@supacloud/cli 0.111.0 → 0.112.0

package/dist/index.js

@@ -9346,7 +9346,7 @@ var ACTION_POLICY = {
   },
   secrets: { read: ["list"], write: ["upsert", "delete"] },
   frontend: {
-    read: ["list", "get", "build_logs", "list_frameworks", "list_records", "list_releases", "get_active_release", "get_release"],
+    read: ["list", "get", "build_logs", "list_frameworks", "list_records", "list_releases", "get_active_release", "get_release", "verify_release"],
     write: ["create", "update", "delete", "deploy_git", "deploy_upload", "redeploy", "add_domain", "remove_domain", "set_env", "upload_release", "activate_release", "rollback"]
   },
   task_events: { read: ["inspect_webhook"], write: ["register_webhook", "unregister_webhook"] },
@@ -16919,6 +16919,8 @@ var TIMESTAMP_PATTERN2 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
 var ARCHIVE_MAX_BYTES = 100 * 1024 * 1024;
 var ARCHIVE_CHUNK_BYTES = 64 * 1024;
 var RESPONSE_MAX_BYTES = 1024 * 1024;
+var LIVE_RESPONSE_MAX_BYTES = 1024 * 1024;
+var LIVE_CHECK_TIMEOUT_MS = 1e4;
 var UPLOAD_REQUEST_TIMEOUT_MS = 10 * 60000;
 var MUTATION_RESPONSE_TIMEOUT_MS = 5000;
 var RELEASE_LIST_LIMIT_MAX = 100;
@@ -17276,6 +17278,129 @@ async function getActiveFrontendRelease(http, projectRef, deploymentId) {
   const snapshot = await readActiveFrontendRelease(http, projectRef, deploymentId);
   return "failure" in snapshot ? snapshot.failure : toolResponse(snapshot.inventory);
 }
+function deploymentLiveUrl(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const value = candidate.deployment_url;
+  if (typeof value !== "string" || !value.trim())
+    return null;
+  try {
+    const url = new URL(value.trim());
+    return url.protocol === "https:" || url.protocol === "http:" ? url.toString() : null;
+  } catch {
+    return null;
+  }
+}
+async function verifyLiveDeployment(url) {
+  try {
+    const response = await fetch(url, {
+      method: "GET",
+      redirect: "follow",
+      cache: "no-store",
+      signal: AbortSignal.timeout(LIVE_CHECK_TIMEOUT_MS)
+    });
+    const contentLength = Number(response.headers.get("content-length") ?? "");
+    if (Number.isFinite(contentLength) && contentLength > LIVE_RESPONSE_MAX_BYTES) {
+      response.body?.cancel().catch(() => {
+        return;
+      });
+      return {
+        ok: false,
+        status: response.status,
+        content_type: response.headers.get("content-type"),
+        bytes: contentLength,
+        error_code: "LIVE_RESPONSE_TOO_LARGE"
+      };
+    }
+    let bytes = 0;
+    const reader = response.body?.getReader();
+    if (reader) {
+      try {
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done)
+            break;
+          bytes += value.byteLength;
+          if (bytes > LIVE_RESPONSE_MAX_BYTES) {
+            reader.cancel().catch(() => {
+              return;
+            });
+            break;
+          }
+        }
+      } finally {
+        reader.releaseLock();
+      }
+    }
+    const ok = response.status === 200 && bytes > 0 && bytes <= LIVE_RESPONSE_MAX_BYTES;
+    return {
+      ok,
+      status: response.status,
+      content_type: response.headers.get("content-type"),
+      bytes,
+      error_code: bytes > LIVE_RESPONSE_MAX_BYTES ? "LIVE_RESPONSE_TOO_LARGE" : ok ? null : bytes === 0 ? "LIVE_RESPONSE_EMPTY" : "LIVE_RESPONSE_INVALID"
+    };
+  } catch (error) {
+    const timedOut = error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError");
+    return {
+      ok: false,
+      status: 0,
+      content_type: null,
+      bytes: 0,
+      error_code: timedOut ? "LIVE_CHECK_TIMEOUT" : "LIVE_CHECK_FAILED"
+    };
+  }
+}
+async function verifyFrontendRelease(http, projectRef, deploymentId) {
+  const snapshot = await readActiveFrontendRelease(http, projectRef, deploymentId);
+  if ("failure" in snapshot)
+    return snapshot.failure;
+  const inventory = snapshot.inventory;
+  const release = inventory.releases[0];
+  if (!release)
+    return releaseFailure("frontend.verify_release", "NO_ACTIVE_RELEASE", 200);
+  const deployment = await http.get(deploymentEndpoint(projectRef, deploymentId), {
+    maxJsonBytes: RESPONSE_MAX_BYTES
+  });
+  const liveUrl = deployment.ok && deployment.status === 200 ? deploymentLiveUrl(deployment.data) : null;
+  const live = liveUrl ? await verifyLiveDeployment(liveUrl) : { ok: false, status: 0, content_type: null, bytes: 0, error_code: "LIVE_URL_UNAVAILABLE" };
+  let errorCode = live.error_code;
+  if (live.ok) {
+    try {
+      const readback = await readActiveFrontendRelease(http, projectRef, deploymentId);
+      if ("failure" in readback)
+        errorCode = "ACTIVE_RELEASE_READBACK_FAILED";
+      else if (readback.inventory.active_release_id !== inventory.active_release_id || readback.inventory.active_activation_id !== inventory.active_activation_id) {
+        errorCode = "STALE_AUTHORITY";
+      }
+    } catch {
+      errorCode = "ACTIVE_RELEASE_READBACK_FAILED";
+    }
+  }
+  const ok = errorCode === null;
+  const receipt = {
+    schema: "supacloud.frontend-release-verification.v1",
+    ok,
+    error_code: errorCode,
+    project_ref: projectRef,
+    deployment_id: deploymentId,
+    active_release_id: inventory.active_release_id,
+    active_activation_id: inventory.active_activation_id,
+    release,
+    live: {
+      url: liveUrl,
+      status: live.status,
+      content_type: live.content_type,
+      bytes: live.bytes,
+      error_code: live.error_code
+    },
+    checked_at: new Date().toISOString()
+  };
+  return {
+    content: [{ type: "text", text: JSON.stringify(receipt, null, 2) }],
+    ...ok ? {} : { isError: true }
+  };
+}
 async function publishFrontendRelease(http, projectRef, deploymentId, archiveSource, expectedTreeSha256) {
   const authority = await readActiveFrontendRelease(http, projectRef, deploymentId);
   if ("failure" in authority)
@@ -17565,7 +17690,7 @@ async function activationReadback(http, input, mutationId, activationStatus) {
 // src/shared/tools/frontend-tools.ts
 function registerFrontendTools(server, http) {
   registerTool(server, "frontend", `Frontend hosting and immutable prebuilt releases. Supports: static, react, vue, svelte, sveltekit, sveltekit-static, nextjs, nuxt, astro.
-Actions: list, get, create, update, delete, build_logs, add_domain, remove_domain, set_env, list_frameworks, list_records, list_releases, get_active_release, get_release, rollback. Publish with supacloud deploy.`, {
+Actions: list, get, create, update, delete, build_logs, add_domain, remove_domain, set_env, list_frameworks, list_records, list_releases, get_active_release, get_release, verify_release, rollback. Publish with supacloud deploy.`, {
     action: withDescription(stringEnum2([
       "list",
       "get",
@@ -17581,6 +17706,7 @@ Actions: list, get, create, update, delete, build_logs, add_domain, remove_domai
       "list_releases",
       "get_active_release",
       "get_release",
+      "verify_release",
       "rollback"
     ]), "Action"),
     ref: optional(String2(), "Project ref"),
@@ -17711,6 +17837,10 @@ Actions: list, get, create, update, delete, build_logs, add_domain, remove_domai
         need("ref", ref);
         need("id", id);
         return getActiveFrontendRelease(http, ref, id);
+      case "verify_release":
+        need("ref", ref);
+        need("id", id);
+        return verifyFrontendRelease(http, ref, id);
       case "rollback":
         need("ref", ref);
         need("id", id);
@@ -20671,8 +20801,23 @@ var VALID_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 var VALID_MIGRATION_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]{0,100}$/;
 var VALID_SCHEMA = /^[A-Za-z_][A-Za-z0-9_$]*$/;
 var VALID_PROJECT_REF = /^[A-Za-z0-9_-]{1,64}$/;
+var OFFICIAL_CLI_PG_TLS_ENV = new Set([
+  "PGSSLMODE",
+  "PGSSLROOTCERT",
+  "PGSSLCERT",
+  "PGSSLKEY",
+  "PGSSLCRL",
+  "PGSSLCRLDIR",
+  "PGSSLSNI",
+  "PGSSLNEGOTIATION",
+  "PGSSLCOMPRESSION",
+  "PGREQUIRESSL"
+]);
 function isSensitiveEnvironmentKey(key) {
-  return key.toUpperCase().startsWith("PG") || SENSITIVE_ENV_KEY.test(key);
+  const upper = key.toUpperCase();
+  if (OFFICIAL_CLI_PG_TLS_ENV.has(upper))
+    return false;
+  return upper.startsWith("PG") || SENSITIVE_ENV_KEY.test(upper);
 }
 function requireMigrationName(name) {
   if (!name || !VALID_MIGRATION_NAME.test(name)) {
@@ -20959,7 +21104,7 @@ function resolveOfficialSupabaseCommand(workdir, environment = process.env) {
   const version = environment.SUPABASE_CLI_VERSION?.trim();
   if (version) {
     if (!VALID_VERSION.test(version))
-      throw new Error("Invalid SUPABASE_CLI_VERSION; use an exact version such as 2.120.0");
+      throw new Error("Invalid SUPABASE_CLI_VERSION; use an exact version such as 2.122.0");
     if (process.versions.bun)
       return [process.execPath, "x", `supabase@${version}`];
     if (process.platform === "win32") {
@@ -21827,9 +21972,9 @@ var starter_metadata_default = {
       }
     },
     sdk: {
-      version: "0.45.2",
+      version: "0.45.3",
       peerDependencies: {
-        "@supabase/supabase-js": "^2.117.3"
+        "@supabase/supabase-js": "^2.118.0"
       }
     }
   }
@@ -29688,8 +29833,23 @@ var VALID_VERSION2 = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 var VALID_MIGRATION_NAME2 = /^[A-Za-z0-9][A-Za-z0-9_-]{0,100}$/;
 var VALID_SCHEMA2 = /^[A-Za-z_][A-Za-z0-9_$]*$/;
 var VALID_PROJECT_REF2 = /^[A-Za-z0-9_-]{1,64}$/;
+var OFFICIAL_CLI_PG_TLS_ENV2 = new Set([
+  "PGSSLMODE",
+  "PGSSLROOTCERT",
+  "PGSSLCERT",
+  "PGSSLKEY",
+  "PGSSLCRL",
+  "PGSSLCRLDIR",
+  "PGSSLSNI",
+  "PGSSLNEGOTIATION",
+  "PGSSLCOMPRESSION",
+  "PGREQUIRESSL"
+]);
 function isSensitiveEnvironmentKey2(key) {
-  return key.toUpperCase().startsWith("PG") || SENSITIVE_ENV_KEY2.test(key);
+  const upper = key.toUpperCase();
+  if (OFFICIAL_CLI_PG_TLS_ENV2.has(upper))
+    return false;
+  return upper.startsWith("PG") || SENSITIVE_ENV_KEY2.test(upper);
 }
 function requireMigrationName2(name) {
   if (!name || !VALID_MIGRATION_NAME2.test(name)) {
@@ -29941,7 +30101,7 @@ function resolveOfficialSupabaseCommand2(workdir, environment = process.env) {
   const version = environment.SUPABASE_CLI_VERSION?.trim();
   if (version) {
     if (!VALID_VERSION2.test(version))
-      throw new Error("Invalid SUPABASE_CLI_VERSION; use an exact version such as 2.120.0");
+      throw new Error("Invalid SUPABASE_CLI_VERSION; use an exact version such as 2.122.0");
     if (process.versions.bun)
       return [process.execPath, "x", `supabase@${version}`];
     if (process.platform === "win32") {
@@ -33421,7 +33581,7 @@ async function runProjectDeployment(http, args) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.111.0",
+  version: "0.112.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",

package/dist/shared/tools/frontend-release-control.d.ts

@@ -45,6 +45,7 @@ export declare function uploadFrontendRelease(http: FrontendReleaseHttp, project
 export declare function uploadProjectWebRelease(http: FrontendReleaseHttp, projectRef: string, environmentId: string, deploymentId: string, archivePath: string): Promise<ToolResponse>;
 export declare function uploadFrontendSource(http: FrontendReleaseHttp, projectRef: string, deploymentId: string, archivePath: string): Promise<ToolResponse>;
 export declare function getActiveFrontendRelease(http: FrontendReleaseHttp, projectRef: string, deploymentId: string): Promise<ToolResponse>;
+export declare function verifyFrontendRelease(http: FrontendReleaseHttp, projectRef: string, deploymentId: string): Promise<ToolResponse>;
 export declare function readFrontendReleaseAuthority(http: FrontendReleaseHttp, projectRef: string, deploymentId: string): Promise<ToolResponse>;
 export declare function publishFrontendRelease(http: FrontendReleaseHttp, projectRef: string, deploymentId: string, archiveSource: string | (() => Promise<{
     archivePath: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.111.0",
+  "version": "0.112.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",