@supacloud/cli 0.40.0 → 0.42.0

package/dist/index.js

@@ -238838,7 +238838,8 @@ var ACTION_POLICY = {
   },
   ai: { local: ["show_skill", "install_skill"] },
   app: { local: ["generate", "compile", "check", "graph", "explain"] },
-  db: { local: ["lint", "explain"], read: ["module_check"] }
+  db: { local: ["lint", "explain"], read: ["module_check"] },
+  dev: { read: ["status"], write: ["sync", "watch", "migrate"] }
 };
 function declaredMode(moduleName, action) {
   const policy = ACTION_POLICY[moduleName];
@@ -238857,6 +238858,8 @@ function executionMode(moduleName, action, args) {
     return "read";
   if (moduleName === "supabase" && action === "push" && args.dry_run === true)
     return "read";
+  if (moduleName === "dev" && action === "migrate" && args.apply !== true)
+    return "read";
   return declaredMode(moduleName, action);
 }
 function authorizeExecution(moduleName, args, authorization) {
@@ -239502,6 +239505,61 @@ function migrationExecutionStatements(statements) {
   const hasOuterTransaction = /^(?:BEGIN(?:\s+(?:WORK|TRANSACTION))?|START\s+TRANSACTION)$/i.test(first) && /^(?:COMMIT|END)(?:\s+(?:WORK|TRANSACTION))?$/i.test(last);
   return hasOuterTransaction ? statements.slice(1, -1) : [...statements];
 }
+function skipSqlTrivia(sql, start) {
+  let cursor = start;
+  for (;; ) {
+    while (cursor < sql.length && /\s/.test(sql[cursor]))
+      cursor++;
+    if (sql.startsWith("--", cursor)) {
+      cursor = lineCommentEnd(sql, cursor);
+      continue;
+    }
+    if (sql.startsWith("/*", cursor)) {
+      cursor = blockCommentEnd(sql, cursor);
+      continue;
+    }
+    return cursor;
+  }
+}
+function doStatementBody(sql, keywordEnd) {
+  let cursor = skipSqlTrivia(sql, keywordEnd);
+  if (/^LANGUAGE\b/i.test(sql.slice(cursor))) {
+    cursor += "LANGUAGE".length;
+    cursor = skipSqlTrivia(sql, cursor);
+    if (sql[cursor] === "'")
+      cursor = maskSingleQuotedString(sql, cursor).end;
+    else if (sql[cursor] === '"')
+      cursor = maskDoubleQuotedIdentifier(sql, cursor).end;
+    else {
+      const languageName = /^[A-Za-z_][A-Za-z0-9_]*/.exec(sql.slice(cursor));
+      if (!languageName)
+        return null;
+      cursor += languageName[0].length;
+    }
+    cursor = skipSqlTrivia(sql, cursor);
+  }
+  if (sql[cursor] === "'") {
+    const end = maskSingleQuotedString(sql, cursor).end;
+    return sql.slice(cursor + 1, Math.max(cursor + 1, end - 1));
+  }
+  const tag = sql[cursor] === "$" ? dollarQuoteTagAt(sql, cursor) : "";
+  if (!tag)
+    return null;
+  const bodyEnd = sql.indexOf(tag, cursor + tag.length);
+  return bodyEnd === -1 ? null : sql.slice(cursor + tag.length, bodyEnd);
+}
+function topLevelDoBodies(sql) {
+  const masked = maskSqlPolicyNoise(sql);
+  const doKeywordPattern = /(?:^|;)\s*DO\b/gi;
+  const bodies = [];
+  let match;
+  while ((match = doKeywordPattern.exec(masked)) !== null) {
+    const body = doStatementBody(sql, doKeywordPattern.lastIndex);
+    if (body !== null)
+      bodies.push(body);
+  }
+  return bodies;
+}
 function splitTopLevelClauses(sql) {
   const masked = maskSqlNoise(sql);
   const clauses = [];
@@ -239596,14 +239654,6 @@ var RISK_RULES = [
     description: "Renames table. Causes immediate downtime for application code.",
     recommendation: "Follow Expand-Contract: Create a view or alias table during transition."
   },
-  {
-    type: "manual_review_do_block",
-    level: "HIGH",
-    pattern: /^\s*DO\b/i,
-    description: "DO blocks can execute dynamic or procedural DDL that static rules cannot inspect safely.",
-    recommendation: "Move schema changes into explicit SQL statements; push_migrations rejects opaque procedural SQL.",
-    blocksTransactionalPush: true
-  },
   {
     type: "manual_review_procedural_definition",
     level: "HIGH",
@@ -239705,7 +239755,7 @@ var MIGRATION_LEDGER_RELATION_END = String.raw`(?=$|[\s,;(*])`;
 var MIGRATION_LEDGER_DDL_OR_MAINTENANCE_PREFIX = String.raw`(?:CREATE\s+(?:UNIQUE\s+)?INDEX\b[^;]*\bON\s+(?:ONLY\s+)?|CREATE\s+(?:CONSTRAINT\s+)?TRIGGER\b[^;]*\bON\s+|DROP\s+TRIGGER\s+(?:IF\s+EXISTS\s+)?[^;]*\bON\s+|CREATE\s+RULE\b[^;]*\bTO\s+|DROP\s+RULE\s+(?:IF\s+EXISTS\s+)?[^;]*\bON\s+|CREATE\s+POLICY\b[^;]*\bON\s+|ALTER\s+POLICY\b[^;]*\bON\s+|DROP\s+POLICY\s+(?:IF\s+EXISTS\s+)?[^;]*\bON\s+|COMMENT\s+ON\s+TABLE\s+|SECURITY\s+LABEL(?:\s+FOR\s+[^;\s]+)?\s+ON\s+TABLE\s+|REINDEX(?:\s*\([^;)]*\))?\s+TABLE\s+(?:CONCURRENTLY\s+)?|CLUSTER(?:\s+VERBOSE)?\s+|VACUUM(?:\s*\([^;)]*\))?(?:\s+(?:FULL|FREEZE|VERBOSE|ANALYZE))*\s+|ANALYZE(?:\s*\([^;)]*\))?(?:\s+VERBOSE)?\s+)`;
 var MIGRATION_LEDGER_MODIFICATION_PATTERN = new RegExp(String.raw`\b(?:(?:CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?|INSERT\s+INTO\s+(?:ONLY\s+)?|UPDATE\s+(?:ONLY\s+)?|DELETE\s+FROM\s+(?:ONLY\s+)?|MERGE\s+INTO\s+(?:ONLY\s+)?|ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?|COPY\s+)` + MIGRATION_LEDGER_RELATION + MIGRATION_LEDGER_RELATION_END + String.raw`|(?:DROP\s+TABLE\s+(?:IF\s+EXISTS\s+)?|TRUNCATE(?:\s+TABLE)?\s+|LOCK\s+(?:TABLE\s+)?)[^;]*` + MIGRATION_LEDGER_RELATION + MIGRATION_LEDGER_RELATION_END + String.raw`|` + MIGRATION_LEDGER_DDL_OR_MAINTENANCE_PREFIX + MIGRATION_LEDGER_RELATION + MIGRATION_LEDGER_RELATION_END + String.raw`)`, "i");
 var NON_TABLE_PRIVILEGE_TARGET = String.raw`(?:ALL\s+(?:FUNCTIONS|PROCEDURES|ROUTINES|SEQUENCES)\s+IN\s+SCHEMA|DATABASE|DOMAIN|FOREIGN\s+DATA\s+WRAPPER|FOREIGN\s+SERVER|FUNCTION|LANGUAGE|LARGE\s+OBJECT|PARAMETER|PROCEDURE|ROUTINE|SCHEMA|SEQUENCE|TABLESPACE|TYPE)\b`;
-var MIGRATION_LEDGER_PRIVILEGE_PATTERN = new RegExp(String.raw`\b(?:GRANT|REVOKE)\b[^;]*\bON\s+(?:(?:TABLE\s+)?(?!` + NON_TABLE_PRIVILEGE_TARGET + String.raw`)(?:(?!\b(?:TO|FROM)\b)[^;])*?` + MIGRATION_LEDGER_RELATION + MIGRATION_LEDGER_RELATION_END + String.raw`(?=[^;]*\b(?:TO|FROM)\b)|ALL\s+TABLES\s+IN\s+SCHEMA\s+"?(?:supabase_migrations|public)"?(?=$|[\s,;]))`, "i");
+var MIGRATION_LEDGER_PRIVILEGE_PATTERN = new RegExp(String.raw`\b(?:GRANT|REVOKE)\b[^;]*\bON\s+(?:(?:TABLE\s+)?(?!` + NON_TABLE_PRIVILEGE_TARGET + String.raw`)(?:(?!\b(?:TO|FROM)\b)[^;])*?` + MIGRATION_LEDGER_RELATION + MIGRATION_LEDGER_RELATION_END + String.raw`(?=[^;]*\b(?:TO|FROM)\b)|ALL\s+TABLES\s+IN\s+SCHEMA\s+"?supabase_migrations"?(?=$|[\s,;]))`, "i");
 var PUSH_BLOCKER_RULES = [
   {
     type: "unsupported_project_scope_management",
@@ -239832,6 +239882,7 @@ var MIGRATION_LEDGER_BLOCKER_RULES = [
     blocksTransactionalPush: true
   }
 ];
+var DO_BODY_BLOCKER_RULES = PUSH_BLOCKER_RULES.filter((rule) => rule.type !== "unsupported_transaction_control");
 function matchingRisks(rawStatement, maskedStatement, rules) {
   return rules.filter((rule) => rule.pattern.test(maskedStatement) && !rule.excludePattern?.test(maskedStatement)).map((rule) => ({
     level: rule.level,
@@ -239908,6 +239959,13 @@ function analyzeMigrationSql(sql) {
     risks.push(...matchingRisks(rawStatement, masked, PUSH_BLOCKER_RULES));
     risks.push(...matchingRisks(rawStatement, policyMasked, QUOTED_FUNCTION_BLOCKER_RULES));
     risks.push(...matchingRisks(rawStatement, policyMasked, MIGRATION_LEDGER_BLOCKER_RULES));
+    for (const body of topLevelDoBodies(rawStatement)) {
+      const maskedBody = maskSqlNoise(body);
+      const policyMaskedBody = maskSqlPolicyNoise(body);
+      risks.push(...matchingRisks(body, maskedBody, DO_BODY_BLOCKER_RULES));
+      risks.push(...matchingRisks(body, policyMaskedBody, QUOTED_FUNCTION_BLOCKER_RULES));
+      risks.push(...matchingRisks(body, policyMaskedBody, MIGRATION_LEDGER_BLOCKER_RULES));
+    }
   }
   return risks;
 }
@@ -246635,9 +246693,9 @@ function parseModule(candidate, nameByNode, ctx) {
           className: cls.getName() ?? "<anonymous>",
           name: stringLiteralProp(meta, "name") ?? cls.getName() ?? "<anonymous>",
           permission: stringLiteralProp(meta, "permission"),
-          transaction: stringLiteralProp(meta, "transaction"),
+          transaction: commandModeProp(meta, "transaction") ?? "none",
           audit: stringLiteralProp(meta, "audit"),
-          idempotency: stringLiteralProp(meta, "idempotency")
+          idempotency: commandModeProp(meta, "idempotency") ?? "none"
         });
       }
     }
@@ -246665,6 +246723,10 @@ function parseModule(candidate, nameByNode, ctx) {
     exports
   };
 }
+function commandModeProp(object, name) {
+  const value = stringLiteralProp(object, name);
+  return value === "required" || value === "none" ? value : undefined;
+}
 function parseProvider(el, exportsSet, ctx) {
   const file = sourcePath(ctx.rootDir, el.getSourceFile().getFilePath());
   const line = el.getStartLineNumber();
@@ -246817,6 +246879,11 @@ function parseController(el, ctx) {
               schemaImports[schemaExpr.getText()] = importPath;
           }
         }
+        const commandExpr = getProp(optionsArg, "command");
+        if (commandExpr && import_ts_morph.Node.isIdentifier(commandExpr)) {
+          const commandDecl = resolveDeclaration(commandExpr)[0];
+          route.command = commandDecl && import_ts_morph.Node.isClassDeclaration(commandDecl) ? commandDecl.getName() ?? commandExpr.getText() : commandExpr.getText();
+        }
       }
       routes.push(route);
     }
@@ -247052,6 +247119,16 @@ var INTERFACES = `export interface CompiledRoute {
   params?: unknown;
   query?: unknown;
   response?: unknown;
+  command?: string;
+}
+
+export interface CompiledCommand {
+  className: string;
+  name: string;
+  permission: string;
+  transaction: "required" | "none";
+  audit?: string;
+  idempotency: "required" | "none";
 }
 
 export interface CompiledController {
@@ -247070,12 +247147,15 @@ export interface CompiledModule {
   createRequestScope?(
     services: Record<string, unknown>,
     ctx: unknown,
+    imported?: Record<string, Record<string, unknown>>,
   ): Record<string, unknown>;
   createJobScope?(
     services: Record<string, unknown>,
     ctx: unknown,
+    imported?: Record<string, Record<string, unknown>>,
   ): Record<string, unknown>;
   controllers: CompiledController[];
+  commands: CompiledCommand[];
 }`;
 async function generateApplication(graph, options) {
   const modules = topoSortModules(graph.modules);
@@ -247094,7 +247174,7 @@ async function generateApplication(graph, options) {
     ...imports.size > 0 ? [""] : [],
     INTERFACES,
     "",
-    "export function createCompiledModules(deps: Record<string, unknown>): CompiledModule[] {",
+    "export function createCompiledModules(): CompiledModule[] {",
     "  return [",
     ...descriptorEntries.map((entry) => indent(entry, 4) + ","),
     "  ];",
@@ -247225,6 +247305,7 @@ class ModuleGenerator {
       lines.push(`  createJobScope: create${this.pascal}JobScope,`);
     }
     lines.push(`  controllers: ${this.renderControllers()},`);
+    lines.push(`  commands: ${JSON.stringify(this.module.commands)},`);
     lines.push(`}`);
     return lines.join(`
 `);
@@ -247249,6 +247330,8 @@ class ModuleGenerator {
             fields.push(`${field}: ${local}`);
           }
         }
+        if (route.command)
+          fields.push(`command: ${JSON.stringify(route.command)}`);
         return `{ ${fields.join(", ")} }`;
       });
       return [
@@ -247282,6 +247365,7 @@ ${indent(item, 2)}`).join(",")}
       `function create${this.pascal}${suffix}(`,
       `  services: Record<string, unknown>,`,
       `  ctx: unknown,`,
+      `  imported: Record<string, Record<string, unknown>> = {},`,
       `): Record<string, unknown> {`,
       indent(this.renderFactoryBody(kind), 2),
       `}`
@@ -247380,7 +247464,7 @@ ${indent(item, 2)}`).join(",")}
         continue;
       if (kind === "services")
         return `imported.${importName}.${camelName(token)}`;
-      return `services.${camelName(token)}`;
+      return `imported.${importName}.${camelName(token)}`;
     }
     if (kind === "services")
       return `deps.${camelName(token)}`;
@@ -247441,6 +247525,42 @@ function validateGraph(graph, strict = false) {
   const warn2 = (code, message, file, line) => {
     diagnostics.push({ severity: strict ? "error" : "warn", code, message, file, line });
   };
+  const modulesByName = new Map;
+  const commandsByName = new Map;
+  const routesByKey = new Map;
+  for (const module of graph.modules) {
+    const previousModule = modulesByName.get(module.name);
+    if (previousModule) {
+      error("duplicate-module", `模块名 ${module.name} 重复（首次声明于 ${previousModule.file}:${previousModule.line}）`, module.file, module.line);
+    } else {
+      modulesByName.set(module.name, module);
+    }
+    for (const command of module.commands) {
+      const previousName = commandsByName.get(command.name);
+      if (previousName) {
+        error("duplicate-command", `command 名 ${command.name} 重复（首次由模块 ${previousName.module.name} 的 ${previousName.className} 声明）`, module.file, module.line);
+      } else {
+        commandsByName.set(command.name, { module, className: command.className });
+      }
+    }
+  }
+  for (const module of graph.modules) {
+    for (const controller of module.controllers) {
+      for (const route of controller.routes) {
+        const fullPath = joinRoutePaths(controller.path, route.path);
+        const key = `${route.method} ${fullPath}`;
+        const previous = routesByKey.get(key);
+        if (previous) {
+          error("duplicate-route", `路由 ${key} 重复（首次声明于模块 ${previous.module.name} 的 ${previous.controller.className}）`, controller.file);
+        } else {
+          routesByKey.set(key, { module, controller });
+        }
+        if (route.command && !module.commands.some((command) => command.className === route.command)) {
+          error("route-command-unresolved", `路由 ${key} 绑定的 command 类 ${route.command} 未在模块 ${module.name} 声明`, controller.file);
+        }
+      }
+    }
+  }
   for (const module of graph.modules) {
     const seen = new Map;
     for (const provider of module.providers) {
@@ -247472,13 +247592,18 @@ function validateGraph(graph, strict = false) {
     }
     for (const command of module.commands) {
       if (!command.permission) {
-        warn2("command-missing-permission", `模块 ${module.name} 的 command ${command.name} (${command.className}) 未声明 permission`, module.file, module.line);
+        error("command-missing-permission", `模块 ${module.name} 的 command ${command.name} (${command.className}) 未声明 permission`, module.file, module.line);
       }
     }
   }
   diagnostics.push(...detectCycles(graph, resolveDep));
   return diagnostics;
 }
+function joinRoutePaths(prefix, path) {
+  const joined = `${prefix}/${path}`.replace(/\/{2,}/g, "/");
+  const normalized = joined.length > 1 ? joined.replace(/\/+$/, "") : joined;
+  return normalized.replace(/:[^/]+/g, ":param");
+}
 function detectCycles(graph, resolveDep) {
   const diagnostics = [];
   const nodeId = (ref) => `${ref.module.name}:${ref.provider.token}`;
@@ -247921,6 +248046,18 @@ JOIN pg_language l ON l.oid = p.prolang
 WHERE n.nspname = ANY($1)
 ORDER BY n.nspname, p.proname
 `;
+var TRIGGERS_SQL = `
+SELECT n.nspname AS schema,
+       c.relname AS table,
+       t.tgname AS name,
+       t.tgenabled <> 'D' AS enabled
+FROM pg_trigger t
+JOIN pg_class c ON c.oid = t.tgrelid
+JOIN pg_namespace n ON n.oid = c.relnamespace
+WHERE NOT t.tgisinternal
+  AND n.nspname = ANY($1)
+ORDER BY n.nspname, c.relname, t.tgname
+`;
 var GRANTS_SQL = `
 SELECT table_schema AS object_schema,
        table_name AS object_name,
@@ -247953,10 +248090,11 @@ function extractSearchPath(config) {
 }
 async function readCatalog(executor, schemas = ["public"]) {
   const params = [schemas];
-  const [tableRows, policyRows, functionRows, grantRows] = await Promise.all([
+  const [tableRows, policyRows, functionRows, triggerRows, grantRows] = await Promise.all([
     executor.query(TABLES_SQL, params),
     executor.query(POLICIES_SQL, params),
     executor.query(FUNCTIONS_SQL, params),
+    executor.query(TRIGGERS_SQL, params),
     executor.query(GRANTS_SQL, params)
   ]);
   return {
@@ -247982,6 +248120,12 @@ async function readCatalog(executor, schemas = ["public"]) {
       searchPath: extractSearchPath(row.config),
       language: row.language
     })),
+    triggers: triggerRows.map((row) => ({
+      schema: row.schema,
+      table: row.table,
+      name: row.name,
+      enabled: row.enabled
+    })),
     grants: grantRows.map((row) => ({
       objectSchema: row.object_schema,
       objectName: row.object_name,
@@ -248035,6 +248179,20 @@ function reconcileModule(module, catalog) {
       push("error", "definer-without-search-path", fn.name, `security definer 函数 ${fn.name} 未设置固定 search_path（当前: ${cf.searchPath ?? "未设置"}）`);
     }
   }
+  for (const trigger of module.triggers) {
+    const [schema, table] = splitQualifiedName(trigger.table);
+    const found = catalog.triggers.some((ct) => ct.schema === schema && ct.table === table && ct.name === trigger.name);
+    if (!found) {
+      push("error", "missing-trigger", `${trigger.table}.${trigger.name}`, `声明的触发器 ${trigger.name} 在表 ${trigger.table} 的 catalog 中不存在`);
+    }
+  }
+  const declaredTriggerKeys = new Set(module.triggers.map((t) => `${t.table}::${t.name}`));
+  for (const ct of catalog.triggers) {
+    const qualified = `${ct.schema}.${ct.table}`;
+    if (ownedTables.has(qualified) && !declaredTriggerKeys.has(`${qualified}::${ct.name}`)) {
+      push("warn", "undeclared-trigger", `${qualified}.${ct.name}`, `归属表 ${qualified} 上存在未声明的触发器 ${ct.name}${ct.enabled ? "" : "（已禁用）"}，可能发生漂移`);
+    }
+  }
   for (const table of module.tables) {
     const [schema, name] = splitQualifiedName(table);
     const ct = catalog.tables.find((t) => t.schema === schema && t.name === name);
@@ -248066,6 +248224,8 @@ var SET_SEARCH_PATH_RE = /\bset\s+search_path\b/i;
 var GRANT_TO_PUBLIC_RE = /\bgrant\b[^;]*\bto\s+public\b/i;
 var DROP_WITHOUT_IF_EXISTS_RE = /\bdrop\s+(?:table|column)\s+(?!if\s+exists\b)/i;
 var ENABLE_RLS_RE = /\benable\s+row\s+level\s+security\b/i;
+var CREATE_POLICY_RE = /\bcreate\s+policy\b/i;
+var DROP_POLICY_IF_EXISTS_RE = /\bdrop\s+policy\s+if\s+exists\b/i;
 function lineOf(sql, index) {
   let line = 1;
   for (let i = 0;i < index; i += 1) {
@@ -248106,6 +248266,19 @@ function lintSql(sql, file) {
       line: lineOf(sql, drop.index)
     });
   }
+  const createPolicy = CREATE_POLICY_RE.exec(sql);
+  if (createPolicy) {
+    const dropPolicy = DROP_POLICY_IF_EXISTS_RE.exec(sql);
+    if (!dropPolicy || dropPolicy.index > createPolicy.index) {
+      issues.push({
+        severity: "warn",
+        code: "non-idempotent-policy",
+        message: "create policy 前缺少 drop policy if exists，策略不可重复执行",
+        file,
+        line: lineOf(sql, createPolicy.index)
+      });
+    }
+  }
   return issues;
 }
 async function lintModule(module, readFile2) {
@@ -250638,10 +250811,282 @@ function registerDeployTools(server2, http, options = {}) {
     }
   });
 }
+
+// src/shared/tools/remote-dev-tools.ts
+import { spawn as spawn4 } from "node:child_process";
+import { existsSync as existsSync11 } from "node:fs";
+import { readFile as readFile3 } from "node:fs/promises";
+import { readdir } from "node:fs/promises";
+import { createHash as createHash5 } from "node:crypto";
+import { join as join10, resolve as resolve11 } from "node:path";
+var SAFE_TOKEN = /^[A-Za-z0-9._:@/+,-]+$/;
+var SAFE_REMOTE_ROOT = /^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+\/?$/;
+var remoteDevToolSchema = {
+  action: withDescription(stringEnum(["sync", "watch", "status", "migrate"]), "Remote development action"),
+  target: optional(stringEnum(["db", "functions", "frontend", "project"]), "Sync target (default: project)"),
+  project_dir: optional(Type.String(), "Local project directory (default: current directory)"),
+  remote_root: optional(Type.String(), "Remote development root"),
+  remote_host: optional(Type.String(), "Remote test server host"),
+  remote_user: optional(Type.String(), "SSH user"),
+  remote_port: optional(Type.Number(), "SSH port"),
+  remote_key: optional(Type.String(), "SSH private key path"),
+  function: optional(Type.String(), "Function slug"),
+  delete: optional(Type.Boolean(), "Delete remote files absent locally"),
+  reload: optional(Type.Boolean(), "Reload the affected target after sync (default: true)"),
+  interval_ms: optional(Type.Number(), "Watch debounce interval in milliseconds (default: 300)"),
+  json: optional(Type.Boolean(), "Emit machine-readable JSON"),
+  apply: optional(Type.Boolean(), "Apply generated migrations to the selected test database"),
+  drizzle_config: optional(Type.String(), "Drizzle config path"),
+  migrations_dir: optional(Type.String(), "Migration directory"),
+  drizzle_bin: optional(Type.String(), "drizzle-kit executable")
+};
+function runProcess(executable, args, cwd) {
+  return new Promise((resolveResult, reject) => {
+    const child = spawn4(executable, args, { cwd, shell: false, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.setEncoding("utf8");
+    child.stderr?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.once("error", reject);
+    child.once("close", (exitCode) => resolveResult({ exitCode: exitCode ?? 1, stdout, stderr }));
+  });
+}
+function resolveDrizzleCommand(root, configured) {
+  if (configured?.trim())
+    return configured.trim();
+  const local = join10(root, "node_modules", ".bin", "drizzle-kit");
+  return existsSync11(local) ? local : "drizzle-kit";
+}
+function toolFailed(value) {
+  return value?.isError === true || value?.content?.some((chunk) => typeof chunk?.text === "string" && chunk.text.trimStart().startsWith("❌"));
+}
+async function migrateDatabase(args, options) {
+  const root = resolve11(String(args.project_dir || options.cwd || process.cwd()));
+  const projectConfig = await readProjectConfig(root);
+  const config = projectConfig.dev || {};
+  const database = config.database || {};
+  const execute = options.execute || ((command, commandArgs, cwd) => runProcess(command, commandArgs, cwd));
+  const drizzleConfig = resolve11(root, String(args.drizzle_config || database.drizzleConfig || "drizzle.config.ts"));
+  const migrationsDir = String(args.migrations_dir || database.migrationsDir || "supabase/migrations");
+  if (!existsSync11(drizzleConfig))
+    throw new Error(`Drizzle config not found: ${drizzleConfig}`);
+  const generated = await execute(resolveDrizzleCommand(root, typeof args.drizzle_bin === "string" ? args.drizzle_bin : database.drizzleBin), ["generate", "--config", drizzleConfig], root);
+  if (generated.exitCode !== 0)
+    throw new Error(`Drizzle migration generation failed: ${generated.stderr.trim() || `exit ${generated.exitCode}`}`);
+  if (!options.runDatabase)
+    throw new Error("dev migrate requires Management API context");
+  const dryRun = await options.runDatabase({ action: "push_migrations", dir: migrationsDir, dry_run: true, strict: database.strict !== false });
+  if (toolFailed(dryRun))
+    throw new Error("SupaCloud migration dry-run failed");
+  if (args.apply !== true)
+    return { ok: true, mode: "dev", action: "migrate", generated: true, applied: false, migrations_dir: migrationsDir, dry_run: dryRun };
+  const applied = await options.runDatabase({ action: "push_migrations", dir: migrationsDir, strict: database.strict !== false });
+  if (toolFailed(applied))
+    throw new Error("SupaCloud migration apply failed");
+  return { ok: true, mode: "dev", action: "migrate", generated: true, applied: true, migrations_dir: migrationsDir, result: applied };
+}
+async function readProjectConfig(root) {
+  const file = join10(root, "supacloud.json");
+  if (!existsSync11(file))
+    return {};
+  try {
+    const parsed = JSON.parse(await readFile3(file, "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch (error) {
+    throw new Error(`Invalid supacloud.json: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function readDevConfig(root) {
+  const config = await readProjectConfig(root);
+  return config.dev || {};
+}
+async function sourceFingerprint(root) {
+  const files = [];
+  const visit = async (directory) => {
+    const entries = await readdir(directory, { withFileTypes: true });
+    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+      const path = join10(directory, entry.name);
+      if (entry.isDirectory() && ![".git", "node_modules", "dist", "generated", ".supacloud"].includes(entry.name))
+        await visit(path);
+      else if (entry.isFile())
+        files.push(path);
+    }
+  };
+  await visit(root);
+  const hash2 = createHash5("sha256");
+  for (const file of files) {
+    hash2.update(file.slice(root.length).replace(/\\/g, "/"));
+    hash2.update(await readFile3(file));
+  }
+  return hash2.digest("hex");
+}
+function safeToken(value, label) {
+  if (!value || !SAFE_TOKEN.test(value))
+    throw new Error(`Invalid ${label}`);
+  return value;
+}
+function remoteRoot(value) {
+  const normalized = value.trim().replace(/\\/g, "/");
+  if (!SAFE_REMOTE_ROOT.test(normalized) || normalized.includes(".."))
+    throw new Error("Invalid remote_root");
+  return normalized.replace(/\/$/, "");
+}
+function targetDirectory(root, target, functionSlug, config = {}) {
+  if (target === "db")
+    return join10(root, "supabase", "migrations");
+  if (target === "functions") {
+    const targets = config.targets && typeof config.targets === "object" ? config.targets : {};
+    const match = Object.values(targets).find((entry) => entry?.type === "edge_function" && (!functionSlug || String(entry.slug || "") === functionSlug));
+    const base = match?.root ? resolve11(root, String(match.root)) : join10(root, "supabase", "functions");
+    return match?.root ? base : functionSlug ? join10(base, safeToken(functionSlug, "function")) : base;
+  }
+  if (target === "frontend") {
+    const targets = config.targets && typeof config.targets === "object" ? config.targets : {};
+    const match = Object.values(targets).find((entry) => entry?.type === "frontend");
+    return match?.root ? resolve11(root, String(match.root)) : join10(root, "apps", "web");
+  }
+  return root;
+}
+function remoteTargetRoot(root, target, functionSlug) {
+  if (target === "db")
+    return `${root}/database/migrations`;
+  if (target === "functions")
+    return `${root}/functions/${functionSlug ? safeToken(functionSlug, "function") : ""}`.replace(/\/$/, "");
+  if (target === "frontend")
+    return `${root}/frontend`;
+  return `${root}/project`;
+}
+function connectionArgs(options, config, args) {
+  const host = String(args.remote_host || config.host || options.host || "").trim();
+  const user = String(args.remote_user || config.user || options.sshUser || "").trim();
+  const port = Number(args.remote_port || config.port || options.sshPort || 22);
+  const key = String(args.remote_key || config.key || options.sshKey || "").trim();
+  if (!host)
+    throw new Error("Remote dev requires SUPACLOUD_HOST or --remote_host");
+  safeToken(host, "remote_host");
+  safeToken(user, "remote_user");
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    throw new Error("Invalid remote_port");
+  if (!key || key.includes("\x00") || key.includes(`
+`))
+    throw new Error("Invalid remote_key");
+  return { host, user, port, key };
+}
+function targetConfigPath(target) {
+  return target === "project" ? "project" : target;
+}
+function reloadCommand(config, target, projectRef2, functionSlug) {
+  const command = config.reloadCommand?.trim() || "supacloud-dev-agent reload";
+  if (!/^[A-Za-z0-9._/-]+(?: [A-Za-z0-9._:/=-]+)*$/.test(command))
+    throw new Error("Invalid reloadCommand in supacloud.json");
+  return [...command.split(" "), "--project-ref", safeToken(projectRef2 || "test", "project_ref"), "--target", targetConfigPath(target), ...functionSlug ? ["--function", safeToken(functionSlug, "function")] : []];
+}
+function sshArgs(connection, remoteCommand) {
+  return ["-p", String(connection.port), "-i", resolve11(connection.key), "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=yes", `${connection.user}@${connection.host}`, ...remoteCommand];
+}
+function rsyncArgs(connection, source, destination, excludes, deleteRemote) {
+  const args = ["-az", "--checksum", "--partial", "--protect-args", "-e", `ssh -p ${connection.port} -i ${resolve11(connection.key)} -o BatchMode=yes -o StrictHostKeyChecking=yes`];
+  if (deleteRemote)
+    args.push("--delete-delay");
+  for (const exclude of excludes) {
+    if (!/^\/?[A-Za-z0-9._*/-]+$/.test(exclude))
+      throw new Error("Invalid dev exclude pattern");
+    args.push("--exclude", exclude);
+  }
+  args.push(`${source.replace(/\/$/, "")}/`, `${connection.user}@${connection.host}:${destination.replace(/\/$/, "")}/`);
+  return args;
+}
+async function syncOnce(args, options) {
+  const root = resolve11(String(args.project_dir || options.cwd || process.cwd()));
+  const projectConfig = await readProjectConfig(root);
+  const config = projectConfig.dev || {};
+  const target = String(args.target || "project");
+  const source = targetDirectory(root, target, typeof args.function === "string" ? args.function : undefined, projectConfig);
+  if (!existsSync11(source))
+    throw new Error(`Dev source directory not found: ${source}`);
+  let compiled = false;
+  if (config.compile === true && target !== "db") {
+    const compileRoot = resolve11(root, config.compileRoot || ".");
+    const compileOutDir = resolve11(root, config.compileOutDir || "generated");
+    const compilation = await compileProject({
+      rootDir: compileRoot,
+      outDir: compileOutDir,
+      strict: config.compileStrict !== false
+    });
+    const errors = compilation.diagnostics.filter((diagnostic) => diagnostic.severity === "error");
+    if (errors.length > 0) {
+      throw new Error(`DI compile failed: ${errors.map((diagnostic) => `${diagnostic.code} ${diagnostic.message}`).join("; ")}`);
+    }
+    compiled = true;
+  }
+  const remoteBase = remoteRoot(String(args.remote_root || config.remoteRoot || `/var/lib/supacloud/dev/${options.projectRef || "project"}`));
+  const slug = typeof args.function === "string" ? args.function : undefined;
+  const destination = remoteTargetRoot(remoteBase, target, slug);
+  const connection = connectionArgs(options, config, args);
+  const execute = options.execute || ((command, commandArgs, cwd) => runProcess(command, commandArgs, cwd));
+  const mkdir3 = await execute("ssh", sshArgs(connection, ["mkdir", "-p", destination]), root);
+  if (mkdir3.exitCode !== 0)
+    throw new Error(`Remote dev prepare failed: ${mkdir3.stderr.trim() || `exit ${mkdir3.exitCode}`}`);
+  const excludes = Array.isArray(config.excludes) ? config.excludes : ["node_modules", ".git", ".env*", "dist", ".supacloud"];
+  const sync = await execute("rsync", rsyncArgs(connection, source, destination, excludes, args.delete === true), root);
+  if (sync.exitCode !== 0)
+    throw new Error(`Remote dev sync failed: ${sync.stderr.trim() || `exit ${sync.exitCode}`}`);
+  const shouldReload = args.reload !== false;
+  let reload = null;
+  if (shouldReload) {
+    reload = await execute("ssh", sshArgs(connection, reloadCommand(config, target, options.projectRef, slug)), root);
+    if (reload.exitCode !== 0)
+      throw new Error(`Remote dev reload failed: ${reload.stderr.trim() || `exit ${reload.exitCode}`}`);
+  }
+  return { ok: true, mode: "dev", action: "sync", environment: options.environment || null, target, source, destination, host: connection.host, compiled, reloaded: shouldReload };
+}
+function registerRemoteDevTools(server2, options = {}) {
+  server2.tool("dev", "Remote test-server development sync. It never targets production and never syncs secrets.", remoteDevToolSchema, async (args) => {
+    if (["production", "prod"].includes((options.environment || "").toLowerCase()))
+      throw new Error("Remote dev mode is forbidden for production environments");
+    if (args.action === "status") {
+      const root = resolve11(String(args.project_dir || options.cwd || process.cwd()));
+      const config = await readDevConfig(root);
+      const connection = connectionArgs(options, config, args);
+      const execute = options.execute || ((command, commandArgs, cwd) => runProcess(command, commandArgs, cwd));
+      const status = await execute("ssh", sshArgs(connection, ["supacloud-dev-agent", "status", "--project-ref", safeToken(options.projectRef || "test", "project_ref")]), root);
+      return { content: [{ type: "text", text: JSON.stringify({ ok: status.exitCode === 0, mode: "dev", action: "status", host: connection.host, output: status.stdout.trim(), error: status.stderr.trim() }, null, 2) }], isError: status.exitCode !== 0 };
+    }
+    if (args.action === "sync") {
+      return { content: [{ type: "text", text: JSON.stringify(await syncOnce(args, options), null, 2) }] };
+    }
+    if (args.action === "migrate") {
+      return { content: [{ type: "text", text: JSON.stringify(await migrateDatabase(args, options), null, 2) }] };
+    }
+    if (args.action === "watch") {
+      const root = resolve11(String(args.project_dir || options.cwd || process.cwd()));
+      const interval = Math.max(100, Math.min(1e4, Number(args.interval_ms || 300)));
+      let fingerprint = "";
+      let lastSync = null;
+      for (;; ) {
+        const nextFingerprint = await sourceFingerprint(root);
+        if (nextFingerprint !== fingerprint) {
+          lastSync = await syncOnce(args, options);
+          fingerprint = nextFingerprint;
+          process.stdout.write(`${JSON.stringify({ ...lastSync, watching: true })}
+`);
+        }
+        await new Promise((resolveDelay) => setTimeout(resolveDelay, interval));
+      }
+    }
+    throw new Error("Unsupported remote dev action");
+  });
+}
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.40.0",
+  version: "0.42.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -250673,8 +251118,8 @@ var package_default = {
   },
   dependencies: {
     "@sinclair/typebox": "^0.34.52",
-    "@supacloud/compiler": "^0.1.0",
-    "@supacloud/db": "^0.1.0",
+    "@supacloud/compiler": "^0.2.0",
+    "@supacloud/db": "^0.2.0",
     fflate: "^0.8.3"
   },
   devDependencies: {
@@ -250892,6 +251337,11 @@ EXAMPLES
   ${preferredCommand} deploy
   ${preferredCommand} deploy --target web
   ${preferredCommand} deploy --target api
+  ${preferredCommand} dev sync --env test --target functions --function api
+  ${preferredCommand} dev status --env test
+  ${preferredCommand} dev watch --env test --target project
+  ${preferredCommand} dev sync --env test --target db
+  ${preferredCommand} dev migrate --env test
   ${preferredCommand} project get
   ${preferredCommand} project logs --log_type database
   ${preferredCommand} project task_stats
@@ -251058,6 +251508,15 @@ function createCliTools(context, confirmProduction) {
     Object.assign(tools, captureTools((server2) => registerDatabaseTools(server2, undefined, {
       localOnly: true
     })));
+    Object.assign(tools, captureTools((server2) => registerRemoteDevTools(server2, {
+      cwd: process.cwd(),
+      host: process.env.SUPACLOUD_DEV_HOST || context.host,
+      sshUser: context.sshUser,
+      sshPort: context.sshPort,
+      sshKey: context.sshKey,
+      projectRef: context.projectRef || undefined,
+      environment: context.environment
+    })));
     tools.setup_help = {
       schema: {},
       callback: async () => ({
@@ -251110,6 +251569,16 @@ function createCliTools(context, confirmProduction) {
   }));
   pushMigrations = databaseTools.database?.callback;
   assign(databaseTools);
+  assign(captureTools((server2) => registerRemoteDevTools(server2, {
+    cwd: process.cwd(),
+    host: process.env.SUPACLOUD_DEV_HOST || context.host,
+    sshUser: context.sshUser,
+    sshPort: context.sshPort,
+    sshKey: context.sshKey,
+    projectRef: context.projectRef || undefined,
+    environment: context.environment,
+    runDatabase: databaseTools.database?.callback
+  })));
   assign(captureTools((server2) => registerAuthTools(server2, http)));
   assign(captureTools((server2) => registerOAuthClientTools(server2, http)));
   assign(captureTools((server2) => registerStorageTools(server2, http)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.40.0",
+  "version": "0.42.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -32,8 +32,8 @@
   },
   "dependencies": {
     "@sinclair/typebox": "^0.34.52",
-    "@supacloud/compiler": "^0.1.0",
-    "@supacloud/db": "^0.1.0",
+    "@supacloud/compiler": "^0.2.0",
+    "@supacloud/db": "^0.2.0",
     "fflate": "^0.8.3"
   },
   "devDependencies": {