@supacloud/admin 0.10.2 → 0.12.0

package/README.md

@@ -80,6 +80,7 @@ npx @supacloud/admin project create --name my-app --domain example.com \
   --env_file /secure/path/.env.project-credentials.test --environment test
 npx @supacloud/admin project list
 npx @supacloud/admin project services --ref abc123
+npx @supacloud/admin project runtime_snapshot --ref abc123
 npx @supacloud/admin project service_control --ref abc123 --service gotrue --service_action stop
 ```
 
@@ -167,6 +168,7 @@ Project commands owned by this CLI:
 - `project restart`
 - `project update_settings`
 - `project services` — read-only project service inventory
+- `project runtime_snapshot` — strict read-only runtime revision and PostgREST attestation snapshot
 - `project service_control` — constrained project service lifecycle control
 
 `project create` never prints project credentials. Pass an absolute

package/dist/index.js

@@ -4759,7 +4759,7 @@ var require_utils = __commonJS((exports, module) => {
 
 // node_modules/ssh2/lib/protocol/crypto/build/Release/sshcrypto.node
 var require_sshcrypto = __commonJS((exports, module) => {
-  module.exports = __require("./sshcrypto-8m50vnmb.node");
+  module.exports = __require("./sshcrypto-vd2k5hq9.node");
 });
 
 // node_modules/ssh2/lib/protocol/crypto/poly1305.js
@@ -25788,7 +25788,17 @@ function resolveSupaCloudContext(env = process.env, cwd = process.cwd(), selecti
 // src/shared/execution-policy.ts
 var ACTION_POLICY = {
   project: {
-    read: ["list", "get", "settings", "api_keys", "health", "logs", "tasks", "services"],
+    read: [
+      "list",
+      "get",
+      "settings",
+      "api_keys",
+      "health",
+      "logs",
+      "tasks",
+      "services",
+      "runtime_snapshot"
+    ],
     write: ["create", "delete", "pause", "restore", "restart", "update_settings"]
   },
   platform: {
@@ -26023,6 +26033,14 @@ function transportFailure(error) {
     transportError: true
   };
 }
+function responseBodyFailure(status) {
+  return {
+    ok: false,
+    status,
+    data: { error: "Invalid Response", code: "INVALID_RESPONSE" },
+    responseError: true
+  };
+}
 function validatedPostTimeout(options) {
   const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT;
   if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_POST_TIMEOUT_MS) {
@@ -26030,12 +26048,90 @@ function validatedPostTimeout(options) {
   }
   return timeoutMs;
 }
+function validatedGetResponseLimit(options) {
+  const maxBytes = options.maxResponseBytes;
+  if (maxBytes === undefined)
+    return;
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new RangeError("HTTP response limit must be a positive safe integer");
+  }
+  return maxBytes;
+}
+function validatedStrictJsonLimit(options) {
+  const maxBytes = options.maxJsonBytes;
+  if (maxBytes === undefined)
+    return;
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new RangeError("HTTP JSON response byte limit must be a positive safe integer");
+  }
+  return maxBytes;
+}
+function responseExceedsDeclaredLimit(response, maxBytes) {
+  const contentLength = response.headers.get("content-length");
+  return contentLength !== null && /^\d+$/u.test(contentLength) && Number(contentLength) > maxBytes;
+}
+function joinedResponseBytes(chunks, totalBytes) {
+  const responseBytes = new Uint8Array(totalBytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    responseBytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return responseBytes;
+}
+async function boundedResponseBytes(response, maxBytes) {
+  if (responseExceedsDeclaredLimit(response, maxBytes)) {
+    response.body?.cancel().catch(() => {
+      return;
+    });
+    return null;
+  }
+  if (!response.body)
+    return new Uint8Array;
+  const reader = response.body.getReader();
+  const chunks = [];
+  let totalBytes = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done)
+      return joinedResponseBytes(chunks, totalBytes);
+    totalBytes += value.byteLength;
+    if (totalBytes > maxBytes) {
+      reader.cancel().catch(() => {
+        return;
+      });
+      return null;
+    }
+    chunks.push(value);
+  }
+}
+async function boundedResponseJson(response, maxBytes) {
+  const responseBytes = await boundedResponseBytes(response, maxBytes);
+  if (responseBytes === null)
+    return null;
+  try {
+    const responseText = new TextDecoder("utf-8", { fatal: true }).decode(responseBytes);
+    return JSON.parse(responseText);
+  } catch (error) {
+    if (error instanceof SyntaxError || error instanceof TypeError)
+      return null;
+    throw error;
+  }
+}
+async function strictBoundedResponseJson(response, maxBytes) {
+  const responseBytes = await boundedResponseBytes(response, maxBytes);
+  if (responseBytes === null)
+    throw new Error("HTTP JSON response exceeded its byte limit");
+  const responseText = new TextDecoder("utf-8", { fatal: true }).decode(responseBytes);
+  return JSON.parse(responseText);
+}
 async function fetchWithTimeout(url, options, timeoutMs = DEFAULT_TIMEOUT) {
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
   try {
     return await fetch(url, {
       ...options,
+      redirect: "error",
       signal: controller.signal
     });
   } finally {
@@ -26078,17 +26174,35 @@ class HttpTransport {
       "Content-Type": "application/json"
     };
   }
-  async get(path) {
+  async get(path, options = {}) {
+    const maxResponseBytes = validatedGetResponseLimit(options);
+    const maxJsonBytes = validatedStrictJsonLimit(options);
+    if (maxResponseBytes !== undefined && maxJsonBytes !== undefined) {
+      throw new RangeError("HTTP response limit options are mutually exclusive");
+    }
+    let response;
     try {
-      const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
+      response = await fetchWithRetry(`${this.baseUrl}${path}`, {
         method: "GET",
         headers: this.headers()
       });
-      const data = await res.json().catch(() => null);
-      return { ok: res.ok, status: res.status, data };
     } catch (error) {
       return transportFailure(error);
     }
+    if (maxJsonBytes !== undefined) {
+      try {
+        const data2 = await strictBoundedResponseJson(response, maxJsonBytes);
+        return { ok: response.ok, status: response.status, data: data2 };
+      } catch {
+        return responseBodyFailure(response.status);
+      }
+    }
+    if (maxResponseBytes !== undefined) {
+      const data2 = await boundedResponseJson(response, maxResponseBytes);
+      return { ok: response.ok, status: response.status, data: data2 };
+    }
+    const data = await response.json().catch(() => null);
+    return { ok: response.ok, status: response.status, data };
   }
   async post(path, body, options) {
     const timeoutMs = validatedPostTimeout(options);
@@ -29717,6 +29831,375 @@ function parseProjectCreateCredentials(responsePayload, expectedApiOrigin, expec
   return isServiceRoleKey(serviceRoleKey) ? { ...identity, serviceRoleKey } : null;
 }
 
+// ../cli/src/shared/tools/project-read-projection.ts
+var PROJECT_READ_RESPONSE_MAX_BYTES = 1048576;
+var PROJECT_REF_PATTERN = /^[a-z0-9-]{1,20}$/;
+var SAFE_IDENTIFIER_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+var REGION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
+var STATUS_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
+var DNS_LABEL_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;
+var DATABASE_VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$/;
+var MAX_PROJECTS = 1e4;
+var PROJECT_SUMMARY_KEYS = new Set([
+  "id",
+  "ref",
+  "organization_id",
+  "organization_slug",
+  "name",
+  "region",
+  "created_at",
+  "status"
+]);
+var PROJECT_DETAILS_KEYS = new Set([
+  ...PROJECT_SUMMARY_KEYS,
+  "database",
+  "api",
+  "studio",
+  "config",
+  "anon_key",
+  "services"
+]);
+var PROJECT_DATABASE_KEYS = new Set([
+  "host",
+  "version",
+  "postgres_engine",
+  "release_channel"
+]);
+var PROJECT_ENDPOINT_KEYS = new Set(["url"]);
+function plainRecord(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const prototype = Object.getPrototypeOf(candidate);
+  return prototype === Object.prototype || prototype === null ? candidate : null;
+}
+function hasOnlyKeys(record, allowedKeys) {
+  return Object.keys(record).every((key) => allowedKeys.has(key));
+}
+function hasWellFormedUnicode(text) {
+  for (let index = 0;index < text.length; index++) {
+    const codeUnit = text.charCodeAt(index);
+    if (codeUnit >= 55296 && codeUnit <= 56319) {
+      if (index + 1 >= text.length)
+        return false;
+      const lowSurrogate = text.charCodeAt(index + 1);
+      if (lowSurrogate < 56320 || lowSurrogate > 57343)
+        return false;
+      index++;
+    } else if (codeUnit >= 56320 && codeUnit <= 57343) {
+      return false;
+    }
+  }
+  return true;
+}
+function boundedText(candidate, maxLength) {
+  return typeof candidate === "string" && candidate.length > 0 && candidate.length <= maxLength && !/[\u0000-\u001f\u007f]/u.test(candidate) && hasWellFormedUnicode(candidate) ? candidate : null;
+}
+function matchingText(candidate, maxLength, pattern) {
+  const candidateText = boundedText(candidate, maxLength);
+  return candidateText && pattern.test(candidateText) ? candidateText : null;
+}
+function canonicalTimestamp(candidate) {
+  const timestamp = boundedText(candidate, 64);
+  if (!timestamp)
+    return null;
+  const milliseconds = Date.parse(timestamp);
+  return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === timestamp ? timestamp : null;
+}
+function projectedSummary(project) {
+  const summary = {
+    id: matchingText(project.id, 128, SAFE_IDENTIFIER_PATTERN),
+    ref: matchingText(project.ref, 20, PROJECT_REF_PATTERN),
+    organization_id: matchingText(project.organization_id, 128, SAFE_IDENTIFIER_PATTERN),
+    organization_slug: matchingText(project.organization_slug, 128, SAFE_IDENTIFIER_PATTERN),
+    name: boundedText(project.name, 100),
+    region: matchingText(project.region, 64, REGION_PATTERN),
+    created_at: canonicalTimestamp(project.created_at),
+    status: matchingText(project.status, 64, STATUS_PATTERN)
+  };
+  return Object.values(summary).every((field) => field !== null) ? summary : null;
+}
+function projectSummary(candidate) {
+  const project = plainRecord(candidate);
+  return project && hasOnlyKeys(project, PROJECT_SUMMARY_KEYS) ? projectedSummary(project) : null;
+}
+function databaseHost(candidate) {
+  const host = boundedText(candidate, 255);
+  if (!host)
+    return null;
+  if (host.startsWith("[") && host.endsWith("]")) {
+    try {
+      const parsedHost = new URL(`http://${host}`);
+      return parsedHost.host === host ? host : null;
+    } catch (error) {
+      if (error instanceof TypeError)
+        return null;
+      throw error;
+    }
+  }
+  const ipv4Parts = host.split(".");
+  if (ipv4Parts.length === 4 && ipv4Parts.every((part) => /^\d{1,3}$/u.test(part))) {
+    return ipv4Parts.every((part) => Number(part) <= 255) ? host : null;
+  }
+  return ipv4Parts.every((label) => DNS_LABEL_PATTERN.test(label)) ? host : null;
+}
+function projectDatabase(candidate) {
+  const database = plainRecord(candidate);
+  if (!database || !hasOnlyKeys(database, PROJECT_DATABASE_KEYS))
+    return null;
+  const host = databaseHost(database.host);
+  const version = matchingText(database.version, 64, DATABASE_VERSION_PATTERN);
+  const postgresEngine = matchingText(database.postgres_engine, 64, DATABASE_VERSION_PATTERN);
+  const releaseChannel = matchingText(database.release_channel, 64, DATABASE_VERSION_PATTERN);
+  return host && version && postgresEngine && releaseChannel ? { host, version, postgres_engine: postgresEngine, release_channel: releaseChannel } : null;
+}
+function rawUrlHasNoPath(candidate) {
+  if (candidate.trim() !== candidate || candidate.includes("\\"))
+    return false;
+  const schemeEnd = candidate.indexOf("://");
+  const pathStart = candidate.indexOf("/", schemeEnd + 3);
+  return pathStart === -1;
+}
+function projectEndpoint(candidate) {
+  const endpoint = plainRecord(candidate);
+  if (!endpoint || !hasOnlyKeys(endpoint, PROJECT_ENDPOINT_KEYS))
+    return null;
+  const endpointUrl = boundedText(endpoint.url, 2048);
+  if (!endpointUrl || !rawUrlHasNoPath(endpointUrl))
+    return null;
+  try {
+    const url = new URL(endpointUrl);
+    if (url.protocol !== "http:" && url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.pathname !== "/")
+      return null;
+    return { url: url.origin };
+  } catch (error) {
+    if (error instanceof TypeError)
+      return null;
+    throw error;
+  }
+}
+function discardedDetailFieldsAreValid(project) {
+  if (project.config !== undefined && plainRecord(project.config) === null)
+    return false;
+  if (project.anon_key !== undefined && boundedText(project.anon_key, 16384) === null)
+    return false;
+  return project.services === undefined || Array.isArray(project.services);
+}
+function projectDetails(candidate, expectedRef) {
+  const project = plainRecord(candidate);
+  if (!project || !hasOnlyKeys(project, PROJECT_DETAILS_KEYS))
+    return null;
+  const summary = projectedSummary(project);
+  const database = projectDatabase(project.database);
+  const api = project.api === undefined ? undefined : projectEndpoint(project.api);
+  const studio = project.studio === undefined ? undefined : projectEndpoint(project.studio);
+  if (!summary || summary.ref !== expectedRef || !database || !discardedDetailFieldsAreValid(project) || project.api !== undefined && !api || project.studio !== undefined && !studio)
+    return null;
+  return {
+    ...summary,
+    database,
+    ...api ? { api } : {},
+    ...studio ? { studio } : {}
+  };
+}
+function payloadWithinLimit(candidate) {
+  try {
+    const serializedPayload = JSON.stringify(candidate);
+    return serializedPayload !== undefined && new TextEncoder().encode(serializedPayload).byteLength <= PROJECT_READ_RESPONSE_MAX_BYTES;
+  } catch {
+    return false;
+  }
+}
+function safeProjectList(candidate) {
+  if (!payloadWithinLimit(candidate) || !Array.isArray(candidate) || candidate.length > MAX_PROJECTS)
+    return null;
+  const safeProjects = [];
+  const ids = new Set;
+  const refs = new Set;
+  for (const projectCandidate of candidate) {
+    const project = projectSummary(projectCandidate);
+    if (!project || ids.has(project.id) || refs.has(project.ref))
+      return null;
+    ids.add(project.id);
+    refs.add(project.ref);
+    safeProjects.push(project);
+  }
+  return safeProjects;
+}
+function validHttpStatus(status) {
+  return Number.isSafeInteger(status) && status >= 100 && status <= 599;
+}
+function successfulResponse(response) {
+  return response.ok === true && validHttpStatus(response.status) && response.status >= 200 && response.status <= 299;
+}
+function failedResult(message) {
+  return { text: `❌ ${message}`, isError: true };
+}
+function failedHttpResult(label, status) {
+  return failedResult(validHttpStatus(status) ? `${label} request failed (${status})` : `${label} request failed`);
+}
+function successfulResult(payload) {
+  return { text: JSON.stringify(payload, null, 2), isError: false };
+}
+function projectListRead(response) {
+  if (!successfulResponse(response))
+    return failedHttpResult("Project list", response.status);
+  const projects = safeProjectList(response.data);
+  return projects ? successfulResult(projects) : failedResult("Invalid project list response");
+}
+function projectGetRead(response, expectedRef) {
+  if (!successfulResponse(response))
+    return failedHttpResult("Project get", response.status);
+  if (!payloadWithinLimit(response.data))
+    return failedResult("Invalid project response");
+  const project = projectDetails(response.data, expectedRef);
+  return project ? successfulResult(project) : failedResult("Invalid project response");
+}
+// src/shared/tools/project-runtime-snapshot.ts
+var RUNTIME_SNAPSHOT_SCHEMA = "supacloud.runtime-snapshot.v1";
+var ATTESTED_REVISION_PATTERN = /^hmac-sha256:[a-f0-9]{64}$/;
+var SAFE_PROJECT_REF2 = /^[a-z0-9-]{1,20}$/;
+var SNAPSHOT_KEYS = ["schema", "project_ref", "captured_at", "secrets", "postgrest"];
+var SECRETS_KEYS = [
+  "desired_revision",
+  "loaded_revision",
+  "load_state",
+  "load_source",
+  "matches_desired",
+  "loaded_at"
+];
+var POSTGREST_KEYS = [
+  "desired_revision",
+  "loaded_revision",
+  "attestation_state",
+  "matches_desired",
+  "desired",
+  "actual",
+  "health",
+  "port",
+  "unit",
+  "loaded_at"
+];
+var SECRET_LOAD_STATES = ["current", "stale", "not_loaded", "unverified", "unreachable"];
+var SECRET_LOAD_SOURCES = ["management_api", "stale_cache", "file_fallback"];
+var POSTGREST_ATTESTATION_STATES = [
+  "loaded",
+  "stale",
+  "drifted",
+  "unverified_legacy",
+  "stopped",
+  "unreachable"
+];
+var POSTGREST_DESIRED_STATES = ["running", "stopped"];
+var POSTGREST_ACTUAL_STATES = ["running", "stopped", "starting", "error"];
+var POSTGREST_HEALTH_STATES = ["healthy", "unhealthy", "unknown"];
+function isRecord2(candidate) {
+  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
+}
+function hasExactKeys(candidate, expectedKeys) {
+  const actualKeys = Object.keys(candidate).sort();
+  const sortedExpectedKeys = [...expectedKeys].sort();
+  return actualKeys.length === sortedExpectedKeys.length && actualKeys.every((key, index) => key === sortedExpectedKeys[index]);
+}
+function isEnumMember(candidate, members) {
+  return typeof candidate === "string" && members.includes(candidate);
+}
+function isIsoTimestampOrNull(candidate) {
+  if (candidate === null)
+    return true;
+  if (typeof candidate !== "string")
+    return false;
+  const timestamp = Date.parse(candidate);
+  return Number.isFinite(timestamp) && new Date(timestamp).toISOString() === candidate;
+}
+function isRevisionOrNull(candidate) {
+  return candidate === null || typeof candidate === "string" && ATTESTED_REVISION_PATTERN.test(candidate);
+}
+function isBooleanOrNull(candidate) {
+  return candidate === null || typeof candidate === "boolean";
+}
+function isUnloadedSecretsState(candidate) {
+  return candidate.loaded_revision === null && candidate.load_source === null && candidate.matches_desired === null && candidate.loaded_at === null;
+}
+function isLoadedSecretsState(candidate) {
+  if (candidate.load_state === "current") {
+    return candidate.loaded_revision === candidate.desired_revision && candidate.load_source === "management_api" && candidate.matches_desired === true && candidate.loaded_at !== null;
+  }
+  return candidate.load_state === "stale" && candidate.loaded_revision !== null && candidate.loaded_revision !== candidate.desired_revision && candidate.load_source === "management_api" && candidate.matches_desired === false && candidate.loaded_at !== null;
+}
+function isUnverifiedSecretsState(candidate) {
+  if (candidate.load_state !== "unverified" || candidate.matches_desired !== null || candidate.loaded_at === null)
+    return false;
+  if (candidate.loaded_revision === candidate.desired_revision) {
+    return candidate.load_source === "management_api";
+  }
+  return candidate.loaded_revision === null && candidate.load_source !== null;
+}
+function hasValidSecretsState(candidate) {
+  if (candidate.load_state === "not_loaded" || candidate.load_state === "unreachable") {
+    return isUnloadedSecretsState(candidate);
+  }
+  return isLoadedSecretsState(candidate) || isUnverifiedSecretsState(candidate);
+}
+function isRuntimeSecretsSnapshot(payload) {
+  if (!isRecord2(payload) || !hasExactKeys(payload, SECRETS_KEYS))
+    return false;
+  if (!isRevisionOrNull(payload.loaded_revision) || typeof payload.desired_revision !== "string" || !ATTESTED_REVISION_PATTERN.test(payload.desired_revision) || !isEnumMember(payload.load_state, SECRET_LOAD_STATES) || !(payload.load_source === null || isEnumMember(payload.load_source, SECRET_LOAD_SOURCES)) || !isBooleanOrNull(payload.matches_desired) || !isIsoTimestampOrNull(payload.loaded_at))
+    return false;
+  return hasValidSecretsState(payload);
+}
+function hasConsistentRevisionMatch(candidate) {
+  if (candidate.loaded_revision === null)
+    return candidate.matches_desired === null;
+  return candidate.matches_desired === (candidate.loaded_revision === candidate.desired_revision);
+}
+function hasActivePostgrestProjection(candidate) {
+  return candidate.actual === "running" && candidate.health === "healthy" || candidate.actual === "error" && candidate.health === "unhealthy";
+}
+function hasValidPostgrestState(candidate) {
+  if (!hasConsistentRevisionMatch(candidate))
+    return false;
+  if (candidate.attestation_state === "loaded") {
+    return candidate.matches_desired === true && candidate.actual === "running" && candidate.health === "healthy" && candidate.loaded_at !== null;
+  }
+  if (candidate.attestation_state === "stale") {
+    return candidate.loaded_revision !== null && candidate.matches_desired === false && candidate.loaded_at !== null && hasActivePostgrestProjection(candidate);
+  }
+  if (candidate.attestation_state === "unverified_legacy")
+    return candidate.loaded_revision === null;
+  if (candidate.attestation_state === "stopped") {
+    return candidate.loaded_revision === null && candidate.actual === "stopped" && candidate.health === "unknown" && candidate.loaded_at === null;
+  }
+  if (candidate.attestation_state === "unreachable")
+    return candidate.loaded_revision === null;
+  return candidate.attestation_state === "drifted";
+}
+function isPostgrestRuntimeSnapshot(payload, projectRef) {
+  if (!isRecord2(payload) || !hasExactKeys(payload, POSTGREST_KEYS))
+    return false;
+  if (typeof payload.desired_revision !== "string" || !ATTESTED_REVISION_PATTERN.test(payload.desired_revision) || !isRevisionOrNull(payload.loaded_revision) || !isEnumMember(payload.attestation_state, POSTGREST_ATTESTATION_STATES) || !isBooleanOrNull(payload.matches_desired) || !isEnumMember(payload.desired, POSTGREST_DESIRED_STATES) || !isEnumMember(payload.actual, POSTGREST_ACTUAL_STATES) || !isEnumMember(payload.health, POSTGREST_HEALTH_STATES) || !Number.isSafeInteger(payload.port) || Number(payload.port) < 1 || Number(payload.port) > 65535 || payload.unit !== `supacloud-pgrst@${projectRef}` || !isIsoTimestampOrNull(payload.loaded_at))
+    return false;
+  return hasValidPostgrestState(payload);
+}
+function sanitizedSnapshot(snapshot) {
+  return {
+    schema: snapshot.schema,
+    project_ref: snapshot.project_ref,
+    captured_at: snapshot.captured_at,
+    secrets: { ...snapshot.secrets },
+    postgrest: { ...snapshot.postgrest }
+  };
+}
+function hasCausalLoadTimestamps(snapshot) {
+  const capturedAt = Date.parse(snapshot.captured_at);
+  return [snapshot.secrets.loaded_at, snapshot.postgrest.loaded_at].every((loadedAt) => loadedAt === null || Date.parse(loadedAt) <= capturedAt);
+}
+function parseProjectRuntimeSnapshot(payload, requestedProjectRef2) {
+  if (!SAFE_PROJECT_REF2.test(requestedProjectRef2) || !isRecord2(payload) || !hasExactKeys(payload, SNAPSHOT_KEYS) || payload.schema !== RUNTIME_SNAPSHOT_SCHEMA || payload.project_ref !== requestedProjectRef2 || !isIsoTimestampOrNull(payload.captured_at) || payload.captured_at === null || !isRuntimeSecretsSnapshot(payload.secrets) || !isPostgrestRuntimeSnapshot(payload.postgrest, requestedProjectRef2))
+    return null;
+  const snapshot = payload;
+  return hasCausalLoadTimestamps(snapshot) ? sanitizedSnapshot(snapshot) : null;
+}
+
 // src/shared/tools/project-cli-tools.ts
 var PROJECT_SERVICE_NAMES = [
   "postgrest",
@@ -29748,9 +30231,10 @@ var STUDIO_PROJECT_SERVICE_STATUSES = [
 ];
 var AUTH_RUNTIME_MANAGED_BY_OWNER = "AUTH_RUNTIME_MANAGED_BY_OWNER";
 var AUTH_SERVICE_HOST_SUFFIX = "-auth";
-var SAFE_PROJECT_REF2 = /^[a-z0-9-]{1,20}$/;
+var SAFE_PROJECT_REF3 = /^[a-z0-9-]{1,20}$/;
 var SAFE_AUTHORITY_PROJECT_REF = /^[A-Za-z0-9_-]{1,20}$/;
 var MAX_SERVICE_CONTROL_MESSAGE_LENGTH = 256;
+var MAX_RUNTIME_SNAPSHOT_BYTES = 64 * 1024;
 var RELEASE_CONTROL_RESPONSE_SCHEMA = "supacloud.cli.release-control.v1";
 var PROJECT_CREATE_OPERATION = "project.create";
 var PROJECT_ENVIRONMENTS = ["test", "production"];
@@ -29766,6 +30250,10 @@ var SUPPORTED_PROJECT_SERVICE_ACTIONS = {
 function projectToolResponse(text) {
   return { content: [{ type: "text", text }] };
 }
+function projectReadResponse(readResult) {
+  const response = projectToolResponse(readResult.text);
+  return readResult.isError ? { ...response, isError: true } : response;
+}
 function failedProjectServiceResponse(message) {
   return {
     content: [{ type: "text", text: `❌ ${message}` }],
@@ -29960,7 +30448,7 @@ function projectServiceStatusOutput(status) {
 function projectServicesResponse(projectRef, response) {
   if (!response.ok)
     return failedProjectServiceHttpResponse(response);
-  if (!SAFE_PROJECT_REF2.test(projectRef) || !Array.isArray(response.data) || response.data.length !== 5) {
+  if (!SAFE_PROJECT_REF3.test(projectRef) || !Array.isArray(response.data) || response.data.length !== 5) {
     return failedProjectServiceResponse("Project service inventory response is invalid");
   }
   if (!response.data.every((service) => isProjectServiceStatus(service, projectRef))) {
@@ -29973,6 +30461,15 @@ function projectServicesResponse(projectRef, response) {
   const services = response.data.map(projectServiceStatusOutput);
   return projectToolResponse(JSON.stringify({ project_ref: projectRef, services }, null, 2));
 }
+function projectRuntimeSnapshotResponse(projectRef, response) {
+  if (response.responseError) {
+    return failedProjectServiceResponse("Project runtime snapshot response is invalid");
+  }
+  if (!response.ok)
+    return failedProjectServiceHttpResponse(response);
+  const snapshot = parseProjectRuntimeSnapshot(response.data, projectRef);
+  return snapshot ? projectToolResponse(JSON.stringify(snapshot, null, 2)) : failedProjectServiceResponse("Project runtime snapshot response is invalid");
+}
 function supportsProjectServiceAction(service, action) {
   return SUPPORTED_PROJECT_SERVICE_ACTIONS[service].includes(action);
 }
@@ -30046,7 +30543,7 @@ function resolveRef(refFromArgs, defaultRef) {
 }
 function registerAdminProjectCliTools(server, http, options = {}) {
   const fileOperations = options.projectEnvFileOperations;
-  server.tool("project", "Platform-level project lifecycle management. Actions: list, create, get, delete, pause, restore, restart, settings, update_settings, api_keys, health, logs, tasks, services, service_control", {
+  server.tool("project", "Platform-level project lifecycle management. Actions: list, create, get, delete, pause, restore, restart, settings, update_settings, api_keys, health, logs, tasks, services, runtime_snapshot, service_control", {
     action: withDescription(stringEnum([
       "list",
       "create",
@@ -30062,6 +30559,7 @@ function registerAdminProjectCliTools(server, http, options = {}) {
       "logs",
       "tasks",
       "services",
+      "runtime_snapshot",
       "service_control"
     ]), "Action to perform"),
     ref: optional(Type.String(), "[*] Project ref (required for most actions except 'list' and 'create')"),
@@ -30098,8 +30596,9 @@ function registerAdminProjectCliTools(server, http, options = {}) {
     let text;
     switch (action) {
       case "list":
-        text = ok(await http.get("/v1/projects"));
-        break;
+        return projectReadResponse(projectListRead(await http.get("/v1/projects", {
+          maxResponseBytes: PROJECT_READ_RESPONSE_MAX_BYTES
+        })));
       case "create": {
         if (!name)
           throw new Error("'name' is required for create");
@@ -30137,9 +30636,12 @@ function registerAdminProjectCliTools(server, http, options = {}) {
           createRequest.credential_delivery = "response";
         return projectCreateResponse(await http.post("/v1/projects", createRequest), preparedEnvFile, { projectName: name, apiOrigin: boundApiOrigin }, fileOperations);
       }
-      case "get":
-        text = ok(await http.get(`/v1/projects/${resolveRef(ref)}`));
-        break;
+      case "get": {
+        const resolvedRef = resolveRef(ref);
+        return projectReadResponse(projectGetRead(await http.get(`/v1/projects/${resolvedRef}`, {
+          maxResponseBytes: PROJECT_READ_RESPONSE_MAX_BYTES
+        }), resolvedRef));
+      }
       case "delete": {
         const resolvedRef = resolveRef(ref);
         text = simple(await http.delete(`/v1/projects/${resolvedRef}`), `Project ${resolvedRef} deleted`);
@@ -30191,6 +30693,10 @@ function registerAdminProjectCliTools(server, http, options = {}) {
         const resolvedRef = resolveRef(ref);
         return projectServicesResponse(resolvedRef, await http.get(`/v1/projects/${encodeURIComponent(resolvedRef)}/services`));
       }
+      case "runtime_snapshot": {
+        const resolvedRef = resolveRef(ref);
+        return projectRuntimeSnapshotResponse(resolvedRef, await http.get(`/v1/projects/${encodeURIComponent(resolvedRef)}/runtime-snapshot`, { maxJsonBytes: MAX_RUNTIME_SNAPSHOT_BYTES }));
+      }
       case "service_control": {
         const resolvedRef = resolveRef(ref);
         if (!service)
@@ -30543,7 +31049,7 @@ Actions: routes, upsert_route, update_route, delete_route, config, get_certifica
 // package.json
 var package_default = {
   name: "@supacloud/admin",
-  version: "0.10.2",
+  version: "0.12.0",
   description: "Platform administration CLI for SupaCloud operators",
   type: "module",
   main: "./dist/index.js",
@@ -30675,6 +31181,7 @@ EXAMPLES
   supacloud-admin project create --name my-app --domain example.com --env_file /secure/path/.env.project-credentials.test --environment test
   supacloud-admin project list
   supacloud-admin project services --ref abc123
+  supacloud-admin project runtime_snapshot --ref abc123
   supacloud-admin project service_control --ref abc123 --service gotrue --service_action stop
   supacloud-admin platform metrics
   supacloud-admin gateway routes --ref abc123

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.10.2",
+  "version": "0.12.0",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",