@supacloud/cli 0.28.0 → 0.29.0

package/README.md

@@ -108,10 +108,12 @@ loopback development origins, with the default `:80` likewise omitted. Use
 
 ### Verified release controls
 
-`release` is an official CLI entry point for the existing Management API
-logical-backup and PostgREST lifecycle capabilities. It requires the Management
-API context above; it does not promote an application `service_role` key to
-Management authority.
+`release` is an official CLI entry point for verified Management API controls
+and the release-canary fixture receipt replay. Management actions require the
+Management API context above. `release_canary_fixture_stage_replay` additionally
+requires the same project's `SUPABASE_URL` and `SUPABASE_SERVICE_ROLE_KEY`; the
+key is sent only to that application origin and is never promoted to Management
+authority.
 
 Project pause and restore are explicit lifecycle commands. A logical backup
 restore requires an operator to pause the selected project first and then use
@@ -138,6 +140,8 @@ supacloud-cli release logical_backup_restore --ref abc123 \
   --restore_confirmation RESTORE_PROJECT:abc123:logical-full_abc123_<backup-id-suffix>:<64-lowercase-hex>
 supacloud-cli release postgrest_status --ref abc123
 supacloud-cli release postgrest_restart --ref abc123
+supacloud-cli release release_canary_fixture_stage_replay --ref abc123 \
+  --subject <central-subject-uuid> --request_id <stage-request-uuid>
 ```
 
 Backup creation reports success only after the CLI verifies exactly one new
@@ -158,6 +162,15 @@ receipt and reads back `desired=running`, `actual=running`, and
 `health=healthy`. Both mutating controls follow the normal production
 confirmation and read-only protections.
 
+`release_canary_fixture_stage_replay` performs one non-retried, response-bounded
+call to the fixed `fa_release_canary_fixture_stage` PostgREST RPC with both
+bearer and `apikey` service-role headers. It accepts only canonical subject and
+request UUIDs, requires a strict `staged` and `idempotent=true` four-field
+receipt, and emits only that safe projection. Before and after the call, the CLI
+reads the selected project's authoritative endpoint projection and requires the
+configured application origin to match its API origin or alias. Production
+confirmation is mandatory.
+
 The legacy `.env` fallback is unclassified and therefore does not enable the
 production confirmation gate. Production automation must select a `prod` or
 `production` profile, or set `SUPACLOUD_ENV=production` together with a complete

package/dist/index.js

@@ -6491,7 +6491,7 @@ var ACTION_POLICY = {
   mutations: { read: ["status"] },
   release: {
     read: ["logical_backup_list", "postgrest_status"],
-    write: ["logical_backup_create", "logical_backup_restore", "postgrest_restart"]
+    write: ["logical_backup_create", "logical_backup_restore", "postgrest_restart", "release_canary_fixture_stage_replay"]
   },
   secrets: { read: ["list"], write: ["upsert", "delete"] },
   frontend: {
@@ -6805,14 +6805,17 @@ async function responseJsonOrNull(response) {
 class HttpTransport {
   baseUrl;
   token;
+  apiKey;
   constructor(config) {
     this.baseUrl = config.baseUrl.replace(/\/$/, "");
     this.token = config.token;
+    this.apiKey = config.apiKey ?? "";
   }
   headers() {
     return {
       Authorization: `Bearer ${this.token}`,
-      "Content-Type": "application/json"
+      "Content-Type": "application/json",
+      ...this.apiKey ? { apikey: this.apiKey } : {}
     };
   }
   async mutationWithResponseReader(method, path, serializedBody, responseReader, timeoutMs = DEFAULT_TIMEOUT) {
@@ -7971,22 +7974,20 @@ var safeAuthMutationCodes = new Set([
 var MAX_AUTH_READ_BYTES = 64 * 1024;
 var AUTH_READ_TIMEOUT_MS = 5000;
 var USER_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var AUTH_LINK_TYPES = [
-  "signup",
-  "magiclink",
-  "recovery",
-  "invite",
-  "email_change",
-  "email_change_current",
-  "email_change_new"
-];
+var AUTH_LINK_TYPES = ["magiclink", "recovery", "invite"];
 var SAFE_USER_FIELDS = [
-  "id",
   "email",
   "phone",
   "created_at",
   "last_sign_in_at"
 ];
+var MAX_AUTH_SEARCH_LENGTH = 256;
+var MAX_AUTH_EMAIL_LENGTH = 320;
+var MAX_AUTH_PHONE_LENGTH = 64;
+var MAX_AUTH_TIMESTAMP_LENGTH = 64;
+var MAX_AUTH_REDIRECT_LENGTH = 4096;
+var MAX_AUTH_ACTION_LINK_LENGTH = 8192;
+var INVALID_FIELD = Symbol("invalid-auth-field");
 function parseAuthConfig(input) {
   if (typeof input !== "string")
     return input;
@@ -8065,18 +8066,32 @@ function boundedPerPage(candidate) {
   }
   return candidate;
 }
+function boundedText(candidate, field, maxLength) {
+  if (typeof candidate !== "string")
+    throw new Error(`'${field}' must be a string`);
+  const value = candidate.trim();
+  if (!value || value.length > maxLength || /[\u0000-\u001f\u007f]/u.test(value)) {
+    throw new Error(`'${field}' is invalid or exceeds ${maxLength} characters`);
+  }
+  return value;
+}
+function boundedSearch(candidate, field) {
+  return boundedText(candidate, field, MAX_AUTH_SEARCH_LENGTH);
+}
+function requiredEmail(candidate) {
+  return boundedText(candidate, "email", MAX_AUTH_EMAIL_LENGTH);
+}
 function safeRedirectTo(candidate) {
   if (candidate === undefined)
     return;
-  if (typeof candidate !== "string" || !candidate.trim())
-    throw new Error("'redirect_to' must be an absolute HTTPS or loopback HTTP URL");
+  const value = boundedText(candidate, "redirect_to", MAX_AUTH_REDIRECT_LENGTH);
   let uri;
   try {
-    uri = new URL(candidate.trim());
+    uri = new URL(value);
   } catch {
     throw new Error("'redirect_to' must be an absolute HTTPS or loopback HTTP URL");
   }
-  const loopback = uri.hostname === "127.0.0.1" || uri.hostname === "[::1]";
+  const loopback = uri.hostname === "localhost" || uri.hostname.endsWith(".localhost") || uri.hostname === "127.0.0.1" || uri.hostname === "[::1]";
   const validProtocol = uri.protocol === "https:" || uri.protocol === "http:" && loopback && Boolean(uri.port);
   if (!validProtocol || uri.username || uri.password || uri.hash) {
     throw new Error("'redirect_to' must be an absolute HTTPS or loopback HTTP URL without credentials or fragment");
@@ -8086,28 +8101,66 @@ function safeRedirectTo(candidate) {
 function isRecord(candidate) {
   return candidate !== null && typeof candidate === "object" && !Array.isArray(candidate);
 }
+function safeOptionalUserField(candidate, field, maxLength) {
+  if (!(field in candidate))
+    return;
+  const value = candidate[field];
+  if (value === null)
+    return null;
+  if (typeof value !== "string" || value.length > maxLength || /[\u0000-\u001f\u007f]/u.test(value))
+    return INVALID_FIELD;
+  return value;
+}
 function projectUser(candidate) {
-  if (!isRecord(candidate) || typeof candidate.id !== "string")
+  if (!isRecord(candidate) || typeof candidate.id !== "string" || !USER_ID_PATTERN.test(candidate.id))
     return null;
-  const projectedUser = {};
+  const projectedUser = { id: candidate.id.toLowerCase() };
+  const fieldLimits = {
+    email: MAX_AUTH_EMAIL_LENGTH,
+    phone: MAX_AUTH_PHONE_LENGTH,
+    created_at: MAX_AUTH_TIMESTAMP_LENGTH,
+    last_sign_in_at: MAX_AUTH_TIMESTAMP_LENGTH
+  };
   for (const field of SAFE_USER_FIELDS) {
-    if (field in candidate)
-      projectedUser[field] = candidate[field];
+    const value = safeOptionalUserField(candidate, field, fieldLimits[field]);
+    if (value === INVALID_FIELD)
+      return null;
+    if (value !== undefined)
+      projectedUser[field] = value;
   }
   return projectedUser;
 }
-function projectUserList(candidate) {
-  if (!isRecord(candidate) || !Array.isArray(candidate.users))
+function safePaginationField(candidate) {
+  if (candidate === undefined)
+    return;
+  if (candidate === null)
+    return null;
+  return typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate >= 0 ? candidate : INVALID_FIELD;
+}
+function projectUserList(candidate, expectedPage, expectedPerPage) {
+  if (!isRecord(candidate) || !Array.isArray(candidate.users) || candidate.users.length > expectedPerPage)
     return null;
   const users = candidate.users.map(projectUser);
   if (users.some((user) => user === null))
     return null;
-  const projectedFields = { users };
+  const projectedUsers = users;
+  const userIds = projectedUsers.map((user) => user.id);
+  if (new Set(userIds).size !== userIds.length)
+    return null;
+  const projectedFields = { users: projectedUsers };
   for (const field of ["total", "page", "per_page", "next_page", "last_page"]) {
-    if (field in candidate && (typeof candidate[field] === "number" || candidate[field] === null)) {
-      projectedFields[field] = candidate[field];
-    }
+    const value = safePaginationField(candidate[field]);
+    if (value === INVALID_FIELD)
+      return null;
+    if (value !== undefined)
+      projectedFields[field] = value;
   }
+  if (projectedFields.page !== undefined && projectedFields.page !== expectedPage)
+    return null;
+  if (projectedFields.per_page !== undefined && projectedFields.per_page !== expectedPerPage)
+    return null;
+  if (typeof projectedFields.total === "number" && projectedFields.total < projectedUsers.length)
+    return null;
   return projectedFields;
 }
 function actionLink(candidate) {
@@ -8117,10 +8170,17 @@ function actionLink(candidate) {
     if (isRecord(candidate.data))
       candidates.push(candidate.data.properties);
   }
-  for (const candidate2 of candidates) {
-    if (isRecord(candidate2) && typeof candidate2.action_link === "string" && candidate2.action_link.length > 0) {
-      return candidate2.action_link;
-    }
+  for (const nested of candidates) {
+    if (!isRecord(nested) || typeof nested.action_link !== "string")
+      continue;
+    const link = nested.action_link;
+    if (!link || link.length > MAX_AUTH_ACTION_LINK_LENGTH || /[\u0000-\u001f\u007f]/u.test(link))
+      continue;
+    try {
+      const uri = new URL(link);
+      if ((uri.protocol === "https:" || uri.protocol === "http:") && !uri.username && !uri.password && !uri.hash && uri.toString() === link)
+        return link;
+    } catch {}
   }
   return null;
 }
@@ -8144,11 +8204,8 @@ async function listUsers(http, args) {
   const perPage = boundedPerPage(args.per_page);
   const params = new URLSearchParams({ page: String(page), per_page: String(perPage) });
   for (const key of ["search", "email_like"]) {
-    if (args[key] !== undefined) {
-      if (typeof args[key] !== "string" || !args[key].trim())
-        throw new Error(`'${key}' must be a non-empty string`);
-      params.set(key, args[key].trim());
-    }
+    if (args[key] !== undefined)
+      params.set(key, boundedSearch(args[key], key));
   }
   const response = await http.get(`/v1/projects/${ref}/auth/users?${params.toString()}`, {
     maxJsonBytes: MAX_AUTH_READ_BYTES,
@@ -8156,7 +8213,7 @@ async function listUsers(http, args) {
   });
   if (!response.ok)
     return safeAuthReadFailure("auth.list_users", response);
-  const users = projectUserList(response.data);
+  const users = projectUserList(response.data, page, perPage);
   if (!users)
     return safeAuthReadFailure("auth.list_users", { ...response, responseReadError: true });
   return { content: [{ type: "text", text: JSON.stringify({ ok: true, operation: "auth.list_users", project_ref: ref, ...users }, null, 2) }] };
@@ -8171,27 +8228,43 @@ async function getUser(http, args) {
   if (!response.ok)
     return safeAuthReadFailure("auth.get_user", response);
   const user = projectUser(response.data);
-  if (!user)
+  if (!user || user.id !== userId) {
     return safeAuthReadFailure("auth.get_user", { ...response, responseReadError: true });
+  }
   return { content: [{ type: "text", text: JSON.stringify({ ok: true, operation: "auth.get_user", project_ref: ref, user }, null, 2) }] };
 }
+function generateLinkFailure(response) {
+  const outcomeUnknown = response.responseReadError || response.transportError || response.status === 408 || response.status >= 500;
+  return {
+    isError: true,
+    content: [{
+      type: "text",
+      text: JSON.stringify({
+        ok: false,
+        operation: "auth.generate_link",
+        error: {
+          code: outcomeUnknown ? "OUTCOME_UNKNOWN" : "HTTP_ERROR",
+          http_status: response.transportError ? null : response.status
+        }
+      }, null, 2)
+    }]
+  };
+}
 async function generateLink(http, args) {
   const ref = requiredRef(args.ref);
   if (typeof args.type !== "string" || !AUTH_LINK_TYPES.includes(args.type)) {
-    throw new Error("'type' is invalid for 'generate_link'");
+    throw new Error("'type' must be one of magiclink, recovery, or invite for 'generate_link'");
   }
-  if (typeof args.email !== "string" || !args.email.trim())
-    throw new Error("'email' is required for 'generate_link'");
-  const body = { type: args.type, email: args.email.trim() };
+  const body = { type: args.type, email: requiredEmail(args.email) };
   const redirectTo = safeRedirectTo(args.redirect_to);
   if (redirectTo)
     body.redirect_to = redirectTo;
   const response = await http.postReleaseMutation(`/v1/projects/${ref}/auth/generate_link`, body);
   if (!response.ok)
-    return safeAuthReadFailure("auth.generate_link", response);
+    return generateLinkFailure(response);
   const link = actionLink(response.data);
   if (!link)
-    return safeAuthReadFailure("auth.generate_link", { ...response, responseReadError: true });
+    return generateLinkFailure({ ...response, responseReadError: true });
   return { content: [{ type: "text", text: JSON.stringify({ ok: true, operation: "auth.generate_link", action_link: link }, null, 2) }] };
 }
 function formatProviders(data) {
@@ -8251,7 +8324,7 @@ Actions: list_users, get_user, generate_link, list_providers, get_provider, conf
     per_page: optional(Type.Integer({ minimum: 1, maximum: 100 }), "[list_users] Users per page (1-100)"),
     search: optional(Type.String(), "[list_users] Search user email, phone, or UUID"),
     email_like: optional(Type.String(), "[list_users] Search user email or phone"),
-    type: optional(stringEnum(AUTH_LINK_TYPES), "[generate_link] GoTrue link type"),
+    type: optional(stringEnum(AUTH_LINK_TYPES), "[generate_link] magiclink, recovery, or invite"),
     email: optional(Type.String(), "[generate_link] User email"),
     redirect_to: optional(Type.String(), "[generate_link] Absolute HTTPS or loopback callback"),
     provider: optional(Type.String(), "[*_provider] Provider name (github, google, wechat, etc.)"),
@@ -10246,15 +10319,15 @@ function hasWellFormedUnicode(text) {
   }
   return true;
 }
-function boundedText(candidate, maxLength) {
+function boundedText2(candidate, maxLength) {
   return typeof candidate === "string" && candidate.length > 0 && candidate.length <= maxLength && !/[\u0000-\u001f\u007f]/u.test(candidate) && hasWellFormedUnicode(candidate) ? candidate : null;
 }
 function matchingText(candidate, maxLength, pattern) {
-  const candidateText = boundedText(candidate, maxLength);
+  const candidateText = boundedText2(candidate, maxLength);
   return candidateText && pattern.test(candidateText) ? candidateText : null;
 }
 function canonicalTimestamp(candidate) {
-  const timestamp = boundedText(candidate, 64);
+  const timestamp = boundedText2(candidate, 64);
   if (!timestamp)
     return null;
   const milliseconds = Date.parse(timestamp);
@@ -10266,7 +10339,7 @@ function projectedSummary(project) {
     ref: matchingText(project.ref, 20, PROJECT_REF_PATTERN3),
     organization_id: matchingText(project.organization_id, 128, SAFE_IDENTIFIER_PATTERN),
     organization_slug: matchingText(project.organization_slug, 128, SAFE_IDENTIFIER_PATTERN),
-    name: boundedText(project.name, 100),
+    name: boundedText2(project.name, 100),
     region: matchingText(project.region, 64, REGION_PATTERN),
     created_at: canonicalTimestamp(project.created_at),
     status: matchingText(project.status, 64, STATUS_PATTERN)
@@ -10274,7 +10347,7 @@ function projectedSummary(project) {
   return Object.values(summary).every((field) => field !== null) ? summary : null;
 }
 function databaseHost(candidate) {
-  const host = boundedText(candidate, 255);
+  const host = boundedText2(candidate, 255);
   if (!host)
     return null;
   if (host.startsWith("[") && host.endsWith("]")) {
@@ -10314,7 +10387,7 @@ function projectEndpoint(candidate) {
   const endpoint = plainRecord(candidate);
   if (!endpoint || !hasOnlyKeys(endpoint, PROJECT_ENDPOINT_KEYS))
     return null;
-  const endpointUrl = boundedText(endpoint.url, 2048);
+  const endpointUrl = boundedText2(endpoint.url, 2048);
   if (!endpointUrl || !rawUrlHasNoPath(endpointUrl))
     return null;
   try {
@@ -10331,7 +10404,7 @@ function projectEndpoint(candidate) {
 function discardedDetailFieldsAreValid(project) {
   if (project.config !== undefined && plainRecord(project.config) === null)
     return false;
-  if (project.anon_key !== undefined && boundedText(project.anon_key, 16384) === null)
+  if (project.anon_key !== undefined && boundedText2(project.anon_key, 16384) === null)
     return false;
   return project.services === undefined || Array.isArray(project.services);
 }
@@ -10410,11 +10483,11 @@ function plainRecord2(candidate) {
 function hasOnlyKeys2(record, allowedKeys) {
   return Object.keys(record).every((key) => allowedKeys.has(key));
 }
-function boundedText2(candidate, maxLength) {
+function boundedText3(candidate, maxLength) {
   return typeof candidate === "string" && candidate.length > 0 && candidate.length <= maxLength && !/[\u0000-\u001f\u007f]/u.test(candidate) ? candidate : null;
 }
 function canonicalHost(candidate, scheme) {
-  const host = boundedText2(candidate, 255);
+  const host = boundedText3(candidate, 255);
   if (!host)
     return null;
   try {
@@ -10429,8 +10502,8 @@ function projectEndpoint2(candidate) {
   if (!endpoint || !hasOnlyKeys2(endpoint, ENDPOINT_KEYS))
     return null;
   const scheme = endpoint.scheme === "http" || endpoint.scheme === "https" ? endpoint.scheme : null;
-  const origin = boundedText2(endpoint.origin, 2048);
-  const source = boundedText2(endpoint.source, 64);
+  const origin = boundedText3(endpoint.origin, 2048);
+  const source = boundedText3(endpoint.source, 64);
   if (!scheme || !origin || !source || !PROJECT_ENDPOINT_SOURCES.has(source))
     return null;
   let parsedOrigin;
@@ -10492,6 +10565,15 @@ function projectEndpointRead(response, expectedRef) {
   const projection = projectEndpointProjection(response.data);
   return projection && projection.project_ref === expectedRef ? successfulResult2(projection) : failedResult2("Invalid project endpoint response");
 }
+function projectApiOrigins(response, expectedRef) {
+  if (!successfulResponse2(response))
+    return null;
+  const projection = projectEndpointProjection(response.data);
+  if (!projection || projection.project_ref !== expectedRef)
+    return null;
+  const api = projection.endpoints.api;
+  return [api.origin, ...api.aliases.map((alias) => `${api.scheme}://${alias}`)];
+}
 
 // src/shared/tools/project-cli-tools.ts
 function projectReadResponse(readResult) {
@@ -12759,6 +12841,9 @@ var INVENTORY_MAX_BYTES = 1024 * 1024;
 var MUTATION_MAX_BYTES = 64 * 1024;
 var BACKUP_TIMEOUT_MS = 36 * 60000;
 var RELEASE_READ_RESPONSE_TIMEOUT_MS = 5000;
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var RELEASE_CANARY_TENANT_KEY = /^release-canary-[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var RELEASE_CANARY_STAGE_RECEIPT_KEYS = new Set(["fixtureId", "tenantKey", "state", "idempotent"]);
 function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -12891,20 +12976,44 @@ function readPostgrestFailure(operation, read) {
 function isRestartReceipt(value) {
   return isRecord3(value) && value.service === "postgrest" && value.action === "restart" && value.success === true;
 }
+function releaseCanaryStageInput(subject, requestId) {
+  if (typeof subject !== "string" || !UUID.test(subject))
+    throw new Error("'subject' must be a canonical UUID");
+  if (typeof requestId !== "string" || !UUID.test(requestId))
+    throw new Error("'request_id' must be a canonical UUID");
+  return { p_subject: subject, p_request_id: requestId };
+}
+function releaseCanaryStageReceipt(value) {
+  if (!isRecord3(value) || Object.keys(value).some((key) => !RELEASE_CANARY_STAGE_RECEIPT_KEYS.has(key)) || Object.keys(value).length !== RELEASE_CANARY_STAGE_RECEIPT_KEYS.size || typeof value.fixtureId !== "string" || !UUID.test(value.fixtureId) || typeof value.tenantKey !== "string" || !RELEASE_CANARY_TENANT_KEY.test(value.tenantKey) || value.state !== "staged" || value.idempotent !== true)
+    return null;
+  return {
+    fixtureId: value.fixtureId,
+    tenantKey: value.tenantKey,
+    state: "staged",
+    idempotent: true
+  };
+}
+async function applicationOriginMatches(http, projectRef2, applicationOrigin) {
+  const endpointRead = await http.get(`${endpoint(projectRef2)}/endpoint/projection`, { maxResponseBytes: PROJECT_ENDPOINT_RESPONSE_MAX_BYTES });
+  return projectApiOrigins(endpointRead, projectRef2)?.includes(applicationOrigin) === true;
+}
 function registerReleaseTools(server, http, options = {}) {
-  server.tool("release", "Verified release controls using a Management API credential. Actions: logical_backup_list, logical_backup_create, logical_backup_restore, postgrest_status, postgrest_restart", {
+  server.tool("release", "Verified release controls. Management actions use the Management API; release_canary_fixture_stage_replay additionally requires the selected project's SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY.", {
     action: withDescription(stringEnum([
       "logical_backup_list",
       "logical_backup_create",
       "logical_backup_restore",
       "postgrest_status",
-      "postgrest_restart"
+      "postgrest_restart",
+      "release_canary_fixture_stage_replay"
     ]), "Release control action"),
     ref: optional(Type.String(), options.projectRef ? "Optional override when not auto-linked" : "Project ref"),
     backup_id: optional(Type.String(), "[logical_backup_restore] Exact verified logical-full backup ID from the selected project inventory"),
     expected_sha256: optional(Type.String(), "[logical_backup_restore] Exact lowercase SHA-256 from the selected project inventory"),
-    restore_confirmation: optional(Type.String(), "[logical_backup_restore] Exact RESTORE_PROJECT:<ref>:<backup_id>:<sha256> confirmation")
-  }, async ({ action, ref, backup_id, expected_sha256, restore_confirmation }) => {
+    restore_confirmation: optional(Type.String(), "[logical_backup_restore] Exact RESTORE_PROJECT:<ref>:<backup_id>:<sha256> confirmation"),
+    subject: optional(Type.String(), "[release_canary_fixture_stage_replay] Exact central subject UUID"),
+    request_id: optional(Type.String(), "[release_canary_fixture_stage_replay] Exact idempotent stage request UUID")
+  }, async ({ action, ref, backup_id, expected_sha256, restore_confirmation, subject, request_id }) => {
     const projectRef2 = typeof ref === "string" && ref || options.projectRef;
     if (!projectRef2)
       throw new Error("'ref' is required for release controls");
@@ -12975,6 +13084,27 @@ function registerReleaseTools(server, http, options = {}) {
         postgrest: read2.status
       });
     }
+    if (action === "release_canary_fixture_stage_replay") {
+      if (!options.applicationHttp || !options.applicationOrigin) {
+        throw new Error("release_canary_fixture_stage_replay requires SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY");
+      }
+      const request = releaseCanaryStageInput(subject, request_id);
+      if (!await applicationOriginMatches(http, projectRef2, options.applicationOrigin)) {
+        return releaseControlFailure("release.release_canary.fixture_stage_replay", "INVALID_RESPONSE", null);
+      }
+      const response = await options.applicationHttp.postReleaseMutation("/rest/v1/rpc/fa_release_canary_fixture_stage", request);
+      if (!response.ok || response.status !== 200) {
+        return mutationFailure("release.release_canary.fixture_stage_replay", response);
+      }
+      const receipt = releaseCanaryStageReceipt(response.data);
+      if (!receipt || !await applicationOriginMatches(http, projectRef2, options.applicationOrigin)) {
+        return releaseControlFailure("release.release_canary.fixture_stage_replay", "OUTCOME_UNKNOWN", response.status);
+      }
+      return releaseControlSuccess("release.release_canary.fixture_stage_replay", {
+        project_ref: projectRef2,
+        receipt
+      });
+    }
     if (action !== "postgrest_restart")
       throw new Error("Unknown release control action");
     const mutation = await http.postReleaseMutation(`${endpoint(projectRef2)}/services/postgrest/restart`);
@@ -12995,7 +13125,7 @@ function registerReleaseTools(server, http, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.28.0",
+  version: "0.29.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -13224,7 +13354,8 @@ DEFAULT CONTEXT
   Without a selector or project variables, runs use the current project's legacy .env.
   Application status accepts SUPABASE_URL + SUPABASE_SERVICE_ROLE_KEY.
   Management-backed project commands require SUPACLOUD_API_URL +
-  SUPACLOUD_API_TOKEN. These credential scopes are never mixed.
+  SUPACLOUD_API_TOKEN. Only release release_canary_fixture_stage_replay may additionally use
+  the selected project's SUPABASE_* pair for one application-origin RPC.
   SUPACLOUD_PROJECT_REF is required when it cannot be inferred from <ref>.api.*.
 
   SUPACLOUD_READ_ONLY=true blocks remote writes. Production writes require an
@@ -13245,6 +13376,7 @@ EXAMPLES
   ${preferredCommand} release logical_backup_restore --ref abc123 --backup_id <backup_id> --expected_sha256 <sha256> --restore_confirmation RESTORE_PROJECT:abc123:<backup_id>:<sha256>
   ${preferredCommand} release postgrest_status --ref abc123
   ${preferredCommand} release postgrest_restart --ref abc123
+  ${preferredCommand} release release_canary_fixture_stage_replay --ref abc123 --subject <uuid> --request_id <uuid>
   ${preferredCommand} queue stats --queue emails
   ${preferredCommand} queue dlq --queue emails --limit 20
   ${preferredCommand} frontend list --ref abc123
@@ -13403,6 +13535,11 @@ function createCliTools(context, confirmProduction) {
     baseUrl: context.apiUrl,
     token: context.apiToken
   });
+  const applicationHttp = context.inferredSupabaseUrl && context.inferredServiceRoleKey ? new HttpTransport({
+    baseUrl: context.inferredSupabaseUrl,
+    token: context.inferredServiceRoleKey,
+    apiKey: context.inferredServiceRoleKey
+  }) : undefined;
   const assign = (extra) => Object.assign(tools, extra);
   assign(captureTools((server) => registerUserProjectCliTools(server, http, {
     projectRef: context.projectRef || undefined
@@ -13424,7 +13561,9 @@ function createCliTools(context, confirmProduction) {
   })));
   assign(captureTools((server) => registerMutationTools(server, http)));
   assign(captureTools((server) => registerReleaseTools(server, http, {
-    projectRef: context.projectRef || undefined
+    projectRef: context.projectRef || undefined,
+    applicationHttp,
+    applicationOrigin: context.inferredSupabaseUrl || undefined
   })));
   assign(captureTools((server) => registerFrontendTools(server, http)));
   assign(captureTools((server) => registerGatewayTools(server, http, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",

package/skills/supacloud-cli/references/command-map.md

@@ -15,9 +15,10 @@ Load this reference when selecting a command surface or when a user asks an AI t
 | Generate migration from local schema changes | `supabase db_diff` | Review generated SQL before use |
 | Rebuild local database | `supabase db_reset` | Local only; preserve required seed behavior |
 | Inspect or back up a remote database | `supabase db_pull`, `migration_list`, `db_dump`, `gen_types` | Requires explicit PostgreSQL DSN; redact it |
+| Replay the release-canary fixture stage receipt | `release release_canary_fixture_stage_replay` | Dual-bind Management project context and that project's service-role application origin; accepts only the exact subject/request UUID pair and a strict idempotent receipt |
 | Preview/apply migrations remotely | `supabase push` | Always dry-run first; production needs explicit approval |
 | Mark proven-equivalent historical migrations as applied | `database baseline_migrations` | Dry-run, schema-equivalence proof, backup, explicit approval |
-| Inspect auth users or generate a controlled login link | `auth list_users`, `auth get_user`, `auth generate_link` | User reads are bounded; login-link generation is a production-confirmed write and action links stay in the calling process |
+| Inspect auth users or generate a controlled login link | `auth list_users`, `auth get_user`, `auth generate_link` | User reads are bounded; generation supports only `magiclink`, `recovery`, and `invite`, requires production confirmation, and returns only a validated action URL |
 | Manage Auth/Storage/Edge Functions/frontend/secrets | Corresponding project module | Keep deployable config/code in version control |
 | Configure project gateway routes | `gateway` | Requires an admin-capable project token; inspect before write |
 | Install/upgrade/debug SupaCloud servers | `supacloud-admin` | Platform boundary; not a project CLI action |
@@ -32,13 +33,14 @@ until a project-scoped context is resolved.
 - `project`: selected-project metadata, authoritative endpoint projection, health, logs, API keys/settings, background tasks, retry/cancel, DLQ, and background settings. `project list` deliberately redirects to `supacloud-admin`; cross-project enumeration is not a project CLI capability.
 - `database`: read/query, schema inspection, extensions, indexes, RLS, stats, migration push, controlled historical baseline, and SQL-file execution.
 - `supabase`: allowlisted official CLI adapter for migration authoring, local reset/diff, explicit-DSN inspection/backup/type generation, and SupaCloud-controlled migration push.
-- `auth`: provider/configuration plus bounded user lookup and production-confirmed login-link generation.
+- `auth`: provider/configuration plus bounded user lookup and production-confirmed `magiclink`, `recovery`, or `invite` generation. Search/email/redirect inputs and returned action URLs are bounded and validated before use.
 - `storage`: buckets and object-management workflows.
 - `edge_functions`: list, atomically read one active or deleted identity with `get_config`, read immutable source, deploy, activate, configure, and delete Edge Functions. For every mutation, pass the `activation_id` read from the same `list` or `get_config` snapshot as `--expected-activation-id`; use `legacy` only for a never-created or listed legacy Function, not for a deleted slug with a tombstone UUID. Deploy and activate actions also require the non-negative observed version as `--expected-active-version`; use `absent` for a never-created slug or a `get_config` tombstone. Version `0` is a legacy version token and cannot be used as a source or activation target.
 - `frontend`: list, build/deploy, domain, and deployment workflows.
 - `secrets`: project secret management; never print values after write.
 - `queue`, `task_events`, `diagnostics`: asynchronous workload operations and bounded diagnostics.
 - `gateway`: project route/config/rebuild operations.
+- `release`: verified backup/PostgREST lifecycle controls plus a production-confirmed, non-retried, strict release-canary fixture stage replay. The replay requires both the selected Management project binding and that project's `SUPABASE_URL`/`SUPABASE_SERVICE_ROLE_KEY`.
 - `ai`: inspect or install this packaged Skill.
 
 ## Safe inspection pattern