API capability pack for bounded Supabase Management API v1 operations against https://api.supabase.com. Enroll a supabase bearer-token connection backed by a personal access token or OAuth token; no credential is embedded in the manifest. The pack reads profile, organizations, organization members and entitlements, projects, available regions, service health, restore-version metadata, Postgres upgrade status, performance/security advisor lints, usage aggregates, SQL snippets, migration and backup metadata, Postgres configuration, SSL enforcement, readonly status, database metadata/OpenAPI, preview branches and action runs/logs, domain configuration, Edge Function metadata, storage buckets, third-party auth and SSO provider metadata, and realtime configuration. Approval-gated writes are limited to project pause/restart, custom-hostname reverify/activate, vanity subdomain check/activate/deactivate, and preview-branch create/update/merge/delete. The pack intentionally excludes project create/delete/transfer/upgrade, raw SQL read/write query, analytics SQL log query endpoints, API-key and signing-key reads/writes, OAuth token exchange/revoke, billing/addons, database credentials/connection-string reads, auth provider secret config reads/writes, PostgREST JWT-secret reads, Edge Function body reads and deploy uploads, arbitrary migration/rollback/PITR execution, database password and pooler mutation, network restriction mutation, JIT access, read replicas, log drains, secret reads/writes, storage external-provider mutation, and arbitrary API passthrough.