@integrity-labs/cloud-broker 0.7.12 → 0.7.13

package/dist/index.js

@@ -21675,7 +21675,7 @@ var supabaseRestShape = supabaseRestSchema.shape;
 // package.json
 var package_default = {
   name: "@integrity-labs/cloud-broker",
-  version: "0.7.12",
+  version: "0.7.13",
   description: "Cloud Access Broker \u2014 MCP server that mints scoped, TTL-bounded cloud credentials per agent task. Ships AWS support (aws_request_access, aws_poll_grant, aws_release_access, aws_describe_scope, aws_preview_request, aws_get_credentials \u2014 STS AssumeRole under the hood); GCP, Azure, and Cloudflare land alongside in the same package as the broker grows.",
   type: "module",
   bin: {
@@ -21698,7 +21698,7 @@ var package_default = {
   scripts: {
     build: "tsup",
     dev: "tsx watch src/index.ts",
-    typecheck: "tsc --noEmit",
+    typecheck: "bash ../../scripts/typecheck-guard.sh tsc --noEmit",
     test: "vitest run",
     clean: "rm -rf dist",
     "publish:templates": "bash cloudformation/publish.sh",
@@ -22168,7 +22168,7 @@ server.tool(
 );
 server.tool(
   "supabase_query",
-  "Run READ-ONLY SQL against a Supabase project for an ACTIVE grant. THIS is how you query Supabase - you do NOT get or hold a database credential, and the supabase_get_credentials JWT cannot run SQL. The broker executes your SQL server-side under the grant's scoped database role, inside a READ ONLY transaction with a statement timeout, and returns rows. Args: { grant_id, sql }. Returns on success { grant_id, ok: true, rows, row_count, truncated } (truncated=true means the row cap was hit - add LIMIT/aggregate). On failure returns { ok: false, error_code, error } where error_code is one of READ_ONLY (you attempted a write - this capability is read-only), SCOPE_DENIED (your grant's role can't access that object - try supabase_describe to see your scope), OBJECT_NOT_FOUND (no such relation/schema, or not visible to your grant), TIMEOUT (query too slow), SYNTAX_ERROR, UNREACHABLE, SQL_NOT_CONFIGURED (no scoped DB credential enrolled - tell the user to ask their operator to configure it), or a grant-state code GRANT_NOT_ACTIVE / GRANT_EXPIRED / GRANT_RELEASED (re-request access). Writes are always rejected. Call supabase_describe first if unsure what you can read. All of these come back in the { ok:false, error_code } envelope on a normal response - branch on error_code, do not treat them as tool failures." + NO_DIRECT_SUPABASE_HTTP_BLOCK,
+  "Run READ-ONLY SQL against a Supabase project for an ACTIVE grant. THIS is how you query Supabase - you do NOT get or hold a database credential, and the supabase_get_credentials JWT cannot run SQL. The broker executes your SQL server-side under the grant's scoped database role, inside a READ ONLY transaction with a statement timeout, and returns rows. Args: { grant_id, sql }. Returns on success { grant_id, ok: true, rows, row_count, truncated } (truncated=true means the row cap was hit - add LIMIT/aggregate). On failure returns { ok: false, error_code, error } where error_code is one of READ_ONLY (you attempted a write - this capability is read-only), SCOPE_DENIED (your grant's role can't access that object - try supabase_describe to see your scope), OBJECT_NOT_FOUND (no such relation/schema, or not visible to your grant), TIMEOUT (query too slow), SYNTAX_ERROR, AUTH_FAILED (the database rejected the enrolled credentials - not something you can fix, tell the user to ask their operator to re-check the stored connection string), UNREACHABLE (the broker cannot reach the database over the network - also an operator fix, not a query fix), SQL_NOT_CONFIGURED (no scoped DB credential enrolled - tell the user to ask their operator to configure it), or a grant-state code GRANT_NOT_ACTIVE / GRANT_EXPIRED / GRANT_RELEASED (re-request access). Writes are always rejected. Call supabase_describe first if unsure what you can read. All of these come back in the { ok:false, error_code } envelope on a normal response - branch on error_code, do not treat them as tool failures." + NO_DIRECT_SUPABASE_HTTP_BLOCK,
   supabaseQueryShape,
   async (args) => {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/cloud-broker",
-  "version": "0.7.12",
+  "version": "0.7.13",
   "description": "Cloud Access Broker — MCP server that mints scoped, TTL-bounded cloud credentials per agent task. Ships AWS support (aws_request_access, aws_poll_grant, aws_release_access, aws_describe_scope, aws_preview_request, aws_get_credentials — STS AssumeRole under the hood); GCP, Azure, and Cloudflare land alongside in the same package as the broker grows.",
   "type": "module",
   "bin": {
@@ -23,7 +23,7 @@
   "scripts": {
     "build": "tsup",
     "dev": "tsx watch src/index.ts",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "bash ../../scripts/typecheck-guard.sh tsc --noEmit",
     "test": "vitest run",
     "clean": "rm -rf dist",
     "publish:templates": "bash cloudformation/publish.sh",