@supacloud/admin 0.28.0 → 0.28.3

package/dist/index.js

@@ -24588,23 +24588,22 @@ function InstanceKeys(value) {
 function IsIEEE754(value) {
   return typeof value === "number";
 }
-var ByteMarker;
-(function(ByteMarker) {
-  ByteMarker[ByteMarker["Array"] = 0] = "Array";
-  ByteMarker[ByteMarker["BigInt"] = 1] = "BigInt";
-  ByteMarker[ByteMarker["Boolean"] = 2] = "Boolean";
-  ByteMarker[ByteMarker["Date"] = 3] = "Date";
-  ByteMarker[ByteMarker["Constructor"] = 4] = "Constructor";
-  ByteMarker[ByteMarker["Function"] = 5] = "Function";
-  ByteMarker[ByteMarker["Null"] = 6] = "Null";
-  ByteMarker[ByteMarker["Number"] = 7] = "Number";
-  ByteMarker[ByteMarker["Object"] = 8] = "Object";
-  ByteMarker[ByteMarker["RegExp"] = 9] = "RegExp";
-  ByteMarker[ByteMarker["String"] = 10] = "String";
-  ByteMarker[ByteMarker["Symbol"] = 11] = "Symbol";
-  ByteMarker[ByteMarker["TypeArray"] = 12] = "TypeArray";
-  ByteMarker[ByteMarker["Undefined"] = 13] = "Undefined";
-})(ByteMarker || (ByteMarker = {}));
+var ByteMarker = {
+  Array: 0,
+  BigInt: 1,
+  Boolean: 2,
+  Date: 3,
+  Constructor: 4,
+  Function: 5,
+  Null: 6,
+  Number: 7,
+  Object: 8,
+  RegExp: 9,
+  String: 10,
+  Symbol: 11,
+  TypeArray: 12,
+  Undefined: 13
+};
 var Accumulator = BigInt("14695981039346656037");
 var [Prime, Size] = [BigInt("1099511628211"), BigInt("18446744073709551616")];
 var Bytes = Array.from({ length: 256 }).map((_, i) => BigInt(i));
@@ -30151,7 +30150,7 @@ function schemaProperties(schema) {
   }
   return schema;
 }
-var DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment is no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, bind application.id and application.environmentId in supacloud.json (or SUPACLOUD_APPLICATION_ID and SUPACLOUD_ENV), then run `supacloud deploy`. SupaCloud owns deployment planning and activation; do not retry with legacy commands.";
+var DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment commands are no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, configure frontend in supacloud.json for static assets, or application.id and application.environmentId for executable application delivery, then run `supacloud deploy`. With a frontend configured, deploy publishes only Web assets; use `supacloud deploy --backend` for the application backend. `supacloud deploy --assets_only` remains an explicit Web-only option. SupaCloud owns activation; do not retry with legacy commands.";
 var removedFrontendActions = new Set([
   "deploy_git",
   "deploy_upload",
@@ -37771,23 +37770,22 @@ function InstanceKeys2(value) {
 function IsIEEE7542(value) {
   return typeof value === "number";
 }
-var ByteMarker2;
-(function(ByteMarker) {
-  ByteMarker[ByteMarker["Array"] = 0] = "Array";
-  ByteMarker[ByteMarker["BigInt"] = 1] = "BigInt";
-  ByteMarker[ByteMarker["Boolean"] = 2] = "Boolean";
-  ByteMarker[ByteMarker["Date"] = 3] = "Date";
-  ByteMarker[ByteMarker["Constructor"] = 4] = "Constructor";
-  ByteMarker[ByteMarker["Function"] = 5] = "Function";
-  ByteMarker[ByteMarker["Null"] = 6] = "Null";
-  ByteMarker[ByteMarker["Number"] = 7] = "Number";
-  ByteMarker[ByteMarker["Object"] = 8] = "Object";
-  ByteMarker[ByteMarker["RegExp"] = 9] = "RegExp";
-  ByteMarker[ByteMarker["String"] = 10] = "String";
-  ByteMarker[ByteMarker["Symbol"] = 11] = "Symbol";
-  ByteMarker[ByteMarker["TypeArray"] = 12] = "TypeArray";
-  ByteMarker[ByteMarker["Undefined"] = 13] = "Undefined";
-})(ByteMarker2 || (ByteMarker2 = {}));
+var ByteMarker2 = {
+  Array: 0,
+  BigInt: 1,
+  Boolean: 2,
+  Date: 3,
+  Constructor: 4,
+  Function: 5,
+  Null: 6,
+  Number: 7,
+  Object: 8,
+  RegExp: 9,
+  String: 10,
+  Symbol: 11,
+  TypeArray: 12,
+  Undefined: 13
+};
 var Accumulator2 = BigInt("14695981039346656037");
 var [Prime2, Size2] = [BigInt("1099511628211"), BigInt("18446744073709551616")];
 var Bytes2 = Array.from({ length: 256 }).map((_, i) => BigInt(i));
@@ -43306,7 +43304,7 @@ function decodedSchema2(inputSchema, outputSchema, decode, options) {
 }
 
 // ../cli/src/shared/deployment-upgrade.ts
-var DEPLOYMENT_UPGRADE2 = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment is no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, bind application.id and application.environmentId in supacloud.json (or SUPACLOUD_APPLICATION_ID and SUPACLOUD_ENV), then run `supacloud deploy`. SupaCloud owns deployment planning and activation; do not retry with legacy commands.";
+var DEPLOYMENT_UPGRADE2 = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment commands are no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, configure frontend in supacloud.json for static assets, or application.id and application.environmentId for executable application delivery, then run `supacloud deploy`. With a frontend configured, deploy publishes only Web assets; use `supacloud deploy --backend` for the application backend. `supacloud deploy --assets_only` remains an explicit Web-only option. SupaCloud owns activation; do not retry with legacy commands.";
 var removedFrontendActions2 = new Set([
   "deploy_git",
   "deploy_upload",
@@ -43702,12 +43700,188 @@ var FRONTEND_ARCHIVE_MAX_FILES2 = 1e4;
 var FRONTEND_ARCHIVE_MAX_SOURCE_BYTES2 = 300 * 1024 * 1024;
 var FRONTEND_ARCHIVE_MAX_TAR_BYTES2 = FRONTEND_ARCHIVE_MAX_SOURCE_BYTES2 + FRONTEND_ARCHIVE_MAX_FILES2 * 2048 + 1024;
 
+// ../cli/src/shared/mutation-protocol.ts
+var MUTATION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/;
+var OPERATION_PATTERN = /^[a-z0-9][a-z0-9._:-]{0,127}$/;
+var RESOURCE_KEY_PATTERN = /^v1\/(?:[a-z0-9][a-z0-9._-]{0,63})\/([A-Za-z0-9_-]{2,171})$/;
+var RESOURCE_ID_CONTROL_PATTERN = /[\u0000-\u001f\u007f-\u009f]/u;
+var FAILURE_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
+var LEASE_OWNER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,254}$/;
+var TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+var MAX_RESOURCE_ID_BYTES = 128;
+var FATAL_UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
+var MUTATION_STATUSES = new Set([
+  "pending",
+  "running",
+  "succeeded",
+  "failed_retryable",
+  "failed_terminal",
+  "outcome_unknown"
+]);
+var MUTATION_KEYS = [
+  "project_ref",
+  "mutation_id",
+  "operation",
+  "resource_key",
+  "request_fingerprint",
+  "principal",
+  "status",
+  "checkpoint",
+  "receipt",
+  "response_status",
+  "failure_code",
+  "lease",
+  "completed_at",
+  "created_at",
+  "updated_at"
+];
+var PRINCIPAL_KEYS = ["type", "id"];
+var LEASE_KEYS = ["owner", "expires_at", "fencing_epoch"];
+function isMutationId(candidate) {
+  return typeof candidate === "string" && MUTATION_ID_PATTERN.test(candidate);
+}
+function objectRecord(candidate) {
+  return candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
+}
+function exactRecord(candidate, keys) {
+  const record = objectRecord(candidate);
+  if (!record || Object.keys(record).length !== keys.length)
+    return null;
+  return keys.every((key) => Object.hasOwn(record, key)) ? record : null;
+}
+function emptyProjection(candidate) {
+  const record = objectRecord(candidate);
+  return record && Object.keys(record).length === 0 ? record : null;
+}
+function canonicalTimestamp4(candidate) {
+  if (typeof candidate !== "string" || !TIMESTAMP_PATTERN.test(candidate))
+    return false;
+  const milliseconds = Date.parse(candidate);
+  return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === candidate;
+}
+function nullableTimestamp(candidate) {
+  return candidate === null || canonicalTimestamp4(candidate);
+}
+function safePrincipal(candidate) {
+  const principal = exactRecord(candidate, PRINCIPAL_KEYS);
+  if (!principal || !["master", "admin", "project"].includes(String(principal["type"])))
+    return null;
+  if (typeof principal["id"] !== "string" || !principal["id"] || principal["id"].length > 320 || principal["id"].trim() !== principal["id"] || /[\u0000-\u001f\u007f]/u.test(principal["id"]))
+    return null;
+  return { type: principal["type"], id: principal["id"] };
+}
+function safeLease(candidate) {
+  const lease = exactRecord(candidate, LEASE_KEYS);
+  if (!lease || lease["owner"] !== null && (typeof lease["owner"] !== "string" || !LEASE_OWNER_PATTERN.test(lease["owner"])))
+    return null;
+  if (!nullableTimestamp(lease["expires_at"]) || !Number.isSafeInteger(lease["fencing_epoch"]) || Number(lease["fencing_epoch"]) < 0)
+    return null;
+  return {
+    owner: lease["owner"],
+    expires_at: lease["expires_at"],
+    fencing_epoch: Number(lease["fencing_epoch"])
+  };
+}
+function safeResponseStatus(candidate) {
+  if (candidate === null)
+    return null;
+  return Number.isInteger(candidate) && Number(candidate) >= 100 && Number(candidate) <= 599 ? Number(candidate) : undefined;
+}
+function validLeaseState(status, lease) {
+  const running = status === "running";
+  return running ? lease.owner !== null && lease.expires_at !== null && lease.fencing_epoch > 0 : lease.owner === null && lease.expires_at === null;
+}
+function validMutationLifecycle(mutation, receipt, responseStatus) {
+  const terminal = ["succeeded", "failed_terminal", "outcome_unknown"].includes(String(mutation["status"]));
+  if (mutation["completed_at"] !== null !== terminal)
+    return false;
+  if (mutation["status"] === "succeeded") {
+    return receipt !== null && responseStatus !== null && responseStatus >= 200 && responseStatus < 300 && mutation["failure_code"] === null;
+  }
+  if (mutation["status"] === "failed_terminal") {
+    return receipt !== null && typeof mutation["failure_code"] === "string";
+  }
+  if (mutation["status"] === "failed_retryable" || mutation["status"] === "outcome_unknown") {
+    return receipt !== null && typeof mutation["failure_code"] === "string";
+  }
+  if (mutation["status"] === "pending") {
+    return receipt === null && responseStatus === null && mutation["failure_code"] === null;
+  }
+  return true;
+}
+function canonicalMutationResourceKey(candidate) {
+  if (typeof candidate !== "string")
+    return false;
+  const match = RESOURCE_KEY_PATTERN.exec(candidate);
+  if (!match)
+    return false;
+  const encodedResourceId = match[1];
+  const resourceIdBytes = Buffer.from(encodedResourceId, "base64url");
+  if (resourceIdBytes.byteLength < 1 || resourceIdBytes.byteLength > MAX_RESOURCE_ID_BYTES || resourceIdBytes.toString("base64url") !== encodedResourceId)
+    return false;
+  let resourceId;
+  try {
+    resourceId = FATAL_UTF8_DECODER.decode(resourceIdBytes);
+  } catch (decodeError) {
+    if (decodeError instanceof TypeError)
+      return false;
+    throw decodeError;
+  }
+  return resourceId.trim() === resourceId && !RESOURCE_ID_CONTROL_PATTERN.test(resourceId) && Buffer.from(resourceId, "utf8").equals(resourceIdBytes);
+}
+function validMutationIdentity(mutation) {
+  if (!isMutationId(mutation["mutation_id"]) || typeof mutation["project_ref"] !== "string")
+    return false;
+  if (typeof mutation["operation"] !== "string" || !OPERATION_PATTERN.test(mutation["operation"]))
+    return false;
+  if (mutation["resource_key"] !== null && !canonicalMutationResourceKey(mutation["resource_key"]))
+    return false;
+  return typeof mutation["request_fingerprint"] === "string" && FINGERPRINT_PATTERN.test(mutation["request_fingerprint"]);
+}
+function validMutationTerminalFields(mutation) {
+  if (typeof mutation["status"] !== "string" || !MUTATION_STATUSES.has(mutation["status"]))
+    return false;
+  if (mutation["failure_code"] !== null && (typeof mutation["failure_code"] !== "string" || !FAILURE_CODE_PATTERN.test(mutation["failure_code"])))
+    return false;
+  return nullableTimestamp(mutation["completed_at"]) && canonicalTimestamp4(mutation["created_at"]) && canonicalTimestamp4(mutation["updated_at"]);
+}
+function safeMutationStatus(candidate) {
+  const mutation = exactRecord(candidate, MUTATION_KEYS);
+  if (!mutation || !validMutationIdentity(mutation) || !validMutationTerminalFields(mutation))
+    return null;
+  const principal = safePrincipal(mutation["principal"]);
+  const checkpoint = emptyProjection(mutation["checkpoint"]);
+  const receipt = mutation["receipt"] === null ? null : emptyProjection(mutation["receipt"]);
+  const responseStatus = safeResponseStatus(mutation["response_status"]);
+  const lease = safeLease(mutation["lease"]);
+  if (!principal || !checkpoint || mutation["receipt"] !== null && !receipt || responseStatus === undefined || !lease || !validLeaseState(String(mutation["status"]), lease) || !validMutationLifecycle(mutation, receipt, responseStatus))
+    return null;
+  return {
+    project_ref: mutation["project_ref"],
+    mutation_id: mutation["mutation_id"],
+    operation: mutation["operation"],
+    resource_key: mutation["resource_key"],
+    request_fingerprint: mutation["request_fingerprint"],
+    principal,
+    status: mutation["status"],
+    checkpoint,
+    receipt,
+    response_status: responseStatus,
+    failure_code: mutation["failure_code"],
+    lease,
+    completed_at: mutation["completed_at"],
+    created_at: mutation["created_at"],
+    updated_at: mutation["updated_at"]
+  };
+}
+
 // ../cli/src/shared/tools/frontend-release-control.ts
 var PROJECT_REF_PATTERN3 = /^[A-Za-z0-9_-]{1,20}$/u;
 var DEPLOYMENT_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/u;
 var RELEASE_ID_PATTERN = /^[0-9a-f]{64}$/u;
-var MUTATION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
-var TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
+var MUTATION_ID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+var TIMESTAMP_PATTERN2 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
 var ARCHIVE_MAX_BYTES = 100 * 1024 * 1024;
 var ARCHIVE_CHUNK_BYTES = 64 * 1024;
 var RESPONSE_MAX_BYTES = 1024 * 1024;
@@ -43748,7 +43922,7 @@ function releaseRecord(candidate) {
     "kind",
     "archive_format"
   ];
-  if (!exactKeys(record, keys) || record.schema !== FRONTEND_ARCHIVE_RELEASE_SCHEMA || record.archive_format !== FRONTEND_ARCHIVE_FORMAT || typeof record.project_ref !== "string" || !PROJECT_REF_PATTERN3.test(record.project_ref) || typeof record.deployment_id !== "string" || !DEPLOYMENT_ID_PATTERN.test(record.deployment_id) || typeof record.release_id !== "string" || !RELEASE_ID_PATTERN.test(record.release_id) || record.sha256 !== record.release_id || typeof record.tree_sha256 !== "string" || !RELEASE_ID_PATTERN.test(record.tree_sha256) || !Number.isSafeInteger(record.size_bytes) || Number(record.size_bytes) < 1 || !Number.isSafeInteger(record.file_count) || Number(record.file_count) < 1 || !canonicalTimestamp4(record.created_at) || record.kind !== "prebuilt_static")
+  if (!exactKeys(record, keys) || record.schema !== FRONTEND_ARCHIVE_RELEASE_SCHEMA || record.archive_format !== FRONTEND_ARCHIVE_FORMAT || typeof record.project_ref !== "string" || !PROJECT_REF_PATTERN3.test(record.project_ref) || typeof record.deployment_id !== "string" || !DEPLOYMENT_ID_PATTERN.test(record.deployment_id) || typeof record.release_id !== "string" || !RELEASE_ID_PATTERN.test(record.release_id) || record.sha256 !== record.release_id || typeof record.tree_sha256 !== "string" || !RELEASE_ID_PATTERN.test(record.tree_sha256) || !Number.isSafeInteger(record.size_bytes) || Number(record.size_bytes) < 1 || !Number.isSafeInteger(record.file_count) || Number(record.file_count) < 1 || !canonicalTimestamp5(record.created_at) || record.kind !== "prebuilt_static")
     return null;
   return {
     project_ref: record.project_ref,
@@ -43772,8 +43946,8 @@ function releaseEnvelope(candidate, expected) {
     return null;
   return release;
 }
-function canonicalTimestamp4(candidate) {
-  if (typeof candidate !== "string" || !TIMESTAMP_PATTERN.test(candidate))
+function canonicalTimestamp5(candidate) {
+  if (typeof candidate !== "string" || !TIMESTAMP_PATTERN2.test(candidate))
     return false;
   const milliseconds = Date.parse(candidate);
   return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === candidate;
@@ -43798,7 +43972,7 @@ function releaseInventory(candidate, expected) {
   if (!exactKeys(record, keys) || typeof record.project_ref !== "string" || !PROJECT_REF_PATTERN3.test(record.project_ref) || typeof record.deployment_id !== "string" || !DEPLOYMENT_ID_PATTERN.test(record.deployment_id) || !Array.isArray(record.releases))
     return null;
   const activeReleaseId = nullableIdentity(record.active_release_id, RELEASE_ID_PATTERN);
-  const activeActivationId = nullableIdentity(record.active_activation_id, MUTATION_ID_PATTERN);
+  const activeActivationId = nullableIdentity(record.active_activation_id, MUTATION_ID_PATTERN2);
   const nextCursor = nullableIdentity(record.next_cursor, RELEASE_ID_PATTERN);
   const releases = record.releases.map(releaseRecord);
   if (activeReleaseId === undefined || activeActivationId === undefined || nextCursor === undefined || activeReleaseId === null !== (activeActivationId === null) || releases.some((release) => release === null))
@@ -43909,13 +44083,16 @@ async function getFrontendRelease(http, projectRef, deploymentId, releaseId) {
   const response = await http.get(releasePath(projectRef, deploymentId, releaseId), {
     maxJsonBytes: RESPONSE_MAX_BYTES
   });
-  const release = response.ok ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId }) : null;
+  const release = response.ok && response.status === 200 ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId }) : null;
   if (!release) {
     return releaseReadFailure("frontend.get_release", response);
   }
   return toolResponse({ project_ref: projectRef, deployment_id: deploymentId, release });
 }
 async function uploadFrontendRelease(http, projectRef, deploymentId, archivePath) {
+  return uploadFrontendReleaseWithReadback(http, projectRef, deploymentId, archivePath, true);
+}
+async function uploadFrontendReleaseWithReadback(http, projectRef, deploymentId, archivePath, verifyReadback) {
   const endpoint = releaseEndpoint(projectRef, deploymentId);
   const archive = await verifiedArchive(archivePath);
   let response;
@@ -43934,13 +44111,15 @@ async function uploadFrontendRelease(http, projectRef, deploymentId, archivePath
   } finally {
     await archive.handle.close();
   }
-  const release = response.ok ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId: archive.sha256 }) : null;
+  const release = response.ok && (response.status === 200 || response.status === 201) ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId: archive.sha256 }) : null;
   if (!release) {
     if (response.status >= 400 && response.status < 500 && response.status !== 408 && !response.transportError) {
       return releaseFailure("frontend.upload_release", "HTTP_ERROR", response.status);
     }
     return uploadReadback(http, projectRef, deploymentId, archive.sha256, response.status);
   }
+  if (!verifyReadback)
+    return toolResponse({ project_ref: projectRef, deployment_id: deploymentId, release });
   const readback = await http.get(`${endpoint}/${release.release_id}`, { maxJsonBytes: RESPONSE_MAX_BYTES });
   const verified = readback.ok ? releaseEnvelope(readback.data, { projectRef, deploymentId, releaseId: release.release_id }) : null;
   if (!verified || verified.tree_sha256 !== release.tree_sha256) {
@@ -43952,7 +44131,7 @@ async function uploadReadback(http, projectRef, deploymentId, releaseId, uploadS
   const response = await http.get(releasePath(projectRef, deploymentId, releaseId), {
     maxJsonBytes: RESPONSE_MAX_BYTES
   });
-  const release = response.ok ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId }) : null;
+  const release = response.ok && response.status === 200 ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId }) : null;
   if (!release) {
     return releaseFailure("frontend.upload_release", "OUTCOME_UNKNOWN", uploadStatus);
   }
@@ -43983,25 +44162,8 @@ function publicMutationReceipt(candidate, expected) {
   if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
     return null;
   const envelope = candidate;
-  const mutation = envelope.mutation;
-  const expectedKeys = [
-    "project_ref",
-    "mutation_id",
-    "operation",
-    "resource_key",
-    "request_fingerprint",
-    "principal",
-    "status",
-    "checkpoint",
-    "receipt",
-    "response_status",
-    "failure_code",
-    "lease",
-    "completed_at",
-    "created_at",
-    "updated_at"
-  ];
-  if (!mutation || !exactKeys(envelope, ["project_ref", "mutation"]) || !exactKeys(mutation, expectedKeys) || envelope.project_ref !== expected.projectRef || mutation.project_ref !== expected.projectRef || mutation.mutation_id !== expected.mutationId || mutation.resource_key !== expected.resourceKey || mutation.request_fingerprint !== expected.requestFingerprint || typeof mutation.operation !== "string" || typeof mutation.status !== "string" || !(mutation.response_status === null || Number.isSafeInteger(mutation.response_status)) || !(mutation.failure_code === null || typeof mutation.failure_code === "string"))
+  const mutation = safeMutationStatus(envelope.mutation);
+  if (!mutation || !exactKeys(envelope, ["project_ref", "mutation"]) || envelope.project_ref !== expected.projectRef || mutation.project_ref !== expected.projectRef || mutation.mutation_id !== expected.mutationId || mutation.resource_key !== expected.resourceKey || mutation.request_fingerprint !== expected.requestFingerprint)
     return null;
   return {
     operation: mutation.operation,
@@ -44028,6 +44190,18 @@ function activationReceipt(candidate, input) {
   return release;
 }
 async function activeReleaseReadback(http, identity) {
+  const snapshot = await activeReleaseSnapshotReadback(http, identity);
+  if (!snapshot.release)
+    return snapshot;
+  const releaseRead = await http.get(releasePath(identity.projectRef, identity.deploymentId, identity.releaseId), { maxJsonBytes: RESPONSE_MAX_BYTES });
+  const release = releaseRead.ok && releaseRead.status === 200 ? releaseEnvelope(releaseRead.data, {
+    projectRef: identity.projectRef,
+    deploymentId: identity.deploymentId,
+    releaseId: identity.releaseId
+  }) : null;
+  return { release, status: releaseRead.status };
+}
+async function activeReleaseSnapshotReadback(http, identity) {
   const snapshot = await readActiveFrontendRelease(http, identity.projectRef, identity.deploymentId);
   if ("failure" in snapshot)
     return { release: null, status: snapshot.status };
@@ -44035,13 +44209,7 @@ async function activeReleaseReadback(http, identity) {
   if (inventory.active_release_id !== identity.releaseId || inventory.active_activation_id !== identity.mutationId) {
     return { release: null, status: 200 };
   }
-  const releaseRead = await http.get(releasePath(identity.projectRef, identity.deploymentId, identity.releaseId), { maxJsonBytes: RESPONSE_MAX_BYTES });
-  const release = releaseRead.ok ? releaseEnvelope(releaseRead.data, {
-    projectRef: identity.projectRef,
-    deploymentId: identity.deploymentId,
-    releaseId: identity.releaseId
-  }) : null;
-  return { release, status: releaseRead.status };
+  return { release: inventory.releases[0] ?? null, status: 200 };
 }
 async function readActiveFrontendRelease(http, projectRef, deploymentId) {
   const response = await http.get(`${deploymentEndpoint(projectRef, deploymentId)}/active-release`, {
@@ -44077,10 +44245,74 @@ async function getActiveFrontendRelease(http, projectRef, deploymentId) {
   const snapshot = await readActiveFrontendRelease(http, projectRef, deploymentId);
   return "failure" in snapshot ? snapshot.failure : toolResponse(snapshot.inventory);
 }
-async function rollbackFrontendRelease(http, projectRef, deploymentId, releaseId) {
+function boundRollbackResponse(result, input) {
+  const payload = JSON.parse(result.content[0].text);
+  return {
+    ...toolResponse({
+      ...payload,
+      operation: "frontend.rollback",
+      project_ref: input.projectRef,
+      deployment_id: input.deploymentId,
+      target_release_id: input.releaseId,
+      mutation_id: input.mutationId,
+      expected_active_release_id: input.expectedActiveReleaseId,
+      expected_activation_id: input.expectedActivationId,
+      ...!result.isError ? {
+        rollback: true,
+        previous_release_id: input.expectedActiveReleaseId,
+        previous_activation_id: input.expectedActivationId
+      } : {}
+    }),
+    ...result.isError ? { isError: true } : {}
+  };
+}
+async function rollbackBoundFrontendRelease(http, input) {
+  const authority = await readActiveFrontendRelease(http, input.projectRef, input.deploymentId);
+  if ("failure" in authority)
+    return boundRollbackResponse(authority.failure, input);
+  const current = authority.inventory;
+  if (current.active_release_id === input.releaseId && current.active_activation_id === input.mutationId) {
+    return boundRollbackResponse(await activationReadback(http, input, input.mutationId, 200), input);
+  }
+  if (current.active_release_id !== input.expectedActiveReleaseId || current.active_activation_id !== input.expectedActivationId) {
+    return boundRollbackResponse(releaseFailure("frontend.rollback", "STALE_AUTHORITY", 409), input);
+  }
+  const target = await getFrontendRelease(http, input.projectRef, input.deploymentId, input.releaseId);
+  if (target.isError)
+    return boundRollbackResponse(target, input);
+  return boundRollbackResponse(await activateFrontendRelease(http, input), input);
+}
+async function rollbackFrontendRelease(http, projectRef, deploymentId, releaseId, options = {}) {
   if (releaseId !== undefined && !RELEASE_ID_PATTERN.test(releaseId)) {
     throw new Error("'release_id' must be a SHA-256 digest");
   }
+  const bound = options.expectedActiveReleaseId !== undefined || options.expectedActivationId !== undefined || options.mutationId !== undefined;
+  if (bound) {
+    const { expectedActiveReleaseId, expectedActivationId, mutationId } = options;
+    if (releaseId === undefined || expectedActiveReleaseId === undefined || expectedActivationId === undefined || mutationId === undefined) {
+      throw new Error("'release_id', 'expected_active_release_id', 'expected_activation_id', and 'mutation_id' are required together for a bound rollback");
+    }
+    if (!RELEASE_ID_PATTERN.test(expectedActiveReleaseId)) {
+      throw new Error("'expected_active_release_id' must be a SHA-256 digest");
+    }
+    if (!MUTATION_ID_PATTERN2.test(expectedActivationId)) {
+      throw new Error("'expected_activation_id' must be a UUIDv4");
+    }
+    if (!MUTATION_ID_PATTERN2.test(mutationId)) {
+      throw new Error("'mutation_id' must be a UUIDv4");
+    }
+    if (releaseId === expectedActiveReleaseId || mutationId === expectedActivationId) {
+      throw new Error("Bound rollback requires a different target release and a distinct mutation UUID");
+    }
+    return rollbackBoundFrontendRelease(http, {
+      projectRef,
+      deploymentId,
+      releaseId,
+      expectedActiveReleaseId,
+      expectedActivationId,
+      mutationId
+    });
+  }
   const authority = releaseId === undefined ? await readPreviousFrontendRelease(http, projectRef, deploymentId) : await readActiveFrontendRelease(http, projectRef, deploymentId);
   if ("failure" in authority)
     return authority.failure;
@@ -44149,8 +44381,8 @@ async function readPreviousFrontendRelease(http, projectRef, deploymentId) {
   const data = response.data;
   const value = data && typeof data === "object" && !Array.isArray(data) ? data : null;
   const activeReleaseId = value ? nullableIdentity(value.active_release_id, RELEASE_ID_PATTERN) : undefined;
-  const activeActivationId = value ? nullableIdentity(value.active_activation_id, MUTATION_ID_PATTERN) : undefined;
-  const previousActivationId = value ? nullableIdentity(value.previous_activation_id, MUTATION_ID_PATTERN) : undefined;
+  const activeActivationId = value ? nullableIdentity(value.active_activation_id, MUTATION_ID_PATTERN2) : undefined;
+  const previousActivationId = value ? nullableIdentity(value.previous_activation_id, MUTATION_ID_PATTERN2) : undefined;
   const previous = value?.previous_release === null ? null : releaseRecord(value?.previous_release);
   if (!response.ok || response.status !== 200 || !value || !exactKeys(value, [
     "schema",
@@ -44176,13 +44408,16 @@ async function readPreviousFrontendRelease(http, projectRef, deploymentId) {
   };
 }
 async function activateFrontendRelease(http, input) {
+  return activateFrontendReleaseWithReadback(http, input, activeReleaseReadback);
+}
+async function activateFrontendReleaseWithReadback(http, input, readActive) {
   const mutationId = input.mutationId;
-  if (!MUTATION_ID_PATTERN.test(mutationId))
+  if (!MUTATION_ID_PATTERN2.test(mutationId))
     throw new Error("'mutation_id' must be a UUIDv4");
   if (input.expectedActiveReleaseId !== "absent" && !RELEASE_ID_PATTERN.test(input.expectedActiveReleaseId)) {
     throw new Error("'expected_active_release_id' is invalid");
   }
-  if (input.expectedActivationId !== "absent" && !MUTATION_ID_PATTERN.test(input.expectedActivationId)) {
+  if (input.expectedActivationId !== "absent" && !MUTATION_ID_PATTERN2.test(input.expectedActivationId)) {
     throw new Error("'expected_activation_id' is invalid");
   }
   const endpoint = `${releasePath(input.projectRef, input.deploymentId, input.releaseId)}/activate`;
@@ -44195,13 +44430,13 @@ async function activateFrontendRelease(http, input) {
     responseTimeoutMs: MUTATION_RESPONSE_TIMEOUT_MS
   });
   const release = activationReceipt(response.data, { ...input, mutationId });
-  if (!response.ok || !release) {
+  if (!response.ok || response.status !== 200 || !release) {
     if (response.status >= 400 && response.status < 500 && response.status !== 408 && !response.transportError) {
       return releaseFailure("frontend.activate_release", "HTTP_ERROR", response.status);
     }
     return activationReadback(http, input, mutationId, response.status);
   }
-  const readback = await activeReleaseReadback(http, { ...input, mutationId });
+  const readback = await readActive(http, { ...input, mutationId });
   if (!readback.release || readback.release.tree_sha256 !== release.tree_sha256) {
     return releaseFailure("frontend.activate_release", "OUTCOME_UNKNOWN", readback.status);
   }
@@ -44216,7 +44451,7 @@ async function activateFrontendRelease(http, input) {
 async function activationReadback(http, input, mutationId, activationStatus) {
   const mutationRead = await http.get(`/v1/projects/${encodeURIComponent(input.projectRef)}/mutations/${mutationId}`, { maxJsonBytes: RESPONSE_MAX_BYTES });
   const mutationEnvelope = mutationRead.data;
-  const mutation = mutationRead.ok ? publicMutationReceipt(mutationRead.data, {
+  const mutation = mutationRead.ok && mutationRead.status === 200 ? publicMutationReceipt(mutationRead.data, {
     projectRef: input.projectRef,
     mutationId,
     resourceKey: activationResourceKey(input.deploymentId),
@@ -44321,7 +44556,7 @@ Actions: list_releases, get_active_release, get_release, upload_release, activat
 // package.json
 var package_default = {
   name: "@supacloud/admin",
-  version: "0.28.0",
+  version: "0.28.3",
   description: "Platform administration CLI for SupaCloud operators",
   type: "module",
   main: "./dist/index.js",
@@ -44356,21 +44591,21 @@ var package_default = {
     directory: "packages/admin"
   },
   dependencies: {
-    "@supacloud/delivery": "0.16.0",
-    typebox: "1.3.36",
-    "@supacloud/cli": "0.94.0",
+    "@supacloud/delivery": "0.19.3",
+    typebox: "1.3.37",
+    "@supacloud/cli": "0.103.6",
     ssh2: "^1.17.0"
   },
   devDependencies: {
-    "@types/bun": "^1.4.2",
+    "@types/bun": "^1.4.3",
     "@types/ssh2": "^1.15.6",
     typescript: "^7.0.2"
   },
   overrides: {
-    "@supacloud/contracts": "0.8.1",
-    "@supacloud/db": "0.16.2",
-    "@supacloud/delivery": "0.16.0",
-    "@graphql-tools/utils": "^12.0.3"
+    "@supacloud/contracts": "0.11.4",
+    "@supacloud/db": "0.18.3",
+    "@supacloud/delivery": "0.19.3",
+    "@graphql-tools/utils": "^12.0.4"
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.28.0",
+  "version": "0.28.3",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",
@@ -35,20 +35,20 @@
     "directory": "packages/admin"
   },
   "dependencies": {
-    "@supacloud/delivery": "0.16.0",
-    "typebox": "1.3.36",
-    "@supacloud/cli": "0.94.0",
+    "@supacloud/delivery": "0.19.3",
+    "typebox": "1.3.37",
+    "@supacloud/cli": "0.103.6",
     "ssh2": "^1.17.0"
   },
   "devDependencies": {
-    "@types/bun": "^1.4.2",
+    "@types/bun": "^1.4.3",
     "@types/ssh2": "^1.15.6",
     "typescript": "^7.0.2"
   },
   "overrides": {
-    "@supacloud/contracts": "0.8.1",
-    "@supacloud/db": "0.16.2",
-    "@supacloud/delivery": "0.16.0",
-    "@graphql-tools/utils": "^12.0.3"
+    "@supacloud/contracts": "0.11.4",
+    "@supacloud/db": "0.18.3",
+    "@supacloud/delivery": "0.19.3",
+    "@graphql-tools/utils": "^12.0.4"
   }
 }