@lifeaitools/clauth 0.2.0 → 0.2.1

package/cli/commands/install.js

@@ -157,16 +157,31 @@ export async function runInstall(opts = {}) {
   const s5 = ora('Deploying auth-vault Edge Function...').start();
   const fnSource = readFileSync(join(ROOT, 'supabase/functions/auth-vault/index.ts'), 'utf8');
   try {
-    // Try update first
-    try {
-      await mgmt(pat, 'PATCH', `/projects/${ref}/functions/auth-vault`, {
-        slug: 'auth-vault', name: 'auth-vault', verify_jwt: true, body: fnSource,
-      });
-    } catch {
-      await mgmt(pat, 'POST', `/projects/${ref}/functions`, {
-        slug: 'auth-vault', name: 'auth-vault', verify_jwt: true, body: fnSource,
-      });
+    // Use the /deploy endpoint with multipart/form-data (not the old /functions endpoint)
+    const formData = new FormData();
+
+    const metadata = {
+      name: 'auth-vault',
+      entrypoint_path: 'index.ts',
+      verify_jwt: true,
+    };
+    formData.append('metadata', new Blob([JSON.stringify(metadata)], { type: 'application/json' }));
+    formData.append('file', new Blob([fnSource], { type: 'application/typescript' }), 'index.ts');
+
+    const deployRes = await fetch(
+      `${MGMT}/projects/${ref}/functions/deploy?slug=auth-vault`,
+      {
+        method: 'POST',
+        headers: { 'Authorization': `Bearer ${pat}` },
+        body: formData,
+      }
+    );
+
+    if (!deployRes.ok) {
+      const errText = await deployRes.text().catch(() => deployRes.statusText);
+      throw new Error(`HTTP ${deployRes.status}: ${errText}`);
     }
+
     s5.succeed('auth-vault Edge Function deployed');
   } catch (e) {
     s5.warn(`Edge Function deploy failed: ${e.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {

package/supabase/migrations/001_clauth_schema.sql

@@ -77,9 +77,17 @@ alter table public.clauth_audit     enable row level security;
 
 -- service_role bypasses RLS — all access from Edge Function only
 -- No direct anon access to any clauth table
-create policy "no_anon_services"  on public.clauth_services  for all using (false);
-create policy "no_anon_machines"  on public.clauth_machines  for all using (false);
-create policy "no_anon_audit"     on public.clauth_audit     for all using (false);
+do $$ begin
+  if not exists (select 1 from pg_policies where policyname = 'no_anon_services' and tablename = 'clauth_services') then
+    create policy "no_anon_services" on public.clauth_services for all using (false);
+  end if;
+  if not exists (select 1 from pg_policies where policyname = 'no_anon_machines' and tablename = 'clauth_machines') then
+    create policy "no_anon_machines" on public.clauth_machines for all using (false);
+  end if;
+  if not exists (select 1 from pg_policies where policyname = 'no_anon_audit' and tablename = 'clauth_audit') then
+    create policy "no_anon_audit" on public.clauth_audit for all using (false);
+  end if;
+end $$;
 
 -- ============================================================
 -- Updated_at trigger
@@ -89,6 +97,7 @@ returns trigger language plpgsql as $$
 begin new.updated_at = now(); return new; end;
 $$;
 
+drop trigger if exists clauth_services_updated on public.clauth_services;
 create trigger clauth_services_updated
   before update on public.clauth_services
   for each row execute procedure public.clauth_touch_updated();