands.execution_receipts
+      ADD CONSTRAINT execution_receipts_input_fingerprint_check CHECK (input_fingerprint ~ '^[a-f0-9]{64}$');
+  END IF;
+END
+$constraint$;
+${COMMAND_PERSISTENCE_SQL}
+DO $backfill$
+DECLARE r record;
+BEGIN
+  FOR r IN SELECT * FROM supacloud_commands.execution_receipts
+    WHERE kind='external' AND status<>'rejected' AND (status<>'confirmed' OR audit_state<>'complete')
+      AND NOT EXISTS(SELECT FROM supacloud_workflows.runs w WHERE w.id=dispatch_key)
+  LOOP
+    PERFORM supacloud_workflows.start_run(
+      r.dispatch_key,'supacloud.command.reconcile','1','reconcile',
+      jsonb_build_object('commandId',r.dispatch_key,'tenantId',r.tenant_id,
+        'actorId',r.actor_id,'command',r.command,'operationId',r.operation_key),20
+    );
+  END LOOP;
+END
+$backfill$;
+DROP INDEX IF EXISTS supacloud_commands.execution_pending_recovery;
+ALTER TABLE supacloud_commands.execution_receipts
+  DROP COLUMN IF EXISTS lease_id,
+  DROP COLUMN IF EXISTS lease_until,
+  DROP COLUMN IF EXISTS next_attempt_at,
+  DROP COLUMN IF EXISTS recovery_attempts;
+`;
+var MAX_MIGRATION_VERSION = 9223372036854775807n;
+function sha2562(value) {
+  return createHash22("sha256").update(value).digest("hex");
+}
+function normalizedSql(value) {
+  return value.replace(/\r\n?/g, `
+`).trimEnd() + `
+`;
+}
+function validVersion(value) {
+  if (!/^\d{1,19}$/.test(value))
+    return false;
+  const version = BigInt(value);
+  return version > 0n && version <= MAX_MIGRATION_VERSION;
+}
+function migrationVersion(file) {
+  const match = basename2(file).match(/^(\d{8,19})[_-]/);
+  if (!match || !validVersion(match[1]))
+    throw new Error(`Invalid migration version in ${file}`);
+  return BigInt(match[1]).toString();
+}
+function migrationName(file) {
+  return basename2(file, ".sql").replace(/^\d{8,19}[_-]/, "");
+}
+function sortMigrations(migrations) {
+  const sorted = [...migrations].sort((left, right) => {
+    const leftVersion = BigInt(left.version);
+    const rightVersion = BigInt(right.version);
+    if (leftVersion !== rightVersion)
+      return leftVersion < rightVersion ? -1 : 1;
+    return left.file.localeCompare(right.file);
+  });
+  for (let index = 1;index < sorted.length; index += 1) {
+    if (sorted[index - 1].version === sorted[index].version) {
+      throw new Error(`Duplicate migration version ${sorted[index].version}`);
+    }
+  }
+  return sorted;
+}
+function planMigrationRebase(migrations, options, baselineSql) {
+  const sorted = sortMigrations([...migrations]);
+  if (!sorted.length)
+    throw new Error("No migration files found");
+  if (!validVersion(options.baselineVersion))
+    throw new Error("Invalid baseline version");
+  if (options.retainAfterVersion !== undefined && !validVersion(options.retainAfterVersion)) {
+    throw new Error("Invalid retain-after version");
+  }
+  const baselineName = options.baselineName?.trim() || "reconstructed_schema";
+  if (!/^[a-z0-9][a-z0-9_-]*$/.test(baselineName))
+    throw new Error("Invalid baseline name");
+  const baselineMigration = `${options.baselineVersion}_${baselineName}.sql`;
+  if (sorted.some((migration) => migration.version === options.baselineVersion)) {
+    throw new Error(`Baseline version ${options.baselineVersion} collides with existing history`);
+  }
+  const retainAfter = options.retainAfterVersion === undefined ? null : BigInt(options.retainAfterVersion);
+  const retained = sorted.filter((migration) => retainAfter !== null && BigInt(migration.version) > retainAfter);
+  const archived = sorted.filter((migration) => !retained.includes(migration));
+  const normalizedBaseline = normalizedSql(baselineSql);
+  if (!normalizedBaseline.trim())
+    throw new Error("Baseline SQL is empty");
+  if (!/\bCREATE\b/i.test(normalizedBaseline))
+    throw new Error("Baseline SQL does not look like a schema snapshot");
+  const sourceHistory = sorted.map((migration) => ({
+    file: migration.file,
+    version: migration.version,
+    name: migration.name,
+    sha256: sha2562(normalizedSql(migration.sql))
+  }));
+  return {
+    version: 1,
+    sourceDirectory: options.sourceDirectory,
+    outputDirectory: options.outputDirectory,
+    baselineFile: options.baselineFile,
+    baselineMigration,
+    retainedMigrations: retained.map((migration) => migration.file),
+    archivedMigrations: archived.map((migration) => migration.file),
+    sourceHistorySha256: sha2562(JSON.stringify(sourceHistory)),
+    baselineSha256: sha2562(normalizedBaseline),
+    warnings: [
+      "The baseline must come from a schema-only snapshot of the verified target database.",
+      "Data backfills, reference data and non-replayable side effects need a separate review.",
+      "Archive the old migration directory until clean replay and remote read-back have passed."
+    ]
+  };
+}
+async function rebaseMigrations(options) {
+  const sourceDirectory = resolve5(options.sourceDirectory);
+  const outputDirectory = resolve5(options.outputDirectory);
+  const baselineFile = resolve5(options.baselineFile);
+  if (!(await stat(sourceDirectory)).isDirectory())
+    throw new Error("Source migration directory is not a directory");
+  if (!(await stat(baselineFile)).isFile())
+    throw new Error("Baseline file is not a file");
+  if (sourceDirectory === outputDirectory)
+    throw new Error("Output directory must be separate from source directory");
+  const files = (await readdir3(sourceDirectory)).filter((file) => file.endsWith(".sql")).sort();
+  const migrations = await Promise.all(files.map(async (file) => {
+    const sql = await readFile2(join3(sourceDirectory, file), "utf8");
+    return { file, version: migrationVersion(file), name: migrationName(file), sql };
+  }));
+  const plan = planMigrationRebase(migrations, { ...options, sourceDirectory, outputDirectory, baselineFile }, await readFile2(baselineFile, "utf8"));
+  await mkdir2(outputDirectory, { recursive: true });
+  await writeFile2(join3(outputDirectory, plan.baselineMigration), normalizedSql(await readFile2(baselineFile, "utf8")));
+  for (const migration of migrations.filter((item) => plan.retainedMigrations.includes(item.file))) {
+    await writeFile2(join3(outputDirectory, migration.file), normalizedSql(migration.sql));
+  }
+  await writeFile2(join3(outputDirectory, "migration-rebase.manifest.json"), JSON.stringify({
+    ...plan,
+    generatedAt: new Date().toISOString(),
+    sourceHistory: migrations.map((migration) => ({
+      file: migration.file,
+      version: migration.version,
+      name: migration.name,
+      sha256: sha2562(normalizedSql(migration.sql))
+    }))
+  }, null, 2) + `
+`);
+  return plan;
+}
+
 // src/shared/project-ref.ts
 var PROJECT_REF_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
 function projectRefPathSegment(ref, operation) {
@@ -209782,19 +210524,19 @@ function formatMigrationRiskReport(analysis) {
 
 // src/shared/tools/migration-import.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync, statSync } from "node:fs";
-import { mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename2, join as join3 } from "node:path";
+import { mkdir as mkdir3, writeFile as writeFile3 } from "node:fs/promises";
+import { basename as basename3, join as join4 } from "node:path";
 async function writeMigrationImportPlan(plan, outputDirectory) {
   if (!outputDirectory.trim())
     throw new Error("Migration import output directory is required");
-  await mkdir2(outputDirectory, { recursive: true });
+  await mkdir3(outputDirectory, { recursive: true });
   const written = [];
   for (const file of plan.files) {
     if (!/^[A-Za-z0-9_.-]+\.sql$/.test(file.file) || file.file.includes("..")) {
       throw new Error(`Unsafe migration import filename: ${file.file}`);
     }
-    const path = join3(outputDirectory, file.file);
-    await writeFile2(path, file.sql, { flag: "wx", encoding: "utf8" });
+    const path = join4(outputDirectory, file.file);
+    await writeFile3(path, file.sql, { flag: "wx", encoding: "utf8" });
     written.push(path);
   }
   return written;
@@ -209805,8 +210547,8 @@ function record3(value) {
 function sqlFile(file, root, source) {
   return {
     file,
-    name: basename2(file, ".sql"),
-    sql: readFileSync2(join3(root, file), "utf8"),
+    name: basename3(file, ".sql"),
+    sql: readFileSync2(join4(root, file), "utf8"),
     source: "sql"
   };
 }
@@ -209908,7 +210650,7 @@ function createMigrationImportPlan(input) {
 }
 
 // src/shared/tools/database-tools.ts
-var MAX_MIGRATION_VERSION = 9223372036854775807n;
+var MAX_MIGRATION_VERSION2 = 9223372036854775807n;
 var FALLBACK_MIGRATION_VERSION_BASE = 8000000000000000000n;
 var FALLBACK_MIGRATION_VERSION_RANGE = 1000000000000000000n;
 var FALLBACK_MIGRATION_VERSION_LIMIT = FALLBACK_MIGRATION_VERSION_BASE + FALLBACK_MIGRATION_VERSION_RANGE;
@@ -209918,7 +210660,7 @@ function isMigrationInventoryVersion(version) {
   if (typeof version !== "string" || !/^\d{1,19}$/.test(version))
     return false;
   const numericVersion = BigInt(version);
-  return numericVersion >= 1n && numericVersion <= MAX_MIGRATION_VERSION && numericVersion.toString() === version;
+  return numericVersion >= 1n && numericVersion <= MAX_MIGRATION_VERSION2 && numericVersion.toString() === version;
 }
 function isMigrationInventoryName(name) {
   return name === null || typeof name === "string" && name.length <= 255 && name.length > 0 && name.trim() === name;
@@ -210013,28 +210755,28 @@ function migrationInventoryResponse(response) {
   return { content: [{ type: "text", text: JSON.stringify(inventory, null, 2) }] };
 }
 function readMigrationFile(dir, file) {
-  const rawBytes = readFileSync3(join4(dir, file));
+  const rawBytes = readFileSync3(join5(dir, file));
   return {
     file,
-    name: basename3(file, ".sql"),
+    name: basename4(file, ".sql"),
     version: migrationVersionFromFilename(file),
     sql: Buffer.from(rawBytes).toString("utf8"),
     rawBytes
   };
 }
 function migrationVersionFromFilename(file) {
-  const match = basename3(file).match(/^(\d{8,20})[_-]/);
+  const match = basename4(file).match(/^(\d{8,20})[_-]/);
   if (match) {
     const version = BigInt(match[1]);
-    if (version < 1n || version > MAX_MIGRATION_VERSION) {
-      throw new Error(`Invalid migration version '${match[1]}' in ${basename3(file)}: expected 1..${MAX_MIGRATION_VERSION}`);
+    if (version < 1n || version > MAX_MIGRATION_VERSION2) {
+      throw new Error(`Invalid migration version '${match[1]}' in ${basename4(file)}: expected 1..${MAX_MIGRATION_VERSION2}`);
     }
     if (version >= FALLBACK_MIGRATION_VERSION_BASE && version < FALLBACK_MIGRATION_VERSION_LIMIT) {
-      throw new Error(`Invalid migration version '${match[1]}' in ${basename3(file)}: version range ${FALLBACK_MIGRATION_VERSION_BASE}..${FALLBACK_MIGRATION_VERSION_LIMIT - 1n} is reserved for non-timestamp migrations`);
+      throw new Error(`Invalid migration version '${match[1]}' in ${basename4(file)}: version range ${FALLBACK_MIGRATION_VERSION_BASE}..${FALLBACK_MIGRATION_VERSION_LIMIT - 1n} is reserved for non-timestamp migrations`);
     }
     return version.toString();
   }
-  const digest = createHash3("sha256").update(basename3(file)).digest("hex");
+  const digest = createHash3("sha256").update(basename4(file)).digest("hex");
   const offset = BigInt(`0x${digest}`) % FALLBACK_MIGRATION_VERSION_RANGE;
   return (FALLBACK_MIGRATION_VERSION_BASE + offset).toString();
 }
@@ -210310,7 +211052,7 @@ function vectorWarningsForPendingMigrations(migrations, vectorEnabled) {
 }
 function registerDatabaseTools(server2, http, config = {}) {
   const { localOnly = false, readOnly = false, projectRef } = config;
-  const localActions = ["lint_migrations", "lint"];
+  const localActions = ["lint_migrations", "lint", "rebase_migrations"];
   const readActions = [
     "query",
     "list_tables",
@@ -210348,7 +211090,7 @@ Actions: ${allActions.join(", ")}${localOnly ? " (local-only mode)" : readOnly ?
     file: optional(String2(), "[query/execute/apply_migration/lint_migrations/lint] Read SQL from local file path (avoids shell escaping issues with $$ and multi-statement DDL)"),
     mode: optional(stringEnum(["read", "migration", "admin"]), "[query/execute] SQL execution mode: read, migration, or admin. execute defaults to migration; query defaults to read/auto"),
     admin: optional(Boolean2(), "[query/execute] Admin execution flag (required when mode=admin)"),
-    dir: optional(String2(), "[push_migrations/baseline_migrations/lint_migrations/lint] Directory containing .sql migration files (default: supabase/migrations)"),
+    dir: optional(String2(), "[push_migrations/baseline_migrations/lint_migrations/lint/rebase_migrations] Directory containing .sql migration files (default: supabase/migrations)"),
     dry_run: optional(Boolean2(), "[push_migrations/baseline_migrations] Preview changes without applying them"),
     strict: optional(Boolean2(), "[push_migrations/lint_migrations/lint/database_lint] Exit with error if high-risk issues or migrations are detected"),
     fail_on_high: optional(Boolean2(), "[push_migrations/lint_migrations/lint/database_lint] Alias for --strict"),
@@ -210366,6 +211108,10 @@ Actions: ${allActions.join(", ")}${localOnly ? " (local-only mode)" : readOnly ?
     metadata_file: optional(String2(), "[migration_import] Hasura metadata JSON file"),
     output_dir: optional(String2(), "[migration_import] Output migration directory when write=true"),
     write: optional(Boolean2(), "[migration_import] Write the reviewed plan to output_dir; never applies SQL"),
+    baseline_file: optional(String2(), "[rebase_migrations] Reviewed schema-only snapshot to use as the new baseline"),
+    baseline_version: optional(String2(), "[rebase_migrations] New migration version for the baseline"),
+    baseline_name: optional(String2(), "[rebase_migrations] New baseline migration name"),
+    retain_after_version: optional(String2(), "[rebase_migrations] Retain migrations newer than this version"),
     columns: optional(String2(), "[create_table_rls] Column definitions"),
     policy_mode: optional(stringEnum(["deny_all", "owner"]), "[create_table_rls] RLS policy mode (default: deny_all)"),
     owner_column: optional(String2(), "[create_table_rls owner] UUID owner column matched to auth.uid()"),
@@ -210383,6 +211129,34 @@ Actions: ${allActions.join(", ")}${localOnly ? " (local-only mode)" : readOnly ?
     const ref = args.ref || projectRef;
     const schema = args.schema || "public";
     const schemas = args.schemas || ["public"];
+    if (action === "rebase_migrations") {
+      const sourceDirectory = args.dir || "supabase/migrations";
+      const outputDirectory = args.output_dir;
+      const baselineFile = args.baseline_file;
+      const baselineVersion = args.baseline_version;
+      if (typeof outputDirectory !== "string" || typeof baselineFile !== "string" || typeof baselineVersion !== "string") {
+        throw new Error("rebase_migrations requires output_dir, baseline_file and baseline_version");
+      }
+      const options = {
+        sourceDirectory,
+        outputDirectory,
+        baselineFile,
+        baselineVersion,
+        ...typeof args.baseline_name === "string" ? { baselineName: args.baseline_name } : {},
+        ...typeof args.retain_after_version === "string" ? { retainAfterVersion: args.retain_after_version } : {}
+      };
+      if (args.write !== true) {
+        const files = readdirSync2(sourceDirectory).filter((file) => file.endsWith(".sql")).sort();
+        const migrations = files.map((file) => {
+          const migration = readMigrationFile(sourceDirectory, file);
+          return { file, version: migration.version, name: migration.name, sql: migration.sql };
+        });
+        const plan = planMigrationRebase(migrations, options, readFileSync3(baselineFile, "utf8"));
+        return { content: [{ type: "text", text: JSON.stringify({ mode: "plan", ...plan }, null, 2) }] };
+      }
+      const plan = await rebaseMigrations(options);
+      return { content: [{ type: "text", text: JSON.stringify({ mode: "written", ...plan }, null, 2) }] };
+    }
     if (action === "delivery_migration_plan") {
       const failure = (code, httpStatus = null) => ({
         isError: true,
@@ -211988,7 +212762,7 @@ function registerOAuthClientTools(server2, http) {
 
 // src/shared/tools/storage-tools.ts
 import { existsSync as existsSync4, openAsBlob, readFileSync as readFileSync4, statSync as statSync3 } from "node:fs";
-import { basename as basename4, resolve as resolve5 } from "node:path";
+import { basename as basename5, resolve as resolve6 } from "node:path";
 var MAX_BUCKET_ID_LENGTH = 100;
 var MAX_MIME_TYPE_COUNT = 100;
 var MAX_MIME_TYPE_LENGTH = 255;
@@ -212447,7 +213221,7 @@ Actions: status, list_buckets, get_bucket, create_bucket, update_bucket, delete_
         if (typeof rawFilePath !== "string" || !rawFilePath.trim()) {
           throw new Error(`'file_path' (or '--file') required for '${action}'`);
         }
-        const resolvedFilePath = resolve5(process.cwd(), rawFilePath.trim());
+        const resolvedFilePath = resolve6(process.cwd(), rawFilePath.trim());
         if (!existsSync4(resolvedFilePath)) {
           throw new Error(`File not found: ${resolvedFilePath}`);
         }
@@ -212455,7 +213229,7 @@ Actions: status, list_buckets, get_bucket, create_bucket, update_bucket, delete_
         if (!stat.isFile()) {
           throw new Error(`Path is not a regular file: ${resolvedFilePath}`);
         }
-        const filename = typeof args.filename === "string" && args.filename.trim() ? args.filename.trim() : basename4(resolvedFilePath);
+        const filename = typeof args.filename === "string" && args.filename.trim() ? args.filename.trim() : basename5(resolvedFilePath);
         const mimeType = typeof args.mime_type === "string" && args.mime_type.trim() ? args.mime_type.trim() : "application/octet-stream";
         let timeoutMs = DEFAULT_UPLOAD_TIMEOUT_MS;
         if (args.timeout_ms !== undefined) {
@@ -212503,7 +213277,7 @@ import {
   writeFileSync
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename as basename5, join as join5, relative as relative2, resolve as resolve6, sep as sep2 } from "node:path";
+import { basename as basename6, join as join6, relative as relative2, resolve as resolve7, sep as sep2 } from "node:path";
 
 // src/shared/tools/edge-function-response.ts
 var CANONICAL_VERSION_PATTERN = /^(?:0|[1-9][0-9]*)$/;
@@ -212806,13 +213580,13 @@ function scaffoldFunction(pathArg, slug, framework) {
   if (typeof framework !== "string" || !FUNCTION_FRAMEWORKS2.includes(framework)) {
     throw new Error("'framework' required for 'scaffold'");
   }
-  const target = resolve6(typeof pathArg === "string" ? pathArg : join5("supabase", "functions", slug));
+  const target = resolve7(typeof pathArg === "string" ? pathArg : join6("supabase", "functions", slug));
   if (existsSync5(target))
     throw new Error(`Scaffold target already exists: ${target}`);
   const files = scaffoldFiles(framework, slug);
   for (const [relativePath, contents] of Object.entries(files)) {
-    const destination = join5(target, relativePath);
-    mkdirSync(resolve6(destination, ".."), { recursive: true });
+    const destination = join6(target, relativePath);
+    mkdirSync(resolve7(destination, ".."), { recursive: true });
     writeFileSync(destination, contents, { flag: "wx" });
   }
   return JSON.stringify({ success: true, framework, path: target, files: Object.keys(files) }, null, 2);
@@ -212857,7 +213631,7 @@ function assertExpectedSha256(bytes, expectedSha256) {
   }
 }
 function readVerifiedPrebundledCode(pathArg, expectedSha256) {
-  const descriptor = openSync(resolve6(pathArg), fsConstants.O_RDONLY | fsConstants.O_NONBLOCK);
+  const descriptor = openSync(resolve7(pathArg), fsConstants.O_RDONLY | fsConstants.O_NONBLOCK);
   try {
     const identityBeforeRead = openFileIdentity(descriptor);
     const bytes = readFileSync5(descriptor);
@@ -212883,7 +213657,7 @@ function readBundleDirectory(root, directory = root) {
   const files = {};
   const entries = readdirSync3(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
   for (const entry of entries) {
-    const entryPath = join5(directory, entry.name);
+    const entryPath = join6(directory, entry.name);
     const bundlePath = canonicalBundlePath(root, entryPath);
     const entryState = lstatSync(entryPath);
     if (entryState.isSymbolicLink())
@@ -212906,7 +213680,7 @@ function preparedBundleFiles(args) {
   }
   if (typeof bundleDirectory !== "string")
     return files;
-  const resolvedDirectory = resolve6(bundleDirectory);
+  const resolvedDirectory = resolve7(bundleDirectory);
   const rootState = lstatSync(resolvedDirectory);
   if (rootState.isSymbolicLink() || !rootState.isDirectory()) {
     throw new Error("'--bundle-dir' must be a regular directory and must not be a symlink");
@@ -212944,8 +213718,8 @@ async function runBunBuild(args) {
 }
 async function bundleEdgeFunctionPath(pathArg) {
   const entrypoint = resolveEntrypoint(pathArg);
-  const tmpDir = mkdtempSync(join5(tmpdir(), "supacloud-edge-"));
-  const outfile = join5(tmpDir, `${basename5(entrypoint).replace(/\.[^.]+$/, "") || "index"}.js`);
+  const tmpDir = mkdtempSync(join6(tmpdir(), "supacloud-edge-"));
+  const outfile = join6(tmpDir, `${basename6(entrypoint).replace(/\.[^.]+$/, "") || "index"}.js`);
   try {
     const { stderr } = await runBunBuild([entrypoint, "--target", "bun", "--outfile", outfile]);
     const outFileHandle = Bun.file(outfile);
@@ -213008,11 +213782,11 @@ function rejectActionSpecificFlags(action, args) {
   }
 }
 function resolveEntrypoint(pathArg) {
-  const resolved = resolve6(pathArg);
+  const resolved = resolve7(pathArg);
   const stat = statSync4(resolved);
   if (!stat.isDirectory())
     return resolved;
-  const entrypoint = join5(resolved, "index.ts");
+  const entrypoint = join6(resolved, "index.ts");
   if (!existsSync5(entrypoint)) {
     throw new Error(`Directory provided but no index.ts found at ${entrypoint}`);
   }
@@ -213316,7 +214090,7 @@ function functionSourceOutput(slug, sourceCode, output) {
   if (!output) {
     return { content: [{ type: "text", text: JSON.stringify({ code: sourceCode }, null, 2) }] };
   }
-  const outputPath = resolve6(output);
+  const outputPath = resolve7(output);
   writeFileSync(outputPath, sourceCode, { flag: "wx" });
   return {
     content: [{
@@ -213553,8 +214327,8 @@ Actions: list, get_config, deploy, deploy_bundle, config, source, activate, dele
     });
     const hasFunctionConfig = () => Object.keys(functionConfig()).length > 0;
     const checkSyntax = async (sourceCode) => {
-      const tmpDir = mkdtempSync(join5(tmpdir(), "supacloud-edge-check-"));
-      const tmpFile = join5(tmpDir, "index.ts");
+      const tmpDir = mkdtempSync(join6(tmpdir(), "supacloud-edge-check-"));
+      const tmpFile = join6(tmpDir, "index.ts");
       writeFileSync(tmpFile, sourceCode);
       try {
         await runBunBuild([tmpFile, "--external", "*"]);
@@ -213845,13 +214619,13 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status}): ${JSON.stringif
 
 // src/shared/tools/frontend-tools.ts
 import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
-import { basename as basename6 } from "node:path";
+import { basename as basename7 } from "node:path";
 
 // src/shared/tools/frontend-release-control.ts
 import { createHash as createHash5 } from "node:crypto";
 import { constants as fsConstants2 } from "node:fs";
 import { open as open2 } from "node:fs/promises";
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 var PROJECT_REF_PATTERN3 = /^[A-Za-z0-9_-]{1,20}$/u;
 var DEPLOYMENT_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/u;
 var RELEASE_ID_PATTERN = /^[0-9a-f]{64}$/u;
@@ -213991,7 +214765,7 @@ async function archiveSha256(handle, sizeBytes) {
   return hash.digest("hex");
 }
 async function verifiedArchive(path) {
-  const archivePath = resolve7(path);
+  const archivePath = resolve8(path);
   const handle = await open2(archivePath, fsConstants2.O_RDONLY | fsConstants2.O_NOFOLLOW);
   try {
     const before = await handle.stat({ bigint: true });
@@ -214388,7 +215162,7 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
         }
         const zipBuffer = readFileSync6(zip_path);
         const form = new FormData;
-        form.append("file", new Blob([zipBuffer], { type: "application/zip" }), basename6(zip_path));
+        form.append("file", new Blob([zipBuffer], { type: "application/zip" }), basename7(zip_path));
         text = ok(await http.postMultipart(`/v1/projects/${ref}/frontend/deployments/${id}/deploy/upload`, form));
         break;
       case "redeploy":
@@ -216143,7 +216917,7 @@ function registerBranchTools(server2, http, options = {}) {
 
 // src/shared/tools/supabase-cli-tools.ts
 import { chmodSync, existsSync as existsSync7, mkdirSync as mkdirSync2, statSync as statSync5, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname3, isAbsolute as isAbsolute2, join as join6, resolve as resolve8 } from "node:path";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join7, resolve as resolve9 } from "node:path";
 var SENSITIVE_ENV_KEY = /(?:^|_)(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIALS?|AUTHORIZATION|AUTH|SESSION|COOKIE|BEARER|DB_URI|DB_URL|DSN|DATABASE_URL|DATABASE_URI|CONNECTION_STRING|CONNECTION_URI)(?:_|$)/i;
 var VALID_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 var VALID_MIGRATION_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]{0,100}$/;
@@ -216188,12 +216962,12 @@ function schemaArguments(schema) {
 function workdirArguments(workdir) {
   if (!workdir)
     throw new Error("A workdir is required");
-  return ["--workdir", resolve8(workdir)];
+  return ["--workdir", resolve9(workdir)];
 }
 function resolveOutputPath(workdir, file, label) {
   if (!file || /[\r\n\0]/.test(file))
     throw new Error(`${label} file is required`);
-  return isAbsolute2(file) ? resolve8(file) : resolve8(workdir, file);
+  return isAbsolute2(file) ? resolve9(file) : resolve9(workdir, file);
 }
 function databaseTargetArguments(databaseUrl) {
   return databaseUrl ? ["--db-url", requirePostgresUrl(databaseUrl)] : ["--local"];
@@ -216367,7 +217141,7 @@ function actionArguments(request, workdir) {
 function buildOfficialSupabaseArgs(request) {
   if (request.action === "version")
     return ["--version"];
-  const workdir = request.workdir ? resolve8(request.workdir) : undefined;
+  const workdir = request.workdir ? resolve9(request.workdir) : undefined;
   if (!workdir)
     throw new Error("A workdir is required");
   return [...actionArguments(request, workdir), ...workdirArguments(workdir)];
@@ -216444,13 +217218,13 @@ function resolveOfficialSupabaseCommand(workdir, environment = process.env) {
     }
     return ["npx", "--yes", `supabase@${version}`];
   }
-  const localPackageEntry = join6(resolve8(workdir), "node_modules", "supabase", "dist", "supabase.js");
+  const localPackageEntry = join7(resolve9(workdir), "node_modules", "supabase", "dist", "supabase.js");
   if (existsSync7(localPackageEntry))
     return [process.execPath, localPackageEntry];
   return ["supabase"];
 }
 function resolveExistingWorkdir(workdirInput, fallback) {
-  const workdir = resolve8(workdirInput || fallback);
+  const workdir = resolve9(workdirInput || fallback);
   if (!existsSync7(workdir) || !statSync5(workdir).isDirectory()) {
     throw new Error(`Supabase workdir not found: ${workdir}`);
   }
@@ -216551,7 +217325,7 @@ async function executeMigrationPush(request, runtime) {
   if (!projectRef)
     return missingProjectRefResult();
   const workdir = resolveExistingWorkdir(request.workdir, runtime.fallbackWorkdir);
-  const migrationDirectory = resolve8(workdir, request.dir || "supabase/migrations");
+  const migrationDirectory = resolve9(workdir, request.dir || "supabase/migrations");
   const migrationResponse = await pushMigrations({
     action: "push_migrations",
     ref: projectRef,
@@ -216664,11 +217438,11 @@ function registerSupabaseCliTools(server2, options = {}) {
 
 // src/shared/tools/lite-cli-tools.ts
 import { existsSync as existsSync9, statSync as statSync7 } from "node:fs";
-import { resolve as resolve10 } from "node:path";
+import { resolve as resolve11 } from "node:path";
 
 // src/shared/tools/lite-cli-command.ts
 import { existsSync as existsSync8, readFileSync as readFileSync7, statSync as statSync6 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join7, relative as relative3, resolve as resolve9 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join8, relative as relative3, resolve as resolve10 } from "node:path";
 function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -216679,8 +217453,8 @@ function resolveLiteCommand(workdir, environment = process.env) {
       throw new Error("Invalid SUPACLOUD_LITE_CLI_BIN");
     return [explicitBinary];
   }
-  const packageRoot = join7(resolve9(workdir), "node_modules", "@supacloud", "lite");
-  const manifestPath = join7(packageRoot, "package.json");
+  const packageRoot = join8(resolve10(workdir), "node_modules", "@supacloud", "lite");
+  const manifestPath = join8(packageRoot, "package.json");
   if (!existsSync8(manifestPath))
     return ["supacloud-lite"];
   const manifest = JSON.parse(readFileSync7(manifestPath, "utf8"));
@@ -216691,7 +217465,7 @@ function resolveLiteCommand(workdir, environment = process.env) {
   if (typeof entry !== "string" || !entry.trim() || entry.includes("\x00") || isAbsolute3(entry)) {
     throw new Error("Invalid installed @supacloud/lite bin");
   }
-  const executable = resolve9(packageRoot, entry);
+  const executable = resolve10(packageRoot, entry);
   const packageRelative = relative3(packageRoot, executable);
   if (!packageRelative || packageRelative === ".." || packageRelative.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute3(packageRelative)) {
     throw new Error("Installed @supacloud/lite bin must stay inside its package");
@@ -216703,7 +217477,7 @@ function resolveLiteCommand(workdir, environment = process.env) {
 }
 // src/shared/tools/lite-cli-tools.ts
 function requireWorkdir(workdir, fallback) {
-  const resolved = resolve10(workdir || fallback);
+  const resolved = resolve11(workdir || fallback);
   if (!existsSync9(resolved) || !statSync7(resolved).isDirectory()) {
     throw new Error(`Lite workdir not found: ${resolved}`);
   }
@@ -216917,13 +217691,13 @@ import {
   rmSync as rmSync2
 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname4, join as join8, relative as relative4, resolve as resolve11, sep as sep3 } from "node:path";
+import { dirname as dirname4, join as join9, relative as relative4, resolve as resolve12, sep as sep3 } from "node:path";
 import { fileURLToPath } from "node:url";
 var SKILL_NAME = "supacloud-cli";
 function regularFiles(rootDirectory, currentDirectory = rootDirectory) {
   const files = [];
   for (const directoryEntry of readdirSync4(currentDirectory, { withFileTypes: true })) {
-    const entryPath = join8(currentDirectory, directoryEntry.name);
+    const entryPath = join9(currentDirectory, directoryEntry.name);
     if (directoryEntry.isSymbolicLink())
       throw new Error(`Skill directories cannot contain symlinks: ${entryPath}`);
     if (directoryEntry.isDirectory())
@@ -216940,7 +217714,7 @@ function directoriesMatch(sourceDirectory, destinationDirectory) {
   const destinationFiles = regularFiles(destinationDirectory);
   if (sourceFiles.join("\x00") !== destinationFiles.join("\x00"))
     return false;
-  return sourceFiles.every((file) => readFileSync8(join8(sourceDirectory, file)).equals(readFileSync8(join8(destinationDirectory, file))));
+  return sourceFiles.every((file) => readFileSync8(join9(sourceDirectory, file)).equals(readFileSync8(join9(destinationDirectory, file))));
 }
 function backupTimestamp(now) {
   return now.toISOString().replace(/[-:.]/g, "");
@@ -216957,8 +217731,8 @@ function availableBackupDirectory(destinationDirectory, now) {
 }
 function stagedSkill(sourceDirectory, targetRoot) {
   mkdirSync3(targetRoot, { recursive: true });
-  const stagingRoot = mkdtempSync2(join8(targetRoot, ".supacloud-cli-install-"));
-  const stagingSkill = join8(stagingRoot, SKILL_NAME);
+  const stagingRoot = mkdtempSync2(join9(targetRoot, ".supacloud-cli-install-"));
+  const stagingSkill = join9(stagingRoot, SKILL_NAME);
   try {
     cpSync(sourceDirectory, stagingSkill, { recursive: true, errorOnExist: true });
   } catch (error) {
@@ -216990,13 +217764,13 @@ function replaceSkill(sourceDirectory, targetRoot, destinationDirectory, backupD
   }
 }
 function skillSummary(request, action, files, backupDirectory) {
-  const sourceDirectory = resolve11(request.sourceDirectory);
-  const targetRoot = resolve11(request.targetRoot);
+  const sourceDirectory = resolve12(request.sourceDirectory);
+  const targetRoot = resolve12(request.targetRoot);
   return {
     name: SKILL_NAME,
     sourceDirectory,
     targetRoot,
-    destinationDirectory: join8(targetRoot, SKILL_NAME),
+    destinationDirectory: join9(targetRoot, SKILL_NAME),
     action,
     mode: request.mode,
     changed: action !== "none",
@@ -217005,10 +217779,10 @@ function skillSummary(request, action, files, backupDirectory) {
   };
 }
 function installSkill(request) {
-  const sourceDirectory = resolve11(request.sourceDirectory);
-  const targetRoot = resolve11(request.targetRoot);
-  const destinationDirectory = join8(targetRoot, SKILL_NAME);
-  if (!existsSync10(join8(sourceDirectory, "SKILL.md"))) {
+  const sourceDirectory = resolve12(request.sourceDirectory);
+  const targetRoot = resolve12(request.targetRoot);
+  const destinationDirectory = join9(targetRoot, SKILL_NAME);
+  if (!existsSync10(join9(sourceDirectory, "SKILL.md"))) {
     throw new Error(`Bundled SupaCloud CLI skill not found: ${sourceDirectory}`);
   }
   const files = regularFiles(sourceDirectory);
@@ -217023,17 +217797,17 @@ function installSkill(request) {
   return installReplacementSkill(request, files);
 }
 function installNewSkill(request, files) {
-  const sourceDirectory = resolve11(request.sourceDirectory);
-  const targetRoot = resolve11(request.targetRoot);
+  const sourceDirectory = resolve12(request.sourceDirectory);
+  const targetRoot = resolve12(request.targetRoot);
   if (request.mode === "write") {
-    createSkill(sourceDirectory, targetRoot, join8(targetRoot, SKILL_NAME));
+    createSkill(sourceDirectory, targetRoot, join9(targetRoot, SKILL_NAME));
   }
   return skillSummary(request, "create", files, null);
 }
 function installReplacementSkill(request, files) {
-  const sourceDirectory = resolve11(request.sourceDirectory);
-  const targetRoot = resolve11(request.targetRoot);
-  const destinationDirectory = join8(targetRoot, SKILL_NAME);
+  const sourceDirectory = resolve12(request.sourceDirectory);
+  const targetRoot = resolve12(request.targetRoot);
+  const destinationDirectory = join9(targetRoot, SKILL_NAME);
   const backupDirectory = availableBackupDirectory(destinationDirectory, request.now);
   if (request.mode === "write") {
     replaceSkill(sourceDirectory, targetRoot, destinationDirectory, backupDirectory);
@@ -217042,15 +217816,15 @@ function installReplacementSkill(request, files) {
 }
 function resolveDefaultCodexSkillRoot(environment = process.env, homeDirectory = homedir2()) {
   const codexHome = environment.CODEX_HOME?.trim();
-  return join8(resolve11(codexHome || join8(homeDirectory, ".codex")), "skills");
+  return join9(resolve12(codexHome || join9(homeDirectory, ".codex")), "skills");
 }
 function resolveBundledSkillDirectory(moduleUrl = import.meta.url) {
   const moduleDirectory = dirname4(fileURLToPath(moduleUrl));
   const candidates = [
-    resolve11(moduleDirectory, "../../../skills", SKILL_NAME),
-    resolve11(moduleDirectory, "../skills", SKILL_NAME)
+    resolve12(moduleDirectory, "../../../skills", SKILL_NAME),
+    resolve12(moduleDirectory, "../skills", SKILL_NAME)
   ];
-  const skillDirectory = candidates.find((candidate) => existsSync10(join8(candidate, "SKILL.md")));
+  const skillDirectory = candidates.find((candidate) => existsSync10(join9(candidate, "SKILL.md")));
   if (!skillDirectory)
     throw new Error("Bundled SupaCloud CLI skill is missing from this installation");
   return skillDirectory;
@@ -217072,7 +217846,7 @@ function registerAiTools(server2) {
         name: SKILL_NAME,
         sourceDirectory,
         defaultTargetRoot,
-        defaultDestination: join8(defaultTargetRoot, SKILL_NAME)
+        defaultDestination: join9(defaultTargetRoot, SKILL_NAME)
       });
     }
     return textResponse(installSkill({
@@ -217087,13 +217861,13 @@ function registerAiTools(server2) {
 
 // src/shared/tools/app-tools.ts
 import { existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
-import { mkdir as mkdir6, readFile as readFile9, readdir as readdir6, writeFile as writeFile5 } from "node:fs/promises";
-import { basename as basename9, dirname as dirname13, join as join16, relative as relative13, resolve as resolve24 } from "node:path";
+import { mkdir as mkdir7, readFile as readFile9, readdir as readdir7, writeFile as writeFile6 } from "node:fs/promises";
+import { basename as basename10, dirname as dirname13, join as join17, relative as relative13, resolve as resolve24 } from "node:path";
 
 // node_modules/@supacloud/compiler/dist/index.js
 import { dirname as dirname22, relative as relative6, sep as sep4 } from "node:path";
 import { createHash as createHash42 } from "node:crypto";
-import { access, mkdir as mkdir3, rename as rename2, unlink, writeFile as writeFile3 } from "node:fs/promises";
+import { access, mkdir as mkdir4, rename as rename2, unlink, writeFile as writeFile4 } from "node:fs/promises";
 import { join as join22 } from "node:path";
 var ts10 = __toESM(require_typescript(), 1);
 var ts11 = __toESM(require_typescript(), 1);
@@ -217103,7 +217877,7 @@ import { resolve as resolve52 } from "node:path";
 import { resolve as resolve62 } from "node:path";
 import { createHash as createHash52 } from "node:crypto";
 import { createHash as createHash62 } from "node:crypto";
-import { readFile as readFile2 } from "node:fs/promises";
+import { readFile as readFile3 } from "node:fs/promises";
 import { relative as relative42, sep as sep42 } from "node:path";
 
 // node_modules/@graphql-codegen/core/esm/codegen.js
@@ -219494,7 +220268,7 @@ var findTransformedDefinitions = (visitedResult) => {
 // node_modules/@supacloud/compiler/dist/index.js
 import { createHash as createHash8 } from "node:crypto";
 import { constants as constants2 } from "node:fs";
-import { lstat as lstat2, mkdir as mkdir22, open as open3, readFile as readFile3, readdir as readdir3, realpath as realpath3, rename as rename22, rm as rm2, writeFile as writeFile22 } from "node:fs/promises";
+import { lstat as lstat2, mkdir as mkdir22, open as open3, readFile as readFile32, readdir as readdir4, realpath as realpath3, rename as rename22, rm as rm2, writeFile as writeFile22 } from "node:fs/promises";
 import { dirname as dirname42, isAbsolute as isAbsolute5, join as join52, relative as relative52, resolve as resolve82, sep as sep5 } from "node:path";
 import { existsSync as existsSync32 } from "node:fs";
 import { dirname as dirname52, join as join62, relative as relative62, sep as sep6 } from "node:path";
@@ -219513,9 +220287,9 @@ var ts3 = __toESM(require_typescript(), 1);
 var ts5 = __toESM(require_typescript(), 1);
 import { createHash as createHash32 } from "node:crypto";
 import { relative as relative22, resolve as resolvePath, sep as sep22 } from "node:path";
-import { createHash as createHash22 } from "node:crypto";
+import { createHash as createHash23 } from "node:crypto";
 import { existsSync as existsSync11, readFileSync as readFileSync9 } from "node:fs";
-import { dirname as dirname6, join as join11, resolve as resolve13 } from "node:path";
+import { dirname as dirname6, join as join12, resolve as resolve15 } from "node:path";
 import { createHash as createHash7 } from "node:crypto";
 import { resolve as resolve22 } from "node:path";
 var ts9 = __toESM(require_typescript(), 1);
@@ -219538,7 +220312,7 @@ import { existsSync as existsSync42, watch } from "node:fs";
 import { dirname as dirname9, relative as relative10, resolve as resolve16, sep as sep10 } from "node:path";
 import { createHash as createHash10 } from "node:crypto";
 import { access as access3, readdir as readdir32, readFile as readFile7 } from "node:fs/promises";
-import { isAbsolute as isAbsolute42, relative as relative9, resolve as resolve15, sep as sep9 } from "node:path";
+import { isAbsolute as isAbsolute42, relative as relative9, resolve as resolve152, sep as sep9 } from "node:path";
 var ts16 = __toESM(require_typescript(), 1);
 import { existsSync as existsSync52 } from "node:fs";
 import { join as join112, resolve as resolve21 } from "node:path";
@@ -220993,7 +221767,7 @@ function renderApplication(graph, options) {
   };
 }
 async function writeRenderedApplication(rendered, options) {
-  await mkdir3(options.outDir, { recursive: true });
+  await mkdir4(options.outDir, { recursive: true });
   const applicationPath = join22(options.outDir, "application.ts");
   const manifestPath = join22(options.outDir, "app.manifest.json");
   const contractsManifestPath = join22(options.outDir, "contracts.manifest.json");
@@ -221035,7 +221809,7 @@ async function writeFileAtomic(path, content) {
     if (typeof Bun !== "undefined" && typeof Bun.write === "function") {
       await Bun.write(temporaryPath, content);
     } else {
-      await writeFile3(temporaryPath, content, "utf8");
+      await writeFile4(temporaryPath, content, "utf8");
     }
     await rename2(temporaryPath, path);
   } catch (error) {
@@ -223767,7 +224541,7 @@ async function renderGraphql(options) {
   let schema;
   let schemaContent;
   try {
-    schemaContent = await readFile2(schemaPath, "utf8");
+    schemaContent = await readFile3(schemaPath, "utf8");
     Object.assign(contract, graphqlSchemaHashes(schemaContent));
     if (schemaPath.endsWith(".json")) {
       const json = JSON.parse(schemaContent);
@@ -223786,7 +224560,7 @@ async function renderGraphql(options) {
   const documents = [];
   for (const path of paths.slice(1)) {
     try {
-      documents.push({ location: path, document: import_graphql64.parse(new import_graphql64.Source(await readFile2(path, "utf8"), path)) });
+      documents.push({ location: path, document: import_graphql64.parse(new import_graphql64.Source(await readFile3(path, "utf8"), path)) });
     } catch (error) {
       diagnostic("graphql-document-invalid", error, path);
     }
@@ -232984,7 +233758,7 @@ async function readOwned(anchor, path) {
   const stat = await lstat2(path);
   if (!stat.isFile())
     throw new Error("Expected a regular delivery input or artifact.");
-  return readFile3(path);
+  return readFile32(path);
 }
 async function readBoundedOwned2(root, path, maximum) {
   await noLinks2(root, path);
@@ -233021,7 +233795,7 @@ async function reserveOutput(project, requested) {
   const marker = join52(path, "owner.json");
   const owner = canonical2({ producer: "@supacloud/compiler/delivery-build-v1", project: base });
   if (!await exists2(marker)) {
-    if ((await readdir3(path)).length > 0)
+    if ((await readdir4(path)).length > 0)
       throw new Error("Refusing to adopt an unowned delivery directory.");
     await writeFile22(marker, owner, { flag: "wx" });
   } else if (new TextDecoder().decode(await readOwned(base, marker)) !== owner) {
@@ -233049,7 +233823,7 @@ async function writeArtifact(root, path, content) {
 async function artifactInventory(root) {
   const files = [];
   async function visit(directory) {
-    for (const entry of await readdir3(directory, { withFileTypes: true })) {
+    for (const entry of await readdir4(directory, { withFileTypes: true })) {
       const path = join52(directory, entry.name);
       if (entry.isSymbolicLink())
         throw new Error("Artifact contains a symbolic link.");
@@ -233067,7 +233841,7 @@ async function artifactInventory(root) {
 async function sourceInventory(root, output) {
   const inputs = new Map;
   async function visit(directory) {
-    for (const entry of await readdir3(directory, { withFileTypes: true })) {
+    for (const entry of await readdir4(directory, { withFileTypes: true })) {
       const path = join52(directory, entry.name);
       if (inside2(output, path) || entry.name === "node_modules" || entry.name === ".git")
         continue;
@@ -242899,7 +243673,7 @@ var init_application_activation = __esm2(() => {
   }, { additionalProperties: false });
 });
 var closed6;
-var sha2562;
+var sha2563;
 var isoDate2;
 var status2;
 var evidenceStatus2;
@@ -242914,7 +243688,7 @@ var init_deployment_evidence = __esm2(() => {
   init_application_configuration();
   init_application_release();
   closed6 = { additionalProperties: false };
-  sha2562 = String22({ pattern: "^[a-f0-9]{64}$" });
+  sha2563 = String22({ pattern: "^[a-f0-9]{64}$" });
   isoDate2 = String22({ minLength: 20, maxLength: 40 });
   status2 = Union2([
     Literal2("confirmed"),
@@ -242933,7 +243707,7 @@ var init_deployment_evidence = __esm2(() => {
     topology: Union2([Literal2("single-node"), Literal2("distributed")]),
     migration: _Object_2({
       status: status2,
-      inventory_sha256: Union2([sha2562, Null2()]),
+      inventory_sha256: Union2([sha2563, Null2()]),
       compatibility: Union2([
         Literal2("verified"),
         Literal2("not-proven"),
@@ -242981,9 +243755,9 @@ var init_deployment_evidence = __esm2(() => {
     }, closed6),
     source: _Object_2({
       commit_sha: Union2([String22({ pattern: "^[0-9a-f]{7,64}$" }), Null2()]),
-      manifest_sha256: sha2562,
+      manifest_sha256: sha2563,
       contract_schema: Union2([String22({ minLength: 1, maxLength: 128 }), Null2()]),
-      environment_binding_version: Union2([sha2562, Null2()])
+      environment_binding_version: Union2([sha2563, Null2()])
     }, closed6),
     database: DatabaseProviderSchema2,
     components: _Array_2(DeploymentComponentEvidenceSchema2, { minItems: 1, maxItems: 32 }),
@@ -243487,7 +244261,7 @@ function decoratedDeclaration(decorator) {
   };
 }
 function createIncrementalProgramSession(projectRoot) {
-  const rootDir = resolve13(projectRoot);
+  const rootDir = resolve15(projectRoot);
   let projectConfig = readProjectConfig(rootDir);
   let projectConfigKey = configKey(projectConfig);
   let builder;
@@ -243516,8 +244290,8 @@ function createIncrementalProgramSession(projectRoot) {
       }
       projectConfig = nextProjectConfig;
       projectConfigKey = nextProjectConfigKey;
-      const normalizedRoots = [...new Set(rootNames.map((file) => resolve13(rootDir, file)))].sort();
-      const normalizedChanged = [...new Set(changedPaths.map((file) => resolve13(rootDir, file)))];
+      const normalizedRoots = [...new Set(rootNames.map((file) => resolve15(rootDir, file)))].sort();
+      const normalizedChanged = [...new Set(changedPaths.map((file) => resolve15(rootDir, file)))];
       const invalidatedPaths = new Set(normalizedChanged.map(canonical3));
       for (const sourceFile of oldSourceFiles.values()) {
         if (sourceVersion(sourceFile.fileName) !== sourceFileVersion(sourceFile)) {
@@ -243618,7 +244392,7 @@ function createHost(options, rootDir, sourceFileCache, invalidatedPaths, invalid
   return host;
 }
 function canonical3(fileName) {
-  const normalized = resolve13(fileName);
+  const normalized = resolve15(fileName);
   return ts2.sys.useCaseSensitiveFileNames ? normalized : normalized.toLowerCase();
 }
 function sourceFileParseKey(languageVersion) {
@@ -243636,7 +244410,7 @@ function configKey(config) {
   });
 }
 function hashText(text) {
-  return createHash22("sha1").update(text).digest("hex");
+  return createHash23("sha1").update(text).digest("hex");
 }
 function sourceVersion(fileName) {
   try {
@@ -243650,7 +244424,7 @@ function sourceFileVersion(sourceFile) {
   return typeof descriptor?.value === "string" ? descriptor.value : undefined;
 }
 function readProjectConfig(rootDir) {
-  const configPath = join11(rootDir, "tsconfig.json");
+  const configPath = join12(rootDir, "tsconfig.json");
   if (!existsSync11(configPath)) {
     return {
       options: {
@@ -243960,7 +244734,7 @@ function withDiagnosticMetadata(diagnostic) {
 function nodeText(node) {
   return node.getText(node.getSourceFile());
 }
-function lineOf(node) {
+function lineOf2(node) {
   const sourceFile = node.getSourceFile();
   return sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
 }
@@ -244054,7 +244828,7 @@ async function analyzeProject(rootDir, include, cache, changedPaths) {
           options,
           className: cls.name?.text ?? "<anonymous>",
           file: sf.fileName,
-          line: lineOf(cls)
+          line: lineOf2(cls)
         });
       }
     }
@@ -244073,7 +244847,7 @@ async function analyzeProject(rootDir, include, cache, changedPaths) {
           options: arg,
           className: variableName3(parent),
           file: sf.fileName,
-          line: lineOf(parent)
+          line: lineOf2(parent)
         });
       }
     }
@@ -244184,7 +244958,7 @@ async function analyzeProject(rootDir, include, cache, changedPaths) {
       if (injectable?.providedIn === "root") {
         const { deps, optionalDeps, selfDeps, skipSelfDeps, hostDeps, functionalInjects, missing } = classDeps(classInfo.decl, ctx);
         const file = sourcePath(ctx.rootDir, classInfo.file);
-        const line = lineOf(classInfo.decl);
+        const line = lineOf2(classInfo.decl);
         if (missing) {
           warn(ctx, "missing-deps", `root provider ${name} 的部分构造依赖无法静态解析`, file, line);
         }
@@ -244231,8 +245005,8 @@ async function analyzeProject(rootDir, include, cache, changedPaths) {
           const rpc = checkedRpc(meta, ctx);
           const audit = stringLiteralProp(meta, "audit");
           const standaloneName = stringLiteralProp(meta, "name") ?? classInfo.decl.name?.text ?? name;
-          const standaloneUses = parseInfraResourceUseRefs(infraResourceProp(meta, "uses", ctx), ctx, `command ${standaloneName}`, sourcePath(ctx.rootDir, classInfo.file), lineOf(classInfo.decl));
-          rejectUndeclaredResourceUses(standaloneUses, standaloneResourceNames, ctx, `command ${standaloneName}`, sourcePath(ctx.rootDir, classInfo.file), lineOf(classInfo.decl));
+          const standaloneUses = parseInfraResourceUseRefs(infraResourceProp(meta, "uses", ctx), ctx, `command ${standaloneName}`, sourcePath(ctx.rootDir, classInfo.file), lineOf2(classInfo.decl));
+          rejectUndeclaredResourceUses(standaloneUses, standaloneResourceNames, ctx, `command ${standaloneName}`, sourcePath(ctx.rootDir, classInfo.file), lineOf2(classInfo.decl));
           standaloneCommands.push({
             className: classInfo.decl.name?.text ?? name,
             name: standaloneName,
@@ -244432,7 +245206,7 @@ function parseTokenVariable(decl, file) {
   if (nodeText(init.expression) !== "InjectionToken")
     return;
   const [nameArg, optionsArg] = init.arguments ?? [];
-  const info = { name: variableName3(decl), file, line: lineOf(decl) };
+  const info = { name: variableName3(decl), file, line: lineOf2(decl) };
   if (nameArg && ts7.isStringLiteral(nameArg)) {
     info.stringName = nameArg.text;
   }
@@ -244488,7 +245262,7 @@ function parseModule(candidate, nameByNode, ctx) {
     }
     if (ts7.isCallExpression(el)) {
       const helper = nodeText(el.expression).split(".").pop() ?? nodeText(el.expression);
-      warn(ctx, "unsupported-provider-helper", `无法静态展开 provider helper '${helper}'；请改用显式 Provider 或实现编译器支持的 helper`, sourcePath(ctx.rootDir, el.getSourceFile().fileName), lineOf(el));
+      warn(ctx, "unsupported-provider-helper", `无法静态展开 provider helper '${helper}'；请改用显式 Provider 或实现编译器支持的 helper`, sourcePath(ctx.rootDir, el.getSourceFile().fileName), lineOf2(el));
       continue;
     }
     const provider = parseProvider(el, exportsSet, ctx);
@@ -244524,7 +245298,7 @@ function parseModule(candidate, nameByNode, ctx) {
       ...hasInitHook(decl) ? { hasOnInit: true } : {},
       exported: exportsSet.has(className),
       file: sourcePath(ctx.rootDir, decl.getSourceFile().fileName),
-      line: lineOf(decl),
+      line: lineOf2(decl),
       importPath: modulePath(ctx.rootDir, decl.getSourceFile().fileName)
     });
   }
@@ -244571,8 +245345,8 @@ function parseModule(candidate, nameByNode, ctx) {
         const rpc = checkedRpc(meta, ctx);
         const audit = stringLiteralProp(meta, "audit");
         const commandName = stringLiteralProp(meta, "name") ?? cls.name?.text ?? "<anonymous>";
-        const uses = parseInfraResourceUseRefs(infraResourceProp(meta, "uses", ctx), ctx, `command ${commandName}`, sourcePath(ctx.rootDir, cls.getSourceFile().fileName), lineOf(cls));
-        rejectUndeclaredResourceUses(uses, moduleResourceNames, ctx, `command ${commandName}`, sourcePath(ctx.rootDir, cls.getSourceFile().fileName), lineOf(cls));
+        const uses = parseInfraResourceUseRefs(infraResourceProp(meta, "uses", ctx), ctx, `command ${commandName}`, sourcePath(ctx.rootDir, cls.getSourceFile().fileName), lineOf2(cls));
+        rejectUndeclaredResourceUses(uses, moduleResourceNames, ctx, `command ${commandName}`, sourcePath(ctx.rootDir, cls.getSourceFile().fileName), lineOf2(cls));
         commands.push({
           className: cls.name?.text ?? "<anonymous>",
           name: commandName,
@@ -244601,7 +245375,7 @@ function parseModule(candidate, nameByNode, ctx) {
             code: "invalid-job-scope",
             message: `job ${className} 不能使用 request scope；Job 只能使用 application 或 job scope`,
             file: sourcePath(ctx.rootDir, cls.getSourceFile().fileName),
-            line: lineOf(cls),
+            line: lineOf2(cls),
             suggestion: "移除 request scope，或改用 application/job scope。",
             errorCode: "SC4007",
             docsUrl: "https://supacloud.dev/errors/SC4007"
@@ -244609,8 +245383,8 @@ function parseModule(candidate, nameByNode, ctx) {
         }
         const aspects = parseAspectRefs(getProp(meta, "aspects"), ctx, `job ${className}`);
         const contract = parseJobOptions(meta, className, ctx);
-        const jobUses = parseInfraResourceUseRefs(infraResourceProp(meta, "uses", ctx), ctx, `job ${stringLiteralProp(meta, "name") ?? className}`, sourcePath(ctx.rootDir, cls.getSourceFile().fileName), lineOf(cls));
-        rejectUndeclaredResourceUses(jobUses, moduleResourceNames, ctx, `job ${stringLiteralProp(meta, "name") ?? className}`, sourcePath(ctx.rootDir, cls.getSourceFile().fileName), lineOf(cls));
+        const jobUses = parseInfraResourceUseRefs(infraResourceProp(meta, "uses", ctx), ctx, `job ${stringLiteralProp(meta, "name") ?? className}`, sourcePath(ctx.rootDir, cls.getSourceFile().fileName), lineOf2(cls));
+        rejectUndeclaredResourceUses(jobUses, moduleResourceNames, ctx, `job ${stringLiteralProp(meta, "name") ?? className}`, sourcePath(ctx.rootDir, cls.getSourceFile().fileName), lineOf2(cls));
         jobs.push({
           className,
           name: stringLiteralProp(meta, "name") ?? className,
@@ -244676,7 +245450,7 @@ function parseFeatureSpec(input, ctx, seen = new Set) {
       code: "invalid-feature-spec",
       message: "Feature spec must use static name, states and transition objects.",
       file: sourcePath(ctx.rootDir, input.getSourceFile().fileName),
-      line: lineOf(input)
+      line: lineOf2(input)
     });
     return;
   };
@@ -244722,7 +245496,7 @@ function parseFeatureSpec(input, ctx, seen = new Set) {
       ...audit === undefined ? {} : { audit }
     });
   }
-  return { name, states, transitions, file: sourcePath(ctx.rootDir, input.getSourceFile().fileName), line: lineOf(input) };
+  return { name, states, transitions, file: sourcePath(ctx.rootDir, input.getSourceFile().fileName), line: lineOf2(input) };
 }
 function resolveStaticObjectLiteral(input, ctx, seen = new Set) {
   if (!input || seen.has(input))
@@ -244779,7 +245553,7 @@ function checkedCommandMode(object, property, ctx, command) {
       docsUrl: "https://supacloud.dev/errors/SC4012",
       message: `${command}.${property} must be the explicit literal "required" or "none"; invalid governance cannot be disabled silently.`,
       file,
-      line: lineOf(expression),
+      line: lineOf2(expression),
       suggestion: `Choose the intended ${property} policy explicitly; use set_command_mode with value "required" or "none".`,
       fix: {
         type: "set_command_mode",
@@ -244794,7 +245568,7 @@ function checkedCommandMode(object, property, ctx, command) {
 }
 function parseProvider(el, exportsSet, ctx) {
   const file = sourcePath(ctx.rootDir, el.getSourceFile().fileName);
-  const line = lineOf(el);
+  const line = lineOf2(el);
   const unwrappedEl = unwrapForwardRef(el);
   if (ts7.isIdentifier(unwrappedEl)) {
     const decl = resolveDeclaration(unwrappedEl, ctx)[0];
@@ -244998,7 +245772,7 @@ function parseFunctionalProvider(expression, exportsSet, ctx) {
   const helper = nodeText(expression.expression).split(".").pop();
   const args = expression.arguments;
   const file = sourcePath(ctx.rootDir, expression.getSourceFile().fileName);
-  const line = lineOf(expression);
+  const line = lineOf2(expression);
   if (helper === "provideToken") {
     const tokenExpr = args[0];
     const valueExpr = args[1];
@@ -245238,7 +246012,7 @@ function parseController(input, ctx) {
   const { deps, optionalDeps, selfDeps, skipSelfDeps, hostDeps, functionalInjects, missing } = classDeps(decl, ctx);
   const file = sourcePath(ctx.rootDir, decl.getSourceFile().fileName);
   if (missing) {
-    warn(ctx, "missing-deps", `controller ${decl.name?.text} 的部分构造依赖无法静态解析`, file, lineOf(decl));
+    warn(ctx, "missing-deps", `controller ${decl.name?.text} 的部分构造依赖无法静态解析`, file, lineOf2(decl));
   }
   const injectable = parseInjectableOptions(decl, ctx);
   const routes = [];
@@ -245472,7 +246246,7 @@ function parseController(input, ctx) {
             errorCode: "SC3026",
             docsUrl: "https://supacloud.dev/errors/SC3026",
             file,
-            line: lineOf(optionsObject),
+            line: lineOf2(optionsObject),
             message: `Route ${route.handler} declares both response and responses; choose the status-map responses field.`,
             suggestion: "Remove response and represent the successful response as responses: { 200: Schema }."
           });
@@ -245521,7 +246295,7 @@ function parseController(input, ctx) {
                 errorCode: "SC3025",
                 docsUrl: "https://supacloud.dev/errors/SC3025",
                 file,
-                line: lineOf(property.name),
+                line: lineOf2(property.name),
                 message: `Route ${route.handler} uses unsupported response selector "${status}". Use an HTTP status (100-599), a status family such as 4XX/5XX, or default.`
               });
               continue;
@@ -245535,7 +246309,7 @@ function parseController(input, ctx) {
                 errorCode: "SC3027",
                 docsUrl: "https://supacloud.dev/errors/SC3027",
                 file,
-                line: lineOf(property.name),
+                line: lineOf2(property.name),
                 message: `Route ${route.handler} declares duplicate response selectors "${existingSelector}" and "${status}".`,
                 suggestion: `Keep one ${canonical} selector so runtime, clients and OpenAPI choose the same schema.`
               });
@@ -245725,7 +246499,7 @@ function jobOptionError(ctx, code, message, node, errorCode, suggestion) {
     code,
     message,
     file: sourcePath(ctx.rootDir, node.getSourceFile().fileName),
-    line: lineOf(node),
+    line: lineOf2(node),
     ...suggestion === undefined ? {} : { suggestion },
     errorCode,
     docsUrl: `https://supacloud.dev/errors/${errorCode}`
@@ -245774,7 +246548,7 @@ function checkedRpc(meta, ctx) {
     severity: "error",
     code: "invalid-command-rpc",
     file: sourcePath(ctx.rootDir, meta.getSourceFile().fileName),
-    line: lineOf(meta),
+    line: lineOf2(meta),
     message: "Command rpc must be a non-empty string literal identifying a configured adapter.",
     suggestion: "Declare a named RPC adapter and its tested persistence capabilities."
   });
@@ -246090,7 +246864,7 @@ function parseAspectRefs(expression, ctx, owner) {
       code: "dynamic-aspect-reference",
       message: `${owner} 的 aspects 必须是显式数组字面量，并且每一项必须是可解析的函数引用`,
       file: sourcePath(ctx.rootDir, expression.getSourceFile().fileName),
-      line: lineOf(expression),
+      line: lineOf2(expression),
       suggestion: "使用 aspects: [auditAspect, transactionAspect]，不要使用变量、调用表达式或字符串 pointcut。",
       errorCode: "SC4010",
       docsUrl: "https://supacloud.dev/errors/SC4010"
@@ -246105,7 +246879,7 @@ function parseAspectRefs(expression, ctx, owner) {
         code: "dynamic-aspect-reference",
         message: `${owner} 的 aspects 只能包含显式的函数标识符引用，无法静态编译 '${nodeText(element)}'`,
         file: sourcePath(ctx.rootDir, element.getSourceFile().fileName),
-        line: lineOf(element),
+        line: lineOf2(element),
         suggestion: "将 aspect 直接写入数组，例如 aspects: [auditAspect]。",
         errorCode: "SC4010",
         docsUrl: "https://supacloud.dev/errors/SC4010"
@@ -246119,7 +246893,7 @@ function parseAspectRefs(expression, ctx, owner) {
         code: "invalid-aspect-reference",
         message: `${owner} 引用了 '${element.text}'，但它不是可静态解析的 aspect 函数`,
         file: sourcePath(ctx.rootDir, element.getSourceFile().fileName),
-        line: lineOf(element),
+        line: lineOf2(element),
         suggestion: "aspect 必须是函数声明、箭头函数或函数表达式的直接引用。",
         errorCode: "SC4011",
         docsUrl: "https://supacloud.dev/errors/SC4011"
@@ -246244,7 +247018,7 @@ function infraResourceProp(obj, name, ctx) {
     return;
   const member = members[0];
   if (members.length !== 1 || !ts7.isPropertyAssignment(member) || ts7.isComputedPropertyName(member.name) || obj.properties.some(ts7.isSpreadAssignment)) {
-    pushResourceError(ctx, "unknown-resource", `${name} 必须是唯一、显式的静态属性，且不能被对象展开覆盖`, sourcePath(ctx.rootDir, obj.getSourceFile().fileName), lineOf(member), `使用 ${name}: [...]，不要使用简写属性、计算属性或对象展开。`);
+    pushResourceError(ctx, "unknown-resource", `${name} 必须是唯一、显式的静态属性，且不能被对象展开覆盖`, sourcePath(ctx.rootDir, obj.getSourceFile().fileName), lineOf2(member), `使用 ${name}: [...]，不要使用简写属性、计算属性或对象展开。`);
     return;
   }
   return member.initializer;
@@ -246254,7 +247028,7 @@ function indexInfraResource(cls, className, sf, ctx) {
   if (!decorator)
     return;
   const file = sourcePath(ctx.rootDir, sf.fileName);
-  const line = lineOf(cls);
+  const line = lineOf2(cls);
   const options = decoratorObjectArg(decorator);
   if (!options || options.properties.some((property) => !ts7.isPropertyAssignment(property) || ts7.isComputedPropertyName(property.name)) || new Set(options.properties.map((property) => property.name && propertyName(property.name))).size !== options.properties.length) {
     pushResourceError(ctx, "invalid-resource-kind", "@InfraResource 需要静态的 { name, kind } 对象参数", file, line, '使用 @InfraResource({ name: "orders-db", kind: "database" })，不要使用对象展开或重复属性。');
@@ -246312,7 +247086,7 @@ function parseModuleInfraResources(value, ctx, owner, file, line) {
     return names;
   }
   for (const element of array.elements) {
-    const resource = resolveInfraResourceRef(element, ctx, owner, file, lineOf(element));
+    const resource = resolveInfraResourceRef(element, ctx, owner, file, lineOf2(element));
     if (resource)
       names.add(resource);
   }
@@ -246330,15 +247104,15 @@ function parseInfraResourceUseRefs(value, ctx, owner, file, line) {
   for (const element of array.elements) {
     const entry = unwrapInfraResourceExpression(element);
     if (!ts7.isObjectLiteralExpression(entry) || entry.properties.some((property) => !ts7.isPropertyAssignment(property) || ts7.isComputedPropertyName(property.name) || !["resource", "operations"].includes(propertyName(property.name))) || new Set(entry.properties.map((property) => property.name && propertyName(property.name))).size !== entry.properties.length) {
-      pushResourceError(ctx, "unknown-resource", `${owner} 的 uses 项必须是显式的 { resource, operations } 对象`, file, lineOf(element), "使用显式属性，不要使用对象/数组展开、简写、计算属性或重复属性。");
+      pushResourceError(ctx, "unknown-resource", `${owner} 的 uses 项必须是显式的 { resource, operations } 对象`, file, lineOf2(element), "使用显式属性，不要使用对象/数组展开、简写、计算属性或重复属性。");
       continue;
     }
     const resourceEl = getProp(entry, "resource");
     if (!resourceEl) {
-      pushResourceError(ctx, "unknown-resource", `${owner} 的 uses 项缺少 resource`, file, lineOf(entry), "在该 uses 项中显式指定 resource: ResourceClass。");
+      pushResourceError(ctx, "unknown-resource", `${owner} 的 uses 项缺少 resource`, file, lineOf2(entry), "在该 uses 项中显式指定 resource: ResourceClass。");
       continue;
     }
-    const resource = resolveInfraResourceRef(resourceEl, ctx, owner, file, lineOf(resourceEl));
+    const resource = resolveInfraResourceRef(resourceEl, ctx, owner, file, lineOf2(resourceEl));
     if (!resource)
       continue;
     const operationsEl = getProp(entry, "operations");
@@ -246348,14 +247122,14 @@ function parseInfraResourceUseRefs(value, ctx, owner, file, line) {
     } else {
       const operationArray = unwrapInfraResourceExpression(operationsEl);
       if (!ts7.isArrayLiteralExpression(operationArray) || operationArray.elements.length === 0) {
-        pushResourceError(ctx, "invalid-resource-operation", `${owner} 对资源 '${resource}' 的 operations 必须是非空静态数组`, file, lineOf(operationsEl), "仅省略 operations 时默认 read；显式填写时必须包含有效操作。");
+        pushResourceError(ctx, "invalid-resource-operation", `${owner} 对资源 '${resource}' 的 operations 必须是非空静态数组`, file, lineOf2(operationsEl), "仅省略 operations 时默认 read；显式填写时必须包含有效操作。");
         continue;
       }
       let invalid = false;
       for (const operationEl of operationArray.elements) {
         const operation = unwrapInfraResourceExpression(operationEl);
         if (!ts7.isStringLiteral(operation) || !isInfraResourceOperation(operation.text)) {
-          pushResourceError(ctx, "invalid-resource-operation", `${owner} 对资源 '${resource}' 声明了无效操作 '${nodeText(operationEl)}'`, file, lineOf(operationEl), `operations 只能包含字符串字面量 ${INFRA_RESOURCE_OPERATIONS.join(" | ")}。`);
+          pushResourceError(ctx, "invalid-resource-operation", `${owner} 对资源 '${resource}' 声明了无效操作 '${nodeText(operationEl)}'`, file, lineOf2(operationEl), `operations 只能包含字符串字面量 ${INFRA_RESOURCE_OPERATIONS.join(" | ")}。`);
           invalid = true;
           continue;
         }
@@ -247973,11 +248747,11 @@ async function readSourceBytes(path) {
   return readFile7(path);
 }
 async function updateSnapshot(previous, options, changedPaths) {
-  const rootDir = resolve15(options.rootDir);
-  const outDir = resolve15(options.outDir);
+  const rootDir = resolve152(options.rootDir);
+  const outDir = resolve152(options.outDir);
   const files = { ...previous.files };
   await Promise.all(changedPaths.map(async (changedPath) => {
-    const absolutePath = isAbsolute42(changedPath) ? resolve15(changedPath) : resolve15(rootDir, changedPath);
+    const absolutePath = isAbsolute42(changedPath) ? resolve152(changedPath) : resolve152(rootDir, changedPath);
     const relativeChangedPath = relative9(rootDir, absolutePath);
     if (relativeChangedPath === ".." || relativeChangedPath.startsWith(`..${sep9}`))
       return;
@@ -247995,8 +248769,8 @@ async function updateSnapshot(previous, options, changedPaths) {
   return { files, optionsKey: optionsKeyOf(options) };
 }
 async function createSnapshot(options) {
-  const rootDir = resolve15(options.rootDir);
-  const outDir = resolve15(options.outDir);
+  const rootDir = resolve152(options.rootDir);
+  const outDir = resolve152(options.outDir);
   const paths = await listSourceFiles(rootDir, outDir);
   const files = {};
   const entries = await Promise.all(paths.map(async (path) => {
@@ -248019,8 +248793,8 @@ async function createSnapshot(options) {
 }
 function optionsKeyOf(options) {
   return JSON.stringify({
-    rootDir: resolve15(options.rootDir),
-    outDir: resolve15(options.outDir),
+    rootDir: resolve152(options.rootDir),
+    outDir: resolve152(options.outDir),
     include: options.include,
     strict: options.strict,
     writeOnError: options.writeOnError,
@@ -248044,7 +248818,7 @@ async function listSourceFiles(rootDir, outDir) {
   const result = [];
   const visit = async (directory) => {
     for (const entry of await readdir32(directory, { withFileTypes: true })) {
-      const path = resolve15(directory, entry.name);
+      const path = resolve152(directory, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules" || entry.name === ".git" || path === outDir)
           continue;
@@ -248618,7 +249392,7 @@ var starter_metadata_default = {
       version: "0.8.0"
     },
     db: {
-      version: "0.13.2",
+      version: "0.14.0",
       peerDependencies: {
         "drizzle-orm": "1.0.0-rc.5-169397b"
       },
@@ -248726,8 +249500,8 @@ test("cancelled stream consumers release their subscription", async () => {
 `;
 
 // src/shared/tools/app-starter.ts
-import { lstat as lstat3, mkdir as mkdir4, readdir as readdir4, writeFile as writeFile4 } from "node:fs/promises";
-import { basename as basename8, dirname as dirname10, join as join12, resolve as resolve17 } from "node:path";
+import { lstat as lstat3, mkdir as mkdir5, readdir as readdir5, writeFile as writeFile5 } from "node:fs/promises";
+import { basename as basename9, dirname as dirname10, join as join13, resolve as resolve17 } from "node:path";
 
 // src/shared/tools/app-starter-environment.ts
 var STARTER_ENVIRONMENT = String.raw`import { existsSync, readFileSync } from "node:fs";
@@ -251271,15 +252045,15 @@ and governance; TypeScript checks both application and generated source.
 }
 async function initializeAppProject(options) {
   const root = resolve17(options.root ?? process.cwd());
-  const name = options.name ?? basename8(root);
+  const name = options.name ?? basename9(root);
   if (!/^[a-z][a-z0-9-]*$/.test(name) || name.length > 100) {
     throw new Error("Project name must be lowercase kebab-case (1-100 characters)");
   }
-  await mkdir4(root, { recursive: true });
+  await mkdir5(root, { recursive: true });
   const stat = await lstat3(root);
   if (stat.isSymbolicLink() || !stat.isDirectory())
     throw new Error("Project root must be a real directory");
-  if ((await readdir4(root)).some((entry) => entry !== ".git")) {
+  if ((await readdir5(root)).some((entry) => entry !== ".git")) {
     throw new Error("app init requires an empty directory (an existing .git directory is allowed)");
   }
   const template = options.template ?? "minimal";
@@ -251288,16 +252062,16 @@ async function initializeAppProject(options) {
     "@supabase/supabase-js": sdkMetadata.peerDependencies["@supabase/supabase-js"]
   });
   for (const [relativePath, content] of Object.entries(files)) {
-    const path = join12(root, relativePath);
-    await mkdir4(dirname10(path), { recursive: true });
-    await writeFile4(path, content, { encoding: "utf8", flag: "wx" });
+    const path = join13(root, relativePath);
+    await mkdir5(dirname10(path), { recursive: true });
+    await writeFile5(path, content, { encoding: "utf8", flag: "wx" });
   }
   return { root, name, files: Object.keys(files) };
 }
 
 // src/shared/tools/app-database-check.ts
 import { existsSync as existsSync12 } from "node:fs";
-import { join as join13, resolve as resolve18 } from "node:path";
+import { join as join14, resolve as resolve18 } from "node:path";
 var CHECK_ENTRY = `
 import { createRequire } from "node:module";
 import { join } from "node:path";
@@ -251309,7 +252083,7 @@ await import(pathToFileURL(cli).href);
 `;
 function checkAppDatabaseSources(projectRoot) {
   const root = resolve18(projectRoot);
-  if (!existsSync12(join13(root, "database.sources.json")))
+  if (!existsSync12(join14(root, "database.sources.json")))
     return;
   const name = "database-source-contracts";
   try {
@@ -251440,7 +252214,7 @@ test("${name} controller preserves an asynchronous read failure", async () => {
 // src/shared/tools/app-local-dev.ts
 import { spawn } from "node:child_process";
 import { readFile as readFile4 } from "node:fs/promises";
-import { join as join14, resolve as resolve19 } from "node:path";
+import { join as join15, resolve as resolve19 } from "node:path";
 function localDatabaseUrl(value) {
   try {
     if (!value || /[\x00-\x20\x7f]/.test(value))
@@ -251499,7 +252273,7 @@ async function runLocalDevelopment(options) {
     throw new Error("Inherited remote context must be complete and explicitly tagged with SUPACLOUD_ENV=test");
   }
   const script = profile === "integration" ? "dev:integration" : "dev";
-  const manifest = JSON.parse(await readFile4(join14(root, "package.json"), "utf8"));
+  const manifest = JSON.parse(await readFile4(join15(root, "package.json"), "utf8"));
   const scripts = manifest && typeof manifest === "object" && "scripts" in manifest ? manifest.scripts : undefined;
   const command = scripts && typeof scripts === "object" ? Reflect.get(scripts, script) : undefined;
   if (typeof command !== "string" || !command.trim()) {
@@ -251587,7 +252361,7 @@ async function runLocalDevelopment(options) {
 }
 
 // src/shared/tools/app-verification-plan.ts
-import { readdir as readdir5, realpath as realpath5 } from "node:fs/promises";
+import { readdir as readdir6, realpath as realpath5 } from "node:fs/promises";
 import { dirname as dirname11, isAbsolute as isAbsolute6, relative as relative11, resolve as resolve20 } from "node:path";
 function inside3(root, file) {
   const path = relative11(root, file).replaceAll("\\", "/");
@@ -251618,7 +252392,7 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
       manual.push("A source directory is outside the project; select its owning project explicitly");
       continue;
     }
-    for (const entry of await readdir5(actual, { withFileTypes: true })) {
+    for (const entry of await readdir6(actual, { withFileTypes: true })) {
       if (entry.isFile() && /\.(test|spec)\.[cm]?[jt]sx?$/.test(entry.name)) {
         tests.add(relative11(project, resolve20(actual, entry.name)).replaceAll("\\", "/"));
       }
@@ -251648,8 +252422,8 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
 
 // src/shared/tools/app-scaffold-writes.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { link, lstat as lstat4, mkdir as mkdir5, open as open4, readFile as readFile8, realpath as realpath6, rename as rename5, rmdir, unlink as unlink3 } from "node:fs/promises";
-import { dirname as dirname12, isAbsolute as isAbsolute7, join as join15, relative as relative12, resolve as resolve23, sep as sep11, win32 } from "node:path";
+import { link, lstat as lstat4, mkdir as mkdir6, open as open4, readFile as readFile8, realpath as realpath6, rename as rename5, rmdir, unlink as unlink3 } from "node:fs/promises";
+import { dirname as dirname12, isAbsolute as isAbsolute7, join as join16, relative as relative12, resolve as resolve23, sep as sep11, win32 } from "node:path";
 
 class ScaffoldError extends Error {
   code;
@@ -251682,7 +252456,7 @@ async function snapshot(root, path) {
   const parts = relative12(root, target).split(sep11);
   let current = root;
   for (const [index, part] of parts.entries()) {
-    current = join15(current, part);
+    current = join16(current, part);
     let stat;
     try {
       stat = await lstat4(current);
@@ -251732,7 +252506,7 @@ async function planScaffoldWrites(root, writes) {
   return Object.freeze({ root: canonical, writes: Object.freeze(planned) });
 }
 async function applyScaffoldWrites(plan) {
-  const lockPath = join15(plan.root, ".supacloud-generate.lock");
+  const lockPath = join16(plan.root, ".supacloud-generate.lock");
   const lock = await open4(lockPath, "wx").catch((error) => {
     if (fsCode(error) === "EEXIST")
       throw new ScaffoldError("SCAFFOLD_BUSY", "Another generator owns .supacloud-generate.lock; no files written");
@@ -251753,9 +252527,9 @@ async function applyScaffoldWrites(plan) {
       const target = scaffoldPath(plan.root, write.path);
       let current = plan.root;
       for (const part of relative12(plan.root, dirname12(target)).split(sep11).filter(Boolean)) {
-        current = join15(current, part);
+        current = join16(current, part);
         try {
-          await mkdir5(current);
+          await mkdir6(current);
           directories.push(current);
         } catch (error) {
           if (fsCode(error) !== "EEXIST")
@@ -251986,19 +252760,19 @@ async function generateScaffold(args) {
   let contractName;
   if (kind === "module" || kind === "resource") {
     const name = requireIdentifier(args.name, "name");
-    modulePath = join16(dir, name, `${name}.module.ts`).replaceAll("\\", "/");
+    modulePath = join17(dir, name, `${name}.module.ts`).replaceAll("\\", "/");
     moduleSymbol = `${pascalName2(name)}Module`;
     if (kind === "module")
       writes.push({ path: modulePath, content: moduleScaffold(name), overwrite: args.force === true });
     else
       for (const [file, content] of Object.entries(resourceScaffold(name, pascalName2(name)))) {
-        writes.push({ path: join16(dir, name, file).replaceAll("\\", "/"), content });
+        writes.push({ path: join17(dir, name, file).replaceAll("\\", "/"), content });
       }
   } else {
     const moduleName = requireIdentifier(args.module, "module");
     const name = kind === "controller" ? moduleName : requireIdentifier(args.name, "name");
     const subdir = kind === "command" ? "commands" : kind === "query" ? "queries" : kind === "job" ? "jobs" : kind === "contract" ? "contracts" : "";
-    const path = join16(dir, moduleName, subdir, `${name}.${kind}.ts`).replaceAll("\\", "/");
+    const path = join17(dir, moduleName, subdir, `${name}.${kind}.ts`).replaceAll("\\", "/");
     if (kind === "controller" && existsSync13(scaffoldPath(root, path))) {
       throw new ScaffoldError("SCAFFOLD_EXISTS", `Controller already exists: ${path}（请手工合并路由到现有 controller）`);
     }
@@ -252048,7 +252822,7 @@ async function generateScaffold(args) {
       written: !args.dry_run,
       changes
     }, null, 2));
-  const lines = changes.map((change) => `${args.dry_run ? "PREVIEW" : "✅"} ${change.action}: ${join16(plan.root, change.path)}`);
+  const lines = changes.map((change) => `${args.dry_run ? "PREVIEW" : "✅"} ${change.action}: ${join17(plan.root, change.path)}`);
   if (args.dry_run)
     lines.push("No files written. Omit --dry-run to apply this generation.");
   if (kind === "resource")
@@ -252084,12 +252858,12 @@ function parseInclude(include) {
   return patterns && patterns.length > 0 ? patterns : undefined;
 }
 function sourceRoot(args, root, configured) {
-  const hasConfig = ["ts", "mts", "js", "mjs"].some((extension) => existsSync13(join16(root, `supacloud.config.${extension}`)));
+  const hasConfig = ["ts", "mts", "js", "mjs"].some((extension) => existsSync13(join17(root, `supacloud.config.${extension}`)));
   return args.root && !hasConfig ? "." : configured;
 }
 async function projectCompileConfig(args) {
   const root = resolve24(args.root || process.cwd());
-  const configFile = ["ts", "mts", "js", "mjs"].map((extension) => join16(root, `supacloud.config.${extension}`)).find((candidate) => existsSync13(candidate)) ?? null;
+  const configFile = ["ts", "mts", "js", "mjs"].map((extension) => join17(root, `supacloud.config.${extension}`)).find((candidate) => existsSync13(candidate)) ?? null;
   const loadedConfig = await loadSupacloudConfig(root);
   const defaults = resolveSupacloudConfig(loadedConfig, root);
   const configuredRoot = sourceRoot(args, root, loadedConfig.root);
@@ -252106,7 +252880,7 @@ async function projectCompileConfig(args) {
   return { root, sourceDir: compileOptions.rootDir, configFile, outDir, result };
 }
 async function readAllowedDependencies(root) {
-  const path = join16(root, "package.json");
+  const path = join17(root, "package.json");
   if (!existsSync13(path))
     return { dependencies: [], devDependencies: [] };
   try {
@@ -252187,14 +252961,14 @@ async function findUnwiredContracts(rootDir) {
   async function walk(directory) {
     let entries;
     try {
-      entries = await readdir6(directory, { withFileTypes: true });
+      entries = await readdir7(directory, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (skip.has(entry.name))
         continue;
-      const path = join16(directory, entry.name);
+      const path = join17(directory, entry.name);
       if (entry.isDirectory())
         await walk(path);
       else if (entry.isFile() && entry.name.endsWith(".ts"))
@@ -252212,7 +252986,7 @@ async function findUnwiredContracts(rootDir) {
     const symbols = [...source.matchAll(/export\s+const\s+([A-Za-z_$][A-Za-z0-9_$]*)/g)].map((match) => match[1]);
     if (symbols.length === 0)
       continue;
-    const moduleName = basename9(contract).replace(/\.ts$/, "");
+    const moduleName = basename10(contract).replace(/\.ts$/, "");
     const wired = otherSources.some((text) => text.includes(moduleName) || symbols.some((symbol) => new RegExp(`\\b${symbol}\\b`).test(text)));
     if (!wired)
       unwired.push({ file: relative13(rootDir, contract), symbols });
@@ -252305,7 +253079,7 @@ function devDatabase(profile, explicit) {
 }
 function readManifestModules(outDir) {
   try {
-    const parsed = JSON.parse(readFileSync10(join16(outDir, "app.manifest.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync10(join17(outDir, "app.manifest.json"), "utf8"));
     return Array.isArray(parsed.modules) ? parsed.modules.map((module) => module.name) : [];
   } catch {
     return [];
@@ -252512,7 +253286,7 @@ async function runCheck(args) {
 async function readManifest(root, args) {
   const config = await loadSupacloudConfig(root);
   const outDir = args.out_dir ? resolve24(root, args.out_dir) : resolveSupacloudConfig(config, root).outDir;
-  const manifestPath = join16(outDir, "app.manifest.json");
+  const manifestPath = join17(outDir, "app.manifest.json");
   if (!existsSync13(manifestPath)) {
     throw new Error(`Manifest not found: ${manifestPath}（先运行 app compile 生成）`);
   }
@@ -252702,15 +253476,15 @@ async function runExportTools(args) {
   const root = resolve24(args.root || process.cwd());
   const manifest = await readManifest(root, { ...args, out_dir: undefined });
   const definitions = buildToolDefinitions(manifest);
-  const outDir = resolve24(args.out_dir || join16(root, "generated"));
+  const outDir = resolve24(args.out_dir || join17(root, "generated"));
   if (args.format === "json") {
     return textResult(JSON.stringify(definitions, null, 2));
   }
-  await mkdir6(outDir, { recursive: true });
-  const openaiPath = join16(outDir, "tool-definitions.openai.json");
-  const mcpPath = join16(outDir, "tool-definitions.mcp.json");
-  await writeFile5(openaiPath, JSON.stringify(definitions.openai, null, 2), "utf8");
-  await writeFile5(mcpPath, JSON.stringify(definitions.mcp, null, 2), "utf8");
+  await mkdir7(outDir, { recursive: true });
+  const openaiPath = join17(outDir, "tool-definitions.openai.json");
+  const mcpPath = join17(outDir, "tool-definitions.mcp.json");
+  await writeFile6(openaiPath, JSON.stringify(definitions.openai, null, 2), "utf8");
+  await writeFile6(mcpPath, JSON.stringify(definitions.mcp, null, 2), "utf8");
   const summary = [
     `exported ${definitions.openai.length} tool(s):`,
     `  openai → ${openaiPath}`,
@@ -252904,440 +253678,7 @@ function registerAppAliases(server2) {
 
 // src/shared/tools/db-governance-tools.ts
 import { existsSync as existsSync14 } from "node:fs";
-import { join as join17, resolve as resolve25 } from "node:path";
-
-// node_modules/@supacloud/db/dist/index.js
-var TABLES_SQL = `
-SELECT n.nspname AS schema,
-       c.relname AS name,
-       c.relrowsecurity AS rls_enabled,
-       c.relforcerowsecurity AS rls_forced
-FROM pg_class c
-JOIN pg_namespace n ON n.oid = c.relnamespace
-WHERE c.relkind = 'r'
-  AND n.nspname = ANY($1)
-ORDER BY n.nspname, c.relname
-`;
-var POLICIES_SQL = `
-SELECT n.nspname AS schema,
-       c.relname AS table,
-       p.polname AS name,
-       p.polcmd AS command,
-       ARRAY(
-         SELECT CASE WHEN r = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(r) END
-         FROM unnest(p.polroles) AS r
-       ) AS roles,
-       pg_get_expr(p.polqual, p.polrelid) AS using_expr,
-       pg_get_expr(p.polwithcheck, p.polrelid) AS check_expr
-FROM pg_policy p
-JOIN pg_class c ON c.oid = p.polrelid
-JOIN pg_namespace n ON n.oid = c.relnamespace
-WHERE n.nspname = ANY($1)
-ORDER BY n.nspname, c.relname, p.polname
-`;
-var FUNCTIONS_SQL = `
-SELECT n.nspname AS schema,
-       p.proname AS name,
-       p.prosecdef AS security_definer,
-       p.proconfig AS config,
-       l.lanname AS language
-FROM pg_proc p
-JOIN pg_namespace n ON n.oid = p.pronamespace
-JOIN pg_language l ON l.oid = p.prolang
-WHERE n.nspname = ANY($1)
-ORDER BY n.nspname, p.proname
-`;
-var TRIGGERS_SQL = `
-SELECT n.nspname AS schema,
-       c.relname AS table,
-       t.tgname AS name,
-       t.tgenabled <> 'D' AS enabled
-FROM pg_trigger t
-JOIN pg_class c ON c.oid = t.tgrelid
-JOIN pg_namespace n ON n.oid = c.relnamespace
-WHERE NOT t.tgisinternal
-  AND n.nspname = ANY($1)
-ORDER BY n.nspname, c.relname, t.tgname
-`;
-var GRANTS_SQL = `
-SELECT table_schema AS object_schema,
-       table_name AS object_name,
-       privilege_type AS privilege,
-       grantee
-FROM information_schema.role_table_grants
-WHERE table_schema = ANY($1)
-UNION ALL
-SELECT routine_schema AS object_schema,
-       routine_name AS object_name,
-       privilege_type AS privilege,
-       grantee
-FROM information_schema.routine_privileges
-WHERE routine_schema = ANY($1)
-`;
-var POLCMD_MAP = {
-  r: "select",
-  a: "insert",
-  w: "update",
-  d: "delete",
-  "*": "all"
-};
-function extractSearchPath(config) {
-  if (!config)
-    return null;
-  const entry = config.find((item) => item.startsWith("search_path="));
-  if (!entry)
-    return null;
-  return entry.slice("search_path=".length);
-}
-async function readCatalog(executor, schemas = ["public"]) {
-  const params = [schemas];
-  const [tableRows, policyRows, functionRows, triggerRows, grantRows] = await Promise.all([
-    executor.query(TABLES_SQL, params),
-    executor.query(POLICIES_SQL, params),
-    executor.query(FUNCTIONS_SQL, params),
-    executor.query(TRIGGERS_SQL, params),
-    executor.query(GRANTS_SQL, params)
-  ]);
-  return {
-    tables: tableRows.map((row) => ({
-      schema: row.schema,
-      name: row.name,
-      rlsEnabled: row.rls_enabled,
-      rlsForced: row.rls_forced
-    })),
-    policies: policyRows.map((row) => ({
-      schema: row.schema,
-      table: row.table,
-      name: row.name,
-      command: POLCMD_MAP[row.command] ?? "all",
-      roles: row.roles ?? [],
-      usingExpr: row.using_expr ?? undefined,
-      checkExpr: row.check_expr ?? undefined
-    })),
-    functions: functionRows.map((row) => ({
-      schema: row.schema,
-      name: row.name,
-      security: row.security_definer ? "definer" : "invoker",
-      searchPath: extractSearchPath(row.config),
-      language: row.language
-    })),
-    triggers: triggerRows.map((row) => ({
-      schema: row.schema,
-      table: row.table,
-      name: row.name,
-      enabled: row.enabled
-    })),
-    grants: grantRows.map((row) => ({
-      objectSchema: row.object_schema,
-      objectName: row.object_name,
-      privilege: row.privilege,
-      grantee: row.grantee
-    }))
-  };
-}
-function splitQualifiedName(name) {
-  const dot = name.indexOf(".");
-  if (dot === -1)
-    return ["public", name];
-  return [name.slice(0, dot), name.slice(dot + 1)];
-}
-function isFixedSearchPath(searchPath) {
-  if (searchPath === null)
-    return false;
-  const parts = searchPath.split(",").map((part) => part.trim().replace(/^"|"$/g, ""));
-  return parts.every((part) => part !== "" && part.toLowerCase() !== "pg_temp");
-}
-function reconcileModule(module, catalog) {
-  const issues = [];
-  const ownedTables = new Set(module.tables);
-  const push = (severity, code, object, message) => issues.push({ severity, code, object, message });
-  for (const policy of module.policies) {
-    const [schema, table] = splitQualifiedName(policy.table);
-    const found = catalog.policies.some((cp) => cp.schema === schema && cp.table === table && cp.name === policy.name);
-    if (!found) {
-      push("error", "missing-policy", `${policy.table}.${policy.name}`, `声明的策略 ${policy.name} 在表 ${policy.table} 的 catalog 中不存在`);
-    }
-  }
-  const declaredPolicyKeys = new Set(module.policies.map((p) => `${p.table}::${p.name}`));
-  for (const cp of catalog.policies) {
-    const qualified = `${cp.schema}.${cp.table}`;
-    if (ownedTables.has(qualified) && !declaredPolicyKeys.has(`${qualified}::${cp.name}`)) {
-      push("warn", "undeclared-policy", `${qualified}.${cp.name}`, `归属表 ${qualified} 上存在未声明的策略 ${cp.name}，可能发生漂移`);
-    }
-  }
-  for (const fn of module.functions) {
-    const [schema, name] = splitQualifiedName(fn.name);
-    const cf = catalog.functions.find((f) => f.schema === schema && f.name === name);
-    if (!cf) {
-      push("error", "missing-function", fn.name, `声明的函数 ${fn.name} 在 catalog 中不存在`);
-      continue;
-    }
-    if (cf.security !== fn.security) {
-      push("warn", "security-mismatch", fn.name, `函数 ${fn.name} 声明为 security ${fn.security}，catalog 实际为 ${cf.security}`);
-    }
-    const effectiveDefiner = fn.security === "definer" || cf.security === "definer";
-    if (effectiveDefiner && !isFixedSearchPath(cf.searchPath)) {
-      push("error", "definer-without-search-path", fn.name, `security definer 函数 ${fn.name} 未设置固定 search_path（当前: ${cf.searchPath ?? "未设置"}）`);
-    }
-  }
-  for (const trigger of module.triggers) {
-    const [schema, table] = splitQualifiedName(trigger.table);
-    const found = catalog.triggers.some((ct) => ct.schema === schema && ct.table === table && ct.name === trigger.name);
-    if (!found) {
-      push("error", "missing-trigger", `${trigger.table}.${trigger.name}`, `声明的触发器 ${trigger.name} 在表 ${trigger.table} 的 catalog 中不存在`);
-    }
-  }
-  const declaredTriggerKeys = new Set(module.triggers.map((t) => `${t.table}::${t.name}`));
-  for (const ct of catalog.triggers) {
-    const qualified = `${ct.schema}.${ct.table}`;
-    if (ownedTables.has(qualified) && !declaredTriggerKeys.has(`${qualified}::${ct.name}`)) {
-      push("warn", "undeclared-trigger", `${qualified}.${ct.name}`, `归属表 ${qualified} 上存在未声明的触发器 ${ct.name}${ct.enabled ? "" : "（已禁用）"}，可能发生漂移`);
-    }
-  }
-  for (const table of module.tables) {
-    const [schema, name] = splitQualifiedName(table);
-    const ct = catalog.tables.find((t) => t.schema === schema && t.name === name);
-    if (ct && !ct.rlsEnabled) {
-      push("error", "rls-disabled", table, `归属表 ${table} 未开启行级安全（relrowsecurity = false）`);
-    }
-  }
-  for (const grant of catalog.grants) {
-    const qualified = `${grant.objectSchema}.${grant.objectName}`;
-    if (ownedTables.has(qualified) && grant.grantee.toUpperCase() === "PUBLIC") {
-      push("error", "wildcard-grant", qualified, `归属表 ${qualified} 存在授予 PUBLIC 的 ${grant.privilege} 权限`);
-    }
-  }
-  for (const grant of module.grants) {
-    const [schema, name] = splitQualifiedName(grant.object);
-    const found = catalog.grants.some((cg) => cg.objectSchema === schema && cg.objectName === name && cg.privilege.toLowerCase() === grant.privilege.toLowerCase() && cg.grantee.toLowerCase() === grant.role.toLowerCase());
-    if (!found) {
-      push("warn", "grant-drift", grant.object, `声明的授权 ${grant.privilege} ON ${grant.object} TO ${grant.role} 在 catalog 中不存在`);
-    }
-  }
-  return {
-    module: module.name,
-    issues,
-    ok: !issues.some((issue) => issue.severity === "error")
-  };
-}
-var SECURITY_DEFINER_RE = /\bsecurity\s+definer\b/i;
-var SET_SEARCH_PATH_RE = /\bset\s+search_path\b/i;
-var GRANT_TO_PUBLIC_RE = /\bgrant\b[^;]*\bto\s+public\b/i;
-var DROP_WITHOUT_IF_EXISTS_RE = /\bdrop\s+(?:table|column)\s+(?!if\s+exists\b)/i;
-var ENABLE_RLS_RE = /\benable\s+row\s+level\s+security\b/i;
-var CREATE_POLICY_RE = /\bcreate\s+policy\b/i;
-var DROP_POLICY_IF_EXISTS_RE = /\bdrop\s+policy\s+if\s+exists\b/i;
-function lineOf2(sql, index) {
-  let line = 1;
-  for (let i = 0;i < index; i += 1) {
-    if (sql.charCodeAt(i) === 10)
-      line += 1;
-  }
-  return line;
-}
-function lintSql(sql, file) {
-  const issues = [];
-  const definer = SECURITY_DEFINER_RE.exec(sql);
-  if (definer && !SET_SEARCH_PATH_RE.test(sql)) {
-    issues.push({
-      severity: "error",
-      code: "definer-no-search-path",
-      message: "security definer 函数必须显式 set search_path，避免 search_path 劫持",
-      file,
-      line: lineOf2(sql, definer.index)
-    });
-  }
-  const grantPublic = GRANT_TO_PUBLIC_RE.exec(sql);
-  if (grantPublic) {
-    issues.push({
-      severity: "error",
-      code: "grant-to-public",
-      message: "禁止将权限授予 PUBLIC 角色",
-      file,
-      line: lineOf2(sql, grantPublic.index)
-    });
-  }
-  const drop = DROP_WITHOUT_IF_EXISTS_RE.exec(sql);
-  if (drop) {
-    issues.push({
-      severity: "warn",
-      code: "drop-without-if-exists",
-      message: "drop table/column 建议使用 if exists，保证迁移可重入",
-      file,
-      line: lineOf2(sql, drop.index)
-    });
-  }
-  const createPolicy = CREATE_POLICY_RE.exec(sql);
-  if (createPolicy) {
-    const dropPolicy = DROP_POLICY_IF_EXISTS_RE.exec(sql);
-    if (!dropPolicy || dropPolicy.index > createPolicy.index) {
-      issues.push({
-        severity: "warn",
-        code: "non-idempotent-policy",
-        message: "create policy 前缺少 drop policy if exists，策略不可重复执行",
-        file,
-        line: lineOf2(sql, createPolicy.index)
-      });
-    }
-  }
-  return issues;
-}
-async function lintModule(module, readFile) {
-  const issues = [];
-  const sources = new Set;
-  for (const decl of [
-    ...module.policies,
-    ...module.functions,
-    ...module.triggers,
-    ...module.grants
-  ]) {
-    sources.add(decl.source);
-  }
-  const contents = new Map;
-  await Promise.all([...sources].map(async (path) => {
-    contents.set(path, await readFile(path));
-  }));
-  for (const [file, sql] of contents) {
-    issues.push(...lintSql(sql, file));
-  }
-  if (module.policies.length > 0) {
-    const anyEnable = module.policies.some((policy) => ENABLE_RLS_RE.test(contents.get(policy.source) ?? ""));
-    if (!anyEnable) {
-      issues.push({
-        severity: "warn",
-        code: "missing-rls-enable",
-        message: `模块 ${module.name} 声明了 ${module.policies.length} 条策略，但所有策略源文件都没有 enable row level security`,
-        file: module.policies[0].source
-      });
-    }
-  }
-  for (const policy of module.policies) {
-    if (!policy.tests || policy.tests.length === 0) {
-      issues.push({
-        severity: "warn",
-        code: "policy-without-test",
-        message: `策略 ${policy.name} 未声明测试文件`,
-        file: policy.source
-      });
-    }
-  }
-  for (const fn of module.functions) {
-    if (!fn.tests || fn.tests.length === 0) {
-      issues.push({
-        severity: "warn",
-        code: "policy-without-test",
-        message: `函数 ${fn.name} 未声明测试文件`,
-        file: fn.source
-      });
-    }
-  }
-  return issues;
-}
-function buildDatabaseManifest(modules) {
-  return {
-    version: 1,
-    modules: modules.map((module) => ({
-      name: module.name,
-      tables: module.tables,
-      policies: module.policies,
-      functions: module.functions,
-      triggers: module.triggers,
-      grants: module.grants
-    }))
-  };
-}
-function describePolicy(moduleName, policy) {
-  const lines = [
-    `对象: ${policy.table}.${policy.name}`,
-    "类型: 策略 (policy)",
-    `所属模块: ${moduleName}`,
-    `表: ${policy.table}`,
-    `操作: ${policy.operation}`,
-    `角色: ${policy.roles.join(", ")}`,
-    `源文件: ${policy.source}`
-  ];
-  if (policy.tests && policy.tests.length > 0)
-    lines.push(`测试: ${policy.tests.join(", ")}`);
-  return lines.join(`
-`);
-}
-function describeFunction(moduleName, fn) {
-  const lines = [
-    `对象: ${fn.name}`,
-    "类型: 函数 (function)",
-    `所属模块: ${moduleName}`,
-    `源文件: ${fn.source}`,
-    `安全模式: ${fn.security}`
-  ];
-  if (fn.permission)
-    lines.push(`权限: ${fn.permission}`);
-  if (fn.transaction)
-    lines.push(`事务: ${fn.transaction}`);
-  if (fn.audit)
-    lines.push(`审计: ${fn.audit}`);
-  if (fn.idempotency)
-    lines.push(`幂等: ${fn.idempotency}`);
-  if (fn.tests && fn.tests.length > 0)
-    lines.push(`测试: ${fn.tests.join(", ")}`);
-  return lines.join(`
-`);
-}
-function describeTrigger(moduleName, trigger) {
-  return [
-    `对象: ${trigger.name}`,
-    "类型: 触发器 (trigger)",
-    `所属模块: ${moduleName}`,
-    `表: ${trigger.table}`,
-    `源文件: ${trigger.source}`
-  ].join(`
-`);
-}
-function describeGrant(moduleName, grant) {
-  return [
-    `对象: ${grant.object}`,
-    "类型: 授权 (grant)",
-    `所属模块: ${moduleName}`,
-    `权限: ${grant.privilege}`,
-    `角色: ${grant.role}`,
-    `源文件: ${grant.source}`
-  ].join(`
-`);
-}
-function explainObject(manifest, name) {
-  for (const module of manifest.modules) {
-    for (const policy of module.policies) {
-      if (policy.name === name || `${policy.table}.${policy.name}` === name) {
-        return describePolicy(module.name, policy);
-      }
-    }
-    for (const fn of module.functions) {
-      if (fn.name === name)
-        return describeFunction(module.name, fn);
-    }
-    for (const trigger of module.triggers) {
-      if (trigger.name === name || `${trigger.table}.${trigger.name}` === name) {
-        return describeTrigger(module.name, trigger);
-      }
-    }
-    for (const table of module.tables) {
-      if (table === name) {
-        return [
-          `对象: ${table}`,
-          "类型: 表 (table)",
-          `所属模块: ${module.name}`
-        ].join(`
-`);
-      }
-    }
-    for (const grant of module.grants) {
-      if (grant.object === name)
-        return describeGrant(module.name, grant);
-    }
-  }
-  return `未找到对象: ${name}`;
-}
-
-// src/shared/tools/db-governance-tools.ts
+import { join as join18, resolve as resolve25 } from "node:path";
 function textResult2(text, isError = false) {
   return { isError, content: [{ type: "text", text }] };
 }
@@ -253356,7 +253697,7 @@ function normalizeModule(candidate, sourcePath) {
   };
 }
 async function loadDatabaseModules(root, moduleFile) {
-  const filePath = moduleFile ? resolve25(root, moduleFile) : join17(root, "db", "modules.ts");
+  const filePath = moduleFile ? resolve25(root, moduleFile) : join18(root, "db", "modules.ts");
   if (!existsSync14(filePath)) {
     throw new Error(moduleFile ? `Module file not found: ${filePath}` : `Module file not found: ${filePath}（用 --module_file 指定一个导出 defineDatabaseModule(...) 的文件）`);
   }
@@ -254183,7 +254524,7 @@ var MUTATION_TOOL_SCHEMA = {
 // src/shared/tools/release-tools.ts
 import { createHash as createHash11 } from "node:crypto";
 import { existsSync as existsSync15, mkdirSync as mkdirSync4, readdirSync as readdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname14, join as join18, relative as relative14, resolve as resolve27 } from "node:path";
+import { dirname as dirname14, join as join19, relative as relative14, resolve as resolve27 } from "node:path";
 var SAFE_PROJECT_REF = /^[A-Za-z0-9_-]{1,64}$/;
 var BACKUP_ID = /^logical-full_[A-Za-z0-9_-]{1,64}_[a-f0-9]{32}$/;
 var SHA256 = /^[a-f0-9]{64}$/;
@@ -254511,7 +254852,7 @@ function collectScopeFiles(cwd, file, files, dir, task) {
         const entries = readdirSync5(directory, { withFileTypes: true });
         for (const entry of entries) {
           if (entry.isFile() && entry.name.endsWith(".json")) {
-            const fullPath = join18(directory, entry.name);
+            const fullPath = join19(directory, entry.name);
             if (!taskFilter) {
               results.push(fullPath);
             } else if (entry.name.toLowerCase().includes(taskFilter)) {
@@ -254896,10 +255237,10 @@ function registerReleaseTools(server2, http, options = {}) {
 }
 
 // src/shared/tools/deploy-tools.ts
-import { access as access4, lstat as lstat5, mkdtemp as mkdtemp2, opendir, readFile as readFile10, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
+import { access as access4, lstat as lstat5, mkdtemp as mkdtemp2, opendir, readFile as readFile10, rm as rm3, writeFile as writeFile7 } from "node:fs/promises";
 import { createHash as createHash12 } from "node:crypto";
 import { tmpdir as tmpdir2 } from "node:os";
-import { basename as basename10, dirname as dirname15, join as join19, relative as relative15, resolve as resolve28, sep as sep12 } from "node:path";
+import { basename as basename11, dirname as dirname15, join as join20, relative as relative15, resolve as resolve28, sep as sep12 } from "node:path";
 
 // node_modules/fflate/esm/index.mjs
 import { createRequire as createRequire3 } from "module";
@@ -255592,7 +255933,7 @@ async function readJson(path) {
 async function findDeployConfigRoot(startDirectory) {
   let directory = resolve28(startDirectory);
   while (true) {
-    if (await pathExists(join19(directory, "supacloud.json")))
+    if (await pathExists(join20(directory, "supacloud.json")))
       return directory;
     const parent = dirname15(directory);
     if (parent === directory)
@@ -255639,7 +255980,7 @@ function deployTargetConfig(candidate, name) {
   };
 }
 async function readDeployConfig(configRoot) {
-  const configPath = join19(configRoot, "supacloud.json");
+  const configPath = join20(configRoot, "supacloud.json");
   const candidate = await readJson(configPath);
   if (candidate === null)
     return {};
@@ -255661,25 +256002,25 @@ async function readDeployConfig(configRoot) {
   };
 }
 async function packageName(projectDirectory) {
-  const candidate = record5(await readJson(join19(projectDirectory, "package.json")));
+  const candidate = record5(await readJson(join20(projectDirectory, "package.json")));
   return typeof candidate?.name === "string" && candidate.name.trim() ? candidate.name.trim() : null;
 }
 async function pathExists(path) {
   return access4(path).then(() => true, () => false);
 }
 async function defaultBuildCommand(projectDirectory, configRoot) {
-  const packageJson = record5(await readJson(join19(projectDirectory, "package.json")));
+  const packageJson = record5(await readJson(join20(projectDirectory, "package.json")));
   const scripts = record5(packageJson?.scripts);
   if (typeof scripts?.build !== "string" || !scripts.build.trim()) {
     throw new Error("No build command was configured and package.json has no build script");
   }
   let directory = projectDirectory;
   while (true) {
-    if (await pathExists(join19(directory, "bun.lock")) || await pathExists(join19(directory, "bun.lockb")))
+    if (await pathExists(join20(directory, "bun.lock")) || await pathExists(join20(directory, "bun.lockb")))
       return "bun run build";
-    if (await pathExists(join19(directory, "pnpm-lock.yaml")))
+    if (await pathExists(join20(directory, "pnpm-lock.yaml")))
       return "pnpm run build";
-    if (await pathExists(join19(directory, "yarn.lock")))
+    if (await pathExists(join20(directory, "yarn.lock")))
       return "yarn build";
     if (directory === configRoot)
       break;
@@ -255798,7 +256139,7 @@ async function collectArchiveFiles(root) {
       entries.push(entry);
     entries.sort((left, right) => left.name.localeCompare(right.name, "en"));
     for (const entry of entries) {
-      const path = join19(directory, entry.name);
+      const path = join20(directory, entry.name);
       const stats = await lstat5(path);
       if (stats.isSymbolicLink())
         throw new Error(`Frontend output cannot contain symbolic links: ${path}`);
@@ -255827,11 +256168,11 @@ async function collectArchiveFiles(root) {
 }
 async function createFrontendArchive(outputDirectory) {
   const collected = await collectArchiveFiles(outputDirectory);
-  const temporaryDirectory = await mkdtemp2(join19(tmpdir2(), "supacloud-deploy-"));
-  const archivePath = join19(temporaryDirectory, `${basename10(outputDirectory)}.zip`);
+  const temporaryDirectory = await mkdtemp2(join20(tmpdir2(), "supacloud-deploy-"));
+  const archivePath = join20(temporaryDirectory, `${basename11(outputDirectory)}.zip`);
   try {
     const archiveBytes = zipSync(collected.files, { level: 6, mtime: FIXED_ZIP_MTIME });
-    await writeFile6(archivePath, archiveBytes);
+    await writeFile7(archivePath, archiveBytes);
     const sha256 = createHash12("sha256").update(archiveBytes).digest("hex");
     return {
       archivePath,
@@ -256052,9 +256393,9 @@ function registerDeployTools(server2, http, options = {}) {
 // src/shared/tools/remote-dev-tools.ts
 import { existsSync as existsSync16 } from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
-import { readdir as readdir7 } from "node:fs/promises";
+import { readdir as readdir8 } from "node:fs/promises";
 import { createHash as createHash13 } from "node:crypto";
-import { join as join20, resolve as resolve29 } from "node:path";
+import { join as join21, resolve as resolve29 } from "node:path";
 var SAFE_TOKEN = /^[A-Za-z0-9._:@/+,-]+$/;
 var SAFE_REMOTE_ROOT = /^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+\/?$/;
 var remoteDevToolSchema = {
@@ -256088,7 +256429,7 @@ async function runProcess(executable, args, cwd) {
 function resolveDrizzleCommand(root, configured) {
   if (configured?.trim())
     return configured.trim();
-  const local = join20(root, "node_modules", ".bin", "drizzle-kit");
+  const local = join21(root, "node_modules", ".bin", "drizzle-kit");
   return existsSync16(local) ? local : "drizzle-kit";
 }
 function toolFailed(value) {
@@ -256120,7 +256461,7 @@ async function migrateDatabase(args, options) {
   return { ok: true, mode: "dev", action: "migrate", generated: true, applied: true, migrations_dir: migrationsDir, result: applied };
 }
 async function readProjectConfig3(root) {
-  const file = join20(root, "supacloud.json");
+  const file = join21(root, "supacloud.json");
   if (!existsSync16(file))
     return {};
   try {
@@ -256137,9 +256478,9 @@ async function readDevConfig(root) {
 async function sourceFingerprint(root) {
   const files = [];
   const visit = async (directory) => {
-    const entries = await readdir7(directory, { withFileTypes: true });
+    const entries = await readdir8(directory, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-      const path = join20(directory, entry.name);
+      const path = join21(directory, entry.name);
       if (entry.isDirectory() && ![".git", "node_modules", "dist", "generated", ".supacloud"].includes(entry.name))
         await visit(path);
       else if (entry.isFile())
@@ -256167,17 +256508,17 @@ function remoteRoot(value) {
 }
 function targetDirectory(root, target, functionSlug, config = {}) {
   if (target === "db")
-    return join20(root, "supabase", "migrations");
+    return join21(root, "supabase", "migrations");
   if (target === "functions") {
     const targets = config.targets && typeof config.targets === "object" ? config.targets : {};
     const match = Object.values(targets).find((entry) => entry?.type === "edge_function" && (!functionSlug || String(entry.slug || "") === functionSlug));
-    const base = match?.root ? resolve29(root, String(match.root)) : join20(root, "supabase", "functions");
-    return match?.root ? base : functionSlug ? join20(base, safeToken(functionSlug, "function")) : base;
+    const base = match?.root ? resolve29(root, String(match.root)) : join21(root, "supabase", "functions");
+    return match?.root ? base : functionSlug ? join21(base, safeToken(functionSlug, "function")) : base;
   }
   if (target === "frontend") {
     const targets = config.targets && typeof config.targets === "object" ? config.targets : {};
     const match = Object.values(targets).find((entry) => entry?.type === "frontend");
-    return match?.root ? resolve29(root, String(match.root)) : join20(root, "apps", "web");
+    return match?.root ? resolve29(root, String(match.root)) : join21(root, "apps", "web");
   }
   return root;
 }
@@ -256314,7 +256655,7 @@ function registerRemoteDevTools(server2, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.70.1",
+  version: "0.71.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -256350,7 +256691,7 @@ var package_default = {
   dependencies: {
     "@supacloud/compiler": "^0.40.1",
     "@supacloud/delivery": "0.8.0",
-    "@supacloud/db": "^0.2.0",
+    "@supacloud/db": "^0.14.0",
     fflate: "^0.8.3",
     typebox: "1.3.34"
   },
@@ -256599,6 +256940,7 @@ EXAMPLES
   ${preferredCommand} database query --ref abc123 --file ./queries/vector-search.sql
   ${preferredCommand} database migration_inventory --ref abc123
   ${preferredCommand} database lint_migrations --dir supabase/migrations
+  ${preferredCommand} database rebase_migrations --dir supabase/migrations --baseline_file backups/schema.sql --baseline_version 20261008000000 --output_dir supabase/migrations-rebased
   ${preferredCommand} database push_migrations --ref abc123 --dir supabase/migrations --dry_run
   ${preferredCommand} supabase migration_new --name add_accounts
   ${preferredCommand} supabase db_diff --schema public --name add_accounts