@integrity-labs/cloud-broker 0.7.10 → 0.7.11

package/dist/index.js

@@ -21380,6 +21380,16 @@ var BrokerClient = class {
       { query: this.agentId ? { agent_id: this.agentId } : void 0 }
     );
   }
+  supabaseRest(args) {
+    return this.request(
+      "POST",
+      `/supabase/grants/${encodeURIComponent(args.grant_id)}/rest`,
+      {
+        query: this.agentId ? { agent_id: this.agentId } : void 0,
+        body: { method: args.method, path: args.path, ...args.body !== void 0 ? { body: args.body } : {} }
+      }
+    );
+  }
 };
 
 // src/inventory.ts
@@ -21613,6 +21623,12 @@ var supabaseQuerySchema = external_exports.object({
 var supabaseDescribeSchema = external_exports.object({
   grant_id: external_exports.string().uuid("grant_id must be a UUID")
 });
+var supabaseRestSchema = external_exports.object({
+  grant_id: external_exports.string().uuid("grant_id must be a UUID"),
+  method: external_exports.enum(["GET", "HEAD", "POST", "PATCH", "PUT", "DELETE"]).describe("HTTP method. Writes require a non-read-only grant."),
+  path: external_exports.string().min(1, "path is required").describe('PostgREST-relative path, e.g. "orders?select=*&limit=10". Do NOT include /rest/v1/.'),
+  body: external_exports.unknown().optional().describe("JSON body for POST/PATCH/PUT.")
+});
 var supabaseDescribeScopeShape = supabaseDescribeScopeSchema.shape;
 var supabasePreviewRequestShape = supabasePreviewRequestSchema.shape;
 var supabaseRequestAccessShape = supabaseRequestAccessSchema.shape;
@@ -21623,11 +21639,12 @@ var supabaseCheckApprovalChannelShape = supabaseCheckApprovalChannelSchema.shape
 var supabaseListProjectsShape = supabaseListProjectsSchema.shape;
 var supabaseQueryShape = supabaseQuerySchema.shape;
 var supabaseDescribeShape = supabaseDescribeSchema.shape;
+var supabaseRestShape = supabaseRestSchema.shape;
 
 // package.json
 var package_default = {
   name: "@integrity-labs/cloud-broker",
-  version: "0.7.10",
+  version: "0.7.11",
   description: "Cloud Access Broker \u2014 MCP server that mints scoped, TTL-bounded cloud credentials per agent task. Ships AWS support (aws_request_access, aws_poll_grant, aws_release_access, aws_describe_scope, aws_preview_request, aws_get_credentials \u2014 STS AssumeRole under the hood); GCP, Azure, and Cloudflare land alongside in the same package as the broker grows.",
   type: "module",
   bin: {
@@ -22131,6 +22148,19 @@ server.tool(
     }
   }
 );
+server.tool(
+  "supabase_rest",
+  'Call a Supabase project\'s REST (PostgREST) API for an ACTIVE grant - the primary way to read AND write your app data. You do NOT hold a key; the broker injects the project api_key and runs the call server-side under your grant\'s scope. Args: { grant_id, method (GET/HEAD/POST/PATCH/PUT/DELETE), path, body? }. `path` is PostgREST-relative - e.g. "orders?select=*&limit=10", "orders?id=eq.7" - do NOT include /rest/v1/ or the host. Filtering/ordering/pagination use PostgREST query syntax. For writes, pass the row(s) as `body` (POST=insert, PATCH=update with a filter in path, DELETE=delete with a filter in path). Returns on success { grant_id, ok: true, status, body } where body is the PostgREST JSON (rows for reads, the affected rows for writes). On a denial returns { ok: false, error_code, error }: READ_ONLY (your grant is read-only - writes rejected), SCOPE_DENIED (table not in your grant\'s allowed tables, or rpc/ blocked), BAD_REQUEST (bad method/path), REST_NOT_CONFIGURED (no api_key enrolled - tell the user to ask their operator), GRANT_NOT_ACTIVE / GRANT_EXPIRED / GRANT_RELEASED, or EXECUTION_ERROR. A 4xx from PostgREST itself comes back as { ok:false, status, body } with the upstream error in body. Call supabase_describe first to see your allowed tables and whether REST is available. rpc/ calls are not permitted. Use supabase_query for raw SQL / system tables instead.' + NO_DIRECT_SUPABASE_HTTP_BLOCK,
+  supabaseRestShape,
+  async (args) => {
+    try {
+      const result = await broker.supabaseRest(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
 var transport = new StdioServerTransport();
 await server.connect(transport);
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/cloud-broker",
-  "version": "0.7.10",
+  "version": "0.7.11",
   "description": "Cloud Access Broker — MCP server that mints scoped, TTL-bounded cloud credentials per agent task. Ships AWS support (aws_request_access, aws_poll_grant, aws_release_access, aws_describe_scope, aws_preview_request, aws_get_credentials — STS AssumeRole under the hood); GCP, Azure, and Cloudflare land alongside in the same package as the broker grows.",
   "type": "module",
   "bin": {