@specific.dev/cli 0.1.225 → 0.1.227

package/dist/cli.js

@@ -1118,11 +1118,11 @@ var init_open = __esm({
       }
       const subprocess = childProcess3.spawn(command, cliArguments, childProcessOptions);
       if (options2.wait) {
-        return new Promise((resolve10, reject) => {
-          subprocess.once("error", reject);
+        return new Promise((resolve10, reject2) => {
+          subprocess.once("error", reject2);
           subprocess.once("close", (exitCode) => {
             if (!options2.allowNonzeroExitCode && exitCode !== 0) {
-              reject(new Error(`Exited with code ${exitCode}`));
+              reject2(new Error(`Exited with code ${exitCode}`));
               return;
             }
             resolve10(subprocess);
@@ -1130,13 +1130,13 @@ var init_open = __esm({
         });
       }
       if (isFallbackAttempt) {
-        return new Promise((resolve10, reject) => {
-          subprocess.once("error", reject);
+        return new Promise((resolve10, reject2) => {
+          subprocess.once("error", reject2);
           subprocess.once("spawn", () => {
             subprocess.once("close", (exitCode) => {
-              subprocess.off("error", reject);
+              subprocess.off("error", reject2);
               if (exitCode !== 0) {
-                reject(new Error(`Exited with code ${exitCode}`));
+                reject2(new Error(`Exited with code ${exitCode}`));
                 return;
               }
               subprocess.unref();
@@ -1146,10 +1146,10 @@ var init_open = __esm({
         });
       }
       subprocess.unref();
-      return new Promise((resolve10, reject) => {
-        subprocess.once("error", reject);
+      return new Promise((resolve10, reject2) => {
+        subprocess.once("error", reject2);
         subprocess.once("spawn", () => {
-          subprocess.off("error", reject);
+          subprocess.off("error", reject2);
           resolve10(subprocess);
         });
       });
@@ -184314,9 +184314,9 @@ var NodeFsHandler = class {
         this._addToNodeFs(path28, initialAdd, wh, depth + 1);
       }
     }).on(EV.ERROR, this._boundHandleError);
-    return new Promise((resolve10, reject) => {
+    return new Promise((resolve10, reject2) => {
       if (!stream)
-        return reject();
+        return reject2();
       stream.once(STR_END, () => {
         if (this.fsw.closed) {
           stream = void 0;
@@ -185187,6 +185187,8 @@ import * as path4 from "path";
 import * as os2 from "os";
 import { createReadStream } from "fs";
 import { createTarExtractor, extractTo } from "tar-vern";
+import { timingSafeEqual } from "node:crypto";
+import { S3Client } from "@aws-sdk/client-s3";
 import * as net from "net";
 import { execFile } from "child_process";
 import { promisify } from "util";
@@ -185207,7 +185209,7 @@ import {
   HeadObjectCommand,
   ListObjectsV2Command,
   PutObjectCommand,
-  S3Client
+  S3Client as S3Client2
 } from "@aws-sdk/client-s3";
 import * as net3 from "net";
 import * as fs8 from "fs";
@@ -369627,9 +369629,9 @@ async function downloadFile(url, destPath, onProgress) {
         });
       }
     }
-    await new Promise((resolve62, reject) => {
+    await new Promise((resolve62, reject2) => {
       fileStream.end((err) => {
-        if (err) reject(err);
+        if (err) reject2(err);
         else resolve62();
       });
     });
@@ -369883,6 +369885,199 @@ function terminateProcess(proc, opts = {}) {
     }
   });
 }
+function reject(ctx, status, code) {
+  ctx.status = status;
+  ctx.type = "application/xml";
+  ctx.body = `<?xml version="1.0" encoding="UTF-8"?><Error><Code>${code}</Code><Message>${code}</Message></Error>`;
+}
+function dateFromAmz(value) {
+  const match = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z$/.exec(value);
+  if (!match) return null;
+  const date = /* @__PURE__ */ new Date(
+    `${match[1]}-${match[2]}-${match[3]}T${match[4]}:${match[5]}:${match[6]}Z`
+  );
+  return Number.isFinite(date.getTime()) ? date : null;
+}
+function storageGuard(options2) {
+  const client = new S3Client({
+    region: "us-east-1",
+    credentials: {
+      accessKeyId: options2.accessKey,
+      secretAccessKey: options2.secretKey
+    }
+  });
+  const locks = /* @__PURE__ */ new Map();
+  async function authenticated(req, url) {
+    const authorization = req.headers.authorization;
+    const presigned = url.searchParams.has("X-Amz-Algorithm");
+    if (presigned && authorization) return false;
+    let credential;
+    let signedHeaders;
+    let signature;
+    if (presigned) {
+      if (url.searchParams.get("X-Amz-Algorithm") !== "AWS4-HMAC-SHA256")
+        return false;
+      credential = url.searchParams.get("X-Amz-Credential") ?? "";
+      signedHeaders = url.searchParams.get("X-Amz-SignedHeaders") ?? "";
+      signature = url.searchParams.get("X-Amz-Signature") ?? "";
+    } else {
+      const parts = /^AWS4-HMAC-SHA256\s+Credential=([^,]+),\s*SignedHeaders=([^,]+),\s*Signature=([a-fA-F0-9]{64})$/.exec(
+        authorization ?? ""
+      );
+      if (!parts) return false;
+      [, credential = "", signedHeaders = "", signature = ""] = parts;
+    }
+    const [accessKey, day, region, service, end, extra] = credential.split("/");
+    if (accessKey !== options2.accessKey || !region || service !== "s3" || end !== "aws4_request" || extra !== void 0)
+      return false;
+    if (!/^[a-fA-F0-9]{64}$/.test(signature)) return false;
+    const names = signedHeaders.split(";");
+    if (!names.includes("host") || names.join(";") !== [...new Set(names)].sort().join(";"))
+      return false;
+    const timestamp = presigned ? url.searchParams.get("X-Amz-Date") : req.headers["x-amz-date"];
+    if (typeof timestamp !== "string" || day !== timestamp.slice(0, 8))
+      return false;
+    const signingDate = dateFromAmz(timestamp);
+    if (!signingDate) return false;
+    const age = (Date.now() - signingDate.getTime()) / 1e3;
+    const expiresIn = presigned ? Number(url.searchParams.get("X-Amz-Expires")) : 900;
+    if (!Number.isInteger(expiresIn) || expiresIn < 1 || expiresIn > 604800 || age < -900 || age > expiresIn)
+      return false;
+    const headers = {};
+    for (const name of names) {
+      const value = req.headers[name];
+      if (typeof value !== "string" || name !== name.toLowerCase())
+        return false;
+      headers[name] = value;
+    }
+    const payloadHash = req.headers["x-amz-content-sha256"] ?? url.searchParams.get("X-Amz-Content-Sha256") ?? url.searchParams.get("x-amz-content-sha256") ?? (presigned ? "UNSIGNED-PAYLOAD" : void 0);
+    if (typeof payloadHash === "string")
+      headers["x-amz-content-sha256"] = payloadHash;
+    const query = {};
+    for (const [key, value] of url.searchParams) {
+      if (key === "X-Amz-Signature") continue;
+      const old = query[key];
+      query[key] = old === void 0 ? value : [...Array.isArray(old) ? old : [old], value];
+    }
+    const request2 = {
+      method: req.method ?? "GET",
+      protocol: url.protocol,
+      hostname: url.hostname,
+      port: Number(url.port),
+      path: url.pathname,
+      headers,
+      query
+    };
+    const signingOptions = {
+      signingDate,
+      signingRegion: region,
+      signingService: "s3",
+      signableHeaders: new Set(names),
+      unsignableHeaders: new Set(
+        Object.keys(headers).filter((name) => !names.includes(name))
+      )
+    };
+    const signer = await client.config.signer();
+    let expected;
+    if (presigned) {
+      const result = await signer.presign(request2, {
+        ...signingOptions,
+        expiresIn,
+        unhoistableHeaders: new Set(Object.keys(headers))
+      });
+      const value = result.query?.["X-Amz-Signature"];
+      expected = typeof value === "string" ? value : void 0;
+    } else {
+      const result = await signer.sign(request2, signingOptions);
+      expected = /Signature=([a-f0-9]{64})$/.exec(
+        result.headers.authorization ?? ""
+      )?.[1];
+    }
+    return Boolean(
+      expected && timingSafeEqual(
+        Buffer.from(signature, "hex"),
+        Buffer.from(expected, "hex")
+      )
+    );
+  }
+  return async (ctx, next) => {
+    const req = ctx.req;
+    if (req.method === "OPTIONS") {
+      await next();
+      return;
+    }
+    let url;
+    let bucket;
+    let key;
+    try {
+      url = new URL(req.url ?? "/", `http://${req.headers.host}`);
+      const parts = url.pathname.slice(1).split("/");
+      bucket = decodeURIComponent(parts.shift() ?? "");
+      key = decodeURIComponent(parts.join("/"));
+    } catch {
+      reject(ctx, 400, "InvalidRequest");
+      return;
+    }
+    const hasAuth = Boolean(req.headers.authorization) || [...url.searchParams.keys()].some(
+      (name) => /^(x-amz-|signature$|awsaccesskeyid$)/i.test(name)
+    );
+    const objectRead = options2.public && bucket === options2.bucket && Boolean(key) && (req.method === "GET" || req.method === "HEAD") && !["acl", "tagging", "uploadId", "uploads", "torrent"].some(
+      (name) => url.searchParams.has(name)
+    );
+    let authorized = false;
+    try {
+      authorized = hasAuth && await authenticated(req, url);
+    } catch {
+    }
+    if (hasAuth && !authorized || !authorized && !objectRead) {
+      reject(ctx, 403, "AccessDenied");
+      return;
+    }
+    const mutation = Boolean(key) && ["PUT", "POST", "DELETE"].includes(req.method ?? "");
+    if (!mutation) {
+      await next();
+      return;
+    }
+    const lockKey = `${bucket}/${key}`;
+    const before = locks.get(lockKey) ?? Promise.resolve();
+    let release;
+    const current = new Promise((resolve62) => {
+      release = resolve62;
+    });
+    locks.set(lockKey, current);
+    await before;
+    try {
+      const finalWrite = req.method === "PUT" && !url.searchParams.has("uploadId") || req.method === "POST" && url.searchParams.has("uploadId");
+      const noneMatch = req.headers["if-none-match"];
+      const match = req.headers["if-match"];
+      if (finalWrite && (noneMatch !== void 0 || match !== void 0)) {
+        if (noneMatch !== void 0 && noneMatch !== "*") {
+          reject(ctx, 400, "InvalidArgument");
+          return;
+        }
+        let metadata;
+        try {
+          metadata = await options2.store.getMetadata(bucket, key);
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+          metadata = null;
+        }
+        if (match !== void 0 && !metadata) {
+          reject(ctx, 404, "NoSuchKey");
+          return;
+        }
+        if (noneMatch === "*" && metadata || match !== void 0 && match !== metadata?.etag) {
+          reject(ctx, 412, "PreconditionFailed");
+          return;
+        }
+      }
+      await next();
+    } finally {
+      release();
+      if (locks.get(lockKey) === current) locks.delete(lockKey);
+    }
+  };
+}
 var execFileAsync = promisify(execFile);
 function isPortInUse(host, port) {
   return new Promise((resolve62) => {
@@ -370093,9 +370288,9 @@ async function startPostgres(pg, port, dataDir, onProgress) {
           env2
         );
       })(),
-      new Promise((_, reject) => {
+      new Promise((_, reject2) => {
         postgres.once("exit", (code, signal) => {
-          reject(
+          reject2(
             new Error(
               `PostgreSQL "${pg.name}" exited during startup (code ${code}, signal ${signal}). Port ${port} may already be in use by another process.`
             )
@@ -370195,9 +370390,18 @@ async function startStorage(storage, port, dataDir) {
     port,
     directory: storageDataPath,
     silent: true,
-    allowMismatchedSignatures: true,
+    allowMismatchedSignatures: false,
     configureBuckets: [{ name: storage.name }]
   });
+  server.middleware.unshift(
+    storageGuard({
+      bucket: storage.name,
+      public: storage.public ?? false,
+      accessKey,
+      secretKey,
+      store: server.store
+    })
+  );
   await server.run();
   const endpoint = `http://${host}:${port}`;
   return {
@@ -370224,7 +370428,7 @@ async function startStorage(storage, port, dataDir) {
   };
 }
 async function runCommand(command, args, env2) {
-  return new Promise((resolve62, reject) => {
+  return new Promise((resolve62, reject2) => {
     const proc = spawn(command, args, {
       stdio: ["ignore", "pipe", "pipe"],
       env: env2
@@ -370237,14 +370441,14 @@ async function runCommand(command, args, env2) {
       if (code === 0) {
         resolve62();
       } else {
-        reject(new Error(`Command failed with code ${code}: ${stderr}`));
+        reject2(new Error(`Command failed with code ${code}: ${stderr}`));
       }
     });
-    proc.on("error", reject);
+    proc.on("error", reject2);
   });
 }
 async function createPostgresDatabase(postgresPath, dataDir, dbName, env2) {
-  return new Promise((resolve62, reject) => {
+  return new Promise((resolve62, reject2) => {
     const proc = spawn(
       postgresPath,
       ["--single", "-D", dataDir, "postgres"],
@@ -370260,7 +370464,7 @@ async function createPostgresDatabase(postgresPath, dataDir, dbName, env2) {
     proc.on("close", (code) => {
       resolve62();
     });
-    proc.on("error", reject);
+    proc.on("error", reject2);
     proc.stdin?.write(`CREATE DATABASE "${dbName}";
 `);
     proc.stdin?.end();
@@ -371190,7 +371394,7 @@ function getClient(info) {
   const cacheKey = `${info.host}:${info.port}:${info.accessKey}`;
   const cached2 = clientCache.get(cacheKey);
   if (cached2) return cached2;
-  const client = new S3Client({
+  const client = new S3Client2({
     endpoint: `http://${info.host}:${info.port}`,
     region: "us-east-1",
     credentials: {
@@ -371776,7 +371980,7 @@ function proxyRequest(req, res, targetPort) {
   req.pipe(proxyReq, { end: true });
 }
 async function startAdminServer(getState, listenPort = 0, getLogsDir = () => null, getStorageInstance = () => void 0) {
-  return new Promise((resolve62, reject) => {
+  return new Promise((resolve62, reject2) => {
     const server = http.createServer((req, res) => {
       const url = new URL(req.url || "/", "http://localhost");
       res.setHeader("Access-Control-Allow-Origin", "*");
@@ -371873,11 +372077,11 @@ async function startAdminServer(getState, listenPort = 0, getLogsDir = () => nul
       }
       serveStaticFile(res, pathname);
     });
-    server.on("error", reject);
+    server.on("error", reject2);
     server.listen(listenPort, "127.0.0.1", () => {
       const addr = server.address();
       if (!addr || typeof addr === "string") {
-        reject(new Error("Failed to get server address"));
+        reject2(new Error("Failed to get server address"));
         return;
       }
       const port = addr.port;
@@ -372160,13 +372364,13 @@ async function startMailServer(mail, smtpPort, apiPort) {
     res.writeHead(404);
     res.end();
   });
-  await new Promise((resolve62, reject) => {
+  await new Promise((resolve62, reject2) => {
     smtpServer.listen(smtpPort, "127.0.0.1", () => resolve62());
-    smtpServer.on("error", reject);
+    smtpServer.on("error", reject2);
   });
-  await new Promise((resolve62, reject) => {
+  await new Promise((resolve62, reject2) => {
     httpServer.listen(apiPort, "127.0.0.1", () => resolve62());
-    httpServer.on("error", reject);
+    httpServer.on("error", reject2);
   });
   const stop = async () => {
     httpServer.closeAllConnections();
@@ -375459,7 +375663,7 @@ async function sendEvents(events) {
           ...event.properties,
           $geoip_disable: true,
           $lib: "specific-cli",
-          $lib_version: "0.1.225"
+          $lib_version: "0.1.227"
         }
       }))
     });
@@ -375509,7 +375713,7 @@ function trackEvent(event, properties) {
       distinct_id: distinctId,
       properties: {
         ...properties,
-        cli_version: "0.1.225",
+        cli_version: "0.1.227",
         platform: process.platform,
         node_version: process.version,
         project_id: getProjectId()
@@ -380571,7 +380775,7 @@ function compareVersions(a, b) {
   return 0;
 }
 async function checkForUpdate() {
-  const currentVersion = "0.1.225";
+  const currentVersion = "0.1.227";
   const response = await fetch(`${BINARIES_BASE_URL}/latest?t=${Date.now()}`);
   if (!response.ok) {
     throw new Error(`Failed to check for updates: HTTP ${response.status}`);
@@ -381222,12 +381426,12 @@ async function resolveSql(arg) {
   return await readStdin();
 }
 async function readStdin() {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve10, reject2) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => data += chunk);
     process.stdin.on("end", () => resolve10(data.trim()));
-    process.stdin.on("error", reject);
+    process.stdin.on("error", reject2);
   });
 }
 function resolveOutputFormat2(format) {
@@ -381628,7 +381832,7 @@ async function feedbackCommand(message) {
     await client.submitFeedback({
       message: trimmed,
       projectId,
-      cliVersion: "0.1.225"
+      cliVersion: "0.1.227"
     });
     trackEvent("feedback_submitted", { hasProject: !!projectId });
     console.log("Thanks! We will take a look at your feedback shortly.");
@@ -381647,7 +381851,7 @@ async function feedbackCommand(message) {
 var program = new Command();
 var env = "production";
 var envLabel = env !== "production" ? `[${env.toUpperCase()}] ` : "";
-program.name("specific").description(`${envLabel}Infrastructure-as-code for coding agents`).version("0.1.225").enablePositionalOptions();
+program.name("specific").description(`${envLabel}Infrastructure-as-code for coding agents`).version("0.1.227").enablePositionalOptions();
 program.command("init").description("Initialize project for use with a coding agent").option("--agent <name...>", "Agents to configure (cursor, claude, codex, other)").addHelpText("after", `
 Examples:
   $ specific init

package/dist/docs/observability.md

@@ -142,11 +142,11 @@ OpenTelemetry spans. Today every row is the edge span the platform's ingress rec
 | Key | Notes |
 |---|---|
 | `http.method` | `GET`, `POST`, … |
-| `http.target` | Request path including the query string |
+| `http.target` | Request path. Newly collected spans omit query strings, fragments, and URL userinfo; older retained rows may still contain them |
 | `http.route` | Path with ID-looking segments replaced by `{id}` (`/api/users/{id}`) and static-asset file names by `{file}.ext` (`/assets/{file}.svg`) — a heuristic, since the platform has no route manifest; group by this for per-endpoint views |
 | `http.status_code` | HTTP status as a string — `toUInt16OrZero(SpanAttributes['http.status_code']) >= 500` |
 | `http.server_name` | Hostname the request arrived on |
-| `http.user_agent`, `http.referer`, `http.x_forwarded_for`, `net.peer.ip` | Client details |
+| `http.user_agent`, `http.x_forwarded_for`, `net.peer.ip` | Client details |
 | `nginx.upstream_header_time` | Seconds until your service sent its response headers (time to first byte) — how fast the service answered. Unaffected by streamed responses and slow client downloads, so use this for "is my service slow". A comma-separated list when nginx retried another pod; absent when the request never reached your service (nginx's own 408/499) |
 | `nginx.upstream_response_time` | Seconds until your service finished sending its response. `Duration` additionally runs until the client received the last byte. Same list/absent conventions as above |
 
@@ -154,6 +154,35 @@ Also exposed but rarely queried directly: `EnvironmentId`, `ProjectId`.
 
 Retention: up to 30 days. Your plan may further restrict how far back queries can read; when that cutoff is in effect, `specific query` prints a one-line note on stderr.
 
+### Ingress URL privacy
+
+After the updated ingress collector configuration rolls out, newly collected
+analytics and request spans omit all query strings, fragments and leading HTTP(S)
+URL userinfo from URL fields and span names. Standalone `url.query` and
+`url.fragment` attributes are removed. Raw Referer is dropped entirely: neither `http.referer` nor its originating
+header is exported. For dashboard analytics only, nginx derives an ICANN
+registrable domain (for example, `news.ycombinator.com/item?id=123` becomes
+`ycombinator.com`, and `www.google.co.uk` becomes `google.co.uk`). Subdomains,
+paths, query strings, fragments, ports and userinfo are not retained as referral
+attribution. Private hosting suffixes are collapsed too: `tenant.github.io`
+becomes `github.io`. IP addresses, unknown suffixes, credentials in the authority,
+malformed URLs and duplicate headers receive no attribution. This field is not
+exported to request traces. Top Referrers uses only the derived domain, with no
+fallback to historical raw URLs. Self-referrals are excluded at the same domain
+granularity, so other sites sharing a parent domain (including `spcf.app`) are
+grouped and excluded together. Domains themselves may still contain sensitive
+information; this is data minimization, not universal secret detection.
+Paths, HTTP status, method and latency remain available; query-dependent RSC and
+Referer-based ACME exclusions still apply to analytics, not request traces.
+
+This is a telemetry-only policy: it does not change URLs or headers forwarded to
+your application. Historical rows and copies are not deleted by this change and
+can still contain unredacted data. This is not universal secret detection:
+credentials in path segments, custom attributes or application logs are outside
+this policy. URL-privacy transformation errors reject the incoming telemetry
+payload, potentially losing otherwise valid spans; they do not reject the
+application's HTTP request.
+
 ### `observability.events`
 
 Kubernetes events about your service pods (probe failures, restarts, out-of-memory kills, scheduling problems), in the OpenTelemetry log-record shape. Retention: up to 30 days.

package/dist/docs/postgres.md

@@ -48,6 +48,7 @@ The following PostgreSQL extensions are available in both development and produc
 - **btree_gist** (`btree_gist`) - GiST operator classes for B-tree types (int, text, timestamp, uuid, ...), enabling exclusion constraints (e.g. preventing overlapping time ranges per resource) and multicolumn GiST indexes that mix scalar and GiST-native types. Enable with `CREATE EXTENSION btree_gist;` in a migration. See https://www.postgresql.org/docs/current/btree-gist.html for full documentation.
 - **unaccent** (`unaccent`) - Text search dictionary that strips accents/diacritics, for accent-insensitive search and matching. Enable with `CREATE EXTENSION unaccent;` in a migration. See https://www.postgresql.org/docs/current/unaccent.html for full documentation.
 - **pgcrypto** (`pgcrypto`) - Cryptographic functions: digests and HMAC (SHA-2 family), password hashing with `crypt()`/`gen_salt()` (including bcrypt), PGP symmetric and public-key encryption, and `gen_random_uuid()`/`gen_random_bytes()`. Enable with `CREATE EXTENSION pgcrypto;` in a migration. See https://www.postgresql.org/docs/current/pgcrypto.html for full documentation.
+- **uuid-ossp** (`uuid-ossp`) - UUID generation functions `uuid_generate_v1()`, `uuid_generate_v3()`, `uuid_generate_v4()`, and `uuid_generate_v5()`, for schemas and migrations written against them (e.g. Supabase or Prisma `dbgenerated("uuid_generate_v4()")`). For new code, the built-in `gen_random_uuid()` needs no extension. Enable with `CREATE EXTENSION "uuid-ossp";` in a migration (the quotes are required). See https://www.postgresql.org/docs/current/uuid-ossp.html for full documentation.
 - **pgRouting** (`pgrouting`) - Geospatial routing and network analysis for transportation networks, logistics, and path-finding. Requires PostGIS. Enable with `CREATE EXTENSION pgrouting CASCADE;` in a migration. See https://docs.pgrouting.org/ for full documentation.
 
 ## Graph data

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/cli",
-  "version": "0.1.225",
+  "version": "0.1.227",
   "description": "CLI for Specific infrastructure-as-code",
   "type": "module",
   "main": "dist/cli.js",