@supacloud/cli 0.90.0 → 0.90.1

package/README.md

@@ -633,54 +633,25 @@ query parameters and accepts only its authoritative JSON boolean `false`
 read-back. The fixture binding comes from the validated disable receipt before
 reporting success. Management endpoint projection is checked before and after.
 
-### Release scope rebinding and inspection
+### Internal release scope controls
 
-Release scopes bind deployment manifests (functions, migrations, web assets) to
-an exact 40-character base commit SHA and one concrete deployment environment.
-Old scope files without `targetEnvironmentId` are rejected and must be
-regenerated. Test and production scopes may share the same source commit, but
-they are separate environment-bound release identities.
+Scope files and manual release-controller operations are internal compatibility
+surfaces. They are not part of the normal customer deployment path. Use the
+project command instead:
 
-```bash
-# Rebind a single environment-bound scope to latest git main (or origin/main)
-supacloud release scope_rebind --file supacloud/fa/release-scopes/20260907-intake-p1-production.json --environment_id production
-
-# Rebind multiple production files together
-supacloud release scope_rebind --files "20260907-intake-p1-production.json,20260907-intake-p1-production-hotfix.json" --environment_id production
-
-# Rebind staging separately; a staging scope can never be rebound as production
-supacloud release scope_rebind --task 20260907-intake-p1 --environment_id staging
-
-# Rebind all scopes matching a task ID or filename prefix in standard directories
-supacloud release scope_rebind --task 20260907-intake-p1 --environment_id production
-
-# Specify an explicit base commit SHA or git ref
-supacloud release scope_rebind --task 20260907-intake-p1 --base_commit origin/main --environment_id production
-
-# Preview changes without modifying files
-supacloud release scope_rebind --task 20260907-intake-p1 --environment_id production --dry_run
-
-# Inspect scope status, SHA-256 hash, and alignment with git HEAD / origin/main
-supacloud release scope_inspect --file 20260907-intake-p1-production.json --environment_id production
-
-# Scaffold a new canonical release scope
-supacloud release scope_create \
-  --file supacloud/fa/release-scopes/20260907-intake-p1.json \
-  --task FA-INTAKE-P1 \
-  --ref abc123 \
-  --environment_id production \
-  --functions "fa-api,fa-worker" \
-  --migrations "20260907120000_init"
+```sh
+supacloud --env test deploy
+supacloud --env production deploy --confirm-production PROJECT_REF
 ```
 
-Scope actions run locally without requiring Management API credentials. Files
-are formatted canonically with 2 spaces and sorted keys, and the authoritative
-`scope_sha256` checksum is recalculated automatically. `scope_create` resolves
-`origin/main` by default, so a new test or production scope is generated from
-the current main baseline instead of reusing an older scope identity.
-These commands are for release maintenance and audit workflows; customers do
-not need to create or rebind a scope before running the one-command deployment
-flow above.
+FA deployment policy and the boundary between platform-owned operations and
+FA-owned business features are documented in
+[`docs/fa-deployment-capability-boundary.md`](../../docs/fa-deployment-capability-boundary.md).
+
+Scope creation, rebinding, inspection and hash calculation are intentionally
+undocumented here. They remain available only for internal compatibility,
+audit and historical receipt migration. Customers do not need a scope file
+before running the one-command deployment flow above.
 
 The legacy `.env` fallback is unclassified and therefore does not enable the
 production confirmation gate. Production automation must select a `prod` or

package/dist/index.js

@@ -8713,6 +8713,8 @@ function decodedSchema(inputSchema, outputSchema, decode, options) {
   return result;
 }
 function schemaEnumValues(schema) {
+  if (!schema)
+    return [];
   const view = schema;
   if (Array.isArray(view.enum)) {
     return view.enum.filter((value) => typeof value === "string" || typeof value === "number").map((value) => String(value));
@@ -8818,7 +8820,7 @@ async function runCli(cliTools, args, options = {}) {
   `);
   const getSchemaShape = (schema) => schemaProperties(schema);
   const getEnumOptions = (field) => schemaEnumValues(field);
-  const getDescription = (field) => schemaDescription(field);
+  const getDescription = (field) => field ? schemaDescription(field) : "";
   const formatToolHelp = (toolName, tool) => {
     const shape = getSchemaShape(tool.schema);
     const actionField = shape.action;
@@ -28024,7 +28026,8 @@ function registerReleaseTools(server, http, options = {}) {
 }
 
 // src/shared/tools/deploy-tools.ts
-import { access, lstat as lstat5, mkdtemp as mkdtemp2, opendir, rm as rm3 } from "node:fs/promises";
+import { access, lstat as lstat5, mkdtemp as mkdtemp2, opendir, readFile as readFile6, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
+import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash9 } from "node:crypto";
 import { tmpdir as tmpdir3 } from "node:os";
 import { basename as basename8, dirname as dirname11, join as join17, relative as relative10, resolve as resolve22, sep as sep5 } from "node:path";
@@ -28074,7 +28077,7 @@ function frontendDeployment(candidate) {
 }
 async function readJson(path) {
   try {
-    return await Bun.file(path).json();
+    return JSON.parse(await readFile6(path, "utf8"));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
       return null;
@@ -28320,9 +28323,9 @@ function resolveInsideProject(projectDirectory, candidate, allowRoot = false) {
   return resolved;
 }
 function createBuildEnvironment(names, environmentVariables) {
-  const selectedNames = [...new Set(names || [])].sort();
-  const selectedNameSet = new Set(selectedNames);
   const values = environmentVariables ?? process.env;
+  const selectedNames = [...new Set(names ?? Object.keys(values).filter(isPublicBuildEnv))].sort();
+  const selectedNameSet = new Set(selectedNames);
   const env = Object.fromEntries(Object.entries(process.env).filter(([name]) => !isProtectedBuildEnv(name) && (!isPublicBuildEnv(name) || selectedNameSet.has(name)) && (!SENSITIVE_BUILD_ENV.test(name) || isPublicBuildEnv(name))));
   const missing = selectedNames.filter((name) => !values[name]?.trim());
   for (const name of selectedNames) {
@@ -28338,15 +28341,21 @@ function assertBuildEnvironment(build, skipBuild) {
   }
 }
 async function runBuild(command, cwd, environment, json) {
-  const child = Bun.spawn(["sh", "-c", command], {
-    cwd,
-    env: environment,
-    stdio: ["inherit", json ? 2 : "inherit", "inherit"]
+  await new Promise((resolve, reject) => {
+    const child = spawn2("sh", ["-c", command], {
+      cwd,
+      env: environment,
+      stdio: ["inherit", json ? 2 : "inherit", "inherit"]
+    });
+    child.once("error", reject);
+    child.once("close", (exitCode) => {
+      if (exitCode === 0) {
+        resolve();
+      } else {
+        reject(new Error(`Build command failed (exit ${exitCode ?? "unknown"}): ${command}`));
+      }
+    });
   });
-  const exitCode = await child.exited;
-  if (exitCode !== 0) {
-    throw new Error(`Build command failed (exit ${exitCode ?? "unknown"}): ${command}`);
-  }
 }
 async function collectArchiveFiles(root) {
   const rootStat = await lstat5(root).catch(() => null);
@@ -28379,7 +28388,7 @@ async function collectArchiveFiles(root) {
   const files = new Map;
   const digests = [];
   for (const path of paths) {
-    const data = new Uint8Array(await Bun.file(path).arrayBuffer());
+    const data = new Uint8Array(await readFile6(path));
     bytes += data.byteLength;
     if (bytes > MAX_SOURCE_BYTES)
       throw new Error(`Frontend output exceeds ${MAX_SOURCE_BYTES} bytes`);
@@ -28403,7 +28412,7 @@ async function createFrontendArchive(outputDirectory) {
   const archivePath = join17(temporaryDirectory, `${basename8(outputDirectory)}.tar.zst`);
   try {
     const archiveBytes = await createFrontendTarZstd(collected.files);
-    await Bun.write(archivePath, archiveBytes);
+    await writeFile6(archivePath, archiveBytes);
     const sha256 = createHash9("sha256").update(archiveBytes).digest("hex");
     return {
       archivePath,
@@ -28792,7 +28801,7 @@ function registerDeployTools(server, http, options = {}) {
 
 // src/shared/tools/remote-dev-tools.ts
 import { existsSync as existsSync14 } from "node:fs";
-import { readFile as readFile6 } from "node:fs/promises";
+import { readFile as readFile7 } from "node:fs/promises";
 import { readdir as readdir7 } from "node:fs/promises";
 import { createHash as createHash10 } from "node:crypto";
 import { join as join18, resolve as resolve23 } from "node:path";
@@ -28870,7 +28879,7 @@ async function readProjectConfig(root) {
   if (!existsSync14(file))
     return {};
   try {
-    const parsed = JSON.parse(await readFile6(file, "utf8"));
+    const parsed = JSON.parse(await readFile7(file, "utf8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch (error) {
     throw new Error(`Invalid supacloud.json: ${error instanceof Error ? error.message : String(error)}`);
@@ -28896,7 +28905,7 @@ async function sourceFingerprint(root) {
   const hash = createHash10("sha256");
   for (const file of files) {
     hash.update(file.slice(root.length).replace(/\\/g, "/"));
-    hash.update(await readFile6(file));
+    hash.update(await readFile7(file));
   }
   return hash.digest("hex");
 }
@@ -29062,7 +29071,7 @@ function registerRemoteDevTools(server, options = {}) {
 
 // src/shared/tools/developer-experience-tools.ts
 import { existsSync as existsSync15 } from "node:fs";
-import { mkdir as mkdir7, readdir as readdir8, readFile as readFile7, writeFile as writeFile6 } from "node:fs/promises";
+import { mkdir as mkdir7, readdir as readdir8, readFile as readFile8, writeFile as writeFile7 } from "node:fs/promises";
 import { dirname as dirname12, join as join19, resolve as resolve24 } from "node:path";
 var initToolSchema = {
   root: optional(String2(), "Project directory to initialize (default: current directory)"),
@@ -29117,7 +29126,7 @@ async function readPackageManifest(root) {
   if (!existsSync15(path))
     return {};
   try {
-    const parsed = JSON.parse(await readFile7(path, "utf8"));
+    const parsed = JSON.parse(await readFile8(path, "utf8"));
     const value = record5(parsed);
     if (!value)
       throw new Error("package.json must contain an object");
@@ -29135,7 +29144,7 @@ async function readPackageManifest(root) {
 }
 async function writeNewFile(path, content) {
   try {
-    await writeFile6(path, content, { encoding: "utf8", flag: "wx", mode: 384 });
+    await writeFile7(path, content, { encoding: "utf8", flag: "wx", mode: 384 });
     return true;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "EEXIST")
@@ -29145,7 +29154,7 @@ async function writeNewFile(path, content) {
 }
 async function ensureGitignore(root) {
   const path = join19(root, ".gitignore");
-  const existing = existsSync15(path) ? await readFile7(path, "utf8") : "";
+  const existing = existsSync15(path) ? await readFile8(path, "utf8") : "";
   const required = [".env.supacloud.*", "!.env.supacloud.*.example"];
   const missing = required.filter((entry) => !existing.split(/\r?\n/).includes(entry));
   if (missing.length === 0)
@@ -29153,7 +29162,7 @@ async function ensureGitignore(root) {
   const prefix = existing.length > 0 && !existing.endsWith(`
 `) ? `${existing}
 ` : existing;
-  await writeFile6(path, `${prefix}${missing.join(`
+  await writeFile7(path, `${prefix}${missing.join(`
 `)}
 `, "utf8");
   return true;
@@ -29176,7 +29185,7 @@ async function initializeProject(request, options) {
   };
   const created = [];
   try {
-    await writeFile6(configPath, `${JSON.stringify(config, null, 2)}
+    await writeFile7(configPath, `${JSON.stringify(config, null, 2)}
 `, {
       encoding: "utf8",
       flag: "wx",
@@ -29372,7 +29381,7 @@ function registerDeveloperExperienceTools(server, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.90.0",
+  version: "0.90.1",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -29665,8 +29674,6 @@ EXAMPLES
   ${preferredCommand} release postgrest_restart --ref abc123
   ${preferredCommand} release release_canary_fixture_stage_replay --ref abc123 --subject <uuid> --request_id <uuid>
   ${preferredCommand} release release_canary_fixture_disable_replay --ref abc123 --fixture_id <uuid> --disable_request_id <uuid> --issuer <issuer-url> --subject <uuid>
-  ${preferredCommand} release scope_rebind --file supacloud/fa/release-scopes/20260907-intake-p1-production.json --environment_id production
-  ${preferredCommand} release scope_inspect --file supacloud/fa/release-scopes/20260907-intake-p1-production.json --environment_id production
   ${preferredCommand} queue stats --queue emails
   ${preferredCommand} queue dlq --queue emails --limit 20
   ${preferredCommand} frontend list --ref abc123

package/dist/shared/schema.d.ts

@@ -8,6 +8,6 @@ export declare function stringEnum<const Values extends readonly [string, ...str
 export declare function withDescription<T extends TSchema>(schema: T, description: string): T;
 export declare function optional<T extends TSchema>(schema: T, description?: string): "~optional" extends keyof T ? T : Type.TOptional<T>;
 export declare function decodedSchema<TInput extends TSchema, TOutput extends TSchema>(inputSchema: TInput, outputSchema: TOutput, decode: (input: StaticDecode<TInput>) => unknown, options?: TSchemaOptions): Type.TCodec<TInput, import("typebox").StaticType<[], "Decode", {}, {}, TOutput>>;
-export declare function schemaEnumValues(schema: TSchema): string[];
+export declare function schemaEnumValues(schema: TSchema | undefined): string[];
 export declare function schemaDescription(schema: TSchema): string;
 export declare function schemaProperties(schema: TSchema | ToolSchema): ToolSchema;

package/dist/tool-runtime.js

@@ -97,6 +97,8 @@ function decodedSchema(inputSchema, outputSchema, decode, options) {
   return result;
 }
 function schemaEnumValues(schema) {
+  if (!schema)
+    return [];
   const view = schema;
   if (Array.isArray(view.enum)) {
     return view.enum.filter((value) => typeof value === "string" || typeof value === "number").map((value) => String(value));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.90.0",
+  "version": "0.90.1",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",