@supacloud/cli 0.112.1 → 0.112.2

package/README.md

@@ -1002,10 +1002,14 @@ supacloud lite db_pull --project_dir . --file remote_schema
 supacloud lite db_pull --project_dir . --file reviewed_schema --baseline
 supacloud lite gen_types --project_dir . --output src/database.types.ts
 supacloud lite snapshot_create --project_dir . --output backups/lite.tar.gz
-supacloud lite doctor --project_dir . --json
-supacloud lite start --project_dir . --port 54321
+supacloud lite doctor --project_dir . --json --production --runtime_mode strict
+supacloud lite db_check --project_dir . --module_file supabase/db/modules.ts
+supacloud lite start --project_dir . --port 54321 --runtime_mode strict
 ```
 
+`auth create-user` is not exposed here. The standalone `supacloud-lite` binary
+reads the password from stdin and rejects password arguments.
+
 The adapter resolves the executable in this order:
 
 1. `SUPACLOUD_LITE_CLI_BIN`

package/dist/index.js

@@ -9318,6 +9318,7 @@ var ACTION_POLICY = {
       "db_reset",
       "db_diff",
       "db_pull",
+      "db_check",
       "snapshot_create",
       "snapshot_restore",
       "upgrade",
@@ -16376,6 +16377,16 @@ Actions: list, get_config, deploy, deploy_bundle, config, source, activate, dele
       const tmpFile = join5(tmpDir, "index.ts");
       writeFileSync(tmpFile, sourceCode);
       try {
+        if (/@ts-(?:ignore|nocheck|expect-error)\b/.test(sourceCode)) {
+          const { scanProductionSource } = await import("@supacloud/compiler");
+          const suppression = scanProductionSource({ rootDir: tmpDir, include: ["index.ts"] }).find((diagnostic) => diagnostic.code === "source-type-suppression");
+          if (suppression) {
+            return {
+              ok: false,
+              err: `Vibecoding guardrail violation: Type suppression directive at line ${suppression.line} is disallowed in Edge Functions. Please fix the underlying type mismatch instead of suppressing it.`
+            };
+          }
+        }
         await runBunBuild([tmpFile, "--external", "*"]);
         return { ok: true };
       } catch (error) {
@@ -21418,6 +21429,9 @@ function buildLiteArgs(request) {
       if (request.file)
         args.push(request.file);
       break;
+    case "db_check":
+      args.push("db", "check");
+      break;
     case "snapshot_create":
       args.push("snapshot", "create");
       break;
@@ -21456,6 +21470,17 @@ function buildLiteArgs(request) {
   if (request.baseline && request.action !== "db_pull")
     throw new Error("baseline requires db_pull");
   booleanFlag(args, "--baseline", request.baseline);
+  if (request.production && request.action !== "doctor")
+    throw new Error("production requires doctor");
+  booleanFlag(args, "--production", request.production);
+  if (request.module_file && request.action !== "db_check")
+    throw new Error("module_file requires db_check");
+  optionalFlag(args, "--module-file", request.module_file);
+  optionalFlag(args, "--runtime-mode", request.runtime_mode);
+  optionalFlag(args, "--postgres-dir", request.postgres_dir);
+  optionalFlag(args, "--identity-module", request.identity_module);
+  optionalFlag(args, "--external-auth-proxy-issuer", request.external_auth_proxy_issuer);
+  optionalFlag(args, "--external-auth-proxy-redirect-origin", request.external_auth_proxy_redirect_origin);
   return args;
 }
 async function spawnLiteCommand(command, workdir, environment, inheritOutput) {
@@ -21538,7 +21563,8 @@ function registerLiteCliTools(server, options = {}) {
       "snapshot_restore",
       "upgrade",
       "inspect",
-      "doctor"
+      "doctor",
+      "db_check"
     ]), "Lite CLI action"),
     workdir: optional(String2(), "[*] Process working directory (default: current directory)"),
     project_dir: optional(String2(), "[*] Project containing supabase/"),
@@ -21566,7 +21592,14 @@ function registerLiteCliTools(server, options = {}) {
     force: optional(Boolean2(), "[snapshot_restore] Replace non-empty restore targets"),
     memory: optional(Boolean2(), "[*] Use an in-memory PGlite database"),
     json: optional(Boolean2(), "[doctor] Emit machine-readable output"),
-    baseline: optional(Boolean2(), "[db_pull] Record already-present schema in local migration history after review")
+    baseline: optional(Boolean2(), "[db_pull] Record already-present schema in local migration history after review"),
+    production: optional(Boolean2(), "[doctor] Add single-node production readiness checks"),
+    runtime_mode: optional(stringEnum2(["development", "strict"]), "[*] Lite runtime mode"),
+    postgres_dir: optional(String2(), "[native] Operator-managed PostgreSQL installation"),
+    identity_module: optional(String2(), "[*] Trusted external identity bridge module"),
+    external_auth_proxy_issuer: optional(String2(), "[start] Same-origin OAuth proxy issuer"),
+    external_auth_proxy_redirect_origin: optional(String2(), "[start] Allowed logout redirect origins"),
+    module_file: optional(String2(), "[db_check] Database module manifest")
   }, async (request) => {
     buildLiteArgs(request);
     const execution = await execute(request);
@@ -21950,16 +21983,16 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.52.1"
+      version: "0.52.2"
     },
     app: {
-      version: "0.34.1",
+      version: "0.35.0",
       dependencies: {
         rxjs: "7.8.2"
       }
     },
     elysia: {
-      version: "0.36.3"
+      version: "0.37.0"
     },
     commands: {
       version: "0.11.2"
@@ -21968,7 +22001,7 @@ var starter_metadata_default = {
       version: "0.15.2"
     },
     db: {
-      version: "0.20.2",
+      version: "0.20.3",
       peerDependencies: {
         "drizzle-orm": "1.0.0-rc.5-5935859"
       },
@@ -21977,7 +22010,7 @@ var starter_metadata_default = {
       }
     },
     sdk: {
-      version: "0.45.4",
+      version: "0.45.5",
       peerDependencies: {
         "@supabase/supabase-js": "^2.118.0"
       }
@@ -33586,7 +33619,7 @@ async function runProjectDeployment(http, args) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.112.1",
+  version: "0.112.2",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -33638,9 +33671,9 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.52.1",
+    "@supacloud/compiler": "^0.52.2",
     "@supacloud/delivery": "0.23.1",
-    "@supacloud/db": "0.20.2",
+    "@supacloud/db": "0.20.3",
     typebox: "1.4.3"
   },
   overrides: {
@@ -33650,7 +33683,7 @@ var package_default = {
   },
   devDependencies: {
     "@supabase/supabase-js": "2.118.0",
-    "@supacloud/elysia": "0.36.3",
+    "@supacloud/elysia": "0.37.0",
     "@types/bun": "^1.4.4",
     effect: "4.0.5",
     elysia: "2.0.0-rc.0",

package/dist/shared/tools/lite-cli-tools.d.ts

@@ -1,6 +1,6 @@
 export { resolveLiteCommand } from "./lite-cli-command";
 import { type ToolServer } from "../tool-server";
-export type LiteCliAction = "version" | "start" | "migrate" | "status" | "keys" | "gen_types" | "db_reset" | "db_diff" | "db_pull" | "snapshot_create" | "snapshot_restore" | "upgrade" | "inspect" | "doctor";
+export type LiteCliAction = "version" | "start" | "migrate" | "status" | "keys" | "gen_types" | "db_reset" | "db_diff" | "db_pull" | "db_check" | "snapshot_create" | "snapshot_restore" | "upgrade" | "inspect" | "doctor";
 export interface LiteCliArgs {
     action: LiteCliAction;
     workdir?: string;
@@ -30,6 +30,13 @@ export interface LiteCliArgs {
     memory?: boolean;
     json?: boolean;
     baseline?: boolean;
+    production?: boolean;
+    runtime_mode?: "development" | "strict";
+    postgres_dir?: string;
+    identity_module?: string;
+    external_auth_proxy_issuer?: string;
+    external_auth_proxy_redirect_origin?: string;
+    module_file?: string;
 }
 export interface LiteCliExecutionResult {
     exitCode: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.112.1",
+  "version": "0.112.2",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,9 +52,9 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@supacloud/compiler": "^0.52.1",
+    "@supacloud/compiler": "^0.52.2",
     "@supacloud/delivery": "0.23.1",
-    "@supacloud/db": "0.20.2",
+    "@supacloud/db": "0.20.3",
     "typebox": "1.4.3"
   },
   "overrides": {
@@ -64,7 +64,7 @@
   },
   "devDependencies": {
     "@supabase/supabase-js": "2.118.0",
-    "@supacloud/elysia": "0.36.3",
+    "@supacloud/elysia": "0.37.0",
     "@types/bun": "^1.4.4",
     "effect": "4.0.5",
     "elysia": "2.0.0-rc.0",

package/skills/supacloud/references/command-map.md

@@ -19,7 +19,7 @@ Load this reference when selecting a command surface or when a user asks an AI t
 | Pull official Supabase configuration | `supabase config_pull` | Preview by default; local write requires `dry_run=false` and `yes`; not SupaCloud settings |
 | Run the official local stack | `supabase stack_start`, `stack_prepare`, `stack_status`, `stack_stop` | Docker default; native alpha requires `SUPACLOUD_ENABLE_NATIVE_STACK=1` |
 | Remove the official local stack | `supabase stack_destroy` | Local data loss; requires `confirm_destroy` and `yes` |
-| Capture Lite drift | `lite db_diff`, `lite db_pull` | Draft outside migrations; only reviewed already-present DDL may use `baseline` |
+| Capture Lite drift | `lite db_diff`, `lite db_pull`, `lite db_check` | Draft outside migrations; only reviewed already-present DDL may use `baseline`; `db_check` is read-only |
 | Rebuild local database | `supabase db_reset` | Local only; preserve required seed behavior |
 | Inspect or back up a remote database | `supabase db_pull`, `migration_list`, `db_dump`, `gen_types` | Requires explicit PostgreSQL DSN; redact it |
 | Replay the release-canary fixture stage receipt | `release release_canary_fixture_stage_replay` | Dual-bind Management project context and that project's service-role application origin; accepts only the exact subject/request UUID pair and a strict idempotent receipt |