@supacloud/cli 0.29.0 → 0.30.0

package/README.md

@@ -142,6 +142,9 @@ supacloud-cli release postgrest_status --ref abc123
 supacloud-cli release postgrest_restart --ref abc123
 supacloud-cli release release_canary_fixture_stage_replay --ref abc123 \
   --subject <central-subject-uuid> --request_id <stage-request-uuid>
+supacloud-cli release release_canary_fixture_disable_replay --ref abc123 \
+  --fixture_id <fixture-uuid> --disable_request_id <disable-request-uuid> \
+  --issuer <issuer-url> --subject <central-subject-uuid>
 ```
 
 Backup creation reports success only after the CLI verifies exactly one new
@@ -171,6 +174,17 @@ reads the selected project's authoritative endpoint projection and requires the
 configured application origin to match its API origin or alias. Production
 confirmation is mandatory.
 
+`release_canary_fixture_disable_replay` performs one non-retried call to the
+fixed `fa_release_canary_fixture_disable` PostgREST RPC using the selected
+project's application service-role origin. Its receipt must contain exactly
+`fixtureId`, `state="disabled"`, and a boolean `idempotent`; both the first
+disable (`idempotent=false`) and same-request replay (`idempotent=true`) are
+valid. The CLI then calls the existing fixed
+`fa_release_canary_fixture_pending` RPC with only the exact issuer and subject
+query parameters and accepts only its authoritative JSON boolean `false`
+read-back. The fixture binding comes from the validated disable receipt before
+reporting success. Management endpoint projection is checked before and after.
+
 The legacy `.env` fallback is unclassified and therefore does not enable the
 production confirmation gate. Production automation must select a `prod` or
 `production` profile, or set `SUPACLOUD_ENV=production` together with a complete

package/dist/index.js

@@ -6491,7 +6491,7 @@ var ACTION_POLICY = {
   mutations: { read: ["status"] },
   release: {
     read: ["logical_backup_list", "postgrest_status"],
-    write: ["logical_backup_create", "logical_backup_restore", "postgrest_restart", "release_canary_fixture_stage_replay"]
+    write: ["logical_backup_create", "logical_backup_restore", "postgrest_restart", "release_canary_fixture_stage_replay", "release_canary_fixture_disable_replay"]
   },
   secrets: { read: ["list"], write: ["upsert", "delete"] },
   frontend: {
@@ -12844,6 +12844,10 @@ var RELEASE_READ_RESPONSE_TIMEOUT_MS = 5000;
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var RELEASE_CANARY_TENANT_KEY = /^release-canary-[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var RELEASE_CANARY_STAGE_RECEIPT_KEYS = new Set(["fixtureId", "tenantKey", "state", "idempotent"]);
+var RELEASE_CANARY_DISABLE_RECEIPT_KEYS = new Set(["fixtureId", "state", "idempotent"]);
+var RELEASE_CANARY_DISABLE_RPC_PATH = "/rest/v1/rpc/fa_release_canary_fixture_disable";
+var RELEASE_CANARY_PENDING_RPC_PATH = "/rest/v1/rpc/fa_release_canary_fixture_pending";
+var RELEASE_CANARY_CLAIM_MAX_LENGTH = 2048;
 function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -12993,27 +12997,79 @@ function releaseCanaryStageReceipt(value) {
     idempotent: true
   };
 }
+function releaseCanaryIssuer(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > RELEASE_CANARY_CLAIM_MAX_LENGTH || value !== value.trim() || /[\u0000-\u001f\u007f]/u.test(value)) {
+    throw new Error("'issuer' must be a bounded absolute HTTP(S) issuer");
+  }
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error("'issuer' must be a bounded absolute HTTP(S) issuer");
+  }
+  const loopbackHttp = parsed.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname) && parsed.port.length > 0;
+  if (parsed.protocol !== "https:" && !loopbackHttp || parsed.username || parsed.password || parsed.search || parsed.hash) {
+    throw new Error("'issuer' must be a bounded absolute HTTP(S) issuer");
+  }
+  return value;
+}
+function releaseCanaryDisableInput(fixtureId, disableRequestId, issuer, subject) {
+  if (typeof fixtureId !== "string" || !UUID.test(fixtureId)) {
+    throw new Error("'fixture_id' must be a canonical UUID");
+  }
+  if (typeof disableRequestId !== "string" || !UUID.test(disableRequestId)) {
+    throw new Error("'disable_request_id' must be a canonical UUID");
+  }
+  if (typeof subject !== "string" || !UUID.test(subject)) {
+    throw new Error("'subject' must be a canonical UUID");
+  }
+  return {
+    p_fixture_id: fixtureId,
+    p_disable_request_id: disableRequestId,
+    p_issuer: releaseCanaryIssuer(issuer),
+    p_subject: subject
+  };
+}
+function releaseCanaryDisableReceipt(receiptCandidate, fixtureId) {
+  if (!isRecord3(receiptCandidate) || Object.keys(receiptCandidate).some((key) => !RELEASE_CANARY_DISABLE_RECEIPT_KEYS.has(key)) || Object.keys(receiptCandidate).length !== RELEASE_CANARY_DISABLE_RECEIPT_KEYS.size || receiptCandidate.fixtureId !== fixtureId || receiptCandidate.state !== "disabled" || typeof receiptCandidate.idempotent !== "boolean")
+    return null;
+  return { fixtureId, state: "disabled", idempotent: receiptCandidate.idempotent };
+}
+function releaseCanaryPendingPath(request) {
+  const params = new URLSearchParams({
+    p_issuer: request.p_issuer,
+    p_subject: request.p_subject
+  });
+  return `${RELEASE_CANARY_PENDING_RPC_PATH}?${params.toString()}`;
+}
+function releaseCanaryPendingReadback(readbackCandidate) {
+  return readbackCandidate === false;
+}
 async function applicationOriginMatches(http, projectRef2, applicationOrigin) {
-  const endpointRead = await http.get(`${endpoint(projectRef2)}/endpoint/projection`, { maxResponseBytes: PROJECT_ENDPOINT_RESPONSE_MAX_BYTES });
+  const endpointRead = await http.get(`${endpoint(projectRef2)}/endpoint/projection`, { maxJsonBytes: PROJECT_ENDPOINT_RESPONSE_MAX_BYTES, responseTimeoutMs: RELEASE_READ_RESPONSE_TIMEOUT_MS });
   return projectApiOrigins(endpointRead, projectRef2)?.includes(applicationOrigin) === true;
 }
 function registerReleaseTools(server, http, options = {}) {
-  server.tool("release", "Verified release controls. Management actions use the Management API; release_canary_fixture_stage_replay additionally requires the selected project's SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY.", {
+  server.tool("release", "Verified release controls. Management actions use the Management API; release canary stage/disable replay additionally require the selected project's SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY.", {
     action: withDescription(stringEnum([
       "logical_backup_list",
       "logical_backup_create",
       "logical_backup_restore",
       "postgrest_status",
       "postgrest_restart",
-      "release_canary_fixture_stage_replay"
+      "release_canary_fixture_stage_replay",
+      "release_canary_fixture_disable_replay"
     ]), "Release control action"),
     ref: optional(Type.String(), options.projectRef ? "Optional override when not auto-linked" : "Project ref"),
     backup_id: optional(Type.String(), "[logical_backup_restore] Exact verified logical-full backup ID from the selected project inventory"),
     expected_sha256: optional(Type.String(), "[logical_backup_restore] Exact lowercase SHA-256 from the selected project inventory"),
     restore_confirmation: optional(Type.String(), "[logical_backup_restore] Exact RESTORE_PROJECT:<ref>:<backup_id>:<sha256> confirmation"),
-    subject: optional(Type.String(), "[release_canary_fixture_stage_replay] Exact central subject UUID"),
-    request_id: optional(Type.String(), "[release_canary_fixture_stage_replay] Exact idempotent stage request UUID")
-  }, async ({ action, ref, backup_id, expected_sha256, restore_confirmation, subject, request_id }) => {
+    subject: optional(Type.String(), "[release_canary_fixture_stage_replay/disable_replay] Exact central subject UUID"),
+    request_id: optional(Type.String(), "[release_canary_fixture_stage_replay] Exact idempotent stage request UUID"),
+    fixture_id: optional(Type.String(), "[release_canary_fixture_disable_replay] Exact staged fixture UUID"),
+    disable_request_id: optional(Type.String(), "[release_canary_fixture_disable_replay] Exact idempotent disable request UUID"),
+    issuer: optional(Type.String(), "[release_canary_fixture_disable_replay] Exact HTTP(S) issuer")
+  }, async ({ action, ref, backup_id, expected_sha256, restore_confirmation, subject, request_id, fixture_id, disable_request_id, issuer }) => {
     const projectRef2 = typeof ref === "string" && ref || options.projectRef;
     if (!projectRef2)
       throw new Error("'ref' is required for release controls");
@@ -13105,6 +13161,36 @@ function registerReleaseTools(server, http, options = {}) {
         receipt
       });
     }
+    if (action === "release_canary_fixture_disable_replay") {
+      if (!options.applicationHttp || !options.applicationOrigin) {
+        throw new Error("release_canary_fixture_disable_replay requires SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY");
+      }
+      const request = releaseCanaryDisableInput(fixture_id, disable_request_id, issuer, subject);
+      if (!await applicationOriginMatches(http, projectRef2, options.applicationOrigin)) {
+        return releaseControlFailure("release.release_canary.fixture_disable_replay", "INVALID_RESPONSE", null);
+      }
+      const response = await options.applicationHttp.postReleaseMutation(RELEASE_CANARY_DISABLE_RPC_PATH, request);
+      if (!response.ok || response.status !== 200) {
+        return mutationFailure("release.release_canary.fixture_disable_replay", response);
+      }
+      const receipt = releaseCanaryDisableReceipt(response.data, request.p_fixture_id);
+      if (!receipt) {
+        return releaseControlFailure("release.release_canary.fixture_disable_replay", "OUTCOME_UNKNOWN", response.status);
+      }
+      const pendingRequest = {
+        p_issuer: request.p_issuer,
+        p_subject: request.p_subject
+      };
+      const pendingResponse = await options.applicationHttp.get(releaseCanaryPendingPath(pendingRequest), { maxJsonBytes: MUTATION_MAX_BYTES, responseTimeoutMs: RELEASE_READ_RESPONSE_TIMEOUT_MS });
+      if (!pendingResponse.ok || pendingResponse.status !== 200 || !releaseCanaryPendingReadback(pendingResponse.data) || !await applicationOriginMatches(http, projectRef2, options.applicationOrigin)) {
+        return releaseControlFailure("release.release_canary.fixture_disable_replay", "OUTCOME_UNKNOWN", pendingResponse.transportError ? null : pendingResponse.status);
+      }
+      return releaseControlSuccess("release.release_canary.fixture_disable_replay", {
+        project_ref: projectRef2,
+        receipt,
+        pending: false
+      });
+    }
     if (action !== "postgrest_restart")
       throw new Error("Unknown release control action");
     const mutation = await http.postReleaseMutation(`${endpoint(projectRef2)}/services/postgrest/restart`);
@@ -13125,7 +13211,7 @@ function registerReleaseTools(server, http, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.29.0",
+  version: "0.30.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -13354,8 +13440,8 @@ DEFAULT CONTEXT
   Without a selector or project variables, runs use the current project's legacy .env.
   Application status accepts SUPABASE_URL + SUPABASE_SERVICE_ROLE_KEY.
   Management-backed project commands require SUPACLOUD_API_URL +
-  SUPACLOUD_API_TOKEN. Only release release_canary_fixture_stage_replay may additionally use
-  the selected project's SUPABASE_* pair for one application-origin RPC.
+  SUPACLOUD_API_TOKEN. Only release canary stage/disable replay actions may additionally use
+  the selected project's SUPABASE_* pair for fixed application-origin RPCs.
   SUPACLOUD_PROJECT_REF is required when it cannot be inferred from <ref>.api.*.
 
   SUPACLOUD_READ_ONLY=true blocks remote writes. Production writes require an
@@ -13377,6 +13463,7 @@ EXAMPLES
   ${preferredCommand} release postgrest_status --ref abc123
   ${preferredCommand} release postgrest_restart --ref abc123
   ${preferredCommand} release release_canary_fixture_stage_replay --ref abc123 --subject <uuid> --request_id <uuid>
+  ${preferredCommand} release release_canary_fixture_disable_replay --ref abc123 --fixture_id <uuid> --disable_request_id <uuid> --issuer <issuer-url> --subject <uuid>
   ${preferredCommand} queue stats --queue emails
   ${preferredCommand} queue dlq --queue emails --limit 20
   ${preferredCommand} frontend list --ref abc123

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",

package/skills/supacloud-cli/references/command-map.md

@@ -16,6 +16,7 @@ Load this reference when selecting a command surface or when a user asks an AI t
 | Rebuild local database | `supabase db_reset` | Local only; preserve required seed behavior |
 | Inspect or back up a remote database | `supabase db_pull`, `migration_list`, `db_dump`, `gen_types` | Requires explicit PostgreSQL DSN; redact it |
 | Replay the release-canary fixture stage receipt | `release release_canary_fixture_stage_replay` | Dual-bind Management project context and that project's service-role application origin; accepts only the exact subject/request UUID pair and a strict idempotent receipt |
+| Disable a staged release-canary fixture | `release release_canary_fixture_disable_replay` | Uses the fixed disable RPC once, accepts idempotent false/true receipts, then queries the existing pending RPC with issuer/subject and requires authoritative JSON `false`; fixture binding comes from the strict disable receipt |
 | Preview/apply migrations remotely | `supabase push` | Always dry-run first; production needs explicit approval |
 | Mark proven-equivalent historical migrations as applied | `database baseline_migrations` | Dry-run, schema-equivalence proof, backup, explicit approval |
 | Inspect auth users or generate a controlled login link | `auth list_users`, `auth get_user`, `auth generate_link` | User reads are bounded; generation supports only `magiclink`, `recovery`, and `invite`, requires production confirmation, and returns only a validated action URL |
@@ -40,7 +41,7 @@ until a project-scoped context is resolved.
 - `secrets`: project secret management; never print values after write.
 - `queue`, `task_events`, `diagnostics`: asynchronous workload operations and bounded diagnostics.
 - `gateway`: project route/config/rebuild operations.
-- `release`: verified backup/PostgREST lifecycle controls plus a production-confirmed, non-retried, strict release-canary fixture stage replay. The replay requires both the selected Management project binding and that project's `SUPABASE_URL`/`SUPABASE_SERVICE_ROLE_KEY`.
+- `release`: verified backup/PostgREST lifecycle controls plus production-confirmed, non-retried, strict release-canary fixture stage and disable replay actions. These actions require both the selected Management project binding and that project's `SUPABASE_URL`/`SUPABASE_SERVICE_ROLE_KEY`.
 - `ai`: inspect or install this packaged Skill.
 
 ## Safe inspection pattern