@supacloud/cli 0.25.0 → 0.27.0

package/dist/index.js

@@ -6458,8 +6458,9 @@ function resolveSupaCloudContext(env = process.env, cwd = process.cwd(), selecti
 // src/shared/execution-policy.ts
 var ACTION_POLICY = {
   project: {
-    read: ["get", "health", "logs", "api_keys", "settings", "tasks", "task_detail", "task_stats", "dlq", "background_settings"],
-    write: ["pause", "restore", "task_cancel", "task_retry", "update_background_settings"]
+    read: ["get", "endpoints", "health", "logs", "api_keys", "settings", "tasks", "task_detail", "task_stats", "dlq", "background_settings"],
+    write: ["pause", "restore", "task_cancel", "task_retry", "update_background_settings"],
+    local: ["list"]
   },
   database: {
     read: ["list_tables", "describe_columns", "list_indexes", "list_constraints", "list_extensions", "rls_status", "rls_policies", "list_auth_users", "get_auth_user", "connections", "stats", "slow_queries", "list_migrations", "migration_inventory", "project_url", "generate_types"],
@@ -6473,6 +6474,10 @@ var ACTION_POLICY = {
     read: ["list_providers", "get_provider", "supported_providers", "get_settings", "get_config"],
     write: ["configure_provider", "update_provider", "disable_provider", "wechat_mini", "wechat_open", "update_settings", "update_config"]
   },
+  oauth_clients: {
+    read: ["list", "get"],
+    write: ["create", "delete"]
+  },
   storage: {
     read: ["status", "list_buckets", "get_bucket", "list_files"],
     write: ["create_bucket", "update_bucket", "delete_bucket", "upload_base64", "delete_file"]
@@ -8170,6 +8175,214 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status}): ${JSON.stringif
   });
 }
 
+// src/shared/tools/oauth-client-tools.ts
+var RELEASE_CANARY_CLIENT_NAME = "supacloud-release-canary";
+var CLIENT_ID_PATTERN = /^[A-Za-z0-9._~-]{1,256}$/;
+var MAX_CLIENT_LIST_BYTES = 256 * 1024;
+var READ_TIMEOUT_MS = 5000;
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function releaseCanaryCallbackUri(value) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error("'redirect_uri' is required");
+  }
+  let uri;
+  try {
+    uri = new URL(value);
+  } catch {
+    throw new Error("'redirect_uri' must be an absolute HTTPS or loopback HTTP URL");
+  }
+  const loopback = uri.hostname === "127.0.0.1" || uri.hostname === "[::1]";
+  const isHttps = uri.protocol === "https:";
+  const isPortBoundLoopback = uri.protocol === "http:" && loopback && Boolean(uri.port);
+  if (!isHttps && !isPortBoundLoopback || !uri.hostname || uri.username || uri.password || uri.search || uri.hash) {
+    throw new Error("'redirect_uri' must be an exact HTTPS callback or port-bound loopback HTTP callback without credentials, query, or fragment");
+  }
+  return uri.toString();
+}
+function createdClientId(value) {
+  if (!isRecord(value))
+    return null;
+  try {
+    return clientId(value.client_id);
+  } catch {
+    return null;
+  }
+}
+function clientId(value) {
+  if (typeof value !== "string" || !CLIENT_ID_PATTERN.test(value)) {
+    throw new Error("'client_id' is invalid");
+  }
+  return value;
+}
+function projectRef(value) {
+  if (typeof value !== "string" || !value.trim())
+    throw new Error("'ref' is required");
+  return projectRefPathSegment(value.trim(), "OAuth client");
+}
+function oauthClientsPath(ref) {
+  return `/v1/projects/${encodeURIComponent(ref)}/auth/oauth-clients`;
+}
+function expectedClient(value, redirectUri) {
+  if (!isRecord(value) || typeof value.client_id !== "string" || !CLIENT_ID_PATTERN.test(value.client_id) || value.client_name !== RELEASE_CANARY_CLIENT_NAME || value.client_type !== "public" || value.token_endpoint_auth_method !== "none" || !Array.isArray(value.redirect_uris) || value.redirect_uris.length !== 1 || !Array.isArray(value.grant_types) || value.grant_types.length !== 1 || value.grant_types[0] !== "authorization_code" || !Array.isArray(value.response_types) || value.response_types.length !== 1 || value.response_types[0] !== "code")
+    return null;
+  let callback;
+  try {
+    callback = releaseCanaryCallbackUri(value.redirect_uris[0]);
+  } catch {
+    return null;
+  }
+  if (redirectUri !== undefined && callback !== redirectUri)
+    return null;
+  return {
+    client_id: value.client_id,
+    client_name: RELEASE_CANARY_CLIENT_NAME,
+    client_type: "public",
+    token_endpoint_auth_method: "none",
+    redirect_uris: [callback],
+    grant_types: ["authorization_code"],
+    response_types: ["code"]
+  };
+}
+function clientInventory(value) {
+  if (!isRecord(value) || !Array.isArray(value.clients))
+    return null;
+  const clients = value.clients.filter((client) => isRecord(client) && client.client_name === RELEASE_CANARY_CLIENT_NAME).map((client) => expectedClient(client));
+  if (clients.some((client) => client === null))
+    return null;
+  const inventory = clients;
+  return new Set(inventory.map((client) => client.client_id)).size === inventory.length ? inventory : null;
+}
+function readFailure(operation, response) {
+  if (!response.ok) {
+    return releaseControlFailure(operation, response.responseReadError ? "INVALID_RESPONSE" : "HTTP_ERROR", response.transportError ? null : response.status);
+  }
+  return null;
+}
+async function listClients(http, ref) {
+  const response = await http.get(oauthClientsPath(ref), {
+    maxJsonBytes: MAX_CLIENT_LIST_BYTES,
+    responseTimeoutMs: READ_TIMEOUT_MS
+  });
+  return { response, clients: response.ok && response.status === 200 ? clientInventory(response.data) : null };
+}
+async function getClient(http, ref, id) {
+  const response = await http.get(`${oauthClientsPath(ref)}/${encodeURIComponent(id)}`, {
+    maxJsonBytes: MAX_CLIENT_LIST_BYTES,
+    responseTimeoutMs: READ_TIMEOUT_MS
+  });
+  return { response, client: response.ok && response.status === 200 ? expectedClient(response.data) : null };
+}
+function exactSingleClient(inventory, redirectUri) {
+  return inventory.length === 1 && inventory[0]?.redirect_uris[0] === redirectUri ? inventory[0] : null;
+}
+async function listReleaseCanaryClients(http, ref) {
+  const read = await listClients(http, ref);
+  const failure = readFailure("oauth_clients.list", read.response);
+  if (failure)
+    return failure;
+  if (!read.clients)
+    return releaseControlFailure("oauth_clients.list", "INVALID_RESPONSE", read.response.status);
+  return releaseControlSuccess("oauth_clients.list", { project_ref: ref, clients: read.clients });
+}
+async function getReleaseCanaryClient(http, ref, id) {
+  const read = await getClient(http, ref, id);
+  const failure = readFailure("oauth_clients.get", read.response);
+  if (failure)
+    return failure;
+  if (!read.client || read.client.client_id !== id) {
+    return releaseControlFailure("oauth_clients.get", "INVALID_RESPONSE", read.response.status);
+  }
+  return releaseControlSuccess("oauth_clients.get", { project_ref: ref, client: read.client });
+}
+async function createReleaseCanaryClient(http, ref, redirectUri) {
+  const before = await listClients(http, ref);
+  const beforeFailure = readFailure("oauth_clients.create", before.response);
+  if (beforeFailure)
+    return beforeFailure;
+  if (!before.clients)
+    return releaseControlFailure("oauth_clients.create", "INVALID_RESPONSE", before.response.status);
+  const existing = exactSingleClient(before.clients, redirectUri);
+  if (existing) {
+    return releaseControlSuccess("oauth_clients.create", {
+      project_ref: ref,
+      client: existing,
+      reused: true
+    });
+  }
+  if (before.clients.length > 0) {
+    return releaseControlFailure("oauth_clients.create", "MUTATION_NOT_SUCCEEDED", null, { project_ref: ref });
+  }
+  const mutation = await http.postReleaseMutation(oauthClientsPath(ref), {
+    client_type: "public",
+    token_endpoint_auth_method: "none",
+    redirect_uris: [redirectUri],
+    grant_types: ["authorization_code"],
+    client_name: RELEASE_CANARY_CLIENT_NAME
+  });
+  if (!mutation.ok) {
+    return releaseControlMutationFailure("oauth_clients.create", mutation, { project_ref: ref });
+  }
+  const createdId = createdClientId(mutation.data);
+  if (!createdId)
+    return releaseControlFailure("oauth_clients.create", "OUTCOME_UNKNOWN", mutation.status, { project_ref: ref });
+  const read = await getClient(http, ref, createdId);
+  const readFailureResult = readFailure("oauth_clients.create", read.response);
+  if (readFailureResult || !read.client || read.client.client_id !== createdId || read.client.redirect_uris[0] !== redirectUri) {
+    return releaseControlFailure("oauth_clients.create", "OUTCOME_UNKNOWN", mutation.status, { project_ref: ref });
+  }
+  return releaseControlSuccess("oauth_clients.create", {
+    project_ref: ref,
+    client: read.client,
+    reused: false
+  });
+}
+async function deleteReleaseCanaryClient(http, ref, id, redirectUri) {
+  const before = await getClient(http, ref, id);
+  const beforeFailure = readFailure("oauth_clients.delete", before.response);
+  if (beforeFailure)
+    return beforeFailure;
+  if (!before.client || before.client.client_id !== id || before.client.redirect_uris[0] !== redirectUri) {
+    return releaseControlFailure("oauth_clients.delete", "MUTATION_NOT_SUCCEEDED", null, { project_ref: ref });
+  }
+  const mutation = await http.deleteReleaseMutation(`${oauthClientsPath(ref)}/${encodeURIComponent(id)}`);
+  if (!mutation.ok || ![200, 204].includes(mutation.status)) {
+    return releaseControlMutationFailure("oauth_clients.delete", mutation, { project_ref: ref });
+  }
+  const after = await listClients(http, ref);
+  const afterFailure = readFailure("oauth_clients.delete", after.response);
+  if (afterFailure || !after.clients || after.clients.some((client) => client.client_id === id)) {
+    return releaseControlFailure("oauth_clients.delete", "OUTCOME_UNKNOWN", mutation.status, { project_ref: ref });
+  }
+  return releaseControlSuccess("oauth_clients.delete", {
+    project_ref: ref,
+    client_id: id,
+    deleted: true
+  });
+}
+function registerOAuthClientTools(server, http) {
+  server.tool("oauth_clients", "Dedicated release-canary public OAuth client lifecycle. It only manages the exact supacloud-release-canary public authorization-code client and never returns client secrets.", {
+    action: withDescription(stringEnum(["list", "get", "create", "delete"]), "OAuth client action"),
+    ref: withDescription(Type.String(), "Central SupAuth project ref"),
+    client_id: optional(Type.String(), "[get/delete] Exact release-canary public OAuth client ID"),
+    redirect_uri: optional(Type.String(), "[create/delete] Exact HTTPS or port-bound RFC 8252 loopback callback")
+  }, async ({ action, ref, client_id, redirect_uri }) => {
+    const targetRef = projectRef(ref);
+    if (action === "list")
+      return listReleaseCanaryClients(http, targetRef);
+    if (action === "get")
+      return getReleaseCanaryClient(http, targetRef, clientId(client_id));
+    if (action === "create") {
+      return createReleaseCanaryClient(http, targetRef, releaseCanaryCallbackUri(redirect_uri));
+    }
+    if (action === "delete") {
+      return deleteReleaseCanaryClient(http, targetRef, clientId(client_id), releaseCanaryCallbackUri(redirect_uri));
+    }
+    throw new Error("Unknown OAuth client action");
+  });
+}
+
 // src/shared/tools/storage-tools.ts
 var MAX_BUCKET_ID_LENGTH = 100;
 var MAX_MIME_TYPE_COUNT = 100;
@@ -9184,13 +9397,13 @@ async function readFunctionSource(http, request) {
 function mutationIdentityMatches2(receipt, expectation) {
   return receipt.success === true && receipt.project_ref === expectation.projectRef && receipt.slug === expectation.slug && receipt.previous_active_version === expectation.expectedActiveVersion && receipt.expected_activation_id === expectation.expectedActivationId;
 }
-async function readFunctionIdentity(http, projectRef, slug) {
-  const resourcePath = edgeFunctionResourcePath(projectRef, slug);
+async function readFunctionIdentity(http, projectRef2, slug) {
+  const resourcePath = edgeFunctionResourcePath(projectRef2, slug);
   const response = await http.get(`${resourcePath}/config`);
   if (!response.ok) {
     return releaseControlFailure("edge_functions.get_config", "HTTP_ERROR", response.status);
   }
-  const identity = projectedFunctionIdentity(response.data, projectRef, slug);
+  const identity = projectedFunctionIdentity(response.data, projectRef2, slug);
   return identity ? { content: [{ type: "text", text: JSON.stringify(identity, null, 2) }] } : releaseControlFailure("edge_functions.get_config", "INVALID_RESPONSE", response.status);
 }
 async function updateFunctionConfiguration(http, request) {
@@ -9253,15 +9466,15 @@ function readOnlyActivationResult() {
   };
 }
 function functionActivationTarget(args) {
-  const projectRef = typeof args.ref === "string" ? args.ref.trim() : "";
+  const projectRef2 = typeof args.ref === "string" ? args.ref.trim() : "";
   const functionSlug = typeof args.slug === "string" ? args.slug.trim() : "";
   const version = positiveFunctionVersion(args.version, "Function activation version");
-  projectRefPathSegment(projectRef, "Edge Function activation");
+  projectRefPathSegment(projectRef2, "Edge Function activation");
   if (!SAFE_FUNCTION_SLUG_PATTERN.test(functionSlug))
     throw new Error("'slug' is invalid for 'activate'");
   const expectedActiveVersion = requiredExpectedActiveVersion(args, "activate");
   const expectedActivationId = requiredExpectedActivationId(args, "activate");
-  return { projectRef, functionSlug, version, expectedActiveVersion, expectedActivationId };
+  return { projectRef: projectRef2, functionSlug, version, expectedActiveVersion, expectedActivationId };
 }
 function requiredExpectedActiveVersion(args, action) {
   const expected = args["expected-active-version"];
@@ -9289,11 +9502,11 @@ async function activateFunctionVersion(http, args, readOnly = false) {
   const unsupported = Object.keys(args).filter((name) => !FUNCTION_ACTIVATION_ARGUMENTS.has(name));
   if (unsupported.length > 0)
     throw new Error(`'${unsupported[0]}' is not supported for 'activate'`);
-  const { projectRef, functionSlug, version, expectedActiveVersion, expectedActivationId } = functionActivationTarget(args);
-  const endpoint = edgeFunctionResourcePath(projectRef, functionSlug) + `/versions/${encodeURIComponent(version)}/activate`;
+  const { projectRef: projectRef2, functionSlug, version, expectedActiveVersion, expectedActivationId } = functionActivationTarget(args);
+  const endpoint = edgeFunctionResourcePath(projectRef2, functionSlug) + `/versions/${encodeURIComponent(version)}/activate`;
   return functionMutationResponse({
     operation: "edge_functions.activate",
-    projectRef,
+    projectRef: projectRef2,
     slug: functionSlug,
     expectedActiveVersion,
     expectedActivationId,
@@ -9979,6 +10192,115 @@ function projectGetRead(response, expectedRef) {
   return project ? successfulResult(project) : failedResult("Invalid project response");
 }
 
+// src/shared/tools/project-endpoint-read.ts
+var PROJECT_ENDPOINT_RESPONSE_MAX_BYTES = 256 * 1024;
+var PROJECT_ENDPOINT_LIST_RESPONSE_MAX_BYTES = 1024 * 1024;
+var PROJECT_REF_PATTERN4 = /^[a-z0-9-]{1,20}$/;
+var PROJECT_ENDPOINTS_SCHEMA = "supacloud.project-endpoints.v1";
+var PROJECT_ENDPOINT_SOURCES = new Set([
+  "explicit_api_domain",
+  "explicit_auth_domain",
+  "explicit_studio_domain",
+  "custom_domain",
+  "derived_api_domain",
+  "generated"
+]);
+var ROOT_KEYS = new Set(["schema", "project_ref", "endpoints"]);
+var ENDPOINTS_KEYS = new Set(["api", "auth", "studio"]);
+var ENDPOINT_KEYS = new Set(["origin", "host", "scheme", "source", "aliases"]);
+var MAX_ALIASES = 64;
+function plainRecord2(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const prototype = Object.getPrototypeOf(candidate);
+  return prototype === Object.prototype || prototype === null ? candidate : null;
+}
+function hasOnlyKeys2(record, allowedKeys) {
+  return Object.keys(record).every((key) => allowedKeys.has(key));
+}
+function boundedText2(candidate, maxLength) {
+  return typeof candidate === "string" && candidate.length > 0 && candidate.length <= maxLength && !/[\u0000-\u001f\u007f]/u.test(candidate) ? candidate : null;
+}
+function canonicalHost(candidate, scheme) {
+  const host = boundedText2(candidate, 255);
+  if (!host)
+    return null;
+  try {
+    const parsed = new URL(`${scheme}://${host}`);
+    return parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || parsed.host !== host ? null : host;
+  } catch {
+    return null;
+  }
+}
+function projectEndpoint2(candidate) {
+  const endpoint = plainRecord2(candidate);
+  if (!endpoint || !hasOnlyKeys2(endpoint, ENDPOINT_KEYS))
+    return null;
+  const scheme = endpoint.scheme === "http" || endpoint.scheme === "https" ? endpoint.scheme : null;
+  const origin = boundedText2(endpoint.origin, 2048);
+  const source = boundedText2(endpoint.source, 64);
+  if (!scheme || !origin || !source || !PROJECT_ENDPOINT_SOURCES.has(source))
+    return null;
+  let parsedOrigin;
+  try {
+    parsedOrigin = new URL(origin);
+  } catch {
+    return null;
+  }
+  if (parsedOrigin.protocol !== `${scheme}:` || parsedOrigin.origin !== origin || parsedOrigin.username || parsedOrigin.password || parsedOrigin.pathname !== "/" || parsedOrigin.search || parsedOrigin.hash)
+    return null;
+  const host = canonicalHost(endpoint.host, scheme);
+  if (!host || host !== parsedOrigin.host || !Array.isArray(endpoint.aliases) || endpoint.aliases.length > MAX_ALIASES)
+    return null;
+  const aliases = [];
+  const seenAliases = new Set;
+  for (const aliasCandidate of endpoint.aliases) {
+    const alias = canonicalHost(aliasCandidate, scheme);
+    if (!alias || alias === host || seenAliases.has(alias))
+      return null;
+    seenAliases.add(alias);
+    aliases.push(alias);
+  }
+  return { origin, host, scheme, source, aliases };
+}
+function projectEndpointProjection(candidate) {
+  const projection = plainRecord2(candidate);
+  if (!projection || !hasOnlyKeys2(projection, ROOT_KEYS) || projection.schema !== PROJECT_ENDPOINTS_SCHEMA || typeof projection.project_ref !== "string" || !PROJECT_REF_PATTERN4.test(projection.project_ref))
+    return null;
+  const endpoints = plainRecord2(projection.endpoints);
+  if (!endpoints || !hasOnlyKeys2(endpoints, ENDPOINTS_KEYS))
+    return null;
+  const api = projectEndpoint2(endpoints.api);
+  const auth = projectEndpoint2(endpoints.auth);
+  const studio = projectEndpoint2(endpoints.studio);
+  return api && auth && studio ? {
+    schema: PROJECT_ENDPOINTS_SCHEMA,
+    project_ref: projection.project_ref,
+    endpoints: { api, auth, studio }
+  } : null;
+}
+function validHttpStatus2(status) {
+  return Number.isSafeInteger(status) && status >= 100 && status <= 599;
+}
+function successfulResponse2(response) {
+  return response.ok === true && validHttpStatus2(response.status) && response.status >= 200 && response.status <= 299;
+}
+function failedResult2(message) {
+  return { text: `❌ ${message}`, isError: true };
+}
+function failedHttpResult2(label, status) {
+  return failedResult2(validHttpStatus2(status) ? `${label} request failed (${status})` : `${label} request failed`);
+}
+function successfulResult2(payload) {
+  return { text: JSON.stringify(payload, null, 2), isError: false };
+}
+function projectEndpointRead(response, expectedRef) {
+  if (!successfulResponse2(response))
+    return failedHttpResult2("Project endpoints", response.status);
+  const projection = projectEndpointProjection(response.data);
+  return projection && projection.project_ref === expectedRef ? successfulResult2(projection) : failedResult2("Invalid project endpoint response");
+}
+
 // src/shared/tools/project-cli-tools.ts
 function projectReadResponse(readResult) {
   return {
@@ -10112,12 +10434,17 @@ function resolveRef(refFromArgs, defaultRef) {
     throw new Error("'ref' is required for this action");
   return ref;
 }
+function projectEndpointProjectionPath(ref) {
+  return `/v1/projects/${encodeURIComponent(ref)}/endpoint/projection`;
+}
 function registerUserProjectCliTools(server, http, options = {}) {
-  const { projectRef } = options;
+  const { projectRef: projectRef2 } = options;
   server.tool("project", `Project-scoped inspection and developer operations.
-Actions: get, pause, restore, health, logs, api_keys, settings, tasks, task_detail, task_cancel, task_retry, task_stats, dlq, background_settings, update_background_settings`, {
+Actions: list (Admin guidance), get, endpoints, pause, restore, health, logs, api_keys, settings, tasks, task_detail, task_cancel, task_retry, task_stats, dlq, background_settings, update_background_settings`, {
     action: withDescription(stringEnum([
+      "list",
       "get",
+      "endpoints",
       "pause",
       "restore",
       "health",
@@ -10133,20 +10460,37 @@ Actions: get, pause, restore, health, logs, api_keys, settings, tasks, task_deta
       "background_settings",
       "update_background_settings"
     ]), "Action to perform"),
-    ref: optional(Type.String(), projectRef ? "Optional override when not auto-linked" : "Project ref"),
+    ref: optional(Type.String(), projectRef2 ? "Optional override when not auto-linked" : "Project ref"),
     log_type: optional(stringEnum(["all", "auth", "database", "api"]), "[logs] Filter by service"),
     task_id: optional(Type.String(), "[task_detail/task_cancel/task_retry] Task ID"),
     limit: optional(Type.Number(), "[tasks/dlq] Max items to return"),
     concurrency: optional(Type.Number(), "[update_background_settings] Max concurrent background tasks"),
     max_attempts: optional(Type.Number(), "[update_background_settings] Max attempts for background tasks")
   }, async ({ action, ref, log_type, task_id, limit, concurrency, max_attempts }) => {
-    const resolvedRef = resolveRef(ref, projectRef);
+    if (action === "list") {
+      return {
+        isError: true,
+        content: [{
+          type: "text",
+          text: [
+            "⚠️ Project enumeration is a platform administration operation.",
+            "Use `supacloud-admin project list` with an admin Management API context."
+          ].join(`
+`)
+        }]
+      };
+    }
+    const resolvedRef = resolveRef(ref, projectRef2);
     let text;
     switch (action) {
       case "get":
         return projectReadResponse(projectGetRead(await http.get(`/v1/projects/${resolvedRef}`, {
           maxResponseBytes: PROJECT_READ_RESPONSE_MAX_BYTES
         }), resolvedRef));
+      case "endpoints":
+        return projectReadResponse(projectEndpointRead(await http.get(projectEndpointProjectionPath(resolvedRef), {
+          maxResponseBytes: PROJECT_ENDPOINT_RESPONSE_MAX_BYTES
+        }), resolvedRef));
       case "pause":
         text = simple(await http.post(`/v1/projects/${resolvedRef}/pause`), `Project ${resolvedRef} paused`);
         break;
@@ -10311,7 +10655,7 @@ function resolveRef2(refFromArgs, defaultRef) {
   return ref;
 }
 function registerQueueTools(server, http, options = {}) {
-  const { projectRef } = options;
+  const { projectRef: projectRef2 } = options;
   server.tool("queue", `Message queue operations for task-based messaging.
 Actions: list, stats, list_messages, dlq, get_message, send, receive, ack, release, fail, retry, delete_message, get_settings, update_settings`, {
     action: withDescription(stringEnum([
@@ -10351,7 +10695,7 @@ Actions: list, stats, list_messages, dlq, get_message, send, receive, ack, relea
     max_attempts_setting: optional(Type.Number(), "[update_settings] Max delivery attempts"),
     rate_limit: optional(Type.Number(), "[update_settings] Rate limit per minute")
   }, async (args) => {
-    const resolvedRef = resolveRef2(args.ref, projectRef);
+    const resolvedRef = resolveRef2(args.ref, projectRef2);
     const q = args.queue;
     const need = (fields) => {
       for (const f of fields) {
@@ -10551,7 +10895,7 @@ var redirectStatus = Type.Optional(Type.Union([
 var ok2 = (res) => res.ok ? JSON.stringify(res.data, null, 2) : `❌ Failed (${res.status}): ${JSON.stringify(res.data)}`;
 var simple2 = (res, msg) => res.ok ? `✅ ${msg}` : `❌ Failed (${res.status}): ${JSON.stringify(res.data)}`;
 function registerGatewayTools(server, http, options = {}) {
-  const { projectRef } = options;
+  const { projectRef: projectRef2 } = options;
   server.tool("gateway", `Gateway / Caddy 配置（通过 JSON Admin API 注入）。要求 admin 权限。
 Actions: routes, upsert_route, update_route, delete_route, config, get_certificate, update_certificate, issue_certificate, deploy_certificate, rebuild, custom_hostname, set_custom_hostname, delete_custom_hostname, verify_custom_hostname`, {
     action: withDescription(stringEnum([
@@ -10570,7 +10914,7 @@ Actions: routes, upsert_route, update_route, delete_route, config, get_certifica
       "delete_custom_hostname",
       "verify_custom_hostname"
     ]), "Action"),
-    ref: optional(Type.String(), projectRef ? "可选：覆盖自动关联的项目 ref" : "项目 ref"),
+    ref: optional(Type.String(), projectRef2 ? "可选：覆盖自动关联的项目 ref" : "项目 ref"),
     route_id: optional(Type.String(), "[upsert_route/update_route/delete_route] 路由 ID（字母/数字/_/-，1-64）"),
     hosts: withDescription(stringArray, "[upsert_route/update_route] 主机名列表，逗号分隔或 JSON 数组（1-20）"),
     paths: withDescription(stringArray, "[upsert_route/update_route] 路径列表，逗号分隔或 JSON 数组（1-32）"),
@@ -10605,7 +10949,7 @@ Actions: routes, upsert_route, update_route, delete_route, config, get_certifica
     custom_hostname: optional(Type.String(), "[set_custom_hostname] 自定义域名")
   }, async (args) => {
     const resolveRef3 = (override) => {
-      const ref2 = override || projectRef;
+      const ref2 = override || projectRef2;
       if (!ref2)
         throw new Error("'ref' is required for this action");
       return ref2;
@@ -10828,8 +11172,8 @@ Actions: routes, upsert_route, update_route, delete_route, config, get_certifica
 }
 
 // src/shared/tools/branch-tools.ts
-function resolveProjectRef(ref, projectRef) {
-  const resolved = typeof ref === "string" && ref.trim() ? ref.trim() : projectRef || "";
+function resolveProjectRef(ref, projectRef2) {
+  const resolved = typeof ref === "string" && ref.trim() ? ref.trim() : projectRef2 || "";
   if (!resolved)
     throw new Error("'ref' is required for this action");
   return resolved;
@@ -11281,14 +11625,14 @@ async function executeMigrationPush(request, runtime) {
   const pushMigrations = runtime.getPushMigrations?.();
   if (!pushMigrations)
     return missingMigrationContextResult();
-  const projectRef = request.ref || runtime.projectRef;
-  if (!projectRef)
+  const projectRef2 = request.ref || runtime.projectRef;
+  if (!projectRef2)
     return missingProjectRefResult();
   const workdir = resolveExistingWorkdir(request.workdir, runtime.fallbackWorkdir);
   const migrationDirectory = resolve3(workdir, request.dir || "supabase/migrations");
   const migrationResponse = await pushMigrations({
     action: "push_migrations",
-    ref: projectRef,
+    ref: projectRef2,
     dir: migrationDirectory,
     dry_run: request.dry_run
   });
@@ -12223,7 +12567,7 @@ var INVENTORY_MAX_BYTES = 1024 * 1024;
 var MUTATION_MAX_BYTES = 64 * 1024;
 var BACKUP_TIMEOUT_MS = 36 * 60000;
 var RELEASE_READ_RESPONSE_TIMEOUT_MS = 5000;
-function isRecord(value) {
+function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function canonicalTimestamp3(value) {
@@ -12235,15 +12579,15 @@ function canonicalTimestamp3(value) {
 function validProjectRef(ref) {
   return SAFE_PROJECT_REF.test(ref);
 }
-function backupBelongsToProject(backupId, projectRef) {
-  return BACKUP_ID.test(backupId) && backupId.startsWith(`logical-full_${projectRef}_`);
+function backupBelongsToProject(backupId, projectRef2) {
+  return BACKUP_ID.test(backupId) && backupId.startsWith(`logical-full_${projectRef2}_`);
 }
-function verifiedBackup(value, projectRef) {
-  if (!isRecord(value) || typeof value.backup_id !== "string" || !backupBelongsToProject(value.backup_id, projectRef) || value.project_ref !== projectRef || typeof value.database !== "string" || !SAFE_DATABASE.test(value.database) || value.kind !== "logical-full" || !canonicalTimestamp3(value.created_at) || !canonicalTimestamp3(value.completed_at) || new Date(value.completed_at).valueOf() < new Date(value.created_at).valueOf() || typeof value.bytes !== "number" || !Number.isSafeInteger(value.bytes) || value.bytes <= 0 || typeof value.sha256 !== "string" || !SHA256.test(value.sha256))
+function verifiedBackup(value, projectRef2) {
+  if (!isRecord2(value) || typeof value.backup_id !== "string" || !backupBelongsToProject(value.backup_id, projectRef2) || value.project_ref !== projectRef2 || typeof value.database !== "string" || !SAFE_DATABASE.test(value.database) || value.kind !== "logical-full" || !canonicalTimestamp3(value.created_at) || !canonicalTimestamp3(value.completed_at) || new Date(value.completed_at).valueOf() < new Date(value.created_at).valueOf() || typeof value.bytes !== "number" || !Number.isSafeInteger(value.bytes) || value.bytes <= 0 || typeof value.sha256 !== "string" || !SHA256.test(value.sha256))
     return null;
   return {
     backup_id: value.backup_id,
-    project_ref: projectRef,
+    project_ref: projectRef2,
     database: value.database,
     kind: "logical-full",
     created_at: value.created_at,
@@ -12252,10 +12596,10 @@ function verifiedBackup(value, projectRef) {
     sha256: value.sha256
   };
 }
-function backupInventory(value, projectRef) {
-  if (!isRecord(value) || !Array.isArray(value.backups))
+function backupInventory(value, projectRef2) {
+  if (!isRecord2(value) || !Array.isArray(value.backups))
     return null;
-  const backups = value.backups.map((backup) => verifiedBackup(backup, projectRef));
+  const backups = value.backups.map((backup) => verifiedBackup(backup, projectRef2));
   if (backups.some((backup) => backup === null))
     return null;
   const inventory = backups;
@@ -12286,23 +12630,23 @@ function newlyCreatedBackup(before, after) {
   const additions = after.filter((backup) => !known.has(backup.backup_id));
   return additions.length === 1 ? additions[0] : null;
 }
-function restoreRequest(projectRef, backupId, expectedSha256, restoreConfirmation) {
-  if (typeof backupId !== "string" || !backupBelongsToProject(backupId, projectRef)) {
+function restoreRequest(projectRef2, backupId, expectedSha256, restoreConfirmation) {
+  if (typeof backupId !== "string" || !backupBelongsToProject(backupId, projectRef2)) {
     throw new Error("'backup_id' must identify a logical-full backup for 'ref'");
   }
   if (typeof expectedSha256 !== "string" || !SHA256.test(expectedSha256)) {
     throw new Error("'expected_sha256' must be a lowercase SHA-256 digest");
   }
-  const confirmation = `RESTORE_PROJECT:${projectRef}:${backupId}:${expectedSha256}`;
+  const confirmation = `RESTORE_PROJECT:${projectRef2}:${backupId}:${expectedSha256}`;
   if (restoreConfirmation !== confirmation) {
     throw new Error("'restore_confirmation' must exactly confirm the selected logical backup restore");
   }
   return { backup_id: backupId, expected_sha256: expectedSha256, confirmation };
 }
-function endpoint(projectRef) {
-  if (!validProjectRef(projectRef))
+function endpoint(projectRef2) {
+  if (!validProjectRef(projectRef2))
     throw new Error("'ref' is invalid for release controls");
-  return `/v1/projects/${encodeURIComponent(projectRef)}`;
+  return `/v1/projects/${encodeURIComponent(projectRef2)}`;
 }
 function httpFailure(operation, response) {
   if (response.responseReadError) {
@@ -12316,12 +12660,12 @@ function mutationFailure(operation, response) {
   }
   return releaseControlFailure(operation, "HTTP_ERROR", response.status);
 }
-async function readInventory(http, projectRef) {
-  const response = await http.get(`${endpoint(projectRef)}/database/backups/logical`, {
+async function readInventory(http, projectRef2) {
+  const response = await http.get(`${endpoint(projectRef2)}/database/backups/logical`, {
     maxJsonBytes: INVENTORY_MAX_BYTES,
     responseTimeoutMs: RELEASE_READ_RESPONSE_TIMEOUT_MS
   });
-  return { response, inventory: response.ok && response.status === 200 ? backupInventory(response.data, projectRef) : null };
+  return { response, inventory: response.ok && response.status === 200 ? backupInventory(response.data, projectRef2) : null };
 }
 function readInventoryFailure(operation, read) {
   if (!read.response.ok)
@@ -12332,7 +12676,7 @@ function readInventoryFailure(operation, read) {
   return null;
 }
 function postgrestStatus(value) {
-  if (!isRecord(value) || value.component !== "postgrest" || !["running", "stopped"].includes(String(value.desired)) || !["running", "stopped", "starting", "error"].includes(String(value.actual)) || !["healthy", "unhealthy", "unknown"].includes(String(value.health)))
+  if (!isRecord2(value) || value.component !== "postgrest" || !["running", "stopped"].includes(String(value.desired)) || !["running", "stopped", "starting", "error"].includes(String(value.actual)) || !["healthy", "unhealthy", "unknown"].includes(String(value.health)))
     return null;
   return {
     desired: value.desired,
@@ -12340,8 +12684,8 @@ function postgrestStatus(value) {
     health: value.health
   };
 }
-async function readPostgrestStatus(http, projectRef) {
-  const response = await http.get(`${endpoint(projectRef)}/services/postgrest/status`, {
+async function readPostgrestStatus(http, projectRef2) {
+  const response = await http.get(`${endpoint(projectRef2)}/services/postgrest/status`, {
     maxJsonBytes: MUTATION_MAX_BYTES,
     responseTimeoutMs: RELEASE_READ_RESPONSE_TIMEOUT_MS
   });
@@ -12353,7 +12697,7 @@ function readPostgrestFailure(operation, read) {
   return read.response.status === 200 && read.status ? null : releaseControlFailure(operation, "INVALID_RESPONSE", read.response.status);
 }
 function isRestartReceipt(value) {
-  return isRecord(value) && value.service === "postgrest" && value.action === "restart" && value.success === true;
+  return isRecord2(value) && value.service === "postgrest" && value.action === "restart" && value.success === true;
 }
 function registerReleaseTools(server, http, options = {}) {
   server.tool("release", "Verified release controls using a Management API credential. Actions: logical_backup_list, logical_backup_create, logical_backup_restore, postgrest_status, postgrest_restart", {
@@ -12369,45 +12713,45 @@ function registerReleaseTools(server, http, options = {}) {
     expected_sha256: optional(Type.String(), "[logical_backup_restore] Exact lowercase SHA-256 from the selected project inventory"),
     restore_confirmation: optional(Type.String(), "[logical_backup_restore] Exact RESTORE_PROJECT:<ref>:<backup_id>:<sha256> confirmation")
   }, async ({ action, ref, backup_id, expected_sha256, restore_confirmation }) => {
-    const projectRef = typeof ref === "string" && ref || options.projectRef;
-    if (!projectRef)
+    const projectRef2 = typeof ref === "string" && ref || options.projectRef;
+    if (!projectRef2)
       throw new Error("'ref' is required for release controls");
-    if (!validProjectRef(projectRef))
+    if (!validProjectRef(projectRef2))
       throw new Error("'ref' is invalid for release controls");
     if (action === "logical_backup_list") {
-      const read2 = await readInventory(http, projectRef);
+      const read2 = await readInventory(http, projectRef2);
       const failure = readInventoryFailure("release.logical_backup.list", read2);
       return failure ?? releaseControlSuccess("release.logical_backup.list", {
-        project_ref: projectRef,
+        project_ref: projectRef2,
         backups: read2.inventory.map(publicBackup)
       });
     }
     if (action === "logical_backup_create") {
-      const before = await readInventory(http, projectRef);
+      const before = await readInventory(http, projectRef2);
       const beforeFailure = readInventoryFailure("release.logical_backup.create", before);
       if (beforeFailure)
         return beforeFailure;
-      const mutation2 = await http.postReleaseMutation(`${endpoint(projectRef)}/database/backups/logical`, {}, {
+      const mutation2 = await http.postReleaseMutation(`${endpoint(projectRef2)}/database/backups/logical`, {}, {
         timeoutMs: BACKUP_TIMEOUT_MS
       });
-      const after = await readInventory(http, projectRef);
+      const after = await readInventory(http, projectRef2);
       if (!mutation2.ok || mutation2.status !== 200) {
         return mutationFailure("release.logical_backup.create", mutation2);
       }
-      const responseBackup = isRecord(mutation2.data) ? verifiedBackup(mutation2.data.backup, projectRef) : null;
+      const responseBackup = isRecord2(mutation2.data) ? verifiedBackup(mutation2.data.backup, projectRef2) : null;
       const afterFailure = readInventoryFailure("release.logical_backup.create", after);
       const addedBackup = after.inventory && newlyCreatedBackup(before.inventory, after.inventory);
       if (!responseBackup || afterFailure || !addedBackup || !equalBackup(responseBackup, addedBackup)) {
         return releaseControlFailure("release.logical_backup.create", "OUTCOME_UNKNOWN", mutation2.status);
       }
       return releaseControlSuccess("release.logical_backup.create", {
-        project_ref: projectRef,
+        project_ref: projectRef2,
         backup: publicBackup(addedBackup)
       });
     }
     if (action === "logical_backup_restore") {
-      const request = restoreRequest(projectRef, backup_id, expected_sha256, restore_confirmation);
-      const before = await readInventory(http, projectRef);
+      const request = restoreRequest(projectRef2, backup_id, expected_sha256, restore_confirmation);
+      const before = await readInventory(http, projectRef2);
       const beforeFailure = readInventoryFailure("release.logical_backup.restore", before);
       if (beforeFailure)
         return beforeFailure;
@@ -12415,43 +12759,43 @@ function registerReleaseTools(server, http, options = {}) {
       if (!selectedBackup) {
         return releaseControlFailure("release.logical_backup.restore", "MUTATION_NOT_SUCCEEDED", null);
       }
-      const mutation2 = await http.postReleaseMutation(`${endpoint(projectRef)}/database/backups/logical/restore`, request, { timeoutMs: BACKUP_TIMEOUT_MS });
+      const mutation2 = await http.postReleaseMutation(`${endpoint(projectRef2)}/database/backups/logical/restore`, request, { timeoutMs: BACKUP_TIMEOUT_MS });
       if (!mutation2.ok || mutation2.status !== 200) {
         return mutationFailure("release.logical_backup.restore", mutation2);
       }
-      const responseBackup = isRecord(mutation2.data) ? verifiedBackup(mutation2.data.restored_backup, projectRef) : null;
-      const after = await readInventory(http, projectRef);
+      const responseBackup = isRecord2(mutation2.data) ? verifiedBackup(mutation2.data.restored_backup, projectRef2) : null;
+      const after = await readInventory(http, projectRef2);
       const afterFailure = readInventoryFailure("release.logical_backup.restore", after);
       const restoredInventoryBackup = after.inventory?.find((backup) => backup.backup_id === request.backup_id);
       if (!responseBackup || !equalBackup(responseBackup, selectedBackup) || afterFailure || !restoredInventoryBackup || !equalBackup(restoredInventoryBackup, selectedBackup)) {
         return releaseControlFailure("release.logical_backup.restore", "OUTCOME_UNKNOWN", mutation2.status);
       }
       return releaseControlSuccess("release.logical_backup.restore", {
-        project_ref: projectRef,
+        project_ref: projectRef2,
         backup: publicBackup(selectedBackup)
       });
     }
     if (action === "postgrest_status") {
-      const read2 = await readPostgrestStatus(http, projectRef);
+      const read2 = await readPostgrestStatus(http, projectRef2);
       const failure = readPostgrestFailure("release.postgrest.status", read2);
       return failure ?? releaseControlSuccess("release.postgrest.status", {
-        project_ref: projectRef,
+        project_ref: projectRef2,
         postgrest: read2.status
       });
     }
     if (action !== "postgrest_restart")
       throw new Error("Unknown release control action");
-    const mutation = await http.postReleaseMutation(`${endpoint(projectRef)}/services/postgrest/restart`);
-    const read = await readPostgrestStatus(http, projectRef);
+    const mutation = await http.postReleaseMutation(`${endpoint(projectRef2)}/services/postgrest/restart`);
+    const read = await readPostgrestStatus(http, projectRef2);
     if (!mutation.ok || mutation.status !== 200) {
       return mutationFailure("release.postgrest.restart", mutation);
     }
-    const readFailure = readPostgrestFailure("release.postgrest.restart", read);
-    if (!isRestartReceipt(mutation.data) || readFailure || read.status.desired !== "running" || read.status.actual !== "running" || read.status.health !== "healthy") {
+    const readFailure2 = readPostgrestFailure("release.postgrest.restart", read);
+    if (!isRestartReceipt(mutation.data) || readFailure2 || read.status.desired !== "running" || read.status.actual !== "running" || read.status.health !== "healthy") {
       return releaseControlFailure("release.postgrest.restart", "OUTCOME_UNKNOWN", mutation.status);
     }
     return releaseControlSuccess("release.postgrest.restart", {
-      project_ref: projectRef,
+      project_ref: projectRef2,
       postgrest: read.status
     });
   });
@@ -12459,7 +12803,7 @@ function registerReleaseTools(server, http, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.25.0",
+  version: "0.27.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -12801,7 +13145,7 @@ function createCliTools(context, confirmProduction) {
         ]
       })
     };
-    for (const name of ["database", "auth", "storage", "edge_functions", "secrets", "frontend", "queue", "task_events", "scheduled_functions", "mutations", "diagnostics", "gateway", "branch", "release"]) {
+    for (const name of ["database", "auth", "oauth_clients", "storage", "edge_functions", "secrets", "frontend", "queue", "task_events", "scheduled_functions", "mutations", "diagnostics", "gateway", "branch", "release"]) {
       tools[name] = {
         schema: { action: genericActionSchema },
         callback: async () => ({
@@ -12878,6 +13222,7 @@ function createCliTools(context, confirmProduction) {
   pushMigrations = databaseTools.database?.callback;
   assign(databaseTools);
   assign(captureTools((server) => registerAuthTools(server, http)));
+  assign(captureTools((server) => registerOAuthClientTools(server, http)));
   assign(captureTools((server) => registerStorageTools(server, http)));
   assign(captureTools((server) => registerAdvancedTools(server, http, process.env, {
     readOnly: context.readOnly

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",

package/skills/supacloud-cli/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: supacloud-cli
-description: Use when operating, implementing, diagnosing, deploying, or documenting a SupaCloud project through supacloud-cli, especially database schema, functions/RPC, triggers, RLS, indexes, grants, extensions, migrations, backups, auth, storage, Edge Functions, frontend, queues, task events, diagnostics, or gateway work. Also use when an AI might otherwise call SQL, psql, a database API, or the Management API directly.
+description: Use when operating, implementing, diagnosing, deploying, or documenting a SupaCloud project through supacloud-cli, especially project endpoint discovery, database schema, functions/RPC, triggers, RLS, indexes, grants, extensions, migrations, backups, auth, storage, Edge Functions, frontend, queues, task events, diagnostics, or gateway work. Also use when an AI might otherwise call SQL, psql, a database API, or the Management API directly.
 ---
 
 # SupaCloud CLI
@@ -24,6 +24,8 @@ Use `supacloud-cli` as the project-level control surface and keep durable change
 5. Run a remote migration dry-run before apply. Production apply requires explicit user approval in the current task.
 6. Do not edit `supabase_migrations.schema_migrations` through ordinary SQL. Migration history is an application ledger, not a schema backup or source of truth. For a proven-equivalent historical baseline, use the controlled `database baseline_migrations` action with dry-run and explicit approval.
 7. Service-role credentials authenticate the SupaCloud Management API. Never reinterpret them as PostgreSQL passwords or forward them to the official Supabase CLI.
+8. Read project domains through `supacloud-cli project endpoints`. Do not infer API, Auth, or Studio origins by concatenating project refs and base domains. The projection reports configuration, not DNS/certificate/runtime readiness.
+9. Cross-project enumeration is an Admin boundary. Use `supacloud-admin project list` or `supacloud-admin project list_endpoints`; do not attempt to widen project credentials.
 
 ## Workflow
 
@@ -36,6 +38,20 @@ Use `supacloud-cli` as the project-level control surface and keep durable change
 7. Apply only within the user-authorized environment and scope.
 8. Read back migration history and affected resources; report exact evidence and any remaining drift.
 
+## Project endpoint inspection
+
+For the selected project:
+
+```bash
+supacloud-cli status
+supacloud-cli project endpoints
+```
+
+The fixed projection contains credential-free API/Auth/Studio origins, hosts,
+schemes, source classifications, and API aliases. Follow it with the relevant
+health or gateway command before claiming that DNS, TLS, routing, or a runtime is
+ready. Project-wide or fleet-wide inventories belong to `supacloud-admin`.
+
 ## Database default
 
 For a new database change:
@@ -66,8 +82,8 @@ supacloud-cli database baseline_migrations \
 
 ## CLI boundaries
 
-- `supacloud-cli`: project status, database, migrations, auth, storage, Edge Functions, frontend, queues, task events, diagnostics, and project gateway configuration.
-- `supacloud-admin`: installation, upgrades, SSH diagnostics, platform-wide project lifecycle, tenant runtime, and server operations.
+- `supacloud-cli`: selected-project status and endpoint projection, database, migrations, auth, storage, Edge Functions, frontend, queues, task events, diagnostics, and project gateway configuration.
+- `supacloud-admin`: installation, upgrades, SSH diagnostics, platform-wide project/endpoint inventory, project lifecycle, tenant runtime, and server operations.
 - Official `supabase` CLI: invoked only through the allowlisted `supacloud-cli supabase` adapter for supported local authoring or explicit-DSN inspection commands.
 - Direct HTTP/SQL: read-only diagnosis or an explicitly approved break-glass path; never the default implementation path.
 

package/skills/supacloud-cli/references/command-map.md

@@ -7,6 +7,8 @@ Load this reference when selecting a command surface or when a user asks an AI t
 | Intent | Use | Guardrail |
 | --- | --- | --- |
 | Inspect current project binding | `supacloud-cli status` | Read-only; run first |
+| Inspect selected project API/Auth/Studio origins | `supacloud-cli project endpoints` | Uses the Management API's authoritative projection; do not reconstruct domains locally |
+| Enumerate projects or endpoint projections | `supacloud-admin project list` / `project list_endpoints` | Platform-wide read; never promote a project credential to Admin authority |
 | Inspect project health/logs/tasks | `project`, `queue`, `task_events`, `diagnostics` | Prefer bounded reads |
 | Read database rows or metadata | `database query` and database inspection actions | `SELECT`/read-only by default |
 | Create schema/function/RPC/trigger/RLS/index/grant/extension | `supabase migration_new`, then edit SQL | Never direct remote DDL |
@@ -26,7 +28,7 @@ until a project-scoped context is resolved.
 ## Command groups
 
 - `status`: resolved context, Management API connectivity, authentication, and project reachability.
-- `project`: project metadata, health, logs, API keys/settings, background tasks, retry/cancel, DLQ, and background settings.
+- `project`: selected-project metadata, authoritative endpoint projection, health, logs, API keys/settings, background tasks, retry/cancel, DLQ, and background settings. `project list` deliberately redirects to `supacloud-admin`; cross-project enumeration is not a project CLI capability.
 - `database`: read/query, schema inspection, extensions, indexes, RLS, stats, migration push, controlled historical baseline, and SQL-file execution.
 - `supabase`: allowlisted official CLI adapter for migration authoring, local reset/diff, explicit-DSN inspection/backup/type generation, and SupaCloud-controlled migration push.
 - `auth`: provider and authentication configuration.
@@ -43,8 +45,14 @@ until a project-scoped context is resolved.
 ```bash
 supacloud-cli status
 supacloud-cli project get
+supacloud-cli project endpoints
 supacloud-cli project health
 supacloud-cli supabase migration_list --db_url "$SUPACLOUD_DB_URL"
 ```
 
+The endpoint projection returns bounded, credential-free API/Auth/Studio origins,
+canonical hosts, URL schemes, configuration sources, and API aliases. It does
+not assert DNS, certificate, or runtime readiness; use the relevant health and
+gateway inspection commands for those checks.
+
 Do not paste the DSN value into chat or commit it to shell scripts. Prefer an environment variable supplied outside the repository.