@supacloud/admin 0.1.11 → 0.2.0

package/README.md

@@ -30,3 +30,24 @@ Project commands owned by this CLI:
 - `project restore`
 - `project restart`
 - `project update_settings`
+
+Gateway / Caddy commands (config is injected via the Caddy JSON Admin API; requires admin privileges):
+
+- `gateway routes` — list custom gateway routes
+- `gateway upsert_route` — create or replace a route
+- `gateway update_route` — replace a route by id
+- `gateway delete_route` — remove a route by id
+- `gateway config` — update rate-limit tier, CORS origins, or JWT settings
+- `gateway get_certificate` / `gateway update_certificate`
+- `gateway issue_certificate` — issue or renew with lego
+- `gateway deploy_certificate` — deploy an existing PEM cert/key pair
+- `gateway rebuild` — rebuild all tenant gateway configs (`--clean` for a full rebuild)
+- `gateway custom_hostname` / `gateway set_custom_hostname` / `gateway delete_custom_hostname` / `gateway verify_custom_hostname`
+
+```bash
+supacloud-admin gateway routes --ref abc123
+supacloud-admin gateway upsert_route --ref abc123 --route_id webhook \
+  --hosts "api.example.com" --paths "/webhook/*" --upstream 10.0.0.5:8080
+supacloud-admin gateway config --ref abc123 --rate_limit_tier pro
+supacloud-admin gateway rebuild --ref abc123 --clean
+```

package/dist/index.js

@@ -34043,7 +34043,7 @@ Actions: list, deploy, deploy_bundle, source, delete, check`, {
     slug: exports_external.string().optional().describe("[deploy/deploy_bundle/source/delete/check] Function name"),
     code: exports_external.string().optional().describe("[deploy/check] Function source code (TypeScript)"),
     path: exports_external.string().optional().describe("[deploy/check] Local file path to read code from (alternative to code)"),
-    files: exports_external.record(exports_external.string()).optional().describe("[deploy_bundle] File map: { 'index.ts': '...', '_shared/x.ts': '...' }"),
+    files: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("[deploy_bundle] File map: { 'index.ts': '...', '_shared/x.ts': '...' }"),
     entrypoint: exports_external.string().optional().describe("[deploy_bundle] Entrypoint file (default: index.ts)"),
     minify: exports_external.boolean().optional().describe("[deploy/deploy_bundle] Minify bundle")
   }, async (args) => {
@@ -34300,7 +34300,7 @@ function registerAdminProjectCliTools(server, http) {
     name: exports_external.string().optional().describe("[create] Project name"),
     region: exports_external.string().optional().describe("[create] Region (default: local)"),
     organization_id: exports_external.string().optional().describe("[create] Organization ID"),
-    settings: exports_external.record(exports_external.unknown()).optional().describe("[update_settings] Config fields to update"),
+    settings: exports_external.record(exports_external.string(), exports_external.unknown()).optional().describe("[update_settings] Config fields to update"),
     log_type: exports_external.enum(["all", "auth", "database", "api"]).optional().describe("[logs] Filter by service")
   }, async ({ action, ref, name, region, organization_id, settings, log_type }) => {
     let text;
@@ -34370,6 +34370,300 @@ function registerAdminProjectCliTools(server, http) {
   });
 }
 
+// src/shared/tools/gateway-tools.ts
+var stringArray = exports_external.preprocess((value) => {
+  if (value === undefined || value === null)
+    return;
+  if (Array.isArray(value))
+    return value;
+  const text = String(value).trim();
+  if (!text)
+    return [];
+  if (text.startsWith("[")) {
+    try {
+      return JSON.parse(text);
+    } catch {
+      return [text];
+    }
+  }
+  return text.split(",").map((item) => item.trim()).filter(Boolean);
+}, exports_external.array(exports_external.string()).optional());
+var headersRecord = exports_external.preprocess((value) => {
+  if (value === undefined || value === null)
+    return;
+  if (typeof value === "object" && !Array.isArray(value))
+    return value;
+  const text = String(value).trim();
+  if (!text)
+    return;
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+      return parsed;
+  } catch {}
+  const out = {};
+  for (const part of text.split(",")) {
+    const idx = part.indexOf(":");
+    if (idx > 0)
+      out[part.slice(0, idx).trim()] = part.slice(idx + 1).trim();
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}, exports_external.record(exports_external.string(), exports_external.string()).optional());
+var ok2 = (res) => res.ok ? JSON.stringify(res.data, null, 2) : `❌ Failed (${res.status}): ${JSON.stringify(res.data)}`;
+var simple2 = (res, msg) => res.ok ? `✅ ${msg}` : `❌ Failed (${res.status}): ${JSON.stringify(res.data)}`;
+function registerGatewayTools(server, http, options = {}) {
+  const { projectRef } = options;
+  server.tool("gateway", `Gateway / Caddy 配置（通过 JSON Admin API 注入）。要求 admin 权限。
+Actions: routes, upsert_route, update_route, delete_route, config, get_certificate, update_certificate, issue_certificate, deploy_certificate, rebuild, custom_hostname, set_custom_hostname, delete_custom_hostname, verify_custom_hostname`, {
+    action: exports_external.enum([
+      "routes",
+      "upsert_route",
+      "update_route",
+      "delete_route",
+      "config",
+      "get_certificate",
+      "update_certificate",
+      "issue_certificate",
+      "deploy_certificate",
+      "rebuild",
+      "custom_hostname",
+      "set_custom_hostname",
+      "delete_custom_hostname",
+      "verify_custom_hostname"
+    ]).describe("Action"),
+    ref: exports_external.string().optional().describe(projectRef ? "可选：覆盖自动关联的项目 ref" : "项目 ref"),
+    route_id: exports_external.string().optional().describe("[upsert_route/update_route/delete_route] 路由 ID（字母/数字/_/-，1-64）"),
+    hosts: stringArray.describe("[upsert_route/update_route] 主机名列表，逗号分隔或 JSON 数组（1-20）"),
+    paths: stringArray.describe("[upsert_route/update_route] 路径列表，逗号分隔或 JSON 数组（1-20）"),
+    upstream: exports_external.string().optional().describe("[upsert_route/update_route] 反代上游 host:port 或 http(s)://host[:port]"),
+    upstream_tls_insecure_skip_verify: exports_external.boolean().optional().describe("[upsert_route/update_route] 上游 TLS 跳过校验"),
+    static_root: exports_external.string().optional().describe("[upsert_route/update_route] 静态站点根目录（与 upstream 二选一）"),
+    rewrite_uri: exports_external.string().optional().describe("[upsert_route/update_route] 重写 URI（以 / 开头）"),
+    strip_prefix: exports_external.string().optional().describe("[upsert_route/update_route] 去除前缀"),
+    headers: headersRecord.describe("[upsert_route/update_route] 自定义请求头，JSON 或 K:V,K2:V2"),
+    cors: stringArray.describe("[upsert_route/update_route] 额外 CORS 源，逗号分隔"),
+    priority: exports_external.number().optional().describe("[upsert_route/update_route] 路由优先级"),
+    enabled: exports_external.boolean().optional().describe("[upsert_route/update_route] 是否启用"),
+    rate_limit_tier: exports_external.enum(["free", "pro", "enterprise"]).optional().describe("[config] 限流档位"),
+    cors_origins: exports_external.string().optional().describe("[config] CORS 源（逗号分隔）"),
+    jwt_enabled: exports_external.boolean().optional().describe("[config] 是否启用 JWT"),
+    jwt_secret: exports_external.string().optional().describe("[config] JWT 密钥"),
+    cert_mode: exports_external.enum(["lego", "manual"]).optional().describe("[update_certificate] 证书模式"),
+    challenge: exports_external.enum(["dns-01", "http-01"]).optional().describe("[update_certificate/issue_certificate] ACME challenge"),
+    email: exports_external.string().optional().describe("[update_certificate/issue_certificate] ACME 邮箱"),
+    dns_provider: exports_external.string().optional().describe("[update_certificate/issue_certificate] DNS 提供商"),
+    dns_env: stringArray.describe("[update_certificate/issue_certificate] DNS 环境变量 KEY=VALUE 列表"),
+    domains: stringArray.describe("[update_certificate/issue_certificate/deploy_certificate] 域名列表"),
+    auto_renew: exports_external.boolean().optional().describe("[update_certificate/issue_certificate] 自动续期"),
+    renew: exports_external.boolean().optional().describe("[issue_certificate] 仅续期已有证书"),
+    cert: exports_external.string().optional().describe("[deploy_certificate] PEM 证书内容"),
+    key: exports_external.string().optional().describe("[deploy_certificate] PEM 私钥内容"),
+    clean: exports_external.boolean().optional().describe("[rebuild] 清理后全量重建"),
+    custom_hostname: exports_external.string().optional().describe("[set_custom_hostname] 自定义域名")
+  }, async (args) => {
+    const resolveRef3 = (override) => {
+      const ref2 = projectRef || override;
+      if (!ref2)
+        throw new Error("'ref' is required for this action");
+      return ref2;
+    };
+    const need = (field, value) => {
+      if (value === undefined || value === null || value === "")
+        throw new Error(`'${field}' is required for '${args.action}'`);
+    };
+    const {
+      action,
+      ref,
+      route_id,
+      hosts,
+      paths,
+      upstream,
+      upstream_tls_insecure_skip_verify,
+      static_root,
+      rewrite_uri,
+      strip_prefix,
+      headers,
+      cors,
+      priority,
+      enabled,
+      rate_limit_tier,
+      cors_origins,
+      jwt_enabled,
+      jwt_secret,
+      cert_mode,
+      challenge,
+      email: email3,
+      dns_provider,
+      dns_env,
+      domains,
+      auto_renew,
+      renew,
+      cert,
+      key,
+      clean,
+      custom_hostname
+    } = args;
+    const projectRefValue = resolveRef3(ref);
+    let text;
+    switch (action) {
+      case "routes":
+        text = ok2(await http.get(`/v1/projects/${projectRefValue}/gateway/routes`));
+        break;
+      case "upsert_route": {
+        need("route_id", route_id);
+        need("hosts", hosts);
+        need("paths", paths);
+        const body = {
+          id: route_id,
+          hosts,
+          path: paths.length === 1 ? paths[0] : paths
+        };
+        if (upstream !== undefined)
+          body.upstream = upstream;
+        if (upstream_tls_insecure_skip_verify !== undefined)
+          body.upstream_tls_insecure_skip_verify = upstream_tls_insecure_skip_verify;
+        if (static_root !== undefined)
+          body.static_root = static_root;
+        if (rewrite_uri !== undefined)
+          body.rewrite_uri = rewrite_uri;
+        if (strip_prefix !== undefined)
+          body.strip_prefix = strip_prefix;
+        if (headers !== undefined)
+          body.headers = headers;
+        if (cors !== undefined)
+          body.cors = cors;
+        if (priority !== undefined)
+          body.priority = priority;
+        if (enabled !== undefined)
+          body.enabled = enabled;
+        text = ok2(await http.post(`/v1/projects/${projectRefValue}/gateway/routes`, body));
+        break;
+      }
+      case "update_route": {
+        need("route_id", route_id);
+        need("hosts", hosts);
+        need("paths", paths);
+        const body = {
+          hosts,
+          path: paths.length === 1 ? paths[0] : paths
+        };
+        if (upstream !== undefined)
+          body.upstream = upstream;
+        if (upstream_tls_insecure_skip_verify !== undefined)
+          body.upstream_tls_insecure_skip_verify = upstream_tls_insecure_skip_verify;
+        if (static_root !== undefined)
+          body.static_root = static_root;
+        if (rewrite_uri !== undefined)
+          body.rewrite_uri = rewrite_uri;
+        if (strip_prefix !== undefined)
+          body.strip_prefix = strip_prefix;
+        if (headers !== undefined)
+          body.headers = headers;
+        if (cors !== undefined)
+          body.cors = cors;
+        if (priority !== undefined)
+          body.priority = priority;
+        if (enabled !== undefined)
+          body.enabled = enabled;
+        text = ok2(await http.put(`/v1/projects/${projectRefValue}/gateway/routes/${route_id}`, body));
+        break;
+      }
+      case "delete_route": {
+        need("route_id", route_id);
+        text = ok2(await http.delete(`/v1/projects/${projectRefValue}/gateway/routes/${route_id}`));
+        break;
+      }
+      case "config": {
+        const body = {};
+        if (rate_limit_tier !== undefined)
+          body.rate_limit_tier = rate_limit_tier;
+        if (cors_origins !== undefined)
+          body.cors_origins = cors_origins;
+        if (jwt_enabled !== undefined)
+          body.jwt_enabled = jwt_enabled;
+        if (jwt_secret !== undefined)
+          body.jwt_secret = jwt_secret;
+        if (Object.keys(body).length === 0)
+          throw new Error("At least one of rate_limit_tier, cors_origins, jwt_enabled, jwt_secret is required");
+        text = ok2(await http.post(`/v1/projects/${projectRefValue}/gateway/config`, body));
+        break;
+      }
+      case "get_certificate":
+        text = ok2(await http.get(`/v1/projects/${projectRefValue}/gateway/certificate`));
+        break;
+      case "update_certificate": {
+        const body = {};
+        if (cert_mode !== undefined)
+          body.mode = cert_mode;
+        if (challenge !== undefined)
+          body.challenge = challenge;
+        if (email3 !== undefined)
+          body.email = email3;
+        if (dns_provider !== undefined)
+          body.dns_provider = dns_provider;
+        if (dns_env !== undefined)
+          body.dns_env = dns_env;
+        if (domains !== undefined)
+          body.domains = domains;
+        if (auto_renew !== undefined)
+          body.auto_renew = auto_renew;
+        text = ok2(await http.put(`/v1/projects/${projectRefValue}/gateway/certificate`, body));
+        break;
+      }
+      case "issue_certificate": {
+        const body = {};
+        if (challenge !== undefined)
+          body.challenge = challenge;
+        if (email3 !== undefined)
+          body.email = email3;
+        if (dns_provider !== undefined)
+          body.dns_provider = dns_provider;
+        if (dns_env !== undefined)
+          body.dns_env = dns_env;
+        if (domains !== undefined)
+          body.domains = domains;
+        if (auto_renew !== undefined)
+          body.auto_renew = auto_renew;
+        if (renew !== undefined)
+          body.renew = renew;
+        text = ok2(await http.post(`/v1/projects/${projectRefValue}/gateway/certificate/issue`, body));
+        break;
+      }
+      case "deploy_certificate": {
+        need("cert", cert);
+        need("key", key);
+        const body = { cert, key };
+        if (domains !== undefined)
+          body.domains = domains;
+        text = ok2(await http.post(`/v1/projects/${projectRefValue}/gateway/certificate/deploy`, body));
+        break;
+      }
+      case "rebuild": {
+        const query = clean ? "?clean=true" : "";
+        text = ok2(await http.post(`/v1/projects/${projectRefValue}/gateway/rebuild-all${query}`));
+        break;
+      }
+      case "custom_hostname":
+        text = ok2(await http.get(`/v1/projects/${projectRefValue}/custom-hostname`));
+        break;
+      case "set_custom_hostname": {
+        need("custom_hostname", custom_hostname);
+        text = simple2(await http.post(`/v1/projects/${projectRefValue}/custom-hostname`, { custom_hostname }), `Custom hostname ${custom_hostname} requested`);
+        break;
+      }
+      case "delete_custom_hostname":
+        text = simple2(await http.delete(`/v1/projects/${projectRefValue}/custom-hostname`), "Custom hostname removed");
+        break;
+      case "verify_custom_hostname":
+        text = ok2(await http.post(`/v1/projects/${projectRefValue}/custom-hostname/verify`));
+        break;
+      default:
+        text = `❌ Unknown action: ${action}`;
+    }
+    return { content: [{ type: "text", text }] };
+  });
+}
+
 // src/index.ts
 var adminProjectActionSchema = exports_external.enum([
   "list",
@@ -34456,6 +34750,10 @@ EXAMPLES
   supacloud-admin project create --name my-app
   supacloud-admin project list
   supacloud-admin platform metrics
+  supacloud-admin gateway routes --ref abc123
+  supacloud-admin gateway upsert_route --ref abc123 --route_id webhook --hosts "api.example.com" --paths "/webhook/*" --upstream 10.0.0.5:8080
+  supacloud-admin gateway config --ref abc123 --rate_limit_tier pro
+  supacloud-admin gateway rebuild --ref abc123 --clean
 `);
 }
 function createAdminTools() {
@@ -34514,6 +34812,17 @@ function createAdminTools() {
         ]
       })
     };
+    tools.gateway = {
+      schema: { action: exports_external.string() },
+      callback: async () => ({
+        content: [
+          {
+            type: "text",
+            text: "⚠️ Gateway / Caddy commands require SUPACLOUD_API_URL and SUPACLOUD_API_TOKEN (admin privileges)."
+          }
+        ]
+      })
+    };
   };
   registerAdminHelp();
   if (context.host) {
@@ -34532,6 +34841,7 @@ function createAdminTools() {
       token: context.apiToken
     });
     Object.assign(tools, captureTools((server) => registerAdminProjectCliTools(server, http)));
+    Object.assign(tools, captureTools((server) => registerGatewayTools(server, http)));
     const advancedTools = captureTools((server) => registerAdvancedTools(server, http));
     if (advancedTools.platform) {
       tools.platform = advancedTools.platform;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.1.11",
+  "version": "0.2.0",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",
@@ -30,12 +30,12 @@
     "directory": "packages/admin"
   },
   "dependencies": {
-    "ssh2": "^1.16.0",
+    "ssh2": "^1.17.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/bun": "^1.3.9",
+    "@types/bun": "^1.3.14",
     "@types/ssh2": "^1.15.5",
-    "typescript": "^6.0.0"
+    "typescript": "^6.0.3"
   }
 }