@supacloud/cli 0.90.1 → 0.91.0

package/README.md

@@ -636,12 +636,15 @@ reporting success. Management endpoint projection is checked before and after.
 ### Internal release scope controls
 
 Scope files and manual release-controller operations are internal compatibility
-surfaces. They are not part of the normal customer deployment path. Use the
-project command instead:
+surfaces. The project-scoped FA deployment command is a proposed future
+contract and is not implemented yet. For current deployments, use the
+target-level one-command flow documented in
+[`docs/cli-guide.md`](../../docs/cli-guide.md), for example:
 
-```sh
-supacloud --env test deploy
-supacloud --env production deploy --confirm-production PROJECT_REF
+```bash
+supacloud deploy
+supacloud deploy --target web
+supacloud deploy --target api
 ```
 
 FA deployment policy and the boundary between platform-owned operations and
@@ -650,8 +653,8 @@ FA-owned business features are documented in
 
 Scope creation, rebinding, inspection and hash calculation are intentionally
 undocumented here. They remain available only for internal compatibility,
-audit and historical receipt migration. Customers do not need a scope file
-before running the one-command deployment flow above.
+audit and historical receipt migration. The future project-scoped flow will
+not require a scope file once its implementation lands.
 
 The legacy `.env` fallback is unclassified and therefore does not enable the
 production confirmation gate. Production automation must select a `prod` or

package/dist/index.js

@@ -10553,10 +10553,29 @@ var ApplicationDeployResultSchema = _Object_({
     replayed: Boolean2()
   }, closed3))
 }, closed3);
-function parseApplicationDeployResult(value) {
+function parseApplicationDeployResult(value, expected) {
   if (!Check2(ApplicationDeployResultSchema, value)) {
     throw new Error("Invalid application deploy result");
   }
+  const backend = value.backend_receipt;
+  const bindingKeys = [
+    "project_ref",
+    "application_id",
+    "environment_id",
+    "release_id",
+    "mutation_id",
+    "plan_sha256"
+  ];
+  if (bindingKeys.some((key) => backend[key] !== value[key]) || !backend.postgrest_healthy || backend.applied_versions.length > 0 && (!backend.schema_reloaded || !backend.backup_id)) {
+    throw new Error("Invalid application deploy receipt binding");
+  }
+  if (expected) {
+    const { request } = expected;
+    const configurationId = request.configuration_id ?? request.configuration_write?.configuration_id;
+    if (value.project_ref !== expected.project_ref || value.application_id !== expected.application_id || value.environment_id !== expected.environment_id || value.release_id !== request.release_id || value.mutation_id !== request.mutation_id || configurationId !== undefined && value.configuration_id !== configurationId || request.configuration_write !== undefined && value.configuration_id !== request.configuration_write.configuration_id || request.expected_plan_sha256 !== undefined && value.plan_sha256 !== request.expected_plan_sha256 || Boolean(value.web) !== Boolean(request.web) || request.web !== undefined && (value.web?.deployment_id !== request.web.deployment_id || value.web.release_id !== request.web.release_id)) {
+      throw new Error("Application deploy receipt does not match request");
+    }
+  }
   return structuredClone(value);
 }
 // node_modules/@supacloud/delivery/src/application-history.ts
@@ -25509,6 +25528,8 @@ function releasePhaseFailure(phase, result, completed) {
   };
   if (phaseResult?.activation_id !== undefined)
     payload.activation_id = phaseResult.activation_id;
+  if (typeof phaseResult?.deployment_id === "string")
+    payload.deployment_id = phaseResult.deployment_id;
   if (phaseResult?.expected_activation_id !== undefined) {
     payload.expected_activation_id = phaseResult.expected_activation_id;
   }
@@ -25612,7 +25633,7 @@ async function runAppRelease(request, options, delegate) {
     ...request.web === undefined ? {} : { web: request.web }
   };
   validateToolArguments(APPLICATION_TOOL_SCHEMA, deployArgs);
-  const deployed = await delegate(deployArgs);
+  const deployed = options.projectDeployment ? await options.projectDeployment(deployArgs) : await delegate(deployArgs);
   const deployReceipt = resultObject(deployed);
   const resolvedConfigurationId = typeof deployReceipt?.configuration_id === "string" ? deployReceipt.configuration_id : undefined;
   if (resolvedConfigurationId !== undefined) {
@@ -25632,6 +25653,7 @@ async function runAppRelease(request, options, delegate) {
     application_id: id,
     environment_id: environmentId,
     release_id: releaseId,
+    ...typeof deployReceipt.deployment_id === "string" ? { deployment_id: deployReceipt.deployment_id } : {},
     ...configurationId === undefined ? {} : { configuration_id: configurationId },
     manifest_path: manifestPath,
     build: buildReceipt ? completed.build : { skipped: true, manifest_path: manifestPath },
@@ -25646,6 +25668,7 @@ async function runAppRelease(request, options, delegate) {
     `Release: ${releaseId}`,
     `Configuration: ${configurationId}`,
     `Activation: ${result.activation_id ?? "not performed"}`,
+    ...result.deployment_id === undefined ? [] : [`Deployment: ${result.deployment_id}`],
     `Build: ${request.skip_build ? "skipped" : "completed"}`
   ].join(`
 `));
@@ -28163,12 +28186,35 @@ async function readDeployConfig(configRoot) {
     return {};
   const config = record4(candidate);
   const frontend = record4(config?.frontend);
+  const application = record4(config?.application);
   const targetValues = record4(config?.targets);
-  if (!config || config.frontend !== undefined && !frontend || config.targets !== undefined && !targetValues) {
-    throw new Error("supacloud.json must contain object-valued 'frontend' or 'targets' configuration");
+  if (!config || config.frontend !== undefined && !frontend || config.application !== undefined && !application || config.targets !== undefined && !targetValues) {
+    throw new Error("supacloud.json must contain object-valued 'application', 'frontend' or 'targets' configuration");
+  }
+  let parsedApplication;
+  if (application) {
+    const id = optionalText(application.id, "application.id");
+    const environmentId = optionalText(application.environmentId, "application.environmentId");
+    if (!id || !Check2(ApplicationIdSchema, id) || environmentId !== undefined && !Check2(ApplicationIdSchema, environmentId)) {
+      throw new Error("supacloud.json requires a valid application.id and optional application.environmentId");
+    }
+    const configurationPath = optionalText(application.configurationPath, "application.configurationPath");
+    const configurationId = optionalText(application.configurationId, "application.configurationId");
+    if (configurationPath && configurationId) {
+      throw new Error("supacloud.json application must set only one of application.configurationPath or application.configurationId");
+    }
+    const manifestPath = optionalText(application.manifestPath, "application.manifestPath");
+    parsedApplication = {
+      id,
+      ...environmentId ? { environmentId } : {},
+      ...configurationPath ? { configurationPath } : {},
+      ...configurationId ? { configurationId } : {},
+      ...manifestPath ? { manifestPath } : {}
+    };
   }
   return {
     defaultTarget: optionalText(config.defaultTarget, "defaultTarget"),
+    ...parsedApplication === undefined ? {} : { application: parsedApplication },
     targets: targetValues ? Object.fromEntries(Object.entries(targetValues).map(([name, value]) => [name, deployTargetConfig(value, name)])) : undefined,
     frontend: frontend ? {
       id: optionalText(frontend.id, "frontend.id"),
@@ -28186,6 +28232,25 @@ async function packageName(projectDirectory) {
 async function pathExists(path) {
   return access(path).then(() => true, () => false);
 }
+async function hasProjectReleaseManifest(root) {
+  if (await pathExists(join17(root, "deploy-manifest.json")))
+    return true;
+  const directory = await opendir(join17(root, "supacloud")).catch((error) => {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT")
+      return null;
+    throw error;
+  });
+  if (!directory)
+    return false;
+  let entries = 0;
+  for await (const entry of directory) {
+    if (++entries > 128)
+      throw new Error("Too many SupaCloud project roots to resolve a deployment");
+    if ((entry.isDirectory() || entry.isSymbolicLink()) && await pathExists(join17(root, "supacloud", entry.name, "deploy-manifest.json")))
+      return true;
+  }
+  return false;
+}
 async function defaultBuildCommand(projectDirectory, configRoot) {
   const packageJson = record4(await readJson(join17(projectDirectory, "package.json")));
   const scripts = record4(packageJson?.scripts);
@@ -28525,7 +28590,7 @@ function deployResponse(result, json) {
 `) }] };
 }
 function registerDeployTools(server, http, options = {}) {
-  registerTool(server, "deploy", "Build and publish the linked frontend with one command", deployToolSchema, async (args) => {
+  registerTool(server, "deploy", "Build and publish the linked project with one command", deployToolSchema, async (args) => {
     if (args.dry_run === true && (args.plan === true || args.diff === true)) {
       throw new Error("Use dry_run for resolution only, or plan/diff for a built release comparison, not both");
     }
@@ -28533,8 +28598,19 @@ function registerDeployTools(server, http, options = {}) {
     const projectRef = String(args.ref || options.projectRef || "").trim();
     if (!projectRef)
       throw new Error("A linked project ref is required. Set SUPACLOUD_PROJECT_REF or pass --ref");
-    const configRoot = await findDeployConfigRoot(invocationDirectory);
-    if (options.application?.id) {
+    const configRoot = await findDeployConfigRoot(invocationDirectory, options.environment ?? undefined);
+    const config = await readDeployConfig(configRoot);
+    const application = options.application?.id ? options.application : config.application ? {
+      ...config.application,
+      environmentId: options.environment || config.application.environmentId
+    } : undefined;
+    if (!args.target && await hasProjectReleaseManifest(configRoot)) {
+      throw new Error("PROJECT_DEPLOYMENT_UNSUPPORTED: This project declares a release manifest that the current deployment orchestrator cannot execute. No Web-only fallback or remote mutation was performed.");
+    }
+    if (application?.id) {
+      if (Object.values(config.targets ?? {}).some((target) => target.type === "edge_function")) {
+        throw new Error("PROJECT_DEPLOYMENT_UNSUPPORTED: Application deployment cannot yet include declared Edge Function targets. No partial deployment was performed.");
+      }
       if (!options.applicationRelease) {
         throw new Error("Application release support is unavailable in this CLI context");
       }
@@ -28544,12 +28620,12 @@ function registerDeployTools(server, http, options = {}) {
       if (args.dry_run === true || args.plan === true || args.diff === true) {
         throw new Error("Application profile deploy does not support dry_run, plan, or diff; use app deploy-plan for a read-only plan");
       }
-      const environmentId = options.application.environmentId.trim();
-      if (!environmentId) {
+      const environmentId = application.environmentId?.trim();
+      if (!environmentId || !Check2(ApplicationIdSchema, environmentId) || !Check2(ApplicationIdSchema, application.id)) {
         throw new Error("Application profile requires SUPACLOUD_APPLICATION_ENVIRONMENT_ID or SUPACLOUD_ENV");
       }
-      const configurationPath = options.application.configurationPath?.trim();
-      const configurationId = options.application.configurationId?.trim();
+      const configurationPath = application.configurationPath?.trim();
+      const configurationId = application.configurationId?.trim();
       if (configurationPath && configurationId) {
         throw new Error("Application profile must set only one of SUPACLOUD_APPLICATION_CONFIGURATION_PATH or SUPACLOUD_APPLICATION_CONFIGURATION_ID");
       }
@@ -28557,20 +28633,22 @@ function registerDeployTools(server, http, options = {}) {
       const result = await options.applicationRelease({
         action: "release",
         ref: projectRef,
-        id: options.application.id,
+        id: application.id,
         environment_id: environmentId,
         root: configRoot,
         ...configurationPath ? { configuration_path: configurationPath } : {},
         ...configurationId ? { configuration_id: configurationId } : {},
-        ...options.application.manifestPath ? { manifest_path: options.application.manifestPath } : {},
+        ...application.manifestPath ? { manifest_path: application.manifestPath } : {},
         ...args.skip_build === true ? { skip_build: true } : {},
         ...stagedWeb?.request === undefined ? {} : { web: stagedWeb.request },
         ...args.json === true ? { format: "json", json: true } : {}
       });
       return result;
     }
-    const config = await readDeployConfig(configRoot);
     const target = selectTarget(configRoot, invocationDirectory, config, String(args.target || "").trim() || undefined);
+    if (!args.target && target.config.type === "frontend" && (Object.values(config.targets ?? {}).some((candidate) => candidate.type === "edge_function") || await pathExists(join17(configRoot, "supacloud.config.ts")) || await pathExists(join17(configRoot, "supabase", "migrations")) || await pathExists(join17(configRoot, "supabase", "functions")))) {
+      throw new Error("PROJECT_DEPLOYMENT_UNSUPPORTED: Backend declarations were detected but are not covered by this deployment. No Web-only fallback or remote mutation was performed.");
+    }
     const projectDirectory = target.root;
     const targetState = await lstat5(projectDirectory).catch(() => null);
     if (!targetState?.isDirectory() || targetState.isSymbolicLink()) {
@@ -29378,10 +29456,109 @@ function registerDeveloperExperienceTools(server, options = {}) {
   registerTool(server, "init", "Create SupaCloud deployment configuration and non-secret environment examples without overwriting project files.", initToolSchema, (request) => initializeProject(request, options));
   registerTool(server, "env", "List or locally validate named SupaCloud environment profiles without contacting the platform or printing secrets.", environmentToolSchema, (request) => inspectEnvironment(request, options));
 }
+
+// src/shared/tools/project-deployment.ts
+var operation = "applications.project_deploy";
+var scopeSchema = _Object_({
+  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+  application_id: ApplicationIdSchema,
+  environment_id: ApplicationIdSchema
+});
+var statusSchema = _Object_({
+  schema: Literal("supacloud.project-deployment-status.v1"),
+  deployment_id: ApplicationDeployRequestSchema.properties.mutation_id,
+  status: Union([
+    Literal("pending"),
+    Literal("running"),
+    Literal("succeeded"),
+    Literal("failed_retryable"),
+    Literal("failed_terminal"),
+    Literal("outcome_unknown")
+  ]),
+  phase: Union([
+    Literal("queued"),
+    Literal("prepared"),
+    Literal("migrating"),
+    Literal("activating"),
+    Literal("binding-web"),
+    Literal("verifying")
+  ]),
+  operation: Literal("application.release.deploy"),
+  ...scopeSchema.properties,
+  receipt: Optional(Unknown()),
+  failure_code: Optional(String2({ pattern: "^[A-Z][A-Z0-9_]{0,63}$" }))
+}, { additionalProperties: false });
+function responseReceipt(data, expected) {
+  if (!data || typeof data !== "object" || Array.isArray(data) || !("ok" in data) || data.ok !== true) {
+    throw new Error("Invalid project deployment response");
+  }
+  const { ok: _ok, ...receipt } = data;
+  return parseApplicationDeployResult(receipt, expected);
+}
+async function runProjectDeployment(http, args) {
+  const scope = { project_ref: args.ref, application_id: args.id, environment_id: args.environment_id };
+  const request = {
+    mutation_id: args.mutation_id,
+    release_id: args.release_id,
+    ...args.configuration_id === undefined ? {} : { configuration_id: args.configuration_id },
+    ...args.configuration_write === undefined ? {} : { configuration_write: args.configuration_write },
+    ...args.expected_plan_sha256 === undefined ? {} : { expected_plan_sha256: args.expected_plan_sha256 },
+    ...args.approved_migration_digest === undefined ? {} : { approved_migration_digest: args.approved_migration_digest },
+    ...args.web === undefined ? {} : { web: args.web }
+  };
+  if (!Check2(scopeSchema, scope) || !Check2(ApplicationDeployRequestSchema, request) || request.configuration_id !== undefined && request.configuration_write !== undefined && request.configuration_id !== request.configuration_write.configuration_id) {
+    return releaseControlFailure(operation, "INVALID_RESPONSE", null);
+  }
+  const expected = { ...scope, request };
+  const identity = {
+    ...scope,
+    deployment_id: request.mutation_id,
+    mutation_id: request.mutation_id,
+    release_id: request.release_id
+  };
+  const endpoint = `/v1/projects/${encodeURIComponent(scope.project_ref)}/environments/${encodeURIComponent(scope.environment_id)}/deployments`;
+  const { mutation_id, ...candidate } = request;
+  const result = await http.post(endpoint, {
+    ...candidate,
+    deployment_id: mutation_id,
+    application_id: scope.application_id
+  }, { timeoutMs: 120000, maxJsonBytes: 131072, responseTimeoutMs: 30000 });
+  if (result.ok && result.status === 200) {
+    try {
+      return releaseControlSuccess(operation, {
+        ...responseReceipt(result.data, expected),
+        deployment_id: mutation_id
+      });
+    } catch {}
+  } else if (!result.ok && !result.transportError && !result.responseReadError && result.status < 500 && result.status !== 408) {
+    return releaseControlMutationFailure(operation, result, identity);
+  }
+  const observed = await http.get(`${endpoint}/${encodeURIComponent(mutation_id)}`, {
+    retry: false,
+    totalTimeoutMs: 30000,
+    maxJsonBytes: 131072
+  });
+  try {
+    if (!observed.ok || observed.status !== 200 || !Check2(statusSchema, observed.data))
+      throw new Error;
+    const state = observed.data;
+    if (state.deployment_id !== mutation_id || state.project_ref !== scope.project_ref || state.application_id !== scope.application_id || state.environment_id !== scope.environment_id || state.status !== "succeeded" || state.phase !== "verifying")
+      throw new Error;
+    const receipt = parseApplicationDeployResult(state.receipt, expected);
+    return releaseControlSuccess(operation, {
+      ...receipt,
+      deployment_id: mutation_id,
+      replayed: true,
+      execution_performed: false
+    });
+  } catch {
+    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", result.transportError ? null : result.status, identity);
+  }
+}
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.90.1",
+  version: "0.91.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -29434,13 +29611,13 @@ var package_default = {
   },
   dependencies: {
     "@supacloud/compiler": "^0.44.1",
-    "@supacloud/delivery": "0.15.0",
+    "@supacloud/delivery": "0.15.1",
     "@supacloud/db": "0.16.1",
     typebox: "1.3.36"
   },
   overrides: {
     "@supacloud/contracts": "0.8.1",
-    "@supacloud/delivery": "0.15.0",
+    "@supacloud/delivery": "0.15.1",
     "@graphql-tools/utils": "^12.0.3"
   },
   devDependencies: {
@@ -29996,7 +30173,8 @@ function createCliTools(context, confirmProduction) {
   Object.assign(tools, captureTools((server) => registerAppTools(server, {
     getApplications: () => tools.applications?.callback,
     onDevProgress: writeDevProgress,
-    projectRef: context.projectRef || undefined
+    projectRef: context.projectRef || undefined,
+    projectDeployment: (args) => runProjectDeployment(http, args)
   })));
   assign(captureTools((server) => registerDeployTools(server, http, {
     environment: context.environment,

package/dist/shared/tools/app-tools.d.ts

@@ -30,6 +30,7 @@ declare const REMOTE_APP_ACTIONS: {
 };
 export interface AppToolOptions {
     getApplications?: () => ((args: Record<string, unknown>) => Promise<ToolResult>) | undefined;
+    projectDeployment?: (args: Record<string, unknown>) => Promise<ToolResult>;
     projectRef?: string;
     /** Abort signal for long-running local actions (`app dev` watch), used for cancellation and tests. */
     signal?: AbortSignal;

package/dist/shared/tools/project-deployment.d.ts

@@ -0,0 +1,3 @@
+import type { ToolResult } from "../tool-server";
+import type { HttpTransport } from "../transports/http";
+export declare function runProjectDeployment(http: Pick<HttpTransport, "post" | "get">, args: Record<string, unknown>): Promise<ToolResult>;

package/dist/shared/tools/project-deployment.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.90.1",
+  "version": "0.91.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -53,13 +53,13 @@
   },
   "dependencies": {
     "@supacloud/compiler": "^0.44.1",
-    "@supacloud/delivery": "0.15.0",
+    "@supacloud/delivery": "0.15.1",
     "@supacloud/db": "0.16.1",
     "typebox": "1.3.36"
   },
   "overrides": {
     "@supacloud/contracts": "0.8.1",
-    "@supacloud/delivery": "0.15.0",
+    "@supacloud/delivery": "0.15.1",
     "@graphql-tools/utils": "^12.0.3"
   },
   "devDependencies": {