@supacloud/admin 0.7.11 → 0.8.0

package/dist/index.js

@@ -25702,8 +25702,10 @@ class HttpTransport {
 }
 
 // src/shared/tools/ssh-tools.ts
+import { Buffer as Buffer2 } from "node:buffer";
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { dirname } from "node:path";
+import { basename as basename3, dirname, join as join2 } from "node:path";
+import { TextDecoder as TextDecoder2 } from "node:util";
 
 // src/shared/releases/local-upgrade-transfer.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
@@ -25735,10 +25737,10 @@ function quoteShell(shellText) {
 
 // src/shared/releases/local-upgrade-bundle.ts
 import { spawn } from "node:child_process";
-import { createHash, randomUUID as randomUUID2 } from "node:crypto";
-import { accessSync, chmodSync, constants as fsConstants, createWriteStream, mkdirSync, mkdtempSync, readFileSync as readFileSync3, rmSync, statSync, writeFileSync } from "node:fs";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import { accessSync, chmodSync as chmodSync2, constants as fsConstants, createWriteStream, lstatSync, mkdirSync, mkdtempSync as mkdtempSync2, readFileSync as readFileSync3, readdirSync, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { get } from "node:https";
-import { tmpdir } from "node:os";
+import { tmpdir as tmpdir2 } from "node:os";
 import { basename, delimiter, join } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { Transform as Transform2 } from "node:stream";
@@ -25905,6 +25907,97 @@ function parseReleaseChecksums(text, manifest) {
   return checksums;
 }
 
+// ../management-api/src/sigstore-trusted-root.ts
+import { createHash } from "node:crypto";
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+// ../management-api/src/assets/sigstore-public-good-trusted-root.jsonl
+var sigstore_public_good_trusted_root_default = '{"mediaType":"application/vnd.dev.sigstore.trustedroot+json;version=0.1","tlogs":[{"baseUrl":"https://rekor.sigstore.dev","hashAlgorithm":"SHA2_256","publicKey":{"rawBytes":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwrkBbmLSGtks4L3qX6yYY0zufBnhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==","keyDetails":"PKIX_ECDSA_P256_SHA_256","validFor":{"start":"2021-01-12T11:53:27Z"}},"logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="}},{"baseUrl":"https://log2025-1.rekor.sigstore.dev","hashAlgorithm":"SHA2_256","publicKey":{"rawBytes":"MCowBQYDK2VwAyEAt8rlp1knGwjfbcXAYPYAkn0XiLz1x8O4t0YkEhie244=","keyDetails":"PKIX_ED25519","validFor":{"start":"2025-09-23T00:00:00Z"}},"logId":{"keyId":"zxGZFVvd0FEmjR8WrFwMdcAJ9vtaY/QXf44Y1wUeP6A="}}],"certificateAuthorities":[{"subject":{"organization":"sigstore.dev","commonName":"sigstore"},"uri":"https://fulcio.sigstore.dev","certChain":{"certificates":[{"rawBytes":"MIIB+DCCAX6gAwIBAgITNVkDZoCiofPDsy7dfm6geLbuhzAKBggqhkjOPQQDAzAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTIxMDMwNzAzMjAyOVoXDTMxMDIyMzAzMjAyOVowKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABLSyA7Ii5k+pNO8ZEWY0ylemWDowOkNa3kL+GZE5Z5GWehL9/A9bRNA3RbrsZ5i0JcastaRL7Sp5fp/jD5dxqc/UdTVnlvS16an+2Yfswe/QuLolRUCrcOE2+2iA5+tzd6NmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFMjFHQBBmiQpMlEk6w2uSu1KBtPsMB8GA1UdIwQYMBaAFMjFHQBBmiQpMlEk6w2uSu1KBtPsMAoGCCqGSM49BAMDA2gAMGUCMH8liWJfMui6vXXBhjDgY4MwslmN/TJxVe/83WrFomwmNf056y1X48F9c4m3a3ozXAIxAKjRay5/aj/jsKKGIkmQatjI8uupHr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ=="}]},"validFor":{"start":"2021-03-07T03:20:29Z","end":"2022-12-31T23:59:59.999Z"}},{"subject":{"organization":"sigstore.dev","commonName":"sigstore"},"uri":"https://fulcio.sigstore.dev","certChain":{"certificates":[{"rawBytes":"MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsPmygUY7Ii2zbdCdliiow="},{"rawBytes":"MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ"}]},"validFor":{"start":"2022-04-13T20:06:15Z"}}],"ctlogs":[{"baseUrl":"https://ctfe.sigstore.dev/test","hashAlgorithm":"SHA2_256","publicKey":{"rawBytes":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbfwR+RJudXscgRBRpKX1XFDy3PyudDxz/SfnRi1fT8ekpfBd2O1uoz7jr3Z8nKzxA69EUQ+eFCFI3zeubPWU7w==","keyDetails":"PKIX_ECDSA_P256_SHA_256","validFor":{"start":"2021-03-14T00:00:00Z","end":"2022-10-31T23:59:59.999Z"}},"logId":{"keyId":"CGCS8ChS/2hF0dFrJ4ScRWcYrBY9wzjSbea8IgY2b3I="}},{"baseUrl":"https://ctfe.sigstore.dev/2022","hashAlgorithm":"SHA2_256","publicKey":{"rawBytes":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEiPSlFi0CmFTfEjCUqF9HuCEcYXNKAaYalIJmBZ8yyezPjTqhxrKBpMnaocVtLJBI1eM3uXnQzQGAJdJ4gs9Fyw==","keyDetails":"PKIX_ECDSA_P256_SHA_256","validFor":{"start":"2022-10-20T00:00:00Z"}},"logId":{"keyId":"3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4="}}],"timestampAuthorities":[{"subject":{"organization":"sigstore.dev","commonName":"sigstore-tsa-selfsigned"},"uri":"https://timestamp.sigstore.dev/api/v1/timestamp","certChain":{"certificates":[{"rawBytes":"MIICEDCCAZagAwIBAgIUOhNULwyQYe68wUMvy4qOiyojiwwwCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTA0MDgwNjU5NDNaFw0zNTA0MDYwNjU5NDNaMC4xFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEVMBMGA1UEAxMMc2lnc3RvcmUtdHNhMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE4ra2Z8hKNig2T9kFjCAToGG30jky+WQv3BzL+mKvh1SKNR/UwuwsfNCg4sryoYAd8E6isovVA3M4aoNdm9QDi50Z8nTEyvqgfDPtTIwXItfiW/AFf1V7uwkbkAoj0xxco2owaDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFIn9eUOHz9BlRsMCRscsc1t9tOsDMB8GA1UdIwQYMBaAFJjsAe9/u1H/1JUeb4qImFMHic6/MBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMAoGCCqGSM49BAMDA2gAMGUCMDtpsV/6KaO0qyF/UMsX2aSUXKQFdoGTptQGc0ftq1csulHPGG6dsmyMNd3JB+G3EQIxAOajvBcjpJmKb4Nv+2Taoj8Uc5+b6ih6FXCCKraSqupe07zqswMcXJTe1cExvHvvlw=="},{"rawBytes":"MIIB9zCCAXygAwIBAgIUV7f0GLDOoEzIh8LXSW80OJiUp14wCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTA0MDgwNjU5NDNaFw0zNTA0MDYwNjU5NDNaMDkxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZzaWduZWQwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQUQNtfRT/ou3YATa6wB/kKTe70cfJwyRIBovMnt8RcJph/COE82uyS6FmppLLL1VBPGcPfpQPYJNXzWwi8icwhKQ6W/Qe2h3oebBb2FHpwNJDqo+TMaC/tdfkv/ElJB72jRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSY7AHvf7tR/9SVHm+KiJhTB4nOvzAKBggqhkjOPQQDAwNpADBmAjEAwGEGrfGZR1cen1R8/DTVMI943LssZmJRtDp/i7SfGHmGRP6gRbuj9vOK3b67Z0QQAjEAuT2H673LQEaHTcyQSZrkp4mX7WwkmF+sVbkYY5mXN+RMH13KUEHHOqASaemYWK/E"}]},"validFor":{"start":"2025-07-04T00:00:00Z"}}]}\n';
+
+// ../management-api/src/sigstore-trusted-root.ts
+var SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_FILENAME = "trusted_root.jsonl";
+var SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SHA256 = "3c2cc7f357dc064ec527fdcd78da6e9245c21a381e1abaa0f2b62b186bcac1a1";
+var SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SIZE = 5748;
+function sha256(text) {
+  return createHash("sha256").update(text).digest("hex");
+}
+function validateEmbeddedTrustedRoot(jsonl) {
+  if (Buffer.byteLength(jsonl) !== SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SIZE || sha256(jsonl) !== SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SHA256) {
+    throw new Error("Embedded Sigstore Public Good trusted root does not match its pinned digest");
+  }
+  if (!jsonl.endsWith(`
+`) || jsonl.slice(0, -1).includes(`
+`)) {
+    throw new Error("Embedded Sigstore Public Good trusted root must be compact JSONL");
+  }
+  let trustedRoot;
+  try {
+    trustedRoot = JSON.parse(jsonl);
+  } catch {
+    throw new Error("Embedded Sigstore Public Good trusted root is not valid JSON");
+  }
+  if (!trustedRoot || typeof trustedRoot !== "object" || Array.isArray(trustedRoot) || `${JSON.stringify(trustedRoot)}
+` !== jsonl) {
+    throw new Error("Embedded Sigstore Public Good trusted root is not canonical compact JSONL");
+  }
+  return jsonl;
+}
+var SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_JSONL = validateEmbeddedTrustedRoot(sigstore_public_good_trusted_root_default);
+function createSigstoreVerificationDirectory() {
+  const directory = mkdtempSync(path.join(tmpdir(), "supacloud-sigstore-"));
+  try {
+    chmodSync(directory, 448);
+    const trustedRootPath = path.join(directory, SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_FILENAME);
+    writeFileSync(trustedRootPath, SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_JSONL, {
+      flag: "wx",
+      mode: 384
+    });
+    chmodSync(trustedRootPath, 384);
+    return { directory, trustedRootPath };
+  } catch (operationError) {
+    try {
+      rmSync(directory, { recursive: true });
+    } catch (cleanupError) {
+      throw new AggregateError([operationError, cleanupError], "Sigstore trusted root creation failed and temporary directory cleanup did not complete");
+    }
+    throw operationError;
+  }
+}
+function throwVerificationDirectoryOutcome(outcome) {
+  if (outcome.operationFailed && outcome.cleanupFailed) {
+    throw new AggregateError([outcome.operationError, outcome.cleanupError], "Sigstore verification failed and temporary trusted root cleanup did not complete");
+  }
+  if (outcome.operationFailed)
+    throw outcome.operationError;
+  if (outcome.cleanupFailed) {
+    throw new AggregateError([outcome.cleanupError], "Temporary Sigstore trusted root cleanup did not complete");
+  }
+}
+async function withSigstoreVerificationDirectory(operation) {
+  const resources = createSigstoreVerificationDirectory();
+  let operationOutput;
+  let operationFailed = false;
+  let operationError;
+  try {
+    operationOutput = await operation(resources);
+  } catch (error) {
+    operationFailed = true;
+    operationError = error;
+  }
+  let cleanupFailed = false;
+  let cleanupError;
+  try {
+    rmSync(resources.directory, { recursive: true });
+  } catch (error) {
+    cleanupFailed = true;
+    cleanupError = error;
+  }
+  throwVerificationDirectoryOutcome({ operationFailed, operationError, cleanupFailed, cleanupError });
+  return operationOutput;
+}
+
 // src/shared/releases/local-upgrade-bundle.ts
 var RELEASES_API = `https://api.github.com/repos/${RELEASE_REPOSITORY}/releases`;
 var ATTESTATIONS_API = `https://api.github.com/repos/${RELEASE_REPOSITORY}/attestations`;
@@ -25938,7 +26031,8 @@ var STRICT_GITHUB_CAPABILITY_FLAGS = [
   "--signer-workflow",
   "--source-ref",
   "--source-digest",
-  "--deny-self-hosted-runners"
+  "--deny-self-hosted-runners",
+  "--custom-trusted-root"
 ];
 
 class RetryableDownloadError extends Error {
@@ -25953,7 +26047,56 @@ function githubCliArchiveIdentity(architecture) {
   };
 }
 function sha256File(filePath) {
-  return createHash("sha256").update(readFileSync3(filePath)).digest("hex");
+  return createHash2("sha256").update(readFileSync3(filePath)).digest("hex");
+}
+function effectiveLocalOwner() {
+  if (process.platform === "win32")
+    return;
+  const uid = process.geteuid?.() ?? process.getuid?.();
+  const gid = process.getegid?.() ?? process.getgid?.();
+  if (uid === undefined || gid === undefined) {
+    throw new Error("Local artifact transport requires POSIX ownership checks");
+  }
+  return { uid, gid };
+}
+function assertLocalOwner(uid, gid, label) {
+  const owner = effectiveLocalOwner();
+  if (!owner)
+    return;
+  if (uid !== owner.uid || gid !== owner.gid) {
+    throw new Error(`${label} must be owned by the current effective user`);
+  }
+}
+function assertLocalTrustedRootDirectory(directory) {
+  const directoryStats = lstatSync(directory);
+  if (!directoryStats.isDirectory() || directoryStats.isSymbolicLink()) {
+    throw new Error("Local trusted-root directory must be a directory without links");
+  }
+  assertPrivateLocalDirectoryMode(directoryStats.mode, "Local trusted-root directory");
+  assertLocalOwner(directoryStats.uid, directoryStats.gid, "Local trusted-root directory");
+  const entries = readdirSync(directory);
+  if (entries.length !== 1 || entries[0] !== SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_FILENAME) {
+    throw new Error("Local trusted-root directory does not match its strict file allowlist");
+  }
+  const trustedRootPath = join(directory, SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_FILENAME);
+  assertLocalTrustedRootFile(trustedRootPath);
+  return trustedRootPath;
+}
+function assertPrivateLocalDirectoryMode(mode, label) {
+  if (process.platform !== "win32" && (mode & 4095) !== 448) {
+    throw new Error(`${label} must use exact mode 0700 without special permission bits`);
+  }
+}
+function assertLocalTrustedRootFile(trustedRootPath) {
+  const stats = lstatSync(trustedRootPath);
+  if (!stats.isFile() || stats.isSymbolicLink() || stats.nlink !== 1) {
+    throw new Error("Local trusted root must be a direct regular file without links");
+  }
+  assertPrivateLocalFileMode(stats.mode, "Local trusted root");
+  assertLocalOwner(stats.uid, stats.gid, "Local trusted root");
+  if (stats.size !== SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SIZE || sha256File(trustedRootPath) !== SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SHA256) {
+    throw new Error("Local trusted root does not match its pinned size and digest");
+  }
 }
 function assertPrivateLocalFileMode(mode, label) {
   if (process.platform !== "win32" && (mode & 4095) !== 384) {
@@ -26055,10 +26198,10 @@ async function downloadDirect(url, destination, maxBytes) {
   const deadline = Date.now() + DOWNLOAD_TIMEOUT_MS;
   const retryFailures = [];
   for (let attempt = 1;attempt <= 3; attempt += 1) {
-    rmSync(destination, { force: true });
+    rmSync2(destination, { force: true });
     try {
       await downloadHttpsResponse({ url: parsed, destination, maxBytes, redirects: 0, deadline });
-      chmodSync(destination, 384);
+      chmodSync2(destination, 384);
       return;
     } catch (error) {
       if (!downloadCanRetry(error))
@@ -26214,13 +26357,13 @@ async function assertLocalGithubVerifier() {
     throw new Error("Local artifact transport requires a current gh attestation verifier");
   }
 }
-async function verifyManifestAttestation(manifestPath, bundlePath, manifest) {
-  const verification = await runGithubCli([
+function githubAttestationVerificationArguments(request) {
+  return [
     "attestation",
     "verify",
-    manifestPath,
+    request.artifactPath,
     "--bundle",
-    bundlePath,
+    request.bundlePath,
     "--repo",
     RELEASE_REPOSITORY,
     "--signer-workflow",
@@ -26228,9 +26371,14 @@ async function verifyManifestAttestation(manifestPath, bundlePath, manifest) {
     "--source-ref",
     RELEASE_SOURCE_REF,
     "--source-digest",
-    manifest.source.commit,
-    "--deny-self-hosted-runners"
-  ], GH_VERIFICATION_TIMEOUT_MS);
+    request.manifest.source.commit,
+    "--deny-self-hosted-runners",
+    "--custom-trusted-root",
+    request.trustedRootPath
+  ];
+}
+async function verifyManifestAttestation(request) {
+  const verification = await runGithubCli(githubAttestationVerificationArguments(request), GH_VERIFICATION_TIMEOUT_MS);
   if (verification.exitCode !== 0) {
     throw new Error(`gh attestation verify failed: ${verification.stderr.trim().slice(-1000) || verification.exitCode}`);
   }
@@ -26261,7 +26409,7 @@ async function downloadReleaseMetadata(component, version, directory) {
     await downloadDirect(`${RELEASES_API}/tags/${expectedTag}`, metadataPath, RELEASE_BUNDLE_SIZE_LIMITS.manifest);
     return parseGithubReleaseMetadata(parseJsonFile(metadataPath, "GitHub release metadata"), expectedTag);
   } finally {
-    rmSync(metadataPath, { force: true });
+    rmSync2(metadataPath, { force: true });
   }
 }
 async function downloadManifestAttestation(manifestPath, destination) {
@@ -26269,10 +26417,10 @@ async function downloadManifestAttestation(manifestPath, destination) {
   try {
     await downloadDirect(`${ATTESTATIONS_API}/sha256:${sha256File(manifestPath)}`, responsePath, RELEASE_BUNDLE_SIZE_LIMITS.attestation);
     const bundles = serializeAttestationBundles(parseJsonFile(responsePath, "GitHub attestation response"));
-    writeFileSync(destination, bundles, { mode: 384, flag: "wx" });
-    chmodSync(destination, 384);
+    writeFileSync2(destination, bundles, { mode: 384, flag: "wx" });
+    chmodSync2(destination, 384);
   } finally {
-    rmSync(responsePath, { force: true });
+    rmSync2(responsePath, { force: true });
   }
 }
 async function downloadComponent(request) {
@@ -26282,7 +26430,12 @@ async function downloadComponent(request) {
   await downloadDirect(releaseAssetUrl(release, RELEASE_MANIFEST_NAME), manifestPath, RELEASE_BUNDLE_SIZE_LIMITS.manifest);
   const manifest = parseReleaseManifest(readFileSync3(manifestPath, "utf8"), request);
   await downloadManifestAttestation(manifestPath, attestationPath);
-  await verifyManifestAttestation(manifestPath, attestationPath, manifest);
+  await verifyManifestAttestation({
+    artifactPath: manifestPath,
+    bundlePath: attestationPath,
+    manifest,
+    trustedRootPath: request.trustedRootPath
+  });
   const checksumsPath = directChildPath(request.destination, RELEASE_CHECKSUMS_NAME);
   await downloadDirect(releaseAssetUrl(release, RELEASE_CHECKSUMS_NAME), checksumsPath, RELEASE_BUNDLE_SIZE_LIMITS.checksums);
   assertSignedArtifact(checksumsPath, manifest);
@@ -26305,7 +26458,7 @@ async function downloadPinnedGithubCli(directory, architecture) {
   return localUpgradeFile(archivePath, `verifier/${identity.archiveName}`);
 }
 function cleanupLocalUpgradeBundle(bundle) {
-  rmSync(bundle.directory, { recursive: true, force: true });
+  rmSync2(bundle.directory, { recursive: true, force: true });
 }
 function assertLocalUpgradeBundleSize(files) {
   const totalBytes = files.reduce((sum, file) => sum + file.size, 0);
@@ -26342,15 +26495,15 @@ async function settleLocalBundleDownloads(downloads) {
   ];
 }
 function createLocalBundleLayout(request) {
-  const directory = mkdtempSync(join(tmpdir(), "supacloud-admin-upgrade-"));
-  chmodSync(directory, 448);
+  const directory = mkdtempSync2(join(tmpdir2(), "supacloud-admin-upgrade-"));
+  chmodSync2(directory, 448);
   const bundleDirectory = join(directory, "bundle");
   const managementDirectory = join(bundleDirectory, "management-api");
   const edgeDirectory = join(bundleDirectory, "edge-runtime");
   const verifierDirectory = join(directory, "verifier");
   for (const createdDirectory of [bundleDirectory, managementDirectory, edgeDirectory, verifierDirectory]) {
     mkdirSync(createdDirectory, { recursive: true, mode: 448 });
-    chmodSync(createdDirectory, 448);
+    chmodSync2(createdDirectory, 448);
   }
   return {
     directory,
@@ -26361,20 +26514,22 @@ function createLocalBundleLayout(request) {
     edgeRuntimeBinaryName: `supacloud-edge-runtime-linux-${request.architecture}`
   };
 }
-async function downloadLocalBundle(request, layout) {
+async function downloadLocalBundle(request, layout, trustedRootPath) {
   const { managementBinaryName, edgeRuntimeBinaryName } = layout;
   const [managementFiles, edgeFiles, verifierArchive] = await settleLocalBundleDownloads([
     downloadComponent({
       component: "management-api",
       version: request.managementVersion,
       assetNames: [managementBinaryName, "web-console-build.tar.gz"],
-      destination: layout.managementDirectory
+      destination: layout.managementDirectory,
+      trustedRootPath
     }),
     downloadComponent({
       component: "edge-runtime",
       version: request.edgeRuntimeVersion,
       assetNames: [edgeRuntimeBinaryName],
-      destination: layout.edgeDirectory
+      destination: layout.edgeDirectory,
+      trustedRootPath
     }),
     request.verifierProvisioning === "bundled" ? downloadPinnedGithubCli(layout.verifierDirectory, request.architecture) : Promise.resolve(null)
   ]);
@@ -26388,9 +26543,16 @@ async function prepareLocalUpgradeBundle(request) {
   await assertLocalGithubVerifier();
   const layout = createLocalBundleLayout(request);
   try {
-    return await downloadLocalBundle(request, layout);
+    return await withSigstoreVerificationDirectory(async (verificationDirectory) => {
+      const trustedRootPath = assertLocalTrustedRootDirectory(verificationDirectory.directory);
+      return await downloadLocalBundle(request, layout, trustedRootPath);
+    });
   } catch (error) {
-    rmSync(layout.directory, { recursive: true, force: true });
+    try {
+      rmSync2(layout.directory, { recursive: true, force: true });
+    } catch (cleanupError) {
+      throw new AggregateError([error, cleanupError], "Local bundle preparation failed and cleanup did not complete");
+    }
     throw error;
   }
 }
@@ -26606,7 +26768,7 @@ function upgradeScriptSetup(paths) {
     "write_status RUNNING",
     buildUpgradeLockScript(SUPACLOUD_UPGRADE_LOCK_PATH),
     `while IFS='=' read -r variable _; do case "$variable" in *PROXY*|*Proxy*|*proxy*) unset "$variable" ;; esac; done < <(env)`,
-    "unset SUPACLOUD_ALLOW_UNVERIFIED_RELEASE SUPACLOUD_GITHUB_REPOSITORY SUPACLOUD_RELEASES_API SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW NODE_USE_ENV_PROXY"
+    "unset SUPACLOUD_ALLOW_UNVERIFIED_RELEASE SUPACLOUD_GITHUB_REPOSITORY SUPACLOUD_RELEASES_API SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW SUPACLOUD_ATTESTATION_TRUSTED_ROOT NODE_USE_ENV_PROXY"
   ];
 }
 function upgradeScriptFilesystemChecks(bundle) {
@@ -27106,493 +27268,7 @@ async function executeLocalUpgradeTransfer(ssh, request) {
 }
 
 // ../../scripts/lib/release_assets.sh
-var release_assets_default = `#!/usr/bin/env bash
-
-SUPACLOUD_GITHUB_REPOSITORY="\${SUPACLOUD_GITHUB_REPOSITORY:-zuohuadong/supacloud}"
-SUPACLOUD_RELEASES_API="\${SUPACLOUD_RELEASES_API:-https://api.github.com/repos/\${SUPACLOUD_GITHUB_REPOSITORY}/releases}"
-SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW="\${SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW:-\${SUPACLOUD_GITHUB_REPOSITORY}/.github/workflows/release-please.yml}"
-SUPACLOUD_GH_VERSION="\${SUPACLOUD_GH_VERSION:-2.96.0}"
-SUPACLOUD_GH_MIN_VERSION="\${SUPACLOUD_GH_MIN_VERSION:-2.68.0}"
-SUPACLOUD_GH_AMD64_SHA256="\${SUPACLOUD_GH_AMD64_SHA256:-83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60}"
-SUPACLOUD_GH_ARM64_SHA256="\${SUPACLOUD_GH_ARM64_SHA256:-06f86ec7103d41993b76cd78072f43595c34aaa56506d971d9860e67140bf909}"
-
-supacloud_curl_release_json() {
-    local url="$1"
-    local output="$2"
-    curl -fsSL --proto '=https' --proto-redir '=https' \\
-        --retry 1 --retry-delay 2 --retry-max-time 60 \\
-        --connect-timeout 15 --max-time 30 --speed-limit 128 --speed-time 10 \\
-        -o "$output" "$url"
-}
-
-supacloud_curl_release_asset() {
-    local url="$1"
-    local output="$2"
-    curl -fL --proto '=https' --proto-redir '=https' \\
-        --retry 1 --retry-delay 2 --retry-max-time 180 \\
-        --connect-timeout 15 --max-time 90 --speed-limit 128 --speed-time 60 \\
-        -o "$output" "$url"
-}
-
-supacloud_component_tag() {
-    local component="$1"
-    local version="$2"
-    case "$version" in
-        "\${component}-v"*) printf '%s' "$version" ;;
-        v*) printf '%s-%s' "$component" "$version" ;;
-        *) printf '%s-v%s' "$component" "$version" ;;
-    esac
-}
-
-supacloud_select_release() {
-    local component="$1"
-    shift
-    local required_assets_json
-    [[ $# -gt 0 ]] || {
-        echo "at least one required release asset must be specified" >&2
-        return 1
-    }
-    required_assets_json=$(printf '%s\\n' "$@" | jq -Rsc 'split("\\n")[:-1]')
-    jq -ce --arg prefix "\${component}-v" --argjson required "$required_assets_json" '
-        map(select(
-            (.draft | not)
-            and (.prerelease | not)
-            and (.tag_name | startswith($prefix))
-            and (. as $release | all($required[]; . as $asset | any($release.assets[]?; .name == $asset)))
-            and any(.assets[]?; .name == "SHA256SUMS")
-        ))
-        | first
-        // error("no matching component release contains all required assets and SHA256SUMS")
-    '
-}
-
-supacloud_fetch_component_release() {
-    local component="$1"
-    local version="\${2:-latest}"
-    shift 2
-    local required_assets=("$@")
-    local required_assets_json
-    local response
-    [[ \${#required_assets[@]} -gt 0 ]] || {
-        echo "at least one required release asset must be specified" >&2
-        return 1
-    }
-    required_assets_json=$(printf '%s\\n' "\${required_assets[@]}" | jq -Rsc 'split("\\n")[:-1]')
-
-    if [[ -n "$version" && "$version" != "latest" ]]; then
-        local tag
-        tag=$(supacloud_component_tag "$component" "$version")
-        response=$(supacloud_fetch_release_json "\${SUPACLOUD_RELEASES_API}/tags/\${tag}") || return 1
-        jq -ce --argjson required "$required_assets_json" '
-            select(
-                (.draft | not)
-                and (.prerelease | not)
-                and (. as $release | all($required[]; . as $asset | any($release.assets[]?; .name == $asset)))
-                and any(.assets[]?; .name == "SHA256SUMS")
-            )
-            // error("release does not contain all required assets and SHA256SUMS")
-        ' <<< "$response"
-        return
-    fi
-
-    response=$(supacloud_fetch_release_json "\${SUPACLOUD_RELEASES_API}?per_page=100") || return 1
-    supacloud_select_release "$component" "\${required_assets[@]}" <<< "$response"
-}
-
-supacloud_fetch_release_json() (
-    local url="$1"
-    local response_file
-    response_file=$(mktemp) || return 1
-    trap 'rm -f "$response_file"' EXIT
-    trap 'trap - EXIT HUP INT TERM; rm -f "$response_file"; exit 1' HUP INT TERM
-    supacloud_download_release_metadata_url "$url" "$response_file" || return 1
-    cat "$response_file"
-)
-
-supacloud_release_asset_url() {
-    local release_json="$1"
-    local asset_name="$2"
-    jq -er --arg asset "$asset_name" '
-        first(.assets[]? | select(.name == $asset) | .browser_download_url)
-        // error("release asset URL is missing")
-    ' <<< "$release_json"
-}
-
-supacloud_download_url() {
-    local url="$1"
-    local output="$2"
-    local proxy="\${SUPACLOUD_GITHUB_PROXY:-\${GH_PROXY:-}}"
-
-    if supacloud_curl_release_asset "$url" "$output"; then
-        return 0
-    fi
-    if [[ -n "$proxy" ]]; then
-        supacloud_curl_release_asset "\${proxy%/}/\${url}" "$output"
-        return
-    fi
-    return 1
-}
-
-supacloud_download_release_metadata_url() {
-    local url="$1"
-    local output="$2"
-    local proxy="\${SUPACLOUD_GITHUB_PROXY:-\${GH_PROXY:-}}"
-
-    if supacloud_curl_release_json "$url" "$output"; then
-        return 0
-    fi
-    if [[ -n "$proxy" ]]; then
-        supacloud_curl_release_json "\${proxy%/}/\${url}" "$output"
-        return
-    fi
-    return 1
-}
-
-supacloud_verify_checksum() {
-    local artifact_file="$1"
-    local asset_name="$2"
-    local checksum_file="$3"
-    local expected
-    expected=$(awk -v asset="$asset_name" '$2 == asset || $2 == "*" asset { print $1; exit }' "$checksum_file")
-    if [[ ! "$expected" =~ ^[0-9a-fA-F]{64}$ ]]; then
-        echo "SHA256SUMS does not contain a valid checksum for \${asset_name}" >&2
-        return 1
-    fi
-
-    local actual
-    actual=$(sha256sum "$artifact_file" | awk '{print $1}')
-    actual=$(printf '%s' "$actual" | tr '[:upper:]' '[:lower:]')
-    expected=$(printf '%s' "$expected" | tr '[:upper:]' '[:lower:]')
-    if [[ "$actual" != "$expected" ]]; then
-        echo "SHA256 mismatch for \${asset_name}" >&2
-        return 1
-    fi
-}
-
-supacloud_validate_binary() {
-    local artifact_file="$1"
-    local asset_name="$2"
-    local description
-    description=$(file -b "$artifact_file")
-    if [[ "$description" != *ELF* ]]; then
-        echo "\${asset_name} is not an ELF binary: \${description}" >&2
-        return 1
-    fi
-
-    case "$asset_name" in
-        *amd64)
-            [[ "$description" == *x86-64* || "$description" == *x86_64* ]] || {
-                echo "\${asset_name} does not contain an x86-64 ELF binary" >&2
-                return 1
-            }
-            ;;
-        *arm64)
-            [[ "$description" == *aarch64* || "$description" == *ARM64* ]] || {
-                echo "\${asset_name} does not contain an arm64 ELF binary" >&2
-                return 1
-            }
-            ;;
-    esac
-}
-
-supacloud_install_pinned_tar_xz_binary() (
-    local archive="$1"
-    local member="$2"
-    local expected_sha256="$3"
-    local arch="$4"
-    local target="$5"
-    local actual_sha256 member_count member_details extract_dir candidate staged_target
-
-    actual_sha256=$(sha256sum "$archive" | awk '{print $1}')
-    actual_sha256=$(printf '%s' "$actual_sha256" | tr '[:upper:]' '[:lower:]')
-    expected_sha256=$(printf '%s' "$expected_sha256" | tr '[:upper:]' '[:lower:]')
-    if [[ ! "$expected_sha256" =~ ^[0-9a-f]{64}$ || "$actual_sha256" != "$expected_sha256" ]]; then
-        echo "SHA256 mismatch for pinned archive" >&2
-        return 1
-    fi
-
-    member_count=$(tar -tJf "$archive" | grep -Fxc "$member" || true)
-    if [[ "$member_count" != "1" ]]; then
-        echo "Pinned archive must contain the exact member once: $member" >&2
-        return 1
-    fi
-    member_details=$(tar -tvJf "$archive" "$member") || return 1
-    if [[ "\${member_details:0:1}" != "-" ]]; then
-        echo "Pinned archive member is not a regular file: $member" >&2
-        return 1
-    fi
-
-    extract_dir=$(mktemp -d)
-    trap 'rm -rf "$extract_dir"; [[ -z "\${staged_target:-}" ]] || rm -f "$staged_target"' EXIT
-    trap 'trap - EXIT HUP INT TERM; rm -rf "$extract_dir"; [[ -z "\${staged_target:-}" ]] || rm -f "$staged_target"; exit 1' HUP INT TERM
-    if ! tar --no-same-owner --no-same-permissions -xJf "$archive" -C "$extract_dir" "$member"; then
-        return 1
-    fi
-    candidate="\${extract_dir}/\${member}"
-    supacloud_validate_binary "$candidate" "pinned-linux-\${arch}" || return 1
-
-    mkdir -p "$(dirname "$target")"
-    staged_target=$(mktemp "\${target}.tmp.XXXXXX")
-    install -m 0755 "$candidate" "$staged_target"
-    mv -f "$staged_target" "$target"
-    staged_target=""
-)
-
-supacloud_version_at_least() {
-    local current="\${1#v}"
-    local required="\${2#v}"
-    local current_major=0 current_minor=0 current_patch=0
-    local required_major=0 required_minor=0 required_patch=0
-    [[ "$current" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+(-.*)?$ ]] || return 1
-    [[ "$required" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+(-.*)?$ ]] || return 1
-    IFS=. read -r current_major current_minor current_patch <<EOF
-\${current%%-*}
-EOF
-    IFS=. read -r required_major required_minor required_patch <<EOF
-\${required%%-*}
-EOF
-    current_major=\${current_major:-0}; current_minor=\${current_minor:-0}; current_patch=\${current_patch:-0}
-    required_major=\${required_major:-0}; required_minor=\${required_minor:-0}; required_patch=\${required_patch:-0}
-    if (( current_major != required_major )); then (( current_major > required_major )); return; fi
-    if (( current_minor != required_minor )); then (( current_minor > required_minor )); return; fi
-    (( current_patch >= required_patch ))
-}
-
-supacloud_gh_version() {
-    gh --version 2>/dev/null | awk 'NR == 1 && $1 == "gh" && $2 == "version" { print $3; exit }'
-}
-
-supacloud_install_gh_archive() {
-    local archive="$1"
-    local version="$2"
-    local arch="$3"
-    local expected_sha256="$4"
-    local target="$5"
-    local member="gh_\${version}_linux_\${arch}/bin/gh"
-    local actual_sha256 member_count member_details extracted_dir candidate version_output
-
-    actual_sha256=$(sha256sum "$archive" | awk '{print $1}')
-    if [[ "$actual_sha256" != "$expected_sha256" ]]; then
-        echo "GitHub CLI archive SHA256 mismatch" >&2
-        return 1
-    fi
-
-    member_count=$(tar -tzf "$archive" | grep -Fxc "$member" || true)
-    if [[ "$member_count" != "1" ]]; then
-        echo "GitHub CLI archive does not contain the exact expected member: $member" >&2
-        return 1
-    fi
-    member_details=$(tar -tvzf "$archive" "$member") || return 1
-    if [[ "\${member_details:0:1}" != "-" ]]; then
-        echo "GitHub CLI archive member is not a regular file: $member" >&2
-        return 1
-    fi
-
-    extracted_dir=$(mktemp -d)
-    candidate="\${extracted_dir}/\${member}"
-    if ! tar --no-same-owner --no-same-permissions -xzf "$archive" -C "$extracted_dir" "$member" \\
-        || ! supacloud_validate_binary "$candidate" "gh-linux-\${arch}"; then
-        rm -rf "$extracted_dir"
-        return 1
-    fi
-    chmod 0755 "$candidate"
-    version_output=$("$candidate" --version 2>/dev/null | head -1) || {
-        rm -rf "$extracted_dir"
-        echo "GitHub CLI bootstrap binary failed its version check" >&2
-        return 1
-    }
-    if [[ "$version_output" != "gh version \${version}"* ]]; then
-        rm -rf "$extracted_dir"
-        echo "GitHub CLI bootstrap version mismatch: \${version_output}" >&2
-        return 1
-    fi
-    mkdir -p "$(dirname "$target")"
-    install -m 0755 "$candidate" "$target"
-    rm -rf "$extracted_dir"
-}
-
-supacloud_install_pinned_gh() {
-    local target="\${1:-/usr/local/bin/gh}"
-    local machine arch expected_sha256 asset url archive
-    machine=$(uname -m)
-    case "$machine" in
-        x86_64|amd64)
-            arch="amd64"
-            expected_sha256="$SUPACLOUD_GH_AMD64_SHA256"
-            ;;
-        aarch64|arm64)
-            arch="arm64"
-            expected_sha256="$SUPACLOUD_GH_ARM64_SHA256"
-            ;;
-        *)
-            echo "Unsupported architecture for GitHub CLI bootstrap: $machine" >&2
-            return 1
-            ;;
-    esac
-    asset="gh_\${SUPACLOUD_GH_VERSION}_linux_\${arch}.tar.gz"
-    url="https://github.com/cli/cli/releases/download/v\${SUPACLOUD_GH_VERSION}/\${asset}"
-    archive=$(mktemp)
-    if ! supacloud_download_url "$url" "$archive" \\
-        || ! supacloud_install_gh_archive "$archive" "$SUPACLOUD_GH_VERSION" "$arch" "$expected_sha256" "$target"; then
-        rm -f "$archive"
-        return 1
-    fi
-    rm -f "$archive"
-}
-
-supacloud_validate_tar() {
-    local artifact_file="$1"
-    local entries
-    entries=$(tar -tzf "$artifact_file") || {
-        echo "Web Console archive is not a readable gzip tarball" >&2
-        return 1
-    }
-    if ! printf '%s\\n' "$entries" | awk '
-        /^\\// { exit 1 }
-        /(^|\\/)\\.\\.($|\\/)/ { exit 1 }
-    '; then
-        echo "Web Console archive contains an unsafe path" >&2
-        return 1
-    fi
-    if ! tar -tvzf "$artifact_file" | awk 'substr($1, 1, 1) != "-" && substr($1, 1, 1) != "d" { exit 1 }'; then
-        echo "Web Console archive contains links or special files" >&2
-        return 1
-    fi
-    printf '%s\\n' "$entries" | grep -Eq '(^|/)index\\.html$' || {
-        echo "Web Console archive is invalid or does not contain index.html" >&2
-        return 1
-    }
-}
-
-supacloud_record_integrity_mode() {
-    local mode="$1"
-    local record_file="\${SUPACLOUD_INTEGRITY_MODE_RECORD:-/var/lib/supacloud/artifact-integrity-mode}"
-    mkdir -p "$(dirname "$record_file")" 2>/dev/null || return 0
-    printf '%s\\n' "$mode" > "$record_file" 2>/dev/null || return 0
-    chmod 600 "$record_file" 2>/dev/null || true
-}
-
-supacloud_fetch_attestation_bundle() {
-    local artifact_file="$1"
-    local bundle_file="$2"
-    local digest response
-    digest=$(sha256sum "$artifact_file" | awk '{print $1}') || return 1
-    [[ "$digest" =~ ^[0-9a-fA-F]{64}$ ]] || {
-        echo "Unable to calculate the artifact digest for attestation lookup" >&2
-        return 1
-    }
-    digest=$(printf '%s' "$digest" | tr '[:upper:]' '[:lower:]')
-    response=$(supacloud_fetch_release_json \\
-        "https://api.github.com/repos/\${SUPACLOUD_GITHUB_REPOSITORY}/attestations/sha256:\${digest}") || {
-        echo "Unable to download the public GitHub artifact attestation bundle" >&2
-        return 1
-    }
-    if ! jq -ce '
-        .attestations
-        | if type != "array" or length == 0 or any(.[]; (.bundle | type) != "object")
-          then error("no valid attestation bundles returned")
-          else .[].bundle
-          end
-    ' <<< "$response" > "$bundle_file"; then
-        echo "GitHub artifact attestation response did not contain a valid bundle" >&2
-        return 1
-    fi
-}
-
-supacloud_verify_attestation() (
-    local artifact_file="$1"
-    if supacloud_attestation_verifier_available; then
-        local verification_output bundle_dir bundle_file
-        bundle_dir=$(mktemp -d "\${TMPDIR:-/tmp}/supacloud-attestation.XXXXXX") || return 1
-        trap 'rm -rf -- "$bundle_dir"' EXIT
-        trap 'trap - EXIT HUP INT TERM; rm -rf -- "$bundle_dir"; exit 1' HUP INT TERM
-        bundle_file="\${bundle_dir}/bundle.jsonl"
-        if ! supacloud_fetch_attestation_bundle "$artifact_file" "$bundle_file"; then
-            return 1
-        fi
-        if ! verification_output=$(gh attestation verify "$artifact_file" \\
-            --bundle "$bundle_file" \\
-            --repo "$SUPACLOUD_GITHUB_REPOSITORY" \\
-            --signer-workflow "$SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW" \\
-            --source-ref "refs/heads/main" \\
-            --deny-self-hosted-runners 2>&1); then
-            echo "GitHub artifact attestation verification failed: \${verification_output}" >&2
-            return 1
-        fi
-        supacloud_record_integrity_mode "github-attestation+same-release-sha256"
-        return
-    fi
-
-    if [[ "\${SUPACLOUD_ALLOW_UNVERIFIED_RELEASE:-false}" == "true" ]]; then
-        echo "BREAK-GLASS LIMITED INTEGRITY MODE: artifact attestation verification is unavailable; only the same-release SHA256 checksum was verified." >&2
-        supacloud_record_integrity_mode "break-glass:same-release-sha256-only"
-        return 0
-    fi
-
-    echo "Artifact attestation verification is required, but gh attestation verify is unavailable. Install GitHub CLI or explicitly set SUPACLOUD_ALLOW_UNVERIFIED_RELEASE=true for emergency break-glass use." >&2
-    return 1
-)
-
-supacloud_attestation_verifier_available() {
-    local version help
-    command -v gh >/dev/null 2>&1 || return 1
-    version=$(supacloud_gh_version)
-    [[ -n "$version" ]] || return 1
-    supacloud_version_at_least "$version" "$SUPACLOUD_GH_MIN_VERSION" || return 1
-    help=$(gh attestation verify --help 2>&1) || return 1
-    grep -Eq -- '(^|[[:space:]])--bundle([=[:space:]]|$)' <<< "$help" || return 1
-    grep -Eq -- '(^|[[:space:]])--signer-workflow([=[:space:]]|$)' <<< "$help" || return 1
-    grep -Eq -- '(^|[[:space:]])--source-ref([=[:space:]]|$)' <<< "$help" || return 1
-    grep -Eq -- '(^|[[:space:]])--deny-self-hosted-runners([=[:space:]]|$)' <<< "$help"
-}
-
-supacloud_download_release_asset() (
-    local release_json="$1"
-    local asset_name="$2"
-    local destination="$3"
-    local asset_kind="$4"
-    local asset_url checksum_url temporary_artifact temporary_checksums
-
-    asset_url=$(supacloud_release_asset_url "$release_json" "$asset_name") || return 1
-    checksum_url=$(supacloud_release_asset_url "$release_json" SHA256SUMS) || return 1
-    mkdir -p "$(dirname "$destination")"
-    temporary_artifact=$(mktemp "\${destination}.tmp.XXXXXX")
-    temporary_checksums=$(mktemp "\${destination}.SHA256SUMS.tmp.XXXXXX")
-    trap 'rm -f "\${temporary_artifact:-}" "\${temporary_checksums:-}"' EXIT
-    trap 'trap - EXIT HUP INT TERM; rm -f "\${temporary_artifact:-}" "\${temporary_checksums:-}"; exit 1' HUP INT TERM
-
-    if ! supacloud_download_url "$asset_url" "$temporary_artifact" \\
-        || ! supacloud_download_release_metadata_url "$checksum_url" "$temporary_checksums" \\
-        || ! supacloud_verify_checksum "$temporary_artifact" "$asset_name" "$temporary_checksums"; then
-        rm -f "$temporary_artifact" "$temporary_checksums"
-        return 1
-    fi
-
-    # Authenticate the digest before parsing archives or inspecting binaries.
-    if ! supacloud_verify_attestation "$temporary_artifact"; then
-        rm -f "$temporary_artifact" "$temporary_checksums"
-        return 1
-    fi
-
-    case "$asset_kind" in
-        binary) supacloud_validate_binary "$temporary_artifact" "$asset_name" ;;
-        tar) supacloud_validate_tar "$temporary_artifact" ;;
-        *)
-            echo "Unknown release asset kind: $asset_kind" >&2
-            rm -f "$temporary_artifact" "$temporary_checksums"
-            return 1
-            ;;
-    esac || {
-        rm -f "$temporary_artifact" "$temporary_checksums"
-        return 1
-    }
-
-    mv -f "$temporary_artifact" "$destination"
-    temporary_artifact=""
-    rm -f "$temporary_checksums"
-    temporary_checksums=""
-)
-`;
+var release_assets_default = '#!/usr/bin/env bash\n\nSUPACLOUD_GITHUB_REPOSITORY="${SUPACLOUD_GITHUB_REPOSITORY:-zuohuadong/supacloud}"\nSUPACLOUD_RELEASES_API="${SUPACLOUD_RELEASES_API:-https://api.github.com/repos/${SUPACLOUD_GITHUB_REPOSITORY}/releases}"\nSUPACLOUD_ATTESTATION_SIGNER_WORKFLOW="${SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW:-${SUPACLOUD_GITHUB_REPOSITORY}/.github/workflows/release-please.yml}"\nSUPACLOUD_GH_VERSION="${SUPACLOUD_GH_VERSION:-2.96.0}"\nSUPACLOUD_GH_MIN_VERSION="${SUPACLOUD_GH_MIN_VERSION:-2.68.0}"\nSUPACLOUD_GH_AMD64_SHA256="${SUPACLOUD_GH_AMD64_SHA256:-83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60}"\nSUPACLOUD_GH_ARM64_SHA256="${SUPACLOUD_GH_ARM64_SHA256:-06f86ec7103d41993b76cd78072f43595c34aaa56506d971d9860e67140bf909}"\nSUPACLOUD_RELEASE_ASSETS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"\nSUPACLOUD_ATTESTATION_TRUSTED_ROOT_DEFAULT="${SUPACLOUD_RELEASE_ASSETS_DIR}/../../packages/management-api/src/assets/sigstore-public-good-trusted-root.jsonl"\nreadonly SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SHA256="3c2cc7f357dc064ec527fdcd78da6e9245c21a381e1abaa0f2b62b186bcac1a1"\nreadonly SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SIZE="5748"\n\nsupacloud_curl_release_json() {\n    local url="$1"\n    local output="$2"\n    curl -fsSL --proto \'=https\' --proto-redir \'=https\' \\\n        --retry 1 --retry-delay 2 --retry-max-time 60 \\\n        --connect-timeout 15 --max-time 30 --speed-limit 128 --speed-time 10 \\\n        -o "$output" "$url"\n}\n\nsupacloud_curl_release_asset() {\n    local url="$1"\n    local output="$2"\n    curl -fL --proto \'=https\' --proto-redir \'=https\' \\\n        --retry 1 --retry-delay 2 --retry-max-time 180 \\\n        --connect-timeout 15 --max-time 90 --speed-limit 128 --speed-time 60 \\\n        -o "$output" "$url"\n}\n\nsupacloud_component_tag() {\n    local component="$1"\n    local version="$2"\n    case "$version" in\n        "${component}-v"*) printf \'%s\' "$version" ;;\n        v*) printf \'%s-%s\' "$component" "$version" ;;\n        *) printf \'%s-v%s\' "$component" "$version" ;;\n    esac\n}\n\nsupacloud_select_release() {\n    local component="$1"\n    shift\n    local required_assets_json\n    [[ $# -gt 0 ]] || {\n        echo "at least one required release asset must be specified" >&2\n        return 1\n    }\n    required_assets_json=$(printf \'%s\\n\' "$@" | jq -Rsc \'split("\\n")[:-1]\')\n    jq -ce --arg prefix "${component}-v" --argjson required "$required_assets_json" \'\n        map(select(\n            (.draft | not)\n            and (.prerelease | not)\n            and (.tag_name | startswith($prefix))\n            and (. as $release | all($required[]; . as $asset | any($release.assets[]?; .name == $asset)))\n            and any(.assets[]?; .name == "SHA256SUMS")\n        ))\n        | first\n        // error("no matching component release contains all required assets and SHA256SUMS")\n    \'\n}\n\nsupacloud_fetch_component_release() {\n    local component="$1"\n    local version="${2:-latest}"\n    shift 2\n    local required_assets=("$@")\n    local required_assets_json\n    local response\n    [[ ${#required_assets[@]} -gt 0 ]] || {\n        echo "at least one required release asset must be specified" >&2\n        return 1\n    }\n    required_assets_json=$(printf \'%s\\n\' "${required_assets[@]}" | jq -Rsc \'split("\\n")[:-1]\')\n\n    if [[ -n "$version" && "$version" != "latest" ]]; then\n        local tag\n        tag=$(supacloud_component_tag "$component" "$version")\n        response=$(supacloud_fetch_release_json "${SUPACLOUD_RELEASES_API}/tags/${tag}") || return 1\n        jq -ce --argjson required "$required_assets_json" \'\n            select(\n                (.draft | not)\n                and (.prerelease | not)\n                and (. as $release | all($required[]; . as $asset | any($release.assets[]?; .name == $asset)))\n                and any(.assets[]?; .name == "SHA256SUMS")\n            )\n            // error("release does not contain all required assets and SHA256SUMS")\n        \' <<< "$response"\n        return\n    fi\n\n    response=$(supacloud_fetch_release_json "${SUPACLOUD_RELEASES_API}?per_page=100") || return 1\n    supacloud_select_release "$component" "${required_assets[@]}" <<< "$response"\n}\n\nsupacloud_fetch_release_json() (\n    local url="$1"\n    local response_file\n    response_file=$(mktemp) || return 1\n    trap \'rm -f "$response_file"\' EXIT\n    trap \'trap - EXIT HUP INT TERM; rm -f "$response_file"; exit 1\' HUP INT TERM\n    supacloud_download_release_metadata_url "$url" "$response_file" || return 1\n    cat "$response_file"\n)\n\nsupacloud_release_asset_url() {\n    local release_json="$1"\n    local asset_name="$2"\n    jq -er --arg asset "$asset_name" \'\n        first(.assets[]? | select(.name == $asset) | .browser_download_url)\n        // error("release asset URL is missing")\n    \' <<< "$release_json"\n}\n\nsupacloud_download_url() {\n    local url="$1"\n    local output="$2"\n    local proxy="${SUPACLOUD_GITHUB_PROXY:-${GH_PROXY:-}}"\n\n    if supacloud_curl_release_asset "$url" "$output"; then\n        return 0\n    fi\n    if [[ -n "$proxy" ]]; then\n        supacloud_curl_release_asset "${proxy%/}/${url}" "$output"\n        return\n    fi\n    return 1\n}\n\nsupacloud_download_release_metadata_url() {\n    local url="$1"\n    local output="$2"\n    local proxy="${SUPACLOUD_GITHUB_PROXY:-${GH_PROXY:-}}"\n\n    if supacloud_curl_release_json "$url" "$output"; then\n        return 0\n    fi\n    if [[ -n "$proxy" ]]; then\n        supacloud_curl_release_json "${proxy%/}/${url}" "$output"\n        return\n    fi\n    return 1\n}\n\nsupacloud_verify_checksum() {\n    local artifact_file="$1"\n    local asset_name="$2"\n    local checksum_file="$3"\n    local expected\n    expected=$(awk -v asset="$asset_name" \'$2 == asset || $2 == "*" asset { print $1; exit }\' "$checksum_file")\n    if [[ ! "$expected" =~ ^[0-9a-fA-F]{64}$ ]]; then\n        echo "SHA256SUMS does not contain a valid checksum for ${asset_name}" >&2\n        return 1\n    fi\n\n    local actual\n    actual=$(sha256sum "$artifact_file" | awk \'{print $1}\')\n    actual=$(printf \'%s\' "$actual" | tr \'[:upper:]\' \'[:lower:]\')\n    expected=$(printf \'%s\' "$expected" | tr \'[:upper:]\' \'[:lower:]\')\n    if [[ "$actual" != "$expected" ]]; then\n        echo "SHA256 mismatch for ${asset_name}" >&2\n        return 1\n    fi\n}\n\nsupacloud_validate_binary() {\n    local artifact_file="$1"\n    local asset_name="$2"\n    local description\n    description=$(file -b "$artifact_file")\n    if [[ "$description" != *ELF* ]]; then\n        echo "${asset_name} is not an ELF binary: ${description}" >&2\n        return 1\n    fi\n\n    case "$asset_name" in\n        *amd64)\n            [[ "$description" == *x86-64* || "$description" == *x86_64* ]] || {\n                echo "${asset_name} does not contain an x86-64 ELF binary" >&2\n                return 1\n            }\n            ;;\n        *arm64)\n            [[ "$description" == *aarch64* || "$description" == *ARM64* ]] || {\n                echo "${asset_name} does not contain an arm64 ELF binary" >&2\n                return 1\n            }\n            ;;\n    esac\n}\n\nsupacloud_install_pinned_tar_xz_binary() (\n    local archive="$1"\n    local member="$2"\n    local expected_sha256="$3"\n    local arch="$4"\n    local target="$5"\n    local actual_sha256 member_count member_details extract_dir candidate staged_target\n\n    actual_sha256=$(sha256sum "$archive" | awk \'{print $1}\')\n    actual_sha256=$(printf \'%s\' "$actual_sha256" | tr \'[:upper:]\' \'[:lower:]\')\n    expected_sha256=$(printf \'%s\' "$expected_sha256" | tr \'[:upper:]\' \'[:lower:]\')\n    if [[ ! "$expected_sha256" =~ ^[0-9a-f]{64}$ || "$actual_sha256" != "$expected_sha256" ]]; then\n        echo "SHA256 mismatch for pinned archive" >&2\n        return 1\n    fi\n\n    member_count=$(tar -tJf "$archive" | grep -Fxc "$member" || true)\n    if [[ "$member_count" != "1" ]]; then\n        echo "Pinned archive must contain the exact member once: $member" >&2\n        return 1\n    fi\n    member_details=$(tar -tvJf "$archive" "$member") || return 1\n    if [[ "${member_details:0:1}" != "-" ]]; then\n        echo "Pinned archive member is not a regular file: $member" >&2\n        return 1\n    fi\n\n    extract_dir=$(mktemp -d)\n    trap \'rm -rf "$extract_dir"; [[ -z "${staged_target:-}" ]] || rm -f "$staged_target"\' EXIT\n    trap \'trap - EXIT HUP INT TERM; rm -rf "$extract_dir"; [[ -z "${staged_target:-}" ]] || rm -f "$staged_target"; exit 1\' HUP INT TERM\n    if ! tar --no-same-owner --no-same-permissions -xJf "$archive" -C "$extract_dir" "$member"; then\n        return 1\n    fi\n    candidate="${extract_dir}/${member}"\n    supacloud_validate_binary "$candidate" "pinned-linux-${arch}" || return 1\n\n    mkdir -p "$(dirname "$target")"\n    staged_target=$(mktemp "${target}.tmp.XXXXXX")\n    install -m 0755 "$candidate" "$staged_target"\n    mv -f "$staged_target" "$target"\n    staged_target=""\n)\n\nsupacloud_version_at_least() {\n    local current="${1#v}"\n    local required="${2#v}"\n    local current_major=0 current_minor=0 current_patch=0\n    local required_major=0 required_minor=0 required_patch=0\n    [[ "$current" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+(-.*)?$ ]] || return 1\n    [[ "$required" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+(-.*)?$ ]] || return 1\n    IFS=. read -r current_major current_minor current_patch <<EOF\n${current%%-*}\nEOF\n    IFS=. read -r required_major required_minor required_patch <<EOF\n${required%%-*}\nEOF\n    current_major=${current_major:-0}; current_minor=${current_minor:-0}; current_patch=${current_patch:-0}\n    required_major=${required_major:-0}; required_minor=${required_minor:-0}; required_patch=${required_patch:-0}\n    if (( current_major != required_major )); then (( current_major > required_major )); return; fi\n    if (( current_minor != required_minor )); then (( current_minor > required_minor )); return; fi\n    (( current_patch >= required_patch ))\n}\n\nsupacloud_gh_version() {\n    gh --version 2>/dev/null | awk \'NR == 1 && $1 == "gh" && $2 == "version" { print $3; exit }\'\n}\n\nsupacloud_install_gh_archive() {\n    local archive="$1"\n    local version="$2"\n    local arch="$3"\n    local expected_sha256="$4"\n    local target="$5"\n    local member="gh_${version}_linux_${arch}/bin/gh"\n    local actual_sha256 member_count member_details extracted_dir candidate version_output\n\n    actual_sha256=$(sha256sum "$archive" | awk \'{print $1}\')\n    if [[ "$actual_sha256" != "$expected_sha256" ]]; then\n        echo "GitHub CLI archive SHA256 mismatch" >&2\n        return 1\n    fi\n\n    member_count=$(tar -tzf "$archive" | grep -Fxc "$member" || true)\n    if [[ "$member_count" != "1" ]]; then\n        echo "GitHub CLI archive does not contain the exact expected member: $member" >&2\n        return 1\n    fi\n    member_details=$(tar -tvzf "$archive" "$member") || return 1\n    if [[ "${member_details:0:1}" != "-" ]]; then\n        echo "GitHub CLI archive member is not a regular file: $member" >&2\n        return 1\n    fi\n\n    extracted_dir=$(mktemp -d)\n    candidate="${extracted_dir}/${member}"\n    if ! tar --no-same-owner --no-same-permissions -xzf "$archive" -C "$extracted_dir" "$member" \\\n        || ! supacloud_validate_binary "$candidate" "gh-linux-${arch}"; then\n        rm -rf "$extracted_dir"\n        return 1\n    fi\n    chmod 0755 "$candidate"\n    version_output=$("$candidate" --version 2>/dev/null | head -1) || {\n        rm -rf "$extracted_dir"\n        echo "GitHub CLI bootstrap binary failed its version check" >&2\n        return 1\n    }\n    if [[ "$version_output" != "gh version ${version}"* ]]; then\n        rm -rf "$extracted_dir"\n        echo "GitHub CLI bootstrap version mismatch: ${version_output}" >&2\n        return 1\n    fi\n    mkdir -p "$(dirname "$target")"\n    install -m 0755 "$candidate" "$target"\n    rm -rf "$extracted_dir"\n}\n\nsupacloud_install_pinned_gh() {\n    local target="${1:-/usr/local/bin/gh}"\n    local machine arch expected_sha256 asset url archive\n    machine=$(uname -m)\n    case "$machine" in\n        x86_64|amd64)\n            arch="amd64"\n            expected_sha256="$SUPACLOUD_GH_AMD64_SHA256"\n            ;;\n        aarch64|arm64)\n            arch="arm64"\n            expected_sha256="$SUPACLOUD_GH_ARM64_SHA256"\n            ;;\n        *)\n            echo "Unsupported architecture for GitHub CLI bootstrap: $machine" >&2\n            return 1\n            ;;\n    esac\n    asset="gh_${SUPACLOUD_GH_VERSION}_linux_${arch}.tar.gz"\n    url="https://github.com/cli/cli/releases/download/v${SUPACLOUD_GH_VERSION}/${asset}"\n    archive=$(mktemp)\n    if ! supacloud_download_url "$url" "$archive" \\\n        || ! supacloud_install_gh_archive "$archive" "$SUPACLOUD_GH_VERSION" "$arch" "$expected_sha256" "$target"; then\n        rm -f "$archive"\n        return 1\n    fi\n    rm -f "$archive"\n}\n\nsupacloud_validate_tar() {\n    local artifact_file="$1"\n    local entries\n    entries=$(tar -tzf "$artifact_file") || {\n        echo "Web Console archive is not a readable gzip tarball" >&2\n        return 1\n    }\n    if ! printf \'%s\\n\' "$entries" | awk \'\n        /^\\// { exit 1 }\n        /(^|\\/)\\.\\.($|\\/)/ { exit 1 }\n    \'; then\n        echo "Web Console archive contains an unsafe path" >&2\n        return 1\n    fi\n    if ! tar -tvzf "$artifact_file" | awk \'substr($1, 1, 1) != "-" && substr($1, 1, 1) != "d" { exit 1 }\'; then\n        echo "Web Console archive contains links or special files" >&2\n        return 1\n    fi\n    printf \'%s\\n\' "$entries" | grep -Eq \'(^|/)index\\.html$\' || {\n        echo "Web Console archive is invalid or does not contain index.html" >&2\n        return 1\n    }\n}\n\nsupacloud_record_integrity_mode() {\n    local mode="$1"\n    local record_file="${SUPACLOUD_INTEGRITY_MODE_RECORD:-/var/lib/supacloud/artifact-integrity-mode}"\n    mkdir -p "$(dirname "$record_file")" 2>/dev/null || return 0\n    printf \'%s\\n\' "$mode" > "$record_file" 2>/dev/null || return 0\n    chmod 600 "$record_file" 2>/dev/null || true\n}\n\nsupacloud_fetch_attestation_bundle() {\n    local artifact_file="$1"\n    local bundle_file="$2"\n    local digest response\n    digest=$(sha256sum "$artifact_file" | awk \'{print $1}\') || return 1\n    [[ "$digest" =~ ^[0-9a-fA-F]{64}$ ]] || {\n        echo "Unable to calculate the artifact digest for attestation lookup" >&2\n        return 1\n    }\n    digest=$(printf \'%s\' "$digest" | tr \'[:upper:]\' \'[:lower:]\')\n    response=$(supacloud_fetch_release_json \\\n        "https://api.github.com/repos/${SUPACLOUD_GITHUB_REPOSITORY}/attestations/sha256:${digest}") || {\n        echo "Unable to download the public GitHub artifact attestation bundle" >&2\n        return 1\n    }\n    if ! jq -ce \'\n        .attestations\n        | if type != "array" or length == 0 or any(.[]; (.bundle | type) != "object")\n          then error("no valid attestation bundles returned")\n          else .[].bundle\n          end\n    \' <<< "$response" > "$bundle_file"; then\n        echo "GitHub artifact attestation response did not contain a valid bundle" >&2\n        return 1\n    fi\n}\n\nsupacloud_attestation_trusted_root_available() {\n    local trusted_root="${SUPACLOUD_ATTESTATION_TRUSTED_ROOT:-$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_DEFAULT}"\n    local actual_size actual_sha256\n    [[ "$trusted_root" == /* && -f "$trusted_root" && ! -L "$trusted_root" ]] || return 1\n    actual_size=$(wc -c < "$trusted_root" | tr -d \'[:space:]\') || return 1\n    [[ "$actual_size" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SIZE" ]] || return 1\n    actual_sha256=$(sha256sum "$trusted_root" | awk \'{print $1}\') || return 1\n    [[ "$actual_sha256" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SHA256" ]] || return 1\n    [[ "$(wc -l < "$trusted_root" | tr -d \'[:space:]\')" == "1" ]] || return 1\n    jq -e \'type == "object" and .mediaType == "application/vnd.dev.sigstore.trustedroot+json;version=0.1"\' \\\n        "$trusted_root" >/dev/null 2>&1\n}\n\nsupacloud_prepare_attestation_trusted_root() {\n    local destination="$1"\n    local trusted_root="${SUPACLOUD_ATTESTATION_TRUSTED_ROOT:-$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_DEFAULT}"\n    supacloud_attestation_trusted_root_available || {\n        echo "Pinned Sigstore Public Good trusted root is missing or invalid" >&2\n        return 1\n    }\n    jq -ce . "$trusted_root" > "$destination" || return 1\n    chmod 600 "$destination"\n    [[ "$(wc -c < "$destination" | tr -d \'[:space:]\')" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SIZE" ]] || return 1\n    [[ "$(sha256sum "$destination" | awk \'{print $1}\')" == "$SUPACLOUD_ATTESTATION_TRUSTED_ROOT_SHA256" ]]\n}\n\nsupacloud_verify_attestation() (\n    local artifact_file="$1"\n    if supacloud_attestation_verifier_available; then\n        local verification_output bundle_dir bundle_file trusted_root_file\n        bundle_dir=$(mktemp -d "${TMPDIR:-/tmp}/supacloud-attestation.XXXXXX") || return 1\n        trap \'rm -rf -- "$bundle_dir"\' EXIT\n        trap \'trap - EXIT HUP INT TERM; rm -rf -- "$bundle_dir"; exit 1\' HUP INT TERM\n        bundle_file="${bundle_dir}/bundle.jsonl"\n        trusted_root_file="${bundle_dir}/trusted_root.jsonl"\n        if ! supacloud_fetch_attestation_bundle "$artifact_file" "$bundle_file"; then\n            return 1\n        fi\n        supacloud_prepare_attestation_trusted_root "$trusted_root_file" || return 1\n        if ! verification_output=$(gh attestation verify "$artifact_file" \\\n            --bundle "$bundle_file" \\\n            --custom-trusted-root "$trusted_root_file" \\\n            --repo "$SUPACLOUD_GITHUB_REPOSITORY" \\\n            --signer-workflow "$SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW" \\\n            --source-ref "refs/heads/main" \\\n            --deny-self-hosted-runners 2>&1); then\n            echo "GitHub artifact attestation verification failed: ${verification_output}" >&2\n            return 1\n        fi\n        supacloud_record_integrity_mode "github-attestation+same-release-sha256"\n        return\n    fi\n\n    if [[ "${SUPACLOUD_ALLOW_UNVERIFIED_RELEASE:-false}" == "true" ]]; then\n        echo "BREAK-GLASS LIMITED INTEGRITY MODE: artifact attestation verification is unavailable; only the same-release SHA256 checksum was verified." >&2\n        supacloud_record_integrity_mode "break-glass:same-release-sha256-only"\n        return 0\n    fi\n\n    echo "Artifact attestation verification is required, but gh attestation verify is unavailable. Install GitHub CLI or explicitly set SUPACLOUD_ALLOW_UNVERIFIED_RELEASE=true for emergency break-glass use." >&2\n    return 1\n)\n\nsupacloud_attestation_verifier_available() {\n    local version help\n    supacloud_attestation_trusted_root_available || return 1\n    command -v gh >/dev/null 2>&1 || return 1\n    version=$(supacloud_gh_version)\n    [[ -n "$version" ]] || return 1\n    supacloud_version_at_least "$version" "$SUPACLOUD_GH_MIN_VERSION" || return 1\n    help=$(gh attestation verify --help 2>&1) || return 1\n    grep -Eq -- \'(^|[[:space:]])--bundle([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--signer-workflow([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--source-ref([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--custom-trusted-root([=[:space:]]|$)\' <<< "$help" || return 1\n    grep -Eq -- \'(^|[[:space:]])--deny-self-hosted-runners([=[:space:]]|$)\' <<< "$help"\n}\n\nsupacloud_download_release_asset() (\n    local release_json="$1"\n    local asset_name="$2"\n    local destination="$3"\n    local asset_kind="$4"\n    local asset_url checksum_url temporary_artifact temporary_checksums\n\n    asset_url=$(supacloud_release_asset_url "$release_json" "$asset_name") || return 1\n    checksum_url=$(supacloud_release_asset_url "$release_json" SHA256SUMS) || return 1\n    mkdir -p "$(dirname "$destination")"\n    temporary_artifact=$(mktemp "${destination}.tmp.XXXXXX")\n    temporary_checksums=$(mktemp "${destination}.SHA256SUMS.tmp.XXXXXX")\n    trap \'rm -f "${temporary_artifact:-}" "${temporary_checksums:-}"\' EXIT\n    trap \'trap - EXIT HUP INT TERM; rm -f "${temporary_artifact:-}" "${temporary_checksums:-}"; exit 1\' HUP INT TERM\n\n    if ! supacloud_download_url "$asset_url" "$temporary_artifact" \\\n        || ! supacloud_download_release_metadata_url "$checksum_url" "$temporary_checksums" \\\n        || ! supacloud_verify_checksum "$temporary_artifact" "$asset_name" "$temporary_checksums"; then\n        rm -f "$temporary_artifact" "$temporary_checksums"\n        return 1\n    fi\n\n    # Authenticate the digest before parsing archives or inspecting binaries.\n    if ! supacloud_verify_attestation "$temporary_artifact"; then\n        rm -f "$temporary_artifact" "$temporary_checksums"\n        return 1\n    fi\n\n    case "$asset_kind" in\n        binary) supacloud_validate_binary "$temporary_artifact" "$asset_name" ;;\n        tar) supacloud_validate_tar "$temporary_artifact" ;;\n        *)\n            echo "Unknown release asset kind: $asset_kind" >&2\n            rm -f "$temporary_artifact" "$temporary_checksums"\n            return 1\n            ;;\n    esac || {\n        rm -f "$temporary_artifact" "$temporary_checksums"\n        return 1\n    }\n\n    mv -f "$temporary_artifact" "$destination"\n    temporary_artifact=""\n    rm -f "$temporary_checksums"\n    temporary_checksums=""\n)\n';
 
 // src/shared/tools/ssh-tools.ts
 var SAFE_CONTAINER_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/;
@@ -27606,6 +27282,92 @@ var SAFE_DB_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_-]{0,62}$/;
 var MINIMUM_COMPONENT_UPGRADE_VERSION = "0.50.27";
 var DIRECT_UPGRADE_SSH_TIMEOUT_MS = 720000;
 var PROXIED_UPGRADE_SSH_TIMEOUT_MS = 1320000;
+var PLATFORM_PROBE_TIMEOUT_MS = 1e4;
+var PLATFORM_HASH_TIMEOUT_MS = 30000;
+var WEB_CONSOLE_PROBE_TIMEOUT_MS = 60000;
+var BINARY_VERSION_MAX_BYTES = 2048;
+var WEB_CONSOLE_MARKER_MAX_BYTES = 4096;
+var WEB_CONSOLE_CURRENT_DIR = "/opt/supacloud/web-console/current";
+var STABLE_SEMVER_CORE = "(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)";
+var EXACT_STABLE_SEMVER = new RegExp(`^(?:${STABLE_SEMVER_CORE})(?![\\s\\S])`);
+var SEMVER_CORE_TOKEN = /\d+\.\d+\.\d+/;
+var VERSION_TOKEN_SEPARATOR = /[\s"'()\[\]{}:,;=]+/;
+var BINARY_HASH_BEFORE_FAILED = 70;
+var BINARY_VERSION_FAILED = 71;
+var BINARY_HASH_AFTER_FAILED = 72;
+var PROBE_CHANGED_DURING_READ = 75;
+var WEB_CONSOLE_ROOT_MISSING = 43;
+var WEB_CONSOLE_MARKER_MISSING = 44;
+var WEB_CONSOLE_ROOT_INVALID = 64;
+var WEB_CONSOLE_MARKER_INVALID = 65;
+var WEB_CONSOLE_TREE_INVALID = 66;
+var WEB_CONSOLE_TREE_FAILED = 67;
+var BINARY_HASH_BEFORE_LABEL = "SUPACLOUD_BINARY_HASH_BEFORE=";
+var BINARY_VERSION_LABEL = "SUPACLOUD_BINARY_VERSION_BASE64=";
+var BINARY_HASH_AFTER_LABEL = "SUPACLOUD_BINARY_HASH_AFTER=";
+var WEB_ROOT_REAL_BEFORE_LABEL = "SUPACLOUD_WEB_ROOT_REAL_BEFORE=";
+var WEB_ROOT_ID_BEFORE_LABEL = "SUPACLOUD_WEB_ROOT_ID_BEFORE=";
+var WEB_MARKER_BEFORE_LABEL = "SUPACLOUD_WEB_MARKER_BASE64_BEFORE=";
+var WEB_TREE_BEFORE_LABEL = "SUPACLOUD_WEB_TREE_SHA256_BEFORE=";
+var WEB_TREE_AFTER_LABEL = "SUPACLOUD_WEB_TREE_SHA256_AFTER=";
+var WEB_MARKER_AFTER_LABEL = "SUPACLOUD_WEB_MARKER_BASE64_AFTER=";
+var WEB_ROOT_REAL_AFTER_LABEL = "SUPACLOUD_WEB_ROOT_REAL_AFTER=";
+var WEB_ROOT_ID_AFTER_LABEL = "SUPACLOUD_WEB_ROOT_ID_AFTER=";
+function fixedBinaryProbeCommand(executablePath, versionArgument) {
+  const executable = quoteEnvValue(executablePath);
+  return [
+    "set -o pipefail",
+    `if exec {BINARY_FD}<${executable}; then :; else exit ${BINARY_HASH_BEFORE_FAILED}; fi`,
+    "PINNED_EXECUTABLE=/proc/$$/fd/$BINARY_FD",
+    `if PINNED_ID=$(stat -Lc '%d:%i' -- "$PINNED_EXECUTABLE"); then :; else exit ${BINARY_HASH_BEFORE_FAILED}; fi`,
+    `if HASH_BEFORE=$(sha256sum -- "$PINNED_EXECUTABLE" | awk '{print $1}'); then :; else exit ${BINARY_HASH_BEFORE_FAILED}; fi`,
+    `printf '${BINARY_HASH_BEFORE_LABEL}%s\\n' "$HASH_BEFORE"`,
+    `if VERSION_BASE64=$( (exec -a ${executable} "$PINNED_EXECUTABLE" ${versionArgument} {BINARY_FD}<&-) 2>&1 | head -c ${BINARY_VERSION_MAX_BYTES + 1} | base64 | tr -d '\\n'); then :; else exit ${BINARY_VERSION_FAILED}; fi`,
+    `printf '${BINARY_VERSION_LABEL}%s\\n' "$VERSION_BASE64"`,
+    `if HASH_AFTER=$(sha256sum -- "$PINNED_EXECUTABLE" | awk '{print $1}'); then :; else exit ${BINARY_HASH_AFTER_FAILED}; fi`,
+    `printf '${BINARY_HASH_AFTER_LABEL}%s\\n' "$HASH_AFTER"`,
+    `[ "$HASH_BEFORE" = "$HASH_AFTER" ] || exit ${PROBE_CHANGED_DURING_READ}`,
+    `if CURRENT_ID=$(stat -Lc '%d:%i' -- ${executable}); then :; else exit ${PROBE_CHANGED_DURING_READ}; fi`,
+    `[ "$PINNED_ID" = "$CURRENT_ID" ] || exit ${PROBE_CHANGED_DURING_READ}`,
+    "exec {BINARY_FD}<&-"
+  ].join(`
+`);
+}
+var BINARY_PROBES = {
+  management_api: {
+    unit: "supacloud.service",
+    source: "systemd:supacloud.service:ExecStart",
+    commands: {
+      "/usr/local/bin/supacloud": {
+        command: fixedBinaryProbeCommand("/usr/local/bin/supacloud", "--version")
+      },
+      "/opt/supacloud/bin/supacloud": {
+        command: fixedBinaryProbeCommand("/opt/supacloud/bin/supacloud", "--version")
+      }
+    }
+  },
+  edge_runtime: {
+    unit: "supacloud-edge-runtime.service",
+    source: "systemd:supacloud-edge-runtime.service:ExecStart",
+    commands: {
+      "/usr/local/bin/supacloud-edge-runtime": {
+        command: fixedBinaryProbeCommand("/usr/local/bin/supacloud-edge-runtime", "--version")
+      },
+      "/opt/supacloud/bin/supacloud-edge-runtime": {
+        command: fixedBinaryProbeCommand("/opt/supacloud/bin/supacloud-edge-runtime", "--version")
+      }
+    }
+  },
+  caddy: {
+    unit: "supacloud-caddy.service",
+    source: "systemd:supacloud-caddy.service:ExecStart",
+    commands: {
+      "/usr/local/bin/supacloud-caddy": {
+        command: fixedBinaryProbeCommand("/usr/local/bin/supacloud-caddy", "version")
+      }
+    }
+  }
+};
 function hostnameSchema(fieldName) {
   return decodedSchema(Type.String(), Type.String({ minLength: 1, maxLength: 253 }), (value) => {
     const normalized = value.trim();
@@ -27663,7 +27425,8 @@ function assertSafeReleaseTag(value) {
   return value;
 }
 function assertExactStableVersion2(value, fieldName) {
-  if (!/^v?\d+\.\d+\.\d+$/.test(value)) {
+  const normalized = value.startsWith("v") ? value.slice(1) : value;
+  if (!EXACT_STABLE_SEMVER.test(normalized)) {
     throw new Error(`${fieldName} must be an exact stable semantic version`);
   }
   return value;
@@ -27707,6 +27470,27 @@ function signalSafeCleanupTraps(cleanupCommand) {
     `trap ${quoteEnvValue(`trap - EXIT HUP INT TERM; ${cleanupCommand}; exit 1`)} HUP INT TERM`
   ];
 }
+function trustedRootPreflightCommands(helperPath) {
+  const helperDirectory = dirname(helperPath);
+  const trustedRootPath = join2(helperDirectory, SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_FILENAME);
+  return [
+    `HELPER_DIRECTORY=${quoteEnvValue(helperDirectory)}`,
+    `TRUSTED_ROOT=${quoteEnvValue(trustedRootPath)}`,
+    `test -d "$HELPER_DIRECTORY" && test ! -L "$HELPER_DIRECTORY" || { echo 'Upgrade helper directory is not secure' >&2; exit 1; }`,
+    `test "$(stat -c '%a' "$HELPER_DIRECTORY")" = 700 || { echo 'Upgrade helper directory must use mode 0700' >&2; exit 1; }`,
+    `EXPECTED_HELPER_ENTRIES=$(printf '%s\\n' ${quoteEnvValue(basename3(helperPath))} ${quoteEnvValue(SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_FILENAME)} | LC_ALL=C sort)`,
+    `ACTUAL_HELPER_ENTRIES=$(find "$HELPER_DIRECTORY" -mindepth 1 -maxdepth 1 -printf '%f\\n' | LC_ALL=C sort)`,
+    `test "$ACTUAL_HELPER_ENTRIES" = "$EXPECTED_HELPER_ENTRIES" || { echo 'Upgrade helper directory does not match its strict file allowlist' >&2; exit 1; }`,
+    `test -f "$TRUSTED_ROOT" && test ! -L "$TRUSTED_ROOT" && test "$(stat -c '%h' "$TRUSTED_ROOT")" = 1 || { echo 'Pinned trusted root must be a direct regular file without links' >&2; exit 1; }`,
+    `test "$(stat -c '%a' "$TRUSTED_ROOT")" = 600 || { echo 'Pinned trusted root must use mode 0600' >&2; exit 1; }`,
+    `test "$(stat -c '%s' "$TRUSTED_ROOT")" = ${SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SIZE} || { echo 'Pinned trusted root size mismatch' >&2; exit 1; }`,
+    `test "$(sha256sum "$TRUSTED_ROOT" | awk '{print $1}')" = ${quoteEnvValue(SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SHA256)} || { echo 'Pinned trusted root digest mismatch' >&2; exit 1; }`,
+    'chown -h root:root "$TRUSTED_ROOT"',
+    `test "$(stat -c '%u:%g:%a:%h' "$TRUSTED_ROOT")" = 0:0:600:1 || { echo 'Pinned trusted root ownership or mode changed during adoption' >&2; exit 1; }`,
+    `test "$(stat -c '%s' "$TRUSTED_ROOT")" = ${SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SIZE} && test "$(sha256sum "$TRUSTED_ROOT" | awk '{print $1}')" = ${quoteEnvValue(SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_SHA256)} || { echo 'Pinned trusted root changed during adoption' >&2; exit 1; }`,
+    'export SUPACLOUD_ATTESTATION_TRUSTED_ROOT="$TRUSTED_ROOT"'
+  ];
+}
 function buildRootUpgradeScript(request) {
   const envAssignments = upgradeEnvAssignments(request);
   return [
@@ -27714,16 +27498,18 @@ function buildRootUpgradeScript(request) {
     "umask 077",
     "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
     "export PATH",
-    "unset SUPACLOUD_ALLOW_UNVERIFIED_RELEASE SUPACLOUD_GITHUB_REPOSITORY SUPACLOUD_RELEASES_API SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW SUPACLOUD_GH_VERSION SUPACLOUD_GH_MIN_VERSION SUPACLOUD_GH_AMD64_SHA256 SUPACLOUD_GH_ARM64_SHA256 GH_PROXY",
+    "unset SUPACLOUD_ALLOW_UNVERIFIED_RELEASE SUPACLOUD_GITHUB_REPOSITORY SUPACLOUD_RELEASES_API SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW SUPACLOUD_ATTESTATION_TRUSTED_ROOT SUPACLOUD_GH_VERSION SUPACLOUD_GH_MIN_VERSION SUPACLOUD_GH_AMD64_SHA256 SUPACLOUD_GH_ARM64_SHA256 GH_PROXY",
     request.githubProxy ? `export SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(request.githubProxy)}` : "unset SUPACLOUD_GITHUB_PROXY SUPACLOUD_GITHUB_PROXIES",
-    'for tool in curl jq file sha256sum stat tar flock; do command -v "$tool" >/dev/null 2>&1 || { echo "Required upgrade tool is missing: $tool" >&2; exit 127; }; done',
+    'for tool in curl jq file sha256sum stat tar flock find sort chown; do command -v "$tool" >/dev/null 2>&1 || { echo "Required upgrade tool is missing: $tool" >&2; exit 127; }; done',
     "test -d /run/lock || { echo '/run/lock is unavailable' >&2; exit 1; }",
     "test -x /usr/local/bin/supacloud || { echo 'SupaCloud binary not found at /usr/local/bin/supacloud; run ssh install first.' >&2; exit 127; }",
+    ...trustedRootPreflightCommands(request.helperPath),
     buildUpgradeLockScript(SUPACLOUD_UPGRADE_LOCK_PATH),
     ...componentPreflightCommands(request),
     "STAGED_MANAGEMENT=''",
     ...signalSafeCleanupTraps('test -z "$STAGED_MANAGEMENT" || rm -f "$STAGED_MANAGEMENT"'),
     `source ${quoteEnvValue(request.helperPath)}`,
+    "supacloud_attestation_trusted_root_available || { echo 'Pinned Sigstore trusted root failed helper validation' >&2; exit 1; }",
     "if ! supacloud_attestation_verifier_available; then supacloud_install_pinned_gh /usr/local/bin/gh; fi",
     "supacloud_attestation_verifier_available || { echo 'Pinned GitHub attestation verifier is unavailable' >&2; exit 1; }",
     ...componentBootstrapCommands(request),
@@ -27745,8 +27531,7 @@ async function prepareRemoteUpgradeHelperDirectory(ssh, helperPath) {
   const command = [
     "set -e",
     "umask 077",
-    `test ! -e ${quoteEnvValue(helperDirectory)}`,
-    `install -d -m 700 -- ${quoteEnvValue(helperDirectory)}`
+    `mkdir -m 700 -- ${quoteEnvValue(helperDirectory)}`
   ].join("; ");
   const preparation = await ssh.exec(command, 30000);
   if (!preparation.success) {
@@ -27773,44 +27558,56 @@ function remoteUpgradeFailure(execution) {
   const diagnostic = execution.stderr.trim() || execution.stdout.trim() || "no remote diagnostic";
   return new Error(`Remote upgrade failed (exit ${execution.code}): ${diagnostic.slice(-500)}`);
 }
-function officialUpgradeOutcome(execution, executionError, cleanupError) {
-  if (executionError && cleanupError) {
-    throw new AggregateError([executionError, cleanupError], "Upgrade execution failed and helper cleanup did not complete");
+function officialUpgradeOutcome(outcome) {
+  if (outcome.executionFailed && outcome.cleanupFailed) {
+    throw new AggregateError([outcome.executionError, outcome.cleanupError], "Upgrade execution failed and helper cleanup did not complete");
   }
-  if (executionError)
-    throw executionError;
-  if (!execution)
+  if (outcome.executionFailed)
+    throw outcome.executionError;
+  if (!outcome.execution)
     throw new Error("Upgrade execution did not return a result");
-  if (cleanupError && !execution.success) {
-    throw new AggregateError([remoteUpgradeFailure(execution), cleanupError], "Remote upgrade failed and helper cleanup did not complete");
+  if (outcome.cleanupFailed && !outcome.execution.success) {
+    throw new AggregateError([remoteUpgradeFailure(outcome.execution), outcome.cleanupError], "Remote upgrade failed and helper cleanup did not complete");
   }
-  if (cleanupError)
-    throw cleanupError;
-  if (!execution.success)
-    throw remoteUpgradeFailure(execution);
-  return execution;
+  if (outcome.cleanupFailed)
+    throw outcome.cleanupError;
+  if (!outcome.execution.success)
+    throw remoteUpgradeFailure(outcome.execution);
+  return outcome.execution;
 }
 async function executeOfficialUpgrade(ssh, helperPath, command, timeoutMs) {
   let execution;
+  let executionFailed = false;
   let executionError;
   let helperPrepared = false;
   try {
     await prepareRemoteUpgradeHelperDirectory(ssh, helperPath);
     helperPrepared = true;
     await ssh.uploadText(helperPath, release_assets_default, 384);
+    const trustedRootPath = join2(dirname(helperPath), SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_FILENAME);
+    await ssh.uploadText(trustedRootPath, SIGSTORE_PUBLIC_GOOD_TRUSTED_ROOT_JSONL, 384);
     execution = await ssh.exec(command, timeoutMs);
   } catch (error) {
+    executionFailed = true;
     executionError = error;
   }
+  let cleanupFailed = false;
   let cleanupError;
   if (helperPrepared) {
     try {
       await removeRemoteUpgradeHelper(ssh, helperPath);
     } catch (error) {
+      cleanupFailed = true;
       cleanupError = error;
     }
   }
-  return officialUpgradeOutcome(execution, executionError, cleanupError);
+  return officialUpgradeOutcome({
+    execution,
+    executionFailed,
+    executionError,
+    cleanupFailed,
+    cleanupError
+  });
 }
 function assertSafeGithubProxy(value) {
   const trimmed = value.trim();
@@ -27949,14 +27746,366 @@ function assertSafeExecCommand(command) {
   }
   return reject();
 }
+async function runFixedRemoteCommand(ssh, command, timeoutMs) {
+  try {
+    return await ssh.exec(command, timeoutMs);
+  } catch {
+    return null;
+  }
+}
+function singleSystemdProperty(output, property) {
+  const prefix = `${property}=`;
+  const matches = output.split(/\r?\n/).filter((line) => line.startsWith(prefix));
+  return matches.length === 1 ? matches[0].slice(prefix.length) : null;
+}
+function strictExecStartPath(execStart) {
+  if (execStart.length > 4096 || /[\r\n\0]/.test(execStart))
+    return null;
+  const matches = Array.from(execStart.matchAll(/(?:^|[{;]\s*)path=([^;}]+?)\s*(?=;|}|$)/g));
+  if (matches.length !== 1)
+    return null;
+  const executablePath = matches[0]?.[1]?.trim() || "";
+  return /^\/[a-zA-Z0-9._/-]+$/.test(executablePath) ? executablePath : null;
+}
+function execStartEvidence(output) {
+  if (output.length > 8192 || /\0/.test(output)) {
+    return { status: "error", path: null, error: "systemd_output_invalid" };
+  }
+  if (!output.trim())
+    return { status: "unknown", path: null, error: "unit_missing" };
+  const loadState = singleSystemdProperty(output, "LoadState");
+  const execStart = singleSystemdProperty(output, "ExecStart");
+  if (loadState === null || execStart === null) {
+    return { status: "error", path: null, error: "systemd_output_invalid" };
+  }
+  if (loadState !== "loaded")
+    return { status: "unknown", path: null, error: "unit_not_loaded" };
+  if (execStart === "")
+    return { status: "unknown", path: null, error: "exec_start_missing" };
+  const executablePath = strictExecStartPath(execStart);
+  return executablePath ? { status: "ok", path: executablePath, error: null } : { status: "error", path: null, error: "exec_start_invalid" };
+}
+function stableVersion(output) {
+  if (output.length > BINARY_VERSION_MAX_BYTES || /\0/.test(output))
+    return null;
+  const versionTokens = output.split(VERSION_TOKEN_SEPARATOR).filter((token) => SEMVER_CORE_TOKEN.test(token));
+  const versions = versionTokens.map((token) => token.startsWith("v") ? token.slice(1) : token);
+  if (versions.length === 0 || versions.some((version) => !EXACT_STABLE_SEMVER.test(version))) {
+    return null;
+  }
+  const uniqueVersions = new Set(versions);
+  return uniqueVersions.size === 1 ? [...uniqueVersions][0] : null;
+}
+function stableSha256(output) {
+  return /^[0-9a-f]{64}$/.test(output) ? output : null;
+}
+function unavailableBinaryEvidence(definition, evidence) {
+  return {
+    status: evidence.status,
+    version: null,
+    sha256: null,
+    path: evidence.path,
+    source: definition.source,
+    error: evidence.error
+  };
+}
+function canonicalBase64Text(encoded, maximumBytes) {
+  if (encoded.length > Math.ceil(maximumBytes / 3) * 4 || encoded.length % 4 !== 0)
+    return null;
+  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(encoded))
+    return null;
+  const decodedBytes = Buffer2.from(encoded, "base64");
+  if (decodedBytes.length > maximumBytes || decodedBytes.toString("base64") !== encoded)
+    return null;
+  try {
+    return new TextDecoder2("utf-8", { fatal: true }).decode(decodedBytes);
+  } catch {
+    return null;
+  }
+}
+function taggedProbeValue(line, label) {
+  return line?.startsWith(label) ? line.slice(label.length) : null;
+}
+function binaryProbeFields(output) {
+  if (output.length > 8192 || /[\r\0]/.test(output))
+    return null;
+  const lines = (output.endsWith(`
+`) ? output.slice(0, -1) : output).split(`
+`);
+  if (lines.length < 2 || lines.length > 3)
+    return null;
+  const hashBefore = taggedProbeValue(lines[0], BINARY_HASH_BEFORE_LABEL);
+  const versionBase64 = taggedProbeValue(lines[1], BINARY_VERSION_LABEL);
+  const hashAfter = lines.length === 3 ? taggedProbeValue(lines[2], BINARY_HASH_AFTER_LABEL) : null;
+  if (hashBefore === null || versionBase64 === null || lines.length === 3 && hashAfter === null)
+    return null;
+  const versionOutput = canonicalBase64Text(versionBase64, BINARY_VERSION_MAX_BYTES);
+  return versionOutput === null ? null : { versionOutput, hashBefore, hashAfter };
+}
+function completedBinaryProbe(fields) {
+  const version = stableVersion(fields.versionOutput);
+  const hashBefore = stableSha256(fields.hashBefore);
+  const hashAfter = fields.hashAfter === null ? null : stableSha256(fields.hashAfter);
+  if (hashBefore && hashAfter && hashBefore !== hashAfter) {
+    return { version: null, sha256: null, error: "binary_changed_during_probe" };
+  }
+  const sha2562 = hashBefore && hashAfter ? hashBefore : null;
+  if (!version)
+    return { version: null, sha256: sha2562, error: "version_output_invalid" };
+  return sha2562 ? { version, sha256: sha2562, error: null } : { version, sha256: null, error: "sha256_output_invalid" };
+}
+function reservedBinaryProbeFailure(execution, fields) {
+  if (execution.code === PROBE_CHANGED_DURING_READ) {
+    return { version: null, sha256: null, error: "binary_changed_during_probe" };
+  }
+  if (execution.code === BINARY_HASH_BEFORE_FAILED) {
+    return { version: null, sha256: null, error: "sha256_probe_failed" };
+  }
+  if (execution.code === BINARY_VERSION_FAILED) {
+    return { version: null, sha256: null, error: "version_probe_failed" };
+  }
+  if (execution.code === BINARY_HASH_AFTER_FAILED) {
+    const version = fields ? stableVersion(fields.versionOutput) : null;
+    return version ? { version, sha256: null, error: "sha256_probe_failed" } : { version: null, sha256: null, error: fields ? "version_output_invalid" : "binary_probe_output_invalid" };
+  }
+  return null;
+}
+function binaryProbeValues(execution) {
+  if (!execution)
+    return { version: null, sha256: null, error: "binary_probe_transport_failed" };
+  const fields = binaryProbeFields(execution.stdout);
+  const reservedFailure = reservedBinaryProbeFailure(execution, fields);
+  if (reservedFailure)
+    return reservedFailure;
+  if (!execution.success)
+    return { version: null, sha256: null, error: "binary_probe_failed" };
+  return fields ? completedBinaryProbe(fields) : { version: null, sha256: null, error: "binary_probe_output_invalid" };
+}
+async function binaryComponentEvidence(ssh, definition) {
+  const execStart = await systemdBinaryEvidence(ssh, definition);
+  if (execStart.status !== "ok" || !execStart.path)
+    return unavailableBinaryEvidence(definition, execStart);
+  const fixedProbe = definition.commands[execStart.path];
+  if (!fixedProbe)
+    return unavailableBinaryEvidence(definition, {
+      status: "error",
+      path: execStart.path,
+      error: "exec_start_not_allowed"
+    });
+  const evidence = await fixedBinaryEvidence(ssh, definition, execStart.path, fixedProbe);
+  const verifiedExecStart = await systemdBinaryEvidence(ssh, definition);
+  if (verifiedExecStart.status !== "ok") {
+    return unavailableBinaryEvidence(definition, {
+      status: "error",
+      path: execStart.path,
+      error: "exec_start_recheck_failed"
+    });
+  }
+  return verifiedExecStart.path === execStart.path ? evidence : unavailableBinaryEvidence(definition, {
+    status: "error",
+    path: execStart.path,
+    error: "exec_start_changed_during_probe"
+  });
+}
+async function systemdBinaryEvidence(ssh, definition) {
+  const systemdCommand = `systemctl show --property=LoadState --property=ExecStart -- ${definition.unit}`;
+  const systemdExecution = await runFixedRemoteCommand(ssh, systemdCommand, PLATFORM_PROBE_TIMEOUT_MS);
+  if (!systemdExecution)
+    return { status: "error", path: null, error: "systemd_probe_transport_failed" };
+  if (!systemdExecution.success)
+    return { status: "error", path: null, error: "systemd_probe_failed" };
+  return execStartEvidence(systemdExecution.stdout);
+}
+async function fixedBinaryEvidence(ssh, definition, executablePath, fixedProbe) {
+  const execution = await runFixedRemoteCommand(ssh, fixedProbe.command, PLATFORM_HASH_TIMEOUT_MS);
+  const probe = binaryProbeValues(execution);
+  return {
+    status: probe.error ? "error" : "ok",
+    version: probe.version,
+    sha256: probe.sha256,
+    path: executablePath,
+    source: definition.source,
+    error: probe.error
+  };
+}
+function parseWebConsoleVersion(markerOutput) {
+  if (markerOutput.length > WEB_CONSOLE_MARKER_MAX_BYTES || /\0/.test(markerOutput))
+    return null;
+  try {
+    const marker = JSON.parse(markerOutput);
+    if (typeof marker !== "object" || marker === null || Array.isArray(marker))
+      return null;
+    const fields = marker;
+    if (fields.schema_version !== 1 || fields.component !== "web-console")
+      return null;
+    return typeof fields.version === "string" && EXACT_STABLE_SEMVER.test(fields.version) ? fields.version : null;
+  } catch {
+    return null;
+  }
+}
+var WEB_CONSOLE_PROBE_COMMAND = [
+  "set -o pipefail",
+  `ROOT=${quoteEnvValue(WEB_CONSOLE_CURRENT_DIR)}`,
+  'if [ ! -e "$ROOT" ] && [ ! -L "$ROOT" ]; then exit 43; fi',
+  `test -d "$ROOT" || exit ${WEB_CONSOLE_ROOT_INVALID}`,
+  `ROOT_REAL_BEFORE=$(readlink -f -- "$ROOT") || exit ${WEB_CONSOLE_ROOT_INVALID}`,
+  `case "$ROOT_REAL_BEFORE" in "$ROOT"|/opt/supacloud/web-console/releases/*) ;; *) exit ${WEB_CONSOLE_ROOT_INVALID} ;; esac`,
+  `ROOT_ID_BEFORE=$(stat -c '%d:%i' -- "$ROOT_REAL_BEFORE") || exit ${WEB_CONSOLE_ROOT_INVALID}`,
+  "MARKER_BEFORE=$ROOT_REAL_BEFORE/.supacloud-component.json",
+  `test ! -L "$MARKER_BEFORE" || exit ${WEB_CONSOLE_MARKER_INVALID}`,
+  `test -e "$MARKER_BEFORE" || exit ${WEB_CONSOLE_MARKER_MISSING}`,
+  `test -f "$MARKER_BEFORE" || exit ${WEB_CONSOLE_MARKER_INVALID}`,
+  `test "$(stat -c '%s' -- "$MARKER_BEFORE")" -le ${WEB_CONSOLE_MARKER_MAX_BYTES} || exit ${WEB_CONSOLE_MARKER_INVALID}`,
+  `MARKER_BASE64_BEFORE=$(head -c ${WEB_CONSOLE_MARKER_MAX_BYTES + 1} -- "$MARKER_BEFORE" | base64 | tr -d '\\n') || exit ${WEB_CONSOLE_MARKER_INVALID}`,
+  "web_tree_sha256() {",
+  "  local TREE_ROOT INVALID_ENTRY TREE_DIGEST",
+  "  TREE_ROOT=$1",
+  `  INVALID_ENTRY=$(cd -- "$TREE_ROOT" && find . -xdev ! -type d ! -type f -print -quit) || return ${WEB_CONSOLE_TREE_FAILED}`,
+  `  test -z "$INVALID_ENTRY" || return ${WEB_CONSOLE_TREE_INVALID}`,
+  `  TREE_DIGEST=$(cd -- "$TREE_ROOT" && find . -xdev -type f -print0 | LC_ALL=C sort -z | xargs -0 -r sha256sum -- | sha256sum | awk '{print $1}') || return ${WEB_CONSOLE_TREE_FAILED}`,
+  `  printf '%s' "$TREE_DIGEST"`,
+  "}",
+  'TREE_BEFORE=$(web_tree_sha256 "$ROOT_REAL_BEFORE")',
+  "TREE_STATUS=$?",
+  'test "$TREE_STATUS" -eq 0 || exit "$TREE_STATUS"',
+  'TREE_AFTER=$(web_tree_sha256 "$ROOT_REAL_BEFORE")',
+  "TREE_STATUS=$?",
+  `test "$TREE_STATUS" -eq 0 || exit ${PROBE_CHANGED_DURING_READ}`,
+  "MARKER_AFTER=$ROOT_REAL_BEFORE/.supacloud-component.json",
+  `test ! -L "$MARKER_AFTER" && test -f "$MARKER_AFTER" || exit ${PROBE_CHANGED_DURING_READ}`,
+  `test "$(stat -c '%s' -- "$MARKER_AFTER")" -le ${WEB_CONSOLE_MARKER_MAX_BYTES} || exit ${PROBE_CHANGED_DURING_READ}`,
+  `MARKER_BASE64_AFTER=$(head -c ${WEB_CONSOLE_MARKER_MAX_BYTES + 1} -- "$MARKER_AFTER" | base64 | tr -d '\\n') || exit ${PROBE_CHANGED_DURING_READ}`,
+  `test -d "$ROOT" || exit ${PROBE_CHANGED_DURING_READ}`,
+  `ROOT_REAL_AFTER=$(readlink -f -- "$ROOT") || exit ${PROBE_CHANGED_DURING_READ}`,
+  `ROOT_ID_AFTER=$(stat -c '%d:%i' -- "$ROOT_REAL_AFTER") || exit ${PROBE_CHANGED_DURING_READ}`,
+  `printf '${WEB_ROOT_REAL_BEFORE_LABEL}%s\\n' "$ROOT_REAL_BEFORE"`,
+  `printf '${WEB_ROOT_ID_BEFORE_LABEL}%s\\n' "$ROOT_ID_BEFORE"`,
+  `printf '${WEB_MARKER_BEFORE_LABEL}%s\\n' "$MARKER_BASE64_BEFORE"`,
+  `printf '${WEB_TREE_BEFORE_LABEL}%s\\n' "$TREE_BEFORE"`,
+  `printf '${WEB_TREE_AFTER_LABEL}%s\\n' "$TREE_AFTER"`,
+  `printf '${WEB_MARKER_AFTER_LABEL}%s\\n' "$MARKER_BASE64_AFTER"`,
+  `printf '${WEB_ROOT_REAL_AFTER_LABEL}%s\\n' "$ROOT_REAL_AFTER"`,
+  `printf '${WEB_ROOT_ID_AFTER_LABEL}%s\\n' "$ROOT_ID_AFTER"`
+].join(`
+`);
+var WEB_CONSOLE_PROBE_LABELS = [
+  WEB_ROOT_REAL_BEFORE_LABEL,
+  WEB_ROOT_ID_BEFORE_LABEL,
+  WEB_MARKER_BEFORE_LABEL,
+  WEB_TREE_BEFORE_LABEL,
+  WEB_TREE_AFTER_LABEL,
+  WEB_MARKER_AFTER_LABEL,
+  WEB_ROOT_REAL_AFTER_LABEL,
+  WEB_ROOT_ID_AFTER_LABEL
+];
+function taggedWebConsoleProbeValues(output) {
+  if (output.length > 16384 || /[\r\0]/.test(output))
+    return null;
+  const lines = (output.endsWith(`
+`) ? output.slice(0, -1) : output).split(`
+`);
+  if (lines.length !== WEB_CONSOLE_PROBE_LABELS.length)
+    return null;
+  const probeValues = WEB_CONSOLE_PROBE_LABELS.map((label, index) => taggedProbeValue(lines[index], label));
+  return probeValues.some((probeValue) => probeValue === null) ? null : probeValues;
+}
+function webConsoleConsistencyError(probeValues) {
+  const [rootBefore, rootIdBefore, markerBefore, treeBefore, treeAfter, markerAfter, rootAfter, rootIdAfter] = probeValues;
+  if (rootBefore !== rootAfter || rootIdBefore !== rootIdAfter) {
+    return "web_console_root_changed_during_probe";
+  }
+  if (markerBefore !== markerAfter)
+    return "marker_changed_during_probe";
+  return treeBefore !== treeAfter ? "tree_sha256_changed_during_probe" : null;
+}
+function webConsoleProbeFields(output) {
+  const probeValues = taggedWebConsoleProbeValues(output);
+  if (!probeValues)
+    return null;
+  const [rootBefore, rootIdBefore, markerBefore, treeBefore, , markerAfter, rootAfter, rootIdAfter] = probeValues;
+  const supportedRoot = /^\/opt\/supacloud\/web-console\/(?:current|releases\/[A-Za-z0-9][A-Za-z0-9._-]*)$/;
+  if (![rootBefore, rootAfter].every((root) => supportedRoot.test(root)))
+    return null;
+  if (![rootIdBefore, rootIdAfter].every((rootId) => /^\d+:\d+$/.test(rootId)))
+    return null;
+  const markerOutput = canonicalBase64Text(markerBefore, WEB_CONSOLE_MARKER_MAX_BYTES);
+  if (markerOutput === null || canonicalBase64Text(markerAfter, WEB_CONSOLE_MARKER_MAX_BYTES) === null)
+    return null;
+  const consistencyError = webConsoleConsistencyError(probeValues);
+  return {
+    markerOutput,
+    treeSha256: consistencyError ? null : stableSha256(treeBefore),
+    consistencyError
+  };
+}
+function webConsoleProbeError(execution, fields, version, treeSha256) {
+  if (!execution)
+    return { status: "error", error: "web_console_probe_transport_failed" };
+  if (execution.code === WEB_CONSOLE_ROOT_MISSING)
+    return { status: "unknown", error: "web_console_missing" };
+  if (execution.code === WEB_CONSOLE_MARKER_MISSING)
+    return { status: "unknown", error: "marker_missing" };
+  if (execution.code === PROBE_CHANGED_DURING_READ) {
+    return { status: "error", error: "web_console_changed_during_probe" };
+  }
+  if (execution.code === WEB_CONSOLE_ROOT_INVALID || execution.code === WEB_CONSOLE_TREE_INVALID) {
+    return { status: "error", error: "web_console_invalid_file" };
+  }
+  if (execution.code === WEB_CONSOLE_MARKER_INVALID)
+    return { status: "error", error: "marker_invalid" };
+  if (execution.code === WEB_CONSOLE_TREE_FAILED)
+    return { status: "error", error: "tree_sha256_probe_failed" };
+  if (!execution.success)
+    return { status: "error", error: "web_console_probe_failed" };
+  if (!fields)
+    return { status: "error", error: "web_console_probe_output_invalid" };
+  if (fields.consistencyError)
+    return { status: "error", error: fields.consistencyError };
+  if (!version)
+    return { status: "error", error: "marker_invalid" };
+  return treeSha256 ? { status: "ok", error: null } : { status: "error", error: "tree_sha256_output_invalid" };
+}
+async function webConsoleEvidence(ssh) {
+  const execution = await runFixedRemoteCommand(ssh, WEB_CONSOLE_PROBE_COMMAND, WEB_CONSOLE_PROBE_TIMEOUT_MS);
+  const fields = execution?.success ? webConsoleProbeFields(execution.stdout) : null;
+  const version = fields && !fields.consistencyError ? parseWebConsoleVersion(fields.markerOutput) : null;
+  const treeSha256 = fields?.treeSha256 ?? null;
+  const state = webConsoleProbeError(execution, fields, version, treeSha256);
+  return {
+    status: state.status,
+    version,
+    tree_sha256: treeSha256,
+    path: WEB_CONSOLE_CURRENT_DIR,
+    source: "component_marker_and_tree_sha256",
+    error: state.error
+  };
+}
+async function platformVersions(ssh) {
+  const [managementApi, edgeRuntime, caddy, webConsole] = await Promise.all([
+    binaryComponentEvidence(ssh, BINARY_PROBES.management_api),
+    binaryComponentEvidence(ssh, BINARY_PROBES.edge_runtime),
+    binaryComponentEvidence(ssh, BINARY_PROBES.caddy),
+    webConsoleEvidence(ssh)
+  ]);
+  return {
+    schema_version: 1,
+    components: {
+      management_api: managementApi,
+      edge_runtime: edgeRuntime,
+      caddy,
+      web_console: webConsole
+    }
+  };
+}
 function registerSshTools(server, ssh) {
   server.tool("ssh", `Server management via SSH. Available before & after SupaCloud installation.
-Actions: ping, setup, install, upgrade, diagnose, exec, troubleshoot, container_logs, tenant_manage, tenant_list, tenant_inspect, tenant_diagnose, tenant_migrate`, {
+Actions: ping, setup, install, upgrade, versions, diagnose, exec, troubleshoot, container_logs, tenant_manage, tenant_list, tenant_inspect, tenant_diagnose, tenant_migrate`, {
     action: withDescription(stringEnum([
       "ping",
       "setup",
       "install",
       "upgrade",
+      "versions",
       "diagnose",
       "exec",
       "troubleshoot",
@@ -28033,7 +28182,7 @@ ${bootstrapDeps.stderr.slice(-500)}`;
           break;
         }
         const osCheck = await ssh.exec("cat /etc/os-release | grep -E 'NAME|VERSION_ID' | head -4");
-        const clone2 = await ssh.exec(`set -e; umask 077; rm -rf ${quoteEnvValue(BOOTSTRAP)}; ` + `${bootstrapClone}; ` + `git -C ${quoteEnvValue(BOOTSTRAP)} remote set-url origin ${quoteEnvValue(REPO)}; ` + `test "$(git -C ${quoteEnvValue(BOOTSTRAP)} remote get-url origin)" = ${quoteEnvValue(REPO)}; ` + `test "$(git -C ${quoteEnvValue(BOOTSTRAP)} symbolic-ref --short HEAD)" = main; ` + `test -z "$(git -C ${quoteEnvValue(BOOTSTRAP)} status --porcelain --untracked-files=no)"; ` + `git -C ${quoteEnvValue(BOOTSTRAP)} ls-files --error-unmatch setup.sh scripts/lib/install_config.sh scripts/lib/release_assets.sh >/dev/null; ` + `test -f ${quoteEnvValue(`${BOOTSTRAP}/setup.sh`)}; echo BOOTSTRAP_OK`, 120000);
+        const clone2 = await ssh.exec(`set -e; umask 077; rm -rf ${quoteEnvValue(BOOTSTRAP)}; ` + `${bootstrapClone}; ` + `git -C ${quoteEnvValue(BOOTSTRAP)} remote set-url origin ${quoteEnvValue(REPO)}; ` + `test "$(git -C ${quoteEnvValue(BOOTSTRAP)} remote get-url origin)" = ${quoteEnvValue(REPO)}; ` + `test "$(git -C ${quoteEnvValue(BOOTSTRAP)} symbolic-ref --short HEAD)" = main; ` + `test -z "$(git -C ${quoteEnvValue(BOOTSTRAP)} status --porcelain --untracked-files=no)"; ` + `git -C ${quoteEnvValue(BOOTSTRAP)} ls-files --error-unmatch setup.sh scripts/lib/install_config.sh scripts/lib/release_assets.sh packages/management-api/src/assets/sigstore-public-good-trusted-root.jsonl >/dev/null; ` + `test -f ${quoteEnvValue(`${BOOTSTRAP}/setup.sh`)}; echo BOOTSTRAP_OK`, 120000);
         if (!clone2.stdout.includes("BOOTSTRAP_OK")) {
           await ssh.exec(`rm -rf ${quoteEnvValue(BOOTSTRAP)}`);
           text = `❌ Trusted bootstrap clone failed
@@ -28098,22 +28247,16 @@ ${result.stderr.slice(-500)}`;
         break;
       }
       case "upgrade": {
-        const version = args.version ? assertSafeReleaseTag(args.version) : undefined;
-        const edgeRuntimeVersion = args.edge_runtime_version ? assertSafeReleaseTag(args.edge_runtime_version) : undefined;
+        const version = args.version ? assertExactStableVersion2(assertSafeReleaseTag(args.version), "version") : undefined;
+        const edgeRuntimeVersion = args.edge_runtime_version ? assertExactStableVersion2(assertSafeReleaseTag(args.edge_runtime_version), "edge_runtime_version") : undefined;
         if (edgeRuntimeVersion && !version) {
           throw new Error("'version' is required with 'edge_runtime_version'");
         }
-        if (edgeRuntimeVersion && version) {
-          assertExactStableVersion2(version, "version");
-          assertExactStableVersion2(edgeRuntimeVersion, "edge_runtime_version");
-        }
         const validatedProxy = args.github_proxy ? assertSafeGithubProxy(args.github_proxy) : undefined;
         if (args.artifact_transport === "local") {
           if (!version || !edgeRuntimeVersion) {
             throw new Error("Local artifact transport requires exact 'version' and 'edge_runtime_version'");
           }
-          assertExactStableVersion2(version, "version");
-          assertExactStableVersion2(edgeRuntimeVersion, "edge_runtime_version");
           if (validatedProxy && !["direct", "none"].includes(validatedProxy.toLowerCase())) {
             throw new Error("Local artifact transport only supports direct GitHub downloads");
           }
@@ -28139,17 +28282,27 @@ ${result.stderr.slice(-500)}`;
 ${upgradeExecution.stdout.slice(-300)}${edgeBoundary}`;
         break;
       }
+      case "versions": {
+        text = JSON.stringify(await platformVersions(ssh), null, 2);
+        break;
+      }
       case "diagnose": {
         const cmds = [
+          "set -o pipefail",
           "echo '=== OS ===' && uname -a",
           "echo '=== Memory ===' && free -h",
           "echo '=== Disk ===' && df -h /",
           "echo '=== Docker ===' && (docker ps --format 'table {{.Names}}\t{{.Status}}' 2>/dev/null || echo 'Not found')",
-          "echo '=== PostgreSQL ===' && (pg_isready 2>/dev/null && echo 'Running' || echo 'Not detected')",
-          "echo '=== Management API ===' && (curl -sf http://localhost:9090/health > /dev/null && echo 'Running' || echo 'Not running')"
+          "echo '=== Management API /health ==='",
+          "(curl --fail --silent --show-error --max-time 5 --max-filesize 4096 http://127.0.0.1:9090/health 2>&1 | head -c 4096) || echo 'Probe failed'",
+          "printf '\\n'",
+          "echo '=== Management API /monitor/health ==='",
+          "(curl --fail --silent --show-error --max-time 15 --max-filesize 16384 http://127.0.0.1:9090/monitor/health 2>&1 | head -c 16384) || echo 'Probe failed'",
+          "printf '\\n'"
         ];
-        const r = await ssh.exec(cmds.join(" && "));
-        text = r.stdout || r.stderr;
+        const r = await ssh.exec(cmds.join(`
+`), 30000);
+        text = redactTenantConfig((r.stdout || r.stderr).slice(0, 32768));
         break;
       }
       case "exec": {
@@ -28984,7 +29137,7 @@ Actions: routes, upsert_route, update_route, delete_route, config, get_certifica
 // package.json
 var package_default = {
   name: "@supacloud/admin",
-  version: "0.7.11",
+  version: "0.8.0",
   description: "Platform administration CLI for SupaCloud operators",
   type: "module",
   main: "./dist/index.js",
@@ -29054,6 +29207,7 @@ var sshActionSchema = stringEnum([
   "setup",
   "install",
   "upgrade",
+  "versions",
   "diagnose",
   "exec",
   "troubleshoot",
@@ -29108,6 +29262,7 @@ EXAMPLES
 
   supacloud-admin status
   supacloud-admin ssh ping
+  supacloud-admin ssh versions
   supacloud-admin ssh install --public_domain api.example.com --studio_domain studio.example.com
   supacloud-admin project create --name my-app
   supacloud-admin project list