@supacloud/cli 0.6.2 → 0.8.0

package/README.md

@@ -96,4 +96,29 @@ Task event commands:
 - `task_events unregister_webhook`
 - `task_events inspect_webhook`
 
+Gateway / Caddy commands (require admin privileges; config is injected via the Caddy JSON Admin API):
+
+- `gateway routes` — list custom gateway routes (reverse_proxy / static sites)
+- `gateway upsert_route` — create or replace a route
+- `gateway update_route` — replace a route by id
+- `gateway delete_route` — remove a route by id
+- `gateway config` — update rate-limit tier, CORS origins, or JWT settings
+- `gateway get_certificate` — read certificate automation settings
+- `gateway update_certificate` — save certificate automation settings
+- `gateway issue_certificate` — issue or renew a certificate with lego
+- `gateway deploy_certificate` — deploy an existing PEM cert/key pair
+- `gateway rebuild` — rebuild all tenant gateway configs (`--clean` for a full rebuild)
+- `gateway custom_hostname` — read the bound custom hostname
+- `gateway set_custom_hostname` — bind a custom hostname
+- `gateway delete_custom_hostname` — remove the custom hostname
+- `gateway verify_custom_hostname` — verify a custom hostname
+
+```bash
+supacloud-cli gateway routes --ref abc123
+supacloud-cli gateway upsert_route --ref abc123 --route_id webhook \
+  --hosts "api.example.com" --paths "/webhook/*" --upstream 10.0.0.5:8080
+supacloud-cli gateway config --ref abc123 --rate_limit_tier pro
+supacloud-cli gateway rebuild --ref abc123 --clean
+```
+
 For server installation, SSH diagnostics, and tenant administration, use `@supacloud/admin`.

package/dist/index.js

@@ -14,9 +14,6 @@ var __export = (target, all) => {
     });
 };
 
-// src/index.ts
-import path from "node:path";
-
 // node_modules/zod/v4/classic/external.js
 var exports_external = {};
 __export(exports_external, {
@@ -16613,10 +16610,303 @@ ${formatQueueSettings(res.data)}` : `❌ Failed (${res.status})`;
   });
 }
 
+// src/shared/tools/gateway-tools.ts
+var stringArray = exports_external.preprocess((value) => {
+  if (value === undefined || value === null)
+    return;
+  if (Array.isArray(value))
+    return value;
+  const text = String(value).trim();
+  if (!text)
+    return [];
+  if (text.startsWith("[")) {
+    try {
+      return JSON.parse(text);
+    } catch {
+      return [text];
+    }
+  }
+  return text.split(",").map((item) => item.trim()).filter(Boolean);
+}, exports_external.array(exports_external.string()).optional());
+var headersRecord = exports_external.preprocess((value) => {
+  if (value === undefined || value === null)
+    return;
+  if (typeof value === "object" && !Array.isArray(value))
+    return value;
+  const text = String(value).trim();
+  if (!text)
+    return;
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+      return parsed;
+  } catch {}
+  const out = {};
+  for (const part of text.split(",")) {
+    const idx = part.indexOf(":");
+    if (idx > 0)
+      out[part.slice(0, idx).trim()] = part.slice(idx + 1).trim();
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}, exports_external.record(exports_external.string(), exports_external.string()).optional());
+var ok2 = (res) => res.ok ? JSON.stringify(res.data, null, 2) : `❌ Failed (${res.status}): ${JSON.stringify(res.data)}`;
+var simple = (res, msg) => res.ok ? `✅ ${msg}` : `❌ Failed (${res.status}): ${JSON.stringify(res.data)}`;
+function registerGatewayTools(server, http, options = {}) {
+  const { projectRef } = options;
+  server.tool("gateway", `Gateway / Caddy 配置（通过 JSON Admin API 注入）。要求 admin 权限。
+Actions: routes, upsert_route, update_route, delete_route, config, get_certificate, update_certificate, issue_certificate, deploy_certificate, rebuild, custom_hostname, set_custom_hostname, delete_custom_hostname, verify_custom_hostname`, {
+    action: exports_external.enum([
+      "routes",
+      "upsert_route",
+      "update_route",
+      "delete_route",
+      "config",
+      "get_certificate",
+      "update_certificate",
+      "issue_certificate",
+      "deploy_certificate",
+      "rebuild",
+      "custom_hostname",
+      "set_custom_hostname",
+      "delete_custom_hostname",
+      "verify_custom_hostname"
+    ]).describe("Action"),
+    ref: exports_external.string().optional().describe(projectRef ? "可选：覆盖自动关联的项目 ref" : "项目 ref"),
+    route_id: exports_external.string().optional().describe("[upsert_route/update_route/delete_route] 路由 ID（字母/数字/_/-，1-64）"),
+    hosts: stringArray.describe("[upsert_route/update_route] 主机名列表，逗号分隔或 JSON 数组（1-20）"),
+    paths: stringArray.describe("[upsert_route/update_route] 路径列表，逗号分隔或 JSON 数组（1-20）"),
+    upstream: exports_external.string().optional().describe("[upsert_route/update_route] 反代上游 host:port 或 http(s)://host[:port]"),
+    upstream_tls_insecure_skip_verify: exports_external.boolean().optional().describe("[upsert_route/update_route] 上游 TLS 跳过校验"),
+    static_root: exports_external.string().optional().describe("[upsert_route/update_route] 静态站点根目录（与 upstream 二选一）"),
+    rewrite_uri: exports_external.string().optional().describe("[upsert_route/update_route] 重写 URI（以 / 开头）"),
+    strip_prefix: exports_external.string().optional().describe("[upsert_route/update_route] 去除前缀"),
+    headers: headersRecord.describe("[upsert_route/update_route] 自定义请求头，JSON 或 K:V,K2:V2"),
+    cors: stringArray.describe("[upsert_route/update_route] 额外 CORS 源，逗号分隔"),
+    priority: exports_external.number().optional().describe("[upsert_route/update_route] 路由优先级"),
+    enabled: exports_external.boolean().optional().describe("[upsert_route/update_route] 是否启用"),
+    rate_limit_tier: exports_external.enum(["free", "pro", "enterprise"]).optional().describe("[config] 限流档位"),
+    cors_origins: exports_external.string().optional().describe("[config] CORS 源（逗号分隔）"),
+    jwt_enabled: exports_external.boolean().optional().describe("[config] 是否启用 JWT"),
+    jwt_secret: exports_external.string().optional().describe("[config] JWT 密钥"),
+    cert_mode: exports_external.enum(["lego", "manual"]).optional().describe("[update_certificate] 证书模式"),
+    challenge: exports_external.enum(["dns-01", "http-01"]).optional().describe("[update_certificate/issue_certificate] ACME challenge"),
+    email: exports_external.string().optional().describe("[update_certificate/issue_certificate] ACME 邮箱"),
+    dns_provider: exports_external.string().optional().describe("[update_certificate/issue_certificate] DNS 提供商"),
+    dns_env: stringArray.describe("[update_certificate/issue_certificate] DNS 环境变量 KEY=VALUE 列表"),
+    domains: stringArray.describe("[update_certificate/issue_certificate/deploy_certificate] 域名列表"),
+    auto_renew: exports_external.boolean().optional().describe("[update_certificate/issue_certificate] 自动续期"),
+    renew: exports_external.boolean().optional().describe("[issue_certificate] 仅续期已有证书"),
+    cert: exports_external.string().optional().describe("[deploy_certificate] PEM 证书内容"),
+    key: exports_external.string().optional().describe("[deploy_certificate] PEM 私钥内容"),
+    clean: exports_external.boolean().optional().describe("[rebuild] 清理后全量重建"),
+    custom_hostname: exports_external.string().optional().describe("[set_custom_hostname] 自定义域名")
+  }, async (args) => {
+    const resolveRef4 = (override) => {
+      const ref2 = projectRef || override;
+      if (!ref2)
+        throw new Error("'ref' is required for this action");
+      return ref2;
+    };
+    const need = (field, value) => {
+      if (value === undefined || value === null || value === "")
+        throw new Error(`'${field}' is required for '${args.action}'`);
+    };
+    const {
+      action,
+      ref,
+      route_id,
+      hosts,
+      paths,
+      upstream,
+      upstream_tls_insecure_skip_verify,
+      static_root,
+      rewrite_uri,
+      strip_prefix,
+      headers,
+      cors,
+      priority,
+      enabled,
+      rate_limit_tier,
+      cors_origins,
+      jwt_enabled,
+      jwt_secret,
+      cert_mode,
+      challenge,
+      email: email3,
+      dns_provider,
+      dns_env,
+      domains,
+      auto_renew,
+      renew,
+      cert,
+      key,
+      clean,
+      custom_hostname
+    } = args;
+    const projectRefValue = resolveRef4(ref);
+    let text;
+    switch (action) {
+      case "routes":
+        text = ok2(await http.get(`/v1/projects/${projectRefValue}/gateway/routes`));
+        break;
+      case "upsert_route": {
+        need("route_id", route_id);
+        need("hosts", hosts);
+        need("paths", paths);
+        const body = {
+          id: route_id,
+          hosts,
+          path: paths.length === 1 ? paths[0] : paths
+        };
+        if (upstream !== undefined)
+          body.upstream = upstream;
+        if (upstream_tls_insecure_skip_verify !== undefined)
+          body.upstream_tls_insecure_skip_verify = upstream_tls_insecure_skip_verify;
+        if (static_root !== undefined)
+          body.static_root = static_root;
+        if (rewrite_uri !== undefined)
+          body.rewrite_uri = rewrite_uri;
+        if (strip_prefix !== undefined)
+          body.strip_prefix = strip_prefix;
+        if (headers !== undefined)
+          body.headers = headers;
+        if (cors !== undefined)
+          body.cors = cors;
+        if (priority !== undefined)
+          body.priority = priority;
+        if (enabled !== undefined)
+          body.enabled = enabled;
+        text = ok2(await http.post(`/v1/projects/${projectRefValue}/gateway/routes`, body));
+        break;
+      }
+      case "update_route": {
+        need("route_id", route_id);
+        need("hosts", hosts);
+        need("paths", paths);
+        const body = {
+          hosts,
+          path: paths.length === 1 ? paths[0] : paths
+        };
+        if (upstream !== undefined)
+          body.upstream = upstream;
+        if (upstream_tls_insecure_skip_verify !== undefined)
+          body.upstream_tls_insecure_skip_verify = upstream_tls_insecure_skip_verify;
+        if (static_root !== undefined)
+          body.static_root = static_root;
+        if (rewrite_uri !== undefined)
+          body.rewrite_uri = rewrite_uri;
+        if (strip_prefix !== undefined)
+          body.strip_prefix = strip_prefix;
+        if (headers !== undefined)
+          body.headers = headers;
+        if (cors !== undefined)
+          body.cors = cors;
+        if (priority !== undefined)
+          body.priority = priority;
+        if (enabled !== undefined)
+          body.enabled = enabled;
+        text = ok2(await http.put(`/v1/projects/${projectRefValue}/gateway/routes/${route_id}`, body));
+        break;
+      }
+      case "delete_route": {
+        need("route_id", route_id);
+        text = ok2(await http.delete(`/v1/projects/${projectRefValue}/gateway/routes/${route_id}`));
+        break;
+      }
+      case "config": {
+        const body = {};
+        if (rate_limit_tier !== undefined)
+          body.rate_limit_tier = rate_limit_tier;
+        if (cors_origins !== undefined)
+          body.cors_origins = cors_origins;
+        if (jwt_enabled !== undefined)
+          body.jwt_enabled = jwt_enabled;
+        if (jwt_secret !== undefined)
+          body.jwt_secret = jwt_secret;
+        if (Object.keys(body).length === 0)
+          throw new Error("At least one of rate_limit_tier, cors_origins, jwt_enabled, jwt_secret is required");
+        text = ok2(await http.post(`/v1/projects/${projectRefValue}/gateway/config`, body));
+        break;
+      }
+      case "get_certificate":
+        text = ok2(await http.get(`/v1/projects/${projectRefValue}/gateway/certificate`));
+        break;
+      case "update_certificate": {
+        const body = {};
+        if (cert_mode !== undefined)
+          body.mode = cert_mode;
+        if (challenge !== undefined)
+          body.challenge = challenge;
+        if (email3 !== undefined)
+          body.email = email3;
+        if (dns_provider !== undefined)
+          body.dns_provider = dns_provider;
+        if (dns_env !== undefined)
+          body.dns_env = dns_env;
+        if (domains !== undefined)
+          body.domains = domains;
+        if (auto_renew !== undefined)
+          body.auto_renew = auto_renew;
+        text = ok2(await http.put(`/v1/projects/${projectRefValue}/gateway/certificate`, body));
+        break;
+      }
+      case "issue_certificate": {
+        const body = {};
+        if (challenge !== undefined)
+          body.challenge = challenge;
+        if (email3 !== undefined)
+          body.email = email3;
+        if (dns_provider !== undefined)
+          body.dns_provider = dns_provider;
+        if (dns_env !== undefined)
+          body.dns_env = dns_env;
+        if (domains !== undefined)
+          body.domains = domains;
+        if (auto_renew !== undefined)
+          body.auto_renew = auto_renew;
+        if (renew !== undefined)
+          body.renew = renew;
+        text = ok2(await http.post(`/v1/projects/${projectRefValue}/gateway/certificate/issue`, body));
+        break;
+      }
+      case "deploy_certificate": {
+        need("cert", cert);
+        need("key", key);
+        const body = { cert, key };
+        if (domains !== undefined)
+          body.domains = domains;
+        text = ok2(await http.post(`/v1/projects/${projectRefValue}/gateway/certificate/deploy`, body));
+        break;
+      }
+      case "rebuild": {
+        const query = clean ? "?clean=true" : "";
+        text = ok2(await http.post(`/v1/projects/${projectRefValue}/gateway/rebuild-all${query}`));
+        break;
+      }
+      case "custom_hostname":
+        text = ok2(await http.get(`/v1/projects/${projectRefValue}/custom-hostname`));
+        break;
+      case "set_custom_hostname": {
+        need("custom_hostname", custom_hostname);
+        text = simple(await http.post(`/v1/projects/${projectRefValue}/custom-hostname`, { custom_hostname }), `Custom hostname ${custom_hostname} requested`);
+        break;
+      }
+      case "delete_custom_hostname":
+        text = simple(await http.delete(`/v1/projects/${projectRefValue}/custom-hostname`), "Custom hostname removed");
+        break;
+      case "verify_custom_hostname":
+        text = ok2(await http.post(`/v1/projects/${projectRefValue}/custom-hostname/verify`));
+        break;
+      default:
+        text = `❌ Unknown action: ${action}`;
+    }
+    return { content: [{ type: "text", text }] };
+  });
+}
+
 // src/index.ts
-var invokedCommand = path.basename(process.argv[1] || "supacloud-cli");
-var commandName = invokedCommand === "supacloud" ? "supacloud" : "supacloud-cli";
-var preferredCommand = "supacloud-cli";
+var commandName = "supacloud-cli";
+var preferredCommand = commandName;
 var projectActionSchema = exports_external.enum([
   "get",
   "health",
@@ -16663,8 +16953,6 @@ function printHelp(context = resolveSupaCloudContext()) {
 ║  Project CLI for SupaCloud users                         ║
 ╚═══════════════════════════════════════════════════════════╝
 
-${commandName === "supacloud" ? "NOTE\n\n  `supacloud` is kept as a compatibility alias. Prefer `supacloud-cli`\n  to avoid confusion with the server binary at /usr/local/bin/supacloud.\n" : ""}
-
 USAGE
 
   ${preferredCommand} <module> <action> [--flags]
@@ -16694,6 +16982,10 @@ EXAMPLES
   ${preferredCommand} database push_migrations --ref abc123 --dir supabase/migrations --dry_run
   ${preferredCommand} edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello
   ${preferredCommand} edge_functions config --ref abc123 --slug hello --verify_jwt false --background_routes "/queue/*,/render/*"
+  ${preferredCommand} gateway routes --ref abc123
+  ${preferredCommand} gateway upsert_route --ref abc123 --route_id webhook --hosts "api.example.com" --paths "/webhook/*" --upstream 10.0.0.5:8080
+  ${preferredCommand} gateway config --ref abc123 --rate_limit_tier pro
+  ${preferredCommand} gateway rebuild --ref abc123 --clean
 
 SEPARATE ADMIN CLI
 
@@ -16748,7 +17040,7 @@ function createCliTools() {
         ]
       })
     };
-    for (const name of ["database", "auth", "storage", "edge_functions", "secrets", "frontend", "queue", "task_events", "diagnostics"]) {
+    for (const name of ["database", "auth", "storage", "edge_functions", "secrets", "frontend", "queue", "task_events", "diagnostics", "gateway"]) {
       tools[name] = {
         schema: { action: genericActionSchema },
         callback: async () => ({
@@ -16811,6 +17103,9 @@ function createCliTools() {
   assign(captureTools((server) => registerStorageTools(server, http)));
   assign(captureTools((server) => registerAdvancedTools(server, http)));
   assign(captureTools((server) => registerFrontendTools(server, http)));
+  assign(captureTools((server) => registerGatewayTools(server, http, {
+    projectRef: context.projectRef || undefined
+  })));
   assign(captureTools((server) => registerQueueTools(server, http, {
     projectRef: context.projectRef || undefined
   })));

package/package.json

@@ -1,12 +1,11 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.6.2",
+  "version": "0.8.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
   "bin": {
-    "supacloud-cli": "dist/index.js",
-    "supacloud": "dist/index.js"
+    "supacloud-cli": "dist/index.js"
   },
   "files": [
     "dist",