@supacloud/cli 0.21.2 → 0.22.0

package/README.md

@@ -198,6 +198,13 @@ it never empties a bucket. Mutation receipts bind `project_ref`, `bucket_id`,
 name with another version, or a local version with another name, before either
 dry-run reporting or apply can continue. This keeps the preview consistent with
 the server conflict that would otherwise occur after deployment starts.
+Mutation failures use the release-control receipt schema and never include the
+server response body. `OUTCOME_UNKNOWN` requires a fresh migration inventory
+read before deciding whether a retry is safe. A migration push failure also
+reports the local files applied or skipped before the failed file, so operators
+can reconcile a partially completed sequence without exposing SQL. Baseline
+success requires a bounded migration-inventory readback that confirms every
+requested version, name, baseline marker, and checksum.
 
 `edge_functions deploy --path` bundles local TypeScript and dependencies with
 Bun and runs a local syntax check before upload. The Management API validates and

package/dist/index.js

@@ -6897,6 +6897,38 @@ function projectRefPathSegment(ref, operation) {
   return encodeURIComponent(ref);
 }
 
+// src/shared/tools/release-control-response.ts
+var RELEASE_CONTROL_RESPONSE_SCHEMA = "supacloud.cli.release-control.v1";
+function releaseControlSuccess(operation, payload) {
+  return releaseControlResponse({
+    ...payload,
+    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
+    ok: true,
+    operation
+  });
+}
+function releaseControlFailure(operation, code, httpStatus, safeState = {}) {
+  return releaseControlErrorResponse({
+    ...safeState,
+    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
+    ok: false,
+    operation,
+    error: { code, http_status: httpStatus }
+  });
+}
+function releaseControlMutationFailure(operation, response, safeState = {}) {
+  const outcomeUnknown = response.transportError || response.responseReadError || response.status === 408 || response.status >= 500;
+  return outcomeUnknown ? releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.transportError ? null : response.status, safeState) : releaseControlFailure(operation, "HTTP_ERROR", response.status, safeState);
+}
+function releaseControlResponse(payload) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(payload, null, 2) }]
+  };
+}
+function releaseControlErrorResponse(payload) {
+  return { ...releaseControlResponse(payload), isError: true };
+}
+
 // src/shared/tools/database-tools.ts
 var MAX_MIGRATION_VERSION = 9223372036854775807n;
 var FALLBACK_MIGRATION_VERSION_BASE = 8000000000000000000n;
@@ -7046,95 +7078,188 @@ function sortMigrationFiles(migrations) {
   }
   return sorted;
 }
-function appliedMigrationKeys(data) {
-  const rows = Array.isArray(data) ? data : data?.rows || [];
-  const keys = new Set;
-  for (const row of rows) {
-    if (!row || typeof row !== "object")
-      continue;
-    const migration = row;
-    if (migration.version != null)
-      keys.add(String(migration.version));
-    if (migration.name != null)
-      keys.add(String(migration.name));
-  }
-  return keys;
+function normalizedMigrationStatement(statement) {
+  return statement.replace(/\r\n?/g, `
+`).trim();
 }
 function migrationRows(data) {
-  const rows = Array.isArray(data) ? data : data?.rows || [];
-  return Array.isArray(rows) ? rows.filter((row) => Boolean(row && typeof row === "object")) : [];
+  if (Array.isArray(data))
+    return data;
+  if (data && typeof data === "object" && Array.isArray(data.rows)) {
+    return data.rows;
+  }
+  throw new Error("Invalid remote migration inventory");
 }
-function migrationIdentityKey(version, name) {
-  return `${version}\x00${name}`;
+function migrationIdentity(row) {
+  if (!row || typeof row !== "object" || Array.isArray(row)) {
+    throw new Error("Invalid remote migration identity");
+  }
+  const migration = row;
+  if (!isMigrationInventoryVersion(migration.version) || !isMigrationInventoryName(migration.name)) {
+    throw new Error("Invalid remote migration identity");
+  }
+  return { version: migration.version, name: migration.name, statements: migration.statements };
 }
 function migrationIdentities(data) {
-  return migrationRows(data).flatMap((row) => row.version == null || row.name == null ? [] : [{ version: String(row.version), name: String(row.name), statements: row.statements }]);
-}
-function isLegacyNameBoundMigration(local, remote, remoteMigrations) {
-  return remoteMigrations.filter((candidate) => candidate.name === local.name).length === 1 && local.name === remote.name && local.version !== remote.version && Array.isArray(remote.statements) && remote.statements.length === 1 && typeof remote.statements[0] === "string" && remote.statements[0].trim() === local.sql.trim();
+  const identities = migrationRows(data).map(migrationIdentity);
+  const versions = new Set;
+  const names = new Set;
+  for (const identity of identities) {
+    if (versions.has(identity.version) || identity.name !== null && names.has(identity.name)) {
+      throw new Error("Invalid remote migration inventory");
+    }
+    versions.add(identity.version);
+    if (identity.name !== null)
+      names.add(identity.name);
+  }
+  return identities;
 }
-function identityConflicts(local, remote, remoteMigrations) {
-  const reusesVersionOrName = local.version === remote.version || local.name === remote.name;
-  const exactlyMatches = local.version === remote.version && local.name === remote.name;
-  return reusesVersionOrName && !exactlyMatches && !isLegacyNameBoundMigration(local, remote, remoteMigrations);
+function singleRemoteStatement(remote) {
+  return Array.isArray(remote.statements) && remote.statements.length === 1 && typeof remote.statements[0] === "string" ? remote.statements[0] : null;
 }
-function migrationIdentityConflicts(data, migrationFiles) {
+function exactIdentityIsApplied(local, remote) {
+  const statement = singleRemoteStatement(remote);
+  if (statement === null)
+    return false;
+  if (statement === `baseline:${local.name}` || statement === `direct-apply:${local.name}`)
+    return true;
+  const rawChecksum = createHash("sha256").update(local.rawBytes).digest("hex");
+  return statement === `sha256:${rawChecksum}` || statement.trim() === local.sql.trim();
+}
+function legacyIdentityIsApplied(local, remote) {
+  const statement = singleRemoteStatement(remote);
+  return remote.name === local.name && remote.version !== local.version && statement !== null && statement.trim() === local.sql.trim();
+}
+function migrationIdentityConflict(local) {
+  return new Error(`Migration identity conflicts:
+- ${local.file} (${local.version}) conflicts with remote inventory`);
+}
+function migrationDisposition(local, remoteMigrations) {
+  const sameVersion = remoteMigrations.filter((remote2) => remote2.version === local.version);
+  const sameName = remoteMigrations.filter((remote2) => remote2.name === local.name);
+  if (sameVersion.length > 1 || sameName.length > 1)
+    throw migrationIdentityConflict(local);
+  if (!sameVersion.length && !sameName.length)
+    return "pending";
+  if (sameVersion[0] && sameName[0] && sameVersion[0] !== sameName[0])
+    throw migrationIdentityConflict(local);
+  const remote = sameVersion[0] ?? sameName[0];
+  const exactIdentity = remote.version === local.version && remote.name === local.name;
+  if (exactIdentity && exactIdentityIsApplied(local, remote))
+    return "applied";
+  if (!sameVersion.length && legacyIdentityIsApplied(local, remote))
+    return "applied";
+  throw migrationIdentityConflict(local);
+}
+function migrationPushPlan(data, migrationFiles) {
   const remoteMigrations = migrationIdentities(data);
-  return migrationFiles.flatMap((localMigration) => remoteMigrations.filter((remoteMigration) => identityConflicts(localMigration, remoteMigration, remoteMigrations)).map((remoteMigration) => ({ file: localMigration.file, local: localMigration, remote: remoteMigration })));
+  const plan = { alreadyApplied: [], pending: [] };
+  for (const migration of migrationFiles) {
+    const disposition = migrationDisposition(migration, remoteMigrations);
+    plan[disposition === "applied" ? "alreadyApplied" : "pending"].push(migration);
+  }
+  return plan;
 }
-function legacyNameBoundMigrationKeys(data, migrationFiles) {
-  const remoteMigrations = migrationIdentities(data);
-  return new Set(migrationFiles.flatMap((localMigration) => remoteMigrations.some((remoteMigration) => isLegacyNameBoundMigration(localMigration, remoteMigration, remoteMigrations)) ? [migrationIdentityKey(localMigration.version, localMigration.name)] : []));
+function recordPayload(payload) {
+  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : null;
 }
-function assertNoMigrationIdentityConflicts(data, migrationFiles) {
-  const conflicts = migrationIdentityConflicts(data, migrationFiles);
-  if (!conflicts.length)
-    return;
-  throw new Error([
-    "Migration identity conflicts:",
-    ...conflicts.map(({ file, local, remote }) => `- ${file} (${local.version}) conflicts with remote ${remote.name} (${remote.version})`)
-  ].join(`
-`));
+function confirmedMigrationReceipt(payload, expected) {
+  const receipt = recordPayload(payload);
+  if (!receipt || !isMigrationInventoryVersion(receipt.version))
+    return false;
+  const responseStatements = [expected.sql.trim()];
+  const checksumStatements = [normalizedMigrationStatement(expected.sql)];
+  const name = expected.name.trim();
+  if (receipt.name !== name || JSON.stringify(receipt.statements) !== JSON.stringify(responseStatements))
+    return false;
+  if (expected.version !== undefined && receipt.version !== expected.version)
+    return false;
+  return receipt.checksum === migrationInventoryChecksum({ version: receipt.version, name, statements: checksumStatements });
 }
-function nameBoundMigrationMarkerKeys(data) {
-  const keys = new Set;
-  for (const row of migrationRows(data)) {
-    if (row.version == null || row.name == null || !Array.isArray(row.statements))
-      continue;
-    if (row.statements.length !== 1)
-      continue;
-    const name = String(row.name);
-    const marker = row.statements[0];
-    if (marker !== `baseline:${name}` && marker !== `direct-apply:${name}`)
-      continue;
-    keys.add(migrationIdentityKey(String(row.version), String(row.name)));
-  }
-  return keys;
+function isAlreadyAppliedMigrationResponse(response, migration) {
+  if (response.ok || response.status !== 409 || response.transportError || response.responseReadError)
+    return false;
+  if (!response.data || typeof response.data !== "object" || Array.isArray(response.data))
+    return false;
+  const body = response.data;
+  const name = migration.name.trim();
+  const statements = [normalizedMigrationStatement(migration.sql)];
+  return body.code === "409" && body.message === "Migration already applied" && body.version === migration.version && body.name === name && body.checksum === migrationInventoryChecksum({ version: migration.version, name, statements });
+}
+function expectedBaselineChecksum(migration) {
+  return migrationInventoryChecksum({
+    version: migration.version,
+    name: migration.name,
+    statements: [`baseline:${migration.name}`]
+  });
 }
-function historicalChecksumMarkerKeys(data, migrationFiles) {
-  const filesByKey = new Map(migrationFiles.map((migration) => [migrationIdentityKey(migration.version, migration.name), migration]));
-  const keys = new Set;
-  for (const row of migrationRows(data)) {
-    if (row.version == null || row.name == null || !Array.isArray(row.statements) || row.statements.length !== 1)
-      continue;
-    const marker = row.statements[0];
-    if (typeof marker !== "string" || !/^sha256:[0-9a-f]{64}$/.test(marker))
-      continue;
-    const key = migrationIdentityKey(String(row.version), String(row.name));
-    const migration = filesByKey.get(key);
-    if (!migration)
-      continue;
-    const checksum = createHash("sha256").update(migration.rawBytes).digest("hex");
-    if (marker === `sha256:${checksum}`)
-      keys.add(key);
+function confirmedBaselineReceipt(payload, migrations) {
+  const receipt = recordPayload(payload);
+  if (!receipt || typeof receipt.marked !== "number" || typeof receipt.already_applied !== "number")
+    return null;
+  if (!Number.isSafeInteger(receipt.marked) || !Number.isSafeInteger(receipt.already_applied))
+    return null;
+  if (receipt.marked < 0 || receipt.already_applied < 0)
+    return null;
+  if (receipt.marked + receipt.already_applied !== migrations.length)
+    return null;
+  if (!Array.isArray(receipt.migrations) || receipt.migrations.length !== receipt.marked)
+    return null;
+  const expected = new Map(migrations.map((migration) => [migration.version, migration]));
+  const marked = [];
+  for (const rawMigration of receipt.migrations) {
+    const migration = recordPayload(rawMigration);
+    if (!migration || typeof migration.version !== "string")
+      return null;
+    const local = expected.get(migration.version);
+    if (!local || migration.name !== local.name || migration.checksum !== expectedBaselineChecksum(local))
+      return null;
+    expected.delete(migration.version);
+    marked.push(local);
   }
-  return keys;
+  return expected.size === receipt.already_applied ? { marked, concurrentlyAlreadyApplied: receipt.already_applied } : null;
 }
-function isAlreadyAppliedMigrationResponse(response) {
-  if (response.status !== 409 || !response.data || typeof response.data !== "object")
+function baselineInventoryIsApplied(payload, migrations) {
+  const inventory = migrationInventory(payload);
+  if (!inventory)
     return false;
-  const body = response.data;
-  return body.code === "409" && body.message === "Migration already applied";
+  const byVersion = new Map(inventory.map((migration) => [migration.version, migration]));
+  return migrations.every((migration) => {
+    const remote = byVersion.get(migration.version);
+    return remote?.name === migration.name && remote.statements.length === 1 && remote.statements[0] === `baseline:${migration.name}` && remote.checksum === expectedBaselineChecksum(migration);
+  });
+}
+function confirmedSqlBatchReceipt(payload, expectedCommands) {
+  const receipt = recordPayload(payload);
+  if (!receipt || receipt.command !== "BATCH" || !Array.isArray(receipt.statements))
+    return false;
+  if (receipt.statements.length !== expectedCommands.length)
+    return false;
+  return receipt.statements.every((rawStatement, index) => {
+    const statement = recordPayload(rawStatement);
+    if (!statement || statement.index !== index + 1 || statement.command !== expectedCommands[index])
+      return false;
+    if (typeof statement.rowCount !== "number" || !Number.isSafeInteger(statement.rowCount) || statement.rowCount < 0)
+      return false;
+    if (typeof statement.durationMs !== "number" || !Number.isFinite(statement.durationMs) || statement.durationMs < 0)
+      return false;
+    return true;
+  });
+}
+function rlsStatementCommands(policyMode) {
+  return [
+    "CREATE",
+    "ALTER",
+    ...Array.from({ length: 5 }, () => "DROP"),
+    ...policyMode === "owner" ? Array.from({ length: 4 }, () => "CREATE") : []
+  ];
+}
+function migrationPushFailureState(applied, skipped, failedFile) {
+  return {
+    applied_before_failure: [...applied],
+    skipped_before_failure: [...skipped],
+    failed_file: failedFile
+  };
 }
 function sqlReferencesVector(sql) {
   return /\bvector\s*\(\s*\d+\s*\)/i.test(sql) || /::\s*vector\b/i.test(sql) || /\bvector_(cosine|l2|ip)_ops\b/i.test(sql) || /<=>|<#>|<->/.test(sql);
@@ -7339,8 +7464,16 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
       case "apply_migration": {
         if (!args.name || !args.sql)
           throw new Error("'name' and 'sql' required");
-        const r = await http.post(`/v1/projects/${ref}/database/migrations`, { name: args.name, sql: args.sql });
-        text = r.ok ? `✅ Migration '${args.name}' applied` : `❌ Failed (${r.status}): ${JSON.stringify(r.data)}`;
+        const r = await http.postReleaseMutation(`/v1/projects/${ref}/database/migrations`, { name: args.name, sql: args.sql });
+        if (!r.ok)
+          return releaseControlMutationFailure("database.apply_migration", r);
+        if (r.status !== 200) {
+          return releaseControlFailure("database.apply_migration", "OUTCOME_UNKNOWN", r.status);
+        }
+        if (!confirmedMigrationReceipt(r.data, { name: args.name, sql: args.sql })) {
+          return releaseControlFailure("database.apply_migration", "OUTCOME_UNKNOWN", r.status);
+        }
+        text = `✅ Migration '${args.name}' applied`;
         break;
       }
       case "push_migrations": {
@@ -7356,15 +7489,13 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
         const migrationFiles = sortMigrationFiles(files.map((file) => readMigrationFile(dir, file)));
         const migrationsResult = await http.get(`/v1/projects/${ref}/database/migrations`);
         if (!migrationsResult.ok) {
-          text = `❌ Failed to load applied migrations (${migrationsResult.status}): ${JSON.stringify(migrationsResult.data)}`;
-          break;
+          return releaseControlFailure("database.push_migrations", "HTTP_ERROR", migrationsResult.transportError ? null : migrationsResult.status);
         }
-        assertNoMigrationIdentityConflicts(migrationsResult.data, migrationFiles);
+        const migrationPlan = migrationPushPlan(migrationsResult.data, migrationFiles);
         if (args.dry_run) {
-          const appliedKeys = appliedMigrationKeys(migrationsResult.data);
-          const pending = migrationFiles.filter(({ name, version }) => !appliedKeys.has(name) && !appliedKeys.has(String(version)));
-          const alreadyApplied = migrationFiles.filter(({ name, version }) => appliedKeys.has(name) || appliedKeys.has(String(version)));
-          const pendingWithSql = pending;
+          const pending2 = migrationPlan.pending;
+          const alreadyApplied = migrationPlan.alreadyApplied;
+          const pendingWithSql = pending2;
           let vectorEnabled = null;
           if (pendingWithSql.some(({ sql }) => sqlReferencesVector(sql) || sqlCreatesVectorExtension(sql))) {
             const extResult = await execSql("SELECT extname AS name FROM pg_extension WHERE extname = 'vector';");
@@ -7376,7 +7507,7 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
             `Total: ${migrationFiles.length}`,
             "",
             "Pending:",
-            ...pending.length ? pending.map(({ file, version }) => `  - ${file} (${version})`) : ["  - none"],
+            ...pending2.length ? pending2.map(({ file, version }) => `  - ${file} (${version})`) : ["  - none"],
             "",
             "Already applied:",
             ...alreadyApplied.length ? alreadyApplied.map(({ file, version }) => `  - ${file} (${version})`) : ["  - none"],
@@ -7385,32 +7516,25 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
 `);
           break;
         }
+        const pending = new Set(migrationPlan.pending.map(({ file }) => file));
         const applied = [];
         const skipped = [];
-        const nameBoundMarkerKeys = nameBoundMigrationMarkerKeys(migrationsResult.data);
-        const historicalChecksumKeys = historicalChecksumMarkerKeys(migrationsResult.data, migrationFiles);
-        const legacyNameBoundKeys = legacyNameBoundMigrationKeys(migrationsResult.data, migrationFiles);
         for (const { file, name, version, sql } of migrationFiles) {
-          const migrationKey = migrationIdentityKey(version, name);
-          if (nameBoundMarkerKeys.has(migrationKey) || historicalChecksumKeys.has(migrationKey) || legacyNameBoundKeys.has(migrationKey)) {
+          if (!pending.has(file)) {
             skipped.push(file);
             continue;
           }
-          const r = await http.post(`/v1/projects/${ref}/database/migrations`, { name, sql, version });
-          if (r.ok) {
+          const r = await http.postReleaseMutation(`/v1/projects/${ref}/database/migrations`, { name, sql, version });
+          if (r.ok && r.status === 200 && confirmedMigrationReceipt(r.data, { name, version, sql })) {
             applied.push(file);
-          } else if (isAlreadyAppliedMigrationResponse(r)) {
+          } else if (isAlreadyAppliedMigrationResponse(r, { name, version, sql })) {
             skipped.push(file);
           } else {
-            text = [
-              `❌ Failed to apply ${file} (${r.status})`,
-              JSON.stringify(r.data, null, 2),
-              "",
-              `Applied before failure: ${applied.length}`,
-              `Skipped before failure: ${skipped.length}`
-            ].join(`
-`);
-            return { content: [{ type: "text", text }] };
+            const safeState = migrationPushFailureState(applied, skipped, file);
+            if (r.ok) {
+              return releaseControlFailure("database.push_migrations", "OUTCOME_UNKNOWN", r.status, safeState);
+            }
+            return releaseControlMutationFailure("database.push_migrations", r, safeState);
           }
         }
         text = [
@@ -7436,12 +7560,11 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
         const migrationFiles = sortMigrationFiles(files.map((file) => readMigrationFile(dir, file)));
         const r = await http.get(`/v1/projects/${ref}/database/migrations`);
         if (!r.ok) {
-          text = `❌ Failed to load applied migrations (${r.status}): ${JSON.stringify(r.data)}`;
-          break;
+          return releaseControlFailure("database.baseline_migrations", "HTTP_ERROR", r.transportError ? null : r.status);
         }
-        const appliedKeys = appliedMigrationKeys(r.data);
-        const missing = migrationFiles.filter(({ name, version }) => !appliedKeys.has(name) && !appliedKeys.has(String(version)));
-        const alreadyApplied = migrationFiles.filter(({ name, version }) => appliedKeys.has(name) || appliedKeys.has(String(version)));
+        const migrationPlan = migrationPushPlan(r.data, migrationFiles);
+        const missing = migrationPlan.pending;
+        const alreadyApplied = migrationPlan.alreadyApplied;
         if (args.dry_run) {
           text = [
             `Migration baseline dry run for ${dir}`,
@@ -7464,16 +7587,28 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
 `);
           break;
         }
-        const baselineResult = await http.post(`/v1/projects/${ref}/database/migrations/baseline`, { migrations: missing.map(({ name, version }) => ({ name, version })) });
-        text = baselineResult.ok ? [
+        const baselineResult = await http.postReleaseMutation(`/v1/projects/${ref}/database/migrations/baseline`, { migrations: missing.map(({ name, version }) => ({ name, version })) });
+        if (!baselineResult.ok) {
+          return releaseControlMutationFailure("database.baseline_migrations", baselineResult);
+        }
+        if (baselineResult.status !== 200) {
+          return releaseControlFailure("database.baseline_migrations", "OUTCOME_UNKNOWN", baselineResult.status);
+        }
+        const receipt = confirmedBaselineReceipt(baselineResult.data, missing);
+        if (!receipt) {
+          return releaseControlFailure("database.baseline_migrations", "OUTCOME_UNKNOWN", baselineResult.status);
+        }
+        const inventoryResult = await http.get(`/v1/projects/${ref}/database/migrations`, { maxResponseBytes: MAX_MIGRATION_INVENTORY_BYTES });
+        if (!inventoryResult.ok || !baselineInventoryIsApplied(inventoryResult.data, missing)) {
+          return releaseControlFailure("database.baseline_migrations", "OUTCOME_UNKNOWN", inventoryResult.transportError ? null : inventoryResult.status);
+        }
+        text = [
           `✅ Migration baseline completed for ${dir}`,
-          `Marked applied: ${missing.length}`,
-          `Already applied: ${alreadyApplied.length}`,
-          "",
-          "Marked files:",
-          ...missing.map(({ file, version }) => `  - ${file} (${version})`)
+          `Marked applied: ${receipt.marked.length}`,
+          `Already applied: ${alreadyApplied.length + receipt.concurrentlyAlreadyApplied}`,
+          ...receipt.marked.length ? ["", "Marked files:", ...receipt.marked.map(({ file, version }) => `  - ${file} (${version})`)] : []
         ].join(`
-`) : `❌ Failed (${baselineResult.status}): ${JSON.stringify(baselineResult.data)}`;
+`);
         break;
       }
       case "create_table_rls": {
@@ -7486,8 +7621,16 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
           throw new Error("Invalid RLS policy mode");
         const policySql = buildRlsPolicySql(qualifiedTable, policyMode, args.owner_column);
         const sql = `BEGIN; CREATE TABLE IF NOT EXISTS ${qualifiedTable} (${columns}); ALTER TABLE ${qualifiedTable} ENABLE ROW LEVEL SECURITY; ${policySql} COMMIT;`;
-        const r = await execSql(sql);
-        text = r.ok ? `✅ Table '${schema}.${args.table}' created with RLS (${policyMode === "owner" ? "auth.uid() owner policy" : "deny-all by default"})` : `❌ Failed (${r.status}): ${JSON.stringify(r.data)}`;
+        const r = await http.postReleaseMutation(`/v1/projects/${ref}/database/sql`, { sql, mode: "migration" });
+        if (!r.ok)
+          return releaseControlMutationFailure("database.create_table_rls", r);
+        if (r.status !== 200) {
+          return releaseControlFailure("database.create_table_rls", "OUTCOME_UNKNOWN", r.status);
+        }
+        if (!confirmedSqlBatchReceipt(r.data, rlsStatementCommands(policyMode))) {
+          return releaseControlFailure("database.create_table_rls", "OUTCOME_UNKNOWN", r.status);
+        }
+        text = `✅ Table '${schema}.${args.table}' created with RLS (${policyMode === "owner" ? "auth.uid() owner policy" : "deny-all by default"})`;
         break;
       }
       default:
@@ -7978,38 +8121,6 @@ ${JSON.stringify(r.data, null, 2)}` : `❌ Failed (${r.status}): ${JSON.stringif
   });
 }
 
-// src/shared/tools/release-control-response.ts
-var RELEASE_CONTROL_RESPONSE_SCHEMA = "supacloud.cli.release-control.v1";
-function releaseControlSuccess(operation, payload) {
-  return releaseControlResponse({
-    ...payload,
-    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
-    ok: true,
-    operation
-  });
-}
-function releaseControlFailure(operation, code, httpStatus, safeState = {}) {
-  return releaseControlErrorResponse({
-    ...safeState,
-    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
-    ok: false,
-    operation,
-    error: { code, http_status: httpStatus }
-  });
-}
-function releaseControlMutationFailure(operation, response) {
-  const outcomeUnknown = response.transportError || response.responseReadError || response.status === 408 || response.status >= 500;
-  return outcomeUnknown ? releaseControlFailure(operation, "OUTCOME_UNKNOWN", response.transportError ? null : response.status) : releaseControlFailure(operation, "HTTP_ERROR", response.status);
-}
-function releaseControlResponse(payload) {
-  return {
-    content: [{ type: "text", text: JSON.stringify(payload, null, 2) }]
-  };
-}
-function releaseControlErrorResponse(payload) {
-  return { ...releaseControlResponse(payload), isError: true };
-}
-
 // src/shared/tools/storage-tools.ts
 var MAX_BUCKET_ID_LENGTH = 100;
 var MAX_MIME_TYPE_COUNT = 100;
@@ -12047,7 +12158,7 @@ var MUTATION_TOOL_SCHEMA = {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.21.2",
+  version: "0.22.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.21.2",
+  "version": "0.22.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",