@supacloud/cli 0.64.4 → 0.65.1

package/dist/index.js

@@ -206650,7 +206650,7 @@ function resolveSupaCloudContext(env = process.env, cwd = process.cwd(), selecti
 var ACTION_POLICY = {
   deploy: { write: ["deploy"] },
   applications: {
-    read: ["list_releases", "get_release", "get_runtime", "get_configuration"],
+    read: ["list_releases", "get_release", "get_runtime", "get_deployment_evidence", "get_configuration"],
     write: ["upload_release", "put_configuration", "activate_release", "reconcile_activation", "retire_activation"]
   },
   project: {
@@ -213741,6 +213741,131 @@ var ApplicationActivationRetirementResultSchema = _Object_2({
   activation_id: ApplicationActivationIdSchema,
   retired_at: String3()
 }, { additionalProperties: false });
+// node_modules/@supacloud/delivery/src/deployment-evidence.ts
+var closed3 = { additionalProperties: false };
+var sha256 = String3({ pattern: "^[a-f0-9]{64}$" });
+var isoDate = String3({ minLength: 20, maxLength: 40 });
+var status = Union3([
+  Literal2("confirmed"),
+  Literal2("failed"),
+  Literal2("unknown")
+]);
+var evidenceStatus = Union3([
+  Literal2("confirmed"),
+  Literal2("failed"),
+  Literal2("unknown"),
+  Literal2("incomplete")
+]);
+var DEPLOYMENT_EVIDENCE_SCHEMA = "supacloud.deployment-evidence.v1";
+var DatabaseProviderSchema = _Object_2({
+  provider: String3({ minLength: 1, maxLength: 64, pattern: "^[a-z][a-z0-9_.-]*$" }),
+  version: String3({ minLength: 1, maxLength: 64 }),
+  topology: Union3([Literal2("single-node"), Literal2("distributed")]),
+  migration: _Object_2({
+    status,
+    inventory_sha256: Union3([sha256, Null2()]),
+    compatibility: Union3([
+      Literal2("verified"),
+      Literal2("not-proven"),
+      Literal2("failed")
+    ])
+  }, closed3),
+  backup: _Object_2({
+    status,
+    latest_success_at: Union3([isoDate, Null2()]),
+    freshness_seconds: Union3([Integer2({ minimum: 0 }), Null2()])
+  }, closed3),
+  recovery: _Object_2({
+    status,
+    drill_id: Union3([String3({ minLength: 1, maxLength: 128 }), Null2()]),
+    rpo_seconds: Union3([Integer2({ minimum: 0 }), Null2()]),
+    rto_seconds: Union3([Integer2({ minimum: 0 }), Null2()])
+  }, closed3)
+}, closed3);
+var componentName = Union3([
+  Literal2("management-api"),
+  Literal2("web-console"),
+  Literal2("edge-runtime"),
+  Literal2("worker"),
+  Literal2("postgres"),
+  Literal2("postgrest"),
+  Literal2("gotrue"),
+  Literal2("storage"),
+  Literal2("realtime")
+]);
+var DeploymentComponentEvidenceSchema = _Object_2({
+  name: componentName,
+  version: Union3([String3({ minLength: 1, maxLength: 128 }), Null2()]),
+  status,
+  health_check: Union3([String3({ minLength: 1, maxLength: 256 }), Null2()]),
+  checked_at: Union3([isoDate, Null2()])
+}, closed3);
+var DeploymentEvidenceSchema = _Object_2({
+  schema: Literal2(DEPLOYMENT_EVIDENCE_SCHEMA),
+  status: evidenceStatus,
+  recorded_at: isoDate,
+  scope: _Object_2({
+    project_ref: String3({ pattern: "^[a-z0-9-]{1,20}$" }),
+    application_id: ApplicationIdSchema,
+    environment_id: ApplicationIdSchema
+  }, closed3),
+  source: _Object_2({
+    commit_sha: Union3([String3({ pattern: "^[0-9a-f]{7,64}$" }), Null2()]),
+    manifest_sha256: sha256,
+    contract_schema: Union3([String3({ minLength: 1, maxLength: 128 }), Null2()]),
+    environment_binding_version: Union3([sha256, Null2()])
+  }, closed3),
+  database: DatabaseProviderSchema,
+  components: _Array_(DeploymentComponentEvidenceSchema, { minItems: 1, maxItems: 32 }),
+  activation: _Object_2({
+    release_id: ApplicationReleaseIdSchema,
+    configuration_id: ApplicationConfigurationIdSchema,
+    activation_id: ApplicationConfigurationIdSchema
+  }, closed3),
+  health: _Object_2({
+    status,
+    checked_at: Union3([isoDate, Null2()]),
+    authenticated_smoke: status
+  }, closed3),
+  rollback: _Object_2({
+    release_id: Union3([ApplicationReleaseIdSchema, Null2()]),
+    configuration_id: Union3([ApplicationConfigurationIdSchema, Null2()]),
+    status: Union3([Literal2("ready"), Literal2("not-ready"), Literal2("unknown")]),
+    result: Union3([status, Null2()])
+  }, closed3),
+  notes: _Array_(String3({ minLength: 1, maxLength: 512 }), { maxItems: 32 })
+}, closed3);
+function isIsoDate(value) {
+  return Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
+}
+function statusValues(evidence) {
+  return [
+    evidence.database.migration.status,
+    evidence.database.backup.status,
+    evidence.database.recovery.status,
+    ...evidence.components.map((component) => component.status),
+    evidence.health.status,
+    evidence.health.authenticated_smoke,
+    ...evidence.rollback.result === null ? [] : [evidence.rollback.result]
+  ];
+}
+function deriveDeploymentEvidenceStatus(evidence) {
+  const values = statusValues({ ...evidence, status: "incomplete" });
+  if (values.includes("failed"))
+    return "failed";
+  if (values.includes("unknown"))
+    return "unknown";
+  if (evidence.database.migration.compatibility !== "verified" || evidence.rollback.status !== "ready" || evidence.components.some((component) => component.health_check === null || component.checked_at === null) || evidence.health.checked_at === null || evidence.health.authenticated_smoke !== "confirmed" || evidence.database.recovery.status !== "confirmed" || evidence.database.recovery.drill_id === null || evidence.database.recovery.rpo_seconds === null || evidence.database.recovery.rto_seconds === null) {
+    return "incomplete";
+  }
+  return "confirmed";
+}
+function parseDeploymentEvidence(value) {
+  if (!Check3(DeploymentEvidenceSchema, value) || !isIsoDate(value.recorded_at) || value.health.checked_at !== null && !isIsoDate(value.health.checked_at) || value.database.backup.latest_success_at !== null && !isIsoDate(value.database.backup.latest_success_at) || value.components.some((component) => component.checked_at !== null && !isIsoDate(component.checked_at)) || new Set(value.components.map((component) => component.name)).size !== value.components.length || deriveDeploymentEvidenceStatus(value) !== value.status) {
+    throw new Error("Invalid deployment evidence.");
+  }
+  return structuredClone(value);
+}
 // node_modules/@supacloud/delivery/src/application-runtime-identity.ts
 var ApplicationRuntimeIdentitySchema = _Object_2({
   schema: Literal2("supacloud.application-runtime.v1"),
@@ -219174,6 +219299,7 @@ var APPLICATION_TOOL_SCHEMA = {
     "get_release",
     "upload_release",
     "get_runtime",
+    "get_deployment_evidence",
     "get_configuration",
     "put_configuration",
     "activate_release",
@@ -219347,6 +219473,30 @@ function registerApplicationTools(server2, http) {
         return releaseControlFailure(operation, "INVALID_RESPONSE", result.status);
       }
     }
+    if (action === "get_deployment_evidence") {
+      const environmentId = text(args, "environment_id");
+      if (!Check(ApplicationIdSchema2, environmentId))
+        throw new Error("Invalid environment ID");
+      const result = await http.get(`/v1/projects/${project}/applications/${encodeURIComponent(id)}/environments/${encodeURIComponent(environmentId)}/deployment-evidence`, { maxJsonBytes: 262144, responseTimeoutMs: 30000 });
+      if (!result.ok)
+        return releaseControlFailure(operation, "HTTP_ERROR", result.status);
+      try {
+        const data = result.data;
+        if (!data || typeof data !== "object" || !("project_ref" in data) || data.project_ref !== ref || !("application_id" in data) || data.application_id !== id || !("environment_id" in data) || data.environment_id !== environmentId || !("evidence" in data))
+          throw new Error;
+        const evidence = data.evidence === null ? null : parseDeploymentEvidence(data.evidence);
+        if (evidence && (evidence.scope.project_ref !== ref || evidence.scope.application_id !== id || evidence.scope.environment_id !== environmentId))
+          throw new Error;
+        return releaseControlSuccess(operation, {
+          project_ref: ref,
+          application_id: id,
+          environment_id: environmentId,
+          evidence
+        });
+      } catch {
+        return releaseControlFailure(operation, "INVALID_RESPONSE", result.status);
+      }
+    }
     if (action === "list_releases") {
       const limit = args.limit ?? 50;
       if (typeof limit !== "number" || !Number.isInteger(limit) || limit < 1 || limit > 100 || args.cursor !== undefined && !Check(ApplicationReleaseIdSchema2, args.cursor)) {
@@ -229212,6 +229362,8 @@ function renderClient(graph, options) {
   const schemaLocals = new Map;
   const usedTypeNames = new Set;
   const allRoutes = [];
+  const allProcedures = [];
+  const commandByClassName = new Map(graph.modules.flatMap((module) => module.commands.map((command) => [command.className, command])));
   let usesStatic = false;
   let usesValue = false;
   const uniqueTypeName = (candidate) => {
@@ -229342,8 +229494,30 @@ function renderClient(graph, options) {
         const responseSchemaEntries = hasResponseMap ? Object.entries(responseSchemas).map(([status, ref]) => [status, ref.local]) : responseSchema ? [["200", responseSchema.local]] : [];
         const responseSchemaArgument = responseSchemaEntries.length > 0 ? `{ ${responseSchemaEntries.map(([status, local]) => `${JSON.stringify(status)}: ${local}`).join(", ")} }` : "undefined";
         const responseKindArgument = responseKind === undefined ? "undefined" : JSON.stringify(responseKind);
+        const command = route.command === undefined ? undefined : commandByClassName.get(route.command);
+        const procedureKind = route.method === "GET" || route.method === "HEAD" ? "query" : "mutation";
+        const idempotencyMode = command?.idempotency ?? "none";
+        const procedureMetadata = {
+          key: `${controller.className}.${route.handler}`,
+          method: route.method,
+          path: fullPath,
+          controller: controller.className,
+          handler: route.handler,
+          kind: procedureKind,
+          idempotency: idempotencyMode
+        };
+        allProcedures.push({
+          method: route.method,
+          path: fullPath,
+          controller: controller.className,
+          handler: route.handler,
+          kind: procedureKind,
+          ...command?.name === undefined ? {} : { command: command.name },
+          ...command?.permission === undefined ? {} : { permission: command.permission },
+          idempotency: idempotencyMode
+        });
         routeMethods.push(`
-    ${route.handler}: makeRoute<${requestTypeName}, ${responseType === "never" ? "never" : responseTypeName}>(${JSON.stringify(route.method)}, ${JSON.stringify(fullPath)}, ${responseSchemaArgument}, ${responseKindArgument}, ${route.parse === "none"}),`);
+    ${route.handler}: makeRoute<${requestTypeName}, ${responseType === "never" ? "never" : responseTypeName}, ${JSON.stringify(procedureKind)}, ${JSON.stringify(idempotencyMode)}>(${JSON.stringify(route.method)}, ${JSON.stringify(fullPath)}, ${responseSchemaArgument}, ${responseKindArgument}, ${route.parse === "none"}, ${JSON.stringify(procedureKind)}, ${JSON.stringify(idempotencyMode)}, ${JSON.stringify(procedureMetadata)}),`);
       }
       controllerEntries.push(`
   ${controllerKey}: {${routeMethods.join("")}
@@ -229374,6 +229548,66 @@ function renderClient(graph, options) {
     "",
     "export type ResponseDecoder<T> = (value: unknown) => T;",
     "",
+    'export type ProcedureKind = "query" | "mutation";',
+    'export type IdempotencyMode = "required" | "none";',
+    "",
+    "export interface ProcedureMetadata<",
+    "  Kind extends ProcedureKind = ProcedureKind,",
+    "  Idempotency extends IdempotencyMode = IdempotencyMode,",
+    "> {",
+    "  key: string;",
+    "  method: string;",
+    "  path: string;",
+    "  controller: string;",
+    "  handler: string;",
+    "  kind: Kind;",
+    "  idempotency: Idempotency;",
+    "}",
+    "",
+    "export interface ProcedureExecutionOptions {",
+    "  /** Reuse the same key when retrying an uncertain mutation. */",
+    "  idempotencyKey?: string;",
+    "  signal?: AbortSignal;",
+    "}",
+    "",
+    "export type RequiredProcedureExecutionOptions = ProcedureExecutionOptions & { idempotencyKey: string };",
+    "",
+    "type ProcedureResult<Result> = [Result] extends [never] ? unknown : Result;",
+    "",
+    "type ProcedureArgs<Options extends ClientRequestOptions, Idempotency extends IdempotencyMode> =",
+    '  Idempotency extends "required"',
+    "    ? {} extends Options",
+    "      ? [execution: RequiredProcedureExecutionOptions] | [input: Options, execution: RequiredProcedureExecutionOptions]",
+    "      : [input: Options, execution: RequiredProcedureExecutionOptions]",
+    "    : {} extends Options",
+    "      ? [input?: Options, execution?: ProcedureExecutionOptions]",
+    "      : [input: Options, execution?: ProcedureExecutionOptions];",
+    "",
+    "export type ProcedureCall<",
+    "  Options extends ClientRequestOptions = ClientRequestOptions,",
+    "  Result = never,",
+    '  Idempotency extends IdempotencyMode = "none",',
+    "> = (...args: ProcedureArgs<Options, Idempotency>) => Promise<ProcedureResult<Result>>;",
+    "",
+    "export type QueryableProcedure<",
+    "  Options extends ClientRequestOptions,",
+    "  Result,",
+    "  Idempotency extends IdempotencyMode,",
+    "  Kind extends ProcedureKind,",
+    "> = ProcedureCall<Options, Result, Idempotency> & {",
+    "  readonly __supacloudProcedure: ProcedureMetadata<Kind, Idempotency>;",
+    "  readonly __supacloudInput?: Options;",
+    "};",
+    "",
+    "export type ProcedureMember<",
+    "  Options extends ClientRequestOptions,",
+    "  Result,",
+    "  Kind extends ProcedureKind,",
+    "  Idempotency extends IdempotencyMode,",
+    '> = Kind extends "query"',
+    '  ? { query: QueryableProcedure<Options, Result, Idempotency, "query"> }',
+    '  : { mutate: QueryableProcedure<Options, Result, Idempotency, "mutation"> };',
+    "",
     'export type ApiClientErrorCode = "API_HTTP_ERROR" | "API_RESPONSE_INVALID" | "API_RESPONSE_UNDECLARED";',
     "",
     "export interface ApiClientErrorDetails {",
@@ -229417,6 +229651,17 @@ function renderClient(graph, options) {
     "    : { (options: Options): Promise<Result>; <T>(options: Options, decode: ResponseDecoder<T>): Promise<T> }",
     ") & ((...args: {} extends Options ? [options?: Options] : [options: Options]) => Promise<[Result] extends [never] ? unknown : Result>);",
     "",
+    "export interface ApiProcedureDefinition {",
+    "  method: string;",
+    "  path: string;",
+    "  controller: string;",
+    "  handler: string;",
+    "  kind: ProcedureKind;",
+    "  command?: string;",
+    "  permission?: string;",
+    "  idempotency: IdempotencyMode;",
+    "}",
+    "",
     ...routeTypes,
     ...routeTypes.length > 0 ? [""] : [],
     "export interface HttpInterceptorRequest {",
@@ -229424,6 +229669,7 @@ function renderClient(graph, options) {
     "  url: string;",
     "  headers: Record<string, string>;",
     "  body?: unknown;",
+    "  signal?: AbortSignal;",
     "}",
     "",
     "export type HttpInterceptorFn = (",
@@ -229442,6 +229688,8 @@ function renderClient(graph, options) {
     "",
     "export const API_ROUTES = " + JSON.stringify(allRoutes, null, 2) + " as const;",
     "",
+    "export const API_PROCEDURES: readonly ApiProcedureDefinition[] = " + JSON.stringify(allProcedures, null, 2) + ";",
+    "",
     "export type AppRoutePath = typeof API_ROUTES[number]['path'];",
     "",
     "export const API_SCHEMAS = [",
@@ -229667,6 +229915,7 @@ function renderClient(graph, options) {
     `    responseSchemas?: Readonly<Record<string, ${responseSchemaType}>>,`,
     "    responseKind?: string,",
     "    raw?: boolean,",
+    "    execution?: ProcedureExecutionOptions,",
     "  ): Promise<T>;",
     "  async function request<T>(",
     "    method: string,",
@@ -229676,6 +229925,7 @@ function renderClient(graph, options) {
     `    responseSchemas?: Readonly<Record<string, ${responseSchemaType}>>,`,
     "    responseKind?: string,",
     "    raw?: boolean,",
+    "    execution?: ProcedureExecutionOptions,",
     "  ): Promise<T | unknown>;",
     "  async function request(",
     "    method: string,",
@@ -229690,6 +229940,7 @@ function renderClient(graph, options) {
     `    responseSchemas?: Readonly<Record<string, ${responseSchemaType}>>,`,
     "    responseKind?: string,",
     "    raw = false,",
+    "    execution?: ProcedureExecutionOptions,",
     "  ): Promise<T | unknown> {",
     "    const url = `${baseUrl}${buildRouteUrl(path, options.params, options.query)}`;",
     '    const customHeaders = typeof config.headers === "function" ? await config.headers() : config.headers;',
@@ -229715,9 +229966,10 @@ function renderClient(graph, options) {
     "        headers: reqPayload.headers,",
     "        ...(reqPayload.body === undefined ? {} : { body: raw ? rawBody(reqPayload.body) : JSON.stringify(reqPayload.body) }),",
     '        ...(raw && reqPayload.body instanceof ReadableStream ? { duplex: "half" } : {}),',
+    "        ...(reqPayload.signal === undefined ? {} : { signal: reqPayload.signal }),",
     "      });",
     "    };",
-    "    const response = await executeChain(0, { method, url, headers, body: options.body });",
+    "    const response = await executeChain(0, { method, url, headers, body: options.body, ...(execution?.signal === undefined ? {} : { signal: execution.signal }) });",
     "    const declaredSchema = responseSchemas ? selectResponseSchema(response.status, responseSchemas) : undefined;",
     "    const failure = (code: ApiClientErrorCode, message: string) => new ApiClientError(message, {",
     '      code, method, path, status: response.status, requestId: response.headers.get("x-request-id"),',
@@ -229755,7 +230007,44 @@ function renderClient(graph, options) {
     "    return decode ? decode(checked) : checked;",
     "  }",
     "",
-    `  function makeRoute<Options extends ClientRequestOptions, Result = never>(method: string, path: string, responseSchemas?: Readonly<Record<string, ${responseSchemaType}>>, responseKind?: string, raw = false): RouteMethod<Options, Result> {`,
+    "  function hasHeader(headers: Record<string, string>, name: string): boolean {",
+    "    return Object.keys(headers).some((key) => key.toLowerCase() === name.toLowerCase());",
+    "  }",
+    "",
+    "  function withProcedureExecution(",
+    "    options: ClientRequestOptions,",
+    "    execution: ProcedureExecutionOptions | undefined,",
+    "    idempotency: IdempotencyMode,",
+    "  ): ClientRequestOptions {",
+    "    const headers = { ...(options.headers as Record<string, string> | undefined) };",
+    "    if (execution?.idempotencyKey !== undefined) {",
+    "      if (!/^[A-Za-z0-9._:-]{1,512}$/.test(execution.idempotencyKey)) {",
+    '        throw new TypeError("idempotencyKey must contain only safe header characters and be at most 512 characters");',
+    "      }",
+    '      headers["idempotency-key"] = execution.idempotencyKey;',
+    "    }",
+    '    if (idempotency === "required" && !hasHeader(headers, "idempotency-key")) {',
+    '      throw new TypeError("This mutation requires an idempotencyKey");',
+    "    }",
+    "    return Object.keys(headers).length === 0 ? options : { ...options, headers };",
+    "  }",
+    "",
+    "  function isProcedureExecution(value: unknown): value is ProcedureExecutionOptions {",
+    '    if (value === null || typeof value !== "object" || Array.isArray(value)) return false;',
+    '    return Object.hasOwn(value, "idempotencyKey") || Object.hasOwn(value, "signal");',
+    "  }",
+    "",
+    `  function makeProcedure<Options extends ClientRequestOptions, Result = never, Idempotency extends IdempotencyMode = "none", Kind extends ProcedureKind = ProcedureKind>(metadata: ProcedureMetadata<Kind, Idempotency>, responseSchemas?: Readonly<Record<string, ${responseSchemaType}>>, responseKind?: string, raw = false): QueryableProcedure<Options, Result, Idempotency, Kind> {`,
+    "    const procedure = async (first?: Options | ProcedureExecutionOptions, second?: ProcedureExecutionOptions): Promise<unknown> => {",
+    "      const execution = second ?? (isProcedureExecution(first) ? first : undefined);",
+    "      const input = (execution === first ? undefined : first) ?? {};",
+    "      const requestOptions = withProcedureExecution(input as ClientRequestOptions, execution, metadata.idempotency);",
+    "      return request(metadata.method, metadata.path, requestOptions, undefined, responseSchemas, responseKind, raw, execution);",
+    "    };",
+    "    return Object.assign(procedure, { __supacloudProcedure: Object.freeze(metadata) }) as QueryableProcedure<Options, Result, Idempotency, Kind>;",
+    "  }",
+    "",
+    `  function makeRoute<Options extends ClientRequestOptions, Result = never, Kind extends ProcedureKind = never, Idempotency extends IdempotencyMode = "none">(method: string, path: string, responseSchemas?: Readonly<Record<string, ${responseSchemaType}>>, responseKind?: string, raw = false, kind?: Kind, idempotency: Idempotency = "none" as Idempotency, metadata?: ProcedureMetadata<Kind, Idempotency>): RouteMethod<Options, Result> & ProcedureMember<Options, Result, Kind, Idempotency> {`,
     "    function route<T>(options: Options, decode: ResponseDecoder<T>): Promise<T>;",
     "    function route(options: Options): Promise<Result>;",
     "    function route(options?: Options): Promise<unknown>;",
@@ -229763,13 +230052,16 @@ function renderClient(graph, options) {
     "      const requestOptions = options ?? {};",
     "      return request(method, path, requestOptions, decode, responseSchemas, responseKind, raw);",
     "    }",
-    "    return route as RouteMethod<Options, Result>;",
+    '    if (kind === "query" && metadata) Object.assign(route, { query: makeProcedure<Options, Result, Idempotency, "query">(metadata as ProcedureMetadata<"query", Idempotency>, responseSchemas, responseKind, raw) });',
+    '    if (kind === "mutation" && metadata) Object.assign(route, { mutate: makeProcedure<Options, Result, Idempotency, "mutation">(metadata as ProcedureMetadata<"mutation", Idempotency>, responseSchemas, responseKind, raw) });',
+    "    return route as RouteMethod<Options, Result> & ProcedureMember<Options, Result, Kind, Idempotency>;",
     "  }",
     "",
     "  return {",
     "    request,",
     "    buildRouteUrl,",
     "    routes: API_ROUTES,",
+    "    procedures: API_PROCEDURES,",
     ...controllerEntries,
     "  };",
     "}",
@@ -239949,14 +240241,14 @@ function validateWorkerExecution2(groups) {
     routes.add(route);
   }
 }
-var closed3;
+var closed4;
 var positive2 = (maximum) => Integer4({ minimum: 1, maximum });
 var WorkerExecutionGroupSchema2;
 var WorkerExecutionSchema2;
 var init_worker_execution = __esm2(() => {
   init_build();
   init_value2();
-  closed3 = { additionalProperties: false };
+  closed4 = { additionalProperties: false };
   WorkerExecutionGroupSchema2 = _Object_3({
     name: String22({ pattern: "^[a-z][a-z0-9-]{0,47}$" }),
     target: String22({ pattern: "^[a-z][a-z0-9-]{0,53}$" }),
@@ -239972,22 +240264,22 @@ var init_worker_execution = __esm2(() => {
     resources: _Object_3({
       cpuLimit: Number22({ minimum: 0.1, maximum: 64, multipleOf: 0.1 }),
       memoryLimitMiB: Integer4({ minimum: 64, maximum: 262144 })
-    }, closed3),
+    }, closed4),
     database: _Object_3({
       engineConnectionsPerReplica: positive2(16),
       handlerConnectionsPerReplica: positive2(16)
-    }, closed3),
+    }, closed4),
     lifecycle: _Object_3({
       executionTimeoutSeconds: positive2(3500),
       visibilityTimeoutSeconds: Integer4({ minimum: 15, maximum: 3600 }),
       shutdownGraceSeconds: positive2(300)
-    }, closed3),
-    retry: _Object_3({ maxAttempts: Integer4({ minimum: 1, maximum: 10 }) }, closed3),
-    admission: _Object_3({ maxOutstandingOperations: positive2(1e6) }, closed3)
-  }, closed3);
+    }, closed4),
+    retry: _Object_3({ maxAttempts: Integer4({ minimum: 1, maximum: 10 }) }, closed4),
+    admission: _Object_3({ maxOutstandingOperations: positive2(1e6) }, closed4)
+  }, closed4);
   WorkerExecutionSchema2 = _Object_3({
     groups: _Array_2(WorkerExecutionGroupSchema2, { minItems: 1, maxItems: 32 })
-  }, closed3);
+  }, closed4);
 });
 function parseDeliveryOptions(value) {
   if (value === undefined)
@@ -240321,6 +240613,9 @@ function parseDeliveryBuildManifest2(value) {
   if (!Check22(DeliveryBuildManifestSchema2, value))
     throw new Error("Invalid delivery build manifest.");
   validateWorkerExecution2(value.plan.targets.flatMap((target) => target.execution ? [target.execution] : []));
+  if (value.plan.targets.reduce((count, target) => count + (target.execution?.replicas ?? 1), 0) > 32) {
+    throw new Error("Invalid delivery replica count.");
+  }
   for (const target of value.plan.targets) {
     if (target.execution && (target.kind !== "jobs" || target.isolation !== "process" || target.execution.target !== target.name || target.jobs.length !== 1 || target.jobs[0]?.name !== target.execution.taskKey || value.objects.find((object) => object.name === target.name)?.entryKind !== "bun-worker-application")) {
       throw new Error("Invalid delivery execution binding.");
@@ -240334,7 +240629,7 @@ function parseDeliveryBuildManifest2(value) {
   }
   for (const object of value.objects) {
     const target = value.plan.targets.find((target) => target.name === object.name);
-    if (object.entryKind === "bun-worker-application" && target?.kind !== "jobs" || object.entryKind === "bun-http-application" && target?.kind === "jobs") {
+    if (["bun-worker-application", "go-worker-application", "scriptc-worker-application"].includes(object.entryKind) && target?.kind !== "jobs" || object.entryKind === "bun-http-application" && target?.kind === "jobs") {
       throw new Error("Delivery executable kind does not match its target.");
     }
     if (new Set(object.files.map((file) => file.path)).size !== object.files.length || !object.files.some((file) => file.path === object.entrypoint) || deliveryObjectDigest2(object) !== object.objectId) {
@@ -240377,7 +240672,9 @@ var init_delivery_build_schema = __esm2(() => {
     entryKind: Union4([
       Literal3("compiled-module-factory"),
       Literal3("bun-http-application"),
-      Literal3("bun-worker-application")
+      Literal3("bun-worker-application"),
+      Literal3("go-worker-application"),
+      Literal3("scriptc-worker-application")
     ]),
     runtimeImports: _Array_2(String22()),
     files: _Array_2(_Object_3({
@@ -240865,7 +241162,7 @@ var APPLICATION_DEVELOPMENT_SCHEMA = "supacloud.application-development.v1";
 var APPLICATION_DEVELOPMENT_ARCHIVE_MAX_BYTES = 524288;
 var APPLICATION_DEVELOPMENT_LIMITS;
 var DevelopmentContractError;
-var closed4;
+var closed42;
 var text22;
 var texts;
 var count;
@@ -240898,13 +241195,13 @@ var init_application_development = __esm2(() => {
       this.name = "DevelopmentContractError";
     }
   };
-  closed4 = { additionalProperties: false };
+  closed42 = { additionalProperties: false };
   text22 = String22({ minLength: 1, maxLength: 512, pattern: "^[^\\u0000-\\u001f\\u007f]+$" });
   texts = _Array_2(text22);
   count = Integer4({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER });
   mode = Union4([Literal3("required"), Literal3("none")]);
   operations2 = _Array_2(Union4([Literal3("read"), Literal3("write"), Literal3("publish"), Literal3("consume")]));
-  resourceUse = _Object_3({ resource: text22, operations: operations2 }, closed4);
+  resourceUse = _Object_3({ resource: text22, operations: operations2 }, closed42);
   schemaKind = Optional4(Union4([Literal3("opaque"), Literal3("declared")]));
   stage = Union4([
     Union4([Literal3("commandExecutor"), Literal3("jobExecutor"), Literal3("authorize"), Literal3("idempotency"), Literal3("transaction"), Literal3("handler"), Literal3("audit")]),
@@ -240929,7 +241226,7 @@ var init_application_development = __esm2(() => {
       jobs: texts,
       queries: texts,
       resources: texts
-    }, closed4), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.modules }),
+    }, closed42), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.modules }),
     routes: _Array_2(_Object_3({
       module: text22,
       method: Union4([Literal3("GET"), Literal3("POST"), Literal3("PUT"), Literal3("PATCH"), Literal3("DELETE"), Literal3("HEAD"), Literal3("OPTIONS")]),
@@ -240945,8 +241242,8 @@ var init_application_development = __esm2(() => {
         headers: schemaKind,
         cookie: schemaKind,
         response: schemaKind
-      }, closed4))
-    }, closed4), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.routes }),
+      }, closed42))
+    }, closed42), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.routes }),
     commands: _Array_2(_Object_3({
       module: text22,
       name: text22,
@@ -240955,28 +241252,28 @@ var init_application_development = __esm2(() => {
       idempotency: mode,
       audit: Optional4(text22),
       resources: _Array_2(resourceUse)
-    }, closed4), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.commands }),
+    }, closed42), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.commands }),
     jobs: _Array_2(_Object_3({
       module: text22,
       name: text22,
       mode: Optional4(Union4([Literal3("task"), Literal3("workflow")])),
       resources: _Array_2(resourceUse)
-    }, closed4), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.jobs }),
-    resources: _Array_2(_Object_3({ name: text22, kind: Union4([Literal3("database"), Literal3("bucket"), Literal3("queue"), Literal3("config"), Literal3("secret")]) }, closed4), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.resources }),
+    }, closed42), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.jobs }),
+    resources: _Array_2(_Object_3({ name: text22, kind: Union4([Literal3("database"), Literal3("bucket"), Literal3("queue"), Literal3("config"), Literal3("secret")]) }, closed42), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.resources }),
     resourceUses: _Array_2(_Object_3({
       module: text22,
       owner: text22,
       ownerKind: Union4([Literal3("command"), Literal3("job")]),
       resource: text22,
       operations: operations2
-    }, closed4), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.resourceUses }),
+    }, closed42), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.resourceUses }),
     executionPlans: _Array_2(_Object_3({
       module: text22,
       kind: Union4([Literal3("route"), Literal3("command"), Literal3("job")]),
       name: text22,
       command: Optional4(text22),
       stages: _Array_2(stage)
-    }, closed4), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.plans }),
+    }, closed42), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.plans }),
     diagnostics: _Array_2(_Object_3({
       code: text22,
       severity: Union4([Literal3("error"), Literal3("warn")]),
@@ -240985,8 +241282,8 @@ var init_application_development = __esm2(() => {
       repair: Optional4(_Object_3({
         type: Union4([Literal3("set_command_mode"), Literal3("add_module_import"), Literal3("add_provider"), Literal3("mark_optional_dependency"), Literal3("change_provider_scope"), Literal3("add_command_permission"), Literal3("add_route_parameter_binding"), Literal3("remove_route_body_binding")]),
         readiness: Union4([Literal3("preview"), Literal3("input-required"), Literal3("manual")])
-      }, closed4))
-    }, closed4), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.diagnostics }),
+      }, closed42))
+    }, closed42), { maxItems: APPLICATION_DEVELOPMENT_LIMITS.diagnostics }),
     omitted: _Object_3({
       modules: count,
       providers: count,
@@ -240997,7 +241294,7 @@ var init_application_development = __esm2(() => {
       resourceUses: count,
       plans: count,
       diagnostics: count
-    }, closed4),
+    }, closed42),
     limits: _Object_3({
       outputBytes: Literal3(APPLICATION_DEVELOPMENT_LIMITS.outputBytes),
       modules: Literal3(APPLICATION_DEVELOPMENT_LIMITS.modules),
@@ -241009,8 +241306,8 @@ var init_application_development = __esm2(() => {
       resourceUses: Literal3(APPLICATION_DEVELOPMENT_LIMITS.resourceUses),
       plans: Literal3(APPLICATION_DEVELOPMENT_LIMITS.plans),
       diagnostics: Literal3(APPLICATION_DEVELOPMENT_LIMITS.diagnostics)
-    }, closed4)
-  }, closed4);
+    }, closed42)
+  }, closed42);
 });
 function parseApplicationDevelopmentContext(input) {
   try {
@@ -241312,6 +241609,114 @@ var init_application_activation = __esm2(() => {
     retired_at: String22()
   }, { additionalProperties: false });
 });
+var closed6;
+var sha2562;
+var isoDate2;
+var status2;
+var evidenceStatus2;
+var DEPLOYMENT_EVIDENCE_SCHEMA2 = "supacloud.deployment-evidence.v1";
+var DatabaseProviderSchema2;
+var componentName2;
+var DeploymentComponentEvidenceSchema2;
+var DeploymentEvidenceSchema2;
+var init_deployment_evidence = __esm2(() => {
+  init_build();
+  init_value2();
+  init_application_configuration();
+  init_application_release();
+  closed6 = { additionalProperties: false };
+  sha2562 = String22({ pattern: "^[a-f0-9]{64}$" });
+  isoDate2 = String22({ minLength: 20, maxLength: 40 });
+  status2 = Union4([
+    Literal3("confirmed"),
+    Literal3("failed"),
+    Literal3("unknown")
+  ]);
+  evidenceStatus2 = Union4([
+    Literal3("confirmed"),
+    Literal3("failed"),
+    Literal3("unknown"),
+    Literal3("incomplete")
+  ]);
+  DatabaseProviderSchema2 = _Object_3({
+    provider: String22({ minLength: 1, maxLength: 64, pattern: "^[a-z][a-z0-9_.-]*$" }),
+    version: String22({ minLength: 1, maxLength: 64 }),
+    topology: Union4([Literal3("single-node"), Literal3("distributed")]),
+    migration: _Object_3({
+      status: status2,
+      inventory_sha256: Union4([sha2562, Null3()]),
+      compatibility: Union4([
+        Literal3("verified"),
+        Literal3("not-proven"),
+        Literal3("failed")
+      ])
+    }, closed6),
+    backup: _Object_3({
+      status: status2,
+      latest_success_at: Union4([isoDate2, Null3()]),
+      freshness_seconds: Union4([Integer4({ minimum: 0 }), Null3()])
+    }, closed6),
+    recovery: _Object_3({
+      status: status2,
+      drill_id: Union4([String22({ minLength: 1, maxLength: 128 }), Null3()]),
+      rpo_seconds: Union4([Integer4({ minimum: 0 }), Null3()]),
+      rto_seconds: Union4([Integer4({ minimum: 0 }), Null3()])
+    }, closed6)
+  }, closed6);
+  componentName2 = Union4([
+    Literal3("management-api"),
+    Literal3("web-console"),
+    Literal3("edge-runtime"),
+    Literal3("worker"),
+    Literal3("postgres"),
+    Literal3("postgrest"),
+    Literal3("gotrue"),
+    Literal3("storage"),
+    Literal3("realtime")
+  ]);
+  DeploymentComponentEvidenceSchema2 = _Object_3({
+    name: componentName2,
+    version: Union4([String22({ minLength: 1, maxLength: 128 }), Null3()]),
+    status: status2,
+    health_check: Union4([String22({ minLength: 1, maxLength: 256 }), Null3()]),
+    checked_at: Union4([isoDate2, Null3()])
+  }, closed6);
+  DeploymentEvidenceSchema2 = _Object_3({
+    schema: Literal3(DEPLOYMENT_EVIDENCE_SCHEMA2),
+    status: evidenceStatus2,
+    recorded_at: isoDate2,
+    scope: _Object_3({
+      project_ref: String22({ pattern: "^[a-z0-9-]{1,20}$" }),
+      application_id: ApplicationIdSchema3,
+      environment_id: ApplicationIdSchema3
+    }, closed6),
+    source: _Object_3({
+      commit_sha: Union4([String22({ pattern: "^[0-9a-f]{7,64}$" }), Null3()]),
+      manifest_sha256: sha2562,
+      contract_schema: Union4([String22({ minLength: 1, maxLength: 128 }), Null3()]),
+      environment_binding_version: Union4([sha2562, Null3()])
+    }, closed6),
+    database: DatabaseProviderSchema2,
+    components: _Array_2(DeploymentComponentEvidenceSchema2, { minItems: 1, maxItems: 32 }),
+    activation: _Object_3({
+      release_id: ApplicationReleaseIdSchema3,
+      configuration_id: ApplicationConfigurationIdSchema3,
+      activation_id: ApplicationConfigurationIdSchema3
+    }, closed6),
+    health: _Object_3({
+      status: status2,
+      checked_at: Union4([isoDate2, Null3()]),
+      authenticated_smoke: status2
+    }, closed6),
+    rollback: _Object_3({
+      release_id: Union4([ApplicationReleaseIdSchema3, Null3()]),
+      configuration_id: Union4([ApplicationConfigurationIdSchema3, Null3()]),
+      status: Union4([Literal3("ready"), Literal3("not-ready"), Literal3("unknown")]),
+      result: Union4([status2, Null3()])
+    }, closed6),
+    notes: _Array_2(String22({ minLength: 1, maxLength: 512 }), { maxItems: 32 })
+  }, closed6);
+});
 var APPLICATION_RUNTIME_PROBE_PATH2 = "/.well-known/supacloud/runtime";
 var ApplicationRuntimeIdentitySchema2;
 var ApplicationReadinessReportSchema2;
@@ -241389,6 +241794,7 @@ var init_src = __esm2(() => {
   init_application_activation();
   init_application_release();
   init_application_configuration();
+  init_deployment_evidence();
   init_application_runtime_identity();
   init_delivery_build_schema();
   init_delivery_migration_archive();
@@ -246856,7 +247262,7 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.32.0"
+      version: "0.34.0"
     },
     app: {
       version: "0.22.0",
@@ -246883,7 +247289,7 @@ var starter_metadata_default = {
       }
     },
     sdk: {
-      version: "0.36.1",
+      version: "0.38.0",
       peerDependencies: {
         "@supabase/supabase-js": "^2.115.0"
       }
@@ -254587,7 +254993,7 @@ function registerRemoteDevTools(server2, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.64.4",
+  version: "0.65.1",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -254622,14 +255028,14 @@ var package_default = {
   },
   dependencies: {
     "@sinclair/typebox": "^0.34.52",
-    "@supacloud/compiler": "^0.32.0",
-    "@supacloud/delivery": "0.6.0",
+    "@supacloud/compiler": "^0.34.0",
+    "@supacloud/delivery": "0.7.0",
     "@supacloud/db": "^0.2.0",
     fflate: "^0.8.3",
     typebox: "1.3.34"
   },
   overrides: {
-    "@supacloud/delivery": "0.6.0"
+    "@supacloud/delivery": "0.7.0"
   },
   devDependencies: {
     "@supacloud/elysia": "^0.23.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.64.4",
+  "version": "0.65.1",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -35,14 +35,14 @@
   },
   "dependencies": {
     "@sinclair/typebox": "^0.34.52",
-    "@supacloud/compiler": "^0.32.0",
-    "@supacloud/delivery": "0.6.0",
+    "@supacloud/compiler": "^0.34.0",
+    "@supacloud/delivery": "0.7.0",
     "@supacloud/db": "^0.2.0",
     "fflate": "^0.8.3",
     "typebox": "1.3.34"
   },
   "overrides": {
-    "@supacloud/delivery": "0.6.0"
+    "@supacloud/delivery": "0.7.0"
   },
   "devDependencies": {
     "@supacloud/elysia": "^0.23.1",