@supacloud/cli 0.17.0 → 0.18.0

package/README.md

@@ -212,10 +212,10 @@ already exist. Add the positive version observed from `list` as
 pointer; this remains correct across an active-version A→B→A transition.
 
 `deploy`, `deploy_bundle`, and `activate` require
-`--expected-active-version <N|absent>`. Read the current positive integer
-version from `edge_functions list`; use `absent` only when creating a slug that
-does not yet exist. A stale value returns HTTP 409 without building, preheating,
-or activating another version. List output remains a JSON array with string
+`--expected-active-version <N|absent>`. Read the current non-negative integer
+version from `edge_functions list`; use `0` for a listed legacy Function and
+`absent` only when creating a slug that does not yet exist. A stale value returns
+HTTP 409 without building, preheating, or activating another version. List output remains a JSON array with string
 `slug` and numeric `version` fields, while source output is exactly
 `{ "code": "..." }`. Release automation must use `source --version <N>` for a
 version-bound backup.
@@ -228,9 +228,13 @@ server response body.
 Mutation receipts use schema `supacloud.cli.release-control.v1`. An
 `OUTCOME_UNKNOWN` error means the server may have committed the mutation before
 the response was lost or failed validation; read back current state before any
-retry.
-Version `0` is reserved for service-internal legacy recovery and cannot be used
-as a public CLI/API activation target or expected active version.
+retry. For Function deploy, bundle deploy, and activation, the CLI applies a
+separate 5-second, 64 KiB response-body boundary after receiving HTTP headers.
+A stalled, oversized, truncated, unreadable, or malformed body is always
+`OUTCOME_UNKNOWN` and its content is never included in CLI output.
+Version `0` is reserved as the active-version CAS token for legacy Functions. It
+can be passed only as `--expected-active-version`; immutable source reads and
+activation targets still require a positive version.
 
 ```json
 {

package/dist/index.js

@@ -6576,6 +6576,8 @@ function validateExecutionPolicyCoverage(tools) {
 
 // src/shared/transports/http.ts
 var DEFAULT_TIMEOUT = 30000;
+var RELEASE_MUTATION_RESPONSE_TIMEOUT = 5000;
+var RELEASE_MUTATION_RESPONSE_MAX_BYTES = 64 * 1024;
 var MAX_RETRIES = 2;
 var RETRY_BASE_DELAY = 500;
 function isRetryableMethod(method) {
@@ -6598,6 +6600,14 @@ function transportFailure(error) {
     transportError: true
   };
 }
+function responseReadFailure(status) {
+  return {
+    ok: false,
+    status,
+    data: { error: "Response body unavailable", code: "RESPONSE_READ_ERROR" },
+    responseReadError: true
+  };
+}
 async function fetchWithTimeout(url, options) {
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
@@ -6647,41 +6657,114 @@ function joinedResponseBytes(chunks, totalBytes) {
   }
   return responseBytes;
 }
-async function responseBytesWithinLimit(response, maxBytes) {
-  if (declaredResponseTooLarge(response, maxBytes)) {
-    await response.body?.cancel();
-    return null;
-  }
-  if (!response.body)
-    return new Uint8Array;
-  const reader = response.body.getReader();
+function cancelResponseReader(reader) {
+  reader.cancel().catch(() => {
+    return;
+  });
+}
+function serializedRequestBody(body) {
+  return body ? JSON.stringify(body) : undefined;
+}
+async function responseBytesFromReader(reader, maxBytes, declaredBytes) {
   const chunks = [];
   let totalBytes = 0;
   while (true) {
     const { done, value } = await reader.read();
-    if (done)
-      return joinedResponseBytes(chunks, totalBytes);
+    if (done) {
+      if (declaredBytes !== null && totalBytes !== declaredBytes)
+        return { ok: false };
+      return { ok: true, bytes: joinedResponseBytes(chunks, totalBytes) };
+    }
     totalBytes += value.byteLength;
     if (totalBytes > maxBytes) {
-      await reader.cancel();
-      return null;
+      cancelResponseReader(reader);
+      return { ok: false };
     }
     chunks.push(value);
   }
 }
+async function responseBytesWithinLimit(response, maxBytes) {
+  if (declaredResponseTooLarge(response, maxBytes)) {
+    await response.body?.cancel();
+    return null;
+  }
+  if (!response.body)
+    return new Uint8Array;
+  const reader = response.body.getReader();
+  const bodyRead = await responseBytesFromReader(reader, maxBytes, null);
+  return bodyRead.ok ? bodyRead.bytes : null;
+}
 function parsedUtf8Json(responseBytes) {
   try {
     const responseText = new TextDecoder("utf-8", { fatal: true }).decode(responseBytes);
-    return JSON.parse(responseText);
+    return { ok: true, parsedJson: JSON.parse(responseText) };
   } catch (error) {
     if (error instanceof SyntaxError || error instanceof TypeError)
-      return null;
+      return { ok: false };
     throw error;
   }
 }
 async function boundedResponseJson(response, maxBytes) {
   const responseBytes = await responseBytesWithinLimit(response, maxBytes);
-  return responseBytes === null ? null : parsedUtf8Json(responseBytes);
+  if (responseBytes === null)
+    return null;
+  const parsed = parsedUtf8Json(responseBytes);
+  return parsed.ok ? parsed.parsedJson : null;
+}
+function declaredIdentityResponseBytes(response) {
+  const contentEncoding = response.headers.get("content-encoding");
+  if (contentEncoding !== null && contentEncoding.toLowerCase() !== "identity")
+    return null;
+  const contentLength = response.headers.get("content-length");
+  if (contentLength === null)
+    return null;
+  if (!/^\d+$/.test(contentLength))
+    return "invalid";
+  const declaredBytes = Number(contentLength);
+  return Number.isSafeInteger(declaredBytes) ? declaredBytes : "invalid";
+}
+async function releaseMutationResponseBytes(response) {
+  const declaredBytes = declaredIdentityResponseBytes(response);
+  if (declaredBytes === "invalid" || declaredBytes !== null && declaredBytes > RELEASE_MUTATION_RESPONSE_MAX_BYTES) {
+    response.body?.cancel().catch(() => {
+      return;
+    });
+    return { ok: false };
+  }
+  if (!response.body) {
+    return declaredBytes === null || declaredBytes === 0 ? { ok: true, bytes: new Uint8Array } : { ok: false };
+  }
+  return responseBytesBeforeDeadline(response.body.getReader(), declaredBytes);
+}
+async function responseBytesBeforeDeadline(reader, declaredBytes) {
+  let deadlineTimer;
+  const deadline = new Promise((resolve2) => {
+    deadlineTimer = setTimeout(() => {
+      cancelResponseReader(reader);
+      resolve2({ ok: false });
+    }, RELEASE_MUTATION_RESPONSE_TIMEOUT);
+  });
+  try {
+    return await Promise.race([
+      responseBytesFromReader(reader, RELEASE_MUTATION_RESPONSE_MAX_BYTES, declaredBytes),
+      deadline
+    ]);
+  } catch {
+    cancelResponseReader(reader);
+    return { ok: false };
+  } finally {
+    clearTimeout(deadlineTimer);
+  }
+}
+async function releaseMutationResponseJson(response) {
+  const responseBytes = await releaseMutationResponseBytes(response);
+  if (!responseBytes.ok)
+    return { ok: false };
+  const parsed = parsedUtf8Json(responseBytes.bytes);
+  return parsed.ok ? { ok: true, parsedJson: parsed.parsedJson } : { ok: false };
+}
+async function responseJsonOrNull(response) {
+  return { ok: true, parsedJson: await response.json().catch(() => null) };
 }
 
 class HttpTransport {
@@ -6697,6 +6780,19 @@ class HttpTransport {
       "Content-Type": "application/json"
     };
   }
+  async postWithResponseReader(path, serializedBody, responseReader) {
+    try {
+      const response = await fetchWithRetry(`${this.baseUrl}${path}`, {
+        method: "POST",
+        headers: this.headers(),
+        body: serializedBody
+      });
+      const responseBody = await responseReader(response);
+      return responseBody.ok ? { ok: response.ok, status: response.status, data: responseBody.parsedJson } : responseReadFailure(response.status);
+    } catch (error) {
+      return transportFailure(error);
+    }
+  }
   async get(path, options = {}) {
     try {
       const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
@@ -6711,17 +6807,14 @@ class HttpTransport {
   }
   async post(path, body) {
     try {
-      const res = await fetchWithRetry(`${this.baseUrl}${path}`, {
-        method: "POST",
-        headers: this.headers(),
-        body: body ? JSON.stringify(body) : undefined
-      });
-      const data = await res.json().catch(() => null);
-      return { ok: res.ok, status: res.status, data };
+      return await this.postWithResponseReader(path, serializedRequestBody(body), responseJsonOrNull);
     } catch (error) {
       return transportFailure(error);
     }
   }
+  async postReleaseMutation(path, body) {
+    return this.postWithResponseReader(path, serializedRequestBody(body), releaseMutationResponseJson);
+  }
   async postMultipart(path, formData) {
     try {
       const headers = { Authorization: `Bearer ${this.token}` };
@@ -7886,7 +7979,7 @@ function releaseControlFailure(operation, code, httpStatus) {
   });
 }
 function releaseControlMutationFailure(operation, response) {
-  const outcomeUnknown = response.transportError || response.status === 408 || response.status >= 500;
+  const outcomeUnknown = response.transportError || response.responseReadError || response.status === 408 || response.status >= 500;
   return outcomeUnknown ? releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.transportError ? null : response.status) : releaseControlFailure(operation, "HTTP_ERROR", response.status);
 }
 function releaseControlResponse(payload) {
@@ -8523,6 +8616,17 @@ function positiveFunctionVersion(input, label) {
   }
   return version;
 }
+function activeFunctionVersionToken(input) {
+  if (typeof input !== "string" && typeof input !== "number") {
+    throw new Error("Expected active version must be a canonical non-negative safe integer");
+  }
+  const version = String(input);
+  if (!CANONICAL_FUNCTION_VERSION_PATTERN.test(version) || !Number.isSafeInteger(Number(version))) {
+    throw new Error("Expected active version must be a canonical non-negative safe integer");
+  }
+  return version;
+}
+var CANONICAL_FUNCTION_VERSION_PATTERN = /^(?:0|[1-9][0-9]*)$/;
 var POSITIVE_FUNCTION_VERSION_PATTERN = /^[1-9][0-9]*$/;
 var SAFE_FUNCTION_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 var FUNCTION_ACTIVATION_ARGUMENTS = new Set([
@@ -8539,15 +8643,15 @@ var functionVersionSchema = Type.Optional(decodedSchema(Type.Union([
 function parseExpectedActiveVersion(input) {
   if (input === "absent")
     return input;
-  return positiveFunctionVersion(input, "Expected active version");
+  return activeFunctionVersionToken(input);
 }
 var expectedActiveVersionSchema = Type.Optional(decodedSchema(Type.Union([
   Type.Literal("absent"),
-  Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),
-  Type.String({ pattern: POSITIVE_FUNCTION_VERSION_PATTERN.source, maxLength: 16 })
+  Type.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),
+  Type.String({ pattern: CANONICAL_FUNCTION_VERSION_PATTERN.source, maxLength: 16 })
 ]), Type.Union([
   Type.Literal("absent"),
-  Type.String({ pattern: POSITIVE_FUNCTION_VERSION_PATTERN.source, maxLength: 16 })
+  Type.String({ pattern: CANONICAL_FUNCTION_VERSION_PATTERN.source, maxLength: 16 })
 ]), parseExpectedActiveVersion));
 var secretListSchema = Type.Array(Type.Object({ name: Type.String(), value: Type.String() }));
 var ENVIRONMENT_SECRET_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]{0,255}$/;
@@ -8679,7 +8783,7 @@ function safeFunctionList(payload) {
     const edgeFunction = objectRecord(candidate);
     const slug = edgeFunction?.slug;
     const version = edgeFunction?.version;
-    if (typeof slug !== "string" || !SAFE_FUNCTION_SLUG_PATTERN.test(slug) || typeof version !== "number" || !Number.isSafeInteger(version) || version < 1 || functionSlugs.has(slug))
+    if (typeof slug !== "string" || !SAFE_FUNCTION_SLUG_PATTERN.test(slug) || typeof version !== "number" || !Number.isSafeInteger(version) || version < 0 || functionSlugs.has(slug))
       return null;
     functionSlugs.add(slug);
   }
@@ -8828,7 +8932,7 @@ async function activateFunctionVersion(http, args, readOnly = false) {
     slug: functionSlug,
     expectedActiveVersion,
     targetVersion: version
-  }, await http.post(endpoint, { expected_active_version: expectedActiveVersion }));
+  }, await http.postReleaseMutation(endpoint, { expected_active_version: expectedActiveVersion }));
 }
 function registerAdvancedTools(server, http, environment = process.env, options = {}) {
   server.tool("edge_functions", `Edge Function management (Deno/Bun serverless). Source deploys are bundled; verified prebuilt artifacts stay byte-exact.
@@ -8920,7 +9024,7 @@ ${deployCheck.err}`;
             break;
           }
         }
-        const deploymentResponse = await http.post(edgeFunctionResourcePath(ref, slug), {
+        const deploymentResponse = await http.postReleaseMutation(edgeFunctionResourcePath(ref, slug), {
           code: deployCode.code,
           ...deployCode.prebundled ? { prebundled: true, expected_sha256: deployCode.expectedSha256 } : { minify },
           expected_active_version: expectedActiveVersion,
@@ -8936,7 +9040,7 @@ ${deployCheck.err}`;
       case "deploy_bundle":
         need("slug", slug);
         need("files", files);
-        const bundleResponse = await http.post(`${edgeFunctionResourcePath(ref, slug)}/bundle`, {
+        const bundleResponse = await http.postReleaseMutation(`${edgeFunctionResourcePath(ref, slug)}/bundle`, {
           files,
           entrypoint,
           minify,
@@ -11267,7 +11371,7 @@ var SCHEDULE_TOOL_SCHEMA = {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.17.0",
+  version: "0.18.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",

package/skills/supacloud-cli/references/command-map.md

@@ -31,7 +31,7 @@ until a project-scoped context is resolved.
 - `supabase`: allowlisted official CLI adapter for migration authoring, local reset/diff, explicit-DSN inspection/backup/type generation, and SupaCloud-controlled migration push.
 - `auth`: provider and authentication configuration.
 - `storage`: buckets and object-management workflows.
-- `edge_functions`: list, read immutable source, deploy, activate, and configure Edge Functions. Pass the positive version read from `list` to `source --version` and as `--expected-active-version`; use `absent` only for a new slug. Version `0` is internal-only.
+- `edge_functions`: list, read immutable source, deploy, activate, and configure Edge Functions. Pass the non-negative version read from `list` as `--expected-active-version`; use `absent` only for a new slug. Version `0` is a legacy CAS token and cannot be used as a source or activation target.
 - `frontend`: list, build/deploy, domain, and deployment workflows.
 - `secrets`: project secret management; never print values after write.
 - `queue`, `task_events`, `diagnostics`: asynchronous workload operations and bounded diagnostics.