@supacloud/cli 0.21.3 → 0.22.0

package/README.md

@@ -198,6 +198,13 @@ it never empties a bucket. Mutation receipts bind `project_ref`, `bucket_id`,
 name with another version, or a local version with another name, before either
 dry-run reporting or apply can continue. This keeps the preview consistent with
 the server conflict that would otherwise occur after deployment starts.
+Mutation failures use the release-control receipt schema and never include the
+server response body. `OUTCOME_UNKNOWN` requires a fresh migration inventory
+read before deciding whether a retry is safe. A migration push failure also
+reports the local files applied or skipped before the failed file, so operators
+can reconcile a partially completed sequence without exposing SQL. Baseline
+success requires a bounded migration-inventory readback that confirms every
+requested version, name, baseline marker, and checksum.
 
 `edge_functions deploy --path` bundles local TypeScript and dependencies with
 Bun and runs a local syntax check before upload. The Management API validates and

package/dist/index.js

@@ -6897,6 +6897,38 @@ function projectRefPathSegment(ref, operation) {
   return encodeURIComponent(ref);
 }
 
+// src/shared/tools/release-control-response.ts
+var RELEASE_CONTROL_RESPONSE_SCHEMA = "supacloud.cli.release-control.v1";
+function releaseControlSuccess(operation, payload) {
+  return releaseControlResponse({
+    ...payload,
+    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
+    ok: true,
+    operation
+  });
+}
+function releaseControlFailure(operation, code, httpStatus, safeState = {}) {
+  return releaseControlErrorResponse({
+    ...safeState,
+    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
+    ok: false,
+    operation,
+    error: { code, http_status: httpStatus }
+  });
+}
+function releaseControlMutationFailure(operation, response, safeState = {}) {
+  const outcomeUnknown = response.transportError || response.responseReadError || response.status === 408 || response.status >= 500;
+  return outcomeUnknown ? releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.transportError ? null : response.status, safeState) : releaseControlFailure(operation, "HTTP_ERROR", response.status, safeState);
+}
+function releaseControlResponse(payload) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(payload, null, 2) }]
+  };
+}
+function releaseControlErrorResponse(payload) {
+  return { ...releaseControlResponse(payload), isError: true };
+}
+
 // src/shared/tools/database-tools.ts
 var MAX_MIGRATION_VERSION = 9223372036854775807n;
 var FALLBACK_MIGRATION_VERSION_BASE = 8000000000000000000n;
@@ -7046,6 +7078,10 @@ function sortMigrationFiles(migrations) {
   }
   return sorted;
 }
+function normalizedMigrationStatement(statement) {
+  return statement.replace(/\r\n?/g, `
+`).trim();
+}
 function migrationRows(data) {
   if (Array.isArray(data))
     return data;
@@ -7078,15 +7114,6 @@ function migrationIdentities(data) {
   }
   return identities;
 }
-function appliedMigrationKeys(data) {
-  const keys = new Set;
-  for (const migration of migrationIdentities(data)) {
-    keys.add(migration.version);
-    if (migration.name !== null)
-      keys.add(migration.name);
-  }
-  return keys;
-}
 function singleRemoteStatement(remote) {
   return Array.isArray(remote.statements) && remote.statements.length === 1 && typeof remote.statements[0] === "string" ? remote.statements[0] : null;
 }
@@ -7133,11 +7160,106 @@ function migrationPushPlan(data, migrationFiles) {
   }
   return plan;
 }
-function isAlreadyAppliedMigrationResponse(response) {
-  if (response.status !== 409 || !response.data || typeof response.data !== "object")
+function recordPayload(payload) {
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : null;
+}
+function confirmedMigrationReceipt(payload, expected) {
+  const receipt = recordPayload(payload);
+  if (!receipt || !isMigrationInventoryVersion(receipt.version))
+    return false;
+  const responseStatements = [expected.sql.trim()];
+  const checksumStatements = [normalizedMigrationStatement(expected.sql)];
+  const name = expected.name.trim();
+  if (receipt.name !== name || JSON.stringify(receipt.statements) !== JSON.stringify(responseStatements))
+    return false;
+  if (expected.version !== undefined && receipt.version !== expected.version)
+    return false;
+  return receipt.checksum === migrationInventoryChecksum({ version: receipt.version, name, statements: checksumStatements });
+}
+function isAlreadyAppliedMigrationResponse(response, migration) {
+  if (response.ok || response.status !== 409 || response.transportError || response.responseReadError)
+    return false;
+  if (!response.data || typeof response.data !== "object" || Array.isArray(response.data))
     return false;
   const body = response.data;
-  return body.code === "409" && body.message === "Migration already applied";
+  const name = migration.name.trim();
+  const statements = [normalizedMigrationStatement(migration.sql)];
+  return body.code === "409" && body.message === "Migration already applied" && body.version === migration.version && body.name === name && body.checksum === migrationInventoryChecksum({ version: migration.version, name, statements });
+}
+function expectedBaselineChecksum(migration) {
+  return migrationInventoryChecksum({
+    version: migration.version,
+    name: migration.name,
+    statements: [`baseline:${migration.name}`]
+  });
+}
+function confirmedBaselineReceipt(payload, migrations) {
+  const receipt = recordPayload(payload);
+  if (!receipt || typeof receipt.marked !== "number" || typeof receipt.already_applied !== "number")
+    return null;
+  if (!Number.isSafeInteger(receipt.marked) || !Number.isSafeInteger(receipt.already_applied))
+    return null;
+  if (receipt.marked < 0 || receipt.already_applied < 0)
+    return null;
+  if (receipt.marked + receipt.already_applied !== migrations.length)
+    return null;
+  if (!Array.isArray(receipt.migrations) || receipt.migrations.length !== receipt.marked)
+    return null;
+  const expected = new Map(migrations.map((migration) => [migration.version, migration]));
+  const marked = [];
+  for (const rawMigration of receipt.migrations) {
+    const migration = recordPayload(rawMigration);
+    if (!migration || typeof migration.version !== "string")
+      return null;
+    const local = expected.get(migration.version);
+    if (!local || migration.name !== local.name || migration.checksum !== expectedBaselineChecksum(local))
+      return null;
+    expected.delete(migration.version);
+    marked.push(local);
+  }
+  return expected.size === receipt.already_applied ? { marked, concurrentlyAlreadyApplied: receipt.already_applied } : null;
+}
+function baselineInventoryIsApplied(payload, migrations) {
+  const inventory = migrationInventory(payload);
+  if (!inventory)
+    return false;
+  const byVersion = new Map(inventory.map((migration) => [migration.version, migration]));
+  return migrations.every((migration) => {
+    const remote = byVersion.get(migration.version);
+    return remote?.name === migration.name && remote.statements.length === 1 && remote.statements[0] === `baseline:${migration.name}` && remote.checksum === expectedBaselineChecksum(migration);
+  });
+}
+function confirmedSqlBatchReceipt(payload, expectedCommands) {
+  const receipt = recordPayload(payload);
+  if (!receipt || receipt.command !== "BATCH" || !Array.isArray(receipt.statements))
+    return false;
+  if (receipt.statements.length !== expectedCommands.length)
+    return false;
+  return receipt.statements.every((rawStatement, index) => {
+    const statement = recordPayload(rawStatement);
+    if (!statement || statement.index !== index + 1 || statement.command !== expectedCommands[index])
+      return false;
+    if (typeof statement.rowCount !== "number" || !Number.isSafeInteger(statement.rowCount) || statement.rowCount < 0)
+      return false;
+    if (typeof statement.durationMs !== "number" || !Number.isFinite(statement.durationMs) || statement.durationMs < 0)
+      return false;
+    return true;
+  });
+}
+function rlsStatementCommands(policyMode) {
+  return [
+    "CREATE",
+    "ALTER",
+    ...Array.from({ length: 5 }, () => "DROP"),
+    ...policyMode === "owner" ? Array.from({ length: 4 }, () => "CREATE") : []
+  ];
+}
+function migrationPushFailureState(applied, skipped, failedFile) {
+  return {
+    applied_before_failure: [...applied],
+    skipped_before_failure: [...skipped],
+    failed_file: failedFile
+  };
 }
 function sqlReferencesVector(sql) {
   return /\bvector\s*\(\s*\d+\s*\)/i.test(sql) || /::\s*vector\b/i.test(sql) || /\bvector_(cosine|l2|ip)_ops\b/i.test(sql) || /<=>|<#>|<->/.test(sql);
@@ -7342,8 +7464,16 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
       case "apply_migration": {
         if (!args.name || !args.sql)
           throw new Error("'name' and 'sql' required");
-        const r = await http.post(`/v1/projects/${ref}/database/migrations`, { name: args.name, sql: args.sql });
-        text = r.ok ? `✅ Migration '${args.name}' applied` : `❌ Failed (${r.status}): ${JSON.stringify(r.data)}`;
+        const r = await http.postReleaseMutation(`/v1/projects/${ref}/database/migrations`, { name: args.name, sql: args.sql });
+        if (!r.ok)
+          return releaseControlMutationFailure("database.apply_migration", r);
+        if (r.status !== 200) {
+          return releaseControlFailure("database.apply_migration", "OUTCOME_UNKNOWN", r.status);
+        }
+        if (!confirmedMigrationReceipt(r.data, { name: args.name, sql: args.sql })) {
+          return releaseControlFailure("database.apply_migration", "OUTCOME_UNKNOWN", r.status);
+        }
+        text = `✅ Migration '${args.name}' applied`;
         break;
       }
       case "push_migrations": {
@@ -7359,14 +7489,13 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
         const migrationFiles = sortMigrationFiles(files.map((file) => readMigrationFile(dir, file)));
         const migrationsResult = await http.get(`/v1/projects/${ref}/database/migrations`);
         if (!migrationsResult.ok) {
-          text = `❌ Failed to load applied migrations (${migrationsResult.status})`;
-          break;
+          return releaseControlFailure("database.push_migrations", "HTTP_ERROR", migrationsResult.transportError ? null : migrationsResult.status);
         }
         const migrationPlan = migrationPushPlan(migrationsResult.data, migrationFiles);
         if (args.dry_run) {
-          const pending = migrationPlan.pending;
+          const pending2 = migrationPlan.pending;
           const alreadyApplied = migrationPlan.alreadyApplied;
-          const pendingWithSql = pending;
+          const pendingWithSql = pending2;
           let vectorEnabled = null;
           if (pendingWithSql.some(({ sql }) => sqlReferencesVector(sql) || sqlCreatesVectorExtension(sql))) {
             const extResult = await execSql("SELECT extname AS name FROM pg_extension WHERE extname = 'vector';");
@@ -7378,7 +7507,7 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
             `Total: ${migrationFiles.length}`,
             "",
             "Pending:",
-            ...pending.length ? pending.map(({ file, version }) => `  - ${file} (${version})`) : ["  - none"],
+            ...pending2.length ? pending2.map(({ file, version }) => `  - ${file} (${version})`) : ["  - none"],
             "",
             "Already applied:",
             ...alreadyApplied.length ? alreadyApplied.map(({ file, version }) => `  - ${file} (${version})`) : ["  - none"],
@@ -7387,22 +7516,25 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
 `);
           break;
         }
+        const pending = new Set(migrationPlan.pending.map(({ file }) => file));
         const applied = [];
-        const skipped = migrationPlan.alreadyApplied.map(({ file }) => file);
-        for (const { file, name, version, sql } of migrationPlan.pending) {
-          const r = await http.post(`/v1/projects/${ref}/database/migrations`, { name, sql, version });
-          if (r.ok) {
+        const skipped = [];
+        for (const { file, name, version, sql } of migrationFiles) {
+          if (!pending.has(file)) {
+            skipped.push(file);
+            continue;
+          }
+          const r = await http.postReleaseMutation(`/v1/projects/${ref}/database/migrations`, { name, sql, version });
+          if (r.ok && r.status === 200 && confirmedMigrationReceipt(r.data, { name, version, sql })) {
             applied.push(file);
-          } else if (isAlreadyAppliedMigrationResponse(r)) {
+          } else if (isAlreadyAppliedMigrationResponse(r, { name, version, sql })) {
             skipped.push(file);
           } else {
-            text = [
-              `❌ Failed to apply ${file} (${r.status})`,
-              `Applied before failure: ${applied.length}`,
-              `Skipped before failure: ${skipped.length}`
-            ].join(`
-`);
-            return { content: [{ type: "text", text }] };
+            const safeState = migrationPushFailureState(applied, skipped, file);
+            if (r.ok) {
+              return releaseControlFailure("database.push_migrations", "OUTCOME_UNKNOWN", r.status, safeState);
+            }
+            return releaseControlMutationFailure("database.push_migrations", r, safeState);
           }
         }
         text = [
@@ -7428,12 +7560,11 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
         const migrationFiles = sortMigrationFiles(files.map((file) => readMigrationFile(dir, file)));
         const r = await http.get(`/v1/projects/${ref}/database/migrations`);
         if (!r.ok) {
-          text = `❌ Failed to load applied migrations (${r.status}): ${JSON.stringify(r.data)}`;
-          break;
+          return releaseControlFailure("database.baseline_migrations", "HTTP_ERROR", r.transportError ? null : r.status);
         }
-        const appliedKeys = appliedMigrationKeys(r.data);
-        const missing = migrationFiles.filter(({ name, version }) => !appliedKeys.has(name) && !appliedKeys.has(String(version)));
-        const alreadyApplied = migrationFiles.filter(({ name, version }) => appliedKeys.has(name) || appliedKeys.has(String(version)));
+        const migrationPlan = migrationPushPlan(r.data, migrationFiles);
+        const missing = migrationPlan.pending;
+        const alreadyApplied = migrationPlan.alreadyApplied;
         if (args.dry_run) {
           text = [
             `Migration baseline dry run for ${dir}`,
@@ -7456,16 +7587,28 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
 `);
           break;
         }
-        const baselineResult = await http.post(`/v1/projects/${ref}/database/migrations/baseline`, { migrations: missing.map(({ name, version }) => ({ name, version })) });
-        text = baselineResult.ok ? [
+        const baselineResult = await http.postReleaseMutation(`/v1/projects/${ref}/database/migrations/baseline`, { migrations: missing.map(({ name, version }) => ({ name, version })) });
+        if (!baselineResult.ok) {
+          return releaseControlMutationFailure("database.baseline_migrations", baselineResult);
+        }
+        if (baselineResult.status !== 200) {
+          return releaseControlFailure("database.baseline_migrations", "OUTCOME_UNKNOWN", baselineResult.status);
+        }
+        const receipt = confirmedBaselineReceipt(baselineResult.data, missing);
+        if (!receipt) {
+          return releaseControlFailure("database.baseline_migrations", "OUTCOME_UNKNOWN", baselineResult.status);
+        }
+        const inventoryResult = await http.get(`/v1/projects/${ref}/database/migrations`, { maxResponseBytes: MAX_MIGRATION_INVENTORY_BYTES });
+        if (!inventoryResult.ok || !baselineInventoryIsApplied(inventoryResult.data, missing)) {
+          return releaseControlFailure("database.baseline_migrations", "OUTCOME_UNKNOWN", inventoryResult.transportError ? null : inventoryResult.status);
+        }
+        text = [
           `✅ Migration baseline completed for ${dir}`,
-          `Marked applied: ${missing.length}`,
-          `Already applied: ${alreadyApplied.length}`,
-          "",
-          "Marked files:",
-          ...missing.map(({ file, version }) => `  - ${file} (${version})`)
+          `Marked applied: ${receipt.marked.length}`,
+          `Already applied: ${alreadyApplied.length + receipt.concurrentlyAlreadyApplied}`,
+          ...receipt.marked.length ? ["", "Marked files:", ...receipt.marked.map(({ file, version }) => `  - ${file} (${version})`)] : []
         ].join(`
-`) : `❌ Failed (${baselineResult.status}): ${JSON.stringify(baselineResult.data)}`;
+`);
         break;
       }
       case "create_table_rls": {
@@ -7478,8 +7621,16 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
           throw new Error("Invalid RLS policy mode");
         const policySql = buildRlsPolicySql(qualifiedTable, policyMode, args.owner_column);
         const sql = `BEGIN; CREATE TABLE IF NOT EXISTS ${qualifiedTable} (${columns}); ALTER TABLE ${qualifiedTable} ENABLE ROW LEVEL SECURITY; ${policySql} COMMIT;`;
-        const r = await execSql(sql);
-        text = r.ok ? `✅ Table '${schema}.${args.table}' created with RLS (${policyMode === "owner" ? "auth.uid() owner policy" : "deny-all by default"})` : `❌ Failed (${r.status}): ${JSON.stringify(r.data)}`;
+        const r = await http.postReleaseMutation(`/v1/projects/${ref}/database/sql`, { sql, mode: "migration" });
+        if (!r.ok)
+          return releaseControlMutationFailure("database.create_table_rls", r);
+        if (r.status !== 200) {
+          return releaseControlFailure("database.create_table_rls", "OUTCOME_UNKNOWN", r.status);
+        }
+        if (!confirmedSqlBatchReceipt(r.data, rlsStatementCommands(policyMode))) {
+          return releaseControlFailure("database.create_table_rls", "OUTCOME_UNKNOWN", r.status);
+        }
+        text = `✅ Table '${schema}.${args.table}' created with RLS (${policyMode === "owner" ? "auth.uid() owner policy" : "deny-all by default"})`;
         break;
       }
       default:
@@ -7970,38 +8121,6 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status}): ${JSON.stringif
   });
 }
 
-// src/shared/tools/release-control-response.ts
-var RELEASE_CONTROL_RESPONSE_SCHEMA = "supacloud.cli.release-control.v1";
-function releaseControlSuccess(operation, payload) {
-  return releaseControlResponse({
-    ...payload,
-    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
-    ok: true,
-    operation
-  });
-}
-function releaseControlFailure(operation, code, httpStatus, safeState = {}) {
-  return releaseControlErrorResponse({
-    ...safeState,
-    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
-    ok: false,
-    operation,
-    error: { code, http_status: httpStatus }
-  });
-}
-function releaseControlMutationFailure(operation, response) {
-  const outcomeUnknown = response.transportError || response.responseReadError || response.status === 408 || response.status >= 500;
-  return outcomeUnknown ? releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.transportError ? null : response.status) : releaseControlFailure(operation, "HTTP_ERROR", response.status);
-}
-function releaseControlResponse(payload) {
-  return {
-    content: [{ type: "text", text: JSON.stringify(payload, null, 2) }]
-  };
-}
-function releaseControlErrorResponse(payload) {
-  return { ...releaseControlResponse(payload), isError: true };
-}
-
 // src/shared/tools/storage-tools.ts
 var MAX_BUCKET_ID_LENGTH = 100;
 var MAX_MIME_TYPE_COUNT = 100;
@@ -12039,7 +12158,7 @@ var MUTATION_TOOL_SCHEMA = {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.21.3",
+  version: "0.22.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.21.3",
+  "version": "0.22.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",