@viberaven/cli 1.6.3 → 1.6.4

package/dist/cli.js

@@ -8484,8 +8484,9 @@ function readFunctionAttributes(tokens) {
     if (t.value === "security" && next?.kind === "word" && (next.value === "definer" || next.value === "invoker")) {
       out.definer = next.value === "definer";
     }
-    if (t.value === "returns" && next?.kind === "word") {
-      out.returnsTrigger = next.value === "trigger" || next.value === "event_trigger";
+    if (t.value === "returns" && (next?.kind === "word" || next?.kind === "ident")) {
+      const type = next.value;
+      out.returnsTrigger = type === "trigger" || type === "event_trigger";
     }
   }
   return out;
@@ -8613,7 +8614,7 @@ function analyzeRls(replay) {
     }
     if (!table2.rls && (table2.created || table2.disabledLoc)) {
       const where = table2.disabledLoc ?? table2.arrivedLoc ?? table2.created;
-      const risk = "Anyone holding the anon key your frontend ships can read and change every row through the Data API (unless the table's grants were revoked).";
+      const risk = "Without RLS, the Data API does not enforce row restrictions for roles and operations allowed by the table's grants. Verify those grants to determine who can read or change rows.";
       const message = table2.disabledLoc ? `${table2.display} has row level security turned off at ${at(table2.disabledLoc)}. ${risk}` : table2.arrivedLoc ? `${table2.display} is moved into public at ${at(table2.arrivedLoc)} without row level security, and no later migration enables it. ${risk}` : `${table2.display} is created at ${at(table2.created)} and no migration enables row level security on it. ${risk}`;
       missingRls.push({
         id: "rls_disabled",
@@ -9439,7 +9440,7 @@ function buildRlsCheck(replay) {
       id: "supabase-rls-policy-proof",
       title: "Supabase RLS policy proof",
       status: "needs_work",
-      summary: `${plural(analysis.missingRls.length, "public table")} without row level security: ${names}. Anyone holding the anon key your frontend ships can read and change those rows through the Data API.`,
+      summary: `${plural(analysis.missingRls.length, "public table")} without row level security: ${names}. The Data API does not enforce row restrictions for roles and operations allowed by the table's grants. Verify those grants to determine who can read or change rows.`,
       evidence: findingEvidence(analysis.missingRls),
       findings
     };
@@ -15022,7 +15023,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.6.3";
+    VERSION = "1.6.4";
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viberaven/cli",
-  "version": "1.6.3",
+  "version": "1.6.4",
   "description": "VibeRaven CLI and local Studio: Supabase RLS and security check for AI-built Vercel + Supabase apps, with an agent task list and fix prompts.",
   "license": "MIT",
   "author": "VibeRaven",