@supacloud/cli 0.97.1 → 0.98.0

package/dist/index.js

@@ -1,4 +1,5 @@
-#!/usr/bin/env node
+#!/usr/bin/env bun
+// @bun
 import { createRequire } from "node:module";
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
@@ -8616,6 +8617,24 @@ var Delete = _Object_({
   path: String2()
 });
 var Edit = Union([Insert2, Update2, Delete]);
+// src/shared/schema.ts
+function schemaErrorPath(path) {
+  return path.replace(/^\//, "").replaceAll("/", ".") || "args";
+}
+function schemaErrorLines(schema, input) {
+  return [...Errors2(schema, input)].map((issue) => `- ${schemaErrorPath(issue.instancePath)}: ${issue.message}`);
+}
+function validateToolArguments(schema, input) {
+  const issues = schemaErrorLines(_Object_(schema, { additionalProperties: false }), input);
+  if (issues.length > 0)
+    throw new Error(`Invalid arguments:
+${issues.join(`
+`)}`);
+}
+function stringEnum(values, options) {
+  return Enum([...values], options);
+}
+
 // src/shared/schema.ts
 var DECODE_ID = "~supacloudDecodeId";
 
@@ -8633,19 +8652,19 @@ function decodeIdOf(schema) {
   const value = Object.getOwnPropertyDescriptor(schema, DECODE_ID)?.value;
   return typeof value === "symbol" ? value : undefined;
 }
-function schemaErrorPath(path) {
+function schemaErrorPath2(path) {
   return path.replace(/^\//, "").replaceAll("/", ".") || "args";
 }
-function schemaErrorLines(schema, input) {
-  return [...Errors2(schema, input)].map((issue) => `- ${schemaErrorPath(issue.instancePath)}: ${issue.message}`);
+function schemaErrorLines2(schema, input) {
+  return [...Errors2(schema, input)].map((issue) => `- ${schemaErrorPath2(issue.instancePath)}: ${issue.message}`);
 }
 function transformErrorLine(error) {
   const message = error instanceof Error ? error.message : String(error);
-  const path = typeof error === "object" && error !== null && "instancePath" in error && typeof error.instancePath === "string" ? schemaErrorPath(error.instancePath) : "args";
+  const path = typeof error === "object" && error !== null && "instancePath" in error && typeof error.instancePath === "string" ? schemaErrorPath2(error.instancePath) : "args";
   return `- ${path}: ${message}`;
 }
-function validateToolArguments(schema, input) {
-  const issues = schemaErrorLines(_Object_(schema, { additionalProperties: false }), input);
+function validateToolArguments2(schema, input) {
+  const issues = schemaErrorLines2(_Object_(schema, { additionalProperties: false }), input);
   if (issues.length > 0)
     throw new Error(`Invalid arguments:
 ${issues.join(`
@@ -8656,7 +8675,7 @@ function isRecord(value) {
 }
 function parseToolArguments(schema, input) {
   const objectSchema = _Object_(schema, { additionalProperties: false });
-  validateToolArguments(schema, input);
+  validateToolArguments2(schema, input);
   let decoded;
   try {
     decoded = Decode10(objectSchema, input);
@@ -8678,7 +8697,7 @@ ${transformErrorLine(error)}`);
   }
   return decoded;
 }
-function stringEnum(values, options) {
+function stringEnum2(values, options) {
   return Enum([...values], options);
 }
 function mergeSchemaOptions(schema, options) {
@@ -8701,7 +8720,7 @@ function decodedSchema(inputSchema, outputSchema, decode, options) {
   const transform = Decode(inputSchema, (input) => {
     const value = decode(input);
     const issues = [...Errors2(outputSchema, value)].map((issue) => ({
-      path: schemaErrorPath(issue.instancePath),
+      path: schemaErrorPath2(issue.instancePath),
       message: issue.message
     }));
     if (issues.length > 0)
@@ -8912,7 +8931,7 @@ async function runCli(cliTools, args, options = {}) {
     if (startIdx === 2)
       parsedArgs.action = args[1];
     assertCurrentDeploymentInput(args[0], parsedArgs);
-    validateToolArguments(tool.schema, parsedArgs);
+    validateToolArguments2(tool.schema, parsedArgs);
     const result = await tool.callback(parsedArgs);
     if (result && result.content && Array.isArray(result.content)) {
       for (const c of result.content) {
@@ -8943,27 +8962,7 @@ import { homedir } from "node:os";
 import { resolve as resolve2 } from "node:path";
 
 // src/shared/global-options.ts
-var GLOBAL_FLAGS = {
-  "--env": "environmentName",
-  "--env-file": "envFile",
-  "--confirm-production": "confirmProduction"
-};
 var ENVIRONMENT_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
-function globalFlag(arg) {
-  return Object.keys(GLOBAL_FLAGS).find((flag) => arg === flag || arg.startsWith(`${flag}=`)) ?? null;
-}
-function globalFlagValue(args, index, flag) {
-  const inlineValue = args[index].slice(flag.length + 1);
-  if (args[index].startsWith(`${flag}=`)) {
-    if (!inlineValue)
-      throw new Error(`${flag} requires a value`);
-    return { value: inlineValue, consumed: 1 };
-  }
-  const value = args[index + 1];
-  if (!value || value.startsWith("--"))
-    throw new Error(`${flag} requires a value`);
-  return { value, consumed: 2 };
-}
 function normalizeEnvironmentName(name) {
   if (!ENVIRONMENT_NAME_PATTERN.test(name)) {
     throw new Error("--env and SUPACLOUD_ENV must match ^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$");
@@ -8971,30 +8970,6 @@ function normalizeEnvironmentName(name) {
   const normalized = name.toLowerCase();
   return normalized === "prod" || normalized === "production" ? "production" : normalized;
 }
-function parseGlobalOptions(args) {
-  const values = {};
-  const remainingArgs = [];
-  for (let index = 0;index < args.length; ) {
-    const flag = globalFlag(args[index]);
-    if (!flag) {
-      remainingArgs.push(args[index]);
-      index += 1;
-      continue;
-    }
-    const key = GLOBAL_FLAGS[flag];
-    if (values[key] !== undefined)
-      throw new Error(`${flag} may be provided only once`);
-    const parsed = globalFlagValue(args, index, flag);
-    values[key] = parsed.value;
-    index += parsed.consumed;
-  }
-  if (values.environmentName && values.envFile) {
-    throw new Error("--env and --env-file are mutually exclusive");
-  }
-  if (values.environmentName)
-    normalizeEnvironmentName(values.environmentName);
-  return { ...values, args: remainingArgs };
-}
 
 // src/shared/context.ts
 var CORE_CONTEXT_KEYS = [
@@ -9187,6 +9162,60 @@ function resolveSupaCloudContext(env = process.env, cwd = process.cwd(), selecti
   };
 }
 
+// src/shared/global-options.ts
+var GLOBAL_FLAGS = {
+  "--env": "environmentName",
+  "--env-file": "envFile",
+  "--confirm-production": "confirmProduction"
+};
+var ENVIRONMENT_NAME_PATTERN2 = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+function globalFlag(arg) {
+  return Object.keys(GLOBAL_FLAGS).find((flag) => arg === flag || arg.startsWith(`${flag}=`)) ?? null;
+}
+function globalFlagValue(args, index, flag) {
+  const inlineValue = args[index].slice(flag.length + 1);
+  if (args[index].startsWith(`${flag}=`)) {
+    if (!inlineValue)
+      throw new Error(`${flag} requires a value`);
+    return { value: inlineValue, consumed: 1 };
+  }
+  const value = args[index + 1];
+  if (!value || value.startsWith("--"))
+    throw new Error(`${flag} requires a value`);
+  return { value, consumed: 2 };
+}
+function normalizeEnvironmentName2(name) {
+  if (!ENVIRONMENT_NAME_PATTERN2.test(name)) {
+    throw new Error("--env and SUPACLOUD_ENV must match ^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$");
+  }
+  const normalized = name.toLowerCase();
+  return normalized === "prod" || normalized === "production" ? "production" : normalized;
+}
+function parseGlobalOptions(args) {
+  const values = {};
+  const remainingArgs = [];
+  for (let index = 0;index < args.length; ) {
+    const flag = globalFlag(args[index]);
+    if (!flag) {
+      remainingArgs.push(args[index]);
+      index += 1;
+      continue;
+    }
+    const key = GLOBAL_FLAGS[flag];
+    if (values[key] !== undefined)
+      throw new Error(`${flag} may be provided only once`);
+    const parsed = globalFlagValue(args, index, flag);
+    values[key] = parsed.value;
+    index += parsed.consumed;
+  }
+  if (values.environmentName && values.envFile) {
+    throw new Error("--env and --env-file are mutually exclusive");
+  }
+  if (values.environmentName)
+    normalizeEnvironmentName2(values.environmentName);
+  return { ...values, args: remainingArgs };
+}
+
 // src/shared/execution-policy.ts
 var ACTION_POLICY = {
   deploy: { write: ["deploy"] },
@@ -12664,11 +12693,11 @@ function registerDatabaseTools(server, http, config = {}) {
   const allActions = localOnly ? localActions : readOnly ? remoteActions : [...remoteActions, ...writeActions];
   registerTool(server, "database", `Database operations: query, schema, RLS, migrations, stats.
 Actions: ${allActions.join(", ")}${localOnly ? " (local-only mode)" : readOnly ? " (read-only mode)" : ""}`, {
-    action: withDescription(stringEnum(allActions), "Action"),
+    action: withDescription(stringEnum2(allActions), "Action"),
     ref: projectRef ? Optional(String2()) : optional(String2(), "Project ref"),
     sql: optional(String2(), "[query/execute/apply_migration/lint_migrations/lint] SQL statement"),
     file: optional(String2(), "[query/execute/apply_migration/lint_migrations/lint] Read SQL from local file path (avoids shell escaping issues with $$ and multi-statement DDL)"),
-    mode: optional(stringEnum(["read", "migration", "admin"]), "[query/execute] SQL execution mode: read, migration, or admin. execute defaults to migration; query defaults to read/auto"),
+    mode: optional(stringEnum2(["read", "migration", "admin"]), "[query/execute] SQL execution mode: read, migration, or admin. execute defaults to migration; query defaults to read/auto"),
     admin: optional(Boolean2(), "[query/execute] Admin execution flag (required when mode=admin)"),
     dir: optional(String2(), "[push_migrations/baseline_migrations/lint_migrations/lint/rebase_migrations] Directory containing .sql migration files (default: supabase/migrations)"),
     dry_run: optional(Boolean2(), "[push_migrations/baseline_migrations] Preview changes without applying them"),
@@ -12684,7 +12713,7 @@ Actions: ${allActions.join(", ")}${localOnly ? " (local-only mode)" : readOnly ?
     name: optional(String2(), "[apply_migration] Migration name"),
     delivery_manifest: optional(String2(), "[delivery_migration_plan] Local immutable delivery manifest"),
     delivery_target: optional(String2(), "[delivery_migration_plan] Target name from the delivery manifest"),
-    import_source: optional(stringEnum(["hasura", "nhost"]), "[migration_import] Source platform"),
+    import_source: optional(stringEnum2(["hasura", "nhost"]), "[migration_import] Source platform"),
     metadata_file: optional(String2(), "[migration_import] Hasura metadata JSON file"),
     output_dir: optional(String2(), "[migration_import] Output migration directory when write=true"),
     write: optional(Boolean2(), "[migration_import] Write the reviewed plan to output_dir; never applies SQL"),
@@ -12693,7 +12722,7 @@ Actions: ${allActions.join(", ")}${localOnly ? " (local-only mode)" : readOnly ?
     baseline_name: optional(String2(), "[rebase_migrations] New baseline migration name"),
     retain_after_version: optional(String2(), "[rebase_migrations] Retain migrations newer than this version"),
     columns: optional(String2(), "[create_table_rls] Column definitions"),
-    policy_mode: optional(stringEnum(["deny_all", "owner"]), "[create_table_rls] RLS policy mode (default: deny_all)"),
+    policy_mode: optional(stringEnum2(["deny_all", "owner"]), "[create_table_rls] RLS policy mode (default: deny_all)"),
     owner_column: optional(String2(), "[create_table_rls owner] UUID owner column matched to auth.uid()"),
     extension: optional(String2(), "[enable_extension/disable_extension] PostgreSQL extension or pgflow")
   }, async (args) => {
@@ -14055,7 +14084,7 @@ function formatProviders(data) {
 function registerAuthTools(server, http) {
   registerTool(server, "auth", `Auth & OAuth provider management, controlled user lookup, and login-link generation.
 Actions: list_users, get_user, generate_link, list_providers, get_provider, configure_provider, update_provider, disable_provider, supported_providers, wechat_mini, wechat_open, get_settings, update_settings, get_config, update_config, get_oauth_server, migrate_oauth_server`, {
-    action: withDescription(stringEnum([
+    action: withDescription(stringEnum2([
       "list_users",
       "get_user",
       "generate_link",
@@ -14080,7 +14109,7 @@ Actions: list_users, get_user, generate_link, list_providers, get_provider, conf
     per_page: optional(Integer({ minimum: 1, maximum: 100 }), "[list_users] Users per page (1-100)"),
     search: optional(String2(), "[list_users] Search user email, phone, or UUID"),
     email_like: optional(String2(), "[list_users] Search user email or phone"),
-    type: optional(stringEnum(AUTH_LINK_TYPES), "[generate_link] magiclink, recovery, or invite"),
+    type: optional(stringEnum2(AUTH_LINK_TYPES), "[generate_link] magiclink, recovery, or invite"),
     email: optional(String2(), "[generate_link] User email"),
     redirect_to: optional(String2(), "[generate_link] Absolute HTTPS or loopback callback"),
     provider: optional(String2(), "[*_provider] Provider name (github, google, wechat, etc.)"),
@@ -14390,7 +14419,7 @@ async function deleteReleaseCanaryClient(http, ref, id, redirectUri) {
 }
 function registerOAuthClientTools(server, http) {
   registerTool(server, "oauth_clients", "Dedicated release-canary public OAuth client lifecycle. It only manages the exact supacloud-release-canary public authorization-code client and never returns client secrets.", {
-    action: withDescription(stringEnum(["list", "get", "create", "delete"]), "OAuth client action"),
+    action: withDescription(stringEnum2(["list", "get", "create", "delete"]), "OAuth client action"),
     ref: withDescription(String2(), "Central SupAuth project ref"),
     client_id: optional(String2(), "[get/delete] Exact release-canary public OAuth client ID"),
     redirect_uri: optional(String2(), "[create/delete] Exact HTTPS or port-bound RFC 8252 loopback callback")
@@ -14782,7 +14811,7 @@ function executeBucketAction(action, http, args) {
 function registerStorageTools(server, http) {
   registerTool(server, "storage", `S3/MinIO storage management.
 Actions: status, list_buckets, get_bucket, create_bucket, update_bucket, delete_bucket, list_files, upload_base64, delete_file, upload, upload_file`, {
-    action: withDescription(stringEnum([
+    action: withDescription(stringEnum2([
       "status",
       "list_buckets",
       "get_bucket",
@@ -15911,7 +15940,7 @@ async function activateFunctionVersion(http, args, readOnly = false) {
 function registerAdvancedTools(server, http, environment = process.env, options = {}) {
   registerTool(server, "edge_functions", `Edge Function management (Deno/Bun serverless). Source deploys are bundled; verified prebuilt artifacts stay byte-exact.
 Actions: list, get_config, deploy, deploy_bundle, config, source, activate, delete, check, scaffold`, {
-    action: withDescription(stringEnum(["list", "get_config", "deploy", "deploy_bundle", "config", "source", "activate", "delete", "check", "scaffold"]), "Action"),
+    action: withDescription(stringEnum2(["list", "get_config", "deploy", "deploy_bundle", "config", "source", "activate", "delete", "check", "scaffold"]), "Action"),
     ref: optional(String2(), "Project ref (not used by scaffold)"),
     slug: optional(String2(), "[get_config/deploy/deploy_bundle/config/source/activate/delete/check] Function name"),
     version: withDescription(functionVersionSchema, "[source/activate] Existing immutable Function version; source requires a positive version"),
@@ -15926,7 +15955,7 @@ Actions: list, get_config, deploy, deploy_bundle, config, source, activate, dele
     minify: optional(Boolean2(), "[deploy/deploy_bundle] Minify bundle"),
     verify_jwt: optional(Boolean2(), "[deploy/deploy_bundle/config] Set JWT verification for this function"),
     background_routes: withDescription(backgroundRoutesSchema, "[deploy/deploy_bundle/config] Background route paths; pass comma-separated or JSON array in CLI"),
-    framework: optional(withDescription(stringEnum(["fetch", "elysia", "hono", "sveltekit-function"]), "[deploy/deploy_bundle/config/scaffold] Fetch framework adapter profile")),
+    framework: optional(withDescription(stringEnum2(["fetch", "elysia", "hono", "sveltekit-function"]), "[deploy/deploy_bundle/config/scaffold] Fetch framework adapter profile")),
     capabilities: optional(functionCapabilitiesSchema, "[deploy/deploy_bundle/config] Host capabilities: secrets, outbound_hosts, bindings, background"),
     limits: optional(functionLimitsSchema, "[deploy/deploy_bundle/config] Execution limits in milliseconds/bytes"),
     max_request_body_bytes: optional(Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }), "[deploy/deploy_bundle/config] Max inbound request body size in bytes"),
@@ -16103,7 +16132,7 @@ ${deployCheck.err}`;
   });
   registerTool(server, "secrets", `Project secrets (environment variables for Edge Functions).
 Actions: list, upsert, delete`, {
-    action: withDescription(stringEnum(["list", "upsert", "delete"]), "Action"),
+    action: withDescription(stringEnum2(["list", "upsert", "delete"]), "Action"),
     ref: withDescription(String2(), "Project ref"),
     secrets: withDescription(secretsSchema, "[upsert] Secret list as JSON array or KEY=VALUE,KEY2=VALUE2"),
     "from-env": withDescription(environmentSecretNamesSchema, "[upsert] Comma-separated environment variable names; values are read from the selected CLI environment"),
@@ -16141,7 +16170,7 @@ Actions: list, upsert, delete`, {
   });
   registerTool(server, "platform", `Platform monitoring, backups, network, and organizations.
 Actions: metrics, list_backups, create_backup, network, update_network, list_orgs, get_org`, {
-    action: withDescription(stringEnum([
+    action: withDescription(stringEnum2([
       "metrics",
       "list_backups",
       "create_backup",
@@ -16199,7 +16228,7 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status})`;
   });
   registerTool(server, "task_events", `Task lifecycle webhook configuration.
 Actions: register_webhook, unregister_webhook, inspect_webhook`, {
-    action: withDescription(stringEnum(["register_webhook", "unregister_webhook", "inspect_webhook"]), "Action"),
+    action: withDescription(stringEnum2(["register_webhook", "unregister_webhook", "inspect_webhook"]), "Action"),
     ref: withDescription(String2(), "Project ref"),
     url: optional(String2(), "[register_webhook] HTTPS webhook URL for task lifecycle events"),
     secret: optional(String2(), "[register_webhook] Optional HMAC secret for webhook verification")
@@ -16235,7 +16264,7 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status}): ${JSON.stringif
   });
   registerTool(server, "diagnostics", `Platform and project diagnostics: health checks, diagnostic runs, and repair.
 Actions: list_checks, run_checks, get_run, repair`, {
-    action: withDescription(stringEnum(["list_checks", "run_checks", "get_run", "repair"]), "Action"),
+    action: withDescription(stringEnum2(["list_checks", "run_checks", "get_run", "repair"]), "Action"),
     ref: optional(String2(), "Project ref (for project-scoped diagnostics)"),
     run_id: optional(String2(), "[get_run/repair] Diagnostic run ID"),
     check_id: optional(String2(), "[repair] Check result ID to repair")
@@ -16279,81 +16308,320 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status}): ${JSON.stringif
 }
 
 // src/shared/tools/frontend-release-control.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { constants as fsConstants2 } from "node:fs";
 import { open as open2 } from "node:fs/promises";
 import { resolve as resolve7 } from "node:path";
-var PROJECT_REF_PATTERN3 = /^[A-Za-z0-9_-]{1,20}$/u;
-var DEPLOYMENT_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/u;
-var RELEASE_ID_PATTERN = /^[0-9a-f]{64}$/u;
-var MUTATION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
-var TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
-var ARCHIVE_MAX_BYTES = 100 * 1024 * 1024;
-var ARCHIVE_CHUNK_BYTES = 64 * 1024;
-var RESPONSE_MAX_BYTES = 1024 * 1024;
-var UPLOAD_REQUEST_TIMEOUT_MS = 10 * 60000;
-var MUTATION_RESPONSE_TIMEOUT_MS = 5000;
-var RELEASE_LIST_LIMIT_MAX = 100;
-function toolResponse(payload) {
-  return { content: [{ type: "text", text: JSON.stringify(payload, null, 2) }] };
+
+// src/shared/mutation-protocol.ts
+import { createHash as createHash5 } from "node:crypto";
+var MUTATION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/;
+var OPERATION_PATTERN = /^[a-z0-9][a-z0-9._:-]{0,127}$/;
+var RESOURCE_KEY_PATTERN = /^v1\/(?:[a-z0-9][a-z0-9._-]{0,63})\/([A-Za-z0-9_-]{2,171})$/;
+var RESOURCE_ID_CONTROL_PATTERN = /[\u0000-\u001f\u007f-\u009f]/u;
+var FAILURE_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
+var LEASE_OWNER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,254}$/;
+var TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+var MAX_STATUS_RESPONSE_BYTES = 196608;
+var MAX_JSON_DEPTH = 32;
+var MAX_RESOURCE_ID_BYTES = 128;
+var FATAL_UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
+var MUTATION_STATUSES = new Set([
+  "pending",
+  "running",
+  "succeeded",
+  "failed_retryable",
+  "failed_terminal",
+  "outcome_unknown"
+]);
+var MUTATION_RESPONSE_KEYS = ["project_ref", "mutation"];
+var MUTATION_KEYS = [
+  "project_ref",
+  "mutation_id",
+  "operation",
+  "resource_key",
+  "request_fingerprint",
+  "principal",
+  "status",
+  "checkpoint",
+  "receipt",
+  "response_status",
+  "failure_code",
+  "lease",
+  "completed_at",
+  "created_at",
+  "updated_at"
+];
+var PRINCIPAL_KEYS = ["type", "id"];
+var LEASE_KEYS = ["owner", "expires_at", "fencing_epoch"];
+function isMutationId(candidate) {
+  return typeof candidate === "string" && MUTATION_ID_PATTERN.test(candidate);
 }
-function releaseFailure(operation, code, status) {
-  return {
-    isError: true,
-    content: [{
-      type: "text",
-      text: JSON.stringify({ ok: false, operation, error: { code, http_status: status } })
-    }]
-  };
+function assertCanonicalJsonNode(candidate, seen, depth) {
+  if (candidate === null || typeof candidate === "string" || typeof candidate === "boolean")
+    return;
+  if (typeof candidate === "number" && Number.isFinite(candidate))
+    return;
+  if (typeof candidate !== "object" || depth > MAX_JSON_DEPTH) {
+    throw new Error("Mutation request must be bounded JSON");
+  }
+  if (seen.has(candidate))
+    throw new Error("Mutation request must not contain cycles");
+  seen.add(candidate);
+  const prototype = Object.getPrototypeOf(candidate);
+  const plainRecord = prototype === Object.prototype || prototype === null;
+  const children = Array.isArray(candidate) ? candidate : plainRecord ? Object.values(candidate) : null;
+  if (!children)
+    throw new Error("Mutation request must contain only JSON objects and arrays");
+  for (const child of children)
+    assertCanonicalJsonNode(child, seen, depth + 1);
+  seen.delete(candidate);
 }
-function exactKeys(candidate, keys) {
-  const actual = Object.keys(candidate).sort();
-  const expected = [...keys].sort();
-  return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+function stableStringifyNode(jsonValue) {
+  if (jsonValue === null || typeof jsonValue !== "object") {
+    const serialized = JSON.stringify(jsonValue);
+    if (serialized === undefined)
+      throw new Error("Mutation request must contain exact JSON values");
+    return serialized;
+  }
+  if (Array.isArray(jsonValue))
+    return `[${jsonValue.map(stableStringifyNode).join(",")}]`;
+  const record = jsonValue;
+  const fields = Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringifyNode(record[key])}`);
+  return `{${fields.join(",")}}`;
 }
-function releaseRecord(candidate) {
-  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
-    return null;
-  const record = candidate;
-  const keys = [
-    "schema",
-    "project_ref",
-    "deployment_id",
-    "release_id",
-    "sha256",
-    "tree_sha256",
-    "size_bytes",
-    "file_count",
-    "created_at",
-    "kind",
-    "archive_format"
-  ];
-  if (!exactKeys(record, keys) || record.schema !== FRONTEND_ARCHIVE_RELEASE_SCHEMA || record.archive_format !== FRONTEND_ARCHIVE_FORMAT || typeof record.project_ref !== "string" || !PROJECT_REF_PATTERN3.test(record.project_ref) || typeof record.deployment_id !== "string" || !DEPLOYMENT_ID_PATTERN.test(record.deployment_id) || typeof record.release_id !== "string" || !RELEASE_ID_PATTERN.test(record.release_id) || record.sha256 !== record.release_id || typeof record.tree_sha256 !== "string" || !RELEASE_ID_PATTERN.test(record.tree_sha256) || !Number.isSafeInteger(record.size_bytes) || Number(record.size_bytes) < 1 || !Number.isSafeInteger(record.file_count) || Number(record.file_count) < 1 || !canonicalTimestamp(record.created_at) || record.kind !== "prebuilt_static")
-    return null;
-  return {
-    project_ref: record.project_ref,
-    deployment_id: record.deployment_id,
-    release_id: record.release_id,
-    sha256: record.release_id,
-    tree_sha256: record.tree_sha256,
-    size_bytes: Number(record.size_bytes),
-    file_count: Number(record.file_count),
-    created_at: record.created_at,
-    kind: "prebuilt_static",
-    archive_format: FRONTEND_ARCHIVE_FORMAT
-  };
+function mutationRequestFingerprint(normalizedRequest) {
+  assertCanonicalJsonNode(normalizedRequest, new WeakSet, 0);
+  return createHash5("sha256").update(stableStringifyNode(normalizedRequest)).digest("hex");
 }
-function releaseEnvelope(candidate, expected) {
-  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+function objectRecord3(candidate) {
+  return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
+}
+function exactRecord(candidate, keys) {
+  const record = objectRecord3(candidate);
+  if (!record || Object.keys(record).length !== keys.length)
     return null;
-  const envelope = candidate;
+  return keys.every((key) => Object.hasOwn(record, key)) ? record : null;
+}
+function emptyProjection(candidate) {
+  const record = objectRecord3(candidate);
+  return record && Object.keys(record).length === 0 ? record : null;
+}
+function canonicalTimestamp(candidate) {
+  if (typeof candidate !== "string" || !TIMESTAMP_PATTERN.test(candidate))
+    return false;
+  const milliseconds = Date.parse(candidate);
+  return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === candidate;
+}
+function nullableTimestamp(candidate) {
+  return candidate === null || canonicalTimestamp(candidate);
+}
+function safePrincipal(candidate) {
+  const principal = exactRecord(candidate, PRINCIPAL_KEYS);
+  if (!principal || !["master", "admin", "project"].includes(String(principal["type"])))
+    return null;
+  if (typeof principal["id"] !== "string" || !principal["id"] || principal["id"].length > 320 || principal["id"].trim() !== principal["id"] || /[\u0000-\u001f\u007f]/u.test(principal["id"]))
+    return null;
+  return { type: principal["type"], id: principal["id"] };
+}
+function safeLease(candidate) {
+  const lease = exactRecord(candidate, LEASE_KEYS);
+  if (!lease || lease["owner"] !== null && (typeof lease["owner"] !== "string" || !LEASE_OWNER_PATTERN.test(lease["owner"])))
+    return null;
+  if (!nullableTimestamp(lease["expires_at"]) || !Number.isSafeInteger(lease["fencing_epoch"]) || Number(lease["fencing_epoch"]) < 0)
+    return null;
+  return {
+    owner: lease["owner"],
+    expires_at: lease["expires_at"],
+    fencing_epoch: Number(lease["fencing_epoch"])
+  };
+}
+function safeResponseStatus(candidate) {
+  if (candidate === null)
+    return null;
+  return Number.isInteger(candidate) && Number(candidate) >= 100 && Number(candidate) <= 599 ? Number(candidate) : undefined;
+}
+function validLeaseState(status, lease) {
+  const running = status === "running";
+  return running ? lease.owner !== null && lease.expires_at !== null && lease.fencing_epoch > 0 : lease.owner === null && lease.expires_at === null;
+}
+function validMutationLifecycle(mutation, receipt, responseStatus) {
+  const terminal = ["succeeded", "failed_terminal", "outcome_unknown"].includes(String(mutation["status"]));
+  if (mutation["completed_at"] !== null !== terminal)
+    return false;
+  if (mutation["status"] === "succeeded") {
+    return receipt !== null && responseStatus !== null && responseStatus >= 200 && responseStatus < 300 && mutation["failure_code"] === null;
+  }
+  if (mutation["status"] === "failed_terminal") {
+    return receipt !== null && typeof mutation["failure_code"] === "string";
+  }
+  if (mutation["status"] === "failed_retryable" || mutation["status"] === "outcome_unknown") {
+    return receipt !== null && typeof mutation["failure_code"] === "string";
+  }
+  if (mutation["status"] === "pending") {
+    return receipt === null && responseStatus === null && mutation["failure_code"] === null;
+  }
+  return true;
+}
+function canonicalMutationResourceKey(candidate) {
+  if (typeof candidate !== "string")
+    return false;
+  const match = RESOURCE_KEY_PATTERN.exec(candidate);
+  if (!match)
+    return false;
+  const encodedResourceId = match[1];
+  const resourceIdBytes = Buffer.from(encodedResourceId, "base64url");
+  if (resourceIdBytes.byteLength < 1 || resourceIdBytes.byteLength > MAX_RESOURCE_ID_BYTES || resourceIdBytes.toString("base64url") !== encodedResourceId)
+    return false;
+  let resourceId;
+  try {
+    resourceId = FATAL_UTF8_DECODER.decode(resourceIdBytes);
+  } catch (decodeError) {
+    if (decodeError instanceof TypeError)
+      return false;
+    throw decodeError;
+  }
+  return resourceId.trim() === resourceId && !RESOURCE_ID_CONTROL_PATTERN.test(resourceId) && Buffer.from(resourceId, "utf8").equals(resourceIdBytes);
+}
+function validMutationIdentity(mutation) {
+  if (!isMutationId(mutation["mutation_id"]) || typeof mutation["project_ref"] !== "string")
+    return false;
+  if (typeof mutation["operation"] !== "string" || !OPERATION_PATTERN.test(mutation["operation"]))
+    return false;
+  if (mutation["resource_key"] !== null && !canonicalMutationResourceKey(mutation["resource_key"]))
+    return false;
+  return typeof mutation["request_fingerprint"] === "string" && FINGERPRINT_PATTERN.test(mutation["request_fingerprint"]);
+}
+function validMutationTerminalFields(mutation) {
+  if (typeof mutation["status"] !== "string" || !MUTATION_STATUSES.has(mutation["status"]))
+    return false;
+  if (mutation["failure_code"] !== null && (typeof mutation["failure_code"] !== "string" || !FAILURE_CODE_PATTERN.test(mutation["failure_code"])))
+    return false;
+  return nullableTimestamp(mutation["completed_at"]) && canonicalTimestamp(mutation["created_at"]) && canonicalTimestamp(mutation["updated_at"]);
+}
+function safeMutationStatus(candidate) {
+  const mutation = exactRecord(candidate, MUTATION_KEYS);
+  if (!mutation || !validMutationIdentity(mutation) || !validMutationTerminalFields(mutation))
+    return null;
+  const principal = safePrincipal(mutation["principal"]);
+  const checkpoint = emptyProjection(mutation["checkpoint"]);
+  const receipt = mutation["receipt"] === null ? null : emptyProjection(mutation["receipt"]);
+  const responseStatus = safeResponseStatus(mutation["response_status"]);
+  const lease = safeLease(mutation["lease"]);
+  if (!principal || !checkpoint || mutation["receipt"] !== null && !receipt || responseStatus === undefined || !lease || !validLeaseState(String(mutation["status"]), lease) || !validMutationLifecycle(mutation, receipt, responseStatus))
+    return null;
+  return {
+    project_ref: mutation["project_ref"],
+    mutation_id: mutation["mutation_id"],
+    operation: mutation["operation"],
+    resource_key: mutation["resource_key"],
+    request_fingerprint: mutation["request_fingerprint"],
+    principal,
+    status: mutation["status"],
+    checkpoint,
+    receipt,
+    response_status: responseStatus,
+    failure_code: mutation["failure_code"],
+    lease,
+    completed_at: mutation["completed_at"],
+    created_at: mutation["created_at"],
+    updated_at: mutation["updated_at"]
+  };
+}
+function mutationStatusPath(ref, mutationId) {
+  if (!isMutationId(mutationId))
+    throw new Error("'mutation_id' must be a UUIDv4");
+  return `/v1/projects/${projectRefPathSegment(ref, "Mutations")}/mutations/${encodeURIComponent(mutationId)}`;
+}
+function mutationStatusResponse(ref, mutationId, payload) {
+  const response = exactRecord(payload, MUTATION_RESPONSE_KEYS);
+  const mutation = safeMutationStatus(response?.["mutation"]);
+  return response?.["project_ref"] === ref && mutation?.project_ref === ref && mutation.mutation_id === mutationId ? mutation : null;
+}
+async function fetchMutationStatus(http, ref, mutationId) {
+  const response = await http.get(mutationStatusPath(ref, mutationId), {
+    maxResponseBytes: MAX_STATUS_RESPONSE_BYTES
+  });
+  if (!response.ok) {
+    return { kind: "unavailable", httpStatus: response.transportError ? null : response.status };
+  }
+  const mutation = mutationStatusResponse(ref, mutationId, response.data);
+  return mutation ? { kind: "available", mutation } : { kind: "invalid" };
+}
+
+// src/shared/tools/frontend-release-control.ts
+var PROJECT_REF_PATTERN3 = /^[A-Za-z0-9_-]{1,20}$/u;
+var DEPLOYMENT_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/u;
+var RELEASE_ID_PATTERN = /^[0-9a-f]{64}$/u;
+var MUTATION_ID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+var TIMESTAMP_PATTERN2 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
+var ARCHIVE_MAX_BYTES = 100 * 1024 * 1024;
+var ARCHIVE_CHUNK_BYTES = 64 * 1024;
+var RESPONSE_MAX_BYTES = 1024 * 1024;
+var UPLOAD_REQUEST_TIMEOUT_MS = 10 * 60000;
+var MUTATION_RESPONSE_TIMEOUT_MS = 5000;
+var RELEASE_LIST_LIMIT_MAX = 100;
+function toolResponse(payload) {
+  return { content: [{ type: "text", text: JSON.stringify(payload, null, 2) }] };
+}
+function releaseFailure(operation, code, status) {
+  return {
+    isError: true,
+    content: [{
+      type: "text",
+      text: JSON.stringify({ ok: false, operation, error: { code, http_status: status } })
+    }]
+  };
+}
+function exactKeys(candidate, keys) {
+  const actual = Object.keys(candidate).sort();
+  const expected = [...keys].sort();
+  return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function releaseRecord(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const record = candidate;
+  const keys = [
+    "schema",
+    "project_ref",
+    "deployment_id",
+    "release_id",
+    "sha256",
+    "tree_sha256",
+    "size_bytes",
+    "file_count",
+    "created_at",
+    "kind",
+    "archive_format"
+  ];
+  if (!exactKeys(record, keys) || record.schema !== FRONTEND_ARCHIVE_RELEASE_SCHEMA || record.archive_format !== FRONTEND_ARCHIVE_FORMAT || typeof record.project_ref !== "string" || !PROJECT_REF_PATTERN3.test(record.project_ref) || typeof record.deployment_id !== "string" || !DEPLOYMENT_ID_PATTERN.test(record.deployment_id) || typeof record.release_id !== "string" || !RELEASE_ID_PATTERN.test(record.release_id) || record.sha256 !== record.release_id || typeof record.tree_sha256 !== "string" || !RELEASE_ID_PATTERN.test(record.tree_sha256) || !Number.isSafeInteger(record.size_bytes) || Number(record.size_bytes) < 1 || !Number.isSafeInteger(record.file_count) || Number(record.file_count) < 1 || !canonicalTimestamp2(record.created_at) || record.kind !== "prebuilt_static")
+    return null;
+  return {
+    project_ref: record.project_ref,
+    deployment_id: record.deployment_id,
+    release_id: record.release_id,
+    sha256: record.release_id,
+    tree_sha256: record.tree_sha256,
+    size_bytes: Number(record.size_bytes),
+    file_count: Number(record.file_count),
+    created_at: record.created_at,
+    kind: "prebuilt_static",
+    archive_format: FRONTEND_ARCHIVE_FORMAT
+  };
+}
+function releaseEnvelope(candidate, expected) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const envelope = candidate;
   const release = exactKeys(envelope, ["project_ref", "deployment_id", "release"]) ? releaseRecord(envelope.release) : null;
   if (!release || envelope.project_ref !== expected.projectRef || envelope.deployment_id !== expected.deploymentId || release.project_ref !== expected.projectRef || release.deployment_id !== expected.deploymentId || release.release_id !== expected.releaseId)
     return null;
   return release;
 }
-function canonicalTimestamp(candidate) {
-  if (typeof candidate !== "string" || !TIMESTAMP_PATTERN.test(candidate))
+function canonicalTimestamp2(candidate) {
+  if (typeof candidate !== "string" || !TIMESTAMP_PATTERN2.test(candidate))
     return false;
   const milliseconds = Date.parse(candidate);
   return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === candidate;
@@ -16378,7 +16646,7 @@ function releaseInventory(candidate, expected) {
   if (!exactKeys(record, keys) || typeof record.project_ref !== "string" || !PROJECT_REF_PATTERN3.test(record.project_ref) || typeof record.deployment_id !== "string" || !DEPLOYMENT_ID_PATTERN.test(record.deployment_id) || !Array.isArray(record.releases))
     return null;
   const activeReleaseId = nullableIdentity(record.active_release_id, RELEASE_ID_PATTERN);
-  const activeActivationId = nullableIdentity(record.active_activation_id, MUTATION_ID_PATTERN);
+  const activeActivationId = nullableIdentity(record.active_activation_id, MUTATION_ID_PATTERN2);
   const nextCursor = nullableIdentity(record.next_cursor, RELEASE_ID_PATTERN);
   const releases = record.releases.map(releaseRecord);
   if (activeReleaseId === undefined || activeActivationId === undefined || nextCursor === undefined || activeReleaseId === null !== (activeActivationId === null) || releases.some((release) => release === null))
@@ -16414,7 +16682,7 @@ function sameArchiveIdentity(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
 }
 async function archiveSha256(handle, sizeBytes) {
-  const hash = createHash5("sha256");
+  const hash = createHash6("sha256");
   const chunk = new Uint8Array(Math.min(sizeBytes, ARCHIVE_CHUNK_BYTES));
   for (let offset = 0;offset < sizeBytes; ) {
     const requested = Math.min(chunk.byteLength, sizeBytes - offset);
@@ -16489,7 +16757,7 @@ async function getFrontendRelease(http, projectRef, deploymentId, releaseId) {
   const response = await http.get(releasePath(projectRef, deploymentId, releaseId), {
     maxJsonBytes: RESPONSE_MAX_BYTES
   });
-  const release = response.ok ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId }) : null;
+  const release = response.ok && response.status === 200 ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId }) : null;
   if (!release) {
     return releaseReadFailure("frontend.get_release", response);
   }
@@ -16601,7 +16869,7 @@ function stableJson(candidate) {
   return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
 }
 function activationFingerprint(identity) {
-  return createHash5("sha256").update(stableJson({
+  return createHash6("sha256").update(stableJson({
     project_ref: identity.projectRef,
     deployment_id: identity.deploymentId,
     release_id: identity.releaseId,
@@ -16617,25 +16885,8 @@ function publicMutationReceipt(candidate, expected) {
   if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
     return null;
   const envelope = candidate;
-  const mutation = envelope.mutation;
-  const expectedKeys = [
-    "project_ref",
-    "mutation_id",
-    "operation",
-    "resource_key",
-    "request_fingerprint",
-    "principal",
-    "status",
-    "checkpoint",
-    "receipt",
-    "response_status",
-    "failure_code",
-    "lease",
-    "completed_at",
-    "created_at",
-    "updated_at"
-  ];
-  if (!mutation || !exactKeys(envelope, ["project_ref", "mutation"]) || !exactKeys(mutation, expectedKeys) || envelope.project_ref !== expected.projectRef || mutation.project_ref !== expected.projectRef || mutation.mutation_id !== expected.mutationId || mutation.resource_key !== expected.resourceKey || mutation.request_fingerprint !== expected.requestFingerprint || typeof mutation.operation !== "string" || typeof mutation.status !== "string" || !(mutation.response_status === null || Number.isSafeInteger(mutation.response_status)) || !(mutation.failure_code === null || typeof mutation.failure_code === "string"))
+  const mutation = safeMutationStatus(envelope.mutation);
+  if (!mutation || !exactKeys(envelope, ["project_ref", "mutation"]) || envelope.project_ref !== expected.projectRef || mutation.project_ref !== expected.projectRef || mutation.mutation_id !== expected.mutationId || mutation.resource_key !== expected.resourceKey || mutation.request_fingerprint !== expected.requestFingerprint)
     return null;
   return {
     operation: mutation.operation,
@@ -16670,7 +16921,7 @@ async function activeReleaseReadback(http, identity) {
     return { release: null, status: 200 };
   }
   const releaseRead = await http.get(releasePath(identity.projectRef, identity.deploymentId, identity.releaseId), { maxJsonBytes: RESPONSE_MAX_BYTES });
-  const release = releaseRead.ok ? releaseEnvelope(releaseRead.data, {
+  const release = releaseRead.ok && releaseRead.status === 200 ? releaseEnvelope(releaseRead.data, {
     projectRef: identity.projectRef,
     deploymentId: identity.deploymentId,
     releaseId: identity.releaseId
@@ -16762,10 +17013,74 @@ async function publishFrontendRelease(http, projectRef, deploymentId, archivePat
     ...activated.isError || treeMismatch ? { isError: true } : {}
   };
 }
-async function rollbackFrontendRelease(http, projectRef, deploymentId, releaseId) {
+function boundRollbackResponse(result, input) {
+  const payload = JSON.parse(result.content[0].text);
+  return {
+    ...toolResponse({
+      ...payload,
+      operation: "frontend.rollback",
+      project_ref: input.projectRef,
+      deployment_id: input.deploymentId,
+      target_release_id: input.releaseId,
+      mutation_id: input.mutationId,
+      expected_active_release_id: input.expectedActiveReleaseId,
+      expected_activation_id: input.expectedActivationId,
+      ...!result.isError ? {
+        rollback: true,
+        previous_release_id: input.expectedActiveReleaseId,
+        previous_activation_id: input.expectedActivationId
+      } : {}
+    }),
+    ...result.isError ? { isError: true } : {}
+  };
+}
+async function rollbackBoundFrontendRelease(http, input) {
+  const authority = await readActiveFrontendRelease(http, input.projectRef, input.deploymentId);
+  if ("failure" in authority)
+    return boundRollbackResponse(authority.failure, input);
+  const current = authority.inventory;
+  if (current.active_release_id === input.releaseId && current.active_activation_id === input.mutationId) {
+    return boundRollbackResponse(await activationReadback(http, input, input.mutationId, 200), input);
+  }
+  if (current.active_release_id !== input.expectedActiveReleaseId || current.active_activation_id !== input.expectedActivationId) {
+    return boundRollbackResponse(releaseFailure("frontend.rollback", "STALE_AUTHORITY", 409), input);
+  }
+  const target = await getFrontendRelease(http, input.projectRef, input.deploymentId, input.releaseId);
+  if (target.isError)
+    return boundRollbackResponse(target, input);
+  return boundRollbackResponse(await activateFrontendRelease(http, input), input);
+}
+async function rollbackFrontendRelease(http, projectRef, deploymentId, releaseId, options = {}) {
   if (releaseId !== undefined && !RELEASE_ID_PATTERN.test(releaseId)) {
     throw new Error("'release_id' must be a SHA-256 digest");
   }
+  const bound = options.expectedActiveReleaseId !== undefined || options.expectedActivationId !== undefined || options.mutationId !== undefined;
+  if (bound) {
+    const { expectedActiveReleaseId, expectedActivationId, mutationId } = options;
+    if (releaseId === undefined || expectedActiveReleaseId === undefined || expectedActivationId === undefined || mutationId === undefined) {
+      throw new Error("'release_id', 'expected_active_release_id', 'expected_activation_id', and 'mutation_id' are required together for a bound rollback");
+    }
+    if (!RELEASE_ID_PATTERN.test(expectedActiveReleaseId)) {
+      throw new Error("'expected_active_release_id' must be a SHA-256 digest");
+    }
+    if (!MUTATION_ID_PATTERN2.test(expectedActivationId)) {
+      throw new Error("'expected_activation_id' must be a UUIDv4");
+    }
+    if (!MUTATION_ID_PATTERN2.test(mutationId)) {
+      throw new Error("'mutation_id' must be a UUIDv4");
+    }
+    if (releaseId === expectedActiveReleaseId || mutationId === expectedActivationId) {
+      throw new Error("Bound rollback requires a different target release and a distinct mutation UUID");
+    }
+    return rollbackBoundFrontendRelease(http, {
+      projectRef,
+      deploymentId,
+      releaseId,
+      expectedActiveReleaseId,
+      expectedActivationId,
+      mutationId
+    });
+  }
   const authority = releaseId === undefined ? await readPreviousFrontendRelease(http, projectRef, deploymentId) : await readActiveFrontendRelease(http, projectRef, deploymentId);
   if ("failure" in authority)
     return authority.failure;
@@ -16834,8 +17149,8 @@ async function readPreviousFrontendRelease(http, projectRef, deploymentId) {
   const data = response.data;
   const value = data && typeof data === "object" && !Array.isArray(data) ? data : null;
   const activeReleaseId = value ? nullableIdentity(value.active_release_id, RELEASE_ID_PATTERN) : undefined;
-  const activeActivationId = value ? nullableIdentity(value.active_activation_id, MUTATION_ID_PATTERN) : undefined;
-  const previousActivationId = value ? nullableIdentity(value.previous_activation_id, MUTATION_ID_PATTERN) : undefined;
+  const activeActivationId = value ? nullableIdentity(value.active_activation_id, MUTATION_ID_PATTERN2) : undefined;
+  const previousActivationId = value ? nullableIdentity(value.previous_activation_id, MUTATION_ID_PATTERN2) : undefined;
   const previous = value?.previous_release === null ? null : releaseRecord(value?.previous_release);
   if (!response.ok || response.status !== 200 || !value || !exactKeys(value, [
     "schema",
@@ -16862,12 +17177,12 @@ async function readPreviousFrontendRelease(http, projectRef, deploymentId) {
 }
 async function activateFrontendRelease(http, input) {
   const mutationId = input.mutationId;
-  if (!MUTATION_ID_PATTERN.test(mutationId))
+  if (!MUTATION_ID_PATTERN2.test(mutationId))
     throw new Error("'mutation_id' must be a UUIDv4");
   if (input.expectedActiveReleaseId !== "absent" && !RELEASE_ID_PATTERN.test(input.expectedActiveReleaseId)) {
     throw new Error("'expected_active_release_id' is invalid");
   }
-  if (input.expectedActivationId !== "absent" && !MUTATION_ID_PATTERN.test(input.expectedActivationId)) {
+  if (input.expectedActivationId !== "absent" && !MUTATION_ID_PATTERN2.test(input.expectedActivationId)) {
     throw new Error("'expected_activation_id' is invalid");
   }
   const endpoint = `${releasePath(input.projectRef, input.deploymentId, input.releaseId)}/activate`;
@@ -16880,7 +17195,7 @@ async function activateFrontendRelease(http, input) {
     responseTimeoutMs: MUTATION_RESPONSE_TIMEOUT_MS
   });
   const release = activationReceipt(response.data, { ...input, mutationId });
-  if (!response.ok || !release) {
+  if (!response.ok || response.status !== 200 || !release) {
     if (response.status >= 400 && response.status < 500 && response.status !== 408 && !response.transportError) {
       return releaseFailure("frontend.activate_release", "HTTP_ERROR", response.status);
     }
@@ -16901,7 +17216,7 @@ async function activateFrontendRelease(http, input) {
 async function activationReadback(http, input, mutationId, activationStatus) {
   const mutationRead = await http.get(`/v1/projects/${encodeURIComponent(input.projectRef)}/mutations/${mutationId}`, { maxJsonBytes: RESPONSE_MAX_BYTES });
   const mutationEnvelope = mutationRead.data;
-  const mutation = mutationRead.ok ? publicMutationReceipt(mutationRead.data, {
+  const mutation = mutationRead.ok && mutationRead.status === 200 ? publicMutationReceipt(mutationRead.data, {
     projectRef: input.projectRef,
     mutationId,
     resourceKey: activationResourceKey(input.deploymentId),
@@ -16912,429 +17227,192 @@ async function activationReadback(http, input, mutationId, activationStatus) {
   }
   const readback = await activeReleaseReadback(http, { ...input, mutationId });
   if (!readback.release) {
-    return releaseFailure("frontend.activate_release", "OUTCOME_UNKNOWN", activationStatus);
-  }
-  return toolResponse({
-    project_ref: input.projectRef,
-    deployment_id: input.deploymentId,
-    active_release_id: input.releaseId,
-    activation_id: mutationId,
-    release: readback.release
-  });
-}
-
-// src/shared/tools/frontend-tools.ts
-function registerFrontendTools(server, http) {
-  registerTool(server, "frontend", `Frontend hosting and immutable prebuilt releases. Supports: static, react, vue, svelte, sveltekit, sveltekit-static, nextjs, nuxt, astro.
-Actions: list, get, create, update, delete, build_logs, add_domain, remove_domain, set_env, list_frameworks, list_records, list_releases, get_active_release, get_release, rollback. Publish with supacloud deploy.`, {
-    action: withDescription(stringEnum([
-      "list",
-      "get",
-      "create",
-      "update",
-      "delete",
-      "build_logs",
-      "add_domain",
-      "remove_domain",
-      "set_env",
-      "list_frameworks",
-      "list_records",
-      "list_releases",
-      "get_active_release",
-      "get_release",
-      "rollback"
-    ]), "Action"),
-    ref: optional(String2(), "Project ref"),
-    id: optional(String2(), "Deployment ID"),
-    name: optional(String2(), "[create] Deployment name"),
-    framework: optional(String2(), "[create] Framework (static|react|vue|svelte|sveltekit|sveltekit-static|nextjs|nuxt|astro)"),
-    domain: optional(String2(), "[create/update/add_domain/remove_domain] Custom domain"),
-    build_command: optional(String2(), "[create/update] Build command override"),
-    output_dir: optional(String2(), "[create/update] Output directory override"),
-    install_command: optional(String2(), "[create/update] Install command override"),
-    node_version: optional(String2(), "[create/update] Node.js version"),
-    health_check_path: optional(String2(), "[create/update] SSR readiness path (default: /)"),
-    env_vars: optional(Record(String2(), String2()), "[create/update/set_env] Environment variables"),
-    release_id: optional(String2(), "[get_release] SHA-256 release ID; [rollback] optional, defaults to journal-verified previous release"),
-    cursor: optional(String2(), "[list_releases] Last release SHA-256 cursor"),
-    limit: optional(Number2(), "[list_releases] Page size, 1-100 (default 50)")
-  }, async (args) => {
-    const {
-      action,
-      ref,
-      id,
-      name,
-      framework,
-      domain,
-      build_command,
-      output_dir,
-      install_command,
-      node_version,
-      health_check_path,
-      env_vars,
-      release_id,
-      cursor,
-      limit
-    } = args;
-    const need = (field, value) => {
-      if (value === undefined || value === null || value === "")
-        throw new Error(`'${field}' required for '${action}'`);
-    };
-    const ok = (res) => res.ok ? JSON.stringify(res.data, null, 2) : `❌ Failed (${res.status}): ${JSON.stringify(res.data)}`;
-    let text;
-    switch (action) {
-      case "list":
-        need("ref", ref);
-        text = ok(await http.get(`/v1/projects/${ref}/frontend/deployments`));
-        break;
-      case "get":
-        need("ref", ref);
-        need("id", id);
-        text = ok(await http.get(`/v1/projects/${ref}/frontend/deployments/${id}`));
-        break;
-      case "create":
-        need("ref", ref);
-        need("name", name);
-        need("framework", framework);
-        text = ok(await http.post(`/v1/projects/${ref}/frontend/deployments`, {
-          name,
-          framework,
-          domain,
-          build_command,
-          output_dir,
-          install_command,
-          node_version,
-          health_check_path,
-          env_vars
-        }));
-        break;
-      case "update":
-        need("ref", ref);
-        need("id", id);
-        text = ok(await http.patch(`/v1/projects/${ref}/frontend/deployments/${id}`, {
-          name,
-          domain,
-          build_command,
-          output_dir,
-          install_command,
-          node_version,
-          health_check_path,
-          env_vars
-        }));
-        break;
-      case "delete":
-        need("ref", ref);
-        need("id", id);
-        text = (await http.delete(`/v1/projects/${ref}/frontend/deployments/${id}`)).ok ? `✅ Deleted` : `❌ Failed`;
-        break;
-      case "build_logs":
-        need("ref", ref);
-        need("id", id);
-        const lr = await http.get(`/v1/projects/${ref}/frontend/deployments/${id}/logs`);
-        text = lr.ok ? typeof lr.data === "object" && lr.data !== null && "logs" in lr.data && typeof lr.data.logs === "string" ? lr.data.logs : "(no logs)" : `❌ Failed (${lr.status})`;
-        break;
-      case "add_domain":
-        need("ref", ref);
-        need("id", id);
-        need("domain", domain);
-        text = (await http.post(`/v1/projects/${ref}/frontend/deployments/${id}/domains`, { domain })).ok ? `✅ Domain ${domain} added` : `❌ Failed`;
-        break;
-      case "remove_domain":
-        need("ref", ref);
-        need("id", id);
-        need("domain", domain);
-        text = (await http.delete(`/v1/projects/${ref}/frontend/deployments/${id}/domains/${domain}`)).ok ? `✅ Domain ${domain} removed` : `❌ Failed`;
-        break;
-      case "set_env":
-        need("ref", ref);
-        need("id", id);
-        need("env_vars", env_vars);
-        text = (await http.put(`/v1/projects/${ref}/frontend/deployments/${id}/env`, { env_vars })).ok ? `✅ Set ${Object.keys(env_vars).length} env vars` : `❌ Failed`;
-        break;
-      case "list_frameworks":
-        text = ok(await http.get("/v1/projects/_/frontend/frameworks"));
-        break;
-      case "list_records":
-        need("ref", ref);
-        need("id", id);
-        text = ok(await http.get(`/v1/projects/${ref}/frontend/deployments/${id}/records`));
-        break;
-      case "list_releases":
-        need("ref", ref);
-        need("id", id);
-        return listFrontendReleases(http, ref, id, cursor, limit);
-      case "get_release":
-        need("ref", ref);
-        need("id", id);
-        need("release_id", release_id);
-        return getFrontendRelease(http, ref, id, release_id);
-      case "get_active_release":
-        need("ref", ref);
-        need("id", id);
-        return getActiveFrontendRelease(http, ref, id);
-      case "rollback":
-        need("ref", ref);
-        need("id", id);
-        return rollbackFrontendRelease(http, ref, id, release_id);
-      default:
-        text = `❌ Unknown action`;
-    }
-    return { content: [{ type: "text", text }] };
-  });
-}
-
-// src/shared/tools/application-schemas.ts
-var ApplicationIdSchema2 = ApplicationIdSchema;
-var ApplicationReleaseIdSchema2 = ApplicationReleaseIdSchema;
-var ApplicationReleaseRecordSchema2 = ApplicationReleaseRecordSchema;
-var ApplicationConfigurationIdSchema2 = ApplicationConfigurationIdSchema;
-var ApplicationActivationIdSchema2 = ApplicationActivationIdSchema;
-var ApplicationActivationWriteSchema2 = ApplicationActivationWriteSchema;
-var ApplicationActivationResultSchema2 = ApplicationActivationResultSchema;
-var ApplicationActivationRetirementResultSchema2 = ApplicationActivationRetirementResultSchema;
-var ApplicationRollbackSnapshotSchema2 = ApplicationRollbackSnapshotSchema;
-var ApplicationActivationHistoryCursorSchema2 = ApplicationActivationHistoryCursorSchema;
-var ApplicationPromotionPlanSchema2 = ApplicationPromotionPlanSchema;
-var ApplicationDeployRequestSchema2 = ApplicationDeployRequestSchema;
-var ApplicationDeployWebReleaseSchema2 = ApplicationDeployWebReleaseSchema;
-
-// src/shared/mutation-protocol.ts
-import { createHash as createHash6 } from "node:crypto";
-var MUTATION_ID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-var FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/;
-var OPERATION_PATTERN = /^[a-z0-9][a-z0-9._:-]{0,127}$/;
-var RESOURCE_KEY_PATTERN = /^v1\/(?:[a-z0-9][a-z0-9._-]{0,63})\/([A-Za-z0-9_-]{2,171})$/;
-var RESOURCE_ID_CONTROL_PATTERN = /[\u0000-\u001f\u007f-\u009f]/u;
-var FAILURE_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
-var LEASE_OWNER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,254}$/;
-var TIMESTAMP_PATTERN2 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
-var MAX_STATUS_RESPONSE_BYTES = 196608;
-var MAX_JSON_DEPTH = 32;
-var MAX_RESOURCE_ID_BYTES = 128;
-var FATAL_UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
-var MUTATION_STATUSES = new Set([
-  "pending",
-  "running",
-  "succeeded",
-  "failed_retryable",
-  "failed_terminal",
-  "outcome_unknown"
-]);
-var MUTATION_RESPONSE_KEYS = ["project_ref", "mutation"];
-var MUTATION_KEYS = [
-  "project_ref",
-  "mutation_id",
-  "operation",
-  "resource_key",
-  "request_fingerprint",
-  "principal",
-  "status",
-  "checkpoint",
-  "receipt",
-  "response_status",
-  "failure_code",
-  "lease",
-  "completed_at",
-  "created_at",
-  "updated_at"
-];
-var PRINCIPAL_KEYS = ["type", "id"];
-var LEASE_KEYS = ["owner", "expires_at", "fencing_epoch"];
-function isMutationId(candidate) {
-  return typeof candidate === "string" && MUTATION_ID_PATTERN2.test(candidate);
-}
-function assertCanonicalJsonNode(candidate, seen, depth) {
-  if (candidate === null || typeof candidate === "string" || typeof candidate === "boolean")
-    return;
-  if (typeof candidate === "number" && Number.isFinite(candidate))
-    return;
-  if (typeof candidate !== "object" || depth > MAX_JSON_DEPTH) {
-    throw new Error("Mutation request must be bounded JSON");
-  }
-  if (seen.has(candidate))
-    throw new Error("Mutation request must not contain cycles");
-  seen.add(candidate);
-  const prototype = Object.getPrototypeOf(candidate);
-  const plainRecord = prototype === Object.prototype || prototype === null;
-  const children = Array.isArray(candidate) ? candidate : plainRecord ? Object.values(candidate) : null;
-  if (!children)
-    throw new Error("Mutation request must contain only JSON objects and arrays");
-  for (const child of children)
-    assertCanonicalJsonNode(child, seen, depth + 1);
-  seen.delete(candidate);
-}
-function stableStringifyNode(jsonValue) {
-  if (jsonValue === null || typeof jsonValue !== "object") {
-    const serialized = JSON.stringify(jsonValue);
-    if (serialized === undefined)
-      throw new Error("Mutation request must contain exact JSON values");
-    return serialized;
-  }
-  if (Array.isArray(jsonValue))
-    return `[${jsonValue.map(stableStringifyNode).join(",")}]`;
-  const record = jsonValue;
-  const fields = Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringifyNode(record[key])}`);
-  return `{${fields.join(",")}}`;
-}
-function mutationRequestFingerprint(normalizedRequest) {
-  assertCanonicalJsonNode(normalizedRequest, new WeakSet, 0);
-  return createHash6("sha256").update(stableStringifyNode(normalizedRequest)).digest("hex");
-}
-function objectRecord3(candidate) {
-  return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
-}
-function exactRecord(candidate, keys) {
-  const record = objectRecord3(candidate);
-  if (!record || Object.keys(record).length !== keys.length)
-    return null;
-  return keys.every((key) => Object.hasOwn(record, key)) ? record : null;
-}
-function emptyProjection(candidate) {
-  const record = objectRecord3(candidate);
-  return record && Object.keys(record).length === 0 ? record : null;
-}
-function canonicalTimestamp2(candidate) {
-  if (typeof candidate !== "string" || !TIMESTAMP_PATTERN2.test(candidate))
-    return false;
-  const milliseconds = Date.parse(candidate);
-  return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === candidate;
-}
-function nullableTimestamp(candidate) {
-  return candidate === null || canonicalTimestamp2(candidate);
-}
-function safePrincipal(candidate) {
-  const principal = exactRecord(candidate, PRINCIPAL_KEYS);
-  if (!principal || !["master", "admin", "project"].includes(String(principal["type"])))
-    return null;
-  if (typeof principal["id"] !== "string" || !principal["id"] || principal["id"].length > 320 || principal["id"].trim() !== principal["id"] || /[\u0000-\u001f\u007f]/u.test(principal["id"]))
-    return null;
-  return { type: principal["type"], id: principal["id"] };
-}
-function safeLease(candidate) {
-  const lease = exactRecord(candidate, LEASE_KEYS);
-  if (!lease || lease["owner"] !== null && (typeof lease["owner"] !== "string" || !LEASE_OWNER_PATTERN.test(lease["owner"])))
-    return null;
-  if (!nullableTimestamp(lease["expires_at"]) || !Number.isSafeInteger(lease["fencing_epoch"]) || Number(lease["fencing_epoch"]) < 0)
-    return null;
-  return {
-    owner: lease["owner"],
-    expires_at: lease["expires_at"],
-    fencing_epoch: Number(lease["fencing_epoch"])
-  };
-}
-function safeResponseStatus(candidate) {
-  if (candidate === null)
-    return null;
-  return Number.isInteger(candidate) && Number(candidate) >= 100 && Number(candidate) <= 599 ? Number(candidate) : undefined;
-}
-function validLeaseState(status, lease) {
-  const running = status === "running";
-  return running ? lease.owner !== null && lease.expires_at !== null && lease.fencing_epoch > 0 : lease.owner === null && lease.expires_at === null;
-}
-function validMutationLifecycle(mutation, receipt, responseStatus) {
-  const terminal = ["succeeded", "failed_terminal", "outcome_unknown"].includes(String(mutation["status"]));
-  if (mutation["completed_at"] !== null !== terminal)
-    return false;
-  if (mutation["status"] === "succeeded") {
-    return receipt !== null && responseStatus !== null && responseStatus >= 200 && responseStatus < 300 && mutation["failure_code"] === null;
-  }
-  if (mutation["status"] === "failed_terminal") {
-    return receipt !== null && typeof mutation["failure_code"] === "string";
-  }
-  if (mutation["status"] === "failed_retryable" || mutation["status"] === "outcome_unknown") {
-    return receipt !== null && typeof mutation["failure_code"] === "string";
-  }
-  if (mutation["status"] === "pending") {
-    return receipt === null && responseStatus === null && mutation["failure_code"] === null;
-  }
-  return true;
-}
-function canonicalMutationResourceKey(candidate) {
-  if (typeof candidate !== "string")
-    return false;
-  const match = RESOURCE_KEY_PATTERN.exec(candidate);
-  if (!match)
-    return false;
-  const encodedResourceId = match[1];
-  const resourceIdBytes = Buffer.from(encodedResourceId, "base64url");
-  if (resourceIdBytes.byteLength < 1 || resourceIdBytes.byteLength > MAX_RESOURCE_ID_BYTES || resourceIdBytes.toString("base64url") !== encodedResourceId)
-    return false;
-  let resourceId;
-  try {
-    resourceId = FATAL_UTF8_DECODER.decode(resourceIdBytes);
-  } catch (decodeError) {
-    if (decodeError instanceof TypeError)
-      return false;
-    throw decodeError;
-  }
-  return resourceId.trim() === resourceId && !RESOURCE_ID_CONTROL_PATTERN.test(resourceId) && Buffer.from(resourceId, "utf8").equals(resourceIdBytes);
-}
-function validMutationIdentity(mutation) {
-  if (!isMutationId(mutation["mutation_id"]) || typeof mutation["project_ref"] !== "string")
-    return false;
-  if (typeof mutation["operation"] !== "string" || !OPERATION_PATTERN.test(mutation["operation"]))
-    return false;
-  if (mutation["resource_key"] !== null && !canonicalMutationResourceKey(mutation["resource_key"]))
-    return false;
-  return typeof mutation["request_fingerprint"] === "string" && FINGERPRINT_PATTERN.test(mutation["request_fingerprint"]);
-}
-function validMutationTerminalFields(mutation) {
-  if (typeof mutation["status"] !== "string" || !MUTATION_STATUSES.has(mutation["status"]))
-    return false;
-  if (mutation["failure_code"] !== null && (typeof mutation["failure_code"] !== "string" || !FAILURE_CODE_PATTERN.test(mutation["failure_code"])))
-    return false;
-  return nullableTimestamp(mutation["completed_at"]) && canonicalTimestamp2(mutation["created_at"]) && canonicalTimestamp2(mutation["updated_at"]);
-}
-function safeMutationStatus(candidate) {
-  const mutation = exactRecord(candidate, MUTATION_KEYS);
-  if (!mutation || !validMutationIdentity(mutation) || !validMutationTerminalFields(mutation))
-    return null;
-  const principal = safePrincipal(mutation["principal"]);
-  const checkpoint = emptyProjection(mutation["checkpoint"]);
-  const receipt = mutation["receipt"] === null ? null : emptyProjection(mutation["receipt"]);
-  const responseStatus = safeResponseStatus(mutation["response_status"]);
-  const lease = safeLease(mutation["lease"]);
-  if (!principal || !checkpoint || mutation["receipt"] !== null && !receipt || responseStatus === undefined || !lease || !validLeaseState(String(mutation["status"]), lease) || !validMutationLifecycle(mutation, receipt, responseStatus))
-    return null;
-  return {
-    project_ref: mutation["project_ref"],
-    mutation_id: mutation["mutation_id"],
-    operation: mutation["operation"],
-    resource_key: mutation["resource_key"],
-    request_fingerprint: mutation["request_fingerprint"],
-    principal,
-    status: mutation["status"],
-    checkpoint,
-    receipt,
-    response_status: responseStatus,
-    failure_code: mutation["failure_code"],
-    lease,
-    completed_at: mutation["completed_at"],
-    created_at: mutation["created_at"],
-    updated_at: mutation["updated_at"]
-  };
-}
-function mutationStatusPath(ref, mutationId) {
-  if (!isMutationId(mutationId))
-    throw new Error("'mutation_id' must be a UUIDv4");
-  return `/v1/projects/${projectRefPathSegment(ref, "Mutations")}/mutations/${encodeURIComponent(mutationId)}`;
-}
-function mutationStatusResponse(ref, mutationId, payload) {
-  const response = exactRecord(payload, MUTATION_RESPONSE_KEYS);
-  const mutation = safeMutationStatus(response?.["mutation"]);
-  return response?.["project_ref"] === ref && mutation?.project_ref === ref && mutation.mutation_id === mutationId ? mutation : null;
+    return releaseFailure("frontend.activate_release", "OUTCOME_UNKNOWN", activationStatus);
+  }
+  return toolResponse({
+    project_ref: input.projectRef,
+    deployment_id: input.deploymentId,
+    active_release_id: input.releaseId,
+    activation_id: mutationId,
+    release: readback.release
+  });
 }
-async function fetchMutationStatus(http, ref, mutationId) {
-  const response = await http.get(mutationStatusPath(ref, mutationId), {
-    maxResponseBytes: MAX_STATUS_RESPONSE_BYTES
+
+// src/shared/tools/frontend-tools.ts
+function registerFrontendTools(server, http) {
+  registerTool(server, "frontend", `Frontend hosting and immutable prebuilt releases. Supports: static, react, vue, svelte, sveltekit, sveltekit-static, nextjs, nuxt, astro.
+Actions: list, get, create, update, delete, build_logs, add_domain, remove_domain, set_env, list_frameworks, list_records, list_releases, get_active_release, get_release, rollback. Publish with supacloud deploy.`, {
+    action: withDescription(stringEnum2([
+      "list",
+      "get",
+      "create",
+      "update",
+      "delete",
+      "build_logs",
+      "add_domain",
+      "remove_domain",
+      "set_env",
+      "list_frameworks",
+      "list_records",
+      "list_releases",
+      "get_active_release",
+      "get_release",
+      "rollback"
+    ]), "Action"),
+    ref: optional(String2(), "Project ref"),
+    id: optional(String2(), "Deployment ID"),
+    name: optional(String2(), "[create] Deployment name"),
+    framework: optional(String2(), "[create] Framework (static|react|vue|svelte|sveltekit|sveltekit-static|nextjs|nuxt|astro)"),
+    domain: optional(String2(), "[create/update/add_domain/remove_domain] Custom domain"),
+    build_command: optional(String2(), "[create/update] Build command override"),
+    output_dir: optional(String2(), "[create/update] Output directory override"),
+    install_command: optional(String2(), "[create/update] Install command override"),
+    node_version: optional(String2(), "[create/update] Node.js version"),
+    health_check_path: optional(String2(), "[create/update] SSR readiness path (default: /)"),
+    env_vars: optional(Record(String2(), String2()), "[create/update/set_env] Environment variables"),
+    release_id: optional(String2(), "[get_release] SHA-256 release ID; [rollback] optional, defaults to journal-verified previous release"),
+    cursor: optional(String2(), "[list_releases] Last release SHA-256 cursor"),
+    limit: optional(Number2(), "[list_releases] Page size, 1-100 (default 50)")
+  }, async (args) => {
+    const {
+      action,
+      ref,
+      id,
+      name,
+      framework,
+      domain,
+      build_command,
+      output_dir,
+      install_command,
+      node_version,
+      health_check_path,
+      env_vars,
+      release_id,
+      cursor,
+      limit
+    } = args;
+    const need = (field, value) => {
+      if (value === undefined || value === null || value === "")
+        throw new Error(`'${field}' required for '${action}'`);
+    };
+    const ok = (res) => res.ok ? JSON.stringify(res.data, null, 2) : `❌ Failed (${res.status}): ${JSON.stringify(res.data)}`;
+    let text;
+    switch (action) {
+      case "list":
+        need("ref", ref);
+        text = ok(await http.get(`/v1/projects/${ref}/frontend/deployments`));
+        break;
+      case "get":
+        need("ref", ref);
+        need("id", id);
+        text = ok(await http.get(`/v1/projects/${ref}/frontend/deployments/${id}`));
+        break;
+      case "create":
+        need("ref", ref);
+        need("name", name);
+        need("framework", framework);
+        text = ok(await http.post(`/v1/projects/${ref}/frontend/deployments`, {
+          name,
+          framework,
+          domain,
+          build_command,
+          output_dir,
+          install_command,
+          node_version,
+          health_check_path,
+          env_vars
+        }));
+        break;
+      case "update":
+        need("ref", ref);
+        need("id", id);
+        text = ok(await http.patch(`/v1/projects/${ref}/frontend/deployments/${id}`, {
+          name,
+          domain,
+          build_command,
+          output_dir,
+          install_command,
+          node_version,
+          health_check_path,
+          env_vars
+        }));
+        break;
+      case "delete":
+        need("ref", ref);
+        need("id", id);
+        text = (await http.delete(`/v1/projects/${ref}/frontend/deployments/${id}`)).ok ? `✅ Deleted` : `❌ Failed`;
+        break;
+      case "build_logs":
+        need("ref", ref);
+        need("id", id);
+        const lr = await http.get(`/v1/projects/${ref}/frontend/deployments/${id}/logs`);
+        text = lr.ok ? typeof lr.data === "object" && lr.data !== null && "logs" in lr.data && typeof lr.data.logs === "string" ? lr.data.logs : "(no logs)" : `❌ Failed (${lr.status})`;
+        break;
+      case "add_domain":
+        need("ref", ref);
+        need("id", id);
+        need("domain", domain);
+        text = (await http.post(`/v1/projects/${ref}/frontend/deployments/${id}/domains`, { domain })).ok ? `✅ Domain ${domain} added` : `❌ Failed`;
+        break;
+      case "remove_domain":
+        need("ref", ref);
+        need("id", id);
+        need("domain", domain);
+        text = (await http.delete(`/v1/projects/${ref}/frontend/deployments/${id}/domains/${domain}`)).ok ? `✅ Domain ${domain} removed` : `❌ Failed`;
+        break;
+      case "set_env":
+        need("ref", ref);
+        need("id", id);
+        need("env_vars", env_vars);
+        text = (await http.put(`/v1/projects/${ref}/frontend/deployments/${id}/env`, { env_vars })).ok ? `✅ Set ${Object.keys(env_vars).length} env vars` : `❌ Failed`;
+        break;
+      case "list_frameworks":
+        text = ok(await http.get("/v1/projects/_/frontend/frameworks"));
+        break;
+      case "list_records":
+        need("ref", ref);
+        need("id", id);
+        text = ok(await http.get(`/v1/projects/${ref}/frontend/deployments/${id}/records`));
+        break;
+      case "list_releases":
+        need("ref", ref);
+        need("id", id);
+        return listFrontendReleases(http, ref, id, cursor, limit);
+      case "get_release":
+        need("ref", ref);
+        need("id", id);
+        need("release_id", release_id);
+        return getFrontendRelease(http, ref, id, release_id);
+      case "get_active_release":
+        need("ref", ref);
+        need("id", id);
+        return getActiveFrontendRelease(http, ref, id);
+      case "rollback":
+        need("ref", ref);
+        need("id", id);
+        return rollbackFrontendRelease(http, ref, id, release_id);
+      default:
+        text = `❌ Unknown action`;
+    }
+    return { content: [{ type: "text", text }] };
   });
-  if (!response.ok) {
-    return { kind: "unavailable", httpStatus: response.transportError ? null : response.status };
-  }
-  const mutation = mutationStatusResponse(ref, mutationId, response.data);
-  return mutation ? { kind: "available", mutation } : { kind: "invalid" };
 }
 
+// src/shared/tools/application-schemas.ts
+var ApplicationIdSchema2 = ApplicationIdSchema;
+var ApplicationReleaseIdSchema2 = ApplicationReleaseIdSchema;
+var ApplicationReleaseRecordSchema2 = ApplicationReleaseRecordSchema;
+var ApplicationConfigurationIdSchema2 = ApplicationConfigurationIdSchema;
+var ApplicationActivationIdSchema2 = ApplicationActivationIdSchema;
+var ApplicationActivationWriteSchema2 = ApplicationActivationWriteSchema;
+var ApplicationActivationResultSchema2 = ApplicationActivationResultSchema;
+var ApplicationActivationRetirementResultSchema2 = ApplicationActivationRetirementResultSchema;
+var ApplicationRollbackSnapshotSchema2 = ApplicationRollbackSnapshotSchema;
+var ApplicationActivationHistoryCursorSchema2 = ApplicationActivationHistoryCursorSchema;
+var ApplicationPromotionPlanSchema2 = ApplicationPromotionPlanSchema;
+var ApplicationDeployRequestSchema2 = ApplicationDeployRequestSchema;
+var ApplicationDeployWebReleaseSchema2 = ApplicationDeployWebReleaseSchema;
+
 // src/shared/tools/application-workflow-schemas.ts
 var closed9 = { additionalProperties: false };
 var ref5 = String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" });
@@ -17545,13 +17623,13 @@ var APPLICATION_PREVIEW_FIELDS = {
   preview_id: optional(previewIdSchema, "[get_preview/reconcile_preview/cleanup_preview] Preview receipt ID; create/plan may pin a stable ID"),
   branch_ref: optional(branchRefSchema, "[get_preview_plan] Proposed branch ref; create assigns its own"),
   branch_name: optional(String2({ minLength: 1, maxLength: 80 }), "[create_preview] Branch display name"),
-  data_mode: optional(stringEnum(["schema_only", "full_clone"]), "[get_preview_plan/create_preview] Default schema_only; full_clone copies rows"),
+  data_mode: optional(stringEnum2(["schema_only", "full_clone"]), "[get_preview_plan/create_preview] Default schema_only; full_clone copies rows"),
   ttl_seconds: optional(ttlSecondsSchema, "[get_preview_plan/create_preview] Lifetime from 300 to 604800 seconds; creation defaults to the platform TTL"),
   wait: optional(Boolean2(), "[create_preview/get_preview] Wait for verified readiness of this preview only"),
   timeout_seconds: optional(waitSecondsSchema, "[create_preview/get_preview] Observation budget with wait, from 1 to 3600 seconds (default 300)")
 };
 var strict = { additionalProperties: false };
-var phase2 = stringEnum(["pending", "ready", "failed", "cleaned"]);
+var phase2 = stringEnum2(["pending", "ready", "failed", "cleaned"]);
 var check5 = String2({ pattern: "^[a-z][a-z0-9_]{0,63}$" });
 var checks2 = _Array_(check5, { maxItems: 64, uniqueItems: true });
 var revision = Union([ApplicationConfigurationIdSchema2, Null()]);
@@ -17563,10 +17641,10 @@ var receiptSchema = _Object_({
   environment_id: ApplicationIdSchema2,
   release_id: ApplicationReleaseIdSchema2,
   expires_at: Optional(Union([timestampSchema, Null()])),
-  status: stringEnum(["planned", "provisioning", "ready", "failed", "cleaned"]),
+  status: stringEnum2(["planned", "provisioning", "ready", "failed", "cleaned"]),
   resources: _Object_({
     build_artifact: _Object_({ status: phase2, release_id: ApplicationReleaseIdSchema2 }, strict),
-    database_branch: _Object_({ status: phase2, branch_ref: branchRefSchema, data_mode: stringEnum(["schema_only", "full_clone"]) }, strict),
+    database_branch: _Object_({ status: phase2, branch_ref: branchRefSchema, data_mode: stringEnum2(["schema_only", "full_clone"]) }, strict),
     queue_namespace: _Object_({ status: phase2, namespace: String2({ minLength: 1, maxLength: 128 }) }, strict),
     storage_namespace: _Object_({ status: phase2, namespace: branchRefSchema }, strict),
     test_secret: _Object_({ status: phase2, name: String2({ pattern: "^[A-Z0-9_-]{1,128}$" }), value_issued: Literal(false) }, strict),
@@ -17874,7 +17952,7 @@ async function applicationPreviewAction(http, args, project) {
 
 // src/shared/tools/application-tools.ts
 var APPLICATION_TOOL_SCHEMA = {
-  action: withDescription(stringEnum([
+  action: withDescription(stringEnum2([
     "list_releases",
     "get_release",
     "upload_release",
@@ -19118,7 +19196,7 @@ function registerUserProjectCliTools(server, http, options = {}) {
   const { projectRef } = options;
   registerTool(server, "project", `Project-scoped inspection and developer operations.
 Actions: list (Admin guidance), get, endpoints, pause, restore, health, logs, api_keys, settings, tasks, task_detail, task_cancel, task_retry, task_stats, dlq, background_settings, update_background_settings`, {
-    action: withDescription(stringEnum([
+    action: withDescription(stringEnum2([
       "list",
       "get",
       "endpoints",
@@ -19138,7 +19216,7 @@ Actions: list (Admin guidance), get, endpoints, pause, restore, health, logs, ap
       "update_background_settings"
     ]), "Action to perform"),
     ref: optional(String2(), projectRef ? "Optional override when not auto-linked" : "Project ref"),
-    log_type: optional(stringEnum(["all", "auth", "database", "api"]), "[logs] Filter by service"),
+    log_type: optional(stringEnum2(["all", "auth", "database", "api"]), "[logs] Filter by service"),
     task_id: optional(String2(), "[task_detail/task_cancel/task_retry] Task ID"),
     limit: optional(Number2(), "[tasks/dlq] Max items to return"),
     concurrency: optional(Number2(), "[update_background_settings] Max concurrent background tasks"),
@@ -19339,7 +19417,7 @@ function registerQueueTools(server, http, options = {}) {
   const { projectRef } = options;
   registerTool(server, "queue", `Message queue operations for task-based messaging.
 Actions: list, stats, list_messages, dlq, get_message, send, receive, ack, release, fail, retry, delete_message, get_settings, update_settings`, {
-    action: withDescription(stringEnum([
+    action: withDescription(stringEnum2([
       "list",
       "stats",
       "list_messages",
@@ -19579,7 +19657,7 @@ function registerGatewayTools(server, http, options = {}) {
   const { projectRef } = options;
   registerTool(server, "gateway", `Gateway / Caddy 配置（通过 JSON Admin API 注入）。要求 admin 权限。
 Actions: routes, upsert_route, update_route, delete_route, config, get_certificate, update_certificate, issue_certificate, deploy_certificate, rebuild, custom_hostname, set_custom_hostname, delete_custom_hostname, verify_custom_hostname`, {
-    action: withDescription(stringEnum([
+    action: withDescription(stringEnum2([
       "routes",
       "upsert_route",
       "update_route",
@@ -19600,11 +19678,11 @@ Actions: routes, upsert_route, update_route, delete_route, config, get_certifica
     hosts: withDescription(stringArray, "[upsert_route/update_route] 主机名列表，逗号分隔或 JSON 数组（1-20）"),
     paths: withDescription(stringArray, "[upsert_route/update_route] 路径列表，逗号分隔或 JSON 数组（1-32）"),
     upstream: optional(String2(), "[upsert_route/update_route] 反代上游 host:port 或 http(s)://host[:port]"),
-    managed_upstream: optional(stringEnum(["edge-functions"]), "[upsert_route/update_route] 托管上游（同步 Edge Function）"),
+    managed_upstream: optional(stringEnum2(["edge-functions"]), "[upsert_route/update_route] 托管上游（同步 Edge Function）"),
     upstream_tls_insecure_skip_verify: optional(Boolean2(), "[upsert_route/update_route] 上游 TLS 跳过校验"),
     static_root: optional(String2(), "[upsert_route/update_route] 静态站点根目录"),
     spa: optional(Boolean2(), "[upsert_route/update_route] 是否启用 SPA 单页回退"),
-    protocol: optional(stringEnum(["http", "https"]), "[upsert_route/update_route] 可选请求协议匹配"),
+    protocol: optional(stringEnum2(["http", "https"]), "[upsert_route/update_route] 可选请求协议匹配"),
     redirect_to: optional(String2(), "[upsert_route/update_route] 带固定 host 的绝对 http(s) 目标，可在末尾使用 {http.request.uri}"),
     redirect_status: withDescription(redirectStatus, "[upsert_route/update_route] 重定向状态码，默认 308"),
     rewrite_uri: optional(String2(), "[upsert_route/update_route] 重写 URI（以 / 开头）"),
@@ -19613,12 +19691,12 @@ Actions: routes, upsert_route, update_route, delete_route, config, get_certifica
     cors: withDescription(stringArray, "[upsert_route/update_route] 额外 CORS 源，逗号分隔"),
     priority: optional(Number2(), "[upsert_route/update_route] 路由优先级"),
     enabled: optional(Boolean2(), "[upsert_route/update_route] 是否启用"),
-    rate_limit_tier: optional(stringEnum(["free", "pro", "enterprise"]), "[config] 限流档位"),
+    rate_limit_tier: optional(stringEnum2(["free", "pro", "enterprise"]), "[config] 限流档位"),
     cors_origins: optional(String2(), "[config] CORS 源（逗号分隔）"),
     jwt_enabled: optional(Boolean2(), "[config] 是否启用 JWT"),
     jwt_secret: optional(String2(), "[config] JWT 密钥"),
-    cert_mode: optional(stringEnum(["lego", "manual"]), "[update_certificate] 证书模式"),
-    challenge: optional(stringEnum(["dns-01", "http-01"]), "[update_certificate/issue_certificate] ACME challenge"),
+    cert_mode: optional(stringEnum2(["lego", "manual"]), "[update_certificate] 证书模式"),
+    challenge: optional(stringEnum2(["dns-01", "http-01"]), "[update_certificate/issue_certificate] ACME challenge"),
     email: optional(String2(), "[update_certificate/issue_certificate] ACME 邮箱"),
     dns_provider: optional(String2(), "[update_certificate/issue_certificate] DNS 提供商"),
     dns_env: withDescription(stringArray, "[update_certificate/issue_certificate] DNS 环境变量 KEY=VALUE 列表"),
@@ -20132,7 +20210,7 @@ function formatPromotionResult(response) {
 }
 function registerBranchTools(server, http, options = {}) {
   registerTool(server, "branch", "Preview branch lifecycle and safe migration promotion. Whole-database replacement is intentionally not exposed by this project CLI.", {
-    action: withDescription(stringEnum([
+    action: withDescription(stringEnum2([
       "list",
       "create",
       "delete",
@@ -20142,7 +20220,7 @@ function registerBranchTools(server, http, options = {}) {
     ref: optional(String2(), "[*] Optional parent project override"),
     branch_ref: optional(String2(), "[delete/promotion_plan/promote] Preview branch ref"),
     name: optional(String2(), "[create] Branch name"),
-    data_mode: optional(stringEnum(["schema_only", "full_clone"]), "[create] Preview data mode (default: schema_only)"),
+    data_mode: optional(stringEnum2(["schema_only", "full_clone"]), "[create] Preview data mode (default: schema_only)"),
     plan_checksum: optional(String2(), "[promote] Reviewed plan checksum from promotion_plan"),
     confirm_destructive: optional(Boolean2(), "[promote] Confirm reviewed destructive migrations"),
     json: optional(Boolean2(), "[promotion_plan/promote] Return machine-readable JSON")
@@ -20737,7 +20815,7 @@ function registerSupabaseCliTools(server, options = {}) {
     executeOfficialCli: options.executeOfficialCli || ((request) => executeOfficialSupabaseCli(request, environment))
   };
   registerTool(server, "supabase", "Controlled adapter for the official open-source Supabase CLI. Remote push stays on the SupaCloud Management API and requires explicit Management credentials.", {
-    action: withDescription(stringEnum([
+    action: withDescription(stringEnum2([
       "version",
       "init",
       "migration_new",
@@ -20770,16 +20848,16 @@ function registerSupabaseCliTools(server, options = {}) {
     experimental: optional(Boolean2(), "[db_schema_declarative_*] Enable the experimental pg-delta workflow"),
     strict_coverage: optional(Boolean2(), "[db_schema_declarative_*] Fail on unmanaged schema objects"),
     overwrite: optional(Boolean2(), "[db_schema_declarative_generate] Replace existing schema files"),
-    runtime: optional(stringEnum(["docker", "podman", "native"]), "[stack_*] Local stack runtime"),
+    runtime: optional(stringEnum2(["docker", "podman", "native"]), "[stack_*] Local stack runtime"),
     eager: optional(Boolean2(), "[stack_start] Start all services before returning"),
-    preparation: optional(stringEnum(["background", "on-demand"]), "[stack_start] Download service archives in the background or on demand"),
+    preparation: optional(stringEnum2(["background", "on-demand"]), "[stack_start] Download service archives in the background or on demand"),
     force: optional(Boolean2(), "[config_pull] Permit overwriting dirty tracked config"),
     yes: optional(Boolean2(), "[config_pull/stack_destroy] Confirm a write or destructive action"),
     confirm_destroy: optional(Boolean2(), "[stack_destroy] Explicitly confirm permanent local stack destruction"),
     no_seed: optional(Boolean2(), "[db_reset] Skip seed scripts"),
-    diff_engine: optional(stringEnum(["migra", "pg-delta", "pgadmin", "pg-schema"]), "[db_diff/db_pull] Official CLI diff engine"),
-    dump_mode: optional(stringEnum(["schema", "data", "roles"]), "[db_dump] Dump schema (default), data, or roles"),
-    language: optional(stringEnum(["typescript", "go", "swift", "python"]), "[gen_types] Output language (default: typescript)")
+    diff_engine: optional(stringEnum2(["migra", "pg-delta", "pgadmin", "pg-schema"]), "[db_diff/db_pull] Official CLI diff engine"),
+    dump_mode: optional(stringEnum2(["schema", "data", "roles"]), "[db_dump] Dump schema (default), data, or roles"),
+    language: optional(stringEnum2(["typescript", "go", "swift", "python"]), "[gen_types] Output language (default: typescript)")
   }, (request) => executeSupabaseAction(request, runtime));
 }
 
@@ -20972,7 +21050,7 @@ function registerLiteCliTools(server, options = {}) {
   const fallbackWorkdir = options.currentWorkingDirectory || process.cwd();
   const execute = options.executeLiteCli || ((request) => executeLiteCli(request, environment, fallbackWorkdir));
   registerTool(server, "lite", "Controlled adapter for the local SupaCloud Lite CLI. Lite actions are local-only and never use the Management API or official Supabase CLI.", {
-    action: withDescription(stringEnum([
+    action: withDescription(stringEnum2([
       "version",
       "start",
       "migrate",
@@ -20993,14 +21071,14 @@ function registerLiteCliTools(server, options = {}) {
     state_dir: optional(String2(), "[*] Lite state root"),
     data_dir: optional(String2(), "[*] PGlite/native data directory"),
     storage_dir: optional(String2(), "[*] Object storage directory"),
-    storage_backend: optional(stringEnum(["fs", "memory", "s3"]), "[*] Storage backend"),
+    storage_backend: optional(stringEnum2(["fs", "memory", "s3"]), "[*] Storage backend"),
     s3_prefix: optional(String2(), "[*] S3 object key prefix"),
-    engine: optional(stringEnum(["pglite", "native"]), "[*] Database engine"),
+    engine: optional(stringEnum2(["pglite", "native"]), "[*] Database engine"),
     host: optional(String2(), "[start] Listen host"),
     port: optional(Number2(), "[start] Listen port"),
     api_url: optional(String2(), "[start] Public API URL"),
     site_url: optional(String2(), "[start] Auth site URL"),
-    replication_profile: optional(stringEnum(["powersync"]), "[start/doctor] Replication profile"),
+    replication_profile: optional(stringEnum2(["powersync"]), "[start/doctor] Replication profile"),
     replication_host: optional(String2(), "[start] Replication listener host"),
     replication_port: optional(Number2(), "[start] Replication listener port"),
     replication_allow_cidrs: optional(String2(), "[start] Replication client CIDRs"),
@@ -21181,7 +21259,7 @@ function textResponse(payload) {
 }
 function registerAiTools(server) {
   registerTool(server, "ai", "Install or inspect the bundled SupaCloud CLI AI skill. Actions: show_skill, install_skill", {
-    action: stringEnum(["show_skill", "install_skill"]),
+    action: stringEnum2(["show_skill", "install_skill"]),
     target: optional(String2(), "[install_skill] Skill root directory; defaults to $CODEX_HOME/skills or ~/.codex/skills"),
     dry_run: optional(Boolean2(), "[install_skill] Preview the installation without writing files"),
     force: optional(Boolean2(), "[install_skill] Back up and replace different existing skill content")
@@ -24287,6 +24365,77 @@ function checkAppDatabaseSources(projectRoot) {
   }
 }
 
+// src/shared/tools/application-tools.ts
+var APPLICATION_TOOL_SCHEMA2 = {
+  action: withDescription(stringEnum2([
+    "list_releases",
+    "get_release",
+    "upload_release",
+    "get_runtime",
+    "get_deployment_evidence",
+    "get_configuration",
+    "put_configuration",
+    "get_deploy_plan",
+    "deploy_release",
+    "deploy_application",
+    "get_release_transfer_plan",
+    "transfer_release",
+    "get_promotion_plan",
+    "promote_application",
+    "get_promotion_status",
+    "reconcile_promotion",
+    "get_preview_plan",
+    "list_previews",
+    "create_preview",
+    "get_preview",
+    "cleanup_preview",
+    "activate_release",
+    "reconcile_activation",
+    "retire_activation",
+    "rollback_release",
+    "get_rollback_snapshot",
+    "get_history",
+    ...APPLICATION_PREVIEW_ACTIONS,
+    "logs"
+  ]), "Action"),
+  ref: withDescription(String2(), "Project ref"),
+  id: withDescription(ApplicationIdSchema2, "Application ID"),
+  environment_id: optional(withDescription(ApplicationIdSchema2, "[get_runtime/get_configuration/put_configuration/get_deploy_plan/deploy_release/get_rollback_snapshot/rollback_release/get_history] Environment ID")),
+  configuration_id: optional(ApplicationConfigurationIdSchema2, "[get_configuration/get_deploy_plan/deploy_release/activate_release/rollback_release/get_history] Immutable revision; required for deployment"),
+  activation_id: optional(ApplicationActivationIdSchema2, "[deploy_release/activate_release/reconcile_activation/retire_activation/rollback_release/get_history] Stable activation ID; generated for automatic deployment/rollback if omitted"),
+  expected_activation_id: optional(Union([ApplicationActivationIdSchema2, Null(), Literal("absent")]), "[deploy_release/activate_release/rollback_release] Current activation ID, or absent for first activation; selected from verified plan for automatic deployment"),
+  configuration_path: optional(String2(), "[put_configuration] Local configuration write JSON including revision and expected revision"),
+  configuration_write: optional(Unknown(), "[deploy_application] Parsed immutable configuration write"),
+  manifest_path: optional(String2(), "[upload_release] Local delivery.manifest.json"),
+  web_release: optional(ApplicationDeployWebReleaseSchema2, "[deploy_application] Immutable staged Web release uploaded by the deploy profile"),
+  release_id: optional(ApplicationReleaseIdSchema2, "[get_release/get_deploy_plan/deploy_release/activate_release/reconcile_activation/rollback_release] Immutable application release ID; platform selects previous for default rollback"),
+  source_ref: optional(String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" }), "[get_release_transfer_plan/transfer_release] Source project ref"),
+  source_release_id: optional(ApplicationReleaseIdSchema2, "[get_release_transfer_plan/transfer_release] Source immutable release ID"),
+  source_environment_id: optional(ApplicationIdSchema2, "[get_promotion_plan] Source environment"),
+  mutation_id: optional(ApplicationActivationIdSchema2, "[deploy_application/promote_application/get_promotion_status/reconcile_promotion] Stable mutation ID"),
+  approved_migration_digest: optional(ApplicationReleaseIdSchema2, "[deploy_application/promote_application] Exact reviewed migration execution-plan digest"),
+  plan: optional(ApplicationPromotionPlanSchema2, "[promote_application] Immutable plan returned by get_promotion_plan"),
+  cursor: optional(Union([ApplicationReleaseIdSchema2, ApplicationActivationHistoryCursorSchema2]), "[list_releases/get_history] Returned page cursor"),
+  limit: optional(Integer({ minimum: 1, maximum: 100 }), "[list_releases/get_history] Page size, default 50/20"),
+  offset: optional(Integer({ minimum: 0, maximum: 1e6 }), "[logs] Result offset"),
+  service: optional(String2(), "[logs] Application target/service filter"),
+  search: optional(String2(), "[logs] Full-text log filter"),
+  start: optional(String2(), "[logs] ISO start timestamp"),
+  end: optional(String2(), "[logs] ISO end timestamp"),
+  ...APPLICATION_PREVIEW_FIELDS
+};
+var responseSchema2 = _Object_({
+  project_ref: String2(),
+  application_id: ApplicationIdSchema2,
+  release: ApplicationReleaseRecordSchema2
+});
+var inventorySchema2 = _Object_({
+  project_ref: String2(),
+  application_id: ApplicationIdSchema2,
+  releases: _Array_(ApplicationReleaseRecordSchema2, { maxItems: 100 }),
+  next_cursor: Union([ApplicationReleaseIdSchema2, Null()])
+});
+
 // src/shared/tools/app-resource.ts
 function resourceScaffold(name, className) {
   return {
@@ -25131,7 +25280,7 @@ var REMOTE_APP_DESCRIPTIONS = {
   cursor: "[history] Returned page cursor",
   limit: "[history] Page size, default 20 (1-100)"
 };
-var { action: _remoteAction, plan: _remotePlan, ...remoteFields } = APPLICATION_TOOL_SCHEMA;
+var { action: _remoteAction, plan: _remotePlan, ...remoteFields } = APPLICATION_TOOL_SCHEMA2;
 var REMOTE_APP_SCHEMA = Partial(_Object_(remoteFields)).properties;
 for (const [name, schema] of Object.entries(REMOTE_APP_SCHEMA)) {
   const description = REMOTE_APP_DESCRIPTIONS[name];
@@ -26150,7 +26299,7 @@ async function runAppRelease(request, options, delegate) {
     id,
     manifest_path: manifestPath
   };
-  validateToolArguments(APPLICATION_TOOL_SCHEMA, uploadArgs);
+  validateToolArguments2(APPLICATION_TOOL_SCHEMA2, uploadArgs);
   const uploaded = await delegate(uploadArgs);
   const uploadReceipt = resultObject(uploaded);
   if (uploaded.isError || !uploadReceipt?.ok) {
@@ -26190,7 +26339,7 @@ async function runAppRelease(request, options, delegate) {
     ...configurationWrite === undefined ? {} : { configuration_write: configurationWrite },
     ...request.web_release === undefined ? {} : { web_release: request.web_release }
   };
-  validateToolArguments(APPLICATION_TOOL_SCHEMA, deployArgs);
+  validateToolArguments2(APPLICATION_TOOL_SCHEMA2, deployArgs);
   if (!options.projectDeployment) {
     throw new Error("Application release requires the unified project deployment handler");
   }
@@ -26432,7 +26581,7 @@ async function runPromotion(request, options, delegate) {
     action: "get_promotion_plan",
     ref
   };
-  validateToolArguments(APPLICATION_TOOL_SCHEMA, planArgs);
+  validateToolArguments2(APPLICATION_TOOL_SCHEMA2, planArgs);
   const planned = await delegate(planArgs);
   if (planned.isError)
     return planned;
@@ -26484,7 +26633,7 @@ Execution: skipped`);
     configuration_id: plan.target.configuration_id,
     plan
   };
-  validateToolArguments(APPLICATION_TOOL_SCHEMA, executeArgs);
+  validateToolArguments2(APPLICATION_TOOL_SCHEMA2, executeArgs);
   const result = await delegate(executeArgs);
   return format === "json" || json ? result : formatPromotionExecution(result);
 }
@@ -26532,7 +26681,7 @@ async function runAppTool(request, options = {}) {
       action,
       ref: request.ref ?? options.projectRef
     };
-    validateToolArguments(APPLICATION_TOOL_SCHEMA, args);
+    validateToolArguments2(APPLICATION_TOOL_SCHEMA2, args);
     const result = await delegate(args);
     if (request.action === "history" && format !== "json" && json !== true) {
       return historyText(result, request, args.ref);
@@ -26594,137 +26743,414 @@ async function runAppTool(request, options = {}) {
     case "fix":
       return runFix(request);
     default:
-      return textResult(`Unknown app action: ${String(request.action)}`, true);
+      return textResult(`Unknown app action: ${String(request.action)}`, true);
+  }
+}
+function registerAppTools(server, options = {}) {
+  registerTool(server, "app", "Application authoring and delivery. Plan is read-only; build, upload and configure never deploy. Deploy/rollback explicitly activate a release; rollback never downgrades schema.", {
+    ...REMOTE_APP_SCHEMA,
+    action: withDescription(stringEnum2([
+      "init",
+      "generate",
+      "dev",
+      "watch",
+      "verify-plan",
+      "compile",
+      "check",
+      "graph",
+      "explain",
+      "export-tools",
+      "context",
+      "doctor",
+      "fix",
+      "plan",
+      "build",
+      "release",
+      "upload",
+      "configure",
+      "transfer-plan",
+      "transfer",
+      "promote-plan",
+      "deploy",
+      "deploy-plan",
+      "diff",
+      "status",
+      "rollback",
+      "rollback-plan",
+      "history",
+      "reconcile",
+      "retire",
+      "logs",
+      "preview-plan",
+      "preview",
+      "previews",
+      "preview-list",
+      "preview-create",
+      "preview-status",
+      "preview-cleanup",
+      "preview-reconcile",
+      "promote",
+      "promote-status",
+      "promote-reconcile"
+    ]), "App action; promote obtains and verifies its plan before one mutation request"),
+    kind: optional(stringEnum2(["module", "command", "query", "controller", "job", "contract", "resource", "feature"]), "[generate] Scaffold kind"),
+    template: optional(stringEnum2(["minimal", "http", "command", "edge"]), "[init] Minimal application by default; explicit http/command/edge recipes"),
+    name: optional(String2(), "[init/generate] Project or object name"),
+    module: optional(String2(), "[generate] Target feature module (required for command/query/controller)"),
+    permission: optional(String2(), "[generate feature] Explicit approval permission; not inferred from name"),
+    rpc: optional(String2(), "[generate feature] Explicit durable RPC capability; must be registered by the host"),
+    dir: optional(String2(), "[generate] Feature root directory (default: src/features)"),
+    force: optional(Boolean2(), "[generate] Overwrite a single regular file; resource/feature/controller never overwrite"),
+    dry_run: optional(Boolean2(), "[generate] Validate and preview the complete change set without writing"),
+    "dry-run": optional(Boolean2(), "[generate] CLI alias of dry_run"),
+    register_in: optional(String2(), "[generate] Existing parent module file for module/resource/feature; uses the compiler AST editor"),
+    "register-in": optional(String2(), "[generate] CLI alias of register_in"),
+    root: optional(String2(), "[dev/plan/build/release/compile/check] Project directory containing supacloud.config.ts (default: current directory)"),
+    include: optional(String2(), "[dev/compile/check] Comma-separated glob patterns for source files"),
+    out_dir: optional(String2(), "[dev/compile/plan/build/export-tools] Output directory (default: configured outDir)"),
+    strict: optional(Boolean2(), "[dev/compile/check] Promote warnings to errors"),
+    format: optional(stringEnum2(["text", "json"]), "[dev/generate/compile/check/plan/release/deploy-plan/diff/history/promote-plan/graph/export-tools] Output format (default: text)"),
+    json: optional(Boolean2(), "[history/transfer-plan/transfer/promote-plan] Preserve or return the full machine-readable receipt"),
+    profile: optional(stringEnum2(["fast", "integration"]), "[dev] Run dev or dev:integration; integration verifies an explicit loopback database"),
+    once: optional(Boolean2(), "[dev] Validate and report once without watching"),
+    watch: optional(Boolean2(), "[dev] Watch for changes (default: true; --once disables)"),
+    database_url: optional(String2(), "[dev] Explicit loopback integration URL; watch/once only inspect its shape"),
+    "database-url": optional(String2(), "[dev] CLI alias of database_url"),
+    target: optional(String2(), "[explain/context/verify-plan] Provider class name / token name / command name / job name / module name"),
+    fix: optional(String2(), "[fix] Path to a DiagnosticFix JSON file produced by `doctor --format json`"),
+    write: optional(Boolean2(), "[fix] Write the fix to disk (default: preview only)"),
+    skip_build: optional(Boolean2(), "[release] Reuse --manifest_path instead of running the local delivery build")
+  }, (request) => runAppTool(request, options));
+}
+var APP_ALIAS_ACTIONS = ["generate", "compile", "check", "graph", "explain", "context", "doctor", "fix"];
+function registerAppAliases(server) {
+  const schema = {
+    kind: optional(stringEnum2(["module", "command", "query", "controller", "job", "contract", "resource", "feature"]), "[generate] Scaffold kind"),
+    name: optional(String2(), "[generate] Object name"),
+    module: optional(String2(), "[generate] Target feature module"),
+    permission: optional(String2(), "[generate feature] Explicit approval permission; not inferred from name"),
+    rpc: optional(String2(), "[generate feature] Explicit durable RPC capability; must be registered by the host"),
+    dir: optional(String2(), "[generate] Feature root directory (default: src/features)"),
+    force: optional(Boolean2(), "[generate] Overwrite a single regular file; resource/feature/controller never overwrite"),
+    dry_run: optional(Boolean2(), "[generate] Validate and preview the complete change set without writing"),
+    "dry-run": optional(Boolean2(), "[generate] CLI alias of dry_run"),
+    register_in: optional(String2(), "[generate] Existing parent module file for module/resource/feature; uses the compiler AST editor"),
+    "register-in": optional(String2(), "[generate] CLI alias of register_in"),
+    root: optional(String2(), "Project directory containing supacloud.config.ts (default: current directory)"),
+    include: optional(String2(), "[compile/check] Comma-separated glob patterns for source files"),
+    out_dir: optional(String2(), "[compile/export-tools] Output directory (default: <root>/generated)"),
+    strict: optional(Boolean2(), "[compile/check] Promote warnings to errors"),
+    format: optional(stringEnum2(["text", "json"]), "Output format (default: text)"),
+    target: optional(String2(), "[explain/context] Provider class name / token name / command name / job name / module name"),
+    fix: optional(String2(), "[fix] Path to a DiagnosticFix JSON file produced by `doctor --format json`"),
+    write: optional(Boolean2(), "[fix] Write the fix to disk (default: preview only)")
+  };
+  for (const action of APP_ALIAS_ACTIONS) {
+    registerTool(server, action, `Top-level alias of \`app ${action}\`.`, schema, (request) => runAppTool({ ...request, action }));
+  }
+}
+
+// src/shared/tools/db-governance-tools.ts
+import { existsSync as existsSync13 } from "node:fs";
+import { join as join16, resolve as resolve20 } from "node:path";
+import {
+  buildDatabaseManifest,
+  explainObject,
+  lintModule,
+  readCatalog,
+  reconcileModule
+} from "@supacloud/db";
+
+// src/shared/tools/db-workflow.ts
+import { createHash as createHash7 } from "node:crypto";
+import { lstat as lstat4, mkdir as mkdir6, mkdtemp, readFile as readFile5, readdir as readdir6, rename as rename3, rm as rm2, writeFile as writeFile5 } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
+import { dirname as dirname10, isAbsolute as isAbsolute7, join as join15, relative as relative8, resolve as resolve19 } from "node:path";
+import {
+  assertApplicationRoleRestricted,
+  readDatabaseRole,
+  renderDatabaseRoleGuardSql,
+  renderReverseSnapshot,
+  reverseDatabase
+} from "@supacloud/db";
+import { parseDatabaseSourcesConfig } from "@supacloud/db/source-contracts";
+
+// src/shared/tools/supabase-cli-tools.ts
+import { chmodSync as chmodSync2, existsSync as existsSync12, mkdirSync as mkdirSync4, statSync as statSync8, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname9, isAbsolute as isAbsolute6, join as join14, resolve as resolve18 } from "node:path";
+var SENSITIVE_ENV_KEY2 = /(?:^|_)(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIALS?|AUTHORIZATION|AUTH|SESSION|COOKIE|BEARER|DB_URI|DB_URL|DSN|DATABASE_URL|DATABASE_URI|CONNECTION_STRING|CONNECTION_URI)(?:_|$)/i;
+var VALID_VERSION2 = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+var VALID_MIGRATION_NAME2 = /^[A-Za-z0-9][A-Za-z0-9_-]{0,100}$/;
+var VALID_SCHEMA2 = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+var VALID_PROJECT_REF2 = /^[A-Za-z0-9_-]{1,64}$/;
+function isSensitiveEnvironmentKey2(key) {
+  return key.toUpperCase().startsWith("PG") || SENSITIVE_ENV_KEY2.test(key);
+}
+function requireMigrationName2(name) {
+  if (!name || !VALID_MIGRATION_NAME2.test(name)) {
+    throw new Error("Invalid migration name; use letters, numbers, underscore, or hyphen");
+  }
+  return name;
+}
+function normalizeSchemaList2(schema) {
+  if (!schema)
+    return;
+  const schemas = schema.split(",").map((schemaName) => schemaName.trim()).filter(Boolean);
+  if (!schemas.length || schemas.some((schemaName) => !VALID_SCHEMA2.test(schemaName))) {
+    throw new Error("Invalid schema list");
+  }
+  return schemas.join(",");
+}
+function requirePostgresUrl2(databaseUrl) {
+  if (!databaseUrl || /[\r\n\0]/.test(databaseUrl)) {
+    throw new Error("A Postgres database URL is required");
+  }
+  try {
+    const url = new URL(databaseUrl);
+    if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") {
+      throw new Error("unsupported protocol");
+    }
+  } catch {
+    throw new Error("A valid Postgres database URL is required");
+  }
+  return databaseUrl;
+}
+function schemaArguments2(schema) {
+  const normalized = normalizeSchemaList2(schema);
+  return normalized ? ["--schema", normalized] : [];
+}
+function workdirArguments2(workdir) {
+  if (!workdir)
+    throw new Error("A workdir is required");
+  return ["--workdir", resolve18(workdir)];
+}
+function resolveOutputPath2(workdir, file, label) {
+  if (!file || /[\r\n\0]/.test(file))
+    throw new Error(`${label} file is required`);
+  return isAbsolute6(file) ? resolve18(file) : resolve18(workdir, file);
+}
+function databaseTargetArguments2(databaseUrl) {
+  return databaseUrl ? ["--db-url", requirePostgresUrl2(databaseUrl)] : ["--local"];
+}
+function databaseDiffArguments2(request) {
+  const engineFlags = {
+    migra: "--use-migra",
+    pgadmin: "--use-pgadmin",
+    "pg-schema": "--use-pg-schema",
+    "pg-delta": "--use-pg-delta"
+  };
+  return [
+    "db",
+    "diff",
+    "--local",
+    ...request.name ? ["--file", requireMigrationName2(request.name)] : [],
+    ...schemaArguments2(request.schema),
+    ...request.diff_engine ? [engineFlags[request.diff_engine]] : []
+  ];
+}
+function databasePullArguments2(request) {
+  if (request.diff_engine && request.diff_engine !== "migra" && request.diff_engine !== "pg-delta") {
+    throw new Error("db_pull only supports migra or pg-delta diff engines");
+  }
+  return [
+    "db",
+    "pull",
+    ...request.name ? [requireMigrationName2(request.name)] : [],
+    "--db-url",
+    requirePostgresUrl2(request.db_url),
+    ...request.declarative ? ["--declarative"] : [],
+    ...request.diff_engine ? ["--diff-engine", request.diff_engine] : [],
+    ...schemaArguments2(request.schema)
+  ];
+}
+function declarativeSyncArguments2(request) {
+  return [
+    "db",
+    "schema",
+    "declarative",
+    "sync",
+    ...request.name ? ["--name", requireMigrationName2(request.name)] : [],
+    ...request.file ? ["--file", requireMigrationName2(request.file)] : [],
+    ...request.apply === true ? ["--apply"] : ["--no-apply"],
+    ...request.experimental === false ? [] : ["--experimental"],
+    ...request.strict_coverage ? ["--strict-coverage"] : [],
+    ...schemaArguments2(request.schema)
+  ];
+}
+function declarativeGenerateArguments2(request) {
+  const target = request.db_url ? ["--db-url", requirePostgresUrl2(request.db_url)] : ["--linked"];
+  return [
+    "db",
+    "schema",
+    "declarative",
+    "generate",
+    ...target,
+    ...request.experimental === false ? [] : ["--experimental"],
+    ...request.overwrite ? ["--overwrite"] : [],
+    ...request.strict_coverage ? ["--strict-coverage"] : [],
+    ...schemaArguments2(request.schema)
+  ];
+}
+function stackRuntimeArguments2(request) {
+  if (request.runtime && !["docker", "podman", "native"].includes(request.runtime)) {
+    throw new Error("Invalid local stack runtime");
+  }
+  return request.runtime ? ["--runtime", request.runtime] : [];
+}
+function stackArguments2(request) {
+  switch (request.action) {
+    case "stack_start":
+      return [
+        "stack",
+        "start",
+        ...stackRuntimeArguments2({ ...request, runtime: request.runtime ?? "docker" }),
+        ...request.eager ? ["--eager"] : [],
+        ...request.preparation ? ["--preparation", request.preparation] : []
+      ];
+    case "stack_prepare":
+      return ["stack", "prepare", ...stackRuntimeArguments2({ ...request, runtime: request.runtime ?? "docker" })];
+    case "stack_status":
+      return ["stack", "status", "--output-format", "json"];
+    case "stack_stop":
+      return ["stack", "stop"];
+    case "stack_destroy":
+      if (request.confirm_destroy !== true || request.yes !== true) {
+        throw new Error("stack_destroy requires confirm_destroy=true and yes=true");
+      }
+      return ["stack", "destroy", "--yes"];
+    default:
+      throw new Error(`Unsupported local stack action: ${request.action}`);
+  }
+}
+function databaseDumpArguments2(request, workdir) {
+  return [
+    "db",
+    "dump",
+    "--db-url",
+    requirePostgresUrl2(request.db_url),
+    "--file",
+    resolveOutputPath2(workdir, request.file, "Database dump"),
+    ...request.dump_mode === "data" ? ["--data-only"] : [],
+    ...request.dump_mode === "roles" ? ["--role-only"] : [],
+    ...schemaArguments2(request.schema)
+  ];
+}
+function configPullArguments2(request) {
+  if (!request.ref || !VALID_PROJECT_REF2.test(request.ref))
+    throw new Error("Invalid project ref");
+  if (request.dry_run === false && request.yes !== true) {
+    throw new Error("config_pull apply requires yes=true");
+  }
+  return [
+    "config",
+    "pull",
+    ...request.ref ? ["--project-ref", request.ref] : [],
+    ...request.dry_run === true || request.dry_run === undefined ? ["--dry-run"] : [],
+    ...request.force ? ["--force"] : [],
+    ...request.dry_run === false ? ["--yes"] : []
+  ];
+}
+function generateTypesArguments2(request, workdir) {
+  resolveOutputPath2(workdir, request.file, "Generated types");
+  return [
+    "gen",
+    "types",
+    ...databaseTargetArguments2(request.db_url),
+    "--lang",
+    request.language || "typescript",
+    ...schemaArguments2(request.schema)
+  ];
+}
+function actionArguments2(request, workdir) {
+  switch (request.action) {
+    case "init":
+      if (request.force)
+        throw new Error("init never overwrites an existing project configuration");
+      return ["init"];
+    case "migration_new":
+      return ["migration", "new", requireMigrationName2(request.name)];
+    case "db_diff":
+      return databaseDiffArguments2(request);
+    case "db_reset":
+      return ["db", "reset", "--local", ...request.no_seed ? ["--no-seed"] : [], "--yes"];
+    case "db_pull":
+      return databasePullArguments2(request);
+    case "db_schema_declarative_sync":
+      return declarativeSyncArguments2(request);
+    case "db_schema_declarative_generate":
+      return declarativeGenerateArguments2(request);
+    case "db_dump":
+      return databaseDumpArguments2(request, workdir);
+    case "config_pull":
+      return configPullArguments2(request);
+    case "stack_start":
+    case "stack_prepare":
+    case "stack_status":
+    case "stack_stop":
+    case "stack_destroy":
+      return stackArguments2(request);
+    case "migration_list":
+      return ["migration", "list", ...databaseTargetArguments2(request.db_url)];
+    case "gen_types":
+      return generateTypesArguments2(request, workdir);
+    case "push":
+      throw new Error("Remote push must use the SupaCloud Management API");
+    default:
+      throw new Error(`Unsupported official Supabase CLI action: ${String(request.action)}`);
   }
 }
-function registerAppTools(server, options = {}) {
-  registerTool(server, "app", "Application authoring and delivery. Plan is read-only; build, upload and configure never deploy. Deploy/rollback explicitly activate a release; rollback never downgrades schema.", {
-    ...REMOTE_APP_SCHEMA,
-    action: withDescription(stringEnum([
-      "init",
-      "generate",
-      "dev",
-      "watch",
-      "verify-plan",
-      "compile",
-      "check",
-      "graph",
-      "explain",
-      "export-tools",
-      "context",
-      "doctor",
-      "fix",
-      "plan",
-      "build",
-      "release",
-      "upload",
-      "configure",
-      "transfer-plan",
-      "transfer",
-      "promote-plan",
-      "deploy",
-      "deploy-plan",
-      "diff",
-      "status",
-      "rollback",
-      "rollback-plan",
-      "history",
-      "reconcile",
-      "retire",
-      "logs",
-      "preview-plan",
-      "preview",
-      "previews",
-      "preview-list",
-      "preview-create",
-      "preview-status",
-      "preview-cleanup",
-      "preview-reconcile",
-      "promote",
-      "promote-status",
-      "promote-reconcile"
-    ]), "App action; promote obtains and verifies its plan before one mutation request"),
-    kind: optional(stringEnum(["module", "command", "query", "controller", "job", "contract", "resource", "feature"]), "[generate] Scaffold kind"),
-    template: optional(stringEnum(["minimal", "http", "command", "edge"]), "[init] Minimal application by default; explicit http/command/edge recipes"),
-    name: optional(String2(), "[init/generate] Project or object name"),
-    module: optional(String2(), "[generate] Target feature module (required for command/query/controller)"),
-    permission: optional(String2(), "[generate feature] Explicit approval permission; not inferred from name"),
-    rpc: optional(String2(), "[generate feature] Explicit durable RPC capability; must be registered by the host"),
-    dir: optional(String2(), "[generate] Feature root directory (default: src/features)"),
-    force: optional(Boolean2(), "[generate] Overwrite a single regular file; resource/feature/controller never overwrite"),
-    dry_run: optional(Boolean2(), "[generate] Validate and preview the complete change set without writing"),
-    "dry-run": optional(Boolean2(), "[generate] CLI alias of dry_run"),
-    register_in: optional(String2(), "[generate] Existing parent module file for module/resource/feature; uses the compiler AST editor"),
-    "register-in": optional(String2(), "[generate] CLI alias of register_in"),
-    root: optional(String2(), "[dev/plan/build/release/compile/check] Project directory containing supacloud.config.ts (default: current directory)"),
-    include: optional(String2(), "[dev/compile/check] Comma-separated glob patterns for source files"),
-    out_dir: optional(String2(), "[dev/compile/plan/build/export-tools] Output directory (default: configured outDir)"),
-    strict: optional(Boolean2(), "[dev/compile/check] Promote warnings to errors"),
-    format: optional(stringEnum(["text", "json"]), "[dev/generate/compile/check/plan/release/deploy-plan/diff/history/promote-plan/graph/export-tools] Output format (default: text)"),
-    json: optional(Boolean2(), "[history/transfer-plan/transfer/promote-plan] Preserve or return the full machine-readable receipt"),
-    profile: optional(stringEnum(["fast", "integration"]), "[dev] Run dev or dev:integration; integration verifies an explicit loopback database"),
-    once: optional(Boolean2(), "[dev] Validate and report once without watching"),
-    watch: optional(Boolean2(), "[dev] Watch for changes (default: true; --once disables)"),
-    database_url: optional(String2(), "[dev] Explicit loopback integration URL; watch/once only inspect its shape"),
-    "database-url": optional(String2(), "[dev] CLI alias of database_url"),
-    target: optional(String2(), "[explain/context/verify-plan] Provider class name / token name / command name / job name / module name"),
-    fix: optional(String2(), "[fix] Path to a DiagnosticFix JSON file produced by `doctor --format json`"),
-    write: optional(Boolean2(), "[fix] Write the fix to disk (default: preview only)"),
-    skip_build: optional(Boolean2(), "[release] Reuse --manifest_path instead of running the local delivery build")
-  }, (request) => runAppTool(request, options));
+function buildOfficialSupabaseArgs2(request) {
+  if (request.action === "version")
+    return ["--version"];
+  const workdir = request.workdir ? resolve18(request.workdir) : undefined;
+  if (!workdir)
+    throw new Error("A workdir is required");
+  return [...actionArguments2(request, workdir), ...workdirArguments2(workdir)];
 }
-var APP_ALIAS_ACTIONS = ["generate", "compile", "check", "graph", "explain", "context", "doctor", "fix"];
-function registerAppAliases(server) {
-  const schema = {
-    kind: optional(stringEnum(["module", "command", "query", "controller", "job", "contract", "resource", "feature"]), "[generate] Scaffold kind"),
-    name: optional(String2(), "[generate] Object name"),
-    module: optional(String2(), "[generate] Target feature module"),
-    permission: optional(String2(), "[generate feature] Explicit approval permission; not inferred from name"),
-    rpc: optional(String2(), "[generate feature] Explicit durable RPC capability; must be registered by the host"),
-    dir: optional(String2(), "[generate] Feature root directory (default: src/features)"),
-    force: optional(Boolean2(), "[generate] Overwrite a single regular file; resource/feature/controller never overwrite"),
-    dry_run: optional(Boolean2(), "[generate] Validate and preview the complete change set without writing"),
-    "dry-run": optional(Boolean2(), "[generate] CLI alias of dry_run"),
-    register_in: optional(String2(), "[generate] Existing parent module file for module/resource/feature; uses the compiler AST editor"),
-    "register-in": optional(String2(), "[generate] CLI alias of register_in"),
-    root: optional(String2(), "Project directory containing supacloud.config.ts (default: current directory)"),
-    include: optional(String2(), "[compile/check] Comma-separated glob patterns for source files"),
-    out_dir: optional(String2(), "[compile/export-tools] Output directory (default: <root>/generated)"),
-    strict: optional(Boolean2(), "[compile/check] Promote warnings to errors"),
-    format: optional(stringEnum(["text", "json"]), "Output format (default: text)"),
-    target: optional(String2(), "[explain/context] Provider class name / token name / command name / job name / module name"),
-    fix: optional(String2(), "[fix] Path to a DiagnosticFix JSON file produced by `doctor --format json`"),
-    write: optional(Boolean2(), "[fix] Write the fix to disk (default: preview only)")
-  };
-  for (const action of APP_ALIAS_ACTIONS) {
-    registerTool(server, action, `Top-level alias of \`app ${action}\`.`, schema, (request) => runAppTool({ ...request, action }));
+function createOfficialSupabaseEnvironment2(environment) {
+  const safeEnvironment = {};
+  for (const [key, environmentValue] of Object.entries(environment)) {
+    if (environmentValue === undefined)
+      continue;
+    if (key === "SUPABASE_YES" || key === "SUPABASE_EXPERIMENTAL")
+      continue;
+    if (key === "SUPABASE_ACCESS_TOKEN" && environment.SUPACLOUD_FORWARD_SUPABASE_ACCESS_TOKEN === "1") {
+      safeEnvironment[key] = environmentValue;
+      continue;
+    }
+    if (isSensitiveEnvironmentKey2(key))
+      continue;
+    safeEnvironment[key] = environmentValue;
   }
+  safeEnvironment.SUPABASE_TELEMETRY_DISABLED = "true";
+  safeEnvironment.NO_COLOR = "1";
+  return safeEnvironment;
+}
+function resolveOfficialSupabaseCommand2(workdir, environment = process.env) {
+  const explicitBinary = environment.SUPACLOUD_SUPABASE_CLI_BIN?.trim();
+  if (explicitBinary) {
+    if (explicitBinary.includes("\x00"))
+      throw new Error("Invalid SUPACLOUD_SUPABASE_CLI_BIN");
+    return [explicitBinary];
+  }
+  const version = environment.SUPABASE_CLI_VERSION?.trim();
+  if (version) {
+    if (!VALID_VERSION2.test(version))
+      throw new Error("Invalid SUPABASE_CLI_VERSION; use an exact version such as 2.120.0");
+    if (process.versions.bun)
+      return [process.execPath, "x", `supabase@${version}`];
+    if (process.platform === "win32") {
+      throw new Error("SUPABASE_CLI_VERSION bootstrap is unavailable under Node on Windows; install the official CLI or set SUPACLOUD_SUPABASE_CLI_BIN");
+    }
+    return ["npx", "--yes", `supabase@${version}`];
+  }
+  const localPackageEntry = join14(resolve18(workdir), "node_modules", "supabase", "dist", "supabase.js");
+  if (existsSync12(localPackageEntry))
+    return [process.execPath, localPackageEntry];
+  return ["supabase"];
 }
-
-// src/shared/tools/db-governance-tools.ts
-import { existsSync as existsSync12 } from "node:fs";
-import { join as join15, resolve as resolve19 } from "node:path";
-import {
-  buildDatabaseManifest,
-  explainObject,
-  lintModule,
-  readCatalog,
-  reconcileModule
-} from "@supacloud/db";
 
 // src/shared/tools/db-workflow.ts
-import { createHash as createHash7 } from "node:crypto";
-import { lstat as lstat4, mkdir as mkdir6, mkdtemp, readFile as readFile5, readdir as readdir6, rename as rename3, rm as rm2, writeFile as writeFile5 } from "node:fs/promises";
-import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname9, isAbsolute as isAbsolute6, join as join14, relative as relative8, resolve as resolve18 } from "node:path";
-import {
-  assertApplicationRoleRestricted,
-  readDatabaseRole,
-  renderDatabaseRoleGuardSql,
-  renderReverseSnapshot,
-  reverseDatabase
-} from "@supacloud/db";
-import { parseDatabaseSourcesConfig } from "@supacloud/db/source-contracts";
 var hash4 = (content) => createHash7("sha256").update(content).digest("hex");
 var result = (value, isError = false) => ({
   isError,
@@ -26732,12 +27158,12 @@ var result = (value, isError = false) => ({
 });
 var schemas = (value) => value?.split(",").map((entry) => entry.trim()).filter(Boolean) ?? ["public"];
 async function projectPath2(root, path) {
-  if (!path || isAbsolute6(path) || path.includes("\\") || path.split("/").some((part) => !part || part === "." || part === "..")) {
+  if (!path || isAbsolute7(path) || path.includes("\\") || path.split("/").some((part) => !part || part === "." || part === "..")) {
     throw new Error("Use a normalized project-relative path");
   }
   let current = root;
   for (const part of path.split("/")) {
-    current = join14(current, part);
+    current = join15(current, part);
     try {
       if ((await lstat4(current)).isSymbolicLink())
         throw new Error("Symlink workflow paths are forbidden");
@@ -26759,7 +27185,7 @@ async function exists2(path) {
   }
 }
 async function boundary(root) {
-  const config = join14(root, "database.sources.json");
+  const config = join15(root, "database.sources.json");
   return await exists2(config) ? parseDatabaseSourcesConfig(JSON.parse(await readFile5(await projectPath2(root, "database.sources.json"), "utf8"))) : undefined;
 }
 var overlaps = (a, b) => a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
@@ -26828,10 +27254,10 @@ async function withDatabase(args, options, work) {
 }
 async function runOfficial(root, workdir, args, environment, options) {
   const command = [
-    ...resolveOfficialSupabaseCommand(root, environment),
-    ...buildOfficialSupabaseArgs({ ...args, workdir })
+    ...resolveOfficialSupabaseCommand2(root, environment),
+    ...buildOfficialSupabaseArgs2({ ...args, workdir })
   ];
-  const safeEnvironment = createOfficialSupabaseEnvironment(environment);
+  const safeEnvironment = createOfficialSupabaseEnvironment2(environment);
   delete safeEnvironment.SUPABASE_ACCESS_TOKEN;
   if (args.db_url)
     safeEnvironment.PGOPTIONS = "-c default_transaction_read_only=on";
@@ -26853,9 +27279,9 @@ async function runOfficial(root, workdir, args, environment, options) {
 async function initializeCandidate(stage, majorVersion = 17) {
   if (![15, 16, 17, 18].includes(majorVersion))
     throw new Error("Select a supported PostgreSQL major version (15-18)");
-  await mkdir6(join14(stage, "supabase/migrations"), { recursive: true });
-  await mkdir6(join14(stage, "supabase/schemas"), { recursive: true });
-  await writeFile5(join14(stage, "supabase/config.toml"), [
+  await mkdir6(join15(stage, "supabase/migrations"), { recursive: true });
+  await mkdir6(join15(stage, "supabase/schemas"), { recursive: true });
+  await writeFile5(join15(stage, "supabase/config.toml"), [
     `project_id = "supacloud-candidate-${hash4(stage).slice(0, 12)}"`,
     "[db]",
     `major_version = ${majorVersion}`,
@@ -26873,9 +27299,9 @@ async function copySqlSources(root, source, destination) {
     const file = await projectPath2(root, `${source}/${name}`);
     const state = await lstat4(file);
     if (state.isDirectory())
-      count += await copySqlSources(root, `${source}/${name}`, join14(destination, name));
+      count += await copySqlSources(root, `${source}/${name}`, join15(destination, name));
     else if (state.isFile() && name.endsWith(".sql")) {
-      await writeFile5(join14(destination, name), await readFile5(file));
+      await writeFile5(join15(destination, name), await readFile5(file));
       count++;
     }
   }
@@ -26889,8 +27315,8 @@ async function reverse(args, root, options) {
   if (!selectedSchemas.length || selectedSchemas.some((schema) => !/^[a-z_][a-z0-9_$]*$/i.test(schema))) {
     throw new Error("Select valid PostgreSQL schemas");
   }
-  await mkdir6(dirname9(out), { recursive: true });
-  const stage = await mkdtemp(join14(dirname9(out), ".reverse-"));
+  await mkdir6(dirname10(out), { recursive: true });
+  const stage = await mkdtemp(join15(dirname10(out), ".reverse-"));
   try {
     const snapshot = await withDatabase(args, options, async (executor, url) => {
       const snapshot = await reverseDatabase(executor, selectedSchemas);
@@ -26906,10 +27332,10 @@ async function reverse(args, root, options) {
       }, options.environment ?? process.env, options);
       return snapshot;
     });
-    const generated = await readdir6(join14(stage, "supabase/schemas"), { recursive: true });
+    const generated = await readdir6(join15(stage, "supabase/schemas"), { recursive: true });
     if (!generated.some((file) => file.endsWith(".sql")))
       throw new Error("Official reverse did not produce declarative SQL");
-    await writeFile5(join14(stage, "catalog.json"), renderReverseSnapshot(snapshot));
+    await writeFile5(join15(stage, "catalog.json"), renderReverseSnapshot(snapshot));
     await rename3(stage, out);
     return result({
       ok: true,
@@ -26934,14 +27360,14 @@ async function diff2(args, root, options) {
   const input = await migrations(root, args.dir ?? (await boundary(root))?.migrations ?? "supabase/migrations");
   if (overlaps(input.dir, out))
     throw new Error("Candidate output overlaps reviewed migration history");
-  await mkdir6(dirname9(out), { recursive: true });
-  const stage = await mkdtemp(join14(dirname9(out), ".diff-"));
+  await mkdir6(dirname10(out), { recursive: true });
+  const stage = await mkdtemp(join15(dirname10(out), ".diff-"));
   try {
     await initializeCandidate(stage, args.db_major_version);
-    if (!await copySqlSources(root, sourcePath, join14(stage, "supabase/schemas")))
+    if (!await copySqlSources(root, sourcePath, join15(stage, "supabase/schemas")))
       throw new Error("No declarative SQL sources");
     for (const { file, text } of input.files)
-      await writeFile5(join14(stage, "supabase/migrations", file), text);
+      await writeFile5(join15(stage, "supabase/migrations", file), text);
     await runOfficial(root, stage, {
       action: "db_schema_declarative_sync",
       apply: false,
@@ -26951,15 +27377,15 @@ async function diff2(args, root, options) {
     }, options.environment ?? process.env, options);
     const history = new Map(input.files.map((file) => [file.file, file.text]));
     for (const [file, text] of history) {
-      if (await readFile5(join14(stage, "supabase/migrations", file), "utf8") !== text) {
+      if (await readFile5(join15(stage, "supabase/migrations", file), "utf8") !== text) {
         throw new Error("Official diff changed reviewed migration history");
       }
     }
-    const names = (await readdir6(join14(stage, "supabase/migrations"))).filter((file) => file.endsWith(".sql") && !history.has(file));
-    const candidates = join14(stage, "candidates");
+    const names = (await readdir6(join15(stage, "supabase/migrations"))).filter((file) => file.endsWith(".sql") && !history.has(file));
+    const candidates = join15(stage, "candidates");
     await mkdir6(candidates);
     for (const file of names)
-      await writeFile5(join14(candidates, file), await readFile5(join14(stage, "supabase/migrations", file)));
+      await writeFile5(join15(candidates, file), await readFile5(join15(stage, "supabase/migrations", file)));
     await rename3(candidates, out);
   } finally {
     await rm2(stage, { force: true, recursive: true });
@@ -26997,10 +27423,10 @@ async function migrationAction(args, root, options) {
     throw new Error("Select a Management API and project ref");
   const path = args.dir ?? (await boundary(root))?.migrations ?? "supabase/migrations";
   const input = await migrations(root, path);
-  const stage = await mkdtemp(join14(tmpdir2(), "supacloud-reviewed-migrations-"));
+  const stage = await mkdtemp(join15(tmpdir2(), "supacloud-reviewed-migrations-"));
   try {
     for (const { file, text } of input.files)
-      await writeFile5(join14(stage, file), text);
+      await writeFile5(join15(stage, file), text);
     const preview = await run({ action: "push_migrations", ref, dir: stage, dry_run: true, strict: true });
     const dryRun = {
       isError: preview.isError === true,
@@ -27027,7 +27453,7 @@ async function migrationAction(args, root, options) {
   }
 }
 async function runDbWorkflow(args, projectRoot, options = {}) {
-  const root = resolve18(projectRoot);
+  const root = resolve19(projectRoot);
   if ((await lstat4(root)).isSymbolicLink())
     throw new Error("Workflow root must not be a symlink");
   switch (args.action) {
@@ -27088,8 +27514,8 @@ function normalizeModule(candidate, sourcePath) {
   };
 }
 async function loadDatabaseModules(root, moduleFile) {
-  const filePath = moduleFile ? resolve19(root, moduleFile) : join15(root, "db", "modules.ts");
-  if (!existsSync12(filePath)) {
+  const filePath = moduleFile ? resolve20(root, moduleFile) : join16(root, "db", "modules.ts");
+  if (!existsSync13(filePath)) {
     throw new Error(moduleFile ? `Module file not found: ${filePath}` : `Module file not found: ${filePath}（用 --module_file 指定一个导出 defineDatabaseModule(...) 的文件）`);
   }
   let imported;
@@ -27178,7 +27604,7 @@ function buildDatabaseAiContext(modules, root, moduleName, target) {
   const objects = target ? allObjects.filter((object) => objectMatchesTarget(object, target)) : allObjects;
   if (target && objects.length === 0)
     throw new Error(`未找到数据库对象: ${target}`);
-  const sqlFirst = existsSync12(join15(root, "supabase/schemas"));
+  const sqlFirst = existsSync13(join16(root, "supabase/schemas"));
   return {
     version: 1,
     scope: "database-ai-context",
@@ -27224,7 +27650,7 @@ async function runLint(args, root) {
   const issues = [];
   for (const module of selected) {
     const readSqlFile = async (path) => {
-      const absolute = resolve19(root, path);
+      const absolute = resolve20(root, path);
       try {
         return await Bun.file(absolute).text();
       } catch (error) {
@@ -27264,14 +27690,14 @@ var defaultLiteSpawn = async (command, cwd) => {
   return { exitCode, stdout, stderr };
 };
 async function runModuleCheckLite(args, root, spawn, liteBinary) {
-  const projectDir = resolve19(args.project_dir?.trim() || root);
+  const projectDir = resolve20(args.project_dir?.trim() || root);
   const binary = liteBinary === undefined ? Bun.which("supacloud-lite") : liteBinary;
   if (!binary) {
     throw new Error("db module_check --lite 需要本机可用的 supacloud-lite（npm i -g @supacloud/lite，或加入 PATH）");
   }
   const command = [binary, "db", "check", "--project-dir", projectDir];
   if (args.module_file?.trim())
-    command.push("--module-file", resolve19(root, args.module_file.trim()));
+    command.push("--module-file", resolve20(root, args.module_file.trim()));
   const result = await spawn(command, projectDir);
   const output = [result.stdout.trim(), result.stderr.trim()].filter(Boolean).join(`
 `);
@@ -27312,7 +27738,7 @@ function registerDbGovernanceTools(server, options = {}) {
   const fallbackRoot = options.currentWorkingDirectory || process.cwd();
   const liteSpawn = options.liteSpawn || defaultLiteSpawn;
   registerTool(server, "db", "Database governance (@supacloud/db): inspect, reverse-adopt, diff, plan and apply through explicit source and migration boundaries. Actions: context, lint, explain, module_check, reverse, diff, plan, apply, role_check, role_sql", {
-    action: withDescription(stringEnum(["context", "lint", "explain", "module_check", "reverse", "diff", "plan", "apply", "role_check", "role_sql"]), "Database governance action"),
+    action: withDescription(stringEnum2(["context", "lint", "explain", "module_check", "reverse", "diff", "plan", "apply", "role_check", "role_sql"]), "Database governance action"),
     module: optional(String2(), "[context/lint] Only select this manifest module (default: all)"),
     root: optional(String2(), "[*] Project root (default: current directory)"),
     module_file: optional(String2(), "[*] File exporting defineDatabaseModule(...) (default: <root>/db/modules.ts)"),
@@ -27331,7 +27757,7 @@ function registerDbGovernanceTools(server, options = {}) {
     migration_role: optional(String2(), "[role_sql] Privileged migration role"),
     database: optional(String2(), "[role_sql] PostgreSQL database name")
   }, async (request) => {
-    const root = resolve19(request.root || fallbackRoot);
+    const root = resolve20(request.root || fallbackRoot);
     switch (request.action) {
       case "context":
         return runContext2(request, root);
@@ -27361,11 +27787,11 @@ function registerDbGovernanceTools(server, options = {}) {
 
 // src/shared/tools/scheduled-function-tools.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { readFileSync as readFileSync9, statSync as statSync8 } from "node:fs";
-import { resolve as resolve20 } from "node:path";
+import { readFileSync as readFileSync9, statSync as statSync9 } from "node:fs";
+import { resolve as resolve21 } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 var HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/;
-var ENVIRONMENT_NAME_PATTERN2 = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
+var ENVIRONMENT_NAME_PATTERN3 = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
 var FORBIDDEN_HEADER_NAMES = new Set([
   "apikey",
   "authorization",
@@ -27446,8 +27872,8 @@ function validScheduledFunctionCron(expression) {
 function readScheduleBodyFile(bodyPathInput) {
   if (!bodyPathInput.trim())
     throw new Error("'body_file' must be a path");
-  const bodyPath = resolve20(bodyPathInput);
-  const bodyStat = statSync8(bodyPath);
+  const bodyPath = resolve21(bodyPathInput);
+  const bodyStat = statSync9(bodyPath);
   if (!bodyStat.isFile() || bodyStat.size > MAX_BODY_FILE_BYTES) {
     throw new Error("Scheduled Function body file must be a regular file no larger than 1 MiB");
   }
@@ -27473,7 +27899,7 @@ function scheduleBody(bodyFile) {
 }
 function resolvedHeaderEntry(headerName, environmentName, environment) {
   const normalizedName = headerName.toLowerCase();
-  if (!HEADER_NAME_PATTERN.test(headerName) || forbiddenHeaderName(normalizedName) || typeof environmentName !== "string" || !ENVIRONMENT_NAME_PATTERN2.test(environmentName)) {
+  if (!HEADER_NAME_PATTERN.test(headerName) || forbiddenHeaderName(normalizedName) || typeof environmentName !== "string" || !ENVIRONMENT_NAME_PATTERN3.test(environmentName)) {
     throw new Error("SCHEDULE_HEADER_MAPPING_INVALID");
   }
   const headerValue = environment[environmentName];
@@ -27778,14 +28204,14 @@ function registerScheduledFunctionTools(server, http, environment = process.env,
 }
 var SCHEDULE_TOOL_DESCRIPTION = "Scheduled Edge Function lifecycle. Actions: list, get, create, update, delete";
 var SCHEDULE_TOOL_SCHEMA = {
-  action: withDescription(stringEnum(["list", "get", "create", "update", "delete"]), "Action"),
+  action: withDescription(stringEnum2(["list", "get", "create", "update", "delete"]), "Action"),
   ref: withDescription(String2(), "Project ref"),
   schedule_id: optional(String2(), "[get/update/delete] Schedule ID"),
   expected_updated_at: optional(String2(), "[update/delete] Canonical updated_at from list"),
   name: optional(String2(), "[create/update] Display name"),
   slug: optional(String2(), "[create] Edge Function slug"),
   cron: optional(String2(), "[create/update] Five-field cron expression"),
-  method: optional(stringEnum(["GET", "POST"]), "[create/update] HTTP method"),
+  method: optional(stringEnum2(["GET", "POST"]), "[create/update] HTTP method"),
   enabled: optional(Boolean2(), "[update] Enabled state"),
   body_file: optional(String2(), "[create/update] Local JSON object file; content is never printed"),
   header_env: withDescription(headerEnvironmentSchema, "[create/update] JSON map of HTTP header names to environment variable names")
@@ -27823,15 +28249,15 @@ function registerMutationTools(server, http) {
   registerTool(server, "mutations", "Durable mutation status readback", MUTATION_TOOL_SCHEMA, (args) => mutationStatus(http, args));
 }
 var MUTATION_TOOL_SCHEMA = {
-  action: withDescription(stringEnum(["status"]), "Action"),
+  action: withDescription(stringEnum2(["status"]), "Action"),
   ref: withDescription(String2(), "[status] Project ref"),
   mutation_id: withDescription(String2(), "[status] Client mutation UUID")
 };
 
 // src/shared/tools/release-tools.ts
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync4, readdirSync as readdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname10, join as join16, relative as relative9, resolve as resolve21 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync5, readdirSync as readdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname11, join as join17, relative as relative9, resolve as resolve22 } from "node:path";
 var SAFE_PROJECT_REF = /^[A-Za-z0-9_-]{1,64}$/;
 var SAFE_ENVIRONMENT_ID = /^[A-Za-z0-9_-]{1,64}$/;
 var BACKUP_ID = /^logical-full_[A-Za-z0-9_-]{1,64}_[a-f0-9]{32}$/;
@@ -28153,15 +28579,15 @@ function collectScopeFiles(cwd, file, files, dir, task) {
   const results = [];
   const resolvePathWithFallbacks = (filePath) => {
     const trimmed = filePath.trim();
-    const resolved = resolve21(cwd, trimmed);
-    if (existsSync13(resolved))
+    const resolved = resolve22(cwd, trimmed);
+    if (existsSync14(resolved))
       return resolved;
     const candidates = [
-      resolve21(cwd, "supacloud/fa/release-scopes", trimmed),
-      resolve21(cwd, "release-scopes", trimmed),
-      resolve21(cwd, "scopes", trimmed)
+      resolve22(cwd, "supacloud/fa/release-scopes", trimmed),
+      resolve22(cwd, "release-scopes", trimmed),
+      resolve22(cwd, "scopes", trimmed)
     ];
-    const found = candidates.find(existsSync13);
+    const found = candidates.find(existsSync14);
     if (found)
       return found;
     throw new Error(`Scope file not found: ${filePath}`);
@@ -28182,18 +28608,18 @@ function collectScopeFiles(cwd, file, files, dir, task) {
   if (!taskFilter && (!dir || typeof dir !== "string" || !dir.trim())) {
     throw new Error("At least one of --file, --files, or --task is required for scope_rebind");
   }
-  const candidates = typeof dir === "string" && dir.trim() ? [resolve21(cwd, dir.trim())] : [
-    resolve21(cwd, "supacloud/fa/release-scopes"),
-    resolve21(cwd, "release-scopes"),
-    resolve21(cwd, "scopes")
+  const candidates = typeof dir === "string" && dir.trim() ? [resolve22(cwd, dir.trim())] : [
+    resolve22(cwd, "supacloud/fa/release-scopes"),
+    resolve22(cwd, "release-scopes"),
+    resolve22(cwd, "scopes")
   ];
   for (const directory of candidates) {
-    if (existsSync13(directory)) {
+    if (existsSync14(directory)) {
       try {
         const entries = readdirSync5(directory, { withFileTypes: true });
         for (const entry of entries) {
           if (entry.isFile() && entry.name.endsWith(".json")) {
-            const fullPath = join16(directory, entry.name);
+            const fullPath = join17(directory, entry.name);
             if (!taskFilter) {
               results.push(fullPath);
             } else if (entry.name.toLowerCase().includes(taskFilter)) {
@@ -28219,7 +28645,7 @@ function collectScopeFiles(cwd, file, files, dir, task) {
   return [...new Set(results)];
 }
 function handleScopeRebind(args) {
-  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve21(args.cwd.trim()) : process.cwd();
+  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve22(args.cwd.trim()) : process.cwd();
   const targetBaseCommit = resolveGitBaseCommit(cwd, args.base_commit);
   const requestedEnvironmentId = requestedScopeEnvironment(args, "scope_rebind");
   const scopeFiles = collectScopeFiles(cwd, args.file, args.files, args.dir, args.task);
@@ -28255,7 +28681,7 @@ function handleScopeRebind(args) {
     if (updated && !dryRun) {
       const formatted = JSON.stringify(canonicalValue(parsed), null, 2) + `
 `;
-      writeFileSync3(filePath, formatted, "utf8");
+      writeFileSync4(filePath, formatted, "utf8");
     }
     scopes.push({
       file: relative9(cwd, filePath),
@@ -28277,20 +28703,20 @@ function handleScopeRebind(args) {
   });
 }
 function handleScopeInspect(args) {
-  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve21(args.cwd.trim()) : process.cwd();
+  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve22(args.cwd.trim()) : process.cwd();
   const requestedEnvironmentId = requestedScopeEnvironment(args, "scope_inspect");
   if (typeof args.file !== "string" || !args.file.trim()) {
     throw new Error("'file' is required for scope_inspect");
   }
   const trimmed = args.file.trim();
-  let filePath = resolve21(cwd, trimmed);
-  if (!existsSync13(filePath)) {
+  let filePath = resolve22(cwd, trimmed);
+  if (!existsSync14(filePath)) {
     const candidates = [
-      resolve21(cwd, "supacloud/fa/release-scopes", trimmed),
-      resolve21(cwd, "release-scopes", trimmed),
-      resolve21(cwd, "scopes", trimmed)
+      resolve22(cwd, "supacloud/fa/release-scopes", trimmed),
+      resolve22(cwd, "release-scopes", trimmed),
+      resolve22(cwd, "scopes", trimmed)
     ];
-    const found = candidates.find(existsSync13);
+    const found = candidates.find(existsSync14);
     if (found)
       filePath = found;
     else
@@ -28353,7 +28779,7 @@ function parseCommaList(value) {
   return [];
 }
 function handleScopeCreate(args, fallbackRef) {
-  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve21(args.cwd.trim()) : process.cwd();
+  const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve22(args.cwd.trim()) : process.cwd();
   if (typeof args.file !== "string" || !args.file.trim()) {
     throw new Error("'file' is required for scope_create");
   }
@@ -28369,8 +28795,8 @@ function handleScopeCreate(args, fallbackRef) {
     throw new Error("'ref' is invalid for release controls");
   }
   const targetBaseCommit = resolveGitBaseCommit(cwd, args.base_commit);
-  const filePath = resolve21(cwd, args.file.trim());
-  mkdirSync4(dirname10(filePath), { recursive: true });
+  const filePath = resolve22(cwd, args.file.trim());
+  mkdirSync5(dirname11(filePath), { recursive: true });
   const scope = {
     baseCommit: targetBaseCommit,
     excludedFunctions: parseCommaList(args.excluded_functions),
@@ -28385,7 +28811,7 @@ function handleScopeCreate(args, fallbackRef) {
   const scopeSha256 = genericScopedReleaseScopeSha256(scope);
   const formatted = JSON.stringify(canonicalValue(scope), null, 2) + `
 `;
-  writeFileSync3(filePath, formatted, "utf8");
+  writeFileSync4(filePath, formatted, "utf8");
   return releaseControlSuccess("release.scope_create", {
     file: relative9(cwd, filePath),
     task_id: scope.taskId,
@@ -28410,7 +28836,7 @@ function registerReleaseTools(server, http, options = {}) {
   ];
   const allActions = [...remoteActions, ...localActions];
   registerTool(server, "release", "Verified release controls. Scope management actions operate locally; management actions use the Management API; release canary stage/disable replay additionally require the selected project's SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY.", {
-    action: withDescription(stringEnum(allActions), "Release control action"),
+    action: withDescription(stringEnum2(allActions), "Release control action"),
     ref: optional(String2(), options.projectRef ? "Optional override when not auto-linked" : "Project ref"),
     file: optional(String2(), "[scope_inspect/scope_rebind/scope_create] Path to release scope JSON file"),
     files: optional(String2(), "[scope_rebind] Comma-separated list of release scope JSON files"),
@@ -28618,7 +29044,7 @@ import { access, lstat as lstat5, mkdtemp as mkdtemp2, opendir, readFile as read
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash9 } from "node:crypto";
 import { tmpdir as tmpdir3 } from "node:os";
-import { basename as basename8, dirname as dirname11, join as join17, relative as relative10, resolve as resolve22, sep as sep5 } from "node:path";
+import { basename as basename8, dirname as dirname12, join as join18, relative as relative10, resolve as resolve23, sep as sep5 } from "node:path";
 
 // src/shared/tools/project-deployment.ts
 async function requireProjectDeploymentProtocol(http, projectRef, environmentId) {
@@ -28631,7 +29057,6 @@ async function requireProjectDeploymentProtocol(http, projectRef, environmentId)
     throw new Error("DEPLOYMENT_PROTOCOL_MISMATCH: Upgrade the SupaCloud server and CLI together (`npm install -g @supacloud/cli@latest`), then retry `supacloud deploy`. No upload or deployment was attempted; legacy endpoints will not be used.");
   }
 }
-var operation2 = "applications.project_deploy";
 var scopeSchema = _Object_({
   project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
   application_id: ApplicationIdSchema,
@@ -28651,83 +29076,16 @@ var statusSchema = _Object_({
   phase: Union([
     Literal("queued"),
     Literal("prepared"),
-    Literal("migrating"),
-    Literal("activating"),
-    Literal("binding-web"),
-    Literal("verifying")
-  ]),
-  operation: Literal("application.release.deploy"),
-  ...scopeSchema.properties,
-  receipt: Optional(Unknown()),
-  failure_code: Optional(String2({ pattern: "^[A-Z][A-Z0-9_]{0,63}$" }))
-}, { additionalProperties: false });
-function responseReceipt(data, expected) {
-  if (!data || typeof data !== "object" || Array.isArray(data) || !("ok" in data) || data.ok !== true) {
-    throw new Error("Invalid project deployment response");
-  }
-  const { ok: _ok, ...receipt } = data;
-  return parseApplicationDeployResult(receipt, expected);
-}
-async function runProjectDeployment(http, args) {
-  const scope = { project_ref: args.ref, application_id: args.id, environment_id: args.environment_id };
-  const request = {
-    mutation_id: args.mutation_id,
-    release_id: args.release_id,
-    ...args.configuration_id === undefined ? {} : { configuration_id: args.configuration_id },
-    ...args.configuration_write === undefined ? {} : { configuration_write: args.configuration_write },
-    ...args.expected_plan_sha256 === undefined ? {} : { expected_plan_sha256: args.expected_plan_sha256 },
-    ...args.approved_migration_digest === undefined ? {} : { approved_migration_digest: args.approved_migration_digest },
-    ...args.web_release === undefined ? {} : { web_release: args.web_release }
-  };
-  if (!Check2(scopeSchema, scope) || !Check2(ApplicationDeployRequestSchema, request) || request.configuration_id !== undefined && request.configuration_write !== undefined && request.configuration_id !== request.configuration_write.configuration_id) {
-    return releaseControlFailure(operation2, "INVALID_RESPONSE", null);
-  }
-  const expected = { ...scope, request };
-  const identity = {
-    ...scope,
-    deployment_id: request.mutation_id,
-    mutation_id: request.mutation_id,
-    release_id: request.release_id
-  };
-  const endpoint = `/v1/projects/${encodeURIComponent(scope.project_ref)}/environments/${encodeURIComponent(scope.environment_id)}/deployments`;
-  const { mutation_id, ...candidate } = request;
-  const result = await http.post(endpoint, {
-    ...candidate,
-    deployment_id: mutation_id,
-    application_id: scope.application_id
-  }, { timeoutMs: 120000, maxJsonBytes: 131072, responseTimeoutMs: 30000 });
-  if (result.ok && result.status === 200) {
-    try {
-      return releaseControlSuccess(operation2, {
-        ...responseReceipt(result.data, expected),
-        deployment_id: mutation_id
-      });
-    } catch {}
-  } else if (!result.ok && !result.transportError && !result.responseReadError && result.status < 500 && result.status !== 408) {
-    return releaseControlMutationFailure(operation2, result, identity);
-  }
-  const observed = await http.get(`${endpoint}/${encodeURIComponent(mutation_id)}`, {
-    retry: false,
-    totalTimeoutMs: 30000,
-    maxJsonBytes: 131072
-  });
-  try {
-    if (!observed.ok || observed.status !== 200 || !Check2(statusSchema, observed.data))
-      throw new Error;
-    const state = observed.data;
-    if (state.deployment_id !== mutation_id || state.project_ref !== scope.project_ref || state.application_id !== scope.application_id || state.environment_id !== scope.environment_id || state.status !== "succeeded" || state.phase !== "verifying")
-      throw new Error;
-    const receipt = parseApplicationDeployResult(state.receipt, expected);
-    return releaseControlSuccess(operation2, {
-      ...receipt,
-      deployment_id: mutation_id,
-      replayed: true,
-      execution_performed: false
-    });
-  } catch {
-    return releaseControlFailure(operation2, "OUTCOME_UNKNOWN", result.transportError ? null : result.status, identity);
-  }
-}
+    Literal("migrating"),
+    Literal("activating"),
+    Literal("binding-web"),
+    Literal("verifying")
+  ]),
+  operation: Literal("application.release.deploy"),
+  ...scopeSchema.properties,
+  receipt: Optional(Unknown()),
+  failure_code: Optional(String2({ pattern: "^[A-Z][A-Z0-9_]{0,63}$" }))
+}, { additionalProperties: false });
 
 // src/shared/tools/deploy-tools.ts
 var MAX_SOURCE_BYTES = 256 * 1024 * 1024;
@@ -28778,15 +29136,15 @@ async function readJson(path) {
   }
 }
 async function findDeployConfigRoot(startDirectory, environmentName) {
-  let directory = resolve22(startDirectory);
+  let directory = resolve23(startDirectory);
   while (true) {
     const environmentFile = environmentName ? `.env.supacloud.${environmentName}` : null;
-    if (await pathExists(join17(directory, "supacloud.json")) || await pathExists(join17(directory, "supacloud.config.ts")) || environmentFile !== null && await pathExists(join17(directory, environmentFile))) {
+    if (await pathExists(join18(directory, "supacloud.json")) || await pathExists(join18(directory, "supacloud.config.ts")) || environmentFile !== null && await pathExists(join18(directory, environmentFile))) {
       return directory;
     }
-    const parent = dirname11(directory);
+    const parent = dirname12(directory);
     if (parent === directory)
-      return resolve22(startDirectory);
+      return resolve23(startDirectory);
     directory = parent;
   }
 }
@@ -28851,7 +29209,7 @@ function deployTargetConfig(candidate, name) {
   };
 }
 async function readDeployConfig(configRoot) {
-  const configPath = join17(configRoot, "supacloud.json");
+  const configPath = join18(configRoot, "supacloud.json");
   const candidate = await readJson(configPath);
   if (candidate === null)
     return {};
@@ -28898,16 +29256,16 @@ async function readDeployConfig(configRoot) {
   };
 }
 async function packageName(projectDirectory) {
-  const candidate = record4(await readJson(join17(projectDirectory, "package.json")));
+  const candidate = record4(await readJson(join18(projectDirectory, "package.json")));
   return typeof candidate?.name === "string" && candidate.name.trim() ? candidate.name.trim() : null;
 }
 async function pathExists(path) {
   return access(path).then(() => true, () => false);
 }
 async function hasProjectReleaseManifest(root) {
-  if (await pathExists(join17(root, "deploy-manifest.json")))
+  if (await pathExists(join18(root, "deploy-manifest.json")))
     return true;
-  const directory = await opendir(join17(root, "supacloud")).catch((error) => {
+  const directory = await opendir(join18(root, "supacloud")).catch((error) => {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
       return null;
     throw error;
@@ -28918,28 +29276,28 @@ async function hasProjectReleaseManifest(root) {
   for await (const entry of directory) {
     if (++entries > 128)
       throw new Error("Too many SupaCloud project roots to resolve a deployment");
-    if ((entry.isDirectory() || entry.isSymbolicLink()) && await pathExists(join17(root, "supacloud", entry.name, "deploy-manifest.json")))
+    if ((entry.isDirectory() || entry.isSymbolicLink()) && await pathExists(join18(root, "supacloud", entry.name, "deploy-manifest.json")))
       return true;
   }
   return false;
 }
 async function defaultBuildCommand(projectDirectory, configRoot) {
-  const packageJson = record4(await readJson(join17(projectDirectory, "package.json")));
+  const packageJson = record4(await readJson(join18(projectDirectory, "package.json")));
   const scripts = record4(packageJson?.scripts);
   if (typeof scripts?.build !== "string" || !scripts.build.trim()) {
     throw new Error("No build command was configured and package.json has no build script");
   }
   let directory = projectDirectory;
   while (true) {
-    if (await pathExists(join17(directory, "bun.lock")) || await pathExists(join17(directory, "bun.lockb")))
+    if (await pathExists(join18(directory, "bun.lock")) || await pathExists(join18(directory, "bun.lockb")))
       return "bun run build";
-    if (await pathExists(join17(directory, "pnpm-lock.yaml")))
+    if (await pathExists(join18(directory, "pnpm-lock.yaml")))
       return "pnpm run build";
-    if (await pathExists(join17(directory, "yarn.lock")))
+    if (await pathExists(join18(directory, "yarn.lock")))
       return "yarn build";
     if (directory === configRoot)
       break;
-    const parent = dirname11(directory);
+    const parent = dirname12(directory);
     if (parent === directory || !directory.startsWith(`${configRoot}${sep5}`))
       break;
     directory = parent;
@@ -29007,9 +29365,9 @@ function selectFrontendTarget(configRoot, config) {
   throw new Error(`Multiple frontend deploy targets found (${targets.map(([name]) => name).sort().join(", ")}). Set defaultTarget to the Web target`);
 }
 function targetRoot(configRoot, target, name) {
-  const root = resolve22(configRoot, target.root || (name === "frontend" ? "." : name));
-  const prefix = `${resolve22(configRoot)}${sep5}`;
-  if (root !== resolve22(configRoot) && !root.startsWith(prefix)) {
+  const root = resolve23(configRoot, target.root || (name === "frontend" ? "." : name));
+  const prefix = `${resolve23(configRoot)}${sep5}`;
+  if (root !== resolve23(configRoot) && !root.startsWith(prefix)) {
     throw new Error(`Deploy target '${name}' root must stay inside the repository root`);
   }
   return root;
@@ -29027,8 +29385,8 @@ function defaultOutputDirectory(framework) {
   }
 }
 function resolveInsideProject(projectDirectory, candidate, allowRoot = false) {
-  const resolved = resolve22(projectDirectory, candidate);
-  const projectRoot = resolve22(projectDirectory);
+  const resolved = resolve23(projectDirectory, candidate);
+  const projectRoot = resolve23(projectDirectory);
   const projectPrefix = `${projectRoot}${sep5}`;
   if (!allowRoot && resolved === projectRoot || resolved !== projectRoot && !resolved.startsWith(projectPrefix)) {
     throw new Error("Frontend output directory must stay inside the project directory");
@@ -29082,7 +29440,7 @@ async function collectArchiveFiles(root) {
       entries.push(entry);
     entries.sort((left, right) => left.name.localeCompare(right.name, "en"));
     for (const entry of entries) {
-      const path = join17(directory, entry.name);
+      const path = join18(directory, entry.name);
       const stats = await lstat5(path);
       if (stats.isSymbolicLink())
         throw new Error(`Frontend output cannot contain symbolic links: ${path}`);
@@ -29121,8 +29479,8 @@ async function collectArchiveFiles(root) {
 }
 async function createFrontendArchive(outputDirectory) {
   const collected = await collectArchiveFiles(outputDirectory);
-  const temporaryDirectory = await mkdtemp2(join17(tmpdir3(), "supacloud-deploy-"));
-  const archivePath = join17(temporaryDirectory, `${basename8(outputDirectory)}.tar.zst`);
+  const temporaryDirectory = await mkdtemp2(join18(tmpdir3(), "supacloud-deploy-"));
+  const archivePath = join18(temporaryDirectory, `${basename8(outputDirectory)}.tar.zst`);
   try {
     const archiveBytes = await createFrontendTarZstd(collected.files);
     await writeFile6(archivePath, archiveBytes);
@@ -29198,7 +29556,7 @@ async function stageApplicationWebRelease(http, projectRef, environmentId, confi
 }
 function registerDeployTools(server, http, options = {}) {
   registerTool(server, "deploy", "Build and publish the linked project with one command", deployToolSchema, async (args) => {
-    const invocationDirectory = resolve22(String(args.cwd || options.cwd || process.cwd()));
+    const invocationDirectory = resolve23(String(args.cwd || options.cwd || process.cwd()));
     const projectRef = String(args.ref || options.projectRef || "").trim();
     if (!projectRef)
       throw new Error("A linked project ref is required. Set SUPACLOUD_PROJECT_REF or pass --ref");
@@ -29265,17 +29623,17 @@ function registerDeployTools(server, http, options = {}) {
 }
 
 // src/shared/tools/remote-dev-tools.ts
-import { existsSync as existsSync14 } from "node:fs";
+import { existsSync as existsSync15 } from "node:fs";
 import { readFile as readFile7 } from "node:fs/promises";
 import { readdir as readdir7 } from "node:fs/promises";
 import { createHash as createHash10 } from "node:crypto";
-import { join as join18, resolve as resolve23 } from "node:path";
+import { join as join19, resolve as resolve24 } from "node:path";
 import { compileProject as compileProject2 } from "@supacloud/compiler";
 var SAFE_TOKEN = /^[A-Za-z0-9._:@/+,-]+$/;
 var SAFE_REMOTE_ROOT = /^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+\/?$/;
 var remoteDevToolSchema = {
-  action: withDescription(stringEnum(["sync", "watch", "status", "migrate"]), "Remote development action"),
-  target: optional(stringEnum(["db", "functions", "frontend", "project"]), "Sync target (default: project)"),
+  action: withDescription(stringEnum2(["sync", "watch", "status", "migrate"]), "Remote development action"),
+  target: optional(stringEnum2(["db", "functions", "frontend", "project"]), "Sync target (default: project)"),
   project_dir: optional(String2(), "Local project directory (default: current directory)"),
   remote_root: optional(String2(), "Remote development root"),
   remote_host: optional(String2(), "Remote test server host"),
@@ -29304,8 +29662,8 @@ async function runProcess(executable, args, cwd) {
 function resolveDrizzleCommand(root, configured) {
   if (configured?.trim())
     return configured.trim();
-  const local = join18(root, "node_modules", ".bin", "drizzle-kit");
-  return existsSync14(local) ? local : "drizzle-kit";
+  const local = join19(root, "node_modules", ".bin", "drizzle-kit");
+  return existsSync15(local) ? local : "drizzle-kit";
 }
 function toolFailed(value) {
   if (!value || typeof value !== "object")
@@ -29315,14 +29673,14 @@ function toolFailed(value) {
   return result.isError === true || content.some((chunk) => chunk !== null && typeof chunk === "object" && ("text" in chunk) && typeof chunk.text === "string" && chunk.text.trimStart().startsWith("❌"));
 }
 async function migrateDatabase(args, options) {
-  const root = resolve23(String(args.project_dir || options.cwd || process.cwd()));
+  const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
   const projectConfig = await readProjectConfig(root);
   const config = projectConfig.dev || {};
   const database = config.database || {};
   const execute = options.execute || ((command, commandArgs, cwd) => runProcess(command, commandArgs, cwd));
-  const drizzleConfig = resolve23(root, String(args.drizzle_config || database.drizzleConfig || "drizzle.config.ts"));
+  const drizzleConfig = resolve24(root, String(args.drizzle_config || database.drizzleConfig || "drizzle.config.ts"));
   const migrationsDir = String(args.migrations_dir || database.migrationsDir || "supabase/migrations");
-  if (!existsSync14(drizzleConfig))
+  if (!existsSync15(drizzleConfig))
     throw new Error(`Drizzle config not found: ${drizzleConfig}`);
   const generated = await execute(resolveDrizzleCommand(root, typeof args.drizzle_bin === "string" ? args.drizzle_bin : database.drizzleBin), ["generate", "--config", drizzleConfig], root);
   if (generated.exitCode !== 0)
@@ -29340,8 +29698,8 @@ async function migrateDatabase(args, options) {
   return { ok: true, mode: "dev", action: "migrate", generated: true, applied: true, migrations_dir: migrationsDir, result: applied };
 }
 async function readProjectConfig(root) {
-  const file = join18(root, "supacloud.json");
-  if (!existsSync14(file))
+  const file = join19(root, "supacloud.json");
+  if (!existsSync15(file))
     return {};
   try {
     const parsed = JSON.parse(await readFile7(file, "utf8"));
@@ -29359,7 +29717,7 @@ async function sourceFingerprint(root) {
   const visit = async (directory) => {
     const entries = await readdir7(directory, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-      const path = join18(directory, entry.name);
+      const path = join19(directory, entry.name);
       if (entry.isDirectory() && ![".git", "node_modules", "dist", "generated", ".supacloud"].includes(entry.name))
         await visit(path);
       else if (entry.isFile())
@@ -29387,19 +29745,19 @@ function remoteRoot(value) {
 }
 function targetDirectory(root, target, functionSlug, config = {}) {
   if (target === "db")
-    return join18(root, "supabase", "migrations");
+    return join19(root, "supabase", "migrations");
   if (target === "functions") {
     const targets = config["targets"];
     const entries = targets && typeof targets === "object" ? Object.values(targets) : [];
     const match = entries.find((entry) => entry !== null && typeof entry === "object" && ("type" in entry) && entry.type === "edge_function" && (!("root" in entry) || typeof entry.root === "string") && (!("slug" in entry) || typeof entry.slug === "string") && (!functionSlug || ("slug" in entry) && entry.slug === functionSlug));
-    const base = match?.root ? resolve23(root, match.root) : join18(root, "supabase", "functions");
-    return match?.root ? base : functionSlug ? join18(base, safeToken(functionSlug, "function")) : base;
+    const base = match?.root ? resolve24(root, match.root) : join19(root, "supabase", "functions");
+    return match?.root ? base : functionSlug ? join19(base, safeToken(functionSlug, "function")) : base;
   }
   if (target === "frontend") {
     const targets = config["targets"];
     const entries = targets && typeof targets === "object" ? Object.values(targets) : [];
     const match = entries.find((entry) => entry !== null && typeof entry === "object" && ("type" in entry) && entry.type === "frontend" && (!("root" in entry) || typeof entry.root === "string"));
-    return match?.root ? resolve23(root, match.root) : join18(root, "apps", "web");
+    return match?.root ? resolve24(root, match.root) : join19(root, "apps", "web");
   }
   return root;
 }
@@ -29438,10 +29796,10 @@ function reloadCommand(config, target, projectRef, functionSlug) {
   return [...command.split(" "), "--project-ref", safeToken(projectRef || "test", "project_ref"), "--target", targetConfigPath(target), ...functionSlug ? ["--function", safeToken(functionSlug, "function")] : []];
 }
 function sshArgs(connection, remoteCommand) {
-  return ["-p", String(connection.port), "-i", resolve23(connection.key), "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=yes", `${connection.user}@${connection.host}`, ...remoteCommand];
+  return ["-p", String(connection.port), "-i", resolve24(connection.key), "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=yes", `${connection.user}@${connection.host}`, ...remoteCommand];
 }
 function rsyncArgs(connection, source, destination, excludes, deleteRemote) {
-  const args = ["-az", "--checksum", "--partial", "--protect-args", "-e", `ssh -p ${connection.port} -i ${resolve23(connection.key)} -o BatchMode=yes -o StrictHostKeyChecking=yes`];
+  const args = ["-az", "--checksum", "--partial", "--protect-args", "-e", `ssh -p ${connection.port} -i ${resolve24(connection.key)} -o BatchMode=yes -o StrictHostKeyChecking=yes`];
   if (deleteRemote)
     args.push("--delete-delay");
   for (const exclude of excludes) {
@@ -29453,17 +29811,17 @@ function rsyncArgs(connection, source, destination, excludes, deleteRemote) {
   return args;
 }
 async function syncOnce(args, options) {
-  const root = resolve23(String(args.project_dir || options.cwd || process.cwd()));
+  const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
   const projectConfig = await readProjectConfig(root);
   const config = projectConfig.dev || {};
   const target = String(args.target || "project");
   const source = targetDirectory(root, target, typeof args.function === "string" ? args.function : undefined, projectConfig);
-  if (!existsSync14(source))
+  if (!existsSync15(source))
     throw new Error(`Dev source directory not found: ${source}`);
   let compiled = false;
   if (config.compile === true && target !== "db") {
-    const compileRoot = resolve23(root, config.compileRoot || ".");
-    const compileOutDir = resolve23(root, config.compileOutDir || "generated");
+    const compileRoot = resolve24(root, config.compileRoot || ".");
+    const compileOutDir = resolve24(root, config.compileOutDir || "generated");
     const compilation = await compileProject2({
       rootDir: compileRoot,
       outDir: compileOutDir,
@@ -29501,7 +29859,7 @@ function registerRemoteDevTools(server, options = {}) {
     if (["production", "prod"].includes((options.environment || "").toLowerCase()))
       throw new Error("Remote dev mode is forbidden for production environments");
     if (args.action === "status") {
-      const root = resolve23(String(args.project_dir || options.cwd || process.cwd()));
+      const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
       const config = await readDevConfig(root);
       const connection = connectionArgs(options, config, args);
       const execute = options.execute || ((command, commandArgs, cwd) => runProcess(command, commandArgs, cwd));
@@ -29515,7 +29873,7 @@ function registerRemoteDevTools(server, options = {}) {
       return { content: [{ type: "text", text: JSON.stringify(await migrateDatabase(args, options), null, 2) }] };
     }
     if (args.action === "watch") {
-      const root = resolve23(String(args.project_dir || options.cwd || process.cwd()));
+      const root = resolve24(String(args.project_dir || options.cwd || process.cwd()));
       const interval = Math.max(100, Math.min(1e4, Number(args.interval_ms || 300)));
       let fingerprint = "";
       let lastSync = null;
@@ -29535,15 +29893,211 @@ function registerRemoteDevTools(server, options = {}) {
 }
 
 // src/shared/tools/developer-experience-tools.ts
-import { existsSync as existsSync15 } from "node:fs";
+import { existsSync as existsSync17 } from "node:fs";
 import { mkdir as mkdir7, readdir as readdir8, readFile as readFile8, writeFile as writeFile7 } from "node:fs/promises";
-import { dirname as dirname12, join as join19, resolve as resolve24 } from "node:path";
+import { dirname as dirname13, join as join20, resolve as resolve26 } from "node:path";
+
+// src/shared/context.ts
+import { existsSync as existsSync16, readFileSync as readFileSync11 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { resolve as resolve25 } from "node:path";
+var CORE_CONTEXT_KEYS2 = [
+  "SUPABASE_URL",
+  "SUPABASE_SERVICE_ROLE_KEY",
+  "SUPACLOUD_API_URL",
+  "SUPACLOUD_MANAGEMENT_API_URL",
+  "MANAGEMENT_API_URL",
+  "SUPACLOUD_API_TOKEN",
+  "SUPACLOUD_PROJECT_REF",
+  "X_PROJECT_REF",
+  "SUPACLOUD_HOST",
+  "SUPACLOUD_APPLICATION_ID",
+  "SUPACLOUD_APPLICATION_ENVIRONMENT_ID",
+  "SUPACLOUD_APPLICATION_CONFIGURATION_PATH",
+  "SUPACLOUD_APPLICATION_CONFIGURATION_ID",
+  "SUPACLOUD_APPLICATION_MANIFEST_PATH"
+];
+function unquotedEnvValue2(rawValue) {
+  const value = rawValue.trim();
+  const quote = value[0];
+  return quote && (quote === '"' || quote === "'") && value.endsWith(quote) ? value.slice(1, -1) : value;
+}
+function parseEnvFile2(contents) {
+  const values = {};
+  for (const rawLine of contents.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!match)
+      continue;
+    values[match[1]] = unquotedEnvValue2(match[2]);
+  }
+  return values;
+}
+function readEnvFile2(path, required) {
+  if (!existsSync16(path)) {
+    if (required)
+      throw new Error(`SupaCloud environment file not found: ${path}`);
+    return {};
+  }
+  try {
+    return parseEnvFile2(readFileSync11(path, "utf8"));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to read SupaCloud environment file ${path}: ${message}`);
+  }
+}
+function canonicalApiOrigin2(value) {
+  const candidate = value.trim();
+  if (!candidate)
+    return "";
+  try {
+    const url = new URL(candidate);
+    const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+    const allowedProtocol = url.protocol === "https:" || url.protocol === "http:" && loopback;
+    const exactOrigin = candidate === url.origin || candidate === `${url.origin}/`;
+    return allowedProtocol && !url.username && !url.password && exactOrigin && url.pathname === "/" && !url.search && !url.hash ? url.origin : "";
+  } catch (error) {
+    if (error instanceof TypeError)
+      return "";
+    throw error;
+  }
+}
+function hostFromUrl2(value) {
+  return value ? new URL(value).hostname : "";
+}
+function inferProjectRefFromSupabaseUrl2(value) {
+  if (!value)
+    return "";
+  return new URL(value).hostname.match(/^([a-z0-9-]+)\.api\./i)?.[1] ?? "";
+}
+function sourceCredentialScope2(values, explicitApiUrl, supabaseUrl) {
+  const hasManagementContext = Boolean(explicitApiUrl.trim() || values.SUPACLOUD_API_TOKEN?.trim() || values.SUPACLOUD_HOST?.trim());
+  if (hasManagementContext)
+    return "management";
+  return supabaseUrl || values.SUPABASE_SERVICE_ROLE_KEY?.trim() ? "project_application" : "incomplete";
+}
+function sourceProjectCore2(values) {
+  const supabaseUrl = canonicalApiOrigin2(values.SUPABASE_URL || "");
+  const projectRef = (values.SUPACLOUD_PROJECT_REF || values.X_PROJECT_REF || "").trim() || inferProjectRefFromSupabaseUrl2(supabaseUrl);
+  const explicitApiUrl = values.SUPACLOUD_API_URL || values.SUPACLOUD_MANAGEMENT_API_URL || values.MANAGEMENT_API_URL || "";
+  const credentialScope = sourceCredentialScope2(values, explicitApiUrl, supabaseUrl);
+  const managementUrl = explicitApiUrl || (values.SUPACLOUD_HOST ? `http://${values.SUPACLOUD_HOST}:9090` : "");
+  const apiUrl = credentialScope === "management" ? canonicalApiOrigin2(managementUrl) : "";
+  const apiToken = credentialScope === "management" ? values.SUPACLOUD_API_TOKEN || "" : "";
+  return { apiUrl, apiToken, projectRef, supabaseUrl, credentialScope };
+}
+function processValues2(env) {
+  return Object.fromEntries(Object.entries(env).filter((entry) => entry[1] !== undefined));
+}
+function hasProcessContext2(env) {
+  return CORE_CONTEXT_KEYS2.some((key) => Object.hasOwn(env, key));
+}
+function completeProjectContext2(values) {
+  const core = sourceProjectCore2(values);
+  if (core.credentialScope === "project_application") {
+    return Boolean(core.supabaseUrl && values.SUPABASE_SERVICE_ROLE_KEY?.trim() && core.projectRef);
+  }
+  return Boolean(core.apiUrl && core.apiToken && core.projectRef);
+}
+function parseInsecureTls2(values) {
+  for (const key of ["SUPACLOUD_TLS_VERIFY", "SUPACLOUD_TLS_INSECURE"]) {
+    const value = values[key]?.trim().toLowerCase();
+    if (value === undefined)
+      continue;
+    if (["1", "true", "yes", "on"].includes(value))
+      return key === "SUPACLOUD_TLS_INSECURE";
+    if (["0", "false", "no", "off"].includes(value))
+      return key === "SUPACLOUD_TLS_VERIFY";
+    throw new Error(`${key} must be a boolean (true or false)`);
+  }
+  return true;
+}
+function namedEnvironmentSource2(cwd, selector) {
+  const environment = normalizeEnvironmentName(selector);
+  const path = resolve25(cwd, `.env.supacloud.${selector}`);
+  const values = readEnvFile2(path, true);
+  if (values.SUPACLOUD_ENV && normalizeEnvironmentName(values.SUPACLOUD_ENV) !== environment) {
+    throw new Error(`SUPACLOUD_ENV in ${path} does not match selector ${selector}`);
+  }
+  return { values, kind: "named_env_file", path, environment };
+}
+function explicitEnvironmentSource2(cwd, envFile) {
+  const path = resolve25(cwd, envFile);
+  const values = readEnvFile2(path, true);
+  if (!values.SUPACLOUD_ENV)
+    throw new Error(`SUPACLOUD_ENV is required in ${path}`);
+  return {
+    values,
+    kind: "explicit_env_file",
+    path,
+    environment: normalizeEnvironmentName(values.SUPACLOUD_ENV)
+  };
+}
+function contextSource2(env, cwd, selection) {
+  if (selection.environmentName && selection.envFile)
+    throw new Error("Environment selectors are mutually exclusive");
+  if (selection.environmentName)
+    return namedEnvironmentSource2(cwd, selection.environmentName);
+  if (selection.envFile)
+    return explicitEnvironmentSource2(cwd, selection.envFile);
+  if (env.SUPACLOUD_ENV) {
+    const environment = normalizeEnvironmentName(env.SUPACLOUD_ENV);
+    const values = processValues2(env);
+    if (completeProjectContext2(values)) {
+      return { values, kind: "process_env", path: null, environment };
+    }
+    return namedEnvironmentSource2(cwd, env.SUPACLOUD_ENV);
+  }
+  if (hasProcessContext2(env)) {
+    return { values: processValues2(env), kind: "process_env", path: null, environment: "" };
+  }
+  const path = resolve25(cwd, ".env");
+  const values = readEnvFile2(path, false);
+  const environment = values.SUPACLOUD_ENV ? normalizeEnvironmentName(values.SUPACLOUD_ENV) : "";
+  return { values, kind: Object.keys(values).length ? "legacy_dotenv" : "none", path: existsSync16(path) ? path : null, environment };
+}
+function resolveSupaCloudContext2(env = process.env, cwd = process.cwd(), selection = {}) {
+  const source = contextSource2(env, cwd, selection);
+  const core = sourceProjectCore2(source.values);
+  const host = source.values.SUPACLOUD_HOST || hostFromUrl2(core.apiUrl || core.supabaseUrl);
+  const readOnly = env.SUPACLOUD_READ_ONLY === "true" || source.values.SUPACLOUD_READ_ONLY === "true";
+  const insecureTls = parseInsecureTls2(source.values);
+  return {
+    host,
+    sshUser: env.SUPACLOUD_SSH_USER ?? "root",
+    sshPort: parseInt(env.SUPACLOUD_SSH_PORT ?? "22", 10),
+    sshKey: env.SUPACLOUD_SSH_KEY ?? resolve25(homedir3(), ".ssh", "id_rsa"),
+    sshPass: env.SUPACLOUD_SSH_PASS ?? "",
+    apiUrl: core.apiUrl,
+    apiToken: core.apiToken,
+    projectRef: core.projectRef,
+    readOnly,
+    environment: source.environment,
+    production: source.environment === "prod" || source.environment === "production",
+    inferredSupabaseUrl: core.supabaseUrl,
+    inferredServiceRoleKey: source.values.SUPABASE_SERVICE_ROLE_KEY || "",
+    credentialScope: core.credentialScope,
+    source: source.kind,
+    sourcePath: source.path,
+    environmentVariables: source.values,
+    applicationId: source.values.SUPACLOUD_APPLICATION_ID?.trim() || "",
+    applicationEnvironmentId: source.values.SUPACLOUD_APPLICATION_ENVIRONMENT_ID?.trim() || source.environment,
+    applicationConfigurationPath: source.values.SUPACLOUD_APPLICATION_CONFIGURATION_PATH?.trim() || "",
+    applicationConfigurationId: source.values.SUPACLOUD_APPLICATION_CONFIGURATION_ID?.trim() || "",
+    applicationManifestPath: source.values.SUPACLOUD_APPLICATION_MANIFEST_PATH?.trim() || "",
+    insecureTls
+  };
+}
+
+// src/shared/tools/developer-experience-tools.ts
 var initToolSchema = {
   root: optional(String2(), "Project directory to initialize (default: current directory)"),
   json: optional(Boolean2(), "Emit one machine-readable JSON result")
 };
 var environmentToolSchema = {
-  action: withDescription(stringEnum(["list", "check"]), "Environment profile inspection action"),
+  action: withDescription(stringEnum2(["list", "check"]), "Environment profile inspection action"),
   root: optional(String2(), "Project directory containing .env.supacloud.* files"),
   json: optional(Boolean2(), "Emit one machine-readable JSON result")
 };
@@ -29589,8 +30143,8 @@ function outputDirectoryFor(manifest) {
   return "dist";
 }
 async function readPackageManifest(root) {
-  const path = join19(root, "package.json");
-  if (!existsSync15(path))
+  const path = join20(root, "package.json");
+  if (!existsSync17(path))
     return {};
   try {
     const parsed = JSON.parse(await readFile8(path, "utf8"));
@@ -29620,8 +30174,8 @@ async function writeNewFile(path, content) {
   }
 }
 async function ensureGitignore(root) {
-  const path = join19(root, ".gitignore");
-  const existing = existsSync15(path) ? await readFile8(path, "utf8") : "";
+  const path = join20(root, ".gitignore");
+  const existing = existsSync17(path) ? await readFile8(path, "utf8") : "";
   const required = [".env.supacloud.*", "!.env.supacloud.*.example"];
   const missing = required.filter((entry) => !existing.split(/\r?\n/).includes(entry));
   if (missing.length === 0)
@@ -29635,10 +30189,10 @@ async function ensureGitignore(root) {
   return true;
 }
 async function initializeProject(request, options) {
-  const root = resolve24(request.root || options.cwd || process.cwd());
+  const root = resolve26(request.root || options.cwd || process.cwd());
   await mkdir7(root, { recursive: true });
-  const configPath = join19(root, "supacloud.json");
-  if (existsSync15(configPath)) {
+  const configPath = join20(root, "supacloud.json");
+  if (existsSync17(configPath)) {
     throw new Error(`supacloud.json already exists in ${root}; init never overwrites project configuration`);
   }
   const manifest = await readPackageManifest(root);
@@ -29665,10 +30219,10 @@ async function initializeProject(request, options) {
     throw error;
   }
   created.push("supacloud.json");
-  if (await writeNewFile(join19(root, ".env.supacloud.test.example"), TEST_PROFILE)) {
+  if (await writeNewFile(join20(root, ".env.supacloud.test.example"), TEST_PROFILE)) {
     created.push(".env.supacloud.test.example");
   }
-  if (await writeNewFile(join19(root, ".env.supacloud.production.example"), PRODUCTION_PROFILE)) {
+  if (await writeNewFile(join20(root, ".env.supacloud.production.example"), PRODUCTION_PROFILE)) {
     created.push(".env.supacloud.production.example");
   }
   if (await ensureGitignore(root))
@@ -29679,7 +30233,7 @@ async function initializeProject(request, options) {
     root,
     created,
     detected: {
-      package_json: existsSync15(join19(root, "package.json")),
+      package_json: existsSync17(join20(root, "package.json")),
       build_script: hasBuildScript,
       output_directory: outputDirectory
     },
@@ -29713,7 +30267,7 @@ async function environmentProfiles(root) {
   });
   return entries.filter((entry) => entry.isFile()).map((entry) => {
     const name = profileNameFromFile(entry.name);
-    return name ? { name, path: join19(root, entry.name), exists: true } : null;
+    return name ? { name, path: join20(root, entry.name), exists: true } : null;
   }).filter((profile) => profile !== null).sort((left, right) => left.name.localeCompare(right.name));
 }
 function statusMissing(context) {
@@ -29748,11 +30302,11 @@ function deployMissing(context, application, hasFrontend = false) {
 }
 async function inspectProfile(profile) {
   try {
-    const context = resolveSupaCloudContext({}, dirname12(profile.path), {
+    const context = resolveSupaCloudContext2({}, dirname13(profile.path), {
       environmentName: profile.name
     });
     const status = statusMissing(context);
-    const configText = await readFile8(join19(dirname12(profile.path), "supacloud.json"), "utf8").catch((error) => {
+    const configText = await readFile8(join20(dirname13(profile.path), "supacloud.json"), "utf8").catch((error) => {
       if (error instanceof Error && "code" in error && error.code === "ENOENT")
         return "{}";
       throw error;
@@ -29796,7 +30350,7 @@ async function inspectProfile(profile) {
   }
 }
 async function inspectEnvironment(request, options) {
-  const root = resolve24(request.root || options.cwd || process.cwd());
+  const root = resolve26(request.root || options.cwd || process.cwd());
   const profiles = await environmentProfiles(root);
   if (request.action === "list") {
     const active = options.activeContext?.environment || null;
@@ -29852,10 +30406,109 @@ function registerDeveloperExperienceTools(server, options = {}) {
   registerTool(server, "init", "Create SupaCloud deployment configuration and non-secret environment examples without overwriting project files.", initToolSchema, (request) => initializeProject(request, options));
   registerTool(server, "env", "List or locally validate named SupaCloud environment profiles without contacting the platform or printing secrets.", environmentToolSchema, (request) => inspectEnvironment(request, options));
 }
+
+// src/shared/tools/project-deployment.ts
+var operation2 = "applications.project_deploy";
+var scopeSchema2 = _Object_({
+  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+  application_id: ApplicationIdSchema,
+  environment_id: ApplicationIdSchema
+});
+var statusSchema2 = _Object_({
+  schema: Literal("supacloud.project-deployment-status.v1"),
+  deployment_id: ApplicationDeployRequestSchema.properties.mutation_id,
+  status: Union([
+    Literal("pending"),
+    Literal("running"),
+    Literal("succeeded"),
+    Literal("failed_retryable"),
+    Literal("failed_terminal"),
+    Literal("outcome_unknown")
+  ]),
+  phase: Union([
+    Literal("queued"),
+    Literal("prepared"),
+    Literal("migrating"),
+    Literal("activating"),
+    Literal("binding-web"),
+    Literal("verifying")
+  ]),
+  operation: Literal("application.release.deploy"),
+  ...scopeSchema2.properties,
+  receipt: Optional(Unknown()),
+  failure_code: Optional(String2({ pattern: "^[A-Z][A-Z0-9_]{0,63}$" }))
+}, { additionalProperties: false });
+function responseReceipt(data, expected) {
+  if (!data || typeof data !== "object" || Array.isArray(data) || !("ok" in data) || data.ok !== true) {
+    throw new Error("Invalid project deployment response");
+  }
+  const { ok: _ok, ...receipt } = data;
+  return parseApplicationDeployResult(receipt, expected);
+}
+async function runProjectDeployment(http, args) {
+  const scope = { project_ref: args.ref, application_id: args.id, environment_id: args.environment_id };
+  const request = {
+    mutation_id: args.mutation_id,
+    release_id: args.release_id,
+    ...args.configuration_id === undefined ? {} : { configuration_id: args.configuration_id },
+    ...args.configuration_write === undefined ? {} : { configuration_write: args.configuration_write },
+    ...args.expected_plan_sha256 === undefined ? {} : { expected_plan_sha256: args.expected_plan_sha256 },
+    ...args.approved_migration_digest === undefined ? {} : { approved_migration_digest: args.approved_migration_digest },
+    ...args.web_release === undefined ? {} : { web_release: args.web_release }
+  };
+  if (!Check2(scopeSchema2, scope) || !Check2(ApplicationDeployRequestSchema, request) || request.configuration_id !== undefined && request.configuration_write !== undefined && request.configuration_id !== request.configuration_write.configuration_id) {
+    return releaseControlFailure(operation2, "INVALID_RESPONSE", null);
+  }
+  const expected = { ...scope, request };
+  const identity = {
+    ...scope,
+    deployment_id: request.mutation_id,
+    mutation_id: request.mutation_id,
+    release_id: request.release_id
+  };
+  const endpoint = `/v1/projects/${encodeURIComponent(scope.project_ref)}/environments/${encodeURIComponent(scope.environment_id)}/deployments`;
+  const { mutation_id, ...candidate } = request;
+  const result = await http.post(endpoint, {
+    ...candidate,
+    deployment_id: mutation_id,
+    application_id: scope.application_id
+  }, { timeoutMs: 120000, maxJsonBytes: 131072, responseTimeoutMs: 30000 });
+  if (result.ok && result.status === 200) {
+    try {
+      return releaseControlSuccess(operation2, {
+        ...responseReceipt(result.data, expected),
+        deployment_id: mutation_id
+      });
+    } catch {}
+  } else if (!result.ok && !result.transportError && !result.responseReadError && result.status < 500 && result.status !== 408) {
+    return releaseControlMutationFailure(operation2, result, identity);
+  }
+  const observed = await http.get(`${endpoint}/${encodeURIComponent(mutation_id)}`, {
+    retry: false,
+    totalTimeoutMs: 30000,
+    maxJsonBytes: 131072
+  });
+  try {
+    if (!observed.ok || observed.status !== 200 || !Check2(statusSchema2, observed.data))
+      throw new Error;
+    const state = observed.data;
+    if (state.deployment_id !== mutation_id || state.project_ref !== scope.project_ref || state.application_id !== scope.application_id || state.environment_id !== scope.environment_id || state.status !== "succeeded" || state.phase !== "verifying")
+      throw new Error;
+    const receipt = parseApplicationDeployResult(state.receipt, expected);
+    return releaseControlSuccess(operation2, {
+      ...receipt,
+      deployment_id: mutation_id,
+      replayed: true,
+      execution_performed: false
+    });
+  } catch {
+    return releaseControlFailure(operation2, "OUTCOME_UNKNOWN", result.transportError ? null : result.status, identity);
+  }
+}
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.97.1",
+  version: "0.98.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -29889,7 +30542,7 @@ var package_default = {
     build: "bun build src/index.ts --outdir dist --target node --conditions=supacloud-source --external @supacloud/compiler --external @supacloud/db && bun run build:tool-runtime && bun run build:types",
     "build:tool-runtime": "bun build src/tool-runtime.ts --outdir dist --target node --external typebox && tsc -p tsconfig.tool-runtime.json --emitDeclarationOnly",
     "build:types": "tsc --emitDeclarationOnly",
-    "check:release-bundle": "node scripts/check-release-bundle.mjs",
+    "check:release-bundle": "bun scripts/check-release-bundle.mjs",
     pretypecheck: "bun install --cwd ../delivery --frozen-lockfile && bun install --cwd ../compiler --frozen-lockfile && bun run --cwd ../compiler build && bun run prepare:db",
     prepublishOnly: "bun run build && bun run check:release-bundle",
     typecheck: "tsc --noEmit"
@@ -30081,10 +30734,10 @@ function captureTools(register) {
 function printHelp(context) {
   const autoLink = context.inferredSupabaseUrl ? `Project context: ${context.inferredSupabaseUrl} (${context.source})` : "Project context: not detected";
   console.error(`
-╔═══════════════════════════════════════════════════════════╗
-║  supacloud                                           ║
-║  Project CLI for SupaCloud users                         ║
-╚═══════════════════════════════════════════════════════════╝
+\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
+\u2551  supacloud                                           \u2551
+\u2551  Project CLI for SupaCloud users                         \u2551
+\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
 
 USAGE
 
@@ -30302,7 +30955,7 @@ function createCliTools(context, confirmProduction) {
           {
             type: "text",
             text: [
-              "⚠️ Project commands need a Management API context.",
+              "\u26A0\uFE0F Project commands need a Management API context.",
               "",
               "Provide one of these sources:",
               "  - --env <name> for .env.supacloud.<name>",
@@ -30330,7 +30983,7 @@ function createCliTools(context, confirmProduction) {
           content: [
             {
               type: "text",
-              text: `⚠️ This command requires Management API context. Run \`${preferredCommand} status\` to inspect current detection.`
+              text: `\u26A0\uFE0F This command requires Management API context. Run \`${preferredCommand} status\` to inspect current detection.`
             }
           ]
         })
@@ -30363,7 +31016,7 @@ function createCliTools(context, confirmProduction) {
         isError: true,
         content: [{
           type: "text",
-          text: `⚠️ Deploy requires Management API context. Run \`${preferredCommand} status\` to inspect current detection.`
+          text: `\u26A0\uFE0F Deploy requires Management API context. Run \`${preferredCommand} status\` to inspect current detection.`
         }]
       })
     };
@@ -30391,7 +31044,7 @@ function createCliTools(context, confirmProduction) {
           {
             type: "text",
             text: [
-              `⚠️ No project context found for ${preferredCommand}.`,
+              `\u26A0\uFE0F No project context found for ${preferredCommand}.`,
               "",
               `${preferredCommand} remote tools require Management API credentials.`,
               "Provide one of these sources:",