@supacloud/admin 0.14.0 → 0.14.2

package/README.md

@@ -157,8 +157,9 @@ upload-drop paths for reconciliation. Inspect that evidence before retrying and
 do not retry blindly while the remote transaction may still be running.
 
 `--artifact_transport local` accepts only `--github_proxy direct` or `none` and
-clears proxy environment variables on both hosts. The legacy server-download
-path remains available as `--artifact_transport remote`.
+clears proxy environment variables on both hosts. The server-download path
+remains available as `--artifact_transport remote`; it verifies and executes
+the target Management release as the runner even for Management-only upgrades.
 
 With `--artifact_transport remote` (the default), omitting
 `--edge_runtime_version` retains the Management and Web Console-only upgrade
@@ -175,14 +176,10 @@ command may finish later and then run its own cleanup. Reconcile the reported
 helper and trusted-root paths and read back deployed versions before deciding
 whether to retry.
 
-After a capable Management release is active, an exact rollback can use that
-active upgrader with explicit older targets, for example:
-
-```bash
-npx @supacloud/admin ssh upgrade \
-  --version 0.50.26 \
-  --edge_runtime_version 0.16.6
-```
+Targets predating the target-bound systemd-unit helper identity command are
+rejected before mutation. A failed transaction still restores its exact frozen
+prior Management/helper/Web identities; an intentional downgrade to a legacy
+release requires a separately reviewed compatibility procedure.
 
 Project commands owned by this CLI:
 

package/dist/index.js

@@ -4759,7 +4759,7 @@ var require_utils = __commonJS((exports, module) => {
 
 // node_modules/ssh2/lib/protocol/crypto/build/Release/sshcrypto.node
 var require_sshcrypto = __commonJS((exports, module) => {
-  module.exports = __require("./sshcrypto-8m50vnmb.node");
+  module.exports = __require("./sshcrypto-vd2k5hq9.node");
 });
 
 // node_modules/ssh2/lib/protocol/crypto/poly1305.js
@@ -27252,7 +27252,7 @@ function buildRemotePreflightScript() {
     "export PATH",
     trustedInstalledGithubFunction(),
     "test -d /run/systemd/system || { echo 'systemd is not the active init system' >&2; exit 1; }",
-    'for tool in systemctl systemd-run sha256sum stat realpath tar file find sort awk grep tail timeout flock; do command -v "$tool" >/dev/null 2>&1 || { echo "Required local-upgrade tool is missing: $tool" >&2; exit 127; }; done',
+    'for tool in systemctl systemd-run sha256sum stat realpath tar file find sort awk grep tail timeout flock install mktemp; do command -v "$tool" >/dev/null 2>&1 || { echo "Required local-upgrade tool is missing: $tool" >&2; exit 127; }; done',
     "tail -n 0 -- /dev/null >/dev/null 2>&1 || { echo 'A tail implementation with -n and -- support is required' >&2; exit 1; }",
     "systemd-run --help | grep -Eq -- '(^|[[:space:]])--collect([=[:space:]]|$)' || { echo 'systemd-run --collect is required' >&2; exit 1; }",
     "test -d /run/lock || { echo '/run/lock is unavailable' >&2; exit 1; }",
@@ -27328,6 +27328,54 @@ async function uploadBundleFiles(ssh, paths, bundle) {
     await ssh.upload(upload.localPath, `${paths.drop}/${upload.relativePath}`, { mode: 384, timeoutMs: 10 * 60000 });
   }
 }
+function managementRunnerFile(bundle) {
+  const relativePath = `bundle/management-api/${bundle.managementBinaryName}`;
+  const runner = bundle.files.find((file) => file.relativePath === relativePath);
+  if (!runner)
+    throw new Error(`Local upgrade bundle is missing ${relativePath}`);
+  return runner;
+}
+function targetRunnerCapabilityCommands() {
+  return [
+    'RUNNER=$(mktemp "$DROP/.runner-capability.XXXXXX")',
+    `trap 'rm -f -- "$RUNNER"' EXIT`,
+    `trap 'trap - EXIT HUP INT TERM; rm -f -- "$RUNNER"; exit 1' HUP INT TERM`,
+    'install -m 0700 "$RUNNER_ASSET" "$RUNNER"',
+    `test "$(sha256sum "$RUNNER" | awk '{print $1}')" = "$EXPECTED_SHA256"`,
+    'VERSION_OUTPUT=$(timeout 5s "$RUNNER" --version 2>&1)',
+    `[[ "$VERSION_OUTPUT" =~ ^SupaCloud[[:space:]]Version:[[:space:]]\${EXPECTED_VERSION//./\\.}$ ]] || { echo 'Target Management runner version mismatch' >&2; exit 1; }`,
+    'SYSTEMD_HELPER_OUTPUT=$(timeout 5s "$RUNNER" --systemd-unit-helper-sha256 2>&1)',
+    `[[ "$SYSTEMD_HELPER_OUTPUT" =~ ^SupaCloud[[:space:]]systemd-unit[[:space:]]helper[[:space:]]SHA-256:[[:space:]][0-9a-f]{64}$ ]] || { echo 'Target Management runner lacks systemd-unit helper delivery' >&2; exit 1; }`,
+    'POSTGREST_LAUNCHER_OUTPUT=$(timeout 5s "$RUNNER" --postgrest-launcher-sha256 2>&1)',
+    `[[ "$POSTGREST_LAUNCHER_OUTPUT" =~ ^SupaCloud[[:space:]]PostgREST[[:space:]]launcher[[:space:]]SHA-256:[[:space:]][0-9a-f]{64}$ ]] || { echo 'Target Management runner lacks PostgREST launcher delivery' >&2; exit 1; }`,
+    'rm -f -- "$RUNNER"',
+    "trap - EXIT HUP INT TERM"
+  ];
+}
+function buildTargetRunnerCapabilityScript(paths, bundle, request) {
+  const runnerFile = managementRunnerFile(bundle);
+  const runnerAsset = `${paths.drop}/${runnerFile.relativePath}`;
+  return [
+    "set -euo pipefail",
+    "umask 077",
+    `DROP=${quoteShell2(paths.drop)}`,
+    `RUNNER_ASSET=${quoteShell2(runnerAsset)}`,
+    `EXPECTED_SIZE=${runnerFile.size}`,
+    `EXPECTED_SHA256=${quoteShell2(runnerFile.sha256)}`,
+    `EXPECTED_VERSION=${quoteShell2(request.managementVersion)}`,
+    `test -f "$RUNNER_ASSET" && test ! -L "$RUNNER_ASSET" && test "$(stat -c '%h' "$RUNNER_ASSET")" = 1 || { echo 'Target Management runner is not a direct single-link file' >&2; exit 1; }`,
+    `test "$(stat -c '%s' "$RUNNER_ASSET")" = "$EXPECTED_SIZE"`,
+    `test "$(sha256sum "$RUNNER_ASSET" | awk '{print $1}')" = "$EXPECTED_SHA256"`,
+    ...targetRunnerCapabilityCommands()
+  ].join(`
+`);
+}
+async function verifyTargetRunnerCapability(ssh, paths, bundle, request) {
+  const verified = await ssh.exec(buildTargetRunnerCapabilityScript(paths, bundle, request), 30000);
+  if (!verified.success) {
+    throw remoteFailure("Target Management runner lacks required transactional helper delivery", verified);
+  }
+}
 function expectedComponentFiles(bundle) {
   return {
     management: [
@@ -27474,6 +27522,8 @@ function upgradeScriptExecution(paths, bundle, request) {
     'install -m 0755 "$RUNNER_ASSET" "$RUNNER"',
     `test "$(sha256sum "$RUNNER"|awk '{print $1}')" = "$(sha256sum "$RUNNER_ASSET"|awk '{print $1}')"`,
     '"$RUNNER" --version | grep -Eq "(^|[^0-9])${MANAGEMENT_VERSION//./\\.}([^0-9]|$)"',
+    `timeout 5s "$RUNNER" --systemd-unit-helper-sha256 | grep -Eq 'SupaCloud systemd-unit helper SHA-256: [0-9a-f]{64}'`,
+    `timeout 5s "$RUNNER" --postgrest-launcher-sha256 | grep -Eq 'SupaCloud PostgREST launcher SHA-256: [0-9a-f]{64}'`,
     `env PATH="$VERIFIER_PATH:$PATH" "$RUNNER" upgrade --yes --target-version ${quoteShell2(request.managementVersion)} --edge-runtime-version ${quoteShell2(request.edgeRuntimeVersion)} --asset-bundle-dir "$BUNDLE"`
   ];
 }
@@ -27866,6 +27916,7 @@ async function executeLocalUpgradeTransfer(ssh, request) {
     try {
       await prepareRemoteDrop(ssh, paths, bundle);
       await uploadBundleFiles(ssh, paths, bundle);
+      await verifyTargetRunnerCapability(ssh, paths, bundle, request);
       await uploadRunScript(ssh, paths, bundle, request, preflight.architecture);
       await adoptRemoteDrop(ssh, paths);
       adopted = true;
@@ -28060,30 +28111,30 @@ function assertExactStableVersion2(value, fieldName) {
   }
   return value;
 }
-function upgradeEnvAssignments(request) {
+function upgradeTransactionEnvAssignments(request) {
   return [
-    request.version ? `SUPACLOUD_UPGRADE_TAG=${quoteEnvValue(request.version)}` : "",
+    'SUPACLOUD_UPGRADE_TAG="$TARGET_MANAGEMENT_VERSION"',
     request.edgeRuntimeVersion ? `SUPACLOUD_EDGE_RUNTIME_UPGRADE_TAG=${quoteEnvValue(request.edgeRuntimeVersion)}` : "",
     request.githubProxy ? `SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(request.githubProxy)}` : ""
   ].filter(Boolean).join(" ");
 }
 function componentBootstrapCommands(request) {
-  if (!request.edgeRuntimeVersion)
-    return [`UPGRADE_RUNNER=${quoteEnvValue("/usr/local/bin/supacloud")}`];
   const managementVersion = request.version || "latest";
   return [
-    `ACTIVE_VERSION=$(/usr/local/bin/supacloud --version 2>&1 | grep -Eo '[0-9]+\\.[0-9]+\\.[0-9]+' | head -1 || true)`,
-    `UPGRADE_RUNNER=${quoteEnvValue("/usr/local/bin/supacloud")}`,
-    `if ! supacloud_version_at_least "$ACTIVE_VERSION" ${quoteEnvValue(MINIMUM_COMPONENT_UPGRADE_VERSION)}; then`,
-    `  case "$(uname -m)" in x86_64|amd64) MANAGEMENT_ASSET=supacloud-linux-amd64 ;; aarch64|arm64) MANAGEMENT_ASSET=supacloud-linux-arm64 ;; *) echo 'Unsupported Management architecture' >&2; exit 1 ;; esac`,
-    `  STAGED_MANAGEMENT=$(mktemp /tmp/supacloud-management-upgrade.XXXXXX)`,
-    `  MANAGEMENT_RELEASE=$(supacloud_fetch_component_release management-api ${quoteEnvValue(managementVersion)} "$MANAGEMENT_ASSET" web-console-build.tar.gz)`,
-    `  supacloud_download_release_asset "$MANAGEMENT_RELEASE" "$MANAGEMENT_ASSET" "$STAGED_MANAGEMENT" binary`,
-    `  chmod 0755 "$STAGED_MANAGEMENT"`,
-    `  STAGED_VERSION=$("$STAGED_MANAGEMENT" --version 2>&1 | grep -Eo '[0-9]+\\.[0-9]+\\.[0-9]+' | head -1 || true)`,
-    `  supacloud_version_at_least "$STAGED_VERSION" ${quoteEnvValue(MINIMUM_COMPONENT_UPGRADE_VERSION)} || { echo 'Target Management release lacks Edge Runtime transaction capability' >&2; exit 1; }`,
-    `  UPGRADE_RUNNER="$STAGED_MANAGEMENT"`,
-    "fi"
+    `case "$(uname -m)" in x86_64|amd64) MANAGEMENT_ASSET=supacloud-linux-amd64 ;; aarch64|arm64) MANAGEMENT_ASSET=supacloud-linux-arm64 ;; *) echo 'Unsupported Management architecture' >&2; exit 1 ;; esac`,
+    `STAGED_MANAGEMENT=$(mktemp /tmp/supacloud-management-upgrade.XXXXXX)`,
+    `MANAGEMENT_RELEASE=$(supacloud_fetch_component_release management-api ${quoteEnvValue(managementVersion)} "$MANAGEMENT_ASSET" web-console-build.tar.gz)`,
+    `supacloud_download_release_asset "$MANAGEMENT_RELEASE" "$MANAGEMENT_ASSET" "$STAGED_MANAGEMENT" binary`,
+    `chmod 0755 "$STAGED_MANAGEMENT"`,
+    `TARGET_MANAGEMENT_VERSION=$(jq -er '.tag_name | capture("^management-api-v(?<version>(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*))$").version' <<< "$MANAGEMENT_RELEASE")`,
+    `STAGED_VERSION=$(timeout 5s "$STAGED_MANAGEMENT" --version 2>&1 | grep -Eo '[0-9]+\\.[0-9]+\\.[0-9]+' | head -1 || true)`,
+    `test "$STAGED_VERSION" = "$TARGET_MANAGEMENT_VERSION" || { echo 'Target Management binary version does not match its verified release' >&2; exit 1; }`,
+    `supacloud_version_at_least "$STAGED_VERSION" ${quoteEnvValue(MINIMUM_COMPONENT_UPGRADE_VERSION)} || { echo 'Target Management release lacks component transaction capability' >&2; exit 1; }`,
+    `SYSTEMD_HELPER_OUTPUT=$(timeout 5s "$STAGED_MANAGEMENT" --systemd-unit-helper-sha256 2>&1)`,
+    `[[ "$SYSTEMD_HELPER_OUTPUT" =~ ^SupaCloud[[:space:]]systemd-unit[[:space:]]helper[[:space:]]SHA-256:[[:space:]][0-9a-f]{64}$ ]] || { echo 'Target Management release lacks target-bound systemd-unit helper delivery' >&2; exit 1; }`,
+    `POSTGREST_LAUNCHER_OUTPUT=$(timeout 5s "$STAGED_MANAGEMENT" --postgrest-launcher-sha256 2>&1)`,
+    `[[ "$POSTGREST_LAUNCHER_OUTPUT" =~ ^SupaCloud[[:space:]]PostgREST[[:space:]]launcher[[:space:]]SHA-256:[[:space:]][0-9a-f]{64}$ ]] || { echo 'Target Management release lacks target-bound PostgREST launcher delivery' >&2; exit 1; }`,
+    `UPGRADE_RUNNER="$STAGED_MANAGEMENT"`
   ];
 }
 function componentPreflightCommands(request) {
@@ -28121,7 +28172,7 @@ function trustedRootPreflightCommands(helperPath) {
   ];
 }
 function buildRootUpgradeScript(request) {
-  const envAssignments = upgradeEnvAssignments(request);
+  const envAssignments = upgradeTransactionEnvAssignments(request);
   return [
     "set -euo pipefail",
     "umask 077",
@@ -28129,7 +28180,7 @@ function buildRootUpgradeScript(request) {
     "export PATH",
     "unset SUPACLOUD_ALLOW_UNVERIFIED_RELEASE SUPACLOUD_GITHUB_REPOSITORY SUPACLOUD_RELEASES_API SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW SUPACLOUD_ATTESTATION_TRUSTED_ROOT SUPACLOUD_GH_VERSION SUPACLOUD_GH_MIN_VERSION SUPACLOUD_GH_AMD64_SHA256 SUPACLOUD_GH_ARM64_SHA256 GH_PROXY",
     request.githubProxy ? `export SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(request.githubProxy)}` : "unset SUPACLOUD_GITHUB_PROXY SUPACLOUD_GITHUB_PROXIES",
-    'for tool in curl jq file sha256sum stat tar flock find sort chown; do command -v "$tool" >/dev/null 2>&1 || { echo "Required upgrade tool is missing: $tool" >&2; exit 127; }; done',
+    'for tool in curl jq file sha256sum stat tar flock find sort chown timeout; do command -v "$tool" >/dev/null 2>&1 || { echo "Required upgrade tool is missing: $tool" >&2; exit 127; }; done',
     "test -d /run/lock || { echo '/run/lock is unavailable' >&2; exit 1; }",
     "test -x /usr/local/bin/supacloud || { echo 'SupaCloud binary not found at /usr/local/bin/supacloud; run ssh install first.' >&2; exit 127; }",
     ...trustedRootPreflightCommands(request.helperPath),
@@ -28142,7 +28193,7 @@ function buildRootUpgradeScript(request) {
     "if ! supacloud_attestation_verifier_available; then supacloud_install_pinned_gh /usr/local/bin/gh; fi",
     "supacloud_attestation_verifier_available || { echo 'Pinned GitHub attestation verifier is unavailable' >&2; exit 1; }",
     ...componentBootstrapCommands(request),
-    `${envAssignments ? `env ${envAssignments} ` : ""}"$UPGRADE_RUNNER" upgrade --yes`
+    `env ${envAssignments} "$UPGRADE_RUNNER" upgrade --yes`
   ].join(`
 `);
 }
@@ -31845,7 +31896,7 @@ Actions: list_releases, get_release, upload_release, activate_release`, {
 // package.json
 var package_default = {
   name: "@supacloud/admin",
-  version: "0.14.0",
+  version: "0.14.2",
   description: "Platform administration CLI for SupaCloud operators",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",