sporades 0.9.38 → 0.9.39

package/CHANGES.md

@@ -1,5 +1,26 @@
 # Changes
 
+## v0.9.39 - 2026-10-22
+
+Changes since v0.9.38.
+
+### 🚀 Features
+
+- Add read-only sporades host db list|dump|query (#286) (c9f0d358).
+
+## Unreleased
+
+### 🚀 Features
+
+- Add read-only `sporades host db list|dump|query` for running Hosted Capsules (#285).
+  It runs the Host helper over the operator's existing SSH access and the
+  generated Bundle's one-shot action seam, opens the Capsule SQLite file
+  read-only and query-only without stopping the Capsule, and refuses mutating
+  SQL both locally and in the runtime. `--json` output matches
+  `sporades db list|dump|query --json` against a Dev session. `--subname`
+  defaults to the project's Host binding. Requires `sporades host upgrade` and
+  a redeploy with this CLI; no public route is added.
+
 ## v0.9.38 - 2026-10-22
 
 Changes since v0.9.37.

package/bin/sporades-host-helper.js

@@ -46183,7 +46183,7 @@ var mutationExecution = new MutationExecutionStorage();
 init_cli_support();
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.38";
+var CLI_VERSION = "0.9.39";
 
 // src/cli/schedule-inspection-envelope.ts
 var SCHEDULE_DIAGNOSTIC_FIELDS = /* @__PURE__ */ new Set([
@@ -46258,6 +46258,40 @@ function sanitizeScheduleInspectionEnvelope(envelope, invalid4) {
   return { ok: true, data: { capsule: { name: envelope.data.capsule.name }, schedules }, error: null };
 }
 
+// src/cli/database-inspection-envelope.ts
+var DATABASE_INSPECTION_ACTIONS = ["db.list", "db.dump", "db.query"];
+var DATABASE_INSPECTION_INPUT_BYTE_LIMIT = 24 * 1024;
+function encodeDatabaseInspectionInput(sql) {
+  const encoded = Buffer.from(JSON.stringify({ sql }), "utf8").toString("base64url");
+  return encoded.length <= DATABASE_INSPECTION_INPUT_BYTE_LIMIT ? encoded : null;
+}
+var DATABASE_INSPECTION_MAX_BUFFER = 128 * 1024 * 1024;
+function isDatabaseInspectionAction(action) {
+  return DATABASE_INSPECTION_ACTIONS.includes(action);
+}
+function sanitizeDatabaseInspectionEnvelope(action, envelope, invalid4) {
+  const data2 = envelope?.data;
+  if (envelope?.ok === true && data2 && typeof data2 === "object" && !Array.isArray(data2)) {
+    if (action === "db.query" && Array.isArray(data2.columns) && Array.isArray(data2.rows)) {
+      return { ok: true, data: { columns: data2.columns, rows: data2.rows }, error: null };
+    }
+    if (action !== "db.query" && Array.isArray(data2.tables)) {
+      return { ok: true, data: { tables: data2.tables }, error: null };
+    }
+  }
+  if (envelope?.ok === false && typeof envelope.error?.message === "string") {
+    return {
+      ok: false,
+      data: null,
+      error: {
+        message: envelope.error.message,
+        hint: typeof envelope.error.hint === "string" ? envelope.error.hint : "Check the SQL and retry the command."
+      }
+    };
+  }
+  return invalid4();
+}
+
 // src/cli/host-helper-archive.ts
 import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
@@ -48806,6 +48840,10 @@ async function dispatchMain(request2) {
     runCapsuleAccessKeyAction(request2);
     return;
   }
+  if (isDatabaseInspectionAction(request2.action)) {
+    inspectCapsuleDatabase(request2);
+    return;
+  }
   if (request2.action === "host.stats") {
     await statsHost(request2);
     return;
@@ -48852,6 +48890,19 @@ function runCapsuleAccessKeyAction(request2) {
     Buffer.from(JSON.stringify(accessKeys), "utf8").toString("base64url")
   ]);
 }
+function inspectCapsuleDatabase(request2) {
+  const action = request2.action;
+  if (!isDatabaseInspectionAction(action)) throw helperError("Unsupported Host helper action.", "Update the Host helper or use a supported Sporades host command.");
+  const exactKeys2 = (value, keys2) => Object.keys(value).length === keys2.length && Object.keys(value).every((key) => keys2.includes(key));
+  const query = action === "db.query";
+  const sql = request2.db?.sql;
+  if (!exactKeys2(request2, query ? ["action", "host", "capsule", "db"] : ["action", "host", "capsule"]) || !request2.host || typeof request2.host !== "object" || Array.isArray(request2.host) || !exactKeys2(request2.host, ["alias", "domain", "scheme", "remoteRoot"]) || !request2.capsule || typeof request2.capsule !== "object" || Array.isArray(request2.capsule) || !exactKeys2(request2.capsule, ["subname"]) || query && (!exactKeys2(request2.db ?? {}, ["sql"]) || typeof sql !== "string" || !encodeDatabaseInspectionInput(sql))) {
+    throw helperError("Invalid Hosted database inspection request.", "Upgrade the local Sporades CLI and Host helper together.");
+  }
+  inspectCapsuleRuntime(request2, action, "database", (envelope) => sanitizeDatabaseInspectionEnvelope(action, envelope, () => {
+    throw helperError("Hosted database inspection returned an invalid response.", "Run `sporades host upgrade`, redeploy the Capsule, and retry the command.");
+  }), query ? ["--sporades-action-input", encodeDatabaseInspectionInput(sql)] : []);
+}
 function inspectCapsuleRuntime(request2, action, label, sanitize = (envelope) => envelope, extraArgs = [], preserveBoundedDiagnostics = false) {
   const containerName = createHostedContainerName(request2.host.domain, request2.capsule.subname);
   if (!checkContainerRunning(containerName)) {
@@ -48860,7 +48911,7 @@ function inspectCapsuleRuntime(request2, action, label, sanitize = (envelope) =>
     throw error;
   }
   const result = runDocker(["exec", containerName, "node", "/app/server.mjs", "--sporades-action", action, ...extraArgs], {
-    maxBuffer: label === "Access-key" ? ACCESS_KEY_OPERATOR_PROCESS_MAX_BUFFER : void 0
+    maxBuffer: label === "Access-key" ? ACCESS_KEY_OPERATOR_PROCESS_MAX_BUFFER : label === "database" ? DATABASE_INSPECTION_MAX_BUFFER : void 0
   });
   let envelope;
   try {

package/bin/sporades.js

@@ -149965,6 +149965,8 @@ Capsule commands:
                       Restore a stopped Capsule; optionally --to-subname <destination>
   backup status       Report last successful backup age for each Capsule
   bind <subname>      Bind this project to a Hosted Capsule
+  db list|dump|query <sql> [--subname <name>]
+                      Read a running Hosted Capsule's database over SSH
   register <subname>  Register a Hosted Capsule
   canonical set <subname> <alias>|clear <subname>
                       Select the public origin; restart a running Capsule
@@ -150849,6 +150851,18 @@ function sanitizeScheduleInspectionEnvelope(envelope, invalid4) {
   return { ok: true, data: { capsule: { name: envelope.data.capsule.name }, schedules }, error: null };
 }
 
+// src/cli/database-inspection-envelope.ts
+var DATABASE_INSPECTION_ACTIONS = ["db.list", "db.dump", "db.query"];
+var DATABASE_INSPECTION_INPUT_BYTE_LIMIT = 24 * 1024;
+function encodeDatabaseInspectionInput(sql2) {
+  const encoded = Buffer.from(JSON.stringify({ sql: sql2 }), "utf8").toString("base64url");
+  return encoded.length <= DATABASE_INSPECTION_INPUT_BYTE_LIMIT ? encoded : null;
+}
+var DATABASE_INSPECTION_MAX_BUFFER = 128 * 1024 * 1024;
+function isDatabaseInspectionAction(action) {
+  return DATABASE_INSPECTION_ACTIONS.includes(action);
+}
+
 // src/cli/server-env-check.ts
 import path20 from "node:path";
 async function readProjectServerEnv(projectDir) {
@@ -153035,7 +153049,7 @@ jobs:
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.38";
+var CLI_VERSION = "0.9.39";
 
 // src/cli/sporades.ts
 var SUPPORTED_TEMPLATES = new Set(CLIENT_TEMPLATES);
@@ -154261,7 +154275,7 @@ function parseHostArgs(args) {
         force = true;
         break;
       default:
-        if (arg.startsWith("--")) {
+        if (arg.startsWith("--") && subcommand !== "db") {
           throw commandError2(
             `Unknown flag: ${arg}`,
             "Use `sporades host add`, `sporades host use`, `sporades host current`, `sporades host health`, `sporades host bind`, `sporades host register`, `sporades host rotate-key`, `sporades host unregister`, `sporades host delete`, `sporades host push`, `sporades host bootstrap`, `sporades host upgrade`, `sporades host list`, `sporades host releases`, `sporades host rollback`, `sporades host reconcile`, `sporades host stats`, `sporades host logs`, or `sporades host invoke`."
@@ -154437,6 +154451,16 @@ function parseHostArgs(args) {
       validateCapsuleSubname(subname);
       return { subcommand, ...parsePolicyOperation(positional), hostAlias, subname, json: json2, projectDir: process.cwd() };
     }
+    case "db": {
+      const [operation, ...sqlParts] = positional;
+      const usage = "Use `sporades host db list`, `sporades host db dump`, or `sporades host db query <sql>`, with optional `--subname <name> --host <alias>`.";
+      if (!["list", "dump", "query"].includes(operation)) throw commandError2(`Unknown host db command: ${operation ?? ""}`.trim(), usage);
+      if (operation !== "query" && sqlParts.length > 0) throw commandError2("Too many positional arguments.", `Use \`sporades host db ${operation} --json\`.`);
+      if (operation === "query" && sqlParts.length === 0) throw commandError2("Missing SQL query.", "Use `sporades host db query <sql>`.");
+      if (hostAlias) validateHostAlias(hostAlias);
+      if (subname) validateCapsuleSubname(subname);
+      return { subcommand, operation, ...operation === "query" ? { sql: sqlParts.join(" ") } : {}, subname, hostAlias, json: json2, projectDir: process.cwd() };
+    }
     case "jobs":
       if (positional.length > 0) throw commandError2("Too many positional arguments.", "Use `sporades host jobs --host <alias> --subname <name>`.");
       if (!hostAlias) throw commandError2("Missing Host profile alias.", "Pass `--host <alias>`.");
@@ -156856,6 +156880,31 @@ async function manageHost(options) {
       writeResult(result, !result.ok);
       return;
     }
+    case "db": {
+      if (options.operation === "query") {
+        assertReadOnlyInspectionSql(options.sql);
+        if (!encodeDatabaseInspectionInput(options.sql)) {
+          throw commandError2("SQL query is too large for Hosted inspection.", "Keep `sporades host db query` SQL under about 16 KiB.");
+        }
+      }
+      const config = await readHostConfig();
+      const target = await resolveHostPushTarget(config, options);
+      let result = invokeRemoteHostHelper({
+        alias: target.alias,
+        profile: target.profile,
+        action: `db.${options.operation}`,
+        subname: target.subname,
+        projectDir: options.projectDir,
+        ...options.operation === "query" ? { db: { sql: options.sql } } : {}
+      });
+      if (!result.ok && /Unsupported Host helper action/i.test(result.error.message)) {
+        result = { ok: false, data: null, error: { code: "HOST_HELPER_UPGRADE_REQUIRED", message: "The Host server CLI does not support database inspection.", hint: `Run \`sporades host upgrade --host ${target.alias}\`, then retry the command.` } };
+      } else if (!result.ok && /Unsupported Sporades runtime action/i.test(result.error.message)) {
+        result = { ok: false, data: null, error: { code: "HOSTED_BUNDLE_UPGRADE_REQUIRED", message: "The Hosted Capsule's Bundle does not support database inspection.", hint: `Redeploy it with this CLI (\`sporades host push --restart --host ${target.alias}\`), then retry the command.` } };
+      }
+      printDatabaseInspection(options.operation, result, options.json);
+      return;
+    }
     case "jobs": {
       const config = await readHostConfig();
       const resolved = resolveHostProfile(config, options.hostAlias);
@@ -158196,21 +158245,24 @@ function inspectedSshPort(inspected) {
   return Number.isInteger(port) ? { host: entry.HostIp ?? null, port } : null;
 }
 async function inspectDatabase(options) {
-  if (options.subcommand === "query") {
-    const validation = validateReadOnlyInspectionSql(options.sql);
-    if (!validation.ok) {
-      throw commandError2(validation.error.message, validation.error.hint);
-    }
+  if (options.subcommand === "query") assertReadOnlyInspectionSql(options.sql);
+  printDatabaseInspection(options.subcommand, await fetchInspectionDatabase(options), options.json);
+}
+function assertReadOnlyInspectionSql(sql2) {
+  const validation = validateReadOnlyInspectionSql(sql2);
+  if (!validation.ok) {
+    throw commandError2(validation.error.message, validation.error.hint);
   }
-  const result = await fetchInspectionDatabase(options);
-  if (options.json) {
+}
+function printDatabaseInspection(subcommand, result, json2) {
+  if (json2) {
     writeResult(result, !result.ok);
     return;
   }
   if (!result.ok) {
     throw commandError2(result.error.message, result.error.hint);
   }
-  switch (options.subcommand) {
+  switch (subcommand) {
     case "list":
       for (const table of result.data.tables) {
         process.stdout.write(`${table}
@@ -158859,6 +158911,7 @@ function invokeRemoteHostHelper(options) {
   if (options.accessKeys) {
     request.accessKeys = options.accessKeys;
   }
+  if (options.db) request.db = options.db;
   if (options.verification) {
     request.verification = options.verification;
   }
@@ -158876,6 +158929,7 @@ function invokeRemoteHostHelper(options) {
     encoding: "utf8",
     ...String(options.action).startsWith("access-keys.") ? { maxBuffer: ACCESS_KEY_OPERATOR_PROCESS_MAX_BUFFER } : {},
     ...String(options.action).includes(".backup.") ? { maxBuffer: 16 * 1024 * 1024 } : {},
+    ...isDatabaseInspectionAction(options.action) ? { maxBuffer: DATABASE_INSPECTION_MAX_BUFFER } : {},
     input: `${JSON.stringify(request)}
 `
   });

package/dist/cli/cli-help.d.ts

@@ -25,7 +25,7 @@ Options:
     readonly monitoring: "Usage: sporades monitoring stack <init|validate|upgrade|rollback|backup|restore> [options]\n       sporades monitoring sender <issue|rotate|commit|cancel|revoke|export|status|legacy-revoke> [options]\n\nGenerate or inspect the versioned trace stack from an installed Sporades package.\nInitialization creates a reviewable directory; it does not start services.\nSender operations run locally on the Monitoring server; results contain no secrets.\nRotation stages a second generation; commit retires the old one after sender verification.\n\nOptions:\n  --dir <path>        Target stack directory (default: current directory)\n  --backup <path>     Protected cold snapshot directory (backup/restore)\n  --baseline <path>   Trusted prior release assets for a schema-3 upgrade\n  --sender <name>     Named sender for lifecycle operations (optional for status)\n  --host <identity>   Exact inventory Host scope (issue or legacy-revoke only)\n  --out <path>        New mode-0600 credential handoff file (export only)\n  --generation <n>    Verified pending generation to activate (commit only)\n  --ingest            Disable shared legacy ingestion (legacy-revoke only)\n  --json              Write { ok, data, error } JSON output\n  --help, -h          Show this help\n";
     readonly telemetry: "Usage: sporades telemetry profile <add|list|show|remove> [name] [options]\n\nRegister and inspect operator-owned OTLP/HTTP Telemetry profiles. Descriptors store only\ncredential environment and private CA file references; they never store secret values.\nDev sessions use --telemetry <name> first, then sporades.json telemetry.profile, then no export.\n\nOptions for profile add:\n  --endpoint <url>        OTLP/HTTP base origin (HTTPS, or HTTP loopback with --loopback)\n  --dashboard <url>       Optional dashboard HTTPS URL\n  --credential-env <KEY>  Environment variable containing the ingestion bearer token\n  --inventory-credential-env <KEY>  Exact Host-scoped lifecycle inventory token\n  --inventory-host <id>   Stable inventory identity (default: first connected domain)\n  --metrics-interval-ms <N>  Metrics export period, 5000-300000 ms (default 15000)\n  --trace-propagation-origin <origin>  Approve exact fetch origin (repeatable, max 32)\n  --event-loop-delay-resolution-ms <N>  Delay timer precision, 10-1000 ms (default 20)\n  --ca-file <path>        Absolute private CA certificate path for verified TLS\n  --loopback              Permit a local HTTP collector for development\n  --json                  Write { ok, data, error } JSON output\n  --help, -h              Show this help\n";
     readonly deploy: "Usage: sporades deploy [status|stop|restart|reconcile|remove|reset|ssh] [options]\n\nStart and manage a local Container session.\n\nCommands:\n  deploy              Start a local Container session\n  deploy status       Print Container session status\n  deploy stop         Stop the running Container session\n  deploy restart      Restart the running Container session\n  deploy policy publish <file>|remove\n                      Publish or remove the declared admission policy\n  deploy reconcile    Settle an interrupted deployment-file attempt\n  deploy ssh          Inspect effective Container SSH access\n  deploy remove       Remove the Container session\n  deploy reset        Remove the Container session and local container state\n\nOptions:\n  --port <number>     Published local port when starting\n  --telemetry <name>  Export HTTP traces using a registered Telemetry profile\n  --no-telemetry      Disable export for this Container session\n  --force             Replace stale or conflicting container state when starting\n  --json              Write JSON output\n  --help, -h          Show this help\n";
-    readonly host: "Usage: sporades host <command> [options]\n\nManage Host profiles and Hosted Capsules.\n\nProfile commands:\n  add <alias>         Add a Host profile\n  use <alias>         Set the default Host profile\n  current             Print the selected Host profile\n  bootstrap           Provision the remote Host server\n  upgrade             Copy the local Host helper to the Host server\n  health [subname]    Check Host server or Hosted Capsule health\n  services enable|disable|uninstall|status observability [--on <alias>]\n                      Manage pinned GlitchTip and Umami (opt-in)\n  services connect <subname> [--host <Capsule-host>] [--on <ops-host>]\n                      Seal configured error/analytics env; push to activate\n  services backup|backups observability [--on <alias>]\n                      Snapshot or list service databases using Host backup policy\n  services restore observability --id <snapshot> --confirm observability\n                      Restore disabled services; enable again after inspection\n  telemetry connect|migrate|reconcile|status|check\n  telemetry inventory-export|inventory-reconcile\n                      Manage the shared Host Telemetry relay\n  telemetry exports-disable|remove-agents\n                       Disable exports; remove agents after inventory acknowledgement\n  telemetry resources-enable|resources-disable|resources-remove\n                     Manage Host OS and Caddy collection independently of Capsules\n  telemetry enable|disable <subname>\n                      Change a Hosted Capsule's Telemetry opt-out\n\nCapsule commands:\n  backup configure --file <policy.json>\n                      Configure encrypted backups and an optional Host timer\n  backup create|list|prune --subname <name>\n                      Manage encrypted SQLite and files snapshots\n  backup restore --subname <source> --id <full-id> --confirm <destination>\n                      Restore a stopped Capsule; optionally --to-subname <destination>\n  backup status       Report last successful backup age for each Capsule\n  bind <subname>      Bind this project to a Hosted Capsule\n  register <subname>  Register a Hosted Capsule\n  canonical set <subname> <alias>|clear <subname>\n                      Select the public origin; restart a running Capsule\n  push                Push and install a Hosted Capsule release\n  start <subname>     Start a Hosted Capsule\n  stop <subname>      Stop a Hosted Capsule\n  restart <subname>   Restart a Hosted Capsule\n  policy publish <file>|remove --host <alias> --subname <name>\n                      Publish or remove the recorded admission policy\n  reconcile <subname> Settle an interrupted deployment-file attempt\n  ssh [subname]       Inspect effective Hosted Capsule SSH access\n  stats [subname]     Print Host server or Hosted Capsule stats\n  logs [source]       Print Hosted Capsule logs\n  releases <subname>  List Hosted Capsule releases\n  rollback <subname> <release-id>\n                      Roll back to a previous release\n  rotate-key <subname>\n                      Rotate Hosted Capsule Sealed Server env keys\n  unregister <subname>\n                      Unregister a Hosted Capsule\n  delete <subname>    Delete Hosted Capsule storage\n\nOther commands:\n  list                List Hosted Capsules\n  github workflow write\n                      Write a GitHub Actions deploy workflow\n  invoke <action>     Invoke a low-level remote Host helper action\n\nOptions:\n  --host <alias>      Host profile alias\n  --profile <name>    Verified HTTPS Telemetry profile for connect or migrate\n  --query-credential-env <name>\n                      Ephemeral operator user:password for check or migrate\n  --server <target>   SSH target for host add\n  --domain <domain>   Hosted domain for host add\n  --canonical-domain <hostname>\n                      Public HTTPS link origin for register\n  --alias-domain <hostname>\n                      Custom HTTPS domain for register (repeatable)\n  --remote-root <path>\n                      Remote root path for host add\n  --tls <mode>        TLS mode: automatic or cloudflare-origin\n  --subname <name>    Hosted Capsule subname\n  --lines <n>, -n <n> Log line count\n  --allow-missing-env  Push despite missing required Server env keys\n  --restart           Restart after host push\n  --verify            Verify release health after host push\n  --fallback-to-previous-release\n                      Roll back when verified push fails\n  --branch <name>     GitHub workflow branch\n  --file <path>       GitHub workflow output path\n  --dry-run           Print workflow without writing it\n  --force             Overwrite workflow output when writing it\n  --json              Write JSON output\n  --help, -h          Show this help\n";
+    readonly host: "Usage: sporades host <command> [options]\n\nManage Host profiles and Hosted Capsules.\n\nProfile commands:\n  add <alias>         Add a Host profile\n  use <alias>         Set the default Host profile\n  current             Print the selected Host profile\n  bootstrap           Provision the remote Host server\n  upgrade             Copy the local Host helper to the Host server\n  health [subname]    Check Host server or Hosted Capsule health\n  services enable|disable|uninstall|status observability [--on <alias>]\n                      Manage pinned GlitchTip and Umami (opt-in)\n  services connect <subname> [--host <Capsule-host>] [--on <ops-host>]\n                      Seal configured error/analytics env; push to activate\n  services backup|backups observability [--on <alias>]\n                      Snapshot or list service databases using Host backup policy\n  services restore observability --id <snapshot> --confirm observability\n                      Restore disabled services; enable again after inspection\n  telemetry connect|migrate|reconcile|status|check\n  telemetry inventory-export|inventory-reconcile\n                      Manage the shared Host Telemetry relay\n  telemetry exports-disable|remove-agents\n                       Disable exports; remove agents after inventory acknowledgement\n  telemetry resources-enable|resources-disable|resources-remove\n                     Manage Host OS and Caddy collection independently of Capsules\n  telemetry enable|disable <subname>\n                      Change a Hosted Capsule's Telemetry opt-out\n\nCapsule commands:\n  backup configure --file <policy.json>\n                      Configure encrypted backups and an optional Host timer\n  backup create|list|prune --subname <name>\n                      Manage encrypted SQLite and files snapshots\n  backup restore --subname <source> --id <full-id> --confirm <destination>\n                      Restore a stopped Capsule; optionally --to-subname <destination>\n  backup status       Report last successful backup age for each Capsule\n  bind <subname>      Bind this project to a Hosted Capsule\n  db list|dump|query <sql> [--subname <name>]\n                      Read a running Hosted Capsule's database over SSH\n  register <subname>  Register a Hosted Capsule\n  canonical set <subname> <alias>|clear <subname>\n                      Select the public origin; restart a running Capsule\n  push                Push and install a Hosted Capsule release\n  start <subname>     Start a Hosted Capsule\n  stop <subname>      Stop a Hosted Capsule\n  restart <subname>   Restart a Hosted Capsule\n  policy publish <file>|remove --host <alias> --subname <name>\n                      Publish or remove the recorded admission policy\n  reconcile <subname> Settle an interrupted deployment-file attempt\n  ssh [subname]       Inspect effective Hosted Capsule SSH access\n  stats [subname]     Print Host server or Hosted Capsule stats\n  logs [source]       Print Hosted Capsule logs\n  releases <subname>  List Hosted Capsule releases\n  rollback <subname> <release-id>\n                      Roll back to a previous release\n  rotate-key <subname>\n                      Rotate Hosted Capsule Sealed Server env keys\n  unregister <subname>\n                      Unregister a Hosted Capsule\n  delete <subname>    Delete Hosted Capsule storage\n\nOther commands:\n  list                List Hosted Capsules\n  github workflow write\n                      Write a GitHub Actions deploy workflow\n  invoke <action>     Invoke a low-level remote Host helper action\n\nOptions:\n  --host <alias>      Host profile alias\n  --profile <name>    Verified HTTPS Telemetry profile for connect or migrate\n  --query-credential-env <name>\n                      Ephemeral operator user:password for check or migrate\n  --server <target>   SSH target for host add\n  --domain <domain>   Hosted domain for host add\n  --canonical-domain <hostname>\n                      Public HTTPS link origin for register\n  --alias-domain <hostname>\n                      Custom HTTPS domain for register (repeatable)\n  --remote-root <path>\n                      Remote root path for host add\n  --tls <mode>        TLS mode: automatic or cloudflare-origin\n  --subname <name>    Hosted Capsule subname\n  --lines <n>, -n <n> Log line count\n  --allow-missing-env  Push despite missing required Server env keys\n  --restart           Restart after host push\n  --verify            Verify release health after host push\n  --fallback-to-previous-release\n                      Roll back when verified push fails\n  --branch <name>     GitHub workflow branch\n  --file <path>       GitHub workflow output path\n  --dry-run           Print workflow without writing it\n  --force             Overwrite workflow output when writing it\n  --json              Write JSON output\n  --help, -h          Show this help\n";
     readonly logs: "Usage: sporades logs [tail] [options]\n\nPrint Dev session logs.\n\nCommands:\n  logs                Print recent Dev session logs\n  logs tail           Follow Dev session logs\n\nOptions:\n  --port <number>     Target Dev session or local Container port\n  --json              Write JSON output\n  --help, -h          Show this help\n";
     readonly db: "Usage: sporades db <command> [options]\n\nInspect the Dev session database.\n\nCommands:\n  list                List database tables\n  dump                Dump database contents\n  query <sql>         Run a read-only SQL query\n\nOptions:\n  --port <number>     Target Dev session or local Container port\n  --json              Write JSON output\n  --help, -h          Show this help\n";
     readonly default: "Usage: sporades <command> [options]\n    \n    Commands:\n      stripe-fake    Run the local Team Billing test provider\n      create <name>  Scaffold a new Capsule\n      dev            Start a local Dev session\n      auth           Manage local auth configuration and simulation\n      access-keys    Inspect and retire Access keys through a running Capsule\n      security       Inspect effective Capsule security policy\n      doctor         Run read-only Sporades diagnostics\n      env            Manage Sealed Server env\n      monitoring     Generate and validate a monitoring stack\n      telemetry      Register operator Telemetry profiles\n      deploy         Start a local Container session\n      host           Manage Host profiles and Hosted Capsules\n      logs           Print Dev session logs\n      db             Inspect the Dev session database\n    \n    Options:\n      --help, -h     Show help for command\n      --version, -v  Show CLI version\n      --host <alias> Show Host server CLI version with --version\n      --json         Write JSON output when supported by the command\n    ";
@@ -46,6 +46,6 @@ Options:
   --no-git            Skip git initialization
   --json              Write JSON output
   --help, -h          Show this help
-` | "Usage: sporades dev [status|stop|reset] [options]\n\nStart and manage a local Dev session.\n\nCommands:\n  dev                 Start a Dev session\n  dev status          Print Dev session status\n  dev stop            Stop the running Dev session\n  dev reset           Stop the Dev session and remove local Dev state\n\nOptions:\n  --port <number>     Dev session port when starting\n  --public            Allow non-localhost access when starting\n  --telemetry <name>  Export HTTP traces using a registered Telemetry profile\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades auth <command> [options]\n\nManage local auth configuration and identity simulation.\n\nCommands:\n  status              Print auth provider status\n  clients             List connected Dev session clients\n  set <provider>      Configure or disable anonymous, email, Google, Microsoft, Apple, or Facebook\n  as email            Simulate a local email identity\n\nOptions:\n  --client-id <id>        OAuth client/app ID (Apple Services ID)\n  --client-secret <secret> OAuth client/app secret\n  --client-json <path>    Read provider-specific credentials JSON\n  --tenant <tenant>       Microsoft tenant (default: common)\n  --team-id <id>          Apple Developer Team ID\n  --key-id <id>           Apple Sign in key ID\n  --private-key <pem>     Apple private key (stored only in Server env)\n  --graph-version <name>  Facebook Graph API version\n  --disable               Disable the selected provider without changing siblings\n  --email <address>       Simulated email identity\n  --display-name <name>   Simulated display name\n  --picture <url>         Simulated profile picture URL\n  --port <number>         Target Dev session port\n  --client <target>       Delivery target: current, all, or a client ID\n  --json                  Write JSON output\n  --help, -h              Show this help\n" | "Usage: sporades access-keys <command> [options]\n\nInspect and retire Access keys through a running Capsule.\n\nCommands:\n  list --user-id <id>       List one owner's Access-key metadata\n  inspect <key-id>          Inspect one Access key\n  revoke <key-id>           Revoke one Access key\n  revoke-all --user-id <id> Revoke one owner's current Access keys\n  delete <key-id>           Delete revoked Access-key history\n\nOptions:\n  --session <name>    Session: dev, container, or hosted (default: dev)\n  --host <alias>      Host profile alias for a Hosted Capsule\n  --subname <name>    Hosted Capsule subname\n  --cursor <cursor>   Opaque list cursor\n  --limit <n>         List page size from 1 through 100\n  --status <status>   List active, expired, or revoked keys\n  --yes               Explicitly approve a destructive operation\n  --json              Write structured JSON; does not imply consent\n  --help, -h          Show this help\n" | "Usage: sporades security [options]\n\nInspect effective Capsule security policy.\n\nOptions:\n  --session <name>    Session: dev, public-dev, container, or hosted\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades doctor [options]\n\nRun read-only Sporades diagnostics.\n\nOptions:\n  --session <name>    Session: dev, public-dev, container, or hosted\n  --host <alias>      Host profile alias for Hosted Capsule checks\n  --subname <name>    Hosted Capsule subname\n  --strict            Exit non-zero on warnings as well as failures\n  --json              Write structured JSON output\n  --help, -h          Show this help\n" | "Usage: sporades env <command> [options]\n\nManage Sealed Server env.\n\nCommands:\n  set <name>          Read one value from stdin and seal it\n  has <name>          Test whether a Server env key is defined\n  init                Create local Sealed Server env key material\n  import              Import Server env values from a file\n  status              Print Sealed Server env status\n  export              Export Sealed Server env for a Host profile\n  reencrypt           Re-encrypt local Sealed Server env material\n\nOptions:\n  --stdin             Read the value for env set from stdin\n  --file <path>       Input file for import or export\n  --host <alias>      Host profile alias\n  --subname <name>    Hosted Capsule subname\n  --output <path>     Export output path\n  --sealed            Treat input as an already sealed export\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades monitoring stack <init|validate|upgrade|rollback|backup|restore> [options]\n       sporades monitoring sender <issue|rotate|commit|cancel|revoke|export|status|legacy-revoke> [options]\n\nGenerate or inspect the versioned trace stack from an installed Sporades package.\nInitialization creates a reviewable directory; it does not start services.\nSender operations run locally on the Monitoring server; results contain no secrets.\nRotation stages a second generation; commit retires the old one after sender verification.\n\nOptions:\n  --dir <path>        Target stack directory (default: current directory)\n  --backup <path>     Protected cold snapshot directory (backup/restore)\n  --baseline <path>   Trusted prior release assets for a schema-3 upgrade\n  --sender <name>     Named sender for lifecycle operations (optional for status)\n  --host <identity>   Exact inventory Host scope (issue or legacy-revoke only)\n  --out <path>        New mode-0600 credential handoff file (export only)\n  --generation <n>    Verified pending generation to activate (commit only)\n  --ingest            Disable shared legacy ingestion (legacy-revoke only)\n  --json              Write { ok, data, error } JSON output\n  --help, -h          Show this help\n" | "Usage: sporades telemetry profile <add|list|show|remove> [name] [options]\n\nRegister and inspect operator-owned OTLP/HTTP Telemetry profiles. Descriptors store only\ncredential environment and private CA file references; they never store secret values.\nDev sessions use --telemetry <name> first, then sporades.json telemetry.profile, then no export.\n\nOptions for profile add:\n  --endpoint <url>        OTLP/HTTP base origin (HTTPS, or HTTP loopback with --loopback)\n  --dashboard <url>       Optional dashboard HTTPS URL\n  --credential-env <KEY>  Environment variable containing the ingestion bearer token\n  --inventory-credential-env <KEY>  Exact Host-scoped lifecycle inventory token\n  --inventory-host <id>   Stable inventory identity (default: first connected domain)\n  --metrics-interval-ms <N>  Metrics export period, 5000-300000 ms (default 15000)\n  --trace-propagation-origin <origin>  Approve exact fetch origin (repeatable, max 32)\n  --event-loop-delay-resolution-ms <N>  Delay timer precision, 10-1000 ms (default 20)\n  --ca-file <path>        Absolute private CA certificate path for verified TLS\n  --loopback              Permit a local HTTP collector for development\n  --json                  Write { ok, data, error } JSON output\n  --help, -h              Show this help\n" | "Usage: sporades deploy [status|stop|restart|reconcile|remove|reset|ssh] [options]\n\nStart and manage a local Container session.\n\nCommands:\n  deploy              Start a local Container session\n  deploy status       Print Container session status\n  deploy stop         Stop the running Container session\n  deploy restart      Restart the running Container session\n  deploy policy publish <file>|remove\n                      Publish or remove the declared admission policy\n  deploy reconcile    Settle an interrupted deployment-file attempt\n  deploy ssh          Inspect effective Container SSH access\n  deploy remove       Remove the Container session\n  deploy reset        Remove the Container session and local container state\n\nOptions:\n  --port <number>     Published local port when starting\n  --telemetry <name>  Export HTTP traces using a registered Telemetry profile\n  --no-telemetry      Disable export for this Container session\n  --force             Replace stale or conflicting container state when starting\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades host <command> [options]\n\nManage Host profiles and Hosted Capsules.\n\nProfile commands:\n  add <alias>         Add a Host profile\n  use <alias>         Set the default Host profile\n  current             Print the selected Host profile\n  bootstrap           Provision the remote Host server\n  upgrade             Copy the local Host helper to the Host server\n  health [subname]    Check Host server or Hosted Capsule health\n  services enable|disable|uninstall|status observability [--on <alias>]\n                      Manage pinned GlitchTip and Umami (opt-in)\n  services connect <subname> [--host <Capsule-host>] [--on <ops-host>]\n                      Seal configured error/analytics env; push to activate\n  services backup|backups observability [--on <alias>]\n                      Snapshot or list service databases using Host backup policy\n  services restore observability --id <snapshot> --confirm observability\n                      Restore disabled services; enable again after inspection\n  telemetry connect|migrate|reconcile|status|check\n  telemetry inventory-export|inventory-reconcile\n                      Manage the shared Host Telemetry relay\n  telemetry exports-disable|remove-agents\n                       Disable exports; remove agents after inventory acknowledgement\n  telemetry resources-enable|resources-disable|resources-remove\n                     Manage Host OS and Caddy collection independently of Capsules\n  telemetry enable|disable <subname>\n                      Change a Hosted Capsule's Telemetry opt-out\n\nCapsule commands:\n  backup configure --file <policy.json>\n                      Configure encrypted backups and an optional Host timer\n  backup create|list|prune --subname <name>\n                      Manage encrypted SQLite and files snapshots\n  backup restore --subname <source> --id <full-id> --confirm <destination>\n                      Restore a stopped Capsule; optionally --to-subname <destination>\n  backup status       Report last successful backup age for each Capsule\n  bind <subname>      Bind this project to a Hosted Capsule\n  register <subname>  Register a Hosted Capsule\n  canonical set <subname> <alias>|clear <subname>\n                      Select the public origin; restart a running Capsule\n  push                Push and install a Hosted Capsule release\n  start <subname>     Start a Hosted Capsule\n  stop <subname>      Stop a Hosted Capsule\n  restart <subname>   Restart a Hosted Capsule\n  policy publish <file>|remove --host <alias> --subname <name>\n                      Publish or remove the recorded admission policy\n  reconcile <subname> Settle an interrupted deployment-file attempt\n  ssh [subname]       Inspect effective Hosted Capsule SSH access\n  stats [subname]     Print Host server or Hosted Capsule stats\n  logs [source]       Print Hosted Capsule logs\n  releases <subname>  List Hosted Capsule releases\n  rollback <subname> <release-id>\n                      Roll back to a previous release\n  rotate-key <subname>\n                      Rotate Hosted Capsule Sealed Server env keys\n  unregister <subname>\n                      Unregister a Hosted Capsule\n  delete <subname>    Delete Hosted Capsule storage\n\nOther commands:\n  list                List Hosted Capsules\n  github workflow write\n                      Write a GitHub Actions deploy workflow\n  invoke <action>     Invoke a low-level remote Host helper action\n\nOptions:\n  --host <alias>      Host profile alias\n  --profile <name>    Verified HTTPS Telemetry profile for connect or migrate\n  --query-credential-env <name>\n                      Ephemeral operator user:password for check or migrate\n  --server <target>   SSH target for host add\n  --domain <domain>   Hosted domain for host add\n  --canonical-domain <hostname>\n                      Public HTTPS link origin for register\n  --alias-domain <hostname>\n                      Custom HTTPS domain for register (repeatable)\n  --remote-root <path>\n                      Remote root path for host add\n  --tls <mode>        TLS mode: automatic or cloudflare-origin\n  --subname <name>    Hosted Capsule subname\n  --lines <n>, -n <n> Log line count\n  --allow-missing-env  Push despite missing required Server env keys\n  --restart           Restart after host push\n  --verify            Verify release health after host push\n  --fallback-to-previous-release\n                      Roll back when verified push fails\n  --branch <name>     GitHub workflow branch\n  --file <path>       GitHub workflow output path\n  --dry-run           Print workflow without writing it\n  --force             Overwrite workflow output when writing it\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades logs [tail] [options]\n\nPrint Dev session logs.\n\nCommands:\n  logs                Print recent Dev session logs\n  logs tail           Follow Dev session logs\n\nOptions:\n  --port <number>     Target Dev session or local Container port\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades db <command> [options]\n\nInspect the Dev session database.\n\nCommands:\n  list                List database tables\n  dump                Dump database contents\n  query <sql>         Run a read-only SQL query\n\nOptions:\n  --port <number>     Target Dev session or local Container port\n  --json              Write JSON output\n  --help, -h          Show this help\n";
+` | "Usage: sporades dev [status|stop|reset] [options]\n\nStart and manage a local Dev session.\n\nCommands:\n  dev                 Start a Dev session\n  dev status          Print Dev session status\n  dev stop            Stop the running Dev session\n  dev reset           Stop the Dev session and remove local Dev state\n\nOptions:\n  --port <number>     Dev session port when starting\n  --public            Allow non-localhost access when starting\n  --telemetry <name>  Export HTTP traces using a registered Telemetry profile\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades auth <command> [options]\n\nManage local auth configuration and identity simulation.\n\nCommands:\n  status              Print auth provider status\n  clients             List connected Dev session clients\n  set <provider>      Configure or disable anonymous, email, Google, Microsoft, Apple, or Facebook\n  as email            Simulate a local email identity\n\nOptions:\n  --client-id <id>        OAuth client/app ID (Apple Services ID)\n  --client-secret <secret> OAuth client/app secret\n  --client-json <path>    Read provider-specific credentials JSON\n  --tenant <tenant>       Microsoft tenant (default: common)\n  --team-id <id>          Apple Developer Team ID\n  --key-id <id>           Apple Sign in key ID\n  --private-key <pem>     Apple private key (stored only in Server env)\n  --graph-version <name>  Facebook Graph API version\n  --disable               Disable the selected provider without changing siblings\n  --email <address>       Simulated email identity\n  --display-name <name>   Simulated display name\n  --picture <url>         Simulated profile picture URL\n  --port <number>         Target Dev session port\n  --client <target>       Delivery target: current, all, or a client ID\n  --json                  Write JSON output\n  --help, -h              Show this help\n" | "Usage: sporades access-keys <command> [options]\n\nInspect and retire Access keys through a running Capsule.\n\nCommands:\n  list --user-id <id>       List one owner's Access-key metadata\n  inspect <key-id>          Inspect one Access key\n  revoke <key-id>           Revoke one Access key\n  revoke-all --user-id <id> Revoke one owner's current Access keys\n  delete <key-id>           Delete revoked Access-key history\n\nOptions:\n  --session <name>    Session: dev, container, or hosted (default: dev)\n  --host <alias>      Host profile alias for a Hosted Capsule\n  --subname <name>    Hosted Capsule subname\n  --cursor <cursor>   Opaque list cursor\n  --limit <n>         List page size from 1 through 100\n  --status <status>   List active, expired, or revoked keys\n  --yes               Explicitly approve a destructive operation\n  --json              Write structured JSON; does not imply consent\n  --help, -h          Show this help\n" | "Usage: sporades security [options]\n\nInspect effective Capsule security policy.\n\nOptions:\n  --session <name>    Session: dev, public-dev, container, or hosted\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades doctor [options]\n\nRun read-only Sporades diagnostics.\n\nOptions:\n  --session <name>    Session: dev, public-dev, container, or hosted\n  --host <alias>      Host profile alias for Hosted Capsule checks\n  --subname <name>    Hosted Capsule subname\n  --strict            Exit non-zero on warnings as well as failures\n  --json              Write structured JSON output\n  --help, -h          Show this help\n" | "Usage: sporades env <command> [options]\n\nManage Sealed Server env.\n\nCommands:\n  set <name>          Read one value from stdin and seal it\n  has <name>          Test whether a Server env key is defined\n  init                Create local Sealed Server env key material\n  import              Import Server env values from a file\n  status              Print Sealed Server env status\n  export              Export Sealed Server env for a Host profile\n  reencrypt           Re-encrypt local Sealed Server env material\n\nOptions:\n  --stdin             Read the value for env set from stdin\n  --file <path>       Input file for import or export\n  --host <alias>      Host profile alias\n  --subname <name>    Hosted Capsule subname\n  --output <path>     Export output path\n  --sealed            Treat input as an already sealed export\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades monitoring stack <init|validate|upgrade|rollback|backup|restore> [options]\n       sporades monitoring sender <issue|rotate|commit|cancel|revoke|export|status|legacy-revoke> [options]\n\nGenerate or inspect the versioned trace stack from an installed Sporades package.\nInitialization creates a reviewable directory; it does not start services.\nSender operations run locally on the Monitoring server; results contain no secrets.\nRotation stages a second generation; commit retires the old one after sender verification.\n\nOptions:\n  --dir <path>        Target stack directory (default: current directory)\n  --backup <path>     Protected cold snapshot directory (backup/restore)\n  --baseline <path>   Trusted prior release assets for a schema-3 upgrade\n  --sender <name>     Named sender for lifecycle operations (optional for status)\n  --host <identity>   Exact inventory Host scope (issue or legacy-revoke only)\n  --out <path>        New mode-0600 credential handoff file (export only)\n  --generation <n>    Verified pending generation to activate (commit only)\n  --ingest            Disable shared legacy ingestion (legacy-revoke only)\n  --json              Write { ok, data, error } JSON output\n  --help, -h          Show this help\n" | "Usage: sporades telemetry profile <add|list|show|remove> [name] [options]\n\nRegister and inspect operator-owned OTLP/HTTP Telemetry profiles. Descriptors store only\ncredential environment and private CA file references; they never store secret values.\nDev sessions use --telemetry <name> first, then sporades.json telemetry.profile, then no export.\n\nOptions for profile add:\n  --endpoint <url>        OTLP/HTTP base origin (HTTPS, or HTTP loopback with --loopback)\n  --dashboard <url>       Optional dashboard HTTPS URL\n  --credential-env <KEY>  Environment variable containing the ingestion bearer token\n  --inventory-credential-env <KEY>  Exact Host-scoped lifecycle inventory token\n  --inventory-host <id>   Stable inventory identity (default: first connected domain)\n  --metrics-interval-ms <N>  Metrics export period, 5000-300000 ms (default 15000)\n  --trace-propagation-origin <origin>  Approve exact fetch origin (repeatable, max 32)\n  --event-loop-delay-resolution-ms <N>  Delay timer precision, 10-1000 ms (default 20)\n  --ca-file <path>        Absolute private CA certificate path for verified TLS\n  --loopback              Permit a local HTTP collector for development\n  --json                  Write { ok, data, error } JSON output\n  --help, -h              Show this help\n" | "Usage: sporades deploy [status|stop|restart|reconcile|remove|reset|ssh] [options]\n\nStart and manage a local Container session.\n\nCommands:\n  deploy              Start a local Container session\n  deploy status       Print Container session status\n  deploy stop         Stop the running Container session\n  deploy restart      Restart the running Container session\n  deploy policy publish <file>|remove\n                      Publish or remove the declared admission policy\n  deploy reconcile    Settle an interrupted deployment-file attempt\n  deploy ssh          Inspect effective Container SSH access\n  deploy remove       Remove the Container session\n  deploy reset        Remove the Container session and local container state\n\nOptions:\n  --port <number>     Published local port when starting\n  --telemetry <name>  Export HTTP traces using a registered Telemetry profile\n  --no-telemetry      Disable export for this Container session\n  --force             Replace stale or conflicting container state when starting\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades host <command> [options]\n\nManage Host profiles and Hosted Capsules.\n\nProfile commands:\n  add <alias>         Add a Host profile\n  use <alias>         Set the default Host profile\n  current             Print the selected Host profile\n  bootstrap           Provision the remote Host server\n  upgrade             Copy the local Host helper to the Host server\n  health [subname]    Check Host server or Hosted Capsule health\n  services enable|disable|uninstall|status observability [--on <alias>]\n                      Manage pinned GlitchTip and Umami (opt-in)\n  services connect <subname> [--host <Capsule-host>] [--on <ops-host>]\n                      Seal configured error/analytics env; push to activate\n  services backup|backups observability [--on <alias>]\n                      Snapshot or list service databases using Host backup policy\n  services restore observability --id <snapshot> --confirm observability\n                      Restore disabled services; enable again after inspection\n  telemetry connect|migrate|reconcile|status|check\n  telemetry inventory-export|inventory-reconcile\n                      Manage the shared Host Telemetry relay\n  telemetry exports-disable|remove-agents\n                       Disable exports; remove agents after inventory acknowledgement\n  telemetry resources-enable|resources-disable|resources-remove\n                     Manage Host OS and Caddy collection independently of Capsules\n  telemetry enable|disable <subname>\n                      Change a Hosted Capsule's Telemetry opt-out\n\nCapsule commands:\n  backup configure --file <policy.json>\n                      Configure encrypted backups and an optional Host timer\n  backup create|list|prune --subname <name>\n                      Manage encrypted SQLite and files snapshots\n  backup restore --subname <source> --id <full-id> --confirm <destination>\n                      Restore a stopped Capsule; optionally --to-subname <destination>\n  backup status       Report last successful backup age for each Capsule\n  bind <subname>      Bind this project to a Hosted Capsule\n  db list|dump|query <sql> [--subname <name>]\n                      Read a running Hosted Capsule's database over SSH\n  register <subname>  Register a Hosted Capsule\n  canonical set <subname> <alias>|clear <subname>\n                      Select the public origin; restart a running Capsule\n  push                Push and install a Hosted Capsule release\n  start <subname>     Start a Hosted Capsule\n  stop <subname>      Stop a Hosted Capsule\n  restart <subname>   Restart a Hosted Capsule\n  policy publish <file>|remove --host <alias> --subname <name>\n                      Publish or remove the recorded admission policy\n  reconcile <subname> Settle an interrupted deployment-file attempt\n  ssh [subname]       Inspect effective Hosted Capsule SSH access\n  stats [subname]     Print Host server or Hosted Capsule stats\n  logs [source]       Print Hosted Capsule logs\n  releases <subname>  List Hosted Capsule releases\n  rollback <subname> <release-id>\n                      Roll back to a previous release\n  rotate-key <subname>\n                      Rotate Hosted Capsule Sealed Server env keys\n  unregister <subname>\n                      Unregister a Hosted Capsule\n  delete <subname>    Delete Hosted Capsule storage\n\nOther commands:\n  list                List Hosted Capsules\n  github workflow write\n                      Write a GitHub Actions deploy workflow\n  invoke <action>     Invoke a low-level remote Host helper action\n\nOptions:\n  --host <alias>      Host profile alias\n  --profile <name>    Verified HTTPS Telemetry profile for connect or migrate\n  --query-credential-env <name>\n                      Ephemeral operator user:password for check or migrate\n  --server <target>   SSH target for host add\n  --domain <domain>   Hosted domain for host add\n  --canonical-domain <hostname>\n                      Public HTTPS link origin for register\n  --alias-domain <hostname>\n                      Custom HTTPS domain for register (repeatable)\n  --remote-root <path>\n                      Remote root path for host add\n  --tls <mode>        TLS mode: automatic or cloudflare-origin\n  --subname <name>    Hosted Capsule subname\n  --lines <n>, -n <n> Log line count\n  --allow-missing-env  Push despite missing required Server env keys\n  --restart           Restart after host push\n  --verify            Verify release health after host push\n  --fallback-to-previous-release\n                      Roll back when verified push fails\n  --branch <name>     GitHub workflow branch\n  --file <path>       GitHub workflow output path\n  --dry-run           Print workflow without writing it\n  --force             Overwrite workflow output when writing it\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades logs [tail] [options]\n\nPrint Dev session logs.\n\nCommands:\n  logs                Print recent Dev session logs\n  logs tail           Follow Dev session logs\n\nOptions:\n  --port <number>     Target Dev session or local Container port\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades db <command> [options]\n\nInspect the Dev session database.\n\nCommands:\n  list                List database tables\n  dump                Dump database contents\n  query <sql>         Run a read-only SQL query\n\nOptions:\n  --port <number>     Target Dev session or local Container port\n  --json              Write JSON output\n  --help, -h          Show this help\n";
 export {};
 //# sourceMappingURL=cli-help.d.ts.map

package/dist/cli/cli-help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-help.d.ts","sourceRoot":"","sources":["../../src/cli/cli-help.ts"],"names":[],"mappings":"AAMA,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+VL,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,OAAO,SAAS,EAAE,SAAS,CAAC,CAAC;AAErE,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;s6aAE7C"}
+{"version":3,"file":"cli-help.d.ts","sourceRoot":"","sources":["../../src/cli/cli-help.ts"],"names":[],"mappings":"AAMA,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiWL,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,OAAO,SAAS,EAAE,SAAS,CAAC,CAAC;AAErE,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;8hbAE7C"}

package/dist/cli/cli-help.js

@@ -246,6 +246,8 @@ Capsule commands:
                       Restore a stopped Capsule; optionally --to-subname <destination>
   backup status       Report last successful backup age for each Capsule
   bind <subname>      Bind this project to a Hosted Capsule
+  db list|dump|query <sql> [--subname <name>]
+                      Read a running Hosted Capsule's database over SSH
   register <subname>  Register a Hosted Capsule
   canonical set <subname> <alias>|clear <subname>
                       Select the public origin; restart a running Capsule

package/dist/cli/cli-help.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../../src/cli/cli-help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnG,MAAM,aAAa,GAAG,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AACnJ,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnH,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAElF,MAAM,SAAS,GAAG;IAChB,aAAa,EAAE;;;;;;;;;;;;;CAahB;IACC,MAAM,EAAE;;;;;;;;0CAQgC,aAAa;0CACb,aAAa;kCACrB,YAAY;;;;;CAK7C;IACC,GAAG,EAAE;;;;;;;;;;;;;;;;CAgBN;IACC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BP;IACC,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;CAqBhB;IACC,QAAQ,EAAE;;;;;;;;CAQX;IACC,MAAM,EAAE;;;;;;;;;;;CAWT;IACC,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsBN;IACC,UAAU,EAAE;;;;;;;;;;;;;;;;;;;CAmBb;IACC,SAAS,EAAE;;;;;;;;;;;;;;;;;;;CAmBZ;IACC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;CAuBT;IACC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6FP;IACC,IAAI,EAAE;;;;;;;;;;;;CAYP;IACC,EAAE,EAAE;;;;;;;;;;;;;CAaL;IACC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;KAuBN;CACK,CAAC;AAIX,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,SAAS,CAAC,OAAyB,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC;AACnE,CAAC"}
+{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../../src/cli/cli-help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnG,MAAM,aAAa,GAAG,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AACnJ,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnH,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAElF,MAAM,SAAS,GAAG;IAChB,aAAa,EAAE;;;;;;;;;;;;;CAahB;IACC,MAAM,EAAE;;;;;;;;0CAQgC,aAAa;0CACb,aAAa;kCACrB,YAAY;;;;;CAK7C;IACC,GAAG,EAAE;;;;;;;;;;;;;;;;CAgBN;IACC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BP;IACC,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;CAqBhB;IACC,QAAQ,EAAE;;;;;;;;CAQX;IACC,MAAM,EAAE;;;;;;;;;;;CAWT;IACC,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsBN;IACC,UAAU,EAAE;;;;;;;;;;;;;;;;;;;CAmBb;IACC,SAAS,EAAE;;;;;;;;;;;;;;;;;;;CAmBZ;IACC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;CAuBT;IACC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+FP;IACC,IAAI,EAAE;;;;;;;;;;;;CAYP;IACC,EAAE,EAAE;;;;;;;;;;;;;CAaL;IACC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;KAuBN;CACK,CAAC;AAIX,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,SAAS,CAAC,OAAyB,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC;AACnE,CAAC"}

package/dist/cli/cli-version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.9.38";
+export declare const CLI_VERSION = "0.9.39";
 //# sourceMappingURL=cli-version.d.ts.map

package/dist/cli/cli-version.js

@@ -1,3 +1,3 @@
 // Generated by `npm run build` from package.json. Do not edit by hand.
-export const CLI_VERSION = "0.9.38";
+export const CLI_VERSION = "0.9.39";
 //# sourceMappingURL=cli-version.js.map

package/dist/cli/database-inspection-envelope.d.ts

@@ -0,0 +1,9 @@
+type LooseRecord = Record<string, any>;
+export declare const DATABASE_INSPECTION_ACTIONS: readonly ["db.list", "db.dump", "db.query"];
+export type DatabaseInspectionAction = (typeof DATABASE_INSPECTION_ACTIONS)[number];
+export declare function encodeDatabaseInspectionInput(sql: string): string | null;
+export declare const DATABASE_INSPECTION_MAX_BUFFER: number;
+export declare function isDatabaseInspectionAction(action: unknown): action is DatabaseInspectionAction;
+export declare function sanitizeDatabaseInspectionEnvelope(action: DatabaseInspectionAction, envelope: LooseRecord, invalid: () => never): LooseRecord;
+export {};
+//# sourceMappingURL=database-inspection-envelope.d.ts.map

package/dist/cli/database-inspection-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-inspection-envelope.d.ts","sourceRoot":"","sources":["../../src/cli/database-inspection-envelope.ts"],"names":[],"mappings":"AAIA,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAEvC,eAAO,MAAM,2BAA2B,6CAA8C,CAAC;AACvF,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAOpF,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,MAAM,iBAGxD;AAID,eAAO,MAAM,8BAA8B,QAAoB,CAAC;AAEhE,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,wBAAwB,CAE9F;AAED,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,wBAAwB,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,KAAK,GAAG,WAAW,CAqB7I"}

package/dist/cli/database-inspection-envelope.js

@@ -0,0 +1,38 @@
+export const DATABASE_INSPECTION_ACTIONS = ["db.list", "db.dump", "db.query"];
+// The Bundle refuses `--sporades-action-input` over 24 KiB of base64url, so SQL whose encoded
+// input is larger could not reach the read-only gate in one piece. Measuring the encoded form, not
+// the raw SQL, keeps heavily escaped SQL from passing here and failing as malformed input there.
+const DATABASE_INSPECTION_INPUT_BYTE_LIMIT = 24 * 1024;
+export function encodeDatabaseInspectionInput(sql) {
+    const encoded = Buffer.from(JSON.stringify({ sql }), "utf8").toString("base64url");
+    return encoded.length <= DATABASE_INSPECTION_INPUT_BYTE_LIMIT ? encoded : null;
+}
+// A dump answers with every inspectable row, so its frame is bounded by the Capsule's data rather
+// than by Sporades. This is the ceiling on what one SSH or `docker exec` hop will buffer.
+export const DATABASE_INSPECTION_MAX_BUFFER = 128 * 1024 * 1024;
+export function isDatabaseInspectionAction(action) {
+    return DATABASE_INSPECTION_ACTIONS.includes(action);
+}
+export function sanitizeDatabaseInspectionEnvelope(action, envelope, invalid) {
+    const data = envelope?.data;
+    if (envelope?.ok === true && data && typeof data === "object" && !Array.isArray(data)) {
+        if (action === "db.query" && Array.isArray(data.columns) && Array.isArray(data.rows)) {
+            return { ok: true, data: { columns: data.columns, rows: data.rows }, error: null };
+        }
+        if (action !== "db.query" && Array.isArray(data.tables)) {
+            return { ok: true, data: { tables: data.tables }, error: null };
+        }
+    }
+    if (envelope?.ok === false && typeof envelope.error?.message === "string") {
+        return {
+            ok: false,
+            data: null,
+            error: {
+                message: envelope.error.message,
+                hint: typeof envelope.error.hint === "string" ? envelope.error.hint : "Check the SQL and retry the command.",
+            },
+        };
+    }
+    return invalid();
+}
+//# sourceMappingURL=database-inspection-envelope.js.map

package/dist/cli/database-inspection-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-inspection-envelope.js","sourceRoot":"","sources":["../../src/cli/database-inspection-envelope.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AAGvF,8FAA8F;AAC9F,mGAAmG;AACnG,iGAAiG;AACjG,MAAM,oCAAoC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD,MAAM,UAAU,6BAA6B,CAAC,GAAW;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnF,OAAO,OAAO,CAAC,MAAM,IAAI,oCAAoC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAED,kGAAkG;AAClG,0FAA0F;AAC1F,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhE,MAAM,UAAU,0BAA0B,CAAC,MAAe;IACxD,OAAQ,2BAAkD,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,MAAgC,EAAE,QAAqB,EAAE,OAAoB;IAC9H,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,CAAC;IAC5B,IAAI,QAAQ,EAAE,EAAE,KAAK,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtF,IAAI,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,EAAE,KAAK,KAAK,IAAI,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,IAAI;YACV,KAAK,EAAE;gBACL,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;gBAC/B,IAAI,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,sCAAsC;aAC7G;SACF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC"}

package/dist/cli/host-helper-requests.d.ts

@@ -1,7 +1,7 @@
 import type { DeployFile } from "../deploy-files.js";
 import type { JsonObject, JsonValue } from "./host-helper-json.js";
 import type { HostHelperCapsuleTarget, HostHelperHost, HostHelperSealedServerEnv, HostLifecycleOptions, HostedCapsuleBaseImage, HostTlsMode } from "./hosted-capsule-contract.js";
-export type HostHelperAction = "host.services.enable" | "host.services.disable" | "host.services.uninstall" | "host.services.status" | "host.services.connect" | "host.services.backup" | "host.services.backups" | "host.services.prune" | "host.services.restore" | "capsule.backup.create" | "capsule.backup.list" | "capsule.backup.restore" | "capsule.backup.prune" | "host.backup.configure" | "host.backup.status" | "capsule.canonical.set" | "capsule.register" | "capsule.sealed-env.rotate-key" | "capsule.unregister" | "capsule.delete" | "capsule.release.install" | "capsule.release.list" | "capsule.release.rollback" | "capsule.release.reconcile" | "capsule.shutdown.checkpoint" | "capsule.resume" | "capsule.start" | "capsule.stop" | "capsule.admission.publish" | "capsule.restart" | "capsule.stats" | "capsule.ssh" | "capsule.health" | "jobs.inspect" | "schedules.inspect" | "access-keys.list" | "access-keys.inspect" | "access-keys.revoke" | "access-keys.revoke-all" | "access-keys.delete" | "capsule.list" | "host.stats" | "host.logs" | "host.version" | "host.bootstrap" | "host.telemetry.migrate" | "host.telemetry.connect" | "host.telemetry.reconcile" | "host.telemetry.status" | "host.telemetry.check" | "host.telemetry.exports-disable" | "host.telemetry.remove-agents" | "host.telemetry.inventory-export" | "host.telemetry.inventory-reconcile" | "host.telemetry.enable" | "host.telemetry.resources-enable" | "host.telemetry.resources-disable" | "host.telemetry.resources-remove" | "host.telemetry.disable";
+export type HostHelperAction = "host.services.enable" | "host.services.disable" | "host.services.uninstall" | "host.services.status" | "host.services.connect" | "host.services.backup" | "host.services.backups" | "host.services.prune" | "host.services.restore" | "capsule.backup.create" | "capsule.backup.list" | "capsule.backup.restore" | "capsule.backup.prune" | "host.backup.configure" | "host.backup.status" | "capsule.canonical.set" | "capsule.register" | "capsule.sealed-env.rotate-key" | "capsule.unregister" | "capsule.delete" | "capsule.release.install" | "capsule.release.list" | "capsule.release.rollback" | "capsule.release.reconcile" | "capsule.shutdown.checkpoint" | "capsule.resume" | "capsule.start" | "capsule.stop" | "capsule.admission.publish" | "capsule.restart" | "capsule.stats" | "capsule.ssh" | "capsule.health" | "jobs.inspect" | "schedules.inspect" | "db.list" | "db.dump" | "db.query" | "access-keys.list" | "access-keys.inspect" | "access-keys.revoke" | "access-keys.revoke-all" | "access-keys.delete" | "capsule.list" | "host.stats" | "host.logs" | "host.version" | "host.bootstrap" | "host.telemetry.migrate" | "host.telemetry.connect" | "host.telemetry.reconcile" | "host.telemetry.status" | "host.telemetry.check" | "host.telemetry.exports-disable" | "host.telemetry.remove-agents" | "host.telemetry.inventory-export" | "host.telemetry.inventory-reconcile" | "host.telemetry.enable" | "host.telemetry.resources-enable" | "host.telemetry.resources-disable" | "host.telemetry.resources-remove" | "host.telemetry.disable";
 export type HostHelperVerification = JsonObject & {
     enabled?: boolean;
     fallbackToPreviousRelease?: boolean;
@@ -200,6 +200,16 @@ export type HostSchedulesInspectRequest = HostHelperRequestBase & {
     action: "schedules.inspect";
     capsule: HostHelperCapsuleTarget;
 };
+export type HostDatabaseInspectRequest = HostHelperRequestBase & ({
+    action: "db.list" | "db.dump";
+    capsule: HostHelperCapsuleTarget;
+} | {
+    action: "db.query";
+    capsule: HostHelperCapsuleTarget;
+    db: {
+        sql: string;
+    };
+});
 export type HostAccessKeyRequest = HostHelperRequestBase & {
     action: "access-keys.list" | "access-keys.inspect" | "access-keys.revoke" | "access-keys.revoke-all" | "access-keys.delete";
     capsule: HostHelperCapsuleTarget;
@@ -222,7 +232,7 @@ export type HostHelperRequest = (HostHelperRequestBase & {
     canonical: {
         domain: string | null;
     };
-}) | HostAdmissionPublishRequest | HostBootstrapRequest | HostRegistrationRequest | HostSealedEnvRotationRequest | HostUnregisterRequest | HostDeleteRequest | HostReleaseInstallRequest | HostReleaseListRequest | HostReleaseRollbackRequest | HostLifecycleRequest | HostStatsRequest | HostSshRequest | HostHealthRequest | HostLogsRequest | HostCapsuleListRequest | HostVersionRequest | HostTelemetryRequest | HostJobsInspectRequest | HostSchedulesInspectRequest | HostAccessKeyRequest;
+}) | HostAdmissionPublishRequest | HostBootstrapRequest | HostRegistrationRequest | HostSealedEnvRotationRequest | HostUnregisterRequest | HostDeleteRequest | HostReleaseInstallRequest | HostReleaseListRequest | HostReleaseRollbackRequest | HostLifecycleRequest | HostStatsRequest | HostSshRequest | HostHealthRequest | HostLogsRequest | HostCapsuleListRequest | HostVersionRequest | HostTelemetryRequest | HostJobsInspectRequest | HostDatabaseInspectRequest | HostSchedulesInspectRequest | HostAccessKeyRequest;
 export type HostHelperErrorBody = JsonObject & {
     message: string;
     hint: string;

package/dist/cli/host-helper-requests.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-helper-requests.d.ts","sourceRoot":"","sources":["../../src/cli/host-helper-requests.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EACV,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,WAAW,EACZ,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GAAG,uBAAuB,GAAG,yBAAyB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,qBAAqB,GAAG,uBAAuB,GACpO,uBAAuB,GAAG,qBAAqB,GAAG,wBAAwB,GAAG,sBAAsB,GACnG,uBAAuB,GAAG,oBAAoB,GAC9C,uBAAuB,GACvB,kBAAkB,GAClB,+BAA+B,GAC/B,oBAAoB,GACpB,gBAAgB,GAChB,yBAAyB,GACzB,sBAAsB,GACtB,0BAA0B,GAC1B,2BAA2B,GAC3B,6BAA6B,GAC7B,gBAAgB,GAChB,eAAe,GACf,cAAc,GACd,2BAA2B,GAC3B,iBAAiB,GACjB,eAAe,GACf,aAAa,GACb,gBAAgB,GAChB,cAAc,GACd,mBAAmB,GACnB,kBAAkB,GAClB,qBAAqB,GACrB,oBAAoB,GACpB,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,YAAY,GACZ,WAAW,GACX,cAAc,GACd,gBAAgB,GAChB,wBAAwB,GACxB,wBAAwB,GACxB,0BAA0B,GAC1B,uBAAuB,GACvB,sBAAsB,GACtB,gCAAgC,GAAG,8BAA8B,GAAG,iCAAiC,GAAG,oCAAoC,GAC5I,uBAAuB,GACvB,iCAAiC,GAAG,kCAAkC,GAAG,iCAAiC,GAAG,wBAAwB,CAAC;AAE1I,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG;IAChD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE;QACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,SAAS,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC1C,UAAU,CAAC,EAAE;QAAE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,eAAe,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACnD,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,GAAG,IAAI,CAAC;CACV,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG;IAC/C,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACzC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,QAAQ,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IACvC,SAAS,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtC,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,WAAW,CAAC,EAAE;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,CAAC,EAAE,OAAO,yBAAyB,EAAE,mBAAmB,CAAC;IACjE,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,mBAAmB,EAAE,gBAAgB,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1H,SAAS,CAAC,EAAE;QAAE,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,0BAA0B,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjO,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG;IACjD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAA,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC3D,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,SAAS,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE;QACJ,IAAI,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IACF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE;QACN,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,GAAG;IAAE,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AACxF,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,GAAG;IAC5D,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,4BAA4B,GAAG,qBAAqB,GAAG;IACjE,MAAM,EAAE,+BAA+B,CAAC;IACxC,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,qBAAqB,GAAG;IAC1D,MAAM,EAAE,oBAAoB,CAAC;IAC7B,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,GAAG;IACtD,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,qBAAqB,GAAG;IAC9D,MAAM,EAAE,yBAAyB,CAAC;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,OAAO,EAAE,iBAAiB,CAAC;CAC5B,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,qBAAqB,GAAG;IAC3D,MAAM,EAAE,sBAAsB,CAAC;IAC/B,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,qBAAqB,GAAG;IAC/D,MAAM,EAAE,0BAA0B,CAAC;IACnC,OAAO,EAAE,uBAAuB,CAAC;IACjC,QAAQ,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACjC,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,GAAG;IACzD,MAAM,EAAE,6BAA6B,GAAG,gBAAgB,GAAG,eAAe,GAAG,cAAc,GAAG,iBAAiB,GAAG,2BAA2B,CAAC;IAC9I,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,gBAAgB,GACxB,CAAC,qBAAqB,GAAG;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,GAClD,CAAC,qBAAqB,GAAG;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAE,CAAC,CAAC;AAC5F,MAAM,MAAM,cAAc,GAAG,qBAAqB,GAAG;IACnD,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,GAAG;IACtD,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,eAAe,GAAG,qBAAqB,GAAG;IACpD,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,qBAAqB,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AACxF,MAAM,MAAM,kBAAkB,GAAG,qBAAqB,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AACpF,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,GAAG;IAAE,MAAM,EAAE,wBAAwB,GAAG,wBAAwB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,sBAAsB,GACpM,gCAAgC,GAAG,8BAA8B,GAAG,iCAAiC,GAAG,oCAAoC,GAAG,uBAAuB,GAAG,iCAAiC,GAAG,kCAAkC,GAAG,iCAAiC,GAAG,wBAAwB,CAAA;CAAE,CAAC;AACrT,MAAM,MAAM,sBAAsB,GAAG,qBAAqB,GAAG;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAE,CAAC;AAC1H,MAAM,MAAM,2BAA2B,GAAG,qBAAqB,GAAG;IAAE,MAAM,EAAE,mBAAmB,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAE,CAAC;AACpI,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,GAAG;IACzD,MAAM,EAAE,kBAAkB,GAAG,qBAAqB,GAAG,oBAAoB,GAAG,wBAAwB,GAAG,oBAAoB,CAAC;IAC5H,OAAO,EAAE,uBAAuB,CAAC;IACjC,UAAU,EAAE,UAAU,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,qBAAqB,GAAG;IAChE,MAAM,EAAE,2BAA2B,CAAC;IACpC,OAAO,EAAE,uBAAuB,CAAC;IACjC,SAAS,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACxC,CAAC;AACF,MAAM,MAAM,iBAAiB,GACzB,CAAC,qBAAqB,GAAG;IAAE,MAAM,EAAE,sBAAsB,GAAG,uBAAuB,GAAG,yBAAyB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,qBAAqB,GAAG,uBAAuB,CAAA;CAAE,CAAC,GAC1Q,CAAC,qBAAqB,GAAG;IAAE,MAAM,EAAE,uBAAuB,GAAG,qBAAqB,GAAG,wBAAwB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,oBAAoB,CAAA;CAAE,CAAC,GAC1L,CAAC,qBAAqB,GAAG;IAAE,MAAM,EAAE,uBAAuB,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAC;IAAC,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CAAE,CAAC,GACrI,2BAA2B,GAC3B,oBAAoB,GACpB,uBAAuB,GACvB,4BAA4B,GAC5B,qBAAqB,GACrB,iBAAiB,GACjB,yBAAyB,GACzB,sBAAsB,GACtB,0BAA0B,GAC1B,oBAAoB,GACpB,gBAAgB,GAChB,cAAc,GACd,iBAAiB,GACjB,eAAe,GACf,sBAAsB,GACtB,kBAAkB,GAClB,oBAAoB,GACpB,sBAAsB,GACtB,2BAA2B,GAC3B,oBAAoB,CAAC;AAEzB,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,SAAS,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,CAAC,IAAI,GAAG,SAAS,IAC3C;IACA,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,IAAI,CAAC;CACb,GACC;IACA,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,KAAK,EAAE,mBAAmB,CAAC;CAC5B,CAAC"}
+{"version":3,"file":"host-helper-requests.d.ts","sourceRoot":"","sources":["../../src/cli/host-helper-requests.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EACV,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,WAAW,EACZ,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GAAG,uBAAuB,GAAG,yBAAyB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,qBAAqB,GAAG,uBAAuB,GACpO,uBAAuB,GAAG,qBAAqB,GAAG,wBAAwB,GAAG,sBAAsB,GACnG,uBAAuB,GAAG,oBAAoB,GAC9C,uBAAuB,GACvB,kBAAkB,GAClB,+BAA+B,GAC/B,oBAAoB,GACpB,gBAAgB,GAChB,yBAAyB,GACzB,sBAAsB,GACtB,0BAA0B,GAC1B,2BAA2B,GAC3B,6BAA6B,GAC7B,gBAAgB,GAChB,eAAe,GACf,cAAc,GACd,2BAA2B,GAC3B,iBAAiB,GACjB,eAAe,GACf,aAAa,GACb,gBAAgB,GAChB,cAAc,GACd,mBAAmB,GACnB,SAAS,GACT,SAAS,GACT,UAAU,GACV,kBAAkB,GAClB,qBAAqB,GACrB,oBAAoB,GACpB,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,YAAY,GACZ,WAAW,GACX,cAAc,GACd,gBAAgB,GAChB,wBAAwB,GACxB,wBAAwB,GACxB,0BAA0B,GAC1B,uBAAuB,GACvB,sBAAsB,GACtB,gCAAgC,GAAG,8BAA8B,GAAG,iCAAiC,GAAG,oCAAoC,GAC5I,uBAAuB,GACvB,iCAAiC,GAAG,kCAAkC,GAAG,iCAAiC,GAAG,wBAAwB,CAAC;AAE1I,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG;IAChD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE;QACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,SAAS,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC1C,UAAU,CAAC,EAAE;QAAE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,eAAe,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACnD,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,GAAG,IAAI,CAAC;CACV,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG;IAC/C,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACzC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,QAAQ,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IACvC,SAAS,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtC,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,WAAW,CAAC,EAAE;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,CAAC,EAAE,OAAO,yBAAyB,EAAE,mBAAmB,CAAC;IACjE,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,mBAAmB,EAAE,gBAAgB,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1H,SAAS,CAAC,EAAE;QAAE,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,0BAA0B,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjO,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG;IACjD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAA,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC3D,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,SAAS,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE;QACJ,IAAI,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IACF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE;QACN,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,GAAG;IAAE,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AACxF,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,GAAG;IAC5D,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,4BAA4B,GAAG,qBAAqB,GAAG;IACjE,MAAM,EAAE,+BAA+B,CAAC;IACxC,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,qBAAqB,GAAG;IAC1D,MAAM,EAAE,oBAAoB,CAAC;IAC7B,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,GAAG;IACtD,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,qBAAqB,GAAG;IAC9D,MAAM,EAAE,yBAAyB,CAAC;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,OAAO,EAAE,iBAAiB,CAAC;CAC5B,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,qBAAqB,GAAG;IAC3D,MAAM,EAAE,sBAAsB,CAAC;IAC/B,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,qBAAqB,GAAG;IAC/D,MAAM,EAAE,0BAA0B,CAAC;IACnC,OAAO,EAAE,uBAAuB,CAAC;IACjC,QAAQ,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACjC,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,GAAG;IACzD,MAAM,EAAE,6BAA6B,GAAG,gBAAgB,GAAG,eAAe,GAAG,cAAc,GAAG,iBAAiB,GAAG,2BAA2B,CAAC;IAC9I,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,gBAAgB,GACxB,CAAC,qBAAqB,GAAG;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,GAClD,CAAC,qBAAqB,GAAG;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAE,CAAC,CAAC;AAC5F,MAAM,MAAM,cAAc,GAAG,qBAAqB,GAAG;IACnD,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,GAAG;IACtD,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AACF,MAAM,MAAM,eAAe,GAAG,qBAAqB,GAAG;IACpD,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,qBAAqB,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AACxF,MAAM,MAAM,kBAAkB,GAAG,qBAAqB,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AACpF,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,GAAG;IAAE,MAAM,EAAE,wBAAwB,GAAG,wBAAwB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,sBAAsB,GACpM,gCAAgC,GAAG,8BAA8B,GAAG,iCAAiC,GAAG,oCAAoC,GAAG,uBAAuB,GAAG,iCAAiC,GAAG,kCAAkC,GAAG,iCAAiC,GAAG,wBAAwB,CAAA;CAAE,CAAC;AACrT,MAAM,MAAM,sBAAsB,GAAG,qBAAqB,GAAG;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAE,CAAC;AAC1H,MAAM,MAAM,2BAA2B,GAAG,qBAAqB,GAAG;IAAE,MAAM,EAAE,mBAAmB,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAE,CAAC;AACpI,MAAM,MAAM,0BAA0B,GAAG,qBAAqB,GAAG,CAC7D;IAAE,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAE,GACnE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAC;IAAC,EAAE,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAChF,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,GAAG;IACzD,MAAM,EAAE,kBAAkB,GAAG,qBAAqB,GAAG,oBAAoB,GAAG,wBAAwB,GAAG,oBAAoB,CAAC;IAC5H,OAAO,EAAE,uBAAuB,CAAC;IACjC,UAAU,EAAE,UAAU,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,qBAAqB,GAAG;IAChE,MAAM,EAAE,2BAA2B,CAAC;IACpC,OAAO,EAAE,uBAAuB,CAAC;IACjC,SAAS,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACxC,CAAC;AACF,MAAM,MAAM,iBAAiB,GACzB,CAAC,qBAAqB,GAAG;IAAE,MAAM,EAAE,sBAAsB,GAAG,uBAAuB,GAAG,yBAAyB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,qBAAqB,GAAG,uBAAuB,CAAA;CAAE,CAAC,GAC1Q,CAAC,qBAAqB,GAAG;IAAE,MAAM,EAAE,uBAAuB,GAAG,qBAAqB,GAAG,wBAAwB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,oBAAoB,CAAA;CAAE,CAAC,GAC1L,CAAC,qBAAqB,GAAG;IAAE,MAAM,EAAE,uBAAuB,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAC;IAAC,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CAAE,CAAC,GACrI,2BAA2B,GAC3B,oBAAoB,GACpB,uBAAuB,GACvB,4BAA4B,GAC5B,qBAAqB,GACrB,iBAAiB,GACjB,yBAAyB,GACzB,sBAAsB,GACtB,0BAA0B,GAC1B,oBAAoB,GACpB,gBAAgB,GAChB,cAAc,GACd,iBAAiB,GACjB,eAAe,GACf,sBAAsB,GACtB,kBAAkB,GAClB,oBAAoB,GACpB,sBAAsB,GACtB,0BAA0B,GAC1B,2BAA2B,GAC3B,oBAAoB,CAAC;AAEzB,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,SAAS,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,CAAC,IAAI,GAAG,SAAS,IAC3C;IACA,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,IAAI,CAAC;CACb,GACC;IACA,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,KAAK,EAAE,mBAAmB,CAAC;CAC5B,CAAC"}

package/dist/cli/sporades-host-helper.js

@@ -21,6 +21,7 @@ import { delay, errorDetails, helperError, readStdin, writeEnvelope, } from "./c
 import { CLI_VERSION } from "./cli-version.js";
 import { sanitizeScheduleInspectionEnvelope } from "./schedule-inspection-envelope.js";
 import { ACCESS_KEY_OPERATOR_PROCESS_MAX_BUFFER, sanitizeAccessKeyOperatorEnvelope, validateAccessKeyOperatorActionInput } from "./access-key-operator-envelope.js";
+import { DATABASE_INSPECTION_MAX_BUFFER, encodeDatabaseInspectionInput, isDatabaseInspectionAction, sanitizeDatabaseInspectionEnvelope } from "./database-inspection-envelope.js";
 import { ACCESS_KEY_CLIENT_ADDRESS_HEADER } from "../access-key-contract.js";
 import { CLIENT_ADDRESS_TOKEN_HEADER, clientAddressBoundaryToken } from "../client-address.js";
 import { HOST_RELEASE_ARCHIVE_LIMITS, validateReleaseArchive } from "./host-helper-archive.js";
@@ -1102,6 +1103,10 @@ async function dispatchMain(request) {
         runCapsuleAccessKeyAction(request);
         return;
     }
+    if (isDatabaseInspectionAction(request.action)) {
+        inspectCapsuleDatabase(request);
+        return;
+    }
     if (request.action === "host.stats") {
         await statsHost(request);
         return;
@@ -1153,6 +1158,26 @@ function runCapsuleAccessKeyAction(request) {
         Buffer.from(JSON.stringify(accessKeys), "utf8").toString("base64url"),
     ]);
 }
+function inspectCapsuleDatabase(request) {
+    const action = request.action;
+    if (!isDatabaseInspectionAction(action))
+        throw helperError("Unsupported Host helper action.", "Update the Host helper or use a supported Sporades host command.");
+    const exactKeys = (value, keys) => Object.keys(value).length === keys.length
+        && Object.keys(value).every((key) => keys.includes(key));
+    const query = action === "db.query";
+    const sql = request.db?.sql;
+    if (!exactKeys(request, query ? ["action", "host", "capsule", "db"] : ["action", "host", "capsule"])
+        || !request.host || typeof request.host !== "object" || Array.isArray(request.host)
+        || !exactKeys(request.host, ["alias", "domain", "scheme", "remoteRoot"])
+        || !request.capsule || typeof request.capsule !== "object" || Array.isArray(request.capsule)
+        || !exactKeys(request.capsule, ["subname"])
+        || (query && (!exactKeys(request.db ?? {}, ["sql"]) || typeof sql !== "string" || !encodeDatabaseInspectionInput(sql)))) {
+        throw helperError("Invalid Hosted database inspection request.", "Upgrade the local Sporades CLI and Host helper together.");
+    }
+    inspectCapsuleRuntime(request, action, "database", (envelope) => sanitizeDatabaseInspectionEnvelope(action, envelope, () => {
+        throw helperError("Hosted database inspection returned an invalid response.", "Run `sporades host upgrade`, redeploy the Capsule, and retry the command.");
+    }), query ? ["--sporades-action-input", encodeDatabaseInspectionInput(sql)] : []);
+}
 function inspectCapsuleRuntime(request, action, label, sanitize = (envelope) => envelope, extraArgs = [], preserveBoundedDiagnostics = false) {
     const containerName = createHostedContainerName(request.host.domain, request.capsule.subname);
     if (!checkContainerRunning(containerName)) {
@@ -1162,7 +1187,7 @@ function inspectCapsuleRuntime(request, action, label, sanitize = (envelope) =>
         throw error;
     }
     const result = runDocker(["exec", containerName, "node", "/app/server.mjs", "--sporades-action", action, ...extraArgs], {
-        maxBuffer: label === "Access-key" ? ACCESS_KEY_OPERATOR_PROCESS_MAX_BUFFER : undefined,
+        maxBuffer: label === "Access-key" ? ACCESS_KEY_OPERATOR_PROCESS_MAX_BUFFER : label === "database" ? DATABASE_INSPECTION_MAX_BUFFER : undefined,
     });
     let envelope;
     try {