@supacloud/admin 0.14.1 → 0.14.2

package/dist/index.js

@@ -27252,7 +27252,7 @@ function buildRemotePreflightScript() {
     "export PATH",
     trustedInstalledGithubFunction(),
     "test -d /run/systemd/system || { echo 'systemd is not the active init system' >&2; exit 1; }",
-    'for tool in systemctl systemd-run sha256sum stat realpath tar file find sort awk grep tail timeout flock; do command -v "$tool" >/dev/null 2>&1 || { echo "Required local-upgrade tool is missing: $tool" >&2; exit 127; }; done',
+    'for tool in systemctl systemd-run sha256sum stat realpath tar file find sort awk grep tail timeout flock install mktemp; do command -v "$tool" >/dev/null 2>&1 || { echo "Required local-upgrade tool is missing: $tool" >&2; exit 127; }; done',
     "tail -n 0 -- /dev/null >/dev/null 2>&1 || { echo 'A tail implementation with -n and -- support is required' >&2; exit 1; }",
     "systemd-run --help | grep -Eq -- '(^|[[:space:]])--collect([=[:space:]]|$)' || { echo 'systemd-run --collect is required' >&2; exit 1; }",
     "test -d /run/lock || { echo '/run/lock is unavailable' >&2; exit 1; }",
@@ -27328,6 +27328,54 @@ async function uploadBundleFiles(ssh, paths, bundle) {
     await ssh.upload(upload.localPath, `${paths.drop}/${upload.relativePath}`, { mode: 384, timeoutMs: 10 * 60000 });
   }
 }
+function managementRunnerFile(bundle) {
+  const relativePath = `bundle/management-api/${bundle.managementBinaryName}`;
+  const runner = bundle.files.find((file) => file.relativePath === relativePath);
+  if (!runner)
+    throw new Error(`Local upgrade bundle is missing ${relativePath}`);
+  return runner;
+}
+function targetRunnerCapabilityCommands() {
+  return [
+    'RUNNER=$(mktemp "$DROP/.runner-capability.XXXXXX")',
+    `trap 'rm -f -- "$RUNNER"' EXIT`,
+    `trap 'trap - EXIT HUP INT TERM; rm -f -- "$RUNNER"; exit 1' HUP INT TERM`,
+    'install -m 0700 "$RUNNER_ASSET" "$RUNNER"',
+    `test "$(sha256sum "$RUNNER" | awk '{print $1}')" = "$EXPECTED_SHA256"`,
+    'VERSION_OUTPUT=$(timeout 5s "$RUNNER" --version 2>&1)',
+    `[[ "$VERSION_OUTPUT" =~ ^SupaCloud[[:space:]]Version:[[:space:]]\${EXPECTED_VERSION//./\\.}$ ]] || { echo 'Target Management runner version mismatch' >&2; exit 1; }`,
+    'SYSTEMD_HELPER_OUTPUT=$(timeout 5s "$RUNNER" --systemd-unit-helper-sha256 2>&1)',
+    `[[ "$SYSTEMD_HELPER_OUTPUT" =~ ^SupaCloud[[:space:]]systemd-unit[[:space:]]helper[[:space:]]SHA-256:[[:space:]][0-9a-f]{64}$ ]] || { echo 'Target Management runner lacks systemd-unit helper delivery' >&2; exit 1; }`,
+    'POSTGREST_LAUNCHER_OUTPUT=$(timeout 5s "$RUNNER" --postgrest-launcher-sha256 2>&1)',
+    `[[ "$POSTGREST_LAUNCHER_OUTPUT" =~ ^SupaCloud[[:space:]]PostgREST[[:space:]]launcher[[:space:]]SHA-256:[[:space:]][0-9a-f]{64}$ ]] || { echo 'Target Management runner lacks PostgREST launcher delivery' >&2; exit 1; }`,
+    'rm -f -- "$RUNNER"',
+    "trap - EXIT HUP INT TERM"
+  ];
+}
+function buildTargetRunnerCapabilityScript(paths, bundle, request) {
+  const runnerFile = managementRunnerFile(bundle);
+  const runnerAsset = `${paths.drop}/${runnerFile.relativePath}`;
+  return [
+    "set -euo pipefail",
+    "umask 077",
+    `DROP=${quoteShell2(paths.drop)}`,
+    `RUNNER_ASSET=${quoteShell2(runnerAsset)}`,
+    `EXPECTED_SIZE=${runnerFile.size}`,
+    `EXPECTED_SHA256=${quoteShell2(runnerFile.sha256)}`,
+    `EXPECTED_VERSION=${quoteShell2(request.managementVersion)}`,
+    `test -f "$RUNNER_ASSET" && test ! -L "$RUNNER_ASSET" && test "$(stat -c '%h' "$RUNNER_ASSET")" = 1 || { echo 'Target Management runner is not a direct single-link file' >&2; exit 1; }`,
+    `test "$(stat -c '%s' "$RUNNER_ASSET")" = "$EXPECTED_SIZE"`,
+    `test "$(sha256sum "$RUNNER_ASSET" | awk '{print $1}')" = "$EXPECTED_SHA256"`,
+    ...targetRunnerCapabilityCommands()
+  ].join(`
+`);
+}
+async function verifyTargetRunnerCapability(ssh, paths, bundle, request) {
+  const verified = await ssh.exec(buildTargetRunnerCapabilityScript(paths, bundle, request), 30000);
+  if (!verified.success) {
+    throw remoteFailure("Target Management runner lacks required transactional helper delivery", verified);
+  }
+}
 function expectedComponentFiles(bundle) {
   return {
     management: [
@@ -27475,6 +27523,7 @@ function upgradeScriptExecution(paths, bundle, request) {
     `test "$(sha256sum "$RUNNER"|awk '{print $1}')" = "$(sha256sum "$RUNNER_ASSET"|awk '{print $1}')"`,
     '"$RUNNER" --version | grep -Eq "(^|[^0-9])${MANAGEMENT_VERSION//./\\.}([^0-9]|$)"',
     `timeout 5s "$RUNNER" --systemd-unit-helper-sha256 | grep -Eq 'SupaCloud systemd-unit helper SHA-256: [0-9a-f]{64}'`,
+    `timeout 5s "$RUNNER" --postgrest-launcher-sha256 | grep -Eq 'SupaCloud PostgREST launcher SHA-256: [0-9a-f]{64}'`,
     `env PATH="$VERIFIER_PATH:$PATH" "$RUNNER" upgrade --yes --target-version ${quoteShell2(request.managementVersion)} --edge-runtime-version ${quoteShell2(request.edgeRuntimeVersion)} --asset-bundle-dir "$BUNDLE"`
   ];
 }
@@ -27867,6 +27916,7 @@ async function executeLocalUpgradeTransfer(ssh, request) {
     try {
       await prepareRemoteDrop(ssh, paths, bundle);
       await uploadBundleFiles(ssh, paths, bundle);
+      await verifyTargetRunnerCapability(ssh, paths, bundle, request);
       await uploadRunScript(ssh, paths, bundle, request, preflight.architecture);
       await adoptRemoteDrop(ssh, paths);
       adopted = true;
@@ -28077,10 +28127,13 @@ function componentBootstrapCommands(request) {
     `supacloud_download_release_asset "$MANAGEMENT_RELEASE" "$MANAGEMENT_ASSET" "$STAGED_MANAGEMENT" binary`,
     `chmod 0755 "$STAGED_MANAGEMENT"`,
     `TARGET_MANAGEMENT_VERSION=$(jq -er '.tag_name | capture("^management-api-v(?<version>(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*))$").version' <<< "$MANAGEMENT_RELEASE")`,
-    `STAGED_VERSION=$("$STAGED_MANAGEMENT" --version 2>&1 | grep -Eo '[0-9]+\\.[0-9]+\\.[0-9]+' | head -1 || true)`,
+    `STAGED_VERSION=$(timeout 5s "$STAGED_MANAGEMENT" --version 2>&1 | grep -Eo '[0-9]+\\.[0-9]+\\.[0-9]+' | head -1 || true)`,
     `test "$STAGED_VERSION" = "$TARGET_MANAGEMENT_VERSION" || { echo 'Target Management binary version does not match its verified release' >&2; exit 1; }`,
     `supacloud_version_at_least "$STAGED_VERSION" ${quoteEnvValue(MINIMUM_COMPONENT_UPGRADE_VERSION)} || { echo 'Target Management release lacks component transaction capability' >&2; exit 1; }`,
-    `"$STAGED_MANAGEMENT" --systemd-unit-helper-sha256 >/dev/null 2>&1 || { echo 'Target Management release lacks target-bound systemd-unit helper delivery' >&2; exit 1; }`,
+    `SYSTEMD_HELPER_OUTPUT=$(timeout 5s "$STAGED_MANAGEMENT" --systemd-unit-helper-sha256 2>&1)`,
+    `[[ "$SYSTEMD_HELPER_OUTPUT" =~ ^SupaCloud[[:space:]]systemd-unit[[:space:]]helper[[:space:]]SHA-256:[[:space:]][0-9a-f]{64}$ ]] || { echo 'Target Management release lacks target-bound systemd-unit helper delivery' >&2; exit 1; }`,
+    `POSTGREST_LAUNCHER_OUTPUT=$(timeout 5s "$STAGED_MANAGEMENT" --postgrest-launcher-sha256 2>&1)`,
+    `[[ "$POSTGREST_LAUNCHER_OUTPUT" =~ ^SupaCloud[[:space:]]PostgREST[[:space:]]launcher[[:space:]]SHA-256:[[:space:]][0-9a-f]{64}$ ]] || { echo 'Target Management release lacks target-bound PostgREST launcher delivery' >&2; exit 1; }`,
     `UPGRADE_RUNNER="$STAGED_MANAGEMENT"`
   ];
 }
@@ -28127,7 +28180,7 @@ function buildRootUpgradeScript(request) {
     "export PATH",
     "unset SUPACLOUD_ALLOW_UNVERIFIED_RELEASE SUPACLOUD_GITHUB_REPOSITORY SUPACLOUD_RELEASES_API SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW SUPACLOUD_ATTESTATION_TRUSTED_ROOT SUPACLOUD_GH_VERSION SUPACLOUD_GH_MIN_VERSION SUPACLOUD_GH_AMD64_SHA256 SUPACLOUD_GH_ARM64_SHA256 GH_PROXY",
     request.githubProxy ? `export SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(request.githubProxy)}` : "unset SUPACLOUD_GITHUB_PROXY SUPACLOUD_GITHUB_PROXIES",
-    'for tool in curl jq file sha256sum stat tar flock find sort chown; do command -v "$tool" >/dev/null 2>&1 || { echo "Required upgrade tool is missing: $tool" >&2; exit 127; }; done',
+    'for tool in curl jq file sha256sum stat tar flock find sort chown timeout; do command -v "$tool" >/dev/null 2>&1 || { echo "Required upgrade tool is missing: $tool" >&2; exit 127; }; done',
     "test -d /run/lock || { echo '/run/lock is unavailable' >&2; exit 1; }",
     "test -x /usr/local/bin/supacloud || { echo 'SupaCloud binary not found at /usr/local/bin/supacloud; run ssh install first.' >&2; exit 127; }",
     ...trustedRootPreflightCommands(request.helperPath),
@@ -31843,7 +31896,7 @@ Actions: list_releases, get_release, upload_release, activate_release`, {
 // package.json
 var package_default = {
   name: "@supacloud/admin",
-  version: "0.14.1",
+  version: "0.14.2",
   description: "Platform administration CLI for SupaCloud operators",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.14.1",
+  "version": "0.14.2",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",