@supacloud/cli 0.23.0 → 0.24.0

package/README.md

@@ -111,18 +111,32 @@ loopback development origins, with the default `:80` likewise omitted. Use
 `release` is an official CLI entry point for the existing Management API
 logical-backup and PostgREST lifecycle capabilities. It requires the Management
 API context above; it does not promote an application `service_role` key to
-Management authority. Restore remains an admin-only operation and is not
-exposed by this command group.
+Management authority.
 
 ```bash
 supacloud-cli release logical_backup_list --ref abc123
 supacloud-cli release logical_backup_create --ref abc123
+supacloud-cli release logical_backup_restore --ref abc123 \
+  --backup_id logical-full_abc123_<backup-id-suffix> \
+  --expected_sha256 <64-lowercase-hex> \
+  --restore_confirmation RESTORE_PROJECT:abc123:logical-full_abc123_<backup-id-suffix>:<64-lowercase-hex>
 supacloud-cli release postgrest_status --ref abc123
 supacloud-cli release postgrest_restart --ref abc123
 ```
 
 Backup creation reports success only after the CLI verifies exactly one new
 logical-backup receipt against the inventory before and after the mutation.
+Logical restore is project-scoped: pause the selected project first, obtain the
+backup ID and SHA-256 from `logical_backup_list`, and supply both the normal
+production `--confirm-production <ref>` value (for production profiles) and
+the exact `--restore_confirmation
+RESTORE_PROJECT:<ref>:<backup_id>:<sha256>`. Before POST, the CLI re-reads
+that same project's inventory and binds the request to the complete verified
+backup identity; it then verifies both the server receipt and a fresh inventory
+read. It never retries a restore. A transport, server, or unreadable-response
+failure is reported as `OUTCOME_UNKNOWN`; read the inventory and investigate
+before any new restore decision.
+
 PostgREST restart reports success only after it receives a matching restart
 receipt and reads back `desired=running`, `actual=running`, and
 `health=healthy`. Both mutating controls follow the normal production

package/dist/index.js

@@ -6486,7 +6486,7 @@ var ACTION_POLICY = {
   mutations: { read: ["status"] },
   release: {
     read: ["logical_backup_list", "postgrest_status"],
-    write: ["logical_backup_create", "postgrest_restart"]
+    write: ["logical_backup_create", "logical_backup_restore", "postgrest_restart"]
   },
   secrets: { read: ["list"], write: ["upsert", "delete"] },
   frontend: {
@@ -12277,6 +12277,19 @@ function newlyCreatedBackup(before, after) {
   const additions = after.filter((backup) => !known.has(backup.backup_id));
   return additions.length === 1 ? additions[0] : null;
 }
+function restoreRequest(projectRef, backupId, expectedSha256, restoreConfirmation) {
+  if (typeof backupId !== "string" || !backupBelongsToProject(backupId, projectRef)) {
+    throw new Error("'backup_id' must identify a logical-full backup for 'ref'");
+  }
+  if (typeof expectedSha256 !== "string" || !SHA256.test(expectedSha256)) {
+    throw new Error("'expected_sha256' must be a lowercase SHA-256 digest");
+  }
+  const confirmation = `RESTORE_PROJECT:${projectRef}:${backupId}:${expectedSha256}`;
+  if (restoreConfirmation !== confirmation) {
+    throw new Error("'restore_confirmation' must exactly confirm the selected logical backup restore");
+  }
+  return { backup_id: backupId, expected_sha256: expectedSha256, confirmation };
+}
 function endpoint(projectRef) {
   if (!validProjectRef(projectRef))
     throw new Error("'ref' is invalid for release controls");
@@ -12334,15 +12347,19 @@ function isRestartReceipt(value) {
   return isRecord(value) && value.service === "postgrest" && value.action === "restart" && value.success === true;
 }
 function registerReleaseTools(server, http, options = {}) {
-  server.tool("release", "Verified release controls using a Management API credential. Actions: logical_backup_list, logical_backup_create, postgrest_status, postgrest_restart", {
+  server.tool("release", "Verified release controls using a Management API credential. Actions: logical_backup_list, logical_backup_create, logical_backup_restore, postgrest_status, postgrest_restart", {
     action: withDescription(stringEnum([
       "logical_backup_list",
       "logical_backup_create",
+      "logical_backup_restore",
       "postgrest_status",
       "postgrest_restart"
     ]), "Release control action"),
-    ref: optional(Type.String(), options.projectRef ? "Optional override when not auto-linked" : "Project ref")
-  }, async ({ action, ref }) => {
+    ref: optional(Type.String(), options.projectRef ? "Optional override when not auto-linked" : "Project ref"),
+    backup_id: optional(Type.String(), "[logical_backup_restore] Exact verified logical-full backup ID from the selected project inventory"),
+    expected_sha256: optional(Type.String(), "[logical_backup_restore] Exact lowercase SHA-256 from the selected project inventory"),
+    restore_confirmation: optional(Type.String(), "[logical_backup_restore] Exact RESTORE_PROJECT:<ref>:<backup_id>:<sha256> confirmation")
+  }, async ({ action, ref, backup_id, expected_sha256, restore_confirmation }) => {
     const projectRef = typeof ref === "string" && ref || options.projectRef;
     if (!projectRef)
       throw new Error("'ref' is required for release controls");
@@ -12379,6 +12396,32 @@ function registerReleaseTools(server, http, options = {}) {
         backup: publicBackup(addedBackup)
       });
     }
+    if (action === "logical_backup_restore") {
+      const request = restoreRequest(projectRef, backup_id, expected_sha256, restore_confirmation);
+      const before = await readInventory(http, projectRef);
+      const beforeFailure = readInventoryFailure("release.logical_backup.restore", before);
+      if (beforeFailure)
+        return beforeFailure;
+      const selectedBackup = before.inventory.find((backup) => backup.backup_id === request.backup_id && backup.sha256 === request.expected_sha256);
+      if (!selectedBackup) {
+        return releaseControlFailure("release.logical_backup.restore", "MUTATION_NOT_SUCCEEDED", null);
+      }
+      const mutation2 = await http.postReleaseMutation(`${endpoint(projectRef)}/database/backups/logical/restore`, request, { timeoutMs: BACKUP_TIMEOUT_MS });
+      if (!mutation2.ok || mutation2.status !== 200) {
+        return mutationFailure("release.logical_backup.restore", mutation2);
+      }
+      const responseBackup = isRecord(mutation2.data) ? verifiedBackup(mutation2.data.restored_backup, projectRef) : null;
+      const after = await readInventory(http, projectRef);
+      const afterFailure = readInventoryFailure("release.logical_backup.restore", after);
+      const restoredInventoryBackup = after.inventory?.find((backup) => backup.backup_id === request.backup_id);
+      if (!responseBackup || !equalBackup(responseBackup, selectedBackup) || afterFailure || !restoredInventoryBackup || !equalBackup(restoredInventoryBackup, selectedBackup)) {
+        return releaseControlFailure("release.logical_backup.restore", "OUTCOME_UNKNOWN", mutation2.status);
+      }
+      return releaseControlSuccess("release.logical_backup.restore", {
+        project_ref: projectRef,
+        backup: publicBackup(selectedBackup)
+      });
+    }
     if (action === "postgrest_status") {
       const read2 = await readPostgrestStatus(http, projectRef);
       const failure = readPostgrestFailure("release.postgrest.status", read2);
@@ -12407,7 +12450,7 @@ function registerReleaseTools(server, http, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.23.0",
+  version: "0.24.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -12652,6 +12695,7 @@ EXAMPLES
   ${preferredCommand} project logs --log_type database
   ${preferredCommand} project task_stats
   ${preferredCommand} release logical_backup_create --ref abc123
+  ${preferredCommand} release logical_backup_restore --ref abc123 --backup_id <backup_id> --expected_sha256 <sha256> --restore_confirmation RESTORE_PROJECT:abc123:<backup_id>:<sha256>
   ${preferredCommand} release postgrest_status --ref abc123
   ${preferredCommand} release postgrest_restart --ref abc123
   ${preferredCommand} queue stats --queue emails

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",