@supacloud/admin 0.14.0 → 0.14.1

package/README.md

@@ -157,8 +157,9 @@ upload-drop paths for reconciliation. Inspect that evidence before retrying and
 do not retry blindly while the remote transaction may still be running.
 
 `--artifact_transport local` accepts only `--github_proxy direct` or `none` and
-clears proxy environment variables on both hosts. The legacy server-download
-path remains available as `--artifact_transport remote`.
+clears proxy environment variables on both hosts. The server-download path
+remains available as `--artifact_transport remote`; it verifies and executes
+the target Management release as the runner even for Management-only upgrades.
 
 With `--artifact_transport remote` (the default), omitting
 `--edge_runtime_version` retains the Management and Web Console-only upgrade
@@ -175,14 +176,10 @@ command may finish later and then run its own cleanup. Reconcile the reported
 helper and trusted-root paths and read back deployed versions before deciding
 whether to retry.
 
-After a capable Management release is active, an exact rollback can use that
-active upgrader with explicit older targets, for example:
-
-```bash
-npx @supacloud/admin ssh upgrade \
-  --version 0.50.26 \
-  --edge_runtime_version 0.16.6
-```
+Targets predating the target-bound systemd-unit helper identity command are
+rejected before mutation. A failed transaction still restores its exact frozen
+prior Management/helper/Web identities; an intentional downgrade to a legacy
+release requires a separately reviewed compatibility procedure.
 
 Project commands owned by this CLI:
 

package/dist/index.js

@@ -4759,7 +4759,7 @@ var require_utils = __commonJS((exports, module) => {
 
 // node_modules/ssh2/lib/protocol/crypto/build/Release/sshcrypto.node
 var require_sshcrypto = __commonJS((exports, module) => {
-  module.exports = __require("./sshcrypto-8m50vnmb.node");
+  module.exports = __require("./sshcrypto-vd2k5hq9.node");
 });
 
 // node_modules/ssh2/lib/protocol/crypto/poly1305.js
@@ -27474,6 +27474,7 @@ function upgradeScriptExecution(paths, bundle, request) {
     'install -m 0755 "$RUNNER_ASSET" "$RUNNER"',
     `test "$(sha256sum "$RUNNER"|awk '{print $1}')" = "$(sha256sum "$RUNNER_ASSET"|awk '{print $1}')"`,
     '"$RUNNER" --version | grep -Eq "(^|[^0-9])${MANAGEMENT_VERSION//./\\.}([^0-9]|$)"',
+    `timeout 5s "$RUNNER" --systemd-unit-helper-sha256 | grep -Eq 'SupaCloud systemd-unit helper SHA-256: [0-9a-f]{64}'`,
     `env PATH="$VERIFIER_PATH:$PATH" "$RUNNER" upgrade --yes --target-version ${quoteShell2(request.managementVersion)} --edge-runtime-version ${quoteShell2(request.edgeRuntimeVersion)} --asset-bundle-dir "$BUNDLE"`
   ];
 }
@@ -28060,30 +28061,27 @@ function assertExactStableVersion2(value, fieldName) {
   }
   return value;
 }
-function upgradeEnvAssignments(request) {
+function upgradeTransactionEnvAssignments(request) {
   return [
-    request.version ? `SUPACLOUD_UPGRADE_TAG=${quoteEnvValue(request.version)}` : "",
+    'SUPACLOUD_UPGRADE_TAG="$TARGET_MANAGEMENT_VERSION"',
     request.edgeRuntimeVersion ? `SUPACLOUD_EDGE_RUNTIME_UPGRADE_TAG=${quoteEnvValue(request.edgeRuntimeVersion)}` : "",
     request.githubProxy ? `SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(request.githubProxy)}` : ""
   ].filter(Boolean).join(" ");
 }
 function componentBootstrapCommands(request) {
-  if (!request.edgeRuntimeVersion)
-    return [`UPGRADE_RUNNER=${quoteEnvValue("/usr/local/bin/supacloud")}`];
   const managementVersion = request.version || "latest";
   return [
-    `ACTIVE_VERSION=$(/usr/local/bin/supacloud --version 2>&1 | grep -Eo '[0-9]+\\.[0-9]+\\.[0-9]+' | head -1 || true)`,
-    `UPGRADE_RUNNER=${quoteEnvValue("/usr/local/bin/supacloud")}`,
-    `if ! supacloud_version_at_least "$ACTIVE_VERSION" ${quoteEnvValue(MINIMUM_COMPONENT_UPGRADE_VERSION)}; then`,
-    `  case "$(uname -m)" in x86_64|amd64) MANAGEMENT_ASSET=supacloud-linux-amd64 ;; aarch64|arm64) MANAGEMENT_ASSET=supacloud-linux-arm64 ;; *) echo 'Unsupported Management architecture' >&2; exit 1 ;; esac`,
-    `  STAGED_MANAGEMENT=$(mktemp /tmp/supacloud-management-upgrade.XXXXXX)`,
-    `  MANAGEMENT_RELEASE=$(supacloud_fetch_component_release management-api ${quoteEnvValue(managementVersion)} "$MANAGEMENT_ASSET" web-console-build.tar.gz)`,
-    `  supacloud_download_release_asset "$MANAGEMENT_RELEASE" "$MANAGEMENT_ASSET" "$STAGED_MANAGEMENT" binary`,
-    `  chmod 0755 "$STAGED_MANAGEMENT"`,
-    `  STAGED_VERSION=$("$STAGED_MANAGEMENT" --version 2>&1 | grep -Eo '[0-9]+\\.[0-9]+\\.[0-9]+' | head -1 || true)`,
-    `  supacloud_version_at_least "$STAGED_VERSION" ${quoteEnvValue(MINIMUM_COMPONENT_UPGRADE_VERSION)} || { echo 'Target Management release lacks Edge Runtime transaction capability' >&2; exit 1; }`,
-    `  UPGRADE_RUNNER="$STAGED_MANAGEMENT"`,
-    "fi"
+    `case "$(uname -m)" in x86_64|amd64) MANAGEMENT_ASSET=supacloud-linux-amd64 ;; aarch64|arm64) MANAGEMENT_ASSET=supacloud-linux-arm64 ;; *) echo 'Unsupported Management architecture' >&2; exit 1 ;; esac`,
+    `STAGED_MANAGEMENT=$(mktemp /tmp/supacloud-management-upgrade.XXXXXX)`,
+    `MANAGEMENT_RELEASE=$(supacloud_fetch_component_release management-api ${quoteEnvValue(managementVersion)} "$MANAGEMENT_ASSET" web-console-build.tar.gz)`,
+    `supacloud_download_release_asset "$MANAGEMENT_RELEASE" "$MANAGEMENT_ASSET" "$STAGED_MANAGEMENT" binary`,
+    `chmod 0755 "$STAGED_MANAGEMENT"`,
+    `TARGET_MANAGEMENT_VERSION=$(jq -er '.tag_name | capture("^management-api-v(?<version>(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*))$").version' <<< "$MANAGEMENT_RELEASE")`,
+    `STAGED_VERSION=$("$STAGED_MANAGEMENT" --version 2>&1 | grep -Eo '[0-9]+\\.[0-9]+\\.[0-9]+' | head -1 || true)`,
+    `test "$STAGED_VERSION" = "$TARGET_MANAGEMENT_VERSION" || { echo 'Target Management binary version does not match its verified release' >&2; exit 1; }`,
+    `supacloud_version_at_least "$STAGED_VERSION" ${quoteEnvValue(MINIMUM_COMPONENT_UPGRADE_VERSION)} || { echo 'Target Management release lacks component transaction capability' >&2; exit 1; }`,
+    `"$STAGED_MANAGEMENT" --systemd-unit-helper-sha256 >/dev/null 2>&1 || { echo 'Target Management release lacks target-bound systemd-unit helper delivery' >&2; exit 1; }`,
+    `UPGRADE_RUNNER="$STAGED_MANAGEMENT"`
   ];
 }
 function componentPreflightCommands(request) {
@@ -28121,7 +28119,7 @@ function trustedRootPreflightCommands(helperPath) {
   ];
 }
 function buildRootUpgradeScript(request) {
-  const envAssignments = upgradeEnvAssignments(request);
+  const envAssignments = upgradeTransactionEnvAssignments(request);
   return [
     "set -euo pipefail",
     "umask 077",
@@ -28142,7 +28140,7 @@ function buildRootUpgradeScript(request) {
     "if ! supacloud_attestation_verifier_available; then supacloud_install_pinned_gh /usr/local/bin/gh; fi",
     "supacloud_attestation_verifier_available || { echo 'Pinned GitHub attestation verifier is unavailable' >&2; exit 1; }",
     ...componentBootstrapCommands(request),
-    `${envAssignments ? `env ${envAssignments} ` : ""}"$UPGRADE_RUNNER" upgrade --yes`
+    `env ${envAssignments} "$UPGRADE_RUNNER" upgrade --yes`
   ].join(`
 `);
 }
@@ -31845,7 +31843,7 @@ Actions: list_releases, get_release, upload_release, activate_release`, {
 // package.json
 var package_default = {
   name: "@supacloud/admin",
-  version: "0.14.0",
+  version: "0.14.1",
   description: "Platform administration CLI for SupaCloud operators",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",