@haakco/hostingctl 1.0.315 → 1.0.332

package/dist/main.js

@@ -12583,6 +12583,18 @@ var createHostingDatabaseRequestEngineEnum = {
 	postgres: "postgres",
 	mysql: "mysql"
 };
+var createHostingDatabaseRequestExtensionsEnum = {
+	pg_stat_statements: "pg_stat_statements",
+	pg_stat_kcache: "pg_stat_kcache",
+	timescaledb: "timescaledb",
+	pgaudit: "pgaudit",
+	vector: "vector",
+	pg_search: "pg_search",
+	citext: "citext",
+	"uuid-ossp": "uuid-ossp",
+	unaccent: "unaccent",
+	pg_trgm: "pg_trgm"
+};
 var hostingWorkloadEnum = {
 	wordpress: "wordpress",
 	moodle: "moodle",
@@ -12594,7 +12606,10 @@ var hostingWorkloadEnum = {
 	laravel: "laravel",
 	"redis-durable": "redis-durable",
 	ruby: "ruby",
-	infisical: "infisical"
+	infisical: "infisical",
+	"supabase-auth": "supabase-auth",
+	"supabase-rest": "supabase-rest",
+	"supabase-realtime": "supabase-realtime"
 };
 var hostingGeneratedHostnameWordTypeEnum = {
 	adjective: "adjective",
@@ -16642,14 +16657,16 @@ function describeCreate$1(name, slug, packageKey) {
 //#region src/commands/environment-databases-text.ts
 var DATABASES_USAGE = [
 	"Usage: hostingctl environment databases <environment-uuid> --company <slug>",
-	"       hostingctl environment database create <environment-uuid> --company <slug> --key <key> --engine <mariadb|postgres|mysql> [--bind <uuid>[,<uuid>…]]",
+	"       hostingctl environment database create <environment-uuid> --company <slug> --key <key> --engine <mariadb|postgres|mysql> [--bind <uuid>[,<uuid>…]] [--extensions <name>[,<name>…]]",
 	"       hostingctl environment database bind <environment-uuid> <database-uuid> --company <slug> (--bind <uuid>[,<uuid>…] | --clear-bindings)",
 	"       hostingctl environment database review <environment-uuid> <database-uuid> --company <slug>",
 	"       hostingctl environment database retire <environment-uuid> <database-uuid> --company <slug> --digest <review-digest> --generation <review-generation>",
 	"",
 	"  databases  Every environment-owned database, with its engine, its consumers, its configuration key and",
 	"             any recorded retirement.",
-	"  create     Declare one independent database; --bind grants it to consuming workloads as it is made.",
+	"  create     Declare one independent database; --bind grants it to consuming workloads as it is made,",
+	"             and --extensions selects PostgreSQL extensions (postgres only; the platform preloads what",
+	"             each one needs).",
 	"  bind       Replace which applications may consume one database.",
 	"  review     What retiring one identity would do, what it retains, and why it cannot proceed yet.",
 	"  retire     Record a previously reviewed retirement; NEW logins stop after reconciliation.",
@@ -16849,14 +16866,17 @@ async function create$1(context, company, rest) {
 	const key = singleFlag(context, "--key");
 	const engine = engineFlag(context);
 	const bindings = bindFlag(context);
+	const extensions = extensionsFlag(context);
 	if (key === null) throw new UsageError(`create needs --key.\n\n${DATABASES_USAGE}`);
 	if (engine === null) throw new UsageError(`create needs --engine, one of ${ENGINES.join(", ")}.\n\n${DATABASES_USAGE}`);
+	if (extensions.length > 0 && engine !== "postgres") throw new UsageError(`--extensions applies only to a postgres database (got --engine ${engine}).\n\n${DATABASES_USAGE}`);
 	const environment = await environmentAt$1(company, environmentUuid);
 	const body = {
 		key,
 		engine,
 		desiredGeneration: environment.desiredGeneration,
-		...bindings.length === 0 ? {} : { bindings }
+		...bindings.length === 0 ? {} : { bindings },
+		...extensions.length === 0 ? {} : { extensions }
 	};
 	return await confirmableWrite(context, describeCreate(environment, body), async () => (await hostingDatabaseStore({
 		path: {
@@ -16898,7 +16918,12 @@ async function environmentAt$1(company, environmentUuid) {
 /** What a create would send, so the dry run names the identity, the engine and the initial consumers. */
 function describeCreate(environment, body) {
 	const consumers = body.bindings ?? [];
-	return [`Create an independent ${body.engine} database "${body.key}" in ${environment.name} (${environment.slug}), generation ${String(body.desiredGeneration)}.`, consumers.length === 0 ? "  It is granted to no application yet." : `  Granted to: ${consumers.join(", ")}`].join("\n");
+	const extensions = body.extensions ?? [];
+	return [
+		`Create an independent ${body.engine} database "${body.key}" in ${environment.name} (${environment.slug}), generation ${String(body.desiredGeneration)}.`,
+		consumers.length === 0 ? "  It is granted to no application yet." : `  Granted to: ${consumers.join(", ")}`,
+		extensions.length === 0 ? "  No optional extensions selected." : `  Extensions: ${extensions.join(", ")} (the platform preloads what each one needs).`
+	].join("\n");
 }
 /** What a bind would send: the reviewed replacement list, named as the list it becomes. */
 function describeBind(environment, databaseUuid, bindings) {
@@ -16933,6 +16958,18 @@ function engineFlag(context) {
 function bindFlag(context) {
 	return (context.flags.get("--bind") ?? "").split(",").map((one) => one.trim()).filter((one) => one !== "");
 }
+/**
+* The extensions named by `--extensions`, comma-separated like `--bind`.
+*
+* Checked against the generated enum, which the contract derives from the API's own catalogue: an unknown
+* name is refused here, by name, instead of travelling to the server to be refused there.
+*/
+function extensionsFlag(context) {
+	const named = (context.flags.get("--extensions") ?? "").split(",").map((one) => one.trim()).filter((one) => one !== "");
+	const known = Object.values(createHostingDatabaseRequestExtensionsEnum);
+	for (const one of named) if (!known.some((candidate) => candidate === one)) throw new UsageError(`--extensions must be among ${known.join(", ")} (got ${one}).\n\n${DATABASES_USAGE}`);
+	return named;
+}
 /** One required flag's trimmed value, or null when it was absent or empty. */
 function singleFlag(context, flag) {
 	const value = context.flags.get(flag)?.trim() ?? "";
@@ -18238,6 +18275,11 @@ var ENVIRONMENT_METADATA = {
 			takesValue: true,
 			description: "The comma-separated workload uuids that may consume a database."
 		},
+		{
+			name: "--extensions",
+			takesValue: true,
+			description: "The comma-separated PostgreSQL extensions to enable; the platform preloads what each one needs."
+		},
 		{
 			name: "--clear-bindings",
 			takesValue: false,
@@ -24686,7 +24728,14 @@ var createHostingAccessUserRequestSchema = object({
 	password_confirmation: string().max(1024).nullish()
 }).describe("Creating one environment access user.\n\nThe submitted generation must match the stored one, which the service checks\nagain under its row lock. At least one way to authenticate is required for an\nenabled user, and the service enforces that too: it is the rule that stops a\nrow existing that nobody can log in with.\n\n`username` is validated against the same grammar the database CHECK enforces,\nso a malformed name is a field error rather than a constraint violation.\n\n`readOnly` is optional here and required on update, deliberately: creating a\nlogin without mentioning it produces the read-write credential that existed\nbefore the flag, while changing one must state which access is wanted rather\nthan resetting a read-only login by omission.");
 var createHostingApplicationRequestSchema = object({
-	type: _enum(["wordpress", "moodle"]),
+	type: _enum([
+		"wordpress",
+		"moodle",
+		"infisical",
+		"supabase-auth",
+		"supabase-rest",
+		"supabase-realtime"
+	]),
 	name: string().max(100),
 	label: string().max(100).nullish(),
 	replicas: int().min(1),
@@ -24728,6 +24777,18 @@ var createHostingDatabaseRequestSchema = object({
 		"mysql"
 	]),
 	desiredGeneration: int().min(0),
+	extensions: array(_enum([
+		"pg_stat_statements",
+		"pg_stat_kcache",
+		"timescaledb",
+		"pgaudit",
+		"vector",
+		"pg_search",
+		"citext",
+		"uuid-ossp",
+		"unaccent",
+		"pg_trgm"
+	])).max(16).refine((items) => new Set(items).size === items.length, { message: "Array entries must be unique" }).optional().describe("PostgreSQL extensions. Validated against the catalogue that knows what each one needs to be\nloaded, so a name that would be silently ignored is refused instead."),
 	bindings: array(uuid()).max(16).refine((items) => new Set(items).size === items.length, { message: "Array entries must be unique" }).optional(),
 	applicationUuid: string().optional()
 }).describe("Declaring one environment-owned database identity.\n\n`key` is the stable declaration key a re-declaration resolves the same identity by, so its\ngrammar is the one the database CHECK and the 1.4 configuration contract already enforce.\n`engine` is limited to the SQL engines this product hosts: a Redis cache is a different thing\nwith its own lifecycle and cannot be declared here.\n\n`bindings` is the optional initial grant list, so a declaration and its consumers can be made in\none call. It is optional rather than required: a database declared for nobody yet is a real\nstate, and `[]` says exactly that. Re-declaring an existing key with a changed list is refused by\nthe controller rather than applied, so a repeated submit cannot reset grants by accident.\n\n`applicationUuid` is prohibited rather than optional. This operation creates an independent,\nenvironment-owned identity; an application's own database is reached through the application\njourney, so ownership cannot be handed over by naming it here.\n\n`desiredGeneration` is required: declaring a database changes the environment, so the customer\nstates which version of it they reviewed, and a stale one is a conflict rather than a second\nidentity.");
@@ -24748,7 +24809,8 @@ var createHostingEnvironmentRequestSchema = object({
 	resourceProfile: _enum([
 		"small_sites",
 		"empty_environment",
-		"low_end"
+		"low_end",
+		"database_pool"
 	]).optional(),
 	name: string().max(100),
 	slug: string().min(3).max(63).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/),
@@ -24799,7 +24861,7 @@ var createHostingEnvironmentRequestSchema = object({
 		type: string(),
 		name: string().max(100),
 		sizeMib: int().min(1)
-	})).min(1).max(20).optional(),
+	})).max(20).optional(),
 	databases: array(object({
 		application: string().max(100),
 		server: string().max(100)
@@ -25879,6 +25941,17 @@ var hostingApplicationAddressDataSchema = object({
 	publishedUrl: string().nullable(),
 	temporaryLoginSupported: boolean()
 });
+var hostingCuratedComponentOutputDataSchema = object({
+	name: string(),
+	description: string(),
+	secret: boolean()
+});
+var hostingApplicationCapabilitiesDataSchema = object({
+	pause: boolean(),
+	backups: boolean(),
+	unsupported: array(string()),
+	outputs: array(hostingCuratedComponentOutputDataSchema)
+});
 var hostingResourceDataSchema = object({
 	cpuRequestMillicores: int(),
 	cpuLimitMillicores: int(),
@@ -25956,7 +26029,10 @@ var hostingWorkloadEnumSchema = _enum([
 	"laravel",
 	"redis-durable",
 	"ruby",
-	"infisical"
+	"infisical",
+	"supabase-auth",
+	"supabase-rest",
+	"supabase-realtime"
 ]);
 var hostingDatabaseRetirementDataSchema = object({
 	status: string(),
@@ -26026,7 +26102,8 @@ object({
 	database: union([hostingDatabaseDataSchema, _null()]),
 	domains: array(hostingDomainDataSchema),
 	administrator: union([hostingAdministratorDataSchema, _null()]),
-	canManage: boolean()
+	canManage: boolean(),
+	capabilities: hostingApplicationCapabilitiesDataSchema
 });
 var hostingApplicationImportDetectionDataSchema = object({
 	wordpressRoot: string(),
@@ -26320,6 +26397,20 @@ object({
 	pending: boolean(),
 	routes: array(hostingApplicationRouteDataSchema)
 });
+var hostingAutoDeployVerdictDataSchema = object({
+	outcome: _enum([
+		"forward",
+		"duplicate",
+		"stale",
+		"no_event_revision",
+		"undecidable"
+	]).describe("What one update event is, judged against what this application already serves. A delivery is not an instruction. It can be redelivered, and it can arrive after a newer one was already applied, so the platform has to answer \"is this event about a revision we have not applied  * yet?\" before anything is built. Each answer has its own name and its own sentence, because \"duplicate\" and \"stale\" are different facts with different next steps: a duplicate says the event names the release that is serving, and a stale event says the event names a revision the platform has already moved past.  Nothing is persisted from this enum. It is a decision read at the moment it is asked for, which is why it is a hand-written enum beside the generated catalog enums rather than a type table.\n| |\n|---|\n| `forward` <br/> The event names a revision this application does not serve, and nothing shows the platform moved past it. |\n| `duplicate` <br/> The event names exactly the revision the serving release was built from: the platform already applied it. |\n| `stale` <br/> The event names a revision behind the one this application already serves, so applying it would go backwards. |\n| `no_event_revision` <br/> The delivery carries no commit, so there is nothing to place against the served revision. |\n| `undecidable` <br/> The two revisions could not be ordered against each other. This is not a stale event and it is not a forward one. The repository named no order between the delivered commit and the one this application serves, so the platform cannot prove that applying it would move forward — and it will not apply a revision it cannot place. The delivery is named as undecidable rather than refused under another name, so a reader can tell \"we could not tell\" from \"we know it is behind\". |").describe("What one update event is, judged against what this application already serves. A delivery is not an instruction. It can be redelivered, and it can arrive after a newer one was already applied, so the platform has to answer \"is this event about a revision we have not applied  * yet?\" before anything is built. Each answer has its own name and its own sentence, because \"duplicate\" and \"stale\" are different facts with different next steps: a duplicate says the event names the release that is serving, and a stale event says the event names a revision the platform has already moved past.  Nothing is persisted from this enum. It is a decision read at the moment it is asked for, which is why it is a hand-written enum beside the generated catalog enums rather than a type table.\n| |\n|---|\n| `forward` <br/> The event names a revision this application does not serve, and nothing shows the platform moved past it. |\n| `duplicate` <br/> The event names exactly the revision the serving release was built from: the platform already applied it. |\n| `stale` <br/> The event names a revision behind the one this application already serves, so applying it would go backwards. |\n| `no_event_revision` <br/> The delivery carries no commit, so there is nothing to place against the served revision. |\n| `undecidable` <br/> The two revisions could not be ordered against each other. This is not a stale event and it is not a forward one. The repository named no order between the delivered commit and the one this application serves, so the platform cannot prove that applying it would move forward — and it will not apply a revision it cannot place. The delivery is named as undecidable rather than refused under another name, so a reader can tell \"we could not tell\" from \"we know it is behind\". |"),
+	eventRevision: string().nullable().describe("The revision the push named, abbreviated, or null when the delivery carried none."),
+	deployedRevision: string().nullable().describe("The revision serving when the decision was drawn, abbreviated, or null when none served."),
+	explanation: string().describe("What the outcome means for this push, in one sentence."),
+	recordedAt: string().describe("When the decision was recorded, as an ISO 8601 timestamp."),
+	refused: boolean().describe("Whether the event was refused rather than built.")
+});
 var hostingAuxiliaryOwnershipEnumSchema = _enum(["pool", "platform"]).describe("Who pays for an auxiliary Pod. `POOL` is the customer's: it is charged against the purchased package and appears in their allocation. `PLATFORM` is HaakCo's: the file backup runs for the platform's own recoverability, so it is reserved in the namespace quota but is never charged to the customer's purchase. The distinction is arithmetic, not decoration — counting a platform Pod inside the customer's allocation is how a purchase reports as spent when part of it was ours.\n");
 var hostingBackupDestinationCopyDataSchema = object({
 	destinationConfigured: boolean().describe("Whether the company has named a destination at all."),
@@ -26373,6 +26464,7 @@ var hostingFailureCauseEnumSchema = _enum([
 	"build-timeout",
 	"worker-never-reported",
 	"image-unavailable",
+	"release-task-failed",
 	"validation-refusal",
 	"kubernetes-refusal",
 	"transient-transport",
@@ -26925,6 +27017,10 @@ var hostingReleaseArtifactSetDataSchema = object({
 	compatibility: hostingReleaseArtifactCompatibilityEnumSchema.describe("Whether a release's backend process digest and the artifact that serves its frontend belong together. An application that serves a browser build runs two immutably identified things: the pinned runtime image its backend processes execute, and the application bundle that carries the built frontend. They are not independent — the bundle was produced by a builder for one exact runtime, and running it on another is how a served page and a serving process end up disagreeing about the same release.  `Paired` and `NoFrontendArtifact` are both deployable and mean different things, so they are different cases: a bundle release has a frontend artifact that has been checked against its process digest, while a legacy image-only release has none to check. Collapsing them into one \"ok\" would make the platform unable to say which of the two it is holding.  `Mismatched` is a refusal with a reason, never a silent success: the release records one process digest and its bundle records another, so nothing here can state which release is being served.\n| |\n|---|\n| `paired` <br/> The bundle was built for exactly the process digest this release serves: the pair belongs together. |\n| `no_frontend_artifact` <br/> This release carries no bundle, so it has no compatibility-bound frontend artifact to pair. |\n| `mismatched` <br/> The bundle records a different runtime than the one this release serves: the pair does not belong together. |"),
 	explanation: string().describe("The pairing's own sentence, so the reason a reader sees is the reason the platform decided.")
 });
+var hostingRetainedBuildLogDataSchema = object({
+	contents: string(),
+	truncated: boolean()
+});
 var hostingReleaseDataSchema = object({
 	uuid: string(),
 	sequence: int(),
@@ -26942,7 +27038,8 @@ var hostingReleaseDataSchema = object({
 	readyAt: string().nullable(),
 	activatedAt: string().nullable(),
 	retiredAt: string().nullable(),
-	explanation: union([hostingFailureExplanationDataSchema, _null()])
+	explanation: union([hostingFailureExplanationDataSchema, _null()]),
+	taskOutput: union([hostingRetainedBuildLogDataSchema, _null()])
 });
 var hostingRepositorySelectionDataSchema = object({
 	uuid: string(),
@@ -26967,6 +27064,7 @@ object({
 	releases: array(hostingReleaseDataSchema),
 	source: union([hostingRepositorySelectionDataSchema, _null()]),
 	autoDeploy: boolean(),
+	autoDeployVerdict: union([hostingAutoDeployVerdictDataSchema, _null()]),
 	availableSources: array(hostingRepositorySelectionDataSchema),
 	canManage: boolean()
 });
@@ -27058,7 +27156,8 @@ var hostingWorkloadDataSchema = object({
 	bounds: hostingWorkloadBoundsDataSchema,
 	runtime: union([hostingWorkloadRuntimeDataSchema, _null()]),
 	address: union([hostingApplicationAddressDataSchema, _null()]),
-	requiresBuild: boolean().describe("Build/deployment controls apply even before this workload has its first release."),
+	capabilities: hostingApplicationCapabilitiesDataSchema.describe("What this workload can and cannot do. Carried here as well as on the application payload because this is the\nshape the applications table renders; the ANSWERS come from one owner either way."),
+	requiresBuild: boolean(),
 	valkey: union([hostingValkeySettingsDataSchema, _null()]),
 	valkeyEndpoints: array(hostingValkeyEndpointDataSchema).describe("The endpoints that actually exist for this service, each with its own warning. Empty for every type that\nis not a Valkey service.")
 });
@@ -27749,6 +27848,17 @@ object({
 	source: union([hostingConfigurationRepositorySourceDataSchema, _null()]),
 	sourceProof: string().nullable()
 });
+object({
+	rows: array(object({
+		claim: string(),
+		provisionedBytes: int().describe("What the purchase allocated, from the platform's own record."),
+		usedBytes: int().nullable().describe("What the volume reports as written, or null when this credential cannot read it."),
+		freeBytes: int().nullable().describe("What the volume still has room for, or null when unreadable."),
+		idle: boolean().describe("Almost nothing written against a large allocation: the state that starved a workload earlier."),
+		unreadable: string().nullable().describe("Why the numbers are absent, when they are.")
+	})),
+	unreadable: string().nullable()
+});
 var hostingTagDecisionEnumSchema = _enum([
 	"adopted",
 	"already_recorded",
@@ -30764,6 +30874,11 @@ union([
 	object({ message: string().describe("Error overview.") }),
 	messageDataSchema
 ]);
+union([
+	object({ message: string().describe("Error overview.") }),
+	object({ message: string().describe("Error overview.") }),
+	messageDataSchema
+]);
 union([
 	object({ message: string().describe("Error overview.") }),
 	object({ message: string().describe("Error overview.") }),
@@ -36512,7 +36627,7 @@ function writeUpdateState(state, env = process.env) {
 }
 //#endregion
 //#region src/version.ts
-var VERSION = "1.0.315";
+var VERSION = "1.0.332";
 //#endregion
 //#region src/commands/update.ts
 /**
@@ -36587,7 +36702,7 @@ var update = {
 		}, process.env);
 		return {
 			...known,
-			current: after ?? "1.0.315",
+			current: after ?? "1.0.332",
 			latest: after ?? latest,
 			upToDate: after !== null && (latest === null || !isNewerVersion(latest, after)),
 			action: "run",
@@ -36862,7 +36977,7 @@ async function printUpdateNotice(options) {
 		}, env, { waitMs: NOTICE_LOCK_WAIT_MS });
 	} catch {}
 	if (latest === null) return;
-	if (!isNewerVersion(latest, "1.0.315")) return;
+	if (!isNewerVersion(latest, "1.0.332")) return;
 	process.stderr.write(`A newer hostingctl is published: ${latest} (this copy is ${VERSION}). Run \`hostingctl update\` to update.\n`);
 }
 /** Whether an environment variable is set to something, which is how CI and the opt-out are read. */