@supacloud/cli 0.112.1 → 0.113.0

package/README.md

@@ -1002,10 +1002,14 @@ supacloud lite db_pull --project_dir . --file remote_schema
 supacloud lite db_pull --project_dir . --file reviewed_schema --baseline
 supacloud lite gen_types --project_dir . --output src/database.types.ts
 supacloud lite snapshot_create --project_dir . --output backups/lite.tar.gz
-supacloud lite doctor --project_dir . --json
-supacloud lite start --project_dir . --port 54321
+supacloud lite doctor --project_dir . --json --production --runtime_mode strict
+supacloud lite db_check --project_dir . --module_file supabase/db/modules.ts
+supacloud lite start --project_dir . --port 54321 --runtime_mode strict
 ```
 
+`auth create-user` is not exposed here. The standalone `supacloud-lite` binary
+reads the password from stdin and rejects password arguments.
+
 The adapter resolves the executable in this order:
 
 1. `SUPACLOUD_LITE_CLI_BIN`

package/dist/index.js

@@ -9318,6 +9318,7 @@ var ACTION_POLICY = {
       "db_reset",
       "db_diff",
       "db_pull",
+      "db_check",
       "snapshot_create",
       "snapshot_restore",
       "upgrade",
@@ -10841,6 +10842,10 @@ var ApplicationPreviewReceiptSchema = _Object_({
       status: phaseStatus,
       activation_id: Union([ApplicationActivationIdSchema, Null()])
     }, closed4),
+    functions: Optional(_Object_({
+      status: phaseStatus,
+      slugs: _Array_(String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }), { maxItems: 64 })
+    }, closed4)),
     smoke_test: _Object_({
       status: phaseStatus,
       checks: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 32 }),
@@ -16376,6 +16381,16 @@ Actions: list, get_config, deploy, deploy_bundle, config, source, activate, dele
       const tmpFile = join5(tmpDir, "index.ts");
       writeFileSync(tmpFile, sourceCode);
       try {
+        if (/@ts-(?:ignore|nocheck|expect-error)\b/.test(sourceCode)) {
+          const { scanProductionSource } = await import("@supacloud/compiler");
+          const suppression = scanProductionSource({ rootDir: tmpDir, include: ["index.ts"] }).find((diagnostic) => diagnostic.code === "source-type-suppression");
+          if (suppression) {
+            return {
+              ok: false,
+              err: `Vibecoding guardrail violation: Type suppression directive at line ${suppression.line} is disallowed in Edge Functions. Please fix the underlying type mismatch instead of suppressing it.`
+            };
+          }
+        }
         await runBunBuild([tmpFile, "--external", "*"]);
         return { ok: true };
       } catch (error) {
@@ -17937,6 +17952,10 @@ var ApplicationPreviewReceiptSchema2 = _Object_({
     test_secret: _Object_({ status: phase, name, value_issued: Literal(false) }, closed9),
     configuration_revision: _Object_({ status: phase, configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]) }, closed9),
     application_activation: _Object_({ status: phase, activation_id: nullableUuid }, closed9),
+    functions: Optional(_Object_({
+      status: phase,
+      slugs: _Array_(String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }), { maxItems: 64, uniqueItems: true })
+    }, closed9)),
     smoke_test: _Object_({ status: phase, checks, passed: checks, failed: checks }, closed9)
   }, closed9),
   cleanup: _Object_({
@@ -18109,6 +18128,10 @@ var receiptSchema = _Object_({
     test_secret: _Object_({ status: phase2, name: String2({ pattern: "^[A-Z0-9_-]{1,128}$" }), value_issued: Literal(false) }, strict),
     configuration_revision: _Object_({ status: phase2, configuration_id: revision }, strict),
     application_activation: _Object_({ status: phase2, activation_id: Union([previewIdSchema, Null()]) }, strict),
+    functions: Optional(_Object_({
+      status: phase2,
+      slugs: _Array_(String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }), { maxItems: 64, uniqueItems: true })
+    }, strict)),
     smoke_test: _Object_({ status: phase2, checks: checks2, passed: checks2, failed: checks2 }, strict)
   }, strict),
   cleanup: _Object_({
@@ -18163,7 +18186,7 @@ function receipt(value, identity) {
       throw new Error("Incomplete preview readiness");
     }
   }
-  if (value.status === "cleaned" && (!value.cleanup.completed || value.cleanup.required || [
+  if (value.status === "cleaned" && (!value.cleanup.completed || value.cleanup.required || value.resources.functions !== undefined && value.resources.functions.status !== "cleaned" || [
     value.resources.database_branch,
     value.resources.queue_namespace,
     value.resources.storage_namespace,
@@ -21418,6 +21441,9 @@ function buildLiteArgs(request) {
       if (request.file)
         args.push(request.file);
       break;
+    case "db_check":
+      args.push("db", "check");
+      break;
     case "snapshot_create":
       args.push("snapshot", "create");
       break;
@@ -21456,6 +21482,17 @@ function buildLiteArgs(request) {
   if (request.baseline && request.action !== "db_pull")
     throw new Error("baseline requires db_pull");
   booleanFlag(args, "--baseline", request.baseline);
+  if (request.production && request.action !== "doctor")
+    throw new Error("production requires doctor");
+  booleanFlag(args, "--production", request.production);
+  if (request.module_file && request.action !== "db_check")
+    throw new Error("module_file requires db_check");
+  optionalFlag(args, "--module-file", request.module_file);
+  optionalFlag(args, "--runtime-mode", request.runtime_mode);
+  optionalFlag(args, "--postgres-dir", request.postgres_dir);
+  optionalFlag(args, "--identity-module", request.identity_module);
+  optionalFlag(args, "--external-auth-proxy-issuer", request.external_auth_proxy_issuer);
+  optionalFlag(args, "--external-auth-proxy-redirect-origin", request.external_auth_proxy_redirect_origin);
   return args;
 }
 async function spawnLiteCommand(command, workdir, environment, inheritOutput) {
@@ -21538,7 +21575,8 @@ function registerLiteCliTools(server, options = {}) {
       "snapshot_restore",
       "upgrade",
       "inspect",
-      "doctor"
+      "doctor",
+      "db_check"
     ]), "Lite CLI action"),
     workdir: optional(String2(), "[*] Process working directory (default: current directory)"),
     project_dir: optional(String2(), "[*] Project containing supabase/"),
@@ -21566,7 +21604,14 @@ function registerLiteCliTools(server, options = {}) {
     force: optional(Boolean2(), "[snapshot_restore] Replace non-empty restore targets"),
     memory: optional(Boolean2(), "[*] Use an in-memory PGlite database"),
     json: optional(Boolean2(), "[doctor] Emit machine-readable output"),
-    baseline: optional(Boolean2(), "[db_pull] Record already-present schema in local migration history after review")
+    baseline: optional(Boolean2(), "[db_pull] Record already-present schema in local migration history after review"),
+    production: optional(Boolean2(), "[doctor] Add single-node production readiness checks"),
+    runtime_mode: optional(stringEnum2(["development", "strict"]), "[*] Lite runtime mode"),
+    postgres_dir: optional(String2(), "[native] Operator-managed PostgreSQL installation"),
+    identity_module: optional(String2(), "[*] Trusted external identity bridge module"),
+    external_auth_proxy_issuer: optional(String2(), "[start] Same-origin OAuth proxy issuer"),
+    external_auth_proxy_redirect_origin: optional(String2(), "[start] Allowed logout redirect origins"),
+    module_file: optional(String2(), "[db_check] Database module manifest")
   }, async (request) => {
     buildLiteArgs(request);
     const execution = await execute(request);
@@ -21950,16 +21995,16 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.52.1"
+      version: "0.53.0"
     },
     app: {
-      version: "0.34.1",
+      version: "0.35.0",
       dependencies: {
         rxjs: "7.8.2"
       }
     },
     elysia: {
-      version: "0.36.3"
+      version: "0.37.0"
     },
     commands: {
       version: "0.11.2"
@@ -21968,7 +22013,7 @@ var starter_metadata_default = {
       version: "0.15.2"
     },
     db: {
-      version: "0.20.2",
+      version: "0.20.3",
       peerDependencies: {
         "drizzle-orm": "1.0.0-rc.5-5935859"
       },
@@ -21977,7 +22022,7 @@ var starter_metadata_default = {
       }
     },
     sdk: {
-      version: "0.45.4",
+      version: "0.45.5",
       peerDependencies: {
         "@supabase/supabase-js": "^2.118.0"
       }
@@ -33586,7 +33631,7 @@ async function runProjectDeployment(http, args) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.112.1",
+  version: "0.113.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -33638,19 +33683,19 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.52.1",
-    "@supacloud/delivery": "0.23.1",
-    "@supacloud/db": "0.20.2",
+    "@supacloud/compiler": "^0.53.0",
+    "@supacloud/delivery": "0.24.0",
+    "@supacloud/db": "0.20.3",
     typebox: "1.4.3"
   },
   overrides: {
     "@supacloud/contracts": "0.15.2",
-    "@supacloud/delivery": "0.23.1",
+    "@supacloud/delivery": "0.24.0",
     "@graphql-tools/utils": "^12.0.4"
   },
   devDependencies: {
     "@supabase/supabase-js": "2.118.0",
-    "@supacloud/elysia": "0.36.3",
+    "@supacloud/elysia": "0.37.0",
     "@types/bun": "^1.4.4",
     effect: "4.0.5",
     elysia: "2.0.0-rc.0",

package/dist/shared/tools/application-preview-tools.d.ts

@@ -50,6 +50,10 @@ declare const receiptSchema: Type.TObject<{
             status: Type.TEnum<("cleaned" | "failed" | "pending" | "ready")[]>;
             activation_id: Type.TUnion<[Type.TString, Type.TNull]>;
         }>;
+        functions: Type.TOptional<Type.TObject<{
+            status: Type.TEnum<("cleaned" | "failed" | "pending" | "ready")[]>;
+            slugs: Type.TArray<Type.TString>;
+        }>>;
         smoke_test: Type.TObject<{
             status: Type.TEnum<("cleaned" | "failed" | "pending" | "ready")[]>;
             checks: Type.TArray<Type.TString>;

package/dist/shared/tools/application-workflow-schemas.d.ts

@@ -64,6 +64,10 @@ export declare const ApplicationPreviewReceiptSchema: Type.TObject<{
             status: Type.TUnion<[Type.TLiteral<"pending">, Type.TLiteral<"ready">, Type.TLiteral<"failed">, Type.TLiteral<"cleaned">]>;
             activation_id: Type.TUnion<[Type.TString, Type.TNull]>;
         }>;
+        functions: Type.TOptional<Type.TObject<{
+            status: Type.TUnion<[Type.TLiteral<"pending">, Type.TLiteral<"ready">, Type.TLiteral<"failed">, Type.TLiteral<"cleaned">]>;
+            slugs: Type.TArray<Type.TString>;
+        }>>;
         smoke_test: Type.TObject<{
             status: Type.TUnion<[Type.TLiteral<"pending">, Type.TLiteral<"ready">, Type.TLiteral<"failed">, Type.TLiteral<"cleaned">]>;
             checks: Type.TArray<Type.TString>;
@@ -151,6 +155,10 @@ export declare function parsePreviewReceipt(value: unknown, identity: Applicatio
             status: "cleaned" | "failed" | "pending" | "ready";
             activation_id: string | null;
         };
+        functions?: {
+            status: "cleaned" | "failed" | "pending" | "ready";
+            slugs: string[];
+        } | undefined;
         smoke_test: {
             status: "cleaned" | "failed" | "pending" | "ready";
             checks: string[];
@@ -214,6 +222,10 @@ export declare function parsePreviewList(value: unknown, identity: ApplicationWo
                 status: "cleaned" | "failed" | "pending" | "ready";
                 activation_id: string | null;
             };
+            functions?: {
+                status: "cleaned" | "failed" | "pending" | "ready";
+                slugs: string[];
+            } | undefined;
             smoke_test: {
                 status: "cleaned" | "failed" | "pending" | "ready";
                 checks: string[];

package/dist/shared/tools/lite-cli-tools.d.ts

@@ -1,6 +1,6 @@
 export { resolveLiteCommand } from "./lite-cli-command";
 import { type ToolServer } from "../tool-server";
-export type LiteCliAction = "version" | "start" | "migrate" | "status" | "keys" | "gen_types" | "db_reset" | "db_diff" | "db_pull" | "snapshot_create" | "snapshot_restore" | "upgrade" | "inspect" | "doctor";
+export type LiteCliAction = "version" | "start" | "migrate" | "status" | "keys" | "gen_types" | "db_reset" | "db_diff" | "db_pull" | "db_check" | "snapshot_create" | "snapshot_restore" | "upgrade" | "inspect" | "doctor";
 export interface LiteCliArgs {
     action: LiteCliAction;
     workdir?: string;
@@ -30,6 +30,13 @@ export interface LiteCliArgs {
     memory?: boolean;
     json?: boolean;
     baseline?: boolean;
+    production?: boolean;
+    runtime_mode?: "development" | "strict";
+    postgres_dir?: string;
+    identity_module?: string;
+    external_auth_proxy_issuer?: string;
+    external_auth_proxy_redirect_origin?: string;
+    module_file?: string;
 }
 export interface LiteCliExecutionResult {
     exitCode: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.112.1",
+  "version": "0.113.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,19 +52,19 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@supacloud/compiler": "^0.52.1",
-    "@supacloud/delivery": "0.23.1",
-    "@supacloud/db": "0.20.2",
+    "@supacloud/compiler": "^0.53.0",
+    "@supacloud/delivery": "0.24.0",
+    "@supacloud/db": "0.20.3",
     "typebox": "1.4.3"
   },
   "overrides": {
     "@supacloud/contracts": "0.15.2",
-    "@supacloud/delivery": "0.23.1",
+    "@supacloud/delivery": "0.24.0",
     "@graphql-tools/utils": "^12.0.4"
   },
   "devDependencies": {
     "@supabase/supabase-js": "2.118.0",
-    "@supacloud/elysia": "0.36.3",
+    "@supacloud/elysia": "0.37.0",
     "@types/bun": "^1.4.4",
     "effect": "4.0.5",
     "elysia": "2.0.0-rc.0",

package/skills/supacloud/references/command-map.md

@@ -19,7 +19,7 @@ Load this reference when selecting a command surface or when a user asks an AI t
 | Pull official Supabase configuration | `supabase config_pull` | Preview by default; local write requires `dry_run=false` and `yes`; not SupaCloud settings |
 | Run the official local stack | `supabase stack_start`, `stack_prepare`, `stack_status`, `stack_stop` | Docker default; native alpha requires `SUPACLOUD_ENABLE_NATIVE_STACK=1` |
 | Remove the official local stack | `supabase stack_destroy` | Local data loss; requires `confirm_destroy` and `yes` |
-| Capture Lite drift | `lite db_diff`, `lite db_pull` | Draft outside migrations; only reviewed already-present DDL may use `baseline` |
+| Capture Lite drift | `lite db_diff`, `lite db_pull`, `lite db_check` | Draft outside migrations; only reviewed already-present DDL may use `baseline`; `db_check` is read-only |
 | Rebuild local database | `supabase db_reset` | Local only; preserve required seed behavior |
 | Inspect or back up a remote database | `supabase db_pull`, `migration_list`, `db_dump`, `gen_types` | Requires explicit PostgreSQL DSN; redact it |
 | Replay the release-canary fixture stage receipt | `release release_canary_fixture_stage_replay` | Dual-bind Management project context and that project's service-role application origin; accepts only the exact subject/request UUID pair and a strict idempotent receipt |