@supacloud/admin 0.14.1 → 0.14.3

package/dist/index.js

@@ -26376,7 +26376,7 @@ import { Transform as Transform2 } from "node:stream";
 var RELEASE_MANIFEST_NAME = "SUPACLOUD-RELEASE.json";
 var RELEASE_ATTESTATION_NAME = "SUPACLOUD-RELEASE.attestation.jsonl";
 var RELEASE_CHECKSUMS_NAME = "SHA256SUMS";
-var RELEASE_REPOSITORY = "zuohuadong/supacloud";
+var RELEASE_REPOSITORY = "vibeunion/supacloud";
 var RELEASE_SOURCE_REF = "refs/heads/main";
 var RELEASE_SIGNER_WORKFLOW = `${RELEASE_REPOSITORY}/.github/workflows/release-please.yml`;
 var MEBIBYTE = 1024 * 1024;
@@ -27252,7 +27252,7 @@ function buildRemotePreflightScript() {
     "export PATH",
     trustedInstalledGithubFunction(),
     "test -d /run/systemd/system || { echo 'systemd is not the active init system' >&2; exit 1; }",
-    'for tool in systemctl systemd-run sha256sum stat realpath tar file find sort awk grep tail timeout flock; do command -v "$tool" >/dev/null 2>&1 || { echo "Required local-upgrade tool is missing: $tool" >&2; exit 127; }; done',
+    'for tool in systemctl systemd-run sha256sum stat realpath tar file find sort awk grep tail timeout flock install mktemp; do command -v "$tool" >/dev/null 2>&1 || { echo "Required local-upgrade tool is missing: $tool" >&2; exit 127; }; done',
     "tail -n 0 -- /dev/null >/dev/null 2>&1 || { echo 'A tail implementation with -n and -- support is required' >&2; exit 1; }",
     "systemd-run --help | grep -Eq -- '(^|[[:space:]])--collect([=[:space:]]|$)' || { echo 'systemd-run --collect is required' >&2; exit 1; }",
     "test -d /run/lock || { echo '/run/lock is unavailable' >&2; exit 1; }",
@@ -27328,6 +27328,54 @@ async function uploadBundleFiles(ssh, paths, bundle) {
     await ssh.upload(upload.localPath, `${paths.drop}/${upload.relativePath}`, { mode: 384, timeoutMs: 10 * 60000 });
   }
 }
+function managementRunnerFile(bundle) {
+  const relativePath = `bundle/management-api/${bundle.managementBinaryName}`;
+  const runner = bundle.files.find((file) => file.relativePath === relativePath);
+  if (!runner)
+    throw new Error(`Local upgrade bundle is missing ${relativePath}`);
+  return runner;
+}
+function targetRunnerCapabilityCommands() {
+  return [
+    'RUNNER=$(mktemp "$DROP/.runner-capability.XXXXXX")',
+    `trap 'rm -f -- "$RUNNER"' EXIT`,
+    `trap 'trap - EXIT HUP INT TERM; rm -f -- "$RUNNER"; exit 1' HUP INT TERM`,
+    'install -m 0700 "$RUNNER_ASSET" "$RUNNER"',
+    `test "$(sha256sum "$RUNNER" | awk '{print $1}')" = "$EXPECTED_SHA256"`,
+    'VERSION_OUTPUT=$(timeout 5s "$RUNNER" --version 2>&1)',
+    `[[ "$VERSION_OUTPUT" =~ ^SupaCloud[[:space:]]Version:[[:space:]]\${EXPECTED_VERSION//./\\.}$ ]] || { echo 'Target Management runner version mismatch' >&2; exit 1; }`,
+    'SYSTEMD_HELPER_OUTPUT=$(timeout 5s "$RUNNER" --systemd-unit-helper-sha256 2>&1)',
+    `[[ "$SYSTEMD_HELPER_OUTPUT" =~ ^SupaCloud[[:space:]]systemd-unit[[:space:]]helper[[:space:]]SHA-256:[[:space:]][0-9a-f]{64}$ ]] || { echo 'Target Management runner lacks systemd-unit helper delivery' >&2; exit 1; }`,
+    'POSTGREST_LAUNCHER_OUTPUT=$(timeout 5s "$RUNNER" --postgrest-launcher-sha256 2>&1)',
+    `[[ "$POSTGREST_LAUNCHER_OUTPUT" =~ ^SupaCloud[[:space:]]PostgREST[[:space:]]launcher[[:space:]]SHA-256:[[:space:]][0-9a-f]{64}$ ]] || { echo 'Target Management runner lacks PostgREST launcher delivery' >&2; exit 1; }`,
+    'rm -f -- "$RUNNER"',
+    "trap - EXIT HUP INT TERM"
+  ];
+}
+function buildTargetRunnerCapabilityScript(paths, bundle, request) {
+  const runnerFile = managementRunnerFile(bundle);
+  const runnerAsset = `${paths.drop}/${runnerFile.relativePath}`;
+  return [
+    "set -euo pipefail",
+    "umask 077",
+    `DROP=${quoteShell2(paths.drop)}`,
+    `RUNNER_ASSET=${quoteShell2(runnerAsset)}`,
+    `EXPECTED_SIZE=${runnerFile.size}`,
+    `EXPECTED_SHA256=${quoteShell2(runnerFile.sha256)}`,
+    `EXPECTED_VERSION=${quoteShell2(request.managementVersion)}`,
+    `test -f "$RUNNER_ASSET" && test ! -L "$RUNNER_ASSET" && test "$(stat -c '%h' "$RUNNER_ASSET")" = 1 || { echo 'Target Management runner is not a direct single-link file' >&2; exit 1; }`,
+    `test "$(stat -c '%s' "$RUNNER_ASSET")" = "$EXPECTED_SIZE"`,
+    `test "$(sha256sum "$RUNNER_ASSET" | awk '{print $1}')" = "$EXPECTED_SHA256"`,
+    ...targetRunnerCapabilityCommands()
+  ].join(`
+`);
+}
+async function verifyTargetRunnerCapability(ssh, paths, bundle, request) {
+  const verified = await ssh.exec(buildTargetRunnerCapabilityScript(paths, bundle, request), 30000);
+  if (!verified.success) {
+    throw remoteFailure("Target Management runner lacks required transactional helper delivery", verified);
+  }
+}
 function expectedComponentFiles(bundle) {
   return {
     management: [
@@ -27475,6 +27523,7 @@ function upgradeScriptExecution(paths, bundle, request) {
     `test "$(sha256sum "$RUNNER"|awk '{print $1}')" = "$(sha256sum "$RUNNER_ASSET"|awk '{print $1}')"`,
     '"$RUNNER" --version | grep -Eq "(^|[^0-9])${MANAGEMENT_VERSION//./\\.}([^0-9]|$)"',
     `timeout 5s "$RUNNER" --systemd-unit-helper-sha256 | grep -Eq 'SupaCloud systemd-unit helper SHA-256: [0-9a-f]{64}'`,
+    `timeout 5s "$RUNNER" --postgrest-launcher-sha256 | grep -Eq 'SupaCloud PostgREST launcher SHA-256: [0-9a-f]{64}'`,
     `env PATH="$VERIFIER_PATH:$PATH" "$RUNNER" upgrade --yes --target-version ${quoteShell2(request.managementVersion)} --edge-runtime-version ${quoteShell2(request.edgeRuntimeVersion)} --asset-bundle-dir "$BUNDLE"`
   ];
 }
@@ -27867,6 +27916,7 @@ async function executeLocalUpgradeTransfer(ssh, request) {
     try {
       await prepareRemoteDrop(ssh, paths, bundle);
       await uploadBundleFiles(ssh, paths, bundle);
+      await verifyTargetRunnerCapability(ssh, paths, bundle, request);
       await uploadRunScript(ssh, paths, bundle, request, preflight.architecture);
       await adoptRemoteDrop(ssh, paths);
       adopted = true;
@@ -27896,7 +27946,7 @@ async function executeLocalUpgradeTransfer(ssh, request) {
 }
 
 // ../../scripts/lib/release_assets.sh
-var release_assets_default = '#!/usr/bin/env bash\n\nSUPACLOUD_GITHUB_REPOSITORY="${SUPACLOUD_GITHUB_REPOSITORY:-zuohuadong/supacloud}"\nSUPACLOUD_RELEASES_API="${SUPACLOUD_RELEASES_API:-https://api.github.com/repos/${SUPACLOUD_GITHUB_REPOSITORY}/releases}"\nSUPACLOUD_ATTESTATION_SIGNER_WORKFLOW="${SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW:-${SUPACLOUD_GITHUB_REPOSITORY}/.github/workflows/release-please.yml}"\nSUPACLOUD_GH_VERSION="${SUPACLOUD_GH_VERSION:-2.96.0}"\nSUPACLOUD_GH_MIN_VERSION="${SUPACLOUD_GH_MIN_VERSION:-2.68.0}"\nSUPACLOUD_GH_AMD64_SHA256="${SUPACLOUD_GH_AMD64_SHA256:-83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60}"\nSUPACLOUD_GH_ARM64_SHA256="${SUPACLOUD_GH_ARM64_SHA256:-06f86ec7103d41993b76cd78072f43595c34aaa56506d971d9860e67140bf909}"\nSUPACLOUD_RELEASE_ASSETS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"\nSUPACLOUD_ATTESTATION_TRUSTED_ROOT_DEFAULT="${SUPACLOUD_RELEASE_ASSETS_DIR}/../../packages/management-api/src/assets/sigstore-public-good-trusted-root.jsonl"\nreadonly SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SHA256="3c2cc7f357dc064ec527fdcd78da6e9245c21a381e1abaa0f2b62b186bcac1a1"\nreadonly SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SIZE="5748"\n\nsupacloud_curl_release_json() {\n    local url="$1"\n    local output="$2"\n    curl -fsSL --proto \'=https\' --proto-redir \'=https\' \\\n        --retry 1 --retry-delay 2 --retry-max-time 60 \\\n        --connect-timeout 15 --max-time 30 --speed-limit 128 --speed-time 10 \\\n        -o "$output" "$url"\n}\n\nsupacloud_curl_release_asset() {\n    local url="$1"\n    local output="$2"\n    curl -fL --proto \'=https\' --proto-redir \'=https\' \\\n        --retry 1 --retry-delay 2 --retry-max-time 180 \\\n        --connect-timeout 15 --max-time 90 --speed-limit 128 --speed-time 60 \\\n        -o "$output" "$url"\n}\n\nsupacloud_component_tag() {\n    local component="$1"\n    local version="$2"\n    case "$version" in\n        "${component}-v"*) printf \'%s\' "$version" ;;\n        v*) printf \'%s-%s\' "$component" "$version" ;;\n        *) printf \'%s-v%s\' "$component" "$version" ;;\n    esac\n}\n\nsupacloud_select_release() {\n    local component="$1"\n    shift\n    local required_assets_json\n    [[ $# -gt 0 ]] || {\n        echo "at least one required release asset must be specified" >&2\n        return 1\n    }\n    required_assets_json=$(printf \'%s\\n\' "$@" | jq -Rsc \'split("\\n")[:-1]\')\n    jq -ce --arg prefix "${component}-v" --argjson required "$required_assets_json" \'\n        map(select(\n            (.draft | not)\n            and (.prerelease | not)\n            and (.tag_name | startswith($prefix))\n            and (. as $release | all($required[]; . as $asset | any($release.assets[]?; .name == $asset)))\n            and any(.assets[]?; .name == "SHA256SUMS")\n        ))\n        | first\n        // error("no matching component release contains all required assets and SHA256SUMS")\n    \'\n}\n\nsupacloud_fetch_component_release() {\n    local component="$1"\n    local version="${2:-latest}"\n    shift 2\n    local required_assets=("$@")\n    local required_assets_json\n    local response\n    [[ ${#required_assets[@]} -gt 0 ]] || {\n        echo "at least one required release asset must be specified" >&2\n        return 1\n    }\n    required_assets_json=$(printf \'%s\\n\' "${required_assets[@]}" | jq -Rsc \'split("\\n")[:-1]\')\n\n    if [[ -n "$version" && "$version" != "latest" ]]; then\n        local tag\n        tag=$(supacloud_component_tag "$component" "$version")\n        response=$(supacloud_fetch_release_json "${SUPACLOUD_RELEASES_API}/tags/${tag}") || return 1\n        jq -ce --argjson required "$required_assets_json" \'\n            select(\n                (.draft | not)\n                and (.prerelease | not)\n                and (. as $release | all($required[]; . as $asset | any($release.assets[]?; .name == $asset)))\n                and any(.assets[]?; .name == "SHA256SUMS")\n            )\n            // error("release does not contain all required assets and SHA256SUMS")\n        \' <<< "$response"\n        return\n    fi\n\n    response=$(supacloud_fetch_release_json "${SUPACLOUD_RELEASES_API}?per_page=100") || return 1\n    supacloud_select_release "$component" "${required_assets[@]}" <<< "$response"\n}\n\nsupacloud_fetch_release_json() (\n    local url="$1"\n    local response_file\n    response_file=$(mktemp) || return 1\n    trap \'rm -f "$response_file"\' EXIT\n    trap \'trap - EXIT HUP INT TERM; rm -f "$response_file"; exit 1\' HUP INT TERM\n    supacloud_download_release_metadata_url "$url" "$response_file" || return 1\n    cat "$response_file"\n)\n\nsupacloud_release_asset_url() {\n    local release_json="$1"\n    local asset_name="$2"\n    jq -er --arg asset "$asset_name" \'\n        first(.assets[]? | select(.name == $asset) | .browser_download_url)\n        // error("release asset URL is missing")\n    \' <<< "$release_json"\n}\n\nsupacloud_download_url() {\n    local url="$1"\n    local output="$2"\n    local proxy="${SUPACLOUD_GITHUB_PROXY:-${GH_PROXY:-}}"\n\n    if supacloud_curl_release_asset "$url" "$output"; then\n        return 0\n    fi\n    if [[ -n "$proxy" ]]; then\n        supacloud_curl_release_asset "${proxy%/}/${url}" "$output"\n        return\n    fi\n    return 1\n}\n\nsupacloud_download_release_metadata_url() {\n    local url="$1"\n    local output="$2"\n    local proxy="${SUPACLOUD_GITHUB_PROXY:-${GH_PROXY:-}}"\n\n    if supacloud_curl_release_json "$url" "$output"; then\n        return 0\n    fi\n    if [[ -n "$proxy" ]]; then\n        supacloud_curl_release_json "${proxy%/}/${url}" "$output"\n        return\n    fi\n    return 1\n}\n\nsupacloud_verify_checksum() {\n    local artifact_file="$1"\n    local asset_name="$2"\n    local checksum_file="$3"\n    local expected\n    expected=$(awk -v asset="$asset_name" \'$2 == asset || $2 == "*" asset { print $1; exit }\' "$checksum_file")\n    if [[ ! "$expected" =~ ^[0-9a-fA-F]{64}$ ]]; then\n        echo "SHA256SUMS does not contain a valid checksum for ${asset_name}" >&2\n        return 1\n    fi\n\n    local actual\n    actual=$(sha256sum "$artifact_file" | awk \'{print $1}\')\n    actual=$(printf \'%s\' "$actual" | tr \'[:upper:]\' \'[:lower:]\')\n    expected=$(printf \'%s\' "$expected" | tr \'[:upper:]\' \'[:lower:]\')\n    if [[ "$actual" != "$expected" ]]; then\n        echo "SHA256 mismatch for ${asset_name}" >&2\n        return 1\n    fi\n}\n\nsupacloud_validate_binary() {\n    local artifact_file="$1"\n    local asset_name="$2"\n    local description\n    description=$(file -b "$artifact_file")\n    if [[ "$description" != *ELF* ]]; then\n        echo "${asset_name} is not an ELF binary: ${description}" >&2\n        return 1\n    fi\n\n    case "$asset_name" in\n        *amd64)\n            [[ "$description" == *x86-64* || "$description" == *x86_64* ]] || {\n                echo "${asset_name} does not contain an x86-64 ELF binary" >&2\n                return 1\n            }\n            ;;\n        *arm64)\n            [[ "$description" == *aarch64* || "$description" == *ARM64* ]] || {\n                echo "${asset_name} does not contain an arm64 ELF binary" >&2\n                return 1\n            }\n            ;;\n    esac\n}\n\nsupacloud_install_pinned_tar_xz_binary() (\n    local archive="$1"\n    local member="$2"\n    local expected_sha256="$3"\n    local arch="$4"\n    local target="$5"\n    local actual_sha256 member_count member_details extract_dir candidate staged_target\n\n    actual_sha256=$(sha256sum "$archive" | awk \'{print $1}\')\n    actual_sha256=$(printf \'%s\' "$actual_sha256" | tr \'[:upper:]\' \'[:lower:]\')\n    expected_sha256=$(printf \'%s\' "$expected_sha256" | tr \'[:upper:]\' \'[:lower:]\')\n    if [[ ! "$expected_sha256" =~ ^[0-9a-f]{64}$ || "$actual_sha256" != "$expected_sha256" ]]; then\n        echo "SHA256 mismatch for pinned archive" >&2\n        return 1\n    fi\n\n    member_count=$(tar -tJf "$archive" | grep -Fxc "$member" || true)\n    if [[ "$member_count" != "1" ]]; then\n        echo "Pinned archive must contain the exact member once: $member" >&2\n        return 1\n    fi\n    member_details=$(tar -tvJf "$archive" "$member") || return 1\n    if [[ "${member_details:0:1}" != "-" ]]; then\n        echo "Pinned archive member is not a regular file: $member" >&2\n        return 1\n    fi\n\n    extract_dir=$(mktemp -d)\n    trap \'rm -rf "$extract_dir"; [[ -z "${staged_target:-}" ]] || rm -f "$staged_target"\' EXIT\n    trap \'trap - EXIT HUP INT TERM; rm -rf "$extract_dir"; [[ -z "${staged_target:-}" ]] || rm -f "$staged_target"; exit 1\' HUP INT TERM\n    if ! tar --no-same-owner --no-same-permissions -xJf "$archive" -C "$extract_dir" "$member"; then\n        return 1\n    fi\n    candidate="${extract_dir}/${member}"\n    supacloud_validate_binary "$candidate" "pinned-linux-${arch}" || return 1\n\n    mkdir -p "$(dirname "$target")"\n    staged_target=$(mktemp "${target}.tmp.XXXXXX")\n    install -m 0755 "$candidate" "$staged_target"\n    mv -f "$staged_target" "$target"\n    staged_target=""\n)\n\nsupacloud_version_at_least() {\n    local current="${1#v}"\n    local required="${2#v}"\n    local current_major=0 current_minor=0 current_patch=0\n    local required_major=0 required_minor=0 required_patch=0\n    [[ "$current" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+(-.*)?$ ]] || return 1\n    [[ "$required" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+(-.*)?$ ]] || return 1\n    IFS=. read -r current_major current_minor current_patch <<EOF\n${current%%-*}\nEOF\n    IFS=. read -r required_major required_minor required_patch <<EOF\n${required%%-*}\nEOF\n    current_major=${current_major:-0}; current_minor=${current_minor:-0}; current_patch=${current_patch:-0}\n    required_major=${required_major:-0}; required_minor=${required_minor:-0}; required_patch=${required_patch:-0}\n    if (( current_major != required_major )); then (( current_major > required_major )); return; fi\n    if (( current_minor != required_minor )); then (( current_minor > required_minor )); return; fi\n    (( current_patch >= required_patch ))\n}\n\nsupacloud_gh_version() {\n    gh --version 2>/dev/null | awk \'NR == 1 && $1 == "gh" && $2 == "version" { print $3; exit }\'\n}\n\nsupacloud_install_gh_archive() {\n    local archive="$1"\n    local version="$2"\n    local arch="$3"\n    local expected_sha256="$4"\n    local target="$5"\n    local member="gh_${version}_linux_${arch}/bin/gh"\n    local actual_sha256 member_count member_details extracted_dir candidate version_output\n\n    actual_sha256=$(sha256sum "$archive" | awk \'{print $1}\')\n    if [[ "$actual_sha256" != "$expected_sha256" ]]; then\n        echo "GitHub CLI archive SHA256 mismatch" >&2\n        return 1\n    fi\n\n    member_count=$(tar -tzf "$archive" | grep -Fxc "$member" || true)\n    if [[ "$member_count" != "1" ]]; then\n        echo "GitHub CLI archive does not contain the exact expected member: $member" >&2\n        return 1\n    fi\n    member_details=$(tar -tvzf "$archive" "$member") || return 1\n    if [[ "${member_details:0:1}" != "-" ]]; then\n        echo "GitHub CLI archive member is not a regular file: $member" >&2\n        return 1\n    fi\n\n    extracted_dir=$(mktemp -d)\n    candidate="${extracted_dir}/${member}"\n    if ! tar --no-same-owner --no-same-permissions -xzf "$archive" -C "$extracted_dir" "$member" \\\n        || ! supacloud_validate_binary "$candidate" "gh-linux-${arch}"; then\n        rm -rf "$extracted_dir"\n        return 1\n    fi\n    chmod 0755 "$candidate"\n    version_output=$("$candidate" --version 2>/dev/null | head -1) || {\n        rm -rf "$extracted_dir"\n        echo "GitHub CLI bootstrap binary failed its version check" >&2\n        return 1\n    }\n    if [[ "$version_output" != "gh version ${version}"* ]]; then\n        rm -rf "$extracted_dir"\n        echo "GitHub CLI bootstrap version mismatch: ${version_output}" >&2\n        return 1\n    fi\n    mkdir -p "$(dirname "$target")"\n    install -m 0755 "$candidate" "$target"\n    rm -rf "$extracted_dir"\n}\n\nsupacloud_install_pinned_gh() {\n    local target="${1:-/usr/local/bin/gh}"\n    local machine arch expected_sha256 asset url archive\n    machine=$(uname -m)\n    case "$machine" in\n        x86_64|amd64)\n            arch="amd64"\n            expected_sha256="$SUPACLOUD_GH_AMD64_SHA256"\n            ;;\n        aarch64|arm64)\n            arch="arm64"\n            expected_sha256="$SUPACLOUD_GH_ARM64_SHA256"\n            ;;\n        *)\n            echo "Unsupported architecture for GitHub CLI bootstrap: $machine" >&2\n            return 1\n            ;;\n    esac\n    asset="gh_${SUPACLOUD_GH_VERSION}_linux_${arch}.tar.gz"\n    url="https://github.com/cli/cli/releases/download/v${SUPACLOUD_GH_VERSION}/${asset}"\n    archive=$(mktemp)\n    if ! supacloud_download_url "$url" "$archive" \\\n        || ! supacloud_install_gh_archive "$archive" "$SUPACLOUD_GH_VERSION" "$arch" "$expected_sha256" "$target"; then\n        rm -f "$archive"\n        return 1\n    fi\n    rm -f "$archive"\n}\n\nsupacloud_validate_tar() {\n    local artifact_file="$1"\n    local entries\n    entries=$(tar -tzf "$artifact_file") || {\n        echo "Web Console archive is not a readable gzip tarball" >&2\n        return 1\n    }\n    if ! printf \'%s\\n\' "$entries" | awk \'\n        /^\\// { exit 1 }\n        /(^|\\/)\\.\\.($|\\/)/ { exit 1 }\n    \'; then\n        echo "Web Console archive contains an unsafe path" >&2\n        return 1\n    fi\n    if ! tar -tvzf "$artifact_file" | awk \'substr($1, 1, 1) != "-" && substr($1, 1, 1) != "d" { exit 1 }\'; then\n        echo "Web Console archive contains links or special files" >&2\n        return 1\n    fi\n    printf \'%s\\n\' "$entries" | grep -Eq \'(^|/)index\\.html$\' || {\n        echo "Web Console archive is invalid or does not contain index.html" >&2\n        return 1\n    }\n}\n\nsupacloud_record_integrity_mode() {\n    local mode="$1"\n    local record_file="${SUPACLOUD_INTEGRITY_MODE_RECORD:-/var/lib/supacloud/artifact-integrity-mode}"\n    mkdir -p "$(dirname "$record_file")" 2>/dev/null || return 0\n    printf \'%s\\n\' "$mode" > "$record_file" 2>/dev/null || return 0\n    chmod 600 "$record_file" 2>/dev/null || true\n}\n\nsupacloud_fetch_attestation_bundle() {\n    local artifact_file="$1"\n    local bundle_file="$2"\n    local digest response\n    digest=$(sha256sum "$artifact_file" | awk \'{print $1}\') || return 1\n    [[ "$digest" =~ ^[0-9a-fA-F]{64}$ ]] || {\n        echo "Unable to calculate the artifact digest for attestation lookup" >&2\n        return 1\n    }\n    digest=$(printf \'%s\' "$digest" | tr \'[:upper:]\' \'[:lower:]\')\n    response=$(supacloud_fetch_release_json \\\n        "https://api.github.com/repos/${SUPACLOUD_GITHUB_REPOSITORY}/attestations/sha256:${digest}") || {\n        echo "Unable to download the public GitHub artifact attestation bundle" >&2\n        return 1\n    }\n    if ! jq -ce \'\n        .attestations\n        | if type != "array" or length == 0 or any(.[]; (.bundle | type) != "object")\n          then error("no valid attestation bundles returned")\n          else .[].bundle\n          end\n    \' <<< "$response" > "$bundle_file"; then\n        echo "GitHub artifact attestation response did not contain a valid bundle" >&2\n        return 1\n    fi\n}\n\nsupacloud_attestation_trusted_root_available() {\n    local trusted_root="${SUPACLOUD_ATTESTATION_TRUSTED_ROOT:-$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_DEFAULT}"\n    local actual_size actual_sha256\n    [[ "$trusted_root" == /* && -f "$trusted_root" && ! -L "$trusted_root" ]] || return 1\n    actual_size=$(wc -c < "$trusted_root" | tr -d \'[:space:]\') || return 1\n    [[ "$actual_size" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SIZE" ]] || return 1\n    actual_sha256=$(sha256sum "$trusted_root" | awk \'{print $1}\') || return 1\n    [[ "$actual_sha256" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SHA256" ]] || return 1\n    [[ "$(wc -l < "$trusted_root" | tr -d \'[:space:]\')" == "1" ]] || return 1\n    jq -e \'type == "object" and .mediaType == "application/vnd.dev.sigstore.trustedroot+json;version=0.1"\' \\\n        "$trusted_root" >/dev/null 2>&1\n}\n\nsupacloud_prepare_attestation_trusted_root() {\n    local destination="$1"\n    local trusted_root="${SUPACLOUD_ATTESTATION_TRUSTED_ROOT:-$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_DEFAULT}"\n    supacloud_attestation_trusted_root_available || {\n        echo "Pinned Sigstore Public Good trusted root is missing or invalid" >&2\n        return 1\n    }\n    jq -ce . "$trusted_root" > "$destination" || return 1\n    chmod 600 "$destination"\n    [[ "$(wc -c < "$destination" | tr -d \'[:space:]\')" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SIZE" ]] || return 1\n    [[ "$(sha256sum "$destination" | awk \'{print $1}\')" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SHA256" ]]\n}\n\nsupacloud_verify_attestation() (\n    local artifact_file="$1"\n    if supacloud_attestation_verifier_available; then\n        local verification_output bundle_dir bundle_file trusted_root_file\n        bundle_dir=$(mktemp -d "${TMPDIR:-/tmp}/supacloud-attestation.XXXXXX") || return 1\n        trap \'rm -rf -- "$bundle_dir"\' EXIT\n        trap \'trap - EXIT HUP INT TERM; rm -rf -- "$bundle_dir"; exit 1\' HUP INT TERM\n        bundle_file="${bundle_dir}/bundle.jsonl"\n        trusted_root_file="${bundle_dir}/trusted_root.jsonl"\n        if ! supacloud_fetch_attestation_bundle "$artifact_file" "$bundle_file"; then\n            return 1\n        fi\n        supacloud_prepare_attestation_trusted_root "$trusted_root_file" || return 1\n        if ! verification_output=$(gh attestation verify "$artifact_file" \\\n            --bundle "$bundle_file" \\\n            --custom-trusted-root "$trusted_root_file" \\\n            --repo "$SUPACLOUD_GITHUB_REPOSITORY" \\\n            --signer-workflow "$SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW" \\\n            --source-ref "refs/heads/main" \\\n            --deny-self-hosted-runners 2>&1); then\n            echo "GitHub artifact attestation verification failed: ${verification_output}" >&2\n            return 1\n        fi\n        supacloud_record_integrity_mode "github-attestation+same-release-sha256"\n        return\n    fi\n\n    if [[ "${SUPACLOUD_ALLOW_UNVERIFIED_RELEASE:-false}" == "true" ]]; then\n        echo "BREAK-GLASS LIMITED INTEGRITY MODE: artifact attestation verification is unavailable; only the same-release SHA256 checksum was verified." >&2\n        supacloud_record_integrity_mode "break-glass:same-release-sha256-only"\n        return 0\n    fi\n\n    echo "Artifact attestation verification is required, but gh attestation verify is unavailable. Install GitHub CLI or explicitly set SUPACLOUD_ALLOW_UNVERIFIED_RELEASE=true for emergency break-glass use." >&2\n    return 1\n)\n\nsupacloud_attestation_verifier_available() {\n    local version help\n    supacloud_attestation_trusted_root_available || return 1\n    command -v gh >/dev/null 2>&1 || return 1\n    version=$(supacloud_gh_version)\n    [[ -n "$version" ]] || return 1\n    supacloud_version_at_least "$version" "$SUPACLOUD_GH_MIN_VERSION" || return 1\n    help=$(gh attestation verify --help 2>&1) || return 1\n    grep -Eq -- \'(^|[[:space:]])--bundle([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--signer-workflow([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--source-ref([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--custom-trusted-root([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--deny-self-hosted-runners([=[:space:]]|$)\' <<< "$help"\n}\n\nsupacloud_download_release_asset() (\n    local release_json="$1"\n    local asset_name="$2"\n    local destination="$3"\n    local asset_kind="$4"\n    local asset_url checksum_url temporary_artifact temporary_checksums\n\n    asset_url=$(supacloud_release_asset_url "$release_json" "$asset_name") || return 1\n    checksum_url=$(supacloud_release_asset_url "$release_json" SHA256SUMS) || return 1\n    mkdir -p "$(dirname "$destination")"\n    temporary_artifact=$(mktemp "${destination}.tmp.XXXXXX")\n    temporary_checksums=$(mktemp "${destination}.SHA256SUMS.tmp.XXXXXX")\n    trap \'rm -f "${temporary_artifact:-}" "${temporary_checksums:-}"\' EXIT\n    trap \'trap - EXIT HUP INT TERM; rm -f "${temporary_artifact:-}" "${temporary_checksums:-}"; exit 1\' HUP INT TERM\n\n    if ! supacloud_download_url "$asset_url" "$temporary_artifact" \\\n        || ! supacloud_download_release_metadata_url "$checksum_url" "$temporary_checksums" \\\n        || ! supacloud_verify_checksum "$temporary_artifact" "$asset_name" "$temporary_checksums"; then\n        rm -f "$temporary_artifact" "$temporary_checksums"\n        return 1\n    fi\n\n    # Authenticate the digest before parsing archives or inspecting binaries.\n    if ! supacloud_verify_attestation "$temporary_artifact"; then\n        rm -f "$temporary_artifact" "$temporary_checksums"\n        return 1\n    fi\n\n    case "$asset_kind" in\n        binary) supacloud_validate_binary "$temporary_artifact" "$asset_name" ;;\n        tar) supacloud_validate_tar "$temporary_artifact" ;;\n        *)\n            echo "Unknown release asset kind: $asset_kind" >&2\n            rm -f "$temporary_artifact" "$temporary_checksums"\n            return 1\n            ;;\n    esac || {\n        rm -f "$temporary_artifact" "$temporary_checksums"\n        return 1\n    }\n\n    mv -f "$temporary_artifact" "$destination"\n    temporary_artifact=""\n    rm -f "$temporary_checksums"\n    temporary_checksums=""\n)\n';
+var release_assets_default = '#!/usr/bin/env bash\n\nSUPACLOUD_GITHUB_REPOSITORY="${SUPACLOUD_GITHUB_REPOSITORY:-vibeunion/supacloud}"\nSUPACLOUD_RELEASES_API="${SUPACLOUD_RELEASES_API:-https://api.github.com/repos/${SUPACLOUD_GITHUB_REPOSITORY}/releases}"\nSUPACLOUD_ATTESTATION_SIGNER_WORKFLOW="${SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW:-${SUPACLOUD_GITHUB_REPOSITORY}/.github/workflows/release-please.yml}"\nSUPACLOUD_GH_VERSION="${SUPACLOUD_GH_VERSION:-2.96.0}"\nSUPACLOUD_GH_MIN_VERSION="${SUPACLOUD_GH_MIN_VERSION:-2.68.0}"\nSUPACLOUD_GH_AMD64_SHA256="${SUPACLOUD_GH_AMD64_SHA256:-83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60}"\nSUPACLOUD_GH_ARM64_SHA256="${SUPACLOUD_GH_ARM64_SHA256:-06f86ec7103d41993b76cd78072f43595c34aaa56506d971d9860e67140bf909}"\nSUPACLOUD_RELEASE_ASSETS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"\nSUPACLOUD_ATTESTATION_TRUSTED_ROOT_DEFAULT="${SUPACLOUD_RELEASE_ASSETS_DIR}/../../packages/management-api/src/assets/sigstore-public-good-trusted-root.jsonl"\nreadonly SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SHA256="3c2cc7f357dc064ec527fdcd78da6e9245c21a381e1abaa0f2b62b186bcac1a1"\nreadonly SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SIZE="5748"\n\nsupacloud_curl_release_json() {\n    local url="$1"\n    local output="$2"\n    curl -fsSL --proto \'=https\' --proto-redir \'=https\' \\\n        --retry 1 --retry-delay 2 --retry-max-time 60 \\\n        --connect-timeout 15 --max-time 30 --speed-limit 128 --speed-time 10 \\\n        -o "$output" "$url"\n}\n\nsupacloud_curl_release_asset() {\n    local url="$1"\n    local output="$2"\n    curl -fL --proto \'=https\' --proto-redir \'=https\' \\\n        --retry 1 --retry-delay 2 --retry-max-time 180 \\\n        --connect-timeout 15 --max-time 90 --speed-limit 128 --speed-time 60 \\\n        -o "$output" "$url"\n}\n\nsupacloud_component_tag() {\n    local component="$1"\n    local version="$2"\n    case "$version" in\n        "${component}-v"*) printf \'%s\' "$version" ;;\n        v*) printf \'%s-%s\' "$component" "$version" ;;\n        *) printf \'%s-v%s\' "$component" "$version" ;;\n    esac\n}\n\nsupacloud_select_release() {\n    local component="$1"\n    shift\n    local required_assets_json\n    [[ $# -gt 0 ]] || {\n        echo "at least one required release asset must be specified" >&2\n        return 1\n    }\n    required_assets_json=$(printf \'%s\\n\' "$@" | jq -Rsc \'split("\\n")[:-1]\')\n    jq -ce --arg prefix "${component}-v" --argjson required "$required_assets_json" \'\n        map(select(\n            (.draft | not)\n            and (.prerelease | not)\n            and (.tag_name | startswith($prefix))\n            and (. as $release | all($required[]; . as $asset | any($release.assets[]?; .name == $asset)))\n            and any(.assets[]?; .name == "SHA256SUMS")\n        ))\n        | first\n        // error("no matching component release contains all required assets and SHA256SUMS")\n    \'\n}\n\nsupacloud_fetch_component_release() {\n    local component="$1"\n    local version="${2:-latest}"\n    shift 2\n    local required_assets=("$@")\n    local required_assets_json\n    local response\n    [[ ${#required_assets[@]} -gt 0 ]] || {\n        echo "at least one required release asset must be specified" >&2\n        return 1\n    }\n    required_assets_json=$(printf \'%s\\n\' "${required_assets[@]}" | jq -Rsc \'split("\\n")[:-1]\')\n\n    if [[ -n "$version" && "$version" != "latest" ]]; then\n        local tag\n        tag=$(supacloud_component_tag "$component" "$version")\n        response=$(supacloud_fetch_release_json "${SUPACLOUD_RELEASES_API}/tags/${tag}") || return 1\n        jq -ce --argjson required "$required_assets_json" \'\n            select(\n                (.draft | not)\n                and (.prerelease | not)\n                and (. as $release | all($required[]; . as $asset | any($release.assets[]?; .name == $asset)))\n                and any(.assets[]?; .name == "SHA256SUMS")\n            )\n            // error("release does not contain all required assets and SHA256SUMS")\n        \' <<< "$response"\n        return\n    fi\n\n    response=$(supacloud_fetch_release_json "${SUPACLOUD_RELEASES_API}?per_page=100") || return 1\n    supacloud_select_release "$component" "${required_assets[@]}" <<< "$response"\n}\n\nsupacloud_fetch_release_json() (\n    local url="$1"\n    local response_file\n    response_file=$(mktemp) || return 1\n    trap \'rm -f "$response_file"\' EXIT\n    trap \'trap - EXIT HUP INT TERM; rm -f "$response_file"; exit 1\' HUP INT TERM\n    supacloud_download_release_metadata_url "$url" "$response_file" || return 1\n    cat "$response_file"\n)\n\nsupacloud_release_asset_url() {\n    local release_json="$1"\n    local asset_name="$2"\n    jq -er --arg asset "$asset_name" \'\n        first(.assets[]? | select(.name == $asset) | .browser_download_url)\n        // error("release asset URL is missing")\n    \' <<< "$release_json"\n}\n\nsupacloud_download_url() {\n    local url="$1"\n    local output="$2"\n    local proxy="${SUPACLOUD_GITHUB_PROXY:-${GH_PROXY:-}}"\n\n    if supacloud_curl_release_asset "$url" "$output"; then\n        return 0\n    fi\n    if [[ -n "$proxy" ]]; then\n        supacloud_curl_release_asset "${proxy%/}/${url}" "$output"\n        return\n    fi\n    return 1\n}\n\nsupacloud_download_release_metadata_url() {\n    local url="$1"\n    local output="$2"\n    local proxy="${SUPACLOUD_GITHUB_PROXY:-${GH_PROXY:-}}"\n\n    if supacloud_curl_release_json "$url" "$output"; then\n        return 0\n    fi\n    if [[ -n "$proxy" ]]; then\n        supacloud_curl_release_json "${proxy%/}/${url}" "$output"\n        return\n    fi\n    return 1\n}\n\nsupacloud_verify_checksum() {\n    local artifact_file="$1"\n    local asset_name="$2"\n    local checksum_file="$3"\n    local expected\n    expected=$(awk -v asset="$asset_name" \'$2 == asset || $2 == "*" asset { print $1; exit }\' "$checksum_file")\n    if [[ ! "$expected" =~ ^[0-9a-fA-F]{64}$ ]]; then\n        echo "SHA256SUMS does not contain a valid checksum for ${asset_name}" >&2\n        return 1\n    fi\n\n    local actual\n    actual=$(sha256sum "$artifact_file" | awk \'{print $1}\')\n    actual=$(printf \'%s\' "$actual" | tr \'[:upper:]\' \'[:lower:]\')\n    expected=$(printf \'%s\' "$expected" | tr \'[:upper:]\' \'[:lower:]\')\n    if [[ "$actual" != "$expected" ]]; then\n        echo "SHA256 mismatch for ${asset_name}" >&2\n        return 1\n    fi\n}\n\nsupacloud_validate_binary() {\n    local artifact_file="$1"\n    local asset_name="$2"\n    local description\n    description=$(file -b "$artifact_file")\n    if [[ "$description" != *ELF* ]]; then\n        echo "${asset_name} is not an ELF binary: ${description}" >&2\n        return 1\n    fi\n\n    case "$asset_name" in\n        *amd64)\n            [[ "$description" == *x86-64* || "$description" == *x86_64* ]] || {\n                echo "${asset_name} does not contain an x86-64 ELF binary" >&2\n                return 1\n            }\n            ;;\n        *arm64)\n            [[ "$description" == *aarch64* || "$description" == *ARM64* ]] || {\n                echo "${asset_name} does not contain an arm64 ELF binary" >&2\n                return 1\n            }\n            ;;\n    esac\n}\n\nsupacloud_install_pinned_tar_xz_binary() (\n    local archive="$1"\n    local member="$2"\n    local expected_sha256="$3"\n    local arch="$4"\n    local target="$5"\n    local actual_sha256 member_count member_details extract_dir candidate staged_target\n\n    actual_sha256=$(sha256sum "$archive" | awk \'{print $1}\')\n    actual_sha256=$(printf \'%s\' "$actual_sha256" | tr \'[:upper:]\' \'[:lower:]\')\n    expected_sha256=$(printf \'%s\' "$expected_sha256" | tr \'[:upper:]\' \'[:lower:]\')\n    if [[ ! "$expected_sha256" =~ ^[0-9a-f]{64}$ || "$actual_sha256" != "$expected_sha256" ]]; then\n        echo "SHA256 mismatch for pinned archive" >&2\n        return 1\n    fi\n\n    member_count=$(tar -tJf "$archive" | grep -Fxc "$member" || true)\n    if [[ "$member_count" != "1" ]]; then\n        echo "Pinned archive must contain the exact member once: $member" >&2\n        return 1\n    fi\n    member_details=$(tar -tvJf "$archive" "$member") || return 1\n    if [[ "${member_details:0:1}" != "-" ]]; then\n        echo "Pinned archive member is not a regular file: $member" >&2\n        return 1\n    fi\n\n    extract_dir=$(mktemp -d)\n    trap \'rm -rf "$extract_dir"; [[ -z "${staged_target:-}" ]] || rm -f "$staged_target"\' EXIT\n    trap \'trap - EXIT HUP INT TERM; rm -rf "$extract_dir"; [[ -z "${staged_target:-}" ]] || rm -f "$staged_target"; exit 1\' HUP INT TERM\n    if ! tar --no-same-owner --no-same-permissions -xJf "$archive" -C "$extract_dir" "$member"; then\n        return 1\n    fi\n    candidate="${extract_dir}/${member}"\n    supacloud_validate_binary "$candidate" "pinned-linux-${arch}" || return 1\n\n    mkdir -p "$(dirname "$target")"\n    staged_target=$(mktemp "${target}.tmp.XXXXXX")\n    install -m 0755 "$candidate" "$staged_target"\n    mv -f "$staged_target" "$target"\n    staged_target=""\n)\n\nsupacloud_version_at_least() {\n    local current="${1#v}"\n    local required="${2#v}"\n    local current_major=0 current_minor=0 current_patch=0\n    local required_major=0 required_minor=0 required_patch=0\n    [[ "$current" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+(-.*)?$ ]] || return 1\n    [[ "$required" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+(-.*)?$ ]] || return 1\n    IFS=. read -r current_major current_minor current_patch <<EOF\n${current%%-*}\nEOF\n    IFS=. read -r required_major required_minor required_patch <<EOF\n${required%%-*}\nEOF\n    current_major=${current_major:-0}; current_minor=${current_minor:-0}; current_patch=${current_patch:-0}\n    required_major=${required_major:-0}; required_minor=${required_minor:-0}; required_patch=${required_patch:-0}\n    if (( current_major != required_major )); then (( current_major > required_major )); return; fi\n    if (( current_minor != required_minor )); then (( current_minor > required_minor )); return; fi\n    (( current_patch >= required_patch ))\n}\n\nsupacloud_gh_version() {\n    gh --version 2>/dev/null | awk \'NR == 1 && $1 == "gh" && $2 == "version" { print $3; exit }\'\n}\n\nsupacloud_install_gh_archive() {\n    local archive="$1"\n    local version="$2"\n    local arch="$3"\n    local expected_sha256="$4"\n    local target="$5"\n    local member="gh_${version}_linux_${arch}/bin/gh"\n    local actual_sha256 member_count member_details extracted_dir candidate version_output\n\n    actual_sha256=$(sha256sum "$archive" | awk \'{print $1}\')\n    if [[ "$actual_sha256" != "$expected_sha256" ]]; then\n        echo "GitHub CLI archive SHA256 mismatch" >&2\n        return 1\n    fi\n\n    member_count=$(tar -tzf "$archive" | grep -Fxc "$member" || true)\n    if [[ "$member_count" != "1" ]]; then\n        echo "GitHub CLI archive does not contain the exact expected member: $member" >&2\n        return 1\n    fi\n    member_details=$(tar -tvzf "$archive" "$member") || return 1\n    if [[ "${member_details:0:1}" != "-" ]]; then\n        echo "GitHub CLI archive member is not a regular file: $member" >&2\n        return 1\n    fi\n\n    extracted_dir=$(mktemp -d)\n    candidate="${extracted_dir}/${member}"\n    if ! tar --no-same-owner --no-same-permissions -xzf "$archive" -C "$extracted_dir" "$member" \\\n        || ! supacloud_validate_binary "$candidate" "gh-linux-${arch}"; then\n        rm -rf "$extracted_dir"\n        return 1\n    fi\n    chmod 0755 "$candidate"\n    version_output=$("$candidate" --version 2>/dev/null | head -1) || {\n        rm -rf "$extracted_dir"\n        echo "GitHub CLI bootstrap binary failed its version check" >&2\n        return 1\n    }\n    if [[ "$version_output" != "gh version ${version}"* ]]; then\n        rm -rf "$extracted_dir"\n        echo "GitHub CLI bootstrap version mismatch: ${version_output}" >&2\n        return 1\n    fi\n    mkdir -p "$(dirname "$target")"\n    install -m 0755 "$candidate" "$target"\n    rm -rf "$extracted_dir"\n}\n\nsupacloud_install_pinned_gh() {\n    local target="${1:-/usr/local/bin/gh}"\n    local machine arch expected_sha256 asset url archive\n    machine=$(uname -m)\n    case "$machine" in\n        x86_64|amd64)\n            arch="amd64"\n            expected_sha256="$SUPACLOUD_GH_AMD64_SHA256"\n            ;;\n        aarch64|arm64)\n            arch="arm64"\n            expected_sha256="$SUPACLOUD_GH_ARM64_SHA256"\n            ;;\n        *)\n            echo "Unsupported architecture for GitHub CLI bootstrap: $machine" >&2\n            return 1\n            ;;\n    esac\n    asset="gh_${SUPACLOUD_GH_VERSION}_linux_${arch}.tar.gz"\n    url="https://github.com/cli/cli/releases/download/v${SUPACLOUD_GH_VERSION}/${asset}"\n    archive=$(mktemp)\n    if ! supacloud_download_url "$url" "$archive" \\\n        || ! supacloud_install_gh_archive "$archive" "$SUPACLOUD_GH_VERSION" "$arch" "$expected_sha256" "$target"; then\n        rm -f "$archive"\n        return 1\n    fi\n    rm -f "$archive"\n}\n\nsupacloud_validate_tar() {\n    local artifact_file="$1"\n    local entries\n    entries=$(tar -tzf "$artifact_file") || {\n        echo "Web Console archive is not a readable gzip tarball" >&2\n        return 1\n    }\n    if ! printf \'%s\\n\' "$entries" | awk \'\n        /^\\// { exit 1 }\n        /(^|\\/)\\.\\.($|\\/)/ { exit 1 }\n    \'; then\n        echo "Web Console archive contains an unsafe path" >&2\n        return 1\n    fi\n    if ! tar -tvzf "$artifact_file" | awk \'substr($1, 1, 1) != "-" && substr($1, 1, 1) != "d" { exit 1 }\'; then\n        echo "Web Console archive contains links or special files" >&2\n        return 1\n    fi\n    printf \'%s\\n\' "$entries" | grep -Eq \'(^|/)index\\.html$\' || {\n        echo "Web Console archive is invalid or does not contain index.html" >&2\n        return 1\n    }\n}\n\nsupacloud_record_integrity_mode() {\n    local mode="$1"\n    local record_file="${SUPACLOUD_INTEGRITY_MODE_RECORD:-/var/lib/supacloud/artifact-integrity-mode}"\n    mkdir -p "$(dirname "$record_file")" 2>/dev/null || return 0\n    printf \'%s\\n\' "$mode" > "$record_file" 2>/dev/null || return 0\n    chmod 600 "$record_file" 2>/dev/null || true\n}\n\nsupacloud_fetch_attestation_bundle() {\n    local artifact_file="$1"\n    local bundle_file="$2"\n    local digest response\n    digest=$(sha256sum "$artifact_file" | awk \'{print $1}\') || return 1\n    [[ "$digest" =~ ^[0-9a-fA-F]{64}$ ]] || {\n        echo "Unable to calculate the artifact digest for attestation lookup" >&2\n        return 1\n    }\n    digest=$(printf \'%s\' "$digest" | tr \'[:upper:]\' \'[:lower:]\')\n    response=$(supacloud_fetch_release_json \\\n        "https://api.github.com/repos/${SUPACLOUD_GITHUB_REPOSITORY}/attestations/sha256:${digest}") || {\n        echo "Unable to download the public GitHub artifact attestation bundle" >&2\n        return 1\n    }\n    if ! jq -ce \'\n        .attestations\n        | if type != "array" or length == 0 or any(.[]; (.bundle | type) != "object")\n          then error("no valid attestation bundles returned")\n          else .[].bundle\n          end\n    \' <<< "$response" > "$bundle_file"; then\n        echo "GitHub artifact attestation response did not contain a valid bundle" >&2\n        return 1\n    fi\n}\n\nsupacloud_attestation_trusted_root_available() {\n    local trusted_root="${SUPACLOUD_ATTESTATION_TRUSTED_ROOT:-$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_DEFAULT}"\n    local actual_size actual_sha256\n    [[ "$trusted_root" == /* && -f "$trusted_root" && ! -L "$trusted_root" ]] || return 1\n    actual_size=$(wc -c < "$trusted_root" | tr -d \'[:space:]\') || return 1\n    [[ "$actual_size" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SIZE" ]] || return 1\n    actual_sha256=$(sha256sum "$trusted_root" | awk \'{print $1}\') || return 1\n    [[ "$actual_sha256" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SHA256" ]] || return 1\n    [[ "$(wc -l < "$trusted_root" | tr -d \'[:space:]\')" == "1" ]] || return 1\n    jq -e \'type == "object" and .mediaType == "application/vnd.dev.sigstore.trustedroot+json;version=0.1"\' \\\n        "$trusted_root" >/dev/null 2>&1\n}\n\nsupacloud_prepare_attestation_trusted_root() {\n    local destination="$1"\n    local trusted_root="${SUPACLOUD_ATTESTATION_TRUSTED_ROOT:-$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_DEFAULT}"\n    supacloud_attestation_trusted_root_available || {\n        echo "Pinned Sigstore Public Good trusted root is missing or invalid" >&2\n        return 1\n    }\n    jq -ce . "$trusted_root" > "$destination" || return 1\n    chmod 600 "$destination"\n    [[ "$(wc -c < "$destination" | tr -d \'[:space:]\')" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SIZE" ]] || return 1\n    [[ "$(sha256sum "$destination" | awk \'{print $1}\')" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SHA256" ]]\n}\n\nsupacloud_verify_attestation() (\n    local artifact_file="$1"\n    if supacloud_attestation_verifier_available; then\n        local verification_output bundle_dir bundle_file trusted_root_file\n        bundle_dir=$(mktemp -d "${TMPDIR:-/tmp}/supacloud-attestation.XXXXXX") || return 1\n        trap \'rm -rf -- "$bundle_dir"\' EXIT\n        trap \'trap - EXIT HUP INT TERM; rm -rf -- "$bundle_dir"; exit 1\' HUP INT TERM\n        bundle_file="${bundle_dir}/bundle.jsonl"\n        trusted_root_file="${bundle_dir}/trusted_root.jsonl"\n        if ! supacloud_fetch_attestation_bundle "$artifact_file" "$bundle_file"; then\n            return 1\n        fi\n        supacloud_prepare_attestation_trusted_root "$trusted_root_file" || return 1\n        if ! verification_output=$(gh attestation verify "$artifact_file" \\\n            --bundle "$bundle_file" \\\n            --custom-trusted-root "$trusted_root_file" \\\n            --repo "$SUPACLOUD_GITHUB_REPOSITORY" \\\n            --signer-workflow "$SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW" \\\n            --source-ref "refs/heads/main" \\\n            --deny-self-hosted-runners 2>&1); then\n            echo "GitHub artifact attestation verification failed: ${verification_output}" >&2\n            return 1\n        fi\n        supacloud_record_integrity_mode "github-attestation+same-release-sha256"\n        return\n    fi\n\n    if [[ "${SUPACLOUD_ALLOW_UNVERIFIED_RELEASE:-false}" == "true" ]]; then\n        echo "BREAK-GLASS LIMITED INTEGRITY MODE: artifact attestation verification is unavailable; only the same-release SHA256 checksum was verified." >&2\n        supacloud_record_integrity_mode "break-glass:same-release-sha256-only"\n        return 0\n    fi\n\n    echo "Artifact attestation verification is required, but gh attestation verify is unavailable. Install GitHub CLI or explicitly set SUPACLOUD_ALLOW_UNVERIFIED_RELEASE=true for emergency break-glass use." >&2\n    return 1\n)\n\nsupacloud_attestation_verifier_available() {\n    local version help\n    supacloud_attestation_trusted_root_available || return 1\n    command -v gh >/dev/null 2>&1 || return 1\n    version=$(supacloud_gh_version)\n    [[ -n "$version" ]] || return 1\n    supacloud_version_at_least "$version" "$SUPACLOUD_GH_MIN_VERSION" || return 1\n    help=$(gh attestation verify --help 2>&1) || return 1\n    grep -Eq -- \'(^|[[:space:]])--bundle([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--signer-workflow([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--source-ref([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--custom-trusted-root([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--deny-self-hosted-runners([=[:space:]]|$)\' <<< "$help"\n}\n\nsupacloud_download_release_asset() (\n    local release_json="$1"\n    local asset_name="$2"\n    local destination="$3"\n    local asset_kind="$4"\n    local asset_url checksum_url temporary_artifact temporary_checksums\n\n    asset_url=$(supacloud_release_asset_url "$release_json" "$asset_name") || return 1\n    checksum_url=$(supacloud_release_asset_url "$release_json" SHA256SUMS) || return 1\n    mkdir -p "$(dirname "$destination")"\n    temporary_artifact=$(mktemp "${destination}.tmp.XXXXXX")\n    temporary_checksums=$(mktemp "${destination}.SHA256SUMS.tmp.XXXXXX")\n    trap \'rm -f "${temporary_artifact:-}" "${temporary_checksums:-}"\' EXIT\n    trap \'trap - EXIT HUP INT TERM; rm -f "${temporary_artifact:-}" "${temporary_checksums:-}"; exit 1\' HUP INT TERM\n\n    if ! supacloud_download_url "$asset_url" "$temporary_artifact" \\\n        || ! supacloud_download_release_metadata_url "$checksum_url" "$temporary_checksums" \\\n        || ! supacloud_verify_checksum "$temporary_artifact" "$asset_name" "$temporary_checksums"; then\n        rm -f "$temporary_artifact" "$temporary_checksums"\n        return 1\n    fi\n\n    # Authenticate the digest before parsing archives or inspecting binaries.\n    if ! supacloud_verify_attestation "$temporary_artifact"; then\n        rm -f "$temporary_artifact" "$temporary_checksums"\n        return 1\n    fi\n\n    case "$asset_kind" in\n        binary) supacloud_validate_binary "$temporary_artifact" "$asset_name" ;;\n        tar) supacloud_validate_tar "$temporary_artifact" ;;\n        *)\n            echo "Unknown release asset kind: $asset_kind" >&2\n            rm -f "$temporary_artifact" "$temporary_checksums"\n            return 1\n            ;;\n    esac || {\n        rm -f "$temporary_artifact" "$temporary_checksums"\n        return 1\n    }\n\n    mv -f "$temporary_artifact" "$destination"\n    temporary_artifact=""\n    rm -f "$temporary_checksums"\n    temporary_checksums=""\n)\n';
 
 // src/shared/tools/ssh-tools.ts
 var SAFE_CONTAINER_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/;
@@ -28077,10 +28127,13 @@ function componentBootstrapCommands(request) {
     `supacloud_download_release_asset "$MANAGEMENT_RELEASE" "$MANAGEMENT_ASSET" "$STAGED_MANAGEMENT" binary`,
     `chmod 0755 "$STAGED_MANAGEMENT"`,
     `TARGET_MANAGEMENT_VERSION=$(jq -er '.tag_name | capture("^management-api-v(?<version>(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*))$").version' <<< "$MANAGEMENT_RELEASE")`,
-    `STAGED_VERSION=$("$STAGED_MANAGEMENT" --version 2>&1 | grep -Eo '[0-9]+\\.[0-9]+\\.[0-9]+' | head -1 || true)`,
+    `STAGED_VERSION=$(timeout 5s "$STAGED_MANAGEMENT" --version 2>&1 | grep -Eo '[0-9]+\\.[0-9]+\\.[0-9]+' | head -1 || true)`,
     `test "$STAGED_VERSION" = "$TARGET_MANAGEMENT_VERSION" || { echo 'Target Management binary version does not match its verified release' >&2; exit 1; }`,
     `supacloud_version_at_least "$STAGED_VERSION" ${quoteEnvValue(MINIMUM_COMPONENT_UPGRADE_VERSION)} || { echo 'Target Management release lacks component transaction capability' >&2; exit 1; }`,
-    `"$STAGED_MANAGEMENT" --systemd-unit-helper-sha256 >/dev/null 2>&1 || { echo 'Target Management release lacks target-bound systemd-unit helper delivery' >&2; exit 1; }`,
+    `SYSTEMD_HELPER_OUTPUT=$(timeout 5s "$STAGED_MANAGEMENT" --systemd-unit-helper-sha256 2>&1)`,
+    `[[ "$SYSTEMD_HELPER_OUTPUT" =~ ^SupaCloud[[:space:]]systemd-unit[[:space:]]helper[[:space:]]SHA-256:[[:space:]][0-9a-f]{64}$ ]] || { echo 'Target Management release lacks target-bound systemd-unit helper delivery' >&2; exit 1; }`,
+    `POSTGREST_LAUNCHER_OUTPUT=$(timeout 5s "$STAGED_MANAGEMENT" --postgrest-launcher-sha256 2>&1)`,
+    `[[ "$POSTGREST_LAUNCHER_OUTPUT" =~ ^SupaCloud[[:space:]]PostgREST[[:space:]]launcher[[:space:]]SHA-256:[[:space:]][0-9a-f]{64}$ ]] || { echo 'Target Management release lacks target-bound PostgREST launcher delivery' >&2; exit 1; }`,
     `UPGRADE_RUNNER="$STAGED_MANAGEMENT"`
   ];
 }
@@ -28127,7 +28180,7 @@ function buildRootUpgradeScript(request) {
     "export PATH",
     "unset SUPACLOUD_ALLOW_UNVERIFIED_RELEASE SUPACLOUD_GITHUB_REPOSITORY SUPACLOUD_RELEASES_API SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW SUPACLOUD_ATTESTATION_TRUSTED_ROOT SUPACLOUD_GH_VERSION SUPACLOUD_GH_MIN_VERSION SUPACLOUD_GH_AMD64_SHA256 SUPACLOUD_GH_ARM64_SHA256 GH_PROXY",
     request.githubProxy ? `export SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(request.githubProxy)}` : "unset SUPACLOUD_GITHUB_PROXY SUPACLOUD_GITHUB_PROXIES",
-    'for tool in curl jq file sha256sum stat tar flock find sort chown; do command -v "$tool" >/dev/null 2>&1 || { echo "Required upgrade tool is missing: $tool" >&2; exit 127; }; done',
+    'for tool in curl jq file sha256sum stat tar flock find sort chown timeout; do command -v "$tool" >/dev/null 2>&1 || { echo "Required upgrade tool is missing: $tool" >&2; exit 127; }; done',
     "test -d /run/lock || { echo '/run/lock is unavailable' >&2; exit 1; }",
     "test -x /usr/local/bin/supacloud || { echo 'SupaCloud binary not found at /usr/local/bin/supacloud; run ssh install first.' >&2; exit 127; }",
     ...trustedRootPreflightCommands(request.helperPath),
@@ -28854,7 +28907,7 @@ Actions: ping, setup, install, upgrade, versions, diagnose, exec, troubleshoot,
         const CONFIG = "/etc/supabase/install.env";
         const INPUT = `/etc/supabase/.install-input-${installId}.env`;
         const BOOTSTRAP = `/opt/.supacloud-bootstrap-${installId}`;
-        const REPO = "https://github.com/zuohuadong/supacloud.git";
+        const REPO = "https://github.com/vibeunion/supacloud.git";
         const configuredProxy = args.github_proxy ? assertSafeGithubProxy(args.github_proxy) : "direct";
         const proxyDisabled = ["direct", "none"].includes(configuredProxy.toLowerCase());
         const proxyPrefix = proxyDisabled ? "" : configuredProxy.endsWith("/") ? configuredProxy : `${configuredProxy}/`;
@@ -31843,7 +31896,7 @@ Actions: list_releases, get_release, upload_release, activate_release`, {
 // package.json
 var package_default = {
   name: "@supacloud/admin",
-  version: "0.14.1",
+  version: "0.14.3",
   description: "Platform administration CLI for SupaCloud operators",
   type: "module",
   main: "./dist/index.js",
@@ -31869,7 +31922,7 @@ var package_default = {
   license: "MIT",
   repository: {
     type: "git",
-    url: "https://github.com/zuohuadong/supacloud.git",
+    url: "https://github.com/vibeunion/supacloud.git",
     directory: "packages/admin"
   },
   dependencies: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.14.1",
+  "version": "0.14.3",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",
@@ -26,7 +26,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/zuohuadong/supacloud.git",
+    "url": "https://github.com/vibeunion/supacloud.git",
     "directory": "packages/admin"
   },
   "dependencies": {