@supacloud/admin 0.15.3 → 0.15.5

package/dist/index.js

@@ -25000,11 +25000,10 @@ class BoundedOutputCollector {
       output = lastNewline >= 0 ? output.slice(0, lastNewline + 1) : "";
     }
     const redacted = redactSshOutput(output);
-    if (!this.truncated)
-      return redacted;
-    return `${redacted}${redacted && !redacted.endsWith(`
+    const bounded = !this.truncated ? redacted : `${redacted}${redacted && !redacted.endsWith(`
 `) ? `
 ` : ""}[TRUNCATED: output exceeded ${this.limit}-byte limit]`;
+    return { output: bounded, redacted: redacted !== output };
   }
 }
 var BLOCKED_COMMANDS = [
@@ -25025,11 +25024,73 @@ var BLOCKED_COMMANDS = [
   "chmod -R 777 /"
 ];
 function redactSshCommand(command) {
-  return command.replace(/(\b[A-Z0-9_]*(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL)[A-Z0-9_]*=)(?:"[^"]*"|'[^']*'|[^\s;]+)/gi, "$1[REDACTED]").replace(/(Authorization\s*[:=]\s*)(['"]?)Bearer\s+[^'"\s;]+\2/gi, "$1$2Bearer [REDACTED]$2").replace(/(\b--(?:password|token|secret|api-key)\s+)(\S+)/gi, "$1[REDACTED]").replace(/(postgres(?:ql)?:\/\/[^:\s/]+:)[^@\s]+@/gi, "$1[REDACTED]@");
+  return command.replace(/(\b[A-Z0-9_]*(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL)[A-Z0-9_]*=)(?:"[^"]*"|'[^']*'|[^\s;]+)/gi, "$1[REDACTED]").replace(/(Authorization\s*[:=]\s*)(['"]?)Bearer\s+[^'"\s;]+\2/gi, "$1$2Bearer [REDACTED]$2").replace(/(\b--(?:password|token|secret|api-key)\s+)(\S+)/gi, "$1[REDACTED]").replace(/(postgres(?:ql)?:\/\/[^:\s/]*:)[^@\s]+@/gi, "$1[REDACTED]@");
+}
+var SENSITIVE_STRUCTURED_FIELD = /(?:password|pass|secret|token|key|credential|db_uri|database_url|dsn)/i;
+function decodedStructuredFieldName(encodedName) {
+  let decodedName = encodedName.replace(/\\'/g, "'");
+  for (let decodingPass = 0;decodingPass < 3; decodingPass += 1) {
+    if (decodedName.length > 256)
+      return null;
+    try {
+      const nextName = JSON.parse(`"${decodedName.replace(/"/g, "\\\"")}"`);
+      if (typeof nextName !== "string" || nextName === decodedName)
+        return decodedName;
+      decodedName = nextName;
+    } catch {
+      return null;
+    }
+  }
+  return decodedName;
+}
+function containsSensitiveStructuredField(message) {
+  const normalizedQuotes = message.replace(/\\"/g, '"').replace(/\\'/g, "'");
+  const fieldPatterns = [
+    /"((?:\\.|[^"\\\r\n])*)"\s*:/g,
+    /'((?:\\.|[^'\\\r\n])*)'\s*:/g,
+    /(?:^|[{,]\s*)([A-Za-z_$\\][A-Za-z0-9_$\\{}]{0,255})\s*:/g
+  ];
+  return fieldPatterns.some((pattern) => [...normalizedQuotes.matchAll(pattern)].some((match) => {
+    const decodedName = decodedStructuredFieldName(match[1]);
+    return decodedName === null || SENSITIVE_STRUCTURED_FIELD.test(decodedName);
+  }));
+}
+function structuredSensitiveFieldsAreRedacted(message) {
+  const normalizedQuotes = message.replace(/\\"/g, '"').replace(/\\'/g, "'");
+  try {
+    const parsedDiagnostic = JSON.parse(normalizedQuotes);
+    if (!parsedDiagnostic || typeof parsedDiagnostic !== "object")
+      return false;
+    let foundSensitiveField = false;
+    const pending = [parsedDiagnostic];
+    while (pending.length > 0) {
+      const current = pending.pop();
+      if (!current || typeof current !== "object")
+        continue;
+      for (const [fieldName, fieldValue] of Object.entries(current)) {
+        if (SENSITIVE_STRUCTURED_FIELD.test(fieldName)) {
+          foundSensitiveField = true;
+          if (fieldValue !== "[REDACTED]")
+            return false;
+        } else if (fieldValue && typeof fieldValue === "object") {
+          pending.push(fieldValue);
+        }
+      }
+    }
+    return foundSensitiveField;
+  } catch {
+    return false;
+  }
 }
 function redactSshOutput(output) {
-  const redactedLines = output.replace(/^(\s*(?:export\s+)?[A-Z0-9_]*(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL|DB_URI|DATABASE_URL|DSN)[A-Z0-9_]*\s*=\s*).*$/gim, "$1[REDACTED]");
-  const redactedStructuredFields = redactedLines.replace(/((?:["']?(?:password|pass|secret|token|key|credential|db_uri|database_url|dsn)["']?)\s*:\s*)(?:"[^"]*"|'[^']*'|[^,}\]\r\n]+)/gi, "$1[REDACTED]");
+  const redactedEscapedFields = output.split(`
+`).map((line) => containsSensitiveStructuredField(line) && !structuredSensitiveFieldsAreRedacted(line) ? "[REDACTED: structured secret output]" : line).join(`
+`);
+  const redactedLines = redactedEscapedFields.replace(/^(\s*(?:export\s+)?[A-Z0-9_]*(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL|DB_URI|DATABASE_URL|DSN)[A-Z0-9_]*\s*=\s*).*$/gim, "$1[REDACTED]");
+  const redactedStructuredFields = redactedLines.replace(/((?:["']?(?:password|pass|secret|token|key|credential|db_uri|database_url|dsn)["']?)\s*:\s*)("[^"]*"|'[^']*'|[^,}\]\r\n]+)/gi, (_match, prefix, literal) => {
+    const quote = literal[0];
+    return `${prefix}${quote === '"' || quote === "'" ? `${quote}[REDACTED]${quote}` : "[REDACTED]"}`;
+  });
   return redactSshCommand(redactedStructuredFields);
 }
 function isCommandBlocked(command) {
@@ -25172,13 +25233,17 @@ class SshTransport {
                 reject(new SshCommandOutcomeUnknownError("SSH command stream closed without a terminal status; remote outcome is unknown"));
                 return;
               }
+              const finalizedStdout = stdout.finalize();
+              const finalizedStderr = stderr.finalize();
               resolve({
                 success: code === 0,
-                stdout: stdout.finalize(),
-                stderr: stderr.finalize(),
+                stdout: finalizedStdout.output,
+                stderr: finalizedStderr.output,
                 code: code ?? 128,
                 stdoutTruncated: stdout.truncated,
-                stderrTruncated: stderr.truncated
+                stderrTruncated: stderr.truncated,
+                stdoutRedacted: finalizedStdout.redacted,
+                stderrRedacted: finalizedStderr.redacted
               });
             }).on("error", () => {
               clearTimeout(timer);
@@ -26367,7 +26432,7 @@ function quoteShell(shellText) {
 // src/shared/releases/local-upgrade-bundle.ts
 import { spawn } from "node:child_process";
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
-import { accessSync, chmodSync as chmodSync2, constants as fsConstants, createWriteStream, lstatSync, mkdirSync, mkdtempSync as mkdtempSync2, readFileSync as readFileSync3, readdirSync, renameSync, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { accessSync, chmodSync as chmodSync2, constants as fsConstants, createWriteStream, lstatSync, mkdirSync, mkdtempSync as mkdtempSync2, readFileSync as readFileSync3, readdirSync, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { get } from "node:https";
 import { tmpdir as tmpdir2 } from "node:os";
 import { basename, delimiter, join } from "node:path";
@@ -26649,6 +26714,7 @@ async function withSigstoreVerificationDirectory(operation) {
 // src/shared/releases/local-upgrade-bundle.ts
 var RELEASES_API = `https://api.github.com/repos/${RELEASE_REPOSITORY}/releases`;
 var ATTESTATIONS_API = `https://api.github.com/repos/${RELEASE_REPOSITORY}/attestations`;
+var GITHUB_CLI_REPOSITORY = "cli/cli";
 var GH_VERSION = "2.96.0";
 var GH_ARCHIVE_SHA256 = {
   amd64: "83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60",
@@ -26859,6 +26925,36 @@ async function downloadDirect(url, destination, maxBytes) {
   }
   throw new AggregateError(retryFailures, `Unable to download ${parsed.hostname}${parsed.pathname}`);
 }
+async function downloadGithubReleaseAsset(request) {
+  const download = await runGithubCliDownload([
+    "release",
+    "download",
+    request.tag,
+    "--repo",
+    `github.com/${request.repository}`,
+    "--pattern",
+    request.assetName,
+    "--output",
+    "-"
+  ], request.destination, request.maxBytes, DOWNLOAD_TIMEOUT_MS);
+  if (download.exitCode !== 0) {
+    rmSync2(request.destination, { force: true });
+    throw new Error(`GitHub release asset download failed: ${download.stderr.trim().slice(-1000) || download.exitCode}`);
+  }
+  assertDownloadedReleaseAsset(request);
+}
+function assertDownloadedReleaseAsset(request) {
+  const stats = lstatSync(request.destination);
+  if (!stats.isFile() || stats.isSymbolicLink() || stats.nlink !== 1) {
+    rmSync2(request.destination, { force: true });
+    throw new Error("GitHub release asset must be a direct regular file");
+  }
+  if (stats.size > request.maxBytes) {
+    rmSync2(request.destination, { force: true });
+    throw new Error(`GitHub release asset exceeded ${request.maxBytes} bytes`);
+  }
+  chmodSync2(request.destination, 384);
+}
 function parseJsonFile(filePath, label) {
   const contents = readFileSync3(filePath, "utf8");
   try {
@@ -26930,7 +27026,7 @@ function serializeAttestationBundles(candidate) {
 function directEnvironment() {
   const environment = { ...process.env };
   for (const key of Object.keys(environment)) {
-    if (/(?:^|_)proxy$/i.test(key) || /^(?:SUPACLOUD_GITHUB_PROXIES|NODE_USE_ENV_PROXY)$/.test(key)) {
+    if (/(?:^|_)proxy$/i.test(key) || /^(?:GH_HOST|GH_REPO|SUPACLOUD_GITHUB_PROXIES|NODE_USE_ENV_PROXY)$/.test(key)) {
       delete environment[key];
     }
   }
@@ -26955,15 +27051,15 @@ function githubCliExecutable(environment) {
   }
   throw new Error("GitHub CLI executable was not found in PATH");
 }
-async function runGithubCli(arguments_, timeoutMs) {
-  return await new Promise((resolve2, reject) => {
-    const environment = directEnvironment();
-    const child = spawn(githubCliExecutable(environment), arguments_, {
-      env: environment,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
+function spawnGithubCli(arguments_) {
+  const environment = directEnvironment();
+  return spawn(githubCliExecutable(environment), arguments_, {
+    env: environment,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+function githubCliExitCode(child, timeoutMs) {
+  return new Promise((resolve2, reject) => {
     let timedOut = false;
     let settled = false;
     let forceKillTimer;
@@ -26982,18 +27078,46 @@ async function runGithubCli(arguments_, timeoutMs) {
       if (error)
         reject(error);
       else
-        resolve2({ exitCode: timedOut ? 124 : exitCode, stdout, stderr });
+        resolve2(timedOut ? 124 : exitCode);
     };
-    child.stdout.on("data", (chunk) => {
-      stdout = `${stdout}${chunk.toString()}`.slice(-8000);
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr = `${stderr}${chunk.toString()}`.slice(-8000);
-    });
     child.once("error", (error) => settleExecution(error, 127));
     child.once("close", (code) => settleExecution(undefined, code ?? 1));
   });
 }
+async function runGithubCli(arguments_, timeoutMs) {
+  const child = spawnGithubCli(arguments_);
+  let stdout = "";
+  let stderr = "";
+  child.stdout.on("data", (chunk) => {
+    stdout = `${stdout}${chunk.toString()}`.slice(-8000);
+  });
+  child.stderr.on("data", (chunk) => {
+    stderr = `${stderr}${chunk.toString()}`.slice(-8000);
+  });
+  const exitCode = await githubCliExitCode(child, timeoutMs);
+  return { exitCode, stdout, stderr };
+}
+async function runGithubCliDownload(arguments_, destination, maxBytes, timeoutMs) {
+  const child = spawnGithubCli(arguments_);
+  let stderr = "";
+  child.stderr.on("data", (chunk) => {
+    stderr = `${stderr}${chunk.toString()}`.slice(-8000);
+  });
+  const write = pipeline(child.stdout, boundedWriter(maxBytes), createWriteStream(destination, { flags: "wx", mode: 384 })).catch((error) => {
+    child.kill("SIGKILL");
+    throw error;
+  });
+  const [writeState, exitState] = await Promise.allSettled([write, githubCliExitCode(child, timeoutMs)]);
+  if (writeState.status === "rejected") {
+    rmSync2(destination, { force: true });
+    throw writeState.reason;
+  }
+  if (exitState.status === "rejected") {
+    rmSync2(destination, { force: true });
+    throw exitState.reason;
+  }
+  return { exitCode: exitState.value, stdout: "", stderr };
+}
 function supportsStrictGithubVerification(execution) {
   const tokens = `${execution.stdout}
 ${execution.stderr}`.split(/\s+/);
@@ -27071,16 +27195,22 @@ function manifestAttestationDownloadUrl(release, manifest, manifestDigest) {
 }
 async function downloadManifestAttestation(request) {
   const { release, manifest, manifestPath, destination } = request;
+  if (manifest.repository !== RELEASE_REPOSITORY) {
+    await downloadGithubReleaseAsset({
+      repository: RELEASE_REPOSITORY,
+      tag: release.tag_name,
+      assetName: RELEASE_ATTESTATION_NAME,
+      destination,
+      maxBytes: RELEASE_BUNDLE_SIZE_LIMITS.attestation
+    });
+    return;
+  }
   const responsePath = `${destination}.response`;
   try {
     await downloadDirect(manifestAttestationDownloadUrl(release, manifest, sha256File(manifestPath)), responsePath, RELEASE_BUNDLE_SIZE_LIMITS.attestation);
-    if (manifest.repository === RELEASE_REPOSITORY) {
-      const bundles = serializeAttestationBundles(parseJsonFile(responsePath, "GitHub attestation response"));
-      writeFileSync2(destination, bundles, { mode: 384, flag: "wx" });
-      chmodSync2(destination, 384);
-    } else {
-      renameSync(responsePath, destination);
-    }
+    const bundles = serializeAttestationBundles(parseJsonFile(responsePath, "GitHub attestation response"));
+    writeFileSync2(destination, bundles, { mode: 384, flag: "wx" });
+    chmodSync2(destination, 384);
   } finally {
     rmSync2(responsePath, { force: true });
   }
@@ -27089,7 +27219,14 @@ async function downloadComponent(request) {
   const release = await downloadReleaseMetadata(request.component, request.version, request.destination);
   const manifestPath = directChildPath(request.destination, RELEASE_MANIFEST_NAME);
   const attestationPath = directChildPath(request.destination, RELEASE_ATTESTATION_NAME);
-  await downloadDirect(releaseAssetUrl(release, RELEASE_MANIFEST_NAME), manifestPath, RELEASE_BUNDLE_SIZE_LIMITS.manifest);
+  releaseAssetUrl(release, RELEASE_MANIFEST_NAME);
+  await downloadGithubReleaseAsset({
+    repository: RELEASE_REPOSITORY,
+    tag: release.tag_name,
+    assetName: RELEASE_MANIFEST_NAME,
+    destination: manifestPath,
+    maxBytes: RELEASE_BUNDLE_SIZE_LIMITS.manifest
+  });
   const manifest = parseReleaseManifest(readFileSync3(manifestPath, "utf8"), request);
   await downloadManifestAttestation({ release, manifest, manifestPath, destination: attestationPath });
   await verifyManifestAttestation({
@@ -27099,12 +27236,26 @@ async function downloadComponent(request) {
     trustedRootPath: request.trustedRootPath
   });
   const checksumsPath = directChildPath(request.destination, RELEASE_CHECKSUMS_NAME);
-  await downloadDirect(releaseAssetUrl(release, RELEASE_CHECKSUMS_NAME), checksumsPath, RELEASE_BUNDLE_SIZE_LIMITS.checksums);
+  releaseAssetUrl(release, RELEASE_CHECKSUMS_NAME);
+  await downloadGithubReleaseAsset({
+    repository: RELEASE_REPOSITORY,
+    tag: release.tag_name,
+    assetName: RELEASE_CHECKSUMS_NAME,
+    destination: checksumsPath,
+    maxBytes: RELEASE_BUNDLE_SIZE_LIMITS.checksums
+  });
   assertSignedArtifact(checksumsPath, manifest);
   const checksums = parseReleaseChecksums(readFileSync3(checksumsPath, "utf8"), manifest);
   for (const assetName of request.assetNames) {
     const assetPath = directChildPath(request.destination, assetName);
-    await downloadDirect(releaseAssetUrl(release, assetName), assetPath, releaseAssetSizeLimit(request.component, assetName));
+    releaseAssetUrl(release, assetName);
+    await downloadGithubReleaseAsset({
+      repository: RELEASE_REPOSITORY,
+      tag: release.tag_name,
+      assetName,
+      destination: assetPath,
+      maxBytes: releaseAssetSizeLimit(request.component, assetName)
+    });
     verifyDownloadedFile(assetPath, manifest, checksums);
   }
   return [RELEASE_MANIFEST_NAME, RELEASE_ATTESTATION_NAME, RELEASE_CHECKSUMS_NAME, ...request.assetNames].map((name) => localUpgradeFile(directChildPath(request.destination, name), `bundle/${request.component}/${name}`));
@@ -27112,8 +27263,13 @@ async function downloadComponent(request) {
 async function downloadPinnedGithubCli(directory, architecture) {
   const identity = githubCliArchiveIdentity(architecture);
   const archivePath = directChildPath(directory, identity.archiveName);
-  const url = `https://github.com/cli/cli/releases/download/v${identity.version}/${identity.archiveName}`;
-  await downloadDirect(url, archivePath, MAX_GH_ARCHIVE_BYTES);
+  await downloadGithubReleaseAsset({
+    repository: GITHUB_CLI_REPOSITORY,
+    tag: `v${identity.version}`,
+    assetName: identity.archiveName,
+    destination: archivePath,
+    maxBytes: MAX_GH_ARCHIVE_BYTES
+  });
   if (sha256File(archivePath) !== identity.sha256) {
     throw new Error("Pinned GitHub CLI archive SHA256 mismatch");
   }
@@ -27226,8 +27382,10 @@ var REMOTE_LOG_ROOT = "/var/log/supacloud";
 var REMOTE_UPLOAD_ROOT = "/var/tmp";
 var REMOTE_COMMAND_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var CONTROL_PLANE_BACKUP_ROOT = "/var/lib/supacloud/backups/control-plane-upgrades";
+var CONTROL_PLANE_PREFLIGHT_PREFIX = "SUPACLOUD_CONTROL_PLANE_UPGRADE_PREFLIGHT=";
 var CONTROL_PLANE_SAFETY_PREFIX = "SUPACLOUD_CONTROL_PLANE_UPGRADE_SAFETY=";
-var MINIMUM_CONTROL_PLANE_SAFETY_VERSION = [0, 61, 4];
+var UPGRADE_FAILURE_PREFIX = "SUPACLOUD_UPGRADE_FAILURE=";
+var MINIMUM_CONTROL_PLANE_SAFETY_VERSION = [0, 61, 7];
 var POLL_INTERVAL_MS = 2000;
 var STATE_READ_ATTEMPTS = 3;
 var REMOTE_STATE_READ_TIMEOUT_MS = 15000;
@@ -27251,13 +27409,13 @@ function canonicalTimestamp(candidate) {
   const timestamp = new Date(candidate);
   return Number.isFinite(timestamp.valueOf()) && timestamp.toISOString() === candidate;
 }
-function parseControlPlaneSafetyEvidence(log) {
-  const receiptLines = log.split(/\r?\n/).filter((line) => line.startsWith(CONTROL_PLANE_SAFETY_PREFIX));
+function parseControlPlaneSafetyReceipt(log, prefix) {
+  const receiptLines = log.split(/\r?\n/).filter((line) => line.startsWith(prefix));
   if (receiptLines.length !== 1)
     throw new Error("Remote upgrade did not emit one control-plane safety receipt");
   let candidate;
   try {
-    candidate = JSON.parse(receiptLines[0].slice(CONTROL_PLANE_SAFETY_PREFIX.length));
+    candidate = JSON.parse(receiptLines[0].slice(prefix.length));
   } catch {
     throw new Error("Remote control-plane safety receipt is not valid JSON");
   }
@@ -27289,6 +27447,46 @@ function parseControlPlaneSafetyEvidence(log) {
   }
   return receipt;
 }
+function parseControlPlaneSafetyEvidence(log) {
+  return parseControlPlaneSafetyReceipt(log, CONTROL_PLANE_SAFETY_PREFIX);
+}
+function parseControlPlanePreflightEvidence(log) {
+  return parseControlPlaneSafetyReceipt(log, CONTROL_PLANE_PREFLIGHT_PREFIX);
+}
+function parsedUpgradeFailureReceipt(log) {
+  const receiptLines = log.split(/\r?\n/).filter((line) => line.startsWith(UPGRADE_FAILURE_PREFIX));
+  if (receiptLines.length !== 1)
+    throw new Error("Remote upgrade did not emit one structured failure receipt");
+  let candidate;
+  try {
+    candidate = JSON.parse(receiptLines[0].slice(UPGRADE_FAILURE_PREFIX.length));
+  } catch {
+    throw new Error("Remote upgrade failure receipt is not valid JSON");
+  }
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+    throw new Error("Remote upgrade failure receipt is invalid");
+  }
+  return candidate;
+}
+function upgradeFailureReceiptIsInvalid(receipt) {
+  const causes = receipt.causes;
+  return !exactObjectKeys(receipt, ["causes", "schema", "summary"]) || receipt.schema !== "supacloud.upgrade-failure.v1" || typeof receipt.summary !== "string" || !receipt.summary || receipt.summary.length > 500 || /[\u0000-\u001f\u007f]/.test(receipt.summary) || !Array.isArray(causes) || causes.length > 8 || causes.some((cause) => typeof cause !== "string" || !cause || cause.length > 500 || /[\u0000-\u001f\u007f]/.test(cause));
+}
+function upgradeFailureMessageContainsSensitiveData(message) {
+  const bareBearer = /\bBearer\s+(?!\[REDACTED\](?:\s|$|[,;.)]))\S+/i;
+  return redactSshOutput(message) !== message || bareBearer.test(message);
+}
+function parseUpgradeFailureEvidence(log) {
+  const receipt = parsedUpgradeFailureReceipt(log);
+  if (upgradeFailureReceiptIsInvalid(receipt)) {
+    throw new Error("Remote upgrade failure receipt is invalid");
+  }
+  const messages = [receipt.summary, ...receipt.causes];
+  if (messages.some(upgradeFailureMessageContainsSensitiveData)) {
+    throw new Error("Remote upgrade failure receipt contains sensitive data");
+  }
+  return receipt;
+}
 function assertControlPlaneSafetyVersion(version) {
   const match = version.match(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/);
   if (!match)
@@ -27301,7 +27499,7 @@ function assertControlPlaneSafetyVersion(version) {
     if (requested[index] > MINIMUM_CONTROL_PLANE_SAFETY_VERSION[index])
       return;
     if (requested[index] < MINIMUM_CONTROL_PLANE_SAFETY_VERSION[index]) {
-      throw new Error("Local artifact upgrades require Management 0.61.4 or newer with control-plane backup safety");
+      throw new Error("Local artifact upgrades require Management 0.61.7 or newer with control-plane backup preflight safety");
     }
   }
 }
@@ -27622,6 +27820,7 @@ function bundledVerifierSetup(paths, architecture) {
 function upgradeScriptExecution(paths, bundle, request) {
   const runnerAsset = `${paths.stage}/bundle/management-api/${bundle.managementBinaryName}`;
   const runner = `${paths.stage}/runner`;
+  const preflight = 'CONTROL_PLANE_PREFLIGHT_RECEIPT=$(env PATH="$VERIFIER_PATH:$PATH" "$RUNNER" --control-plane-upgrade-preflight)';
   return [
     `MANAGEMENT_VERSION=${quoteShell2(request.managementVersion)}`,
     `RUNNER_ASSET=${quoteShell2(runnerAsset)}`,
@@ -27632,7 +27831,9 @@ function upgradeScriptExecution(paths, bundle, request) {
     '"$RUNNER" --version | grep -Eq "(^|[^0-9])${MANAGEMENT_VERSION//./\\.}([^0-9]|$)"',
     `timeout 5s "$RUNNER" --systemd-unit-helper-sha256 | grep -Eq 'SupaCloud systemd-unit helper SHA-256: [0-9a-f]{64}'`,
     `timeout 5s "$RUNNER" --postgrest-launcher-sha256 | grep -Eq 'SupaCloud PostgREST launcher SHA-256: [0-9a-f]{64}'`,
-    `env PATH="$VERIFIER_PATH:$PATH" "$RUNNER" upgrade --yes --target-version ${quoteShell2(request.managementVersion)} --edge-runtime-version ${quoteShell2(request.edgeRuntimeVersion)} --asset-bundle-dir "$BUNDLE"`
+    preflight,
+    `env PATH="$VERIFIER_PATH:$PATH" "$RUNNER" upgrade --yes --target-version ${quoteShell2(request.managementVersion)} --edge-runtime-version ${quoteShell2(request.edgeRuntimeVersion)} --asset-bundle-dir "$BUNDLE"`,
+    `printf '%s\\n' "$CONTROL_PLANE_PREFLIGHT_RECEIPT"`
   ];
 }
 function buildLocalUpgradeRunScript(paths, bundle, request, architecture) {
@@ -27848,6 +28049,9 @@ async function remoteLogTail(ssh, paths) {
   const output = await ssh.exec(rootCommand(script), 15000);
   if (!output.success)
     throw remoteFailure("Unable to read the remote upgrade log", output);
+  if (output.stdoutRedacted || output.stderrRedacted || output.stdoutTruncated || output.stderrTruncated) {
+    throw new Error("Remote upgrade log required transport redaction or truncation");
+  }
   return output.stdout.slice(-4000);
 }
 async function cleanupRemoteRecords(ssh, paths) {
@@ -27945,11 +28149,13 @@ async function completedUpgradeOutput(ssh, paths) {
   } catch (error) {
     throw remoteReconciliationFailure("Upgrade succeeded but its retained log could not be read", [error], paths);
   }
+  let preflightEvidence;
   let safetyEvidence;
   try {
+    preflightEvidence = parseControlPlanePreflightEvidence(log);
     safetyEvidence = parseControlPlaneSafetyEvidence(log);
   } catch (error) {
-    throw remoteReconciliationFailure("Upgrade succeeded but control-plane safety evidence is invalid", [error], paths);
+    throw remoteReconciliationFailure("Upgrade succeeded but control-plane preflight or safety evidence is invalid", [error], paths);
   }
   try {
     await cleanupRemoteRecords(ssh, paths);
@@ -27957,7 +28163,7 @@ async function completedUpgradeOutput(ssh, paths) {
     throw remoteReconciliationFailure("Upgrade succeeded but remote evidence cleanup could not be confirmed", [error], paths);
   }
   return `✅ Upgrade done
-${JSON.stringify(safetyEvidence)}
+${JSON.stringify({ preflight: preflightEvidence, transaction: safetyEvidence })}
 ${log.slice(-1500)}`;
 }
 async function throwRemoteUpgradeFailure(ssh, paths, status) {
@@ -27967,13 +28173,19 @@ async function throwRemoteUpgradeFailure(ssh, paths, status) {
   } catch (error) {
     throw remoteReconciliationFailure("Remote upgrade failed but its retained log could not be read", [error], paths);
   }
-  const failure = new Error(`Remote local upgrade failed (${status}): ${log.slice(-1500)}`);
   if (status.endsWith(":CLEANUP_AFTER_TRANSACTION")) {
-    throw remoteReconciliationFailure("Upgrade transaction completed but staging cleanup is incomplete", [failure], paths);
+    throw remoteReconciliationFailure("Upgrade transaction completed but staging cleanup is incomplete", [new Error(`Remote local upgrade ended with ${status}`)], paths);
   }
   if (status.includes("CLEANUP")) {
-    throw remoteReconciliationFailure("Upgrade transaction and staging cleanup both failed", [failure], paths);
+    throw remoteReconciliationFailure("Upgrade transaction and staging cleanup both failed", [new Error(`Remote local upgrade ended with ${status}`)], paths);
+  }
+  let failureEvidence;
+  try {
+    failureEvidence = parseUpgradeFailureEvidence(log);
+  } catch (error) {
+    throw remoteReconciliationFailure("Remote upgrade failed without valid structured failure evidence", [error], paths);
   }
+  const failure = new Error(`Remote local upgrade failed (${status}): ${failureEvidence.summary}` + (failureEvidence.causes.length > 0 ? `; causes: ${failureEvidence.causes.join(" | ")}` : ""));
   try {
     await cleanupRemoteRecords(ssh, paths);
   } catch (cleanupError) {
@@ -32154,7 +32366,7 @@ Actions: list_releases, get_release, upload_release, activate_release`, {
 // package.json
 var package_default = {
   name: "@supacloud/admin",
-  version: "0.15.3",
+  version: "0.15.5",
   description: "Platform administration CLI for SupaCloud operators",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.15.3",
+  "version": "0.15.5",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",