@supacloud/admin 0.7.0 → 0.7.2

package/dist/index.js

@@ -6360,7 +6360,7 @@ var require_crypto = __commonJS((exports, module) => {
     MAC_INFO,
     bindingAvailable: !!binding,
     init: (() => {
-      return new Promise(async (resolve2, reject) => {
+      return new Promise(async (resolve, reject) => {
         try {
           POLY1305_WASM_MODULE = await require_poly1305()();
           POLY1305_RESULT_MALLOC = POLY1305_WASM_MODULE._malloc(16);
@@ -6368,7 +6368,7 @@ var require_crypto = __commonJS((exports, module) => {
         } catch (ex) {
           return reject(ex);
         }
-        resolve2();
+        resolve();
       });
     })(),
     NullCipher,
@@ -7540,7 +7540,7 @@ var require_agent = __commonJS((exports, module) => {
   var __dirname = "/home/runner/work/supacloud/supacloud/packages/admin/node_modules/ssh2/lib";
   var { Socket } = __require("net");
   var { Duplex } = __require("stream");
-  var { resolve: resolve2 } = __require("path");
+  var { resolve } = __require("path");
   var { readFile } = __require("fs");
   var { execFile, spawn } = __require("child_process");
   var { isParsedKey, parseKey } = require_keyParser();
@@ -7672,7 +7672,7 @@ var require_agent = __commonJS((exports, module) => {
     const RET_ERR_BINSTDIN = 13;
     const RET_ERR_BINSTDOUT = 14;
     const RET_ERR_BADLEN = 15;
-    const EXEPATH = resolve2(__dirname, "..", "util/pagent.exe");
+    const EXEPATH = resolve(__dirname, "..", "util/pagent.exe");
     const ERROR = {
       [RET_ERR_BADARGS]: new Error("Invalid pagent.exe arguments"),
       [RET_ERR_UNAVAILABLE]: new Error("Pageant is not running"),
@@ -24921,7 +24921,299 @@ function schemaProperties(schema) {
 
 // src/index.ts
 import { resolve as resolve2 } from "node:path";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
+
+// src/shared/transports/ssh.ts
+var import_ssh2 = __toESM(require_lib3(), 1);
+import { timingSafeEqual } from "node:crypto";
+import { readFileSync } from "node:fs";
+var DEFAULT_MAX_OUTPUT_BYTES = 1024 * 1024;
+var MAX_CONFIGURABLE_OUTPUT_BYTES = 16 * 1024 * 1024;
+function normalizeSshHostFingerprint(value) {
+  const trimmed = value.trim();
+  const match = trimmed.match(/^SHA256:([A-Za-z0-9+/]{43}=?)$/);
+  if (!match) {
+    throw new Error("SUPACLOUD_SSH_HOST_FINGERPRINT must use OpenSSH SHA256:<base64> format");
+  }
+  const decoded = Buffer.from(match[1], "base64");
+  if (decoded.length !== 32) {
+    throw new Error("SUPACLOUD_SSH_HOST_FINGERPRINT must contain a 32-byte SHA256 digest");
+  }
+  return `SHA256:${match[1].replace(/=+$/, "")}`;
+}
+function createHostVerifier(fingerprint) {
+  const expected = Buffer.from(normalizeSshHostFingerprint(fingerprint).slice("SHA256:".length), "base64");
+  return (actualHash) => {
+    if (!/^[a-f0-9]{64}$/i.test(actualHash))
+      return false;
+    const actual = Buffer.from(actualHash, "hex");
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+  };
+}
+function normalizeMaxOutputBytes(value) {
+  const resolved = value ?? DEFAULT_MAX_OUTPUT_BYTES;
+  if (!Number.isSafeInteger(resolved) || resolved < 1 || resolved > MAX_CONFIGURABLE_OUTPUT_BYTES) {
+    throw new Error(`maxOutputBytes must be an integer between 1 and ${MAX_CONFIGURABLE_OUTPUT_BYTES}`);
+  }
+  return resolved;
+}
+
+class BoundedOutputCollector {
+  limit;
+  storage;
+  bytes = 0;
+  truncated = false;
+  constructor(limit) {
+    this.limit = limit;
+    this.storage = Buffer.allocUnsafe(limit);
+  }
+  append(data) {
+    if (this.truncated)
+      return;
+    const buffer = Buffer.isBuffer(data) ? data : Buffer.from(data);
+    const remaining = this.limit - this.bytes;
+    const copied = Math.min(buffer.length, Math.max(0, remaining));
+    if (copied > 0)
+      buffer.copy(this.storage, this.bytes, 0, copied);
+    this.bytes += copied;
+    this.truncated = buffer.length > copied;
+  }
+  finalize() {
+    let output = this.storage.subarray(0, this.bytes).toString("utf8");
+    if (this.truncated) {
+      const lastNewline = output.lastIndexOf(`
+`);
+      output = lastNewline >= 0 ? output.slice(0, lastNewline + 1) : "";
+    }
+    const redacted = redactSshOutput(output);
+    if (!this.truncated)
+      return redacted;
+    return `${redacted}${redacted && !redacted.endsWith(`
+`) ? `
+` : ""}[TRUNCATED: output exceeded ${this.limit}-byte limit]`;
+  }
+}
+var BLOCKED_COMMANDS = [
+  "rm -rf /",
+  "mkfs",
+  "dd if=",
+  ":(){:|:&};:",
+  "shutdown",
+  "reboot",
+  "init 0",
+  "init 6",
+  "passwd",
+  "userdel",
+  "usermod -L",
+  "iptables -F",
+  "ufw disable",
+  "crontab -r",
+  "chmod -R 777 /"
+];
+function redactSshCommand(command) {
+  return command.replace(/(\b[A-Z0-9_]*(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL)[A-Z0-9_]*=)(?:"[^"]*"|'[^']*'|[^\s;]+)/gi, "$1[REDACTED]").replace(/(Authorization\s*[:=]\s*)(['"]?)Bearer\s+[^'"\s;]+\2/gi, "$1$2Bearer [REDACTED]$2").replace(/(\b--(?:password|token|secret|api-key)\s+)(\S+)/gi, "$1[REDACTED]").replace(/(postgres(?:ql)?:\/\/[^:\s/]+:)[^@\s]+@/gi, "$1[REDACTED]@");
+}
+function redactSshOutput(output) {
+  const redactedLines = output.replace(/^(\s*(?:export\s+)?[A-Z0-9_]*(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL|DB_URI|DATABASE_URL|DSN)[A-Z0-9_]*\s*=\s*).*$/gim, "$1[REDACTED]");
+  const redactedStructuredFields = redactedLines.replace(/((?:["']?(?:password|pass|secret|token|key|credential|db_uri|database_url|dsn)["']?)\s*:\s*)(?:"[^"]*"|'[^']*'|[^,}\]\r\n]+)/gi, "$1[REDACTED]");
+  return redactSshCommand(redactedStructuredFields);
+}
+function isCommandBlocked(command) {
+  const normalized = command.trim().toLowerCase();
+  return BLOCKED_COMMANDS.some((blocked) => normalized.includes(blocked));
+}
+var auditLog = [];
+function auditCommand(command, host, blocked) {
+  const safeCommand = redactSshCommand(command);
+  const entry = { timestamp: new Date().toISOString(), command: safeCommand, host, blocked };
+  auditLog.push(entry);
+  if (auditLog.length > 1000)
+    auditLog.shift();
+  if (blocked) {
+    console.error(`[SSH-AUDIT] BLOCKED command on ${host}: ${safeCommand}`);
+  } else {
+    console.log(`[SSH-AUDIT] Executing on ${host}: ${safeCommand.substring(0, 200)}`);
+  }
+}
+class SshConnectionPool {
+  pool = [];
+  maxSize = 3;
+  config;
+  creating = 0;
+  clientFactory;
+  constructor(config, clientFactory) {
+    this.config = config;
+    this.clientFactory = clientFactory;
+  }
+  async createConnection() {
+    const conn = this.clientFactory();
+    return new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        conn.end();
+        reject(new Error("SSH connection timeout"));
+      }, 15000);
+      conn.on("ready", () => {
+        clearTimeout(timeout);
+        resolve(conn);
+      }).on("error", (err) => {
+        clearTimeout(timeout);
+        reject(err);
+      }).connect({
+        host: this.config.host,
+        port: this.config.port,
+        username: this.config.username,
+        ...this.config.privateKeyPath ? { privateKey: readFileSync(this.config.privateKeyPath) } : {},
+        ...this.config.password ? { password: this.config.password } : {},
+        hostHash: "sha256",
+        hostVerifier: createHostVerifier(this.config.hostFingerprint),
+        readyTimeout: 15000,
+        keepaliveInterval: 30000
+      });
+    });
+  }
+  async acquire() {
+    if (this.pool.length > 0) {
+      const conn = this.pool.pop();
+      return conn;
+    }
+    if (this.creating < this.maxSize) {
+      this.creating++;
+      try {
+        return await this.createConnection();
+      } finally {
+        this.creating--;
+      }
+    }
+    return this.createConnection();
+  }
+  release(conn) {
+    if (this.pool.length < this.maxSize) {
+      this.pool.push(conn);
+    } else {
+      try {
+        conn.end();
+      } catch {}
+    }
+  }
+  closeAll() {
+    for (const conn of this.pool) {
+      try {
+        conn.end();
+      } catch {}
+    }
+    this.pool = [];
+  }
+}
+
+class SshTransport {
+  config;
+  pool;
+  constructor(config, options = {}) {
+    this.config = {
+      ...config,
+      hostFingerprint: normalizeSshHostFingerprint(config.hostFingerprint || ""),
+      maxOutputBytes: normalizeMaxOutputBytes(config.maxOutputBytes)
+    };
+    this.pool = new SshConnectionPool(this.config, options.clientFactory ?? (() => new import_ssh2.Client));
+  }
+  async exec(command, timeoutMs = 300000) {
+    if (isCommandBlocked(command)) {
+      auditCommand(command, this.config.host, true);
+      const safeCommand = redactSshCommand(command);
+      return {
+        success: false,
+        stdout: "",
+        stderr: `Command blocked by security policy: "${safeCommand.substring(0, 100)}". ` + `Destructive or system-altering commands are not allowed via supacloud-admin.`,
+        code: 126
+      };
+    }
+    auditCommand(command, this.config.host, false);
+    const conn = await this.pool.acquire();
+    try {
+      return await new Promise((resolve, reject) => {
+        const outputLimit = this.config.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
+        const stdout = new BoundedOutputCollector(outputLimit);
+        const stderr = new BoundedOutputCollector(outputLimit);
+        const timer = setTimeout(() => {
+          conn.end();
+          reject(new Error(`SSH command timed out after ${timeoutMs}ms`));
+        }, timeoutMs);
+        conn.exec(command, (err, stream) => {
+          if (err) {
+            clearTimeout(timer);
+            return reject(err);
+          }
+          stream.on("close", (code) => {
+            clearTimeout(timer);
+            resolve({
+              success: code === 0,
+              stdout: stdout.finalize(),
+              stderr: stderr.finalize(),
+              code,
+              stdoutTruncated: stdout.truncated,
+              stderrTruncated: stderr.truncated
+            });
+          }).on("data", (data) => {
+            stdout.append(data);
+          }).stderr.on("data", (data) => {
+            stderr.append(data);
+          });
+        });
+      });
+    } finally {
+      this.pool.release(conn);
+    }
+  }
+  async upload(localPath, remotePath) {
+    const conn = await this.pool.acquire();
+    try {
+      return await new Promise((resolve, reject) => {
+        conn.sftp((err, sftp) => {
+          if (err)
+            return reject(err);
+          sftp.fastPut(localPath, remotePath, (err2) => {
+            if (err2)
+              return reject(err2);
+            resolve();
+          });
+        });
+      });
+    } finally {
+      this.pool.release(conn);
+    }
+  }
+  async uploadText(remotePath, content, mode = 384) {
+    auditCommand(`upload ${remotePath} (${Buffer.byteLength(content)} bytes; content redacted)`, this.config.host, false);
+    const conn = await this.pool.acquire();
+    try {
+      await new Promise((resolve, reject) => {
+        conn.sftp((err, sftp) => {
+          if (err)
+            return reject(err);
+          sftp.writeFile(remotePath, content, { mode }, (writeError) => {
+            if (writeError)
+              return reject(writeError);
+            sftp.chmod(remotePath, mode, (chmodError) => {
+              if (chmodError)
+                return reject(chmodError);
+              resolve();
+            });
+          });
+        });
+      });
+    } finally {
+      this.pool.release(conn);
+    }
+  }
+  async ping() {
+    const result = await this.exec("echo pong", 1e4).catch(() => null);
+    return result?.stdout.trim() === "pong";
+  }
+  close() {
+    this.pool.closeAll();
+  }
+}
 
 // src/shared/cli.ts
 function coerceCliValue(value) {
@@ -24933,6 +25225,26 @@ function coerceCliValue(value) {
     return Number(value);
   return value;
 }
+function sanitizedCliDiagnostic(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return redactSshOutput(message).replace(/[\r\n\t]+/g, " ").trim().slice(0, 1000);
+}
+function nestedCliDiagnostics(error) {
+  if (error instanceof AggregateError) {
+    return error.errors.flatMap((candidate) => nestedCliDiagnostics(candidate));
+  }
+  return [sanitizedCliDiagnostic(error)];
+}
+function formatCliError(error) {
+  const summary = sanitizedCliDiagnostic(error);
+  const diagnostics = [...new Set(nestedCliDiagnostics(error))].filter((message) => message && message !== summary);
+  if (diagnostics.length === 0)
+    return summary;
+  return `${summary}
+Details:
+${diagnostics.map((message) => `  - ${message}`).join(`
+`)}`;
+}
 async function runCli(cliTools, args, options = {}) {
   const commandName = options.commandName || "supacloud-admin";
   const formatAvailableCommands = () => Object.keys(cliTools).filter((k) => !["setup_help", "deploy_web_console"].includes(k)).join(`
@@ -25031,7 +25343,7 @@ async function runCli(cliTools, args, options = {}) {
     }
     process.exit(result && typeof result === "object" && "isError" in result && result.isError === true ? 1 : 0);
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
+    const message = formatCliError(error);
     console.error(`❌ Error: ${message}`);
     if (message.includes("required")) {
       console.error(`Hint: Pass arguments like --ref YOUR_REF`);
@@ -25043,14 +25355,14 @@ async function runCli(cliTools, args, options = {}) {
 // src/shared/context.ts
 import { homedir } from "node:os";
 import { resolve } from "node:path";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 function readDotEnvFile(cwd) {
   const envPath = resolve(cwd, ".env");
   if (!existsSync(envPath))
     return {};
   const values = {};
   try {
-    const envContent = readFileSync(envPath, "utf-8");
+    const envContent = readFileSync2(envPath, "utf-8");
     for (const line of envContent.split(`
 `)) {
       const match = line.trim().match(/^([^=]+)=(.*)$/);
@@ -25060,529 +25372,675 @@ function readDotEnvFile(cwd) {
       const value = match[2].trim().replace(/^["']|["']$/g, "");
       values[key] = value;
     }
-  } catch {
-    return {};
-  }
-  return values;
-}
-function pickValue(env, dotenv, keys) {
-  for (const key of keys) {
-    const envValue = env[key];
-    if (envValue)
-      return { value: envValue, source: "env" };
-  }
-  for (const key of keys) {
-    const dotenvValue = dotenv[key];
-    if (dotenvValue)
-      return { value: dotenvValue, source: "dotenv" };
-  }
-  return { value: "", source: "env" };
-}
-function detectSource(sources) {
-  const present = new Set(sources.filter((value) => value !== "none"));
-  if (present.size === 0)
-    return "none";
-  if (present.size === 1)
-    return present.has("env") ? "env" : "dotenv";
-  return "mixed";
-}
-function normalizeUrl(value) {
-  const trimmed = value.trim().replace(/\/+$/, "");
-  if (!trimmed)
-    return "";
-  try {
-    return new URL(trimmed).toString().replace(/\/+$/, "");
-  } catch {
-    return "";
-  }
-}
-function hostFromUrl(value) {
-  try {
-    return new URL(value).hostname;
-  } catch {
-    return "";
-  }
-}
-function inferManagementApiUrlFromSupabaseUrl(value, projectRef = "") {
-  const normalized = normalizeUrl(value);
-  if (!normalized)
-    return "";
-  const url = new URL(normalized);
-  const host = url.hostname;
-  if (host.startsWith("api.")) {
-    url.hostname = `studio.${host.slice("api.".length)}`;
-    return url.toString().replace(/\/+$/, "");
-  }
-  const ref = projectRef.trim();
-  if (ref && host.startsWith(`${ref}.api.`)) {
-    url.hostname = `studio-${ref}.${host.slice(`${ref}.api.`.length)}`;
-    return url.toString().replace(/\/+$/, "");
-  }
-  const managedHostMatch = host.match(/^([a-z0-9-]+)\.api\.(.+)$/i);
-  if (managedHostMatch) {
-    url.hostname = `studio-${managedHostMatch[1]}.${managedHostMatch[2]}`;
-    return url.toString().replace(/\/+$/, "");
-  }
-  return normalized;
-}
-function resolveSupaCloudContext(env = process.env, cwd = process.cwd()) {
-  const dotenv = readDotEnvFile(cwd);
-  const supabaseUrl = pickValue(env, dotenv, ["SUPABASE_URL"]);
-  const explicitApiUrl = pickValue(env, dotenv, ["SUPACLOUD_API_URL", "SUPACLOUD_MANAGEMENT_API_URL", "MANAGEMENT_API_URL"]);
-  const inferredToken = pickValue(env, dotenv, ["SUPABASE_SERVICE_ROLE_KEY", "SUPACLOUD_API_TOKEN"]);
-  const projectRef = pickValue(env, dotenv, ["SUPACLOUD_PROJECT_REF", "X_PROJECT_REF"]).value;
-  const hostFromEnv = env.SUPACLOUD_HOST;
-  const normalizedSupabaseUrl = normalizeUrl(supabaseUrl.value);
-  const apiUrl = normalizeUrl(explicitApiUrl.value) || inferManagementApiUrlFromSupabaseUrl(normalizedSupabaseUrl, projectRef) || (hostFromEnv ? `http://${hostFromEnv}:9090` : "");
-  const resolvedHostFromUrl = hostFromUrl(apiUrl || normalizedSupabaseUrl);
-  return {
-    host: hostFromEnv ?? resolvedHostFromUrl,
-    sshUser: env.SUPACLOUD_SSH_USER ?? "root",
-    sshPort: parseInt(env.SUPACLOUD_SSH_PORT ?? "22", 10),
-    sshKey: env.SUPACLOUD_SSH_KEY ?? resolve(homedir(), ".ssh", "id_rsa"),
-    sshPass: env.SUPACLOUD_SSH_PASS ?? "",
-    sshHostFingerprint: env.SUPACLOUD_SSH_HOST_FINGERPRINT ?? "",
-    apiUrl,
-    apiToken: env.SUPACLOUD_API_TOKEN ?? inferredToken.value,
-    projectRef,
-    readOnly: env.SUPACLOUD_READ_ONLY === "true",
-    inferredSupabaseUrl: normalizedSupabaseUrl,
-    inferredServiceRoleKey: inferredToken.value,
-    source: detectSource([
-      supabaseUrl.value || explicitApiUrl.value ? supabaseUrl.value ? supabaseUrl.source : explicitApiUrl.source : "none",
-      inferredToken.value ? inferredToken.source : "none"
-    ])
-  };
-}
-
-// src/shared/transports/http.ts
-var DEFAULT_TIMEOUT = 30000;
-var MAX_RETRIES = 2;
-var RETRY_BASE_DELAY = 500;
-async function fetchWithRetry(url, options, retries = MAX_RETRIES) {
-  for (let attempt = 0;attempt <= retries; attempt++) {
-    try {
-      const controller = new AbortController;
-      const timeout = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
-      const res = await fetch(url, {
-        ...options,
-        signal: controller.signal
-      });
-      clearTimeout(timeout);
-      if (res.status >= 500 && attempt < retries) {
-        const delay = RETRY_BASE_DELAY * Math.pow(2, attempt);
-        await new Promise((r) => setTimeout(r, delay));
-        continue;
-      }
-      return res;
-    } catch (err) {
-      if (attempt < retries && (err.name === "AbortError" || err.code === "ECONNREFUSED" || err.code === "ECONNRESET")) {
-        const delay = RETRY_BASE_DELAY * Math.pow(2, attempt);
-        await new Promise((r) => setTimeout(r, delay));
-        continue;
-      }
-      throw err;
-    }
-  }
-  throw new Error("Unreachable");
-}
-
-class HttpTransport {
-  baseUrl;
-  token;
-  constructor(config) {
-    this.baseUrl = config.baseUrl.replace(/\/$/, "");
-    this.token = config.token;
-  }
-  headers() {
-    return {
-      Authorization: `Bearer ${this.token}`,
-      "Content-Type": "application/json"
-    };
-  }
-  async get(path) {
-    try {
-      const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
-        method: "GET",
-        headers: this.headers()
-      });
-      const data = await res.json().catch(() => null);
-      return { ok: res.ok, status: res.status, data };
-    } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
-    }
-  }
-  async post(path, body) {
-    try {
-      const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
-        method: "POST",
-        headers: this.headers(),
-        body: body ? JSON.stringify(body) : undefined
-      });
-      const data = await res.json().catch(() => null);
-      return { ok: res.ok, status: res.status, data };
-    } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
-    }
-  }
-  async postMultipart(path, formData) {
-    try {
-      const headers = { Authorization: `Bearer ${this.token}` };
-      const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
-        method: "POST",
-        headers,
-        body: formData
-      });
-      const data = await res.json().catch(() => null);
-      return { ok: res.ok, status: res.status, data };
-    } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
-    }
-  }
-  async patch(path, body) {
-    try {
-      const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
-        method: "PATCH",
-        headers: this.headers(),
-        body: body ? JSON.stringify(body) : undefined
-      });
-      const data = await res.json().catch(() => null);
-      return { ok: res.ok, status: res.status, data };
-    } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
-    }
-  }
-  async put(path, body) {
-    try {
-      const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
-        method: "PUT",
-        headers: this.headers(),
-        body: body ? JSON.stringify(body) : undefined
-      });
-      const data = await res.json().catch(() => null);
-      return { ok: res.ok, status: res.status, data };
-    } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
-    }
-  }
-  async delete(path) {
-    try {
-      const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
-        method: "DELETE",
-        headers: this.headers()
-      });
-      const data = await res.json().catch(() => null);
-      return { ok: res.ok, status: res.status, data };
-    } catch (error) {
-      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
-    }
-  }
-  async ping() {
-    const res = await this.get("/v1/projects").catch(() => null);
-    return res?.ok ?? false;
+  } catch {
+    return {};
   }
+  return values;
 }
-
-// src/shared/transports/ssh.ts
-var import_ssh2 = __toESM(require_lib3(), 1);
-import { timingSafeEqual } from "node:crypto";
-import { readFileSync as readFileSync2 } from "node:fs";
-var DEFAULT_MAX_OUTPUT_BYTES = 1024 * 1024;
-var MAX_CONFIGURABLE_OUTPUT_BYTES = 16 * 1024 * 1024;
-function normalizeSshHostFingerprint(value) {
-  const trimmed = value.trim();
-  const match = trimmed.match(/^SHA256:([A-Za-z0-9+/]{43}=?)$/);
-  if (!match) {
-    throw new Error("SUPACLOUD_SSH_HOST_FINGERPRINT must use OpenSSH SHA256:<base64> format");
+function pickValue(env, dotenv, keys) {
+  for (const key of keys) {
+    const envValue = env[key];
+    if (envValue)
+      return { value: envValue, source: "env" };
   }
-  const decoded = Buffer.from(match[1], "base64");
-  if (decoded.length !== 32) {
-    throw new Error("SUPACLOUD_SSH_HOST_FINGERPRINT must contain a 32-byte SHA256 digest");
+  for (const key of keys) {
+    const dotenvValue = dotenv[key];
+    if (dotenvValue)
+      return { value: dotenvValue, source: "dotenv" };
   }
-  return `SHA256:${match[1].replace(/=+$/, "")}`;
+  return { value: "", source: "env" };
 }
-function createHostVerifier(fingerprint) {
-  const expected = Buffer.from(normalizeSshHostFingerprint(fingerprint).slice("SHA256:".length), "base64");
-  return (actualHash) => {
-    if (!/^[a-f0-9]{64}$/i.test(actualHash))
-      return false;
-    const actual = Buffer.from(actualHash, "hex");
-    return actual.length === expected.length && timingSafeEqual(actual, expected);
-  };
+function detectSource(sources) {
+  const present = new Set(sources.filter((value) => value !== "none"));
+  if (present.size === 0)
+    return "none";
+  if (present.size === 1)
+    return present.has("env") ? "env" : "dotenv";
+  return "mixed";
 }
-function normalizeMaxOutputBytes(value) {
-  const resolved = value ?? DEFAULT_MAX_OUTPUT_BYTES;
-  if (!Number.isSafeInteger(resolved) || resolved < 1 || resolved > MAX_CONFIGURABLE_OUTPUT_BYTES) {
-    throw new Error(`maxOutputBytes must be an integer between 1 and ${MAX_CONFIGURABLE_OUTPUT_BYTES}`);
+function normalizeUrl(value) {
+  const trimmed = value.trim().replace(/\/+$/, "");
+  if (!trimmed)
+    return "";
+  try {
+    return new URL(trimmed).toString().replace(/\/+$/, "");
+  } catch {
+    return "";
   }
-  return resolved;
 }
-
-class BoundedOutputCollector {
-  limit;
-  storage;
-  bytes = 0;
-  truncated = false;
-  constructor(limit) {
-    this.limit = limit;
-    this.storage = Buffer.allocUnsafe(limit);
+function hostFromUrl(value) {
+  try {
+    return new URL(value).hostname;
+  } catch {
+    return "";
   }
-  append(data) {
-    if (this.truncated)
-      return;
-    const buffer = Buffer.isBuffer(data) ? data : Buffer.from(data);
-    const remaining = this.limit - this.bytes;
-    const copied = Math.min(buffer.length, Math.max(0, remaining));
-    if (copied > 0)
-      buffer.copy(this.storage, this.bytes, 0, copied);
-    this.bytes += copied;
-    this.truncated = buffer.length > copied;
+}
+function inferManagementApiUrlFromSupabaseUrl(value, projectRef = "") {
+  const normalized = normalizeUrl(value);
+  if (!normalized)
+    return "";
+  const url = new URL(normalized);
+  const host = url.hostname;
+  if (host.startsWith("api.")) {
+    url.hostname = `studio.${host.slice("api.".length)}`;
+    return url.toString().replace(/\/+$/, "");
   }
-  finalize() {
-    let output = this.storage.subarray(0, this.bytes).toString("utf8");
-    if (this.truncated) {
-      const lastNewline = output.lastIndexOf(`
-`);
-      output = lastNewline >= 0 ? output.slice(0, lastNewline + 1) : "";
-    }
-    const redacted = redactSshOutput(output);
-    if (!this.truncated)
-      return redacted;
-    return `${redacted}${redacted && !redacted.endsWith(`
-`) ? `
-` : ""}[TRUNCATED: output exceeded ${this.limit}-byte limit]`;
+  const ref = projectRef.trim();
+  if (ref && host.startsWith(`${ref}.api.`)) {
+    url.hostname = `studio-${ref}.${host.slice(`${ref}.api.`.length)}`;
+    return url.toString().replace(/\/+$/, "");
   }
+  const managedHostMatch = host.match(/^([a-z0-9-]+)\.api\.(.+)$/i);
+  if (managedHostMatch) {
+    url.hostname = `studio-${managedHostMatch[1]}.${managedHostMatch[2]}`;
+    return url.toString().replace(/\/+$/, "");
+  }
+  return normalized;
 }
-var BLOCKED_COMMANDS = [
-  "rm -rf /",
-  "mkfs",
-  "dd if=",
-  ":(){:|:&};:",
-  "shutdown",
-  "reboot",
-  "init 0",
-  "init 6",
-  "passwd",
-  "userdel",
-  "usermod -L",
-  "iptables -F",
-  "ufw disable",
-  "crontab -r",
-  "chmod -R 777 /"
-];
-function redactSshCommand(command) {
-  return command.replace(/(\b[A-Z0-9_]*(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL)[A-Z0-9_]*=)(?:"[^"]*"|'[^']*'|[^\s;]+)/gi, "$1[REDACTED]").replace(/(Authorization\s*[:=]\s*)(['"]?)Bearer\s+[^'"\s;]+\2/gi, "$1$2Bearer [REDACTED]$2").replace(/(\b--(?:password|token|secret|api-key)\s+)(\S+)/gi, "$1[REDACTED]").replace(/(postgres(?:ql)?:\/\/[^:\s/]+:)[^@\s]+@/gi, "$1[REDACTED]@");
-}
-function redactSshOutput(output) {
-  const redactedLines = output.replace(/^(\s*(?:export\s+)?[A-Z0-9_]*(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL|DB_URI|DATABASE_URL|DSN)[A-Z0-9_]*\s*=\s*).*$/gim, "$1[REDACTED]");
-  const redactedStructuredFields = redactedLines.replace(/((?:["']?(?:password|pass|secret|token|key|credential|db_uri|database_url|dsn)["']?)\s*:\s*)(?:"[^"]*"|'[^']*'|[^,}\]\r\n]+)/gi, "$1[REDACTED]");
-  return redactSshCommand(redactedStructuredFields);
+function resolveSupaCloudContext(env = process.env, cwd = process.cwd()) {
+  const dotenv = readDotEnvFile(cwd);
+  const supabaseUrl = pickValue(env, dotenv, ["SUPABASE_URL"]);
+  const explicitApiUrl = pickValue(env, dotenv, ["SUPACLOUD_API_URL", "SUPACLOUD_MANAGEMENT_API_URL", "MANAGEMENT_API_URL"]);
+  const inferredToken = pickValue(env, dotenv, ["SUPABASE_SERVICE_ROLE_KEY", "SUPACLOUD_API_TOKEN"]);
+  const projectRef = pickValue(env, dotenv, ["SUPACLOUD_PROJECT_REF", "X_PROJECT_REF"]).value;
+  const hostFromEnv = env.SUPACLOUD_HOST;
+  const normalizedSupabaseUrl = normalizeUrl(supabaseUrl.value);
+  const apiUrl = normalizeUrl(explicitApiUrl.value) || inferManagementApiUrlFromSupabaseUrl(normalizedSupabaseUrl, projectRef) || (hostFromEnv ? `http://${hostFromEnv}:9090` : "");
+  const resolvedHostFromUrl = hostFromUrl(apiUrl || normalizedSupabaseUrl);
+  return {
+    host: hostFromEnv ?? resolvedHostFromUrl,
+    sshUser: env.SUPACLOUD_SSH_USER ?? "root",
+    sshPort: parseInt(env.SUPACLOUD_SSH_PORT ?? "22", 10),
+    sshKey: env.SUPACLOUD_SSH_KEY ?? resolve(homedir(), ".ssh", "id_rsa"),
+    sshPass: env.SUPACLOUD_SSH_PASS ?? "",
+    sshHostFingerprint: env.SUPACLOUD_SSH_HOST_FINGERPRINT ?? "",
+    apiUrl,
+    apiToken: env.SUPACLOUD_API_TOKEN ?? inferredToken.value,
+    projectRef,
+    readOnly: env.SUPACLOUD_READ_ONLY === "true",
+    inferredSupabaseUrl: normalizedSupabaseUrl,
+    inferredServiceRoleKey: inferredToken.value,
+    source: detectSource([
+      supabaseUrl.value || explicitApiUrl.value ? supabaseUrl.value ? supabaseUrl.source : explicitApiUrl.source : "none",
+      inferredToken.value ? inferredToken.source : "none"
+    ])
+  };
 }
-function isCommandBlocked(command) {
-  const normalized = command.trim().toLowerCase();
-  return BLOCKED_COMMANDS.some((blocked) => normalized.includes(blocked));
+
+// src/shared/transports/http.ts
+var DEFAULT_TIMEOUT = 30000;
+var MAX_RETRIES = 2;
+var RETRY_BASE_DELAY = 500;
+function isRetryableMethod(method) {
+  const normalizedMethod = (method ?? "GET").toUpperCase();
+  return normalizedMethod === "GET" || normalizedMethod === "HEAD";
 }
-var auditLog = [];
-function auditCommand(command, host, blocked) {
-  const safeCommand = redactSshCommand(command);
-  const entry = { timestamp: new Date().toISOString(), command: safeCommand, host, blocked };
-  auditLog.push(entry);
-  if (auditLog.length > 1000)
-    auditLog.shift();
-  if (blocked) {
-    console.error(`[SSH-AUDIT] BLOCKED command on ${host}: ${safeCommand}`);
-  } else {
-    console.log(`[SSH-AUDIT] Executing on ${host}: ${safeCommand.substring(0, 200)}`);
-  }
+function isRetryableError(error) {
+  if (!(error instanceof Error))
+    return false;
+  const networkError = error;
+  return networkError.name === "AbortError" || networkError.code === "ECONNREFUSED" || networkError.code === "ECONNRESET";
 }
-class SshConnectionPool {
-  pool = [];
-  maxSize = 3;
-  config;
-  creating = 0;
-  clientFactory;
-  constructor(config, clientFactory) {
-    this.config = config;
-    this.clientFactory = clientFactory;
-  }
-  async createConnection() {
-    const conn = this.clientFactory();
-    return new Promise((resolve2, reject) => {
-      const timeout = setTimeout(() => {
-        conn.end();
-        reject(new Error("SSH connection timeout"));
-      }, 15000);
-      conn.on("ready", () => {
-        clearTimeout(timeout);
-        resolve2(conn);
-      }).on("error", (err) => {
-        clearTimeout(timeout);
-        reject(err);
-      }).connect({
-        host: this.config.host,
-        port: this.config.port,
-        username: this.config.username,
-        ...this.config.privateKeyPath ? { privateKey: readFileSync2(this.config.privateKeyPath) } : {},
-        ...this.config.password ? { password: this.config.password } : {},
-        hostHash: "sha256",
-        hostVerifier: createHostVerifier(this.config.hostFingerprint),
-        readyTimeout: 15000,
-        keepaliveInterval: 30000
-      });
+async function fetchWithTimeout(url, options) {
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
+  try {
+    return await fetch(url, {
+      ...options,
+      signal: controller.signal
     });
+  } finally {
+    clearTimeout(timeout);
   }
-  async acquire() {
-    if (this.pool.length > 0) {
-      const conn = this.pool.pop();
-      return conn;
-    }
-    if (this.creating < this.maxSize) {
-      this.creating++;
-      try {
-        return await this.createConnection();
-      } finally {
-        this.creating--;
-      }
-    }
-    return this.createConnection();
-  }
-  release(conn) {
-    if (this.pool.length < this.maxSize) {
-      this.pool.push(conn);
-    } else {
-      try {
-        conn.end();
-      } catch {}
-    }
-  }
-  closeAll() {
-    for (const conn of this.pool) {
-      try {
-        conn.end();
-      } catch {}
+}
+async function fetchWithRetry(url, options) {
+  const retries = isRetryableMethod(options.method) ? MAX_RETRIES : 0;
+  for (let attempt = 0;attempt <= retries; attempt++) {
+    try {
+      const res = await fetchWithTimeout(url, options);
+      if (res.status >= 500 && res.status < 600 && attempt < retries) {
+        const delay = RETRY_BASE_DELAY * Math.pow(2, attempt);
+        await new Promise((r) => setTimeout(r, delay));
+        continue;
+      }
+      return res;
+    } catch (error) {
+      if (attempt < retries && isRetryableError(error)) {
+        const delay = RETRY_BASE_DELAY * Math.pow(2, attempt);
+        await new Promise((r) => setTimeout(r, delay));
+        continue;
+      }
+      throw error;
     }
-    this.pool = [];
   }
+  throw new Error("Unreachable");
 }
 
-class SshTransport {
-  config;
-  pool;
-  constructor(config, options = {}) {
-    this.config = {
-      ...config,
-      hostFingerprint: normalizeSshHostFingerprint(config.hostFingerprint || ""),
-      maxOutputBytes: normalizeMaxOutputBytes(config.maxOutputBytes)
+class HttpTransport {
+  baseUrl;
+  token;
+  constructor(config) {
+    this.baseUrl = config.baseUrl.replace(/\/$/, "");
+    this.token = config.token;
+  }
+  headers() {
+    return {
+      Authorization: `Bearer ${this.token}`,
+      "Content-Type": "application/json"
     };
-    this.pool = new SshConnectionPool(this.config, options.clientFactory ?? (() => new import_ssh2.Client));
   }
-  async exec(command, timeoutMs = 300000) {
-    if (isCommandBlocked(command)) {
-      auditCommand(command, this.config.host, true);
-      const safeCommand = redactSshCommand(command);
-      return {
-        success: false,
-        stdout: "",
-        stderr: `Command blocked by security policy: "${safeCommand.substring(0, 100)}". ` + `Destructive or system-altering commands are not allowed via supacloud-admin.`,
-        code: 126
-      };
+  async get(path) {
+    try {
+      const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
+        method: "GET",
+        headers: this.headers()
+      });
+      const data = await res.json().catch(() => null);
+      return { ok: res.ok, status: res.status, data };
+    } catch (error) {
+      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
     }
-    auditCommand(command, this.config.host, false);
-    const conn = await this.pool.acquire();
+  }
+  async post(path, body) {
     try {
-      return await new Promise((resolve2, reject) => {
-        const outputLimit = this.config.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
-        const stdout = new BoundedOutputCollector(outputLimit);
-        const stderr = new BoundedOutputCollector(outputLimit);
-        const timer = setTimeout(() => {
-          conn.end();
-          reject(new Error(`SSH command timed out after ${timeoutMs}ms`));
-        }, timeoutMs);
-        conn.exec(command, (err, stream) => {
-          if (err) {
-            clearTimeout(timer);
-            return reject(err);
-          }
-          stream.on("close", (code) => {
-            clearTimeout(timer);
-            resolve2({
-              success: code === 0,
-              stdout: stdout.finalize(),
-              stderr: stderr.finalize(),
-              code,
-              stdoutTruncated: stdout.truncated,
-              stderrTruncated: stderr.truncated
-            });
-          }).on("data", (data) => {
-            stdout.append(data);
-          }).stderr.on("data", (data) => {
-            stderr.append(data);
-          });
-        });
+      const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
+        method: "POST",
+        headers: this.headers(),
+        body: body ? JSON.stringify(body) : undefined
       });
-    } finally {
-      this.pool.release(conn);
+      const data = await res.json().catch(() => null);
+      return { ok: res.ok, status: res.status, data };
+    } catch (error) {
+      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
     }
   }
-  async upload(localPath, remotePath) {
-    const conn = await this.pool.acquire();
+  async postMultipart(path, formData) {
     try {
-      return await new Promise((resolve2, reject) => {
-        conn.sftp((err, sftp) => {
-          if (err)
-            return reject(err);
-          sftp.fastPut(localPath, remotePath, (err2) => {
-            if (err2)
-              return reject(err2);
-            resolve2();
-          });
-        });
+      const headers = { Authorization: `Bearer ${this.token}` };
+      const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
+        method: "POST",
+        headers,
+        body: formData
       });
-    } finally {
-      this.pool.release(conn);
+      const data = await res.json().catch(() => null);
+      return { ok: res.ok, status: res.status, data };
+    } catch (error) {
+      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
     }
   }
-  async uploadText(remotePath, content, mode = 384) {
-    auditCommand(`upload ${remotePath} (${Buffer.byteLength(content)} bytes; content redacted)`, this.config.host, false);
-    const conn = await this.pool.acquire();
+  async patch(path, body) {
     try {
-      await new Promise((resolve2, reject) => {
-        conn.sftp((err, sftp) => {
-          if (err)
-            return reject(err);
-          sftp.writeFile(remotePath, content, { mode }, (writeError) => {
-            if (writeError)
-              return reject(writeError);
-            sftp.chmod(remotePath, mode, (chmodError) => {
-              if (chmodError)
-                return reject(chmodError);
-              resolve2();
-            });
-          });
-        });
+      const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
+        method: "PATCH",
+        headers: this.headers(),
+        body: body ? JSON.stringify(body) : undefined
       });
-    } finally {
-      this.pool.release(conn);
+      const data = await res.json().catch(() => null);
+      return { ok: res.ok, status: res.status, data };
+    } catch (error) {
+      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
     }
   }
-  async ping() {
-    const result = await this.exec("echo pong", 1e4).catch(() => null);
-    return result?.stdout.trim() === "pong";
+  async put(path, body) {
+    try {
+      const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
+        method: "PUT",
+        headers: this.headers(),
+        body: body ? JSON.stringify(body) : undefined
+      });
+      const data = await res.json().catch(() => null);
+      return { ok: res.ok, status: res.status, data };
+    } catch (error) {
+      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
+    }
   }
-  close() {
-    this.pool.closeAll();
+  async delete(path) {
+    try {
+      const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
+        method: "DELETE",
+        headers: this.headers()
+      });
+      const data = await res.json().catch(() => null);
+      return { ok: res.ok, status: res.status, data };
+    } catch (error) {
+      return { ok: false, status: 500, data: { error: "Network Error", details: error.message } };
+    }
+  }
+  async ping() {
+    const res = await this.get("/v1/projects").catch(() => null);
+    return res?.ok ?? false;
   }
 }
 
 // src/shared/tools/ssh-tools.ts
 import { randomUUID } from "node:crypto";
+
+// ../../scripts/lib/release_assets.sh
+var release_assets_default = `#!/usr/bin/env bash
+
+SUPACLOUD_GITHUB_REPOSITORY="\${SUPACLOUD_GITHUB_REPOSITORY:-zuohuadong/supacloud}"
+SUPACLOUD_RELEASES_API="\${SUPACLOUD_RELEASES_API:-https://api.github.com/repos/\${SUPACLOUD_GITHUB_REPOSITORY}/releases}"
+SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW="\${SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW:-\${SUPACLOUD_GITHUB_REPOSITORY}/.github/workflows/release-please.yml}"
+SUPACLOUD_GH_VERSION="\${SUPACLOUD_GH_VERSION:-2.96.0}"
+SUPACLOUD_GH_MIN_VERSION="\${SUPACLOUD_GH_MIN_VERSION:-2.51.0}"
+SUPACLOUD_GH_AMD64_SHA256="\${SUPACLOUD_GH_AMD64_SHA256:-83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60}"
+SUPACLOUD_GH_ARM64_SHA256="\${SUPACLOUD_GH_ARM64_SHA256:-06f86ec7103d41993b76cd78072f43595c34aaa56506d971d9860e67140bf909}"
+
+supacloud_component_tag() {
+    local component="$1"
+    local version="$2"
+    case "$version" in
+        "\${component}-v"*) printf '%s' "$version" ;;
+        v*) printf '%s-%s' "$component" "$version" ;;
+        *) printf '%s-v%s' "$component" "$version" ;;
+    esac
+}
+
+supacloud_select_release() {
+    local component="$1"
+    shift
+    local required_assets_json
+    [[ $# -gt 0 ]] || {
+        echo "at least one required release asset must be specified" >&2
+        return 1
+    }
+    required_assets_json=$(printf '%s\\n' "$@" | jq -Rsc 'split("\\n")[:-1]')
+    jq -ce --arg prefix "\${component}-v" --argjson required "$required_assets_json" '
+        map(select(
+            (.draft | not)
+            and (.prerelease | not)
+            and (.tag_name | startswith($prefix))
+            and (. as $release | all($required[]; . as $asset | any($release.assets[]?; .name == $asset)))
+            and any(.assets[]?; .name == "SHA256SUMS")
+        ))
+        | first
+        // error("no matching component release contains all required assets and SHA256SUMS")
+    '
+}
+
+supacloud_fetch_component_release() {
+    local component="$1"
+    local version="\${2:-latest}"
+    shift 2
+    local required_assets=("$@")
+    local required_assets_json
+    local response
+    [[ \${#required_assets[@]} -gt 0 ]] || {
+        echo "at least one required release asset must be specified" >&2
+        return 1
+    }
+    required_assets_json=$(printf '%s\\n' "\${required_assets[@]}" | jq -Rsc 'split("\\n")[:-1]')
+
+    if [[ -n "$version" && "$version" != "latest" ]]; then
+        local tag
+        tag=$(supacloud_component_tag "$component" "$version")
+        response=$(supacloud_fetch_release_json "\${SUPACLOUD_RELEASES_API}/tags/\${tag}") || return 1
+        jq -ce --argjson required "$required_assets_json" '
+            select(
+                (.draft | not)
+                and (.prerelease | not)
+                and (. as $release | all($required[]; . as $asset | any($release.assets[]?; .name == $asset)))
+                and any(.assets[]?; .name == "SHA256SUMS")
+            )
+            // error("release does not contain all required assets and SHA256SUMS")
+        ' <<< "$response"
+        return
+    fi
+
+    response=$(supacloud_fetch_release_json "\${SUPACLOUD_RELEASES_API}?per_page=100") || return 1
+    supacloud_select_release "$component" "\${required_assets[@]}" <<< "$response"
+}
+
+supacloud_fetch_release_json() {
+    local url="$1"
+    local proxy="\${SUPACLOUD_GITHUB_PROXY:-\${GH_PROXY:-}}"
+    if curl -fsSL --retry 3 --connect-timeout 15 "$url"; then
+        return 0
+    fi
+    if [[ -n "$proxy" ]]; then
+        curl -fsSL --retry 3 --connect-timeout 15 "\${proxy%/}/\${url}"
+        return
+    fi
+    return 1
+}
+
+supacloud_release_asset_url() {
+    local release_json="$1"
+    local asset_name="$2"
+    jq -er --arg asset "$asset_name" '
+        first(.assets[]? | select(.name == $asset) | .browser_download_url)
+        // error("release asset URL is missing")
+    ' <<< "$release_json"
+}
+
+supacloud_download_url() {
+    local url="$1"
+    local output="$2"
+    local proxy="\${SUPACLOUD_GITHUB_PROXY:-\${GH_PROXY:-}}"
+
+    if curl -fL --retry 3 --connect-timeout 15 -o "$output" "$url"; then
+        return 0
+    fi
+    if [[ -n "$proxy" ]]; then
+        curl -fL --retry 3 --connect-timeout 15 -o "$output" "\${proxy%/}/\${url}"
+        return
+    fi
+    return 1
+}
+
+supacloud_verify_checksum() {
+    local artifact_file="$1"
+    local asset_name="$2"
+    local checksum_file="$3"
+    local expected
+    expected=$(awk -v asset="$asset_name" '$2 == asset || $2 == "*" asset { print $1; exit }' "$checksum_file")
+    if [[ ! "$expected" =~ ^[0-9a-fA-F]{64}$ ]]; then
+        echo "SHA256SUMS does not contain a valid checksum for \${asset_name}" >&2
+        return 1
+    fi
+
+    local actual
+    actual=$(sha256sum "$artifact_file" | awk '{print $1}')
+    actual=$(printf '%s' "$actual" | tr '[:upper:]' '[:lower:]')
+    expected=$(printf '%s' "$expected" | tr '[:upper:]' '[:lower:]')
+    if [[ "$actual" != "$expected" ]]; then
+        echo "SHA256 mismatch for \${asset_name}" >&2
+        return 1
+    fi
+}
+
+supacloud_validate_binary() {
+    local artifact_file="$1"
+    local asset_name="$2"
+    local description
+    description=$(file -b "$artifact_file")
+    if [[ "$description" != *ELF* ]]; then
+        echo "\${asset_name} is not an ELF binary: \${description}" >&2
+        return 1
+    fi
+
+    case "$asset_name" in
+        *amd64)
+            [[ "$description" == *x86-64* || "$description" == *x86_64* ]] || {
+                echo "\${asset_name} does not contain an x86-64 ELF binary" >&2
+                return 1
+            }
+            ;;
+        *arm64)
+            [[ "$description" == *aarch64* || "$description" == *ARM64* ]] || {
+                echo "\${asset_name} does not contain an arm64 ELF binary" >&2
+                return 1
+            }
+            ;;
+    esac
+}
+
+supacloud_install_pinned_tar_xz_binary() (
+    local archive="$1"
+    local member="$2"
+    local expected_sha256="$3"
+    local arch="$4"
+    local target="$5"
+    local actual_sha256 member_count member_details extract_dir candidate staged_target
+
+    actual_sha256=$(sha256sum "$archive" | awk '{print $1}')
+    actual_sha256=$(printf '%s' "$actual_sha256" | tr '[:upper:]' '[:lower:]')
+    expected_sha256=$(printf '%s' "$expected_sha256" | tr '[:upper:]' '[:lower:]')
+    if [[ ! "$expected_sha256" =~ ^[0-9a-f]{64}$ || "$actual_sha256" != "$expected_sha256" ]]; then
+        echo "SHA256 mismatch for pinned archive" >&2
+        return 1
+    fi
+
+    member_count=$(tar -tJf "$archive" | grep -Fxc "$member" || true)
+    if [[ "$member_count" != "1" ]]; then
+        echo "Pinned archive must contain the exact member once: $member" >&2
+        return 1
+    fi
+    member_details=$(tar -tvJf "$archive" "$member") || return 1
+    if [[ "\${member_details:0:1}" != "-" ]]; then
+        echo "Pinned archive member is not a regular file: $member" >&2
+        return 1
+    fi
+
+    extract_dir=$(mktemp -d)
+    trap 'rm -rf "$extract_dir"; [[ -z "\${staged_target:-}" ]] || rm -f "$staged_target"' EXIT HUP INT TERM
+    if ! tar --no-same-owner --no-same-permissions -xJf "$archive" -C "$extract_dir" "$member"; then
+        return 1
+    fi
+    candidate="\${extract_dir}/\${member}"
+    supacloud_validate_binary "$candidate" "pinned-linux-\${arch}" || return 1
+
+    mkdir -p "$(dirname "$target")"
+    staged_target=$(mktemp "\${target}.tmp.XXXXXX")
+    install -m 0755 "$candidate" "$staged_target"
+    mv -f "$staged_target" "$target"
+    staged_target=""
+)
+
+supacloud_version_at_least() {
+    local current="\${1#v}"
+    local required="\${2#v}"
+    local current_major=0 current_minor=0 current_patch=0
+    local required_major=0 required_minor=0 required_patch=0
+    [[ "$current" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+(-.*)?$ ]] || return 1
+    [[ "$required" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+(-.*)?$ ]] || return 1
+    IFS=. read -r current_major current_minor current_patch <<EOF
+\${current%%-*}
+EOF
+    IFS=. read -r required_major required_minor required_patch <<EOF
+\${required%%-*}
+EOF
+    current_major=\${current_major:-0}; current_minor=\${current_minor:-0}; current_patch=\${current_patch:-0}
+    required_major=\${required_major:-0}; required_minor=\${required_minor:-0}; required_patch=\${required_patch:-0}
+    if (( current_major != required_major )); then (( current_major > required_major )); return; fi
+    if (( current_minor != required_minor )); then (( current_minor > required_minor )); return; fi
+    (( current_patch >= required_patch ))
+}
+
+supacloud_gh_version() {
+    gh --version 2>/dev/null | awk 'NR == 1 && $1 == "gh" && $2 == "version" { print $3; exit }'
+}
+
+supacloud_install_gh_archive() {
+    local archive="$1"
+    local version="$2"
+    local arch="$3"
+    local expected_sha256="$4"
+    local target="$5"
+    local member="gh_\${version}_linux_\${arch}/bin/gh"
+    local actual_sha256 member_count member_details extracted_dir candidate version_output
+
+    actual_sha256=$(sha256sum "$archive" | awk '{print $1}')
+    if [[ "$actual_sha256" != "$expected_sha256" ]]; then
+        echo "GitHub CLI archive SHA256 mismatch" >&2
+        return 1
+    fi
+
+    member_count=$(tar -tzf "$archive" | grep -Fxc "$member" || true)
+    if [[ "$member_count" != "1" ]]; then
+        echo "GitHub CLI archive does not contain the exact expected member: $member" >&2
+        return 1
+    fi
+    member_details=$(tar -tvzf "$archive" "$member") || return 1
+    if [[ "\${member_details:0:1}" != "-" ]]; then
+        echo "GitHub CLI archive member is not a regular file: $member" >&2
+        return 1
+    fi
+
+    extracted_dir=$(mktemp -d)
+    candidate="\${extracted_dir}/\${member}"
+    if ! tar --no-same-owner --no-same-permissions -xzf "$archive" -C "$extracted_dir" "$member" \\
+        || ! supacloud_validate_binary "$candidate" "gh-linux-\${arch}"; then
+        rm -rf "$extracted_dir"
+        return 1
+    fi
+    chmod 0755 "$candidate"
+    version_output=$("$candidate" --version 2>/dev/null | head -1) || {
+        rm -rf "$extracted_dir"
+        echo "GitHub CLI bootstrap binary failed its version check" >&2
+        return 1
+    }
+    if [[ "$version_output" != "gh version \${version}"* ]]; then
+        rm -rf "$extracted_dir"
+        echo "GitHub CLI bootstrap version mismatch: \${version_output}" >&2
+        return 1
+    fi
+    mkdir -p "$(dirname "$target")"
+    install -m 0755 "$candidate" "$target"
+    rm -rf "$extracted_dir"
+}
+
+supacloud_install_pinned_gh() {
+    local target="\${1:-/usr/local/bin/gh}"
+    local machine arch expected_sha256 asset url archive
+    machine=$(uname -m)
+    case "$machine" in
+        x86_64|amd64)
+            arch="amd64"
+            expected_sha256="$SUPACLOUD_GH_AMD64_SHA256"
+            ;;
+        aarch64|arm64)
+            arch="arm64"
+            expected_sha256="$SUPACLOUD_GH_ARM64_SHA256"
+            ;;
+        *)
+            echo "Unsupported architecture for GitHub CLI bootstrap: $machine" >&2
+            return 1
+            ;;
+    esac
+    asset="gh_\${SUPACLOUD_GH_VERSION}_linux_\${arch}.tar.gz"
+    url="https://github.com/cli/cli/releases/download/v\${SUPACLOUD_GH_VERSION}/\${asset}"
+    archive=$(mktemp)
+    if ! supacloud_download_url "$url" "$archive" \\
+        || ! supacloud_install_gh_archive "$archive" "$SUPACLOUD_GH_VERSION" "$arch" "$expected_sha256" "$target"; then
+        rm -f "$archive"
+        return 1
+    fi
+    rm -f "$archive"
+}
+
+supacloud_validate_tar() {
+    local artifact_file="$1"
+    local entries
+    entries=$(tar -tzf "$artifact_file") || {
+        echo "Web Console archive is not a readable gzip tarball" >&2
+        return 1
+    }
+    if ! printf '%s\\n' "$entries" | awk '
+        /^\\// { exit 1 }
+        /(^|\\/)\\.\\.($|\\/)/ { exit 1 }
+    '; then
+        echo "Web Console archive contains an unsafe path" >&2
+        return 1
+    fi
+    if ! tar -tvzf "$artifact_file" | awk 'substr($1, 1, 1) != "-" && substr($1, 1, 1) != "d" { exit 1 }'; then
+        echo "Web Console archive contains links or special files" >&2
+        return 1
+    fi
+    printf '%s\\n' "$entries" | grep -Eq '(^|/)index\\.html$' || {
+        echo "Web Console archive is invalid or does not contain index.html" >&2
+        return 1
+    }
+}
+
+supacloud_record_integrity_mode() {
+    local mode="$1"
+    local record_file="\${SUPACLOUD_INTEGRITY_MODE_RECORD:-/var/lib/supacloud/artifact-integrity-mode}"
+    mkdir -p "$(dirname "$record_file")" 2>/dev/null || return 0
+    printf '%s\\n' "$mode" > "$record_file" 2>/dev/null || return 0
+    chmod 600 "$record_file" 2>/dev/null || true
+}
+
+supacloud_verify_attestation() {
+    local artifact_file="$1"
+    if supacloud_attestation_verifier_available; then
+        local verification_output
+        if ! verification_output=$(gh attestation verify "$artifact_file" \\
+            --repo "$SUPACLOUD_GITHUB_REPOSITORY" \\
+            --signer-workflow "$SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW" 2>&1); then
+            echo "GitHub artifact attestation verification failed: \${verification_output}" >&2
+            return 1
+        fi
+        supacloud_record_integrity_mode "github-attestation+same-release-sha256"
+        return
+    fi
+
+    if [[ "\${SUPACLOUD_ALLOW_UNVERIFIED_RELEASE:-false}" == "true" ]]; then
+        echo "BREAK-GLASS LIMITED INTEGRITY MODE: artifact attestation verification is unavailable; only the same-release SHA256 checksum was verified." >&2
+        supacloud_record_integrity_mode "break-glass:same-release-sha256-only"
+        return 0
+    fi
+
+    echo "Artifact attestation verification is required, but gh attestation verify is unavailable. Install GitHub CLI or explicitly set SUPACLOUD_ALLOW_UNVERIFIED_RELEASE=true for emergency break-glass use." >&2
+    return 1
+}
+
+supacloud_attestation_verifier_available() {
+    local version
+    command -v gh >/dev/null 2>&1 || return 1
+    version=$(supacloud_gh_version)
+    [[ -n "$version" ]] || return 1
+    supacloud_version_at_least "$version" "$SUPACLOUD_GH_MIN_VERSION" || return 1
+    gh attestation verify --help 2>&1 | grep -q -- '--signer-workflow'
+}
+
+supacloud_download_release_asset() (
+    local release_json="$1"
+    local asset_name="$2"
+    local destination="$3"
+    local asset_kind="$4"
+    local asset_url checksum_url temporary_artifact temporary_checksums
+
+    asset_url=$(supacloud_release_asset_url "$release_json" "$asset_name") || return 1
+    checksum_url=$(supacloud_release_asset_url "$release_json" SHA256SUMS) || return 1
+    mkdir -p "$(dirname "$destination")"
+    temporary_artifact=$(mktemp "\${destination}.tmp.XXXXXX")
+    temporary_checksums=$(mktemp "\${destination}.SHA256SUMS.tmp.XXXXXX")
+    trap 'rm -f "\${temporary_artifact:-}" "\${temporary_checksums:-}"' EXIT HUP INT TERM
+
+    if ! supacloud_download_url "$asset_url" "$temporary_artifact" \\
+        || ! supacloud_download_url "$checksum_url" "$temporary_checksums" \\
+        || ! supacloud_verify_checksum "$temporary_artifact" "$asset_name" "$temporary_checksums"; then
+        rm -f "$temporary_artifact" "$temporary_checksums"
+        return 1
+    fi
+
+    # Authenticate the digest before parsing archives or inspecting binaries.
+    if ! supacloud_verify_attestation "$temporary_artifact"; then
+        rm -f "$temporary_artifact" "$temporary_checksums"
+        return 1
+    fi
+
+    case "$asset_kind" in
+        binary) supacloud_validate_binary "$temporary_artifact" "$asset_name" ;;
+        tar) supacloud_validate_tar "$temporary_artifact" ;;
+        *)
+            echo "Unknown release asset kind: $asset_kind" >&2
+            rm -f "$temporary_artifact" "$temporary_checksums"
+            return 1
+            ;;
+    esac || {
+        rm -f "$temporary_artifact" "$temporary_checksums"
+        return 1
+    }
+
+    mv -f "$temporary_artifact" "$destination"
+    temporary_artifact=""
+    rm -f "$temporary_checksums"
+    temporary_checksums=""
+)
+`;
+
+// src/shared/tools/ssh-tools.ts
 var SAFE_CONTAINER_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/;
 var SAFE_PROJECT_REF = /^[a-z0-9-]{1,20}$/;
+var SAFE_SCHEMA_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]{0,62}$/;
 var SAFE_RELEASE_TAG = /^[a-zA-Z0-9._-]{1,80}$/;
 var SAFE_TIMEOUT_SECONDS = 300;
 var SAFE_HOSTNAME = /^(?=.{1,253}$)(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)(?:\.(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?))*$/;
 var SAFE_SYSTEMD_UNIT = /^[a-zA-Z0-9][a-zA-Z0-9_.@:-]{0,127}$/;
 var SAFE_DB_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_-]{0,62}$/;
+var MINIMUM_COMPONENT_UPGRADE_VERSION = "0.50.27";
 function hostnameSchema(fieldName) {
   return decodedSchema(Type.String(), Type.String({ minLength: 1, maxLength: 253 }), (value) => {
     const normalized = value.trim();
@@ -25639,6 +26097,114 @@ function assertSafeReleaseTag(value) {
   }
   return value;
 }
+function assertExactStableVersion(value, fieldName) {
+  if (!/^v?\d+\.\d+\.\d+$/.test(value)) {
+    throw new Error(`${fieldName} must be an exact stable semantic version`);
+  }
+  return value;
+}
+function upgradeEnvAssignments(request) {
+  return [
+    request.version ? `SUPACLOUD_UPGRADE_TAG=${quoteEnvValue(request.version)}` : "",
+    request.edgeRuntimeVersion ? `SUPACLOUD_EDGE_RUNTIME_UPGRADE_TAG=${quoteEnvValue(request.edgeRuntimeVersion)}` : "",
+    request.githubProxy ? `SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(request.githubProxy)}` : ""
+  ].filter(Boolean).join(" ");
+}
+function componentBootstrapCommands(request) {
+  if (!request.edgeRuntimeVersion)
+    return [`UPGRADE_RUNNER=${quoteEnvValue("/usr/local/bin/supacloud")}`];
+  const managementVersion = request.version || "latest";
+  return [
+    `ACTIVE_VERSION=$(/usr/local/bin/supacloud --version 2>&1 | grep -Eo '[0-9]+\\.[0-9]+\\.[0-9]+' | head -1 || true)`,
+    `UPGRADE_RUNNER=${quoteEnvValue("/usr/local/bin/supacloud")}`,
+    `if ! supacloud_version_at_least "$ACTIVE_VERSION" ${quoteEnvValue(MINIMUM_COMPONENT_UPGRADE_VERSION)}; then`,
+    `  case "$(uname -m)" in x86_64|amd64) MANAGEMENT_ASSET=supacloud-linux-amd64 ;; aarch64|arm64) MANAGEMENT_ASSET=supacloud-linux-arm64 ;; *) echo 'Unsupported Management architecture' >&2; exit 1 ;; esac`,
+    `  STAGED_MANAGEMENT=$(mktemp /tmp/supacloud-management-upgrade.XXXXXX)`,
+    `  MANAGEMENT_RELEASE=$(supacloud_fetch_component_release management-api ${quoteEnvValue(managementVersion)} "$MANAGEMENT_ASSET" web-console-build.tar.gz)`,
+    `  supacloud_download_release_asset "$MANAGEMENT_RELEASE" "$MANAGEMENT_ASSET" "$STAGED_MANAGEMENT" binary`,
+    `  chmod 0755 "$STAGED_MANAGEMENT"`,
+    `  STAGED_VERSION=$("$STAGED_MANAGEMENT" --version 2>&1 | grep -Eo '[0-9]+\\.[0-9]+\\.[0-9]+' | head -1 || true)`,
+    `  supacloud_version_at_least "$STAGED_VERSION" ${quoteEnvValue(MINIMUM_COMPONENT_UPGRADE_VERSION)} || { echo 'Target Management release lacks Edge Runtime transaction capability' >&2; exit 1; }`,
+    `  UPGRADE_RUNNER="$STAGED_MANAGEMENT"`,
+    "fi"
+  ];
+}
+function componentPreflightCommands(request) {
+  return request.edgeRuntimeVersion ? [
+    "test -f /etc/supabase/management-api.env || { echo 'EDGE_RUNTIME_MODE is unavailable; component upgrade requires external mode' >&2; exit 1; }",
+    `EDGE_RUNTIME_MODE_VALUE=$(awk -F= '$1 == "EDGE_RUNTIME_MODE" { value=$2 } END { gsub(/^[[:space:]\\"'"']+|[[:space:]\\"'"']+$/, "", value); print value }' /etc/supabase/management-api.env)`,
+    `test "$EDGE_RUNTIME_MODE_VALUE" = external || { echo 'Edge Runtime component upgrade supports persisted external mode only' >&2; exit 1; }`
+  ] : [];
+}
+function buildRootUpgradeScript(request) {
+  const envAssignments = upgradeEnvAssignments(request);
+  return [
+    "set -euo pipefail",
+    "umask 077",
+    "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+    "export PATH",
+    "unset SUPACLOUD_ALLOW_UNVERIFIED_RELEASE SUPACLOUD_GITHUB_REPOSITORY SUPACLOUD_RELEASES_API SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW SUPACLOUD_GH_VERSION SUPACLOUD_GH_MIN_VERSION SUPACLOUD_GH_AMD64_SHA256 SUPACLOUD_GH_ARM64_SHA256 GH_PROXY",
+    request.githubProxy ? `export SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(request.githubProxy)}` : "unset SUPACLOUD_GITHUB_PROXY",
+    'for tool in curl jq file sha256sum tar; do command -v "$tool" >/dev/null 2>&1 || { echo "Required upgrade tool is missing: $tool" >&2; exit 127; }; done',
+    "test -x /usr/local/bin/supacloud || { echo 'SupaCloud binary not found at /usr/local/bin/supacloud; run ssh install first.' >&2; exit 127; }",
+    ...componentPreflightCommands(request),
+    "STAGED_MANAGEMENT=''",
+    `trap 'test -z "$STAGED_MANAGEMENT" || rm -f "$STAGED_MANAGEMENT"' EXIT HUP INT TERM`,
+    `source ${quoteEnvValue(request.helperPath)}`,
+    "if ! supacloud_attestation_verifier_available; then supacloud_install_pinned_gh /usr/local/bin/gh; fi",
+    "supacloud_attestation_verifier_available || { echo 'Pinned GitHub attestation verifier is unavailable' >&2; exit 1; }",
+    ...componentBootstrapCommands(request),
+    `${envAssignments ? `env ${envAssignments} ` : ""}"$UPGRADE_RUNNER" upgrade --yes`
+  ].join("; ");
+}
+function buildOfficialUpgradeCommand(request) {
+  const rootScript = buildRootUpgradeScript(request);
+  return `set -e; trap 'rm -f ${request.helperPath}' EXIT HUP INT TERM; ` + 'if [ "$(id -u)" -eq 0 ]; then ' + `bash -c ${quoteEnvValue(rootScript)}; ` + "else sudo -n true; " + `sudo -n bash -c ${quoteEnvValue(rootScript)}; fi`;
+}
+async function removeRemoteUpgradeHelper(ssh, helperPath) {
+  const cleanup = await ssh.exec(`rm -f ${quoteEnvValue(helperPath)}`);
+  if (!cleanup.success) {
+    throw new Error(`Failed to remove remote upgrade helper (exit ${cleanup.code}): ${cleanup.stderr.slice(-300)}`);
+  }
+}
+function remoteUpgradeFailure(execution) {
+  const diagnostic = execution.stderr.trim() || execution.stdout.trim() || "no remote diagnostic";
+  return new Error(`Remote upgrade failed (exit ${execution.code}): ${diagnostic.slice(-500)}`);
+}
+function officialUpgradeOutcome(execution, executionError, cleanupError) {
+  if (executionError && cleanupError) {
+    throw new AggregateError([executionError, cleanupError], "Upgrade execution failed and helper cleanup did not complete");
+  }
+  if (executionError)
+    throw executionError;
+  if (!execution)
+    throw new Error("Upgrade execution did not return a result");
+  if (cleanupError && !execution.success) {
+    throw new AggregateError([remoteUpgradeFailure(execution), cleanupError], "Remote upgrade failed and helper cleanup did not complete");
+  }
+  if (cleanupError)
+    throw cleanupError;
+  if (!execution.success)
+    throw remoteUpgradeFailure(execution);
+  return execution;
+}
+async function executeOfficialUpgrade(ssh, helperPath, command) {
+  let execution;
+  let executionError;
+  try {
+    await ssh.uploadText(helperPath, release_assets_default, 384);
+    execution = await ssh.exec(command, 600000);
+  } catch (error) {
+    executionError = error;
+  }
+  let cleanupError;
+  try {
+    await removeRemoteUpgradeHelper(ssh, helperPath);
+  } catch (error) {
+    cleanupError = error;
+  }
+  return officialUpgradeOutcome(execution, executionError, cleanupError);
+}
 function assertSafeGithubProxy(value) {
   const trimmed = value.trim();
   if (/[\s\n\r;&|`$<>{}\[\]()*!?\\'\"]/.test(trimmed)) {
@@ -25803,6 +26369,7 @@ Actions: ping, setup, install, upgrade, diagnose, exec, troubleshoot, container_
     edge_runtime: optional(stringEnum(["bun"]), "[install] Runtime (default: bun)"),
     storage_type: optional(stringEnum(["juicefs", "minio"]), "[install] Storage backend configurable through Admin"),
     version: optional(Type.String(), "[upgrade] Specific version"),
+    edge_runtime_version: optional(Type.String(), "[upgrade] Exact independent Edge Runtime version"),
     github_proxy: optional(Type.String(), "[install/upgrade] Explicit GitHub proxy prefix, or direct/none"),
     focus: optional(stringEnum(["all", "containers", "database", "network", "disk", "logs"]), "[troubleshoot] Focus area"),
     container: optional(Type.String(), "[container_logs] Container name"),
@@ -25921,16 +26488,29 @@ ${result.stderr.slice(-500)}`;
         break;
       }
       case "upgrade": {
-        const envParts = [
-          args.version ? `SUPACLOUD_UPGRADE_TAG=${assertSafeReleaseTag(args.version)}` : "",
-          args.github_proxy ? `SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(assertSafeGithubProxy(args.github_proxy))}` : ""
-        ].filter(Boolean);
-        const envPrefix = envParts.length > 0 ? `${envParts.join(" ")} ` : "";
-        const cmd = "if [ ! -x /usr/local/bin/supacloud ]; then " + "echo 'SupaCloud binary not found at /usr/local/bin/supacloud; run ssh install first.' >&2; exit 127; " + `fi; ${envPrefix}/usr/local/bin/supacloud upgrade --yes`;
-        const r = await ssh.exec(cmd, 600000);
-        text = r.success ? `✅ Upgrade done
-${r.stdout.slice(-300)}` : `❌ Failed (exit ${r.code})
-${r.stderr.slice(-500)}`;
+        const version = args.version ? assertSafeReleaseTag(args.version) : undefined;
+        const edgeRuntimeVersion = args.edge_runtime_version ? assertSafeReleaseTag(args.edge_runtime_version) : undefined;
+        if (edgeRuntimeVersion && !version) {
+          throw new Error("'version' is required with 'edge_runtime_version'");
+        }
+        if (edgeRuntimeVersion && version) {
+          assertExactStableVersion(version, "version");
+          assertExactStableVersion(edgeRuntimeVersion, "edge_runtime_version");
+        }
+        const validatedProxy = args.github_proxy ? assertSafeGithubProxy(args.github_proxy) : undefined;
+        const githubProxy = validatedProxy && !["direct", "none"].includes(validatedProxy.toLowerCase()) ? validatedProxy : undefined;
+        const helperPath = `/tmp/.supacloud-release-assets-${randomUUID()}.sh`;
+        const cmd = buildOfficialUpgradeCommand({
+          version,
+          edgeRuntimeVersion,
+          githubProxy,
+          helperPath
+        });
+        const upgradeExecution = await executeOfficialUpgrade(ssh, helperPath, cmd);
+        const edgeBoundary = edgeRuntimeVersion ? "" : `
+⚠️ Edge Runtime was not upgraded; provide --edge_runtime_version for a component transaction.`;
+        text = `✅ Upgrade done
+${upgradeExecution.stdout.slice(-300)}${edgeBoundary}`;
         break;
       }
       case "diagnose": {
@@ -26071,12 +26651,15 @@ ${output}`;
         if (sourceRef === targetRef)
           throw new Error("source_ref and target_ref must be different");
         const s = args.schemas || "public,auth,storage";
-        if (!/^[a-z_,\s]+$/.test(s))
-          throw new Error("Invalid schemas");
         const schemas = s.split(",").map((x) => x.trim()).filter(Boolean);
         if (schemas.length === 0)
           throw new Error("At least one schema is required");
-        const schemaArgs = schemas.map((schema) => `-n ${schema}`).join(" ");
+        for (const schema of schemas) {
+          if (!SAFE_SCHEMA_IDENTIFIER.test(schema)) {
+            throw new Error(`Invalid schema identifier: ${JSON.stringify(schema)}`);
+          }
+        }
+        const schemaArgs = schemas.map((schema) => `-n '${schema}'`).join(" ");
         const df = args.data_only ? "--data-only" : "";
         const cmd = [
           "set -euo pipefail",
@@ -27039,7 +27622,13 @@ async function main() {
   await runCli(cliTools, args, { commandName: "supacloud-admin" });
 }
 function isDirectRun() {
-  return Boolean(process.argv[1]) && import.meta.url === pathToFileURL(resolve2(process.argv[1])).href;
+  if (!process.argv[1])
+    return false;
+  try {
+    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(resolve2(process.argv[1]));
+  } catch {
+    return false;
+  }
 }
 if (isDirectRun()) {
   main().catch((error) => {