@supacloud/cli 0.26.0 → 0.28.0

package/dist/index.js

@@ -6458,8 +6458,9 @@ function resolveSupaCloudContext(env = process.env, cwd = process.cwd(), selecti
 // src/shared/execution-policy.ts
 var ACTION_POLICY = {
   project: {
-    read: ["get", "health", "logs", "api_keys", "settings", "tasks", "task_detail", "task_stats", "dlq", "background_settings"],
-    write: ["pause", "restore", "task_cancel", "task_retry", "update_background_settings"]
+    read: ["get", "endpoints", "health", "logs", "api_keys", "settings", "tasks", "task_detail", "task_stats", "dlq", "background_settings"],
+    write: ["pause", "restore", "task_cancel", "task_retry", "update_background_settings"],
+    local: ["list"]
   },
   database: {
     read: ["list_tables", "describe_columns", "list_indexes", "list_constraints", "list_extensions", "rls_status", "rls_policies", "list_auth_users", "get_auth_user", "connections", "stats", "slow_queries", "list_migrations", "migration_inventory", "project_url", "generate_types"],
@@ -6470,8 +6471,8 @@ var ACTION_POLICY = {
     write: ["push"]
   },
   auth: {
-    read: ["list_providers", "get_provider", "supported_providers", "get_settings", "get_config"],
-    write: ["configure_provider", "update_provider", "disable_provider", "wechat_mini", "wechat_open", "update_settings", "update_config"]
+    read: ["list_users", "get_user", "list_providers", "get_provider", "supported_providers", "get_settings", "get_config"],
+    write: ["generate_link", "configure_provider", "update_provider", "disable_provider", "wechat_mini", "wechat_open", "update_settings", "update_config"]
   },
   oauth_clients: {
     read: ["list", "get"],
@@ -7967,6 +7968,25 @@ var safeAuthMutationCodes = new Set([
   "AUTH_RUNTIME_APPLY_FAILED",
   "SUPAUTH_DEPENDENT_REFRESH_FAILED"
 ]);
+var MAX_AUTH_READ_BYTES = 64 * 1024;
+var AUTH_READ_TIMEOUT_MS = 5000;
+var USER_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var AUTH_LINK_TYPES = [
+  "signup",
+  "magiclink",
+  "recovery",
+  "invite",
+  "email_change",
+  "email_change_current",
+  "email_change_new"
+];
+var SAFE_USER_FIELDS = [
+  "id",
+  "email",
+  "phone",
+  "created_at",
+  "last_sign_in_at"
+];
 function parseAuthConfig(input) {
   if (typeof input !== "string")
     return input;
@@ -8018,6 +8038,162 @@ function authMutationResult(response, successMessage) {
     }]
   };
 }
+function requiredRef(candidate) {
+  if (typeof candidate !== "string" || !candidate.trim())
+    throw new Error("'ref' is required");
+  return projectRefPathSegment(candidate.trim(), "Auth");
+}
+function requiredUserId(candidate) {
+  if (typeof candidate !== "string" || !USER_ID_PATTERN.test(candidate.trim())) {
+    throw new Error("'user_id' must be a UUID");
+  }
+  return candidate.trim().toLowerCase();
+}
+function boundedPage(candidate) {
+  if (candidate === undefined)
+    return 1;
+  if (typeof candidate !== "number" || !Number.isSafeInteger(candidate) || candidate < 1) {
+    throw new Error("'page' must be a positive integer");
+  }
+  return candidate;
+}
+function boundedPerPage(candidate) {
+  if (candidate === undefined)
+    return 50;
+  if (typeof candidate !== "number" || !Number.isSafeInteger(candidate) || candidate < 1 || candidate > 100) {
+    throw new Error("'per_page' must be an integer between 1 and 100");
+  }
+  return candidate;
+}
+function safeRedirectTo(candidate) {
+  if (candidate === undefined)
+    return;
+  if (typeof candidate !== "string" || !candidate.trim())
+    throw new Error("'redirect_to' must be an absolute HTTPS or loopback HTTP URL");
+  let uri;
+  try {
+    uri = new URL(candidate.trim());
+  } catch {
+    throw new Error("'redirect_to' must be an absolute HTTPS or loopback HTTP URL");
+  }
+  const loopback = uri.hostname === "127.0.0.1" || uri.hostname === "[::1]";
+  const validProtocol = uri.protocol === "https:" || uri.protocol === "http:" && loopback && Boolean(uri.port);
+  if (!validProtocol || uri.username || uri.password || uri.hash) {
+    throw new Error("'redirect_to' must be an absolute HTTPS or loopback HTTP URL without credentials or fragment");
+  }
+  return uri.toString();
+}
+function isRecord(candidate) {
+  return candidate !== null && typeof candidate === "object" && !Array.isArray(candidate);
+}
+function projectUser(candidate) {
+  if (!isRecord(candidate) || typeof candidate.id !== "string")
+    return null;
+  const projectedUser = {};
+  for (const field of SAFE_USER_FIELDS) {
+    if (field in candidate)
+      projectedUser[field] = candidate[field];
+  }
+  return projectedUser;
+}
+function projectUserList(candidate) {
+  if (!isRecord(candidate) || !Array.isArray(candidate.users))
+    return null;
+  const users = candidate.users.map(projectUser);
+  if (users.some((user) => user === null))
+    return null;
+  const projectedFields = { users };
+  for (const field of ["total", "page", "per_page", "next_page", "last_page"]) {
+    if (field in candidate && (typeof candidate[field] === "number" || candidate[field] === null)) {
+      projectedFields[field] = candidate[field];
+    }
+  }
+  return projectedFields;
+}
+function actionLink(candidate) {
+  const candidates = [candidate];
+  if (isRecord(candidate)) {
+    candidates.push(candidate.data, candidate.properties);
+    if (isRecord(candidate.data))
+      candidates.push(candidate.data.properties);
+  }
+  for (const candidate2 of candidates) {
+    if (isRecord(candidate2) && typeof candidate2.action_link === "string" && candidate2.action_link.length > 0) {
+      return candidate2.action_link;
+    }
+  }
+  return null;
+}
+function safeAuthReadFailure(operation, response) {
+  return {
+    isError: true,
+    content: [{
+      type: "text",
+      text: JSON.stringify({
+        ok: false,
+        operation,
+        http_status: response.transportError || response.responseReadError ? null : response.status,
+        error: response.responseReadError ? "INVALID_RESPONSE" : response.transportError ? "NETWORK_ERROR" : "HTTP_ERROR"
+      }, null, 2)
+    }]
+  };
+}
+async function listUsers(http, args) {
+  const ref = requiredRef(args.ref);
+  const page = boundedPage(args.page);
+  const perPage = boundedPerPage(args.per_page);
+  const params = new URLSearchParams({ page: String(page), per_page: String(perPage) });
+  for (const key of ["search", "email_like"]) {
+    if (args[key] !== undefined) {
+      if (typeof args[key] !== "string" || !args[key].trim())
+        throw new Error(`'${key}' must be a non-empty string`);
+      params.set(key, args[key].trim());
+    }
+  }
+  const response = await http.get(`/v1/projects/${ref}/auth/users?${params.toString()}`, {
+    maxJsonBytes: MAX_AUTH_READ_BYTES,
+    responseTimeoutMs: AUTH_READ_TIMEOUT_MS
+  });
+  if (!response.ok)
+    return safeAuthReadFailure("auth.list_users", response);
+  const users = projectUserList(response.data);
+  if (!users)
+    return safeAuthReadFailure("auth.list_users", { ...response, responseReadError: true });
+  return { content: [{ type: "text", text: JSON.stringify({ ok: true, operation: "auth.list_users", project_ref: ref, ...users }, null, 2) }] };
+}
+async function getUser(http, args) {
+  const ref = requiredRef(args.ref);
+  const userId = requiredUserId(args.user_id);
+  const response = await http.get(`/v1/projects/${ref}/auth/users/${encodeURIComponent(userId)}`, {
+    maxJsonBytes: MAX_AUTH_READ_BYTES,
+    responseTimeoutMs: AUTH_READ_TIMEOUT_MS
+  });
+  if (!response.ok)
+    return safeAuthReadFailure("auth.get_user", response);
+  const user = projectUser(response.data);
+  if (!user)
+    return safeAuthReadFailure("auth.get_user", { ...response, responseReadError: true });
+  return { content: [{ type: "text", text: JSON.stringify({ ok: true, operation: "auth.get_user", project_ref: ref, user }, null, 2) }] };
+}
+async function generateLink(http, args) {
+  const ref = requiredRef(args.ref);
+  if (typeof args.type !== "string" || !AUTH_LINK_TYPES.includes(args.type)) {
+    throw new Error("'type' is invalid for 'generate_link'");
+  }
+  if (typeof args.email !== "string" || !args.email.trim())
+    throw new Error("'email' is required for 'generate_link'");
+  const body = { type: args.type, email: args.email.trim() };
+  const redirectTo = safeRedirectTo(args.redirect_to);
+  if (redirectTo)
+    body.redirect_to = redirectTo;
+  const response = await http.postReleaseMutation(`/v1/projects/${ref}/auth/generate_link`, body);
+  if (!response.ok)
+    return safeAuthReadFailure("auth.generate_link", response);
+  const link = actionLink(response.data);
+  if (!link)
+    return safeAuthReadFailure("auth.generate_link", { ...response, responseReadError: true });
+  return { content: [{ type: "text", text: JSON.stringify({ ok: true, operation: "auth.generate_link", action_link: link }, null, 2) }] };
+}
 function formatProviders(data) {
   if (!data || typeof data !== "object")
     return JSON.stringify(data, null, 2);
@@ -8050,9 +8226,12 @@ function formatProviders(data) {
   return out;
 }
 function registerAuthTools(server, http) {
-  server.tool("auth", `Auth & OAuth provider management.
-Actions: list_providers, get_provider, configure_provider, update_provider, disable_provider, supported_providers, wechat_mini, wechat_open, get_settings, update_settings, get_config, update_config`, {
+  server.tool("auth", `Auth & OAuth provider management, controlled user lookup, and login-link generation.
+Actions: list_users, get_user, generate_link, list_providers, get_provider, configure_provider, update_provider, disable_provider, supported_providers, wechat_mini, wechat_open, get_settings, update_settings, get_config, update_config`, {
     action: withDescription(stringEnum([
+      "list_users",
+      "get_user",
+      "generate_link",
       "list_providers",
       "get_provider",
       "configure_provider",
@@ -8067,6 +8246,14 @@ Actions: list_providers, get_provider, configure_provider, update_provider, disa
       "update_config"
     ]), "Action to perform"),
     ref: optional(Type.String(), "Project ref (required for most actions)"),
+    user_id: optional(Type.String(), "[get_user] Exact auth user UUID"),
+    page: optional(Type.Integer({ minimum: 1 }), "[list_users] 1-based page"),
+    per_page: optional(Type.Integer({ minimum: 1, maximum: 100 }), "[list_users] Users per page (1-100)"),
+    search: optional(Type.String(), "[list_users] Search user email, phone, or UUID"),
+    email_like: optional(Type.String(), "[list_users] Search user email or phone"),
+    type: optional(stringEnum(AUTH_LINK_TYPES), "[generate_link] GoTrue link type"),
+    email: optional(Type.String(), "[generate_link] User email"),
+    redirect_to: optional(Type.String(), "[generate_link] Absolute HTTPS or loopback callback"),
     provider: optional(Type.String(), "[*_provider] Provider name (github, google, wechat, etc.)"),
     client_id: optional(Type.String(), "[configure/update] OAuth Client ID"),
     client_secret: optional(Type.String(), "[configure/update] OAuth Client Secret"),
@@ -8084,6 +8271,12 @@ Actions: list_providers, get_provider, configure_provider, update_provider, disa
     const ok = (res) => res.ok ? JSON.stringify(res.data, null, 2) : `❌ Failed (${res.status}): ${JSON.stringify(res.data)}`;
     let text;
     switch (action) {
+      case "list_users":
+        return listUsers(http, args);
+      case "get_user":
+        return getUser(http, args);
+      case "generate_link":
+        return generateLink(http, args);
       case "list_providers":
         need("ref");
         const lp = await http.get(`/v1/projects/${ref}/auth/providers`);
@@ -8179,7 +8372,7 @@ var RELEASE_CANARY_CLIENT_NAME = "supacloud-release-canary";
 var CLIENT_ID_PATTERN = /^[A-Za-z0-9._~-]{1,256}$/;
 var MAX_CLIENT_LIST_BYTES = 256 * 1024;
 var READ_TIMEOUT_MS = 5000;
-function isRecord(value) {
+function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function releaseCanaryCallbackUri(value) {
@@ -8201,7 +8394,7 @@ function releaseCanaryCallbackUri(value) {
   return uri.toString();
 }
 function createdClientId(value) {
-  if (!isRecord(value))
+  if (!isRecord2(value))
     return null;
   try {
     return clientId(value.client_id);
@@ -8224,7 +8417,7 @@ function oauthClientsPath(ref) {
   return `/v1/projects/${encodeURIComponent(ref)}/auth/oauth-clients`;
 }
 function expectedClient(value, redirectUri) {
-  if (!isRecord(value) || typeof value.client_id !== "string" || !CLIENT_ID_PATTERN.test(value.client_id) || value.client_name !== RELEASE_CANARY_CLIENT_NAME || value.client_type !== "public" || value.token_endpoint_auth_method !== "none" || !Array.isArray(value.redirect_uris) || value.redirect_uris.length !== 1 || !Array.isArray(value.grant_types) || value.grant_types.length !== 1 || value.grant_types[0] !== "authorization_code" || !Array.isArray(value.response_types) || value.response_types.length !== 1 || value.response_types[0] !== "code")
+  if (!isRecord2(value) || typeof value.client_id !== "string" || !CLIENT_ID_PATTERN.test(value.client_id) || value.client_name !== RELEASE_CANARY_CLIENT_NAME || value.client_type !== "public" || value.token_endpoint_auth_method !== "none" || !Array.isArray(value.redirect_uris) || value.redirect_uris.length !== 1 || !Array.isArray(value.grant_types) || value.grant_types.length !== 1 || value.grant_types[0] !== "authorization_code" || !Array.isArray(value.response_types) || value.response_types.length !== 1 || value.response_types[0] !== "code")
     return null;
   let callback;
   try {
@@ -8245,9 +8438,9 @@ function expectedClient(value, redirectUri) {
   };
 }
 function clientInventory(value) {
-  if (!isRecord(value) || !Array.isArray(value.clients))
+  if (!isRecord2(value) || !Array.isArray(value.clients))
     return null;
-  const clients = value.clients.filter((client) => isRecord(client) && client.client_name === RELEASE_CANARY_CLIENT_NAME).map((client) => expectedClient(client));
+  const clients = value.clients.filter((client) => isRecord2(client) && client.client_name === RELEASE_CANARY_CLIENT_NAME).map((client) => expectedClient(client));
   if (clients.some((client) => client === null))
     return null;
   const inventory = clients;
@@ -10191,6 +10384,115 @@ function projectGetRead(response, expectedRef) {
   return project ? successfulResult(project) : failedResult("Invalid project response");
 }
 
+// src/shared/tools/project-endpoint-read.ts
+var PROJECT_ENDPOINT_RESPONSE_MAX_BYTES = 256 * 1024;
+var PROJECT_ENDPOINT_LIST_RESPONSE_MAX_BYTES = 1024 * 1024;
+var PROJECT_REF_PATTERN4 = /^[a-z0-9-]{1,20}$/;
+var PROJECT_ENDPOINTS_SCHEMA = "supacloud.project-endpoints.v1";
+var PROJECT_ENDPOINT_SOURCES = new Set([
+  "explicit_api_domain",
+  "explicit_auth_domain",
+  "explicit_studio_domain",
+  "custom_domain",
+  "derived_api_domain",
+  "generated"
+]);
+var ROOT_KEYS = new Set(["schema", "project_ref", "endpoints"]);
+var ENDPOINTS_KEYS = new Set(["api", "auth", "studio"]);
+var ENDPOINT_KEYS = new Set(["origin", "host", "scheme", "source", "aliases"]);
+var MAX_ALIASES = 64;
+function plainRecord2(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+    return null;
+  const prototype = Object.getPrototypeOf(candidate);
+  return prototype === Object.prototype || prototype === null ? candidate : null;
+}
+function hasOnlyKeys2(record, allowedKeys) {
+  return Object.keys(record).every((key) => allowedKeys.has(key));
+}
+function boundedText2(candidate, maxLength) {
+  return typeof candidate === "string" && candidate.length > 0 && candidate.length <= maxLength && !/[\u0000-\u001f\u007f]/u.test(candidate) ? candidate : null;
+}
+function canonicalHost(candidate, scheme) {
+  const host = boundedText2(candidate, 255);
+  if (!host)
+    return null;
+  try {
+    const parsed = new URL(`${scheme}://${host}`);
+    return parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || parsed.host !== host ? null : host;
+  } catch {
+    return null;
+  }
+}
+function projectEndpoint2(candidate) {
+  const endpoint = plainRecord2(candidate);
+  if (!endpoint || !hasOnlyKeys2(endpoint, ENDPOINT_KEYS))
+    return null;
+  const scheme = endpoint.scheme === "http" || endpoint.scheme === "https" ? endpoint.scheme : null;
+  const origin = boundedText2(endpoint.origin, 2048);
+  const source = boundedText2(endpoint.source, 64);
+  if (!scheme || !origin || !source || !PROJECT_ENDPOINT_SOURCES.has(source))
+    return null;
+  let parsedOrigin;
+  try {
+    parsedOrigin = new URL(origin);
+  } catch {
+    return null;
+  }
+  if (parsedOrigin.protocol !== `${scheme}:` || parsedOrigin.origin !== origin || parsedOrigin.username || parsedOrigin.password || parsedOrigin.pathname !== "/" || parsedOrigin.search || parsedOrigin.hash)
+    return null;
+  const host = canonicalHost(endpoint.host, scheme);
+  if (!host || host !== parsedOrigin.host || !Array.isArray(endpoint.aliases) || endpoint.aliases.length > MAX_ALIASES)
+    return null;
+  const aliases = [];
+  const seenAliases = new Set;
+  for (const aliasCandidate of endpoint.aliases) {
+    const alias = canonicalHost(aliasCandidate, scheme);
+    if (!alias || alias === host || seenAliases.has(alias))
+      return null;
+    seenAliases.add(alias);
+    aliases.push(alias);
+  }
+  return { origin, host, scheme, source, aliases };
+}
+function projectEndpointProjection(candidate) {
+  const projection = plainRecord2(candidate);
+  if (!projection || !hasOnlyKeys2(projection, ROOT_KEYS) || projection.schema !== PROJECT_ENDPOINTS_SCHEMA || typeof projection.project_ref !== "string" || !PROJECT_REF_PATTERN4.test(projection.project_ref))
+    return null;
+  const endpoints = plainRecord2(projection.endpoints);
+  if (!endpoints || !hasOnlyKeys2(endpoints, ENDPOINTS_KEYS))
+    return null;
+  const api = projectEndpoint2(endpoints.api);
+  const auth = projectEndpoint2(endpoints.auth);
+  const studio = projectEndpoint2(endpoints.studio);
+  return api && auth && studio ? {
+    schema: PROJECT_ENDPOINTS_SCHEMA,
+    project_ref: projection.project_ref,
+    endpoints: { api, auth, studio }
+  } : null;
+}
+function validHttpStatus2(status) {
+  return Number.isSafeInteger(status) && status >= 100 && status <= 599;
+}
+function successfulResponse2(response) {
+  return response.ok === true && validHttpStatus2(response.status) && response.status >= 200 && response.status <= 299;
+}
+function failedResult2(message) {
+  return { text: `❌ ${message}`, isError: true };
+}
+function failedHttpResult2(label, status) {
+  return failedResult2(validHttpStatus2(status) ? `${label} request failed (${status})` : `${label} request failed`);
+}
+function successfulResult2(payload) {
+  return { text: JSON.stringify(payload, null, 2), isError: false };
+}
+function projectEndpointRead(response, expectedRef) {
+  if (!successfulResponse2(response))
+    return failedHttpResult2("Project endpoints", response.status);
+  const projection = projectEndpointProjection(response.data);
+  return projection && projection.project_ref === expectedRef ? successfulResult2(projection) : failedResult2("Invalid project endpoint response");
+}
+
 // src/shared/tools/project-cli-tools.ts
 function projectReadResponse(readResult) {
   return {
@@ -10324,12 +10626,17 @@ function resolveRef(refFromArgs, defaultRef) {
     throw new Error("'ref' is required for this action");
   return ref;
 }
+function projectEndpointProjectionPath(ref) {
+  return `/v1/projects/${encodeURIComponent(ref)}/endpoint/projection`;
+}
 function registerUserProjectCliTools(server, http, options = {}) {
   const { projectRef: projectRef2 } = options;
   server.tool("project", `Project-scoped inspection and developer operations.
-Actions: get, pause, restore, health, logs, api_keys, settings, tasks, task_detail, task_cancel, task_retry, task_stats, dlq, background_settings, update_background_settings`, {
+Actions: list (Admin guidance), get, endpoints, pause, restore, health, logs, api_keys, settings, tasks, task_detail, task_cancel, task_retry, task_stats, dlq, background_settings, update_background_settings`, {
     action: withDescription(stringEnum([
+      "list",
       "get",
+      "endpoints",
       "pause",
       "restore",
       "health",
@@ -10352,6 +10659,19 @@ Actions: get, pause, restore, health, logs, api_keys, settings, tasks, task_deta
     concurrency: optional(Type.Number(), "[update_background_settings] Max concurrent background tasks"),
     max_attempts: optional(Type.Number(), "[update_background_settings] Max attempts for background tasks")
   }, async ({ action, ref, log_type, task_id, limit, concurrency, max_attempts }) => {
+    if (action === "list") {
+      return {
+        isError: true,
+        content: [{
+          type: "text",
+          text: [
+            "⚠️ Project enumeration is a platform administration operation.",
+            "Use `supacloud-admin project list` with an admin Management API context."
+          ].join(`
+`)
+        }]
+      };
+    }
     const resolvedRef = resolveRef(ref, projectRef2);
     let text;
     switch (action) {
@@ -10359,6 +10679,10 @@ Actions: get, pause, restore, health, logs, api_keys, settings, tasks, task_deta
         return projectReadResponse(projectGetRead(await http.get(`/v1/projects/${resolvedRef}`, {
           maxResponseBytes: PROJECT_READ_RESPONSE_MAX_BYTES
         }), resolvedRef));
+      case "endpoints":
+        return projectReadResponse(projectEndpointRead(await http.get(projectEndpointProjectionPath(resolvedRef), {
+          maxResponseBytes: PROJECT_ENDPOINT_RESPONSE_MAX_BYTES
+        }), resolvedRef));
       case "pause":
         text = simple(await http.post(`/v1/projects/${resolvedRef}/pause`), `Project ${resolvedRef} paused`);
         break;
@@ -12435,7 +12759,7 @@ var INVENTORY_MAX_BYTES = 1024 * 1024;
 var MUTATION_MAX_BYTES = 64 * 1024;
 var BACKUP_TIMEOUT_MS = 36 * 60000;
 var RELEASE_READ_RESPONSE_TIMEOUT_MS = 5000;
-function isRecord2(value) {
+function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function canonicalTimestamp3(value) {
@@ -12451,7 +12775,7 @@ function backupBelongsToProject(backupId, projectRef2) {
   return BACKUP_ID.test(backupId) && backupId.startsWith(`logical-full_${projectRef2}_`);
 }
 function verifiedBackup(value, projectRef2) {
-  if (!isRecord2(value) || typeof value.backup_id !== "string" || !backupBelongsToProject(value.backup_id, projectRef2) || value.project_ref !== projectRef2 || typeof value.database !== "string" || !SAFE_DATABASE.test(value.database) || value.kind !== "logical-full" || !canonicalTimestamp3(value.created_at) || !canonicalTimestamp3(value.completed_at) || new Date(value.completed_at).valueOf() < new Date(value.created_at).valueOf() || typeof value.bytes !== "number" || !Number.isSafeInteger(value.bytes) || value.bytes <= 0 || typeof value.sha256 !== "string" || !SHA256.test(value.sha256))
+  if (!isRecord3(value) || typeof value.backup_id !== "string" || !backupBelongsToProject(value.backup_id, projectRef2) || value.project_ref !== projectRef2 || typeof value.database !== "string" || !SAFE_DATABASE.test(value.database) || value.kind !== "logical-full" || !canonicalTimestamp3(value.created_at) || !canonicalTimestamp3(value.completed_at) || new Date(value.completed_at).valueOf() < new Date(value.created_at).valueOf() || typeof value.bytes !== "number" || !Number.isSafeInteger(value.bytes) || value.bytes <= 0 || typeof value.sha256 !== "string" || !SHA256.test(value.sha256))
     return null;
   return {
     backup_id: value.backup_id,
@@ -12465,7 +12789,7 @@ function verifiedBackup(value, projectRef2) {
   };
 }
 function backupInventory(value, projectRef2) {
-  if (!isRecord2(value) || !Array.isArray(value.backups))
+  if (!isRecord3(value) || !Array.isArray(value.backups))
     return null;
   const backups = value.backups.map((backup) => verifiedBackup(backup, projectRef2));
   if (backups.some((backup) => backup === null))
@@ -12544,7 +12868,7 @@ function readInventoryFailure(operation, read) {
   return null;
 }
 function postgrestStatus(value) {
-  if (!isRecord2(value) || value.component !== "postgrest" || !["running", "stopped"].includes(String(value.desired)) || !["running", "stopped", "starting", "error"].includes(String(value.actual)) || !["healthy", "unhealthy", "unknown"].includes(String(value.health)))
+  if (!isRecord3(value) || value.component !== "postgrest" || !["running", "stopped"].includes(String(value.desired)) || !["running", "stopped", "starting", "error"].includes(String(value.actual)) || !["healthy", "unhealthy", "unknown"].includes(String(value.health)))
     return null;
   return {
     desired: value.desired,
@@ -12565,7 +12889,7 @@ function readPostgrestFailure(operation, read) {
   return read.response.status === 200 && read.status ? null : releaseControlFailure(operation, "INVALID_RESPONSE", read.response.status);
 }
 function isRestartReceipt(value) {
-  return isRecord2(value) && value.service === "postgrest" && value.action === "restart" && value.success === true;
+  return isRecord3(value) && value.service === "postgrest" && value.action === "restart" && value.success === true;
 }
 function registerReleaseTools(server, http, options = {}) {
   server.tool("release", "Verified release controls using a Management API credential. Actions: logical_backup_list, logical_backup_create, logical_backup_restore, postgrest_status, postgrest_restart", {
@@ -12606,7 +12930,7 @@ function registerReleaseTools(server, http, options = {}) {
       if (!mutation2.ok || mutation2.status !== 200) {
         return mutationFailure("release.logical_backup.create", mutation2);
       }
-      const responseBackup = isRecord2(mutation2.data) ? verifiedBackup(mutation2.data.backup, projectRef2) : null;
+      const responseBackup = isRecord3(mutation2.data) ? verifiedBackup(mutation2.data.backup, projectRef2) : null;
       const afterFailure = readInventoryFailure("release.logical_backup.create", after);
       const addedBackup = after.inventory && newlyCreatedBackup(before.inventory, after.inventory);
       if (!responseBackup || afterFailure || !addedBackup || !equalBackup(responseBackup, addedBackup)) {
@@ -12631,7 +12955,7 @@ function registerReleaseTools(server, http, options = {}) {
       if (!mutation2.ok || mutation2.status !== 200) {
         return mutationFailure("release.logical_backup.restore", mutation2);
       }
-      const responseBackup = isRecord2(mutation2.data) ? verifiedBackup(mutation2.data.restored_backup, projectRef2) : null;
+      const responseBackup = isRecord3(mutation2.data) ? verifiedBackup(mutation2.data.restored_backup, projectRef2) : null;
       const after = await readInventory(http, projectRef2);
       const afterFailure = readInventoryFailure("release.logical_backup.restore", after);
       const restoredInventoryBackup = after.inventory?.find((backup) => backup.backup_id === request.backup_id);
@@ -12671,7 +12995,7 @@ function registerReleaseTools(server, http, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.26.0",
+  version: "0.28.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",

package/skills/supacloud-cli/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: supacloud-cli
-description: Use when operating, implementing, diagnosing, deploying, or documenting a SupaCloud project through supacloud-cli, especially database schema, functions/RPC, triggers, RLS, indexes, grants, extensions, migrations, backups, auth, storage, Edge Functions, frontend, queues, task events, diagnostics, or gateway work. Also use when an AI might otherwise call SQL, psql, a database API, or the Management API directly.
+description: Use when operating, implementing, diagnosing, deploying, or documenting a SupaCloud project through supacloud-cli, especially project endpoint discovery, database schema, functions/RPC, triggers, RLS, indexes, grants, extensions, migrations, backups, auth, storage, Edge Functions, frontend, queues, task events, diagnostics, or gateway work. Also use when an AI might otherwise call SQL, psql, a database API, or the Management API directly.
 ---
 
 # SupaCloud CLI
@@ -24,6 +24,8 @@ Use `supacloud-cli` as the project-level control surface and keep durable change
 5. Run a remote migration dry-run before apply. Production apply requires explicit user approval in the current task.
 6. Do not edit `supabase_migrations.schema_migrations` through ordinary SQL. Migration history is an application ledger, not a schema backup or source of truth. For a proven-equivalent historical baseline, use the controlled `database baseline_migrations` action with dry-run and explicit approval.
 7. Service-role credentials authenticate the SupaCloud Management API. Never reinterpret them as PostgreSQL passwords or forward them to the official Supabase CLI.
+8. Read project domains through `supacloud-cli project endpoints`. Do not infer API, Auth, or Studio origins by concatenating project refs and base domains. The projection reports configuration, not DNS/certificate/runtime readiness.
+9. Cross-project enumeration is an Admin boundary. Use `supacloud-admin project list` or `supacloud-admin project list_endpoints`; do not attempt to widen project credentials.
 
 ## Workflow
 
@@ -36,6 +38,20 @@ Use `supacloud-cli` as the project-level control surface and keep durable change
 7. Apply only within the user-authorized environment and scope.
 8. Read back migration history and affected resources; report exact evidence and any remaining drift.
 
+## Project endpoint inspection
+
+For the selected project:
+
+```bash
+supacloud-cli status
+supacloud-cli project endpoints
+```
+
+The fixed projection contains credential-free API/Auth/Studio origins, hosts,
+schemes, source classifications, and API aliases. Follow it with the relevant
+health or gateway command before claiming that DNS, TLS, routing, or a runtime is
+ready. Project-wide or fleet-wide inventories belong to `supacloud-admin`.
+
 ## Database default
 
 For a new database change:
@@ -66,8 +82,8 @@ supacloud-cli database baseline_migrations \
 
 ## CLI boundaries
 
-- `supacloud-cli`: project status, database, migrations, auth, storage, Edge Functions, frontend, queues, task events, diagnostics, and project gateway configuration.
-- `supacloud-admin`: installation, upgrades, SSH diagnostics, platform-wide project lifecycle, tenant runtime, and server operations.
+- `supacloud-cli`: selected-project status and endpoint projection, database, migrations, auth, storage, Edge Functions, frontend, queues, task events, diagnostics, and project gateway configuration.
+- `supacloud-admin`: installation, upgrades, SSH diagnostics, platform-wide project/endpoint inventory, project lifecycle, tenant runtime, and server operations.
 - Official `supabase` CLI: invoked only through the allowlisted `supacloud-cli supabase` adapter for supported local authoring or explicit-DSN inspection commands.
 - Direct HTTP/SQL: read-only diagnosis or an explicitly approved break-glass path; never the default implementation path.
 

package/skills/supacloud-cli/references/command-map.md

@@ -7,6 +7,8 @@ Load this reference when selecting a command surface or when a user asks an AI t
 | Intent | Use | Guardrail |
 | --- | --- | --- |
 | Inspect current project binding | `supacloud-cli status` | Read-only; run first |
+| Inspect selected project API/Auth/Studio origins | `supacloud-cli project endpoints` | Uses the Management API's authoritative projection; do not reconstruct domains locally |
+| Enumerate projects or endpoint projections | `supacloud-admin project list` / `project list_endpoints` | Platform-wide read; never promote a project credential to Admin authority |
 | Inspect project health/logs/tasks | `project`, `queue`, `task_events`, `diagnostics` | Prefer bounded reads |
 | Read database rows or metadata | `database query` and database inspection actions | `SELECT`/read-only by default |
 | Create schema/function/RPC/trigger/RLS/index/grant/extension | `supabase migration_new`, then edit SQL | Never direct remote DDL |
@@ -15,6 +17,7 @@ Load this reference when selecting a command surface or when a user asks an AI t
 | Inspect or back up a remote database | `supabase db_pull`, `migration_list`, `db_dump`, `gen_types` | Requires explicit PostgreSQL DSN; redact it |
 | Preview/apply migrations remotely | `supabase push` | Always dry-run first; production needs explicit approval |
 | Mark proven-equivalent historical migrations as applied | `database baseline_migrations` | Dry-run, schema-equivalence proof, backup, explicit approval |
+| Inspect auth users or generate a controlled login link | `auth list_users`, `auth get_user`, `auth generate_link` | User reads are bounded; login-link generation is a production-confirmed write and action links stay in the calling process |
 | Manage Auth/Storage/Edge Functions/frontend/secrets | Corresponding project module | Keep deployable config/code in version control |
 | Configure project gateway routes | `gateway` | Requires an admin-capable project token; inspect before write |
 | Install/upgrade/debug SupaCloud servers | `supacloud-admin` | Platform boundary; not a project CLI action |
@@ -26,10 +29,10 @@ until a project-scoped context is resolved.
 ## Command groups
 
 - `status`: resolved context, Management API connectivity, authentication, and project reachability.
-- `project`: project metadata, health, logs, API keys/settings, background tasks, retry/cancel, DLQ, and background settings.
+- `project`: selected-project metadata, authoritative endpoint projection, health, logs, API keys/settings, background tasks, retry/cancel, DLQ, and background settings. `project list` deliberately redirects to `supacloud-admin`; cross-project enumeration is not a project CLI capability.
 - `database`: read/query, schema inspection, extensions, indexes, RLS, stats, migration push, controlled historical baseline, and SQL-file execution.
 - `supabase`: allowlisted official CLI adapter for migration authoring, local reset/diff, explicit-DSN inspection/backup/type generation, and SupaCloud-controlled migration push.
-- `auth`: provider and authentication configuration.
+- `auth`: provider/configuration plus bounded user lookup and production-confirmed login-link generation.
 - `storage`: buckets and object-management workflows.
 - `edge_functions`: list, atomically read one active or deleted identity with `get_config`, read immutable source, deploy, activate, configure, and delete Edge Functions. For every mutation, pass the `activation_id` read from the same `list` or `get_config` snapshot as `--expected-activation-id`; use `legacy` only for a never-created or listed legacy Function, not for a deleted slug with a tombstone UUID. Deploy and activate actions also require the non-negative observed version as `--expected-active-version`; use `absent` for a never-created slug or a `get_config` tombstone. Version `0` is a legacy version token and cannot be used as a source or activation target.
 - `frontend`: list, build/deploy, domain, and deployment workflows.
@@ -43,8 +46,14 @@ until a project-scoped context is resolved.
 ```bash
 supacloud-cli status
 supacloud-cli project get
+supacloud-cli project endpoints
 supacloud-cli project health
 supacloud-cli supabase migration_list --db_url "$SUPACLOUD_DB_URL"
 ```
 
+The endpoint projection returns bounded, credential-free API/Auth/Studio origins,
+canonical hosts, URL schemes, configuration sources, and API aliases. It does
+not assert DNS, certificate, or runtime readiness; use the relevant health and
+gateway inspection commands for those checks.
+
 Do not paste the DSN value into chat or commit it to shell scripts. Prefer an environment variable supplied outside the repository.