@supacloud/cli 0.7.0 → 0.9.0

package/dist/index.js

@@ -14,9 +14,6 @@ var __export = (target, all) => {
     });
 };
 
-// src/index.ts
-import path from "node:path";
-
 // node_modules/zod/v4/classic/external.js
 var exports_external = {};
 __export(exports_external, {
@@ -14780,7 +14777,9 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
     user_id: exports_external.string().optional().describe("[get_auth_user] User UUID"),
     limit: exports_external.number().optional().describe("[list_auth_users] Max users (default: 20)"),
     name: exports_external.string().optional().describe("[apply_migration] Migration name"),
-    columns: exports_external.string().optional().describe("[create_table_rls] Column definitions")
+    columns: exports_external.string().optional().describe("[create_table_rls] Column definitions"),
+    policy_mode: exports_external.enum(["deny_all", "owner"]).optional().describe("[create_table_rls] RLS policy mode (default: deny_all)"),
+    owner_column: exports_external.string().optional().describe("[create_table_rls owner] UUID owner column matched to auth.uid()")
   }, async (args) => {
     const { action } = args;
     const ref = projectRef || args.ref;
@@ -15056,9 +15055,15 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
       case "create_table_rls": {
         if (!args.table || !args.columns)
           throw new Error("'table' and 'columns' required");
-        const sql = `BEGIN; CREATE TABLE IF NOT EXISTS "${schema}"."${args.table}" (${args.columns}); ALTER TABLE "${schema}"."${args.table}" ENABLE ROW LEVEL SECURITY; CREATE POLICY "Enable ALL for authenticated" ON "${schema}"."${args.table}" FOR ALL TO authenticated USING (true) WITH CHECK (true); COMMIT;`;
+        const qualifiedTable = `${quoteIdentifier(schema, "schema")}.${quoteIdentifier(args.table, "table")}`;
+        const columns = validateColumnDefinitions(args.columns);
+        const policyMode = args.policy_mode || "deny_all";
+        if (policyMode !== "deny_all" && policyMode !== "owner")
+          throw new Error("Invalid RLS policy mode");
+        const policySql = buildRlsPolicySql(qualifiedTable, policyMode, args.owner_column);
+        const sql = `BEGIN; CREATE TABLE IF NOT EXISTS ${qualifiedTable} (${columns}); ALTER TABLE ${qualifiedTable} ENABLE ROW LEVEL SECURITY; ${policySql} COMMIT;`;
         const r = await execSql(sql);
-        text = r.ok ? `✅ Table '${schema}.${args.table}' created with RLS` : `❌ Failed (${r.status}): ${JSON.stringify(r.data)}`;
+        text = r.ok ? `✅ Table '${schema}.${args.table}' created with RLS (${policyMode === "owner" ? "auth.uid() owner policy" : "deny-all by default"})` : `❌ Failed (${r.status}): ${JSON.stringify(r.data)}`;
         break;
       }
       default:
@@ -15067,6 +15072,42 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
     return { content: [{ type: "text", text }] };
   });
 }
+function quoteIdentifier(value, label) {
+  if (typeof value !== "string" || !/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(value)) {
+    throw new Error(`Invalid ${label} identifier`);
+  }
+  return `"${value}"`;
+}
+function validateColumnDefinitions(value) {
+  if (typeof value !== "string")
+    throw new Error("Invalid column definitions");
+  const columns = value.trim();
+  if (!columns || columns.length > 16384)
+    throw new Error("Invalid column definitions");
+  if (/[;\0]/.test(columns) || /--|\/\*|\*\//.test(columns) || /\b(?:ALTER|CREATE|DROP|GRANT|REVOKE|TRUNCATE|COPY|CALL|DO)\b/i.test(columns)) {
+    throw new Error("Unsafe column definitions");
+  }
+  return columns;
+}
+function buildRlsPolicySql(qualifiedTable, policyMode, ownerColumnValue) {
+  const policyNames = [
+    "Enable ALL for authenticated",
+    "SupaCloud owner select",
+    "SupaCloud owner insert",
+    "SupaCloud owner update",
+    "SupaCloud owner delete"
+  ];
+  const dropPolicies = policyNames.map((name) => `DROP POLICY IF EXISTS "${name}" ON ${qualifiedTable};`).join(" ");
+  if (policyMode === "deny_all")
+    return dropPolicies;
+  const ownerColumn = quoteIdentifier(ownerColumnValue, "owner column");
+  const predicate = `auth.uid() IS NOT NULL AND auth.uid() = ${ownerColumn}`;
+  return `${dropPolicies}
+      CREATE POLICY "SupaCloud owner select" ON ${qualifiedTable} FOR SELECT TO authenticated USING (${predicate});
+      CREATE POLICY "SupaCloud owner insert" ON ${qualifiedTable} FOR INSERT TO authenticated WITH CHECK (${predicate});
+      CREATE POLICY "SupaCloud owner update" ON ${qualifiedTable} FOR UPDATE TO authenticated USING (${predicate}) WITH CHECK (${predicate});
+      CREATE POLICY "SupaCloud owner delete" ON ${qualifiedTable} FOR DELETE TO authenticated USING (${predicate});`;
+}
 function sqlString(value) {
   return `'${value.replace(/'/g, "''")}'`;
 }
@@ -16908,9 +16949,8 @@ Actions: routes, upsert_route, update_route, delete_route, config, get_certifica
 }
 
 // src/index.ts
-var invokedCommand = path.basename(process.argv[1] || "supacloud-cli");
-var commandName = invokedCommand === "supacloud" ? "supacloud" : "supacloud-cli";
-var preferredCommand = "supacloud-cli";
+var commandName = "supacloud-cli";
+var preferredCommand = commandName;
 var projectActionSchema = exports_external.enum([
   "get",
   "health",
@@ -16957,8 +16997,6 @@ function printHelp(context = resolveSupaCloudContext()) {
 ║  Project CLI for SupaCloud users                         ║
 ╚═══════════════════════════════════════════════════════════╝
 
-${commandName === "supacloud" ? "NOTE\n\n  `supacloud` is kept as a compatibility alias. Prefer `supacloud-cli`\n  to avoid confusion with the server binary at /usr/local/bin/supacloud.\n" : ""}
-
 USAGE
 
   ${preferredCommand} <module> <action> [--flags]

package/package.json

@@ -1,12 +1,11 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
   "bin": {
-    "supacloud-cli": "dist/index.js",
-    "supacloud": "dist/index.js"
+    "supacloud-cli": "dist/index.js"
   },
   "files": [
     "dist",