memoir-cli 3.17.3 → 3.17.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memoir-cli",
-  "version": "3.17.3",
+  "version": "3.17.5",
   "mcpName": "io.github.camgitt/memoir",
   "description": "Portable, project-scoped memory and session handoffs for coding agents. Readable files, MCP recall, and optional user-passphrase encrypted backups.",
   "main": "src/index.js",

package/src/cloud/auth.js

@@ -1,7 +1,7 @@
 import fs from 'fs-extra';
 import path from 'path';
 import os from 'os';
-import { SUPABASE_URL, SUPABASE_ANON_KEY, STORAGE_BUCKET } from './constants.js';
+import { SUPABASE_URL, SUPABASE_ANON_KEY, STORAGE_BUCKET, SUPPORT_EMAIL } from './constants.js';
 
 const isWin = process.platform === 'win32';
 const configDir = isWin
@@ -21,25 +21,39 @@ async function supaFetch(endpoint, options = {}) {
   });
 }
 
+// GoTrue's REST API takes the post-email landing URL as a `redirect_to`
+// QUERY PARAM. `options.emailRedirectTo` / `options.redirectTo` in the JSON
+// body is supabase-js's client shape — sent raw it is silently ignored and
+// the email links fall back to the project's Site URL. Both URLs below must
+// also be on the Auth → URL Configuration → Redirect URLs allow-list.
 const CONFIRMED_URL = 'https://memoir.sh/confirmed';
 const RESET_URL = 'https://memoir.sh/reset-password';
 
 export async function signUp(email, password) {
-  const res = await supaFetch(`/auth/v1/signup?redirect_to=${encodeURIComponent(CONFIRMED_URL)}`, { method: 'POST', body: JSON.stringify({ email, password }) });
+  const res = await supaFetch(`/auth/v1/signup?redirect_to=${encodeURIComponent(CONFIRMED_URL)}`, {
+    method: 'POST',
+    body: JSON.stringify({ email, password }),
+  });
   const data = await res.json();
   if (!res.ok) throw new Error(data.error_description || data.msg || 'Sign up failed');
   return data;
 }
 
 export async function signIn(email, password) {
-  const res = await supaFetch('/auth/v1/token?grant_type=password', { method: 'POST', body: JSON.stringify({ email, password }) });
+  const res = await supaFetch('/auth/v1/token?grant_type=password', {
+    method: 'POST',
+    body: JSON.stringify({ email, password }),
+  });
   const data = await res.json();
   if (!res.ok) throw new Error(data.error_description || data.msg || 'Sign in failed');
   return data;
 }
 
 export async function refreshSession(refreshToken) {
-  const res = await supaFetch('/auth/v1/token?grant_type=refresh_token', { method: 'POST', body: JSON.stringify({ refresh_token: refreshToken }) });
+  const res = await supaFetch('/auth/v1/token?grant_type=refresh_token', {
+    method: 'POST',
+    body: JSON.stringify({ refresh_token: refreshToken }),
+  });
   const data = await res.json();
   if (!res.ok) throw new Error(data.error_description || data.msg || 'Token refresh failed');
   return data;
@@ -47,30 +61,58 @@ export async function refreshSession(refreshToken) {
 
 export async function saveSession(session) {
   await fs.ensureDir(configDir);
-  const payload = { access_token: session.access_token, refresh_token: session.refresh_token, expires_at: Date.now() + (session.expires_in * 1000), user: { id: session.user.id, email: session.user.email } };
+  const payload = {
+    access_token: session.access_token,
+    refresh_token: session.refresh_token,
+    expires_at: Date.now() + (session.expires_in * 1000),
+    user: {
+      id: session.user.id,
+      email: session.user.email,
+    },
+  };
   await fs.writeFile(AUTH_FILE, JSON.stringify(payload, null, 2), { mode: 0o600 });
   return payload;
 }
 
 export async function getSession() {
   if (!await fs.pathExists(AUTH_FILE)) return null;
+
   const stored = await fs.readJson(AUTH_FILE);
+
+  // If token expires within 60 seconds, refresh
   if (stored.expires_at < Date.now() + 60000) {
-    try { return await saveSession(await refreshSession(stored.refresh_token)); }
-    catch { await fs.remove(AUTH_FILE); return null; }
+    try {
+      const refreshed = await refreshSession(stored.refresh_token);
+      return await saveSession(refreshed);
+    } catch {
+      // Refresh failed — session is dead
+      await fs.remove(AUTH_FILE);
+      return null;
+    }
   }
+
   return stored;
 }
 
-export async function logout() { if (await fs.pathExists(AUTH_FILE)) await fs.remove(AUTH_FILE); }
-export async function isLoggedIn() { return !!(await getSession()); }
+export async function logout() {
+  if (await fs.pathExists(AUTH_FILE)) {
+    await fs.remove(AUTH_FILE);
+  }
+}
+
+export async function isLoggedIn() {
+  const session = await getSession();
+  return !!session;
+}
 
 // A failed plan lookup is not evidence that a user is on Free. Callers use
 // this value to choose destructive retention limits, so fail closed instead of
 // silently downgrading a Pro account and pruning its history.
 export async function getSubscription(session) {
   const res = await supaFetch('/rest/v1/subscriptions?select=*&user_id=eq.' + encodeURIComponent(session.user.id), {
-    headers: { 'Authorization': `Bearer ${session.access_token}` },
+    headers: {
+      'Authorization': `Bearer ${session.access_token}`,
+    },
   });
   if (!res.ok) throw new Error(`Could not verify subscription (${res.status}). Existing backups were not pruned.`);
   const data = await res.json();
@@ -80,8 +122,14 @@ export async function getSubscription(session) {
 }
 
 export async function resetPassword(email) {
-  const res = await supaFetch(`/auth/v1/recover?redirect_to=${encodeURIComponent(RESET_URL)}`, { method: 'POST', body: JSON.stringify({ email }) });
-  if (!res.ok) { const data = await res.json(); throw new Error(data.error_description || data.msg || 'Password reset failed'); }
+  const res = await supaFetch(`/auth/v1/recover?redirect_to=${encodeURIComponent(RESET_URL)}`, {
+    method: 'POST',
+    body: JSON.stringify({ email }),
+  });
+  if (!res.ok) {
+    const data = await res.json();
+    throw new Error(data.error_description || data.msg || 'Password reset failed');
+  }
 }
 
 async function requireDelete(res, label) {
@@ -91,27 +139,146 @@ async function requireDelete(res, label) {
   throw new Error(`${label} failed (${res.status})${detail ? ': ' + detail : ''}. Nothing else was reported as deleted; retry account deletion.`);
 }
 
+async function requireRowDelete(res, label, { expectedMinRows = 0 } = {}) {
+  await requireDelete(res, label);
+  if (res.status === 204) {
+    throw new Error(`${label} failed: server returned 204 without representation (check RLS DELETE policy). Nothing else was reported as deleted; retry account deletion.`);
+  }
+  let rows = [];
+  try {
+    rows = await res.json();
+  } catch {
+    rows = [];
+  }
+  if (!Array.isArray(rows)) {
+    throw new Error(`${label} failed: unexpected response shape. Nothing else was reported as deleted; retry account deletion.`);
+  }
+  if (expectedMinRows > 0 && rows.length < expectedMinRows) {
+    throw new Error(`${label} failed: 0 rows removed (check RLS DELETE policy). Nothing else was reported as deleted; retry account deletion.`);
+  }
+  return rows;
+}
+
+async function verifyNoneRemaining(endpoint, headers, label) {
+  const checkRes = await fetch(`${SUPABASE_URL}${endpoint}`, { headers });
+  if (!checkRes.ok) {
+    throw new Error(`${label} verification failed (${checkRes.status}). Nothing else was reported as deleted; retry account deletion.`);
+  }
+  const remaining = await checkRes.json();
+  if (!Array.isArray(remaining) || remaining.length > 0) {
+    throw new Error(`${label} failed: 0 rows removed while account rows still exist (check RLS DELETE policy). Nothing else was reported as deleted; retry account deletion.`);
+  }
+}
+
 // Deletes the data the current user is authorized to delete. Auth-user removal
 // itself requires a privileged server-side endpoint and must never be attempted
 // with a service-role key from this CLI.
 export async function deleteAccount(session) {
-  const headers = { 'Authorization': `Bearer ${session.access_token}`, 'apikey': SUPABASE_ANON_KEY };
-  const backupsRes = await fetch(`${SUPABASE_URL}/rest/v1/backups?select=*&user_id=eq.${encodeURIComponent(session.user.id)}`, { headers });
-  if (!backupsRes.ok) throw new Error(`Could not enumerate backups (${backupsRes.status}); account deletion stopped safely.`);
+  const headers = {
+    'Authorization': `Bearer ${session.access_token}`,
+    'apikey': SUPABASE_ANON_KEY,
+  };
+  const deleteHeaders = {
+    ...headers,
+    'Prefer': 'return=representation',
+  };
+
+  // Deleting data does not cancel a Stripe subscription, and the billing
+  // webhook re-creates the subscription row on the next renewal. Stop before
+  // deleting anything while the account is paying, or while the plan can't be read.
+  let sub;
+  try {
+    sub = await getSubscription(session);
+  } catch (error) {
+    throw new Error(`Could not check your plan (${error.message.replace(/ Existing backups were not pruned\.$/, '')}). Nothing was deleted; retry account deletion.`);
+  }
+  if (sub.status === 'pro') {
+    throw new Error(`Your Pro subscription is still active, and deleting your data would not stop billing. Email ${SUPPORT_EMAIL} to cancel it, then run this again. Nothing was deleted.`);
+  }
+
+  const backupsRes = await fetch(
+    `${SUPABASE_URL}/rest/v1/backups?select=*&user_id=eq.${encodeURIComponent(session.user.id)}`,
+    { headers }
+  );
+  if (!backupsRes.ok) {
+    throw new Error(`Could not enumerate backups (${backupsRes.status}); account deletion stopped safely.`);
+  }
   const backups = await backupsRes.json();
 
   for (const backup of backups) {
-    if (typeof backup.storage_path !== 'string' || !backup.storage_path.startsWith(session.user.id + '/')) throw new Error('Unsafe backup path; account deletion stopped.');
-    const object = await fetch(`${SUPABASE_URL}/storage/v1/object/${STORAGE_BUCKET}`, {
-      method: 'DELETE', headers: { ...headers, 'Content-Type': 'application/json' }, body: JSON.stringify({ prefixes: [backup.storage_path] }),
+    if (typeof backup.storage_path !== 'string' || !backup.storage_path.startsWith(session.user.id + '/')) {
+      throw new Error('Unsafe backup path; account deletion stopped.');
+    }
+    const objectRes = await fetch(`${SUPABASE_URL}/storage/v1/object/${STORAGE_BUCKET}`, {
+      method: 'DELETE',
+      headers: {
+        ...headers,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ prefixes: [backup.storage_path] }),
     });
-    await requireDelete(object, 'Backup object deletion');
-    const row = await fetch(`${SUPABASE_URL}/rest/v1/backups?id=eq.${encodeURIComponent(backup.id)}`, { method: 'DELETE', headers });
-    await requireDelete(row, 'Backup metadata deletion');
+    await requireDelete(objectRes, 'Backup object deletion');
+
+    const rowRes = await fetch(
+      `${SUPABASE_URL}/rest/v1/backups?id=eq.${encodeURIComponent(backup.id)}`,
+      { method: 'DELETE', headers: deleteHeaders }
+    );
+    await requireRowDelete(rowRes, 'Backup metadata deletion', { expectedMinRows: 1 });
+  }
+
+  // Share bundles go before their rows, like backups above: if a bundle
+  // delete fails, the row is still there for the retry to find.
+  const linksRes = await fetch(
+    `${SUPABASE_URL}/rest/v1/shared_links?select=id,backup_id&created_by=eq.${encodeURIComponent(session.user.id)}`,
+    { headers }
+  );
+  if (!linksRes.ok) {
+    throw new Error(`Could not enumerate shared links (${linksRes.status}). Nothing else was reported as deleted; retry account deletion.`);
+  }
+  const links = await linksRes.json();
+  if (!Array.isArray(links)) {
+    throw new Error('Could not enumerate shared links. Nothing else was reported as deleted; retry account deletion.');
+  }
+  for (const link of links) {
+    if (typeof link?.backup_id === 'string' && link.backup_id.startsWith(session.user.id + '/')) {
+      const shareObjRes = await fetch(`${SUPABASE_URL}/storage/v1/object/${STORAGE_BUCKET}`, {
+        method: 'DELETE',
+        headers: {
+          ...headers,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ prefixes: [link.backup_id] }),
+      });
+      await requireDelete(shareObjRes, 'Shared bundle object deletion');
+    }
+  }
+
+  const sharedRes = await fetch(
+    `${SUPABASE_URL}/rest/v1/shared_links?created_by=eq.${encodeURIComponent(session.user.id)}`,
+    { method: 'DELETE', headers: deleteHeaders }
+  );
+  const deletedLinks = await requireRowDelete(sharedRes, 'Shared-link deletion');
+  if (deletedLinks.length < links.length) {
+    await verifyNoneRemaining(
+      `/rest/v1/shared_links?select=id&created_by=eq.${encodeURIComponent(session.user.id)}&limit=1`,
+      headers,
+      'Shared-link deletion'
+    );
+  }
+
+  const subRes = await fetch(
+    `${SUPABASE_URL}/rest/v1/subscriptions?user_id=eq.${encodeURIComponent(session.user.id)}`,
+    { method: 'DELETE', headers: deleteHeaders }
+  );
+  const deletedSubs = await requireRowDelete(subRes, 'Subscription deletion');
+  if (deletedSubs.length === 0) {
+    await verifyNoneRemaining(
+      `/rest/v1/subscriptions?select=user_id&user_id=eq.${encodeURIComponent(session.user.id)}&limit=1`,
+      headers,
+      'Subscription deletion'
+    );
   }
 
-  await requireDelete(await fetch(`${SUPABASE_URL}/rest/v1/shared_links?user_id=eq.${encodeURIComponent(session.user.id)}`, { method: 'DELETE', headers }), 'Shared-link deletion');
-  await requireDelete(await fetch(`${SUPABASE_URL}/rest/v1/subscriptions?user_id=eq.${encodeURIComponent(session.user.id)}`, { method: 'DELETE', headers }), 'Subscription deletion');
   await logout();
   return { localDataDeleted: true, authUserDeleted: false };
 }

package/src/cloud/constants.js

@@ -7,3 +7,6 @@ export const STORAGE_BUCKET = 'memoir-backups';
 // Free is a safety net; Pro is "full version history" (memoir.sh pricing).
 export const MAX_BACKUPS_FREE = 10;
 export const MAX_BACKUPS_PRO = 100;
+// Public contact on memoir.sh (forwards via ImprovMX). Used where the CLI
+// can't finish a job itself, e.g. cancelling a Pro subscription.
+export const SUPPORT_EMAIL = 'hello@memoir.sh';

package/src/commands/cloud.js

@@ -26,11 +26,20 @@ export async function cloudPushCommand(options = {}) {
     throw new Error('Cloud login required');
   }
 
-  const sub = await getSubscription(session);
-  const isPro = sub.status === 'pro';
+  let isPro = false;
+  let planVerified = false;
+  try {
+    const sub = await getSubscription(session);
+    isPro = sub.status === 'pro';
+    planVerified = true;
+  } catch {
+    // If plan lookup fails, still upload the new backup and skip retention
+    // pruning below rather than aborting the backup or assuming Free.
+    planVerified = false;
+  }
 
-  // Check backup count for free users
-  if (!isPro) {
+  // Check backup count for verified free users
+  if (planVerified && !isPro) {
     const existing = await listBackups(session);
     if (existing.length >= MAX_BACKUPS_FREE) {
       console.log('\n' + boxen(
@@ -75,8 +84,8 @@ export async function cloudPushCommand(options = {}) {
 
     const backup = await uploadBackup(stagingDir, session, toolResults);
 
-    // Cleanup old backups
-    const deleted = await cleanupOldBackups(session, isPro);
+    // Cleanup old backups only when the subscription plan was verified
+    const deleted = planVerified ? await cleanupOldBackups(session, isPro) : 0;
 
     spinner.stop();
 

package/src/commands/login.js

@@ -9,54 +9,181 @@ export async function loginCommand(options = {}) {
   if (existing) {
     try {
       const sub = await getSubscription(existing);
-      console.log('\n' + boxen(gradient.pastel('  memoir cloud  ') + '\n\n' + chalk.green('✔ Already logged in as ') + chalk.cyan(existing.user.email) + '\n' + chalk.gray('Plan: ') + (sub.status === 'pro' ? chalk.green('Pro') : chalk.yellow('Free')), { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }) + '\n');
+      console.log('\n' + boxen(
+        gradient.pastel('  memoir cloud  ') + '\n\n' +
+        chalk.green('✔ Already logged in as ') + chalk.cyan(existing.user.email) + '\n' +
+        chalk.gray('Plan: ') + (sub.status === 'pro' ? chalk.green('Pro') : chalk.yellow('Free')),
+        { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }
+      ) + '\n');
     } catch (error) {
-      console.log('\n' + boxen(chalk.green('✔ Logged in as ') + chalk.cyan(existing.user.email) + '\n' + chalk.yellow('Plan could not be verified right now. No backup history will be pruned until it can be verified.') + '\n' + chalk.gray(error.message), { padding: 1, borderStyle: 'round', borderColor: 'yellow' }) + '\n');
+      console.log('\n' + boxen(
+        chalk.green('✔ Logged in as ') + chalk.cyan(existing.user.email) + '\n' +
+        chalk.yellow('Plan could not be verified right now. No backup history will be pruned until it can be verified.') + '\n' +
+        chalk.gray(error.message),
+        { padding: 1, borderStyle: 'round', borderColor: 'yellow' }
+      ) + '\n');
     }
     return;
   }
 
   let action, email, password;
-  if (options.email && options.password) { action = options.signup ? 'signup' : 'signin'; email = options.email; password = options.password; }
-  else {
+
+  if (options.email && options.password) {
+    action = options.signup ? 'signup' : 'signin';
+    email = options.email;
+    password = options.password;
+  } else {
     console.log();
-    action = (await inquirer.prompt([{ type: 'list', name: 'action', message: 'Sign in or create account?', choices: [{ name: 'Sign in (existing account)', value: 'signin' }, { name: 'Create account', value: 'signup' }] }])).action;
-    email = (await inquirer.prompt([{ type: 'input', name: 'email', message: 'Email:', validate: v => v.includes('@') ? true : 'Enter a valid email' }])).email;
-    password = (await inquirer.prompt([{ type: 'password', name: 'password', message: 'Password:', mask: '*', validate: v => v.length >= 6 ? true : 'Password must be at least 6 characters' }])).password;
+    const actionAnswer = await inquirer.prompt([{
+      type: 'list',
+      name: 'action',
+      message: 'Sign in or create account?',
+      choices: [
+        { name: 'Sign in (existing account)', value: 'signin' },
+        { name: 'Create account', value: 'signup' },
+      ],
+    }]);
+    action = actionAnswer.action;
+
+    const emailAnswer = await inquirer.prompt([{
+      type: 'input',
+      name: 'email',
+      message: 'Email:',
+      validate: v => v.includes('@') ? true : 'Enter a valid email',
+    }]);
+    email = emailAnswer.email;
+
+    const passwordAnswer = await inquirer.prompt([{
+      type: 'password',
+      name: 'password',
+      message: 'Password:',
+      mask: '*',
+      validate: v => v.length >= 6 ? true : 'Password must be at least 6 characters',
+    }]);
+    password = passwordAnswer.password;
   }
 
   try {
     let session;
+
     if (action === 'signup') {
       const result = await signUp(email, password);
-      if (result.access_token) session = await saveSession(result);
-      else { console.log('\n' + boxen(chalk.green('✔ Account created!') + '\n\n' + chalk.white('Check your email to confirm, then run ') + chalk.cyan('memoir login') + chalk.white(' again.'), { padding: 1, borderStyle: 'round', borderColor: 'green' }) + '\n'); return; }
-    } else session = await saveSession(await signIn(email, password));
+      if (result.access_token) {
+        session = await saveSession(result);
+      } else {
+        // Email confirmation required
+        console.log('\n' + boxen(
+          chalk.green('✔ Account created!') + '\n\n' +
+          chalk.white('Check your email to confirm, then run ') + chalk.cyan('memoir login') + chalk.white(' again.'),
+          { padding: 1, borderStyle: 'round', borderColor: 'green' }
+        ) + '\n');
+        return;
+      }
+    } else {
+      const result = await signIn(email, password);
+      session = await saveSession(result);
+    }
 
     let plan = 'Unknown';
-    try { const sub = await getSubscription(session); plan = sub.status === 'pro' ? 'Pro' : 'Free'; } catch {}
-    console.log('\n' + boxen(gradient.pastel('  memoir cloud  ') + '\n\n' + chalk.green('✔ Logged in as ') + chalk.cyan(session.user.email) + '\n' + chalk.gray('Plan: ') + (plan === 'Pro' ? chalk.green(plan) : plan === 'Free' ? chalk.yellow(plan) : chalk.yellow(plan + ' — will retry before retention cleanup')) + '\n\n' + chalk.gray('Try: ') + chalk.cyan('memoir cloud push') + chalk.gray(' to back up to the cloud'), { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }) + '\n');
-  } catch (error) { console.log('\n' + boxen(chalk.red('✖ ' + error.message), { padding: 1, borderStyle: 'round', borderColor: 'red' }) + '\n'); }
+    try {
+      const sub = await getSubscription(session);
+      plan = sub.status === 'pro' ? 'Pro' : 'Free';
+    } catch {}
+
+    console.log('\n' + boxen(
+      gradient.pastel('  memoir cloud  ') + '\n\n' +
+      chalk.green('✔ Logged in as ') + chalk.cyan(session.user.email) + '\n' +
+      chalk.gray('Plan: ') + (
+        plan === 'Pro'
+          ? chalk.green(plan)
+          : plan === 'Free'
+            ? chalk.yellow(plan)
+            : chalk.yellow(plan + ' — will retry before retention cleanup')
+      ) + '\n\n' +
+      chalk.gray('Try: ') + chalk.cyan('memoir cloud push') + chalk.gray(' to back up to the cloud'),
+      { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }
+    ) + '\n');
+  } catch (error) {
+    console.log('\n' + boxen(
+      chalk.red('✖ ' + error.message),
+      { padding: 1, borderStyle: 'round', borderColor: 'red' }
+    ) + '\n');
+  }
 }
 
 export async function forgotPasswordCommand(options = {}) {
   let email = options.email;
-  if (!email) email = (await inquirer.prompt([{ type: 'input', name: 'email', message: 'Email:', validate: v => v.includes('@') ? true : 'Enter a valid email' }])).email;
-  try { await resetPassword(email); console.log('\n' + boxen(chalk.green('✔ Password reset email sent!') + '\n\n' + chalk.white('Check ') + chalk.cyan(email) + chalk.white(' for a reset link.'), { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }) + '\n'); }
-  catch (error) { console.log('\n' + boxen(chalk.red('✖ ' + error.message), { padding: 1, borderStyle: 'round', borderColor: 'red' }) + '\n'); }
+
+  if (!email) {
+    const emailAnswer = await inquirer.prompt([{
+      type: 'input',
+      name: 'email',
+      message: 'Email:',
+      validate: v => v.includes('@') ? true : 'Enter a valid email',
+    }]);
+    email = emailAnswer.email;
+  }
+
+  try {
+    await resetPassword(email);
+    console.log('\n' + boxen(
+      chalk.green('✔ Password reset email sent!') + '\n\n' +
+      chalk.white('Check ') + chalk.cyan(email) + chalk.white(' for a reset link.'),
+      { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }
+    ) + '\n');
+  } catch (error) {
+    console.log('\n' + boxen(
+      chalk.red('✖ ' + error.message),
+      { padding: 1, borderStyle: 'round', borderColor: 'red' }
+    ) + '\n');
+  }
 }
 
-export async function logoutCommand() { await logout(); console.log('\n' + boxen(chalk.green('✔ Logged out'), { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }) + '\n'); }
+export async function logoutCommand() {
+  await logout();
+  console.log('\n' + boxen(
+    chalk.green('✔ Logged out'),
+    { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }
+  ) + '\n');
+}
 
 export async function deleteAccountCommand(options = {}) {
   const session = await getSession();
-  if (!session) { console.log('\n' + boxen(chalk.red('✖ Not logged in. Run ') + chalk.cyan('memoir login') + chalk.red(' first.'), { padding: 1, borderStyle: 'round', borderColor: 'red' }) + '\n'); return; }
+  if (!session) {
+    console.log('\n' + boxen(
+      chalk.red('✖ Not logged in. Run ') + chalk.cyan('memoir login') + chalk.red(' first.'),
+      { padding: 1, borderStyle: 'round', borderColor: 'red' }
+    ) + '\n');
+    return;
+  }
+
   if (!options.confirm) {
-    const answer = await inquirer.prompt([{ type: 'input', name: 'confirmation', message: 'Type DELETE to remove your Memoir cloud data and sign out:' }]);
-    if (answer.confirmation !== 'DELETE') { console.log('\n' + chalk.gray('  Account-data deletion cancelled.') + '\n'); return; }
+    const answer = await inquirer.prompt([{
+      type: 'input',
+      name: 'confirmation',
+      message: 'Type DELETE to remove your Memoir cloud data and sign out:',
+    }]);
+
+    if (answer.confirmation !== 'DELETE') {
+      console.log('\n' + chalk.gray('  Account-data deletion cancelled.') + '\n');
+      return;
+    }
   }
+
   try {
     await deleteAccount(session);
-    console.log('\n' + boxen(gradient.pastel('  memoir cloud  ') + '\n\n' + chalk.green('✔ Memoir cloud data deleted and this device signed out.') + '\n' + chalk.gray('Backups, shared links, and subscription data accessible to this account were removed.') + '\n\n' + chalk.yellow('Your authentication identity may still exist. Full auth-account removal requires the hosted account-deletion service.'), { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }) + '\n');
-  } catch (error) { console.log('\n' + boxen(chalk.red('✖ Deletion incomplete: ' + error.message) + '\n' + chalk.gray('Retry the command. Memoir will not report success for an incomplete deletion.'), { padding: 1, borderStyle: 'round', borderColor: 'red' }) + '\n'); }
+    console.log('\n' + boxen(
+      gradient.pastel('  memoir cloud  ') + '\n\n' +
+      chalk.green('✔ Memoir cloud data deleted and this device signed out.') + '\n' +
+      chalk.gray('Backups, shared links, and subscription data accessible to this account were removed.') + '\n\n' +
+      chalk.yellow('Your authentication identity may still exist in Supabase Auth (removing the login record requires server-side admin access).'),
+      { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }
+    ) + '\n');
+  } catch (error) {
+    console.log('\n' + boxen(
+      chalk.red('✖ Deletion incomplete: ' + error.message) + '\n' +
+      chalk.gray('Retry the command. Memoir will not report success for an incomplete deletion.'),
+      { padding: 1, borderStyle: 'round', borderColor: 'red' }
+    ) + '\n');
+  }
 }

package/src/commands/restore.js

@@ -6,13 +6,12 @@ import ora from 'ora';
 import boxen from 'boxen';
 import gradient from 'gradient-string';
 import inquirer from 'inquirer';
-import { readSafeFile, writeSafeFile, relativeFile } from '../security/files.js';
+import { readSafeFile, writeSafeFile } from '../security/files.js';
 import { getConfig, autoSetup } from '../config.js';
 import { fetchFromLocal, fetchFromGit } from '../providers/restore.js';
 import { decryptDirectory, verifyPassphrase } from '../security/encryption.js';
 import { detectLocalHomeKey } from '../adapters/restore.js';
 import { restoreWorkspace } from '../workspace/tracker.js';
-import { getSession } from '../cloud/auth.js';
 import { unbundleToDir, readBoundedResponse } from '../cloud/storage.js';
 import { SUPABASE_URL, SUPABASE_ANON_KEY, STORAGE_BUCKET } from '../cloud/constants.js';
 import { readSession, writeSession, mergeSessions, paths as sessionPaths } from '../session/state.js';
@@ -298,7 +297,7 @@ export async function restoreCommand(options = {}) {
 }
 
 async function restoreFromShare(options) {
-  const shareToken = encodeURIComponent(options.from);
+  const rawToken = String(options.from || '').trim();
 
   console.log();
   const spinner = ora({ text: chalk.gray('Fetching share link...'), spinner: 'dots' }).start();
@@ -307,14 +306,16 @@ async function restoreFromShare(options) {
   await fs.ensureDir(stagingDir);
 
   try {
-    // Fetch share metadata from Supabase
+    // Fetch share metadata via token-scoped RPC (shared_links table does not allow table-wide anonymous SELECT)
     const metaRes = await fetch(
-      `${SUPABASE_URL}/rest/v1/shared_links?select=*&token=eq.${shareToken}&limit=1`,
+      `${SUPABASE_URL}/rest/v1/rpc/memoir_get_shared_link`,
       {
+        method: 'POST',
         headers: {
           'apikey': SUPABASE_ANON_KEY,
           'Content-Type': 'application/json',
         },
+        body: JSON.stringify({ link_token: rawToken }),
       }
     );
 
@@ -370,16 +371,40 @@ async function restoreFromShare(options) {
     // Download the backup
     spinner.start(chalk.gray('Downloading share bundle...'));
 
-    // Try authenticated first, fall back to anon key
-    const session = await getSession();
-    const authHeaders = session
-      ? { 'Authorization': `Bearer ${session.access_token}`, 'apikey': SUPABASE_ANON_KEY }
-      : { 'apikey': SUPABASE_ANON_KEY };
-
-    const dlRes = await fetch(`${SUPABASE_URL}/storage/v1/object/${STORAGE_BUCKET}/${relativeFile(shareLink.backup_id).split('/').map(encodeURIComponent).join('/')}`, {
-      headers: authHeaders,
+    // Share bundles are not readable through Storage directly: a read rule
+    // for recipients would also let anyone list every bundle name, and each
+    // name contains its token. The share-download function checks the exact
+    // token, uses up one use, and returns a short-lived signed URL.
+    const grantRes = await fetch(`${SUPABASE_URL}/functions/v1/share-download`, {
+      method: 'POST',
+      headers: {
+        'apikey': SUPABASE_ANON_KEY,
+        'Authorization': `Bearer ${SUPABASE_ANON_KEY}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ token: rawToken }),
     });
+    if (grantRes.status === 404) {
+      spinner.stop();
+      console.log('\n' + boxen(
+        chalk.red('✖ Share link no longer available\n\n') +
+        chalk.gray('It may have expired, been used up, or been deleted.'),
+        { padding: 1, borderStyle: 'round', borderColor: 'red' }
+      ) + '\n');
+      return;
+    }
+    if (!grantRes.ok) {
+      throw new Error(`Download failed (${grantRes.status})`);
+    }
+    const grant = await grantRes.json();
+    const signedUrl = typeof grant?.url === 'string' ? new URL(grant.url) : null;
+    if (!signedUrl
+      || signedUrl.origin !== new URL(SUPABASE_URL).origin
+      || !signedUrl.pathname.startsWith(`/storage/v1/object/sign/${STORAGE_BUCKET}/`)) {
+      throw new Error('Download failed: unexpected download URL');
+    }
 
+    const dlRes = await fetch(signedUrl);
     if (!dlRes.ok) {
       throw new Error(`Download failed: ${await dlRes.text()}`);
     }
@@ -445,20 +470,6 @@ async function restoreFromShare(options) {
       await fs.remove(decryptedDir);
     }
 
-    // Increment use_count
-    try {
-      const patchHeaders = { 'apikey': SUPABASE_ANON_KEY, 'Content-Type': 'application/json' };
-      if (session) patchHeaders['Authorization'] = `Bearer ${session.access_token}`;
-
-      await fetch(`${SUPABASE_URL}/rest/v1/shared_links?token=eq.${shareToken}`, {
-        method: 'PATCH',
-        headers: patchHeaders,
-        body: JSON.stringify({ use_count: shareLink.use_count + 1 }),
-      });
-    } catch {
-      // Best-effort — don't fail restore if count update fails
-    }
-
     spinner.stop();
 
     if (restored) {

package/src/commands/share.js

@@ -89,7 +89,7 @@ export async function shareCommand(options = {}) {
     const gzipped = await bundleDir(encryptedDir);
 
     const shareToken = crypto.randomUUID();
-    const storagePath = `shares/${session.user.id}/${shareToken}.gz`;
+    const storagePath = `${session.user.id}/shares/${shareToken}.gz`;
 
     const uploadRes = await fetch(`${SUPABASE_URL}/storage/v1/object/${STORAGE_BUCKET}/${storagePath}`, {
       method: 'POST',

package/supabase/migrations/202610180001_cloud_delete_and_share_rls.sql

@@ -0,0 +1,113 @@
+-- Fix account-deletion RLS (allow authenticated users to delete their own
+-- shared_links and subscriptions rows) and close permissive shared_links
+-- SELECT/UPDATE policies that allowed full-table enumeration and arbitrary
+-- column mutation.
+begin;
+
+-- 1. subscriptions: allow owners to delete their own subscription row on account deletion
+drop policy if exists "Users delete own subscription" on public.subscriptions;
+create policy "Users delete own subscription"
+  on public.subscriptions
+  for delete
+  to authenticated
+  using ((select auth.uid()) = user_id);
+
+-- 2. shared_links: replace world-readable / world-writable policies with owner-only RLS
+drop policy if exists "Anyone can increment use count" on public.shared_links;
+drop policy if exists "Anyone can read shared links" on public.shared_links;
+drop policy if exists "Authenticated users can create shared links" on public.shared_links;
+drop policy if exists "Users read own shared links" on public.shared_links;
+drop policy if exists "Users delete own shared links" on public.shared_links;
+
+create policy "Authenticated users can create shared links"
+  on public.shared_links
+  for insert
+  to authenticated
+  with check ((select auth.uid()) = created_by);
+
+create policy "Users read own shared links"
+  on public.shared_links
+  for select
+  to authenticated
+  using ((select auth.uid()) = created_by);
+
+create policy "Users delete own shared links"
+  on public.shared_links
+  for delete
+  to authenticated
+  using ((select auth.uid()) = created_by);
+
+-- Token-scoped share lookup so callers with an exact share token can inspect
+-- a link (including expired/exhausted status) without table-wide SELECT.
+create or replace function public.memoir_get_shared_link(link_token text)
+returns setof public.shared_links
+language sql
+security definer
+set search_path = ''
+as $$
+  select *
+  from public.shared_links
+  where token = link_token
+  limit 1;
+$$;
+
+revoke all on function public.memoir_get_shared_link(text) from public;
+grant execute on function public.memoir_get_shared_link(text) to anon, authenticated;
+
+-- Atomic, token-scoped use_count increment so callers with an exact share token
+-- can redeem a link without granting table-wide UPDATE.
+create or replace function public.memoir_consume_shared_link(link_token text)
+returns setof public.shared_links
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if link_token is null or length(trim(link_token)) = 0 then
+    return;
+  end if;
+
+  return query
+  update public.shared_links
+     set use_count = coalesce(use_count, 0) + 1
+   where token = link_token
+     and expires_at > now()
+     and coalesce(use_count, 0) < coalesce(max_uses, 5)
+  returning *;
+end;
+$$;
+
+revoke all on function public.memoir_consume_shared_link(text) from public;
+grant execute on function public.memoir_consume_shared_link(text) to anon, authenticated;
+
+-- Helper for storage.objects SELECT policy on active shared bundles under <uid>/shares/<token>.gz
+create or replace function public.memoir_can_read_shared_object(object_name text)
+returns boolean
+language sql
+security definer
+set search_path = ''
+as $$
+  select exists (
+    select 1
+    from public.shared_links sl
+    where sl.backup_id = object_name
+      and sl.expires_at > now()
+      and coalesce(sl.use_count, 0) < coalesce(sl.max_uses, 5)
+  );
+$$;
+
+revoke all on function public.memoir_can_read_shared_object(text) from public;
+grant execute on function public.memoir_can_read_shared_object(text) to anon, authenticated;
+
+drop policy if exists "Recipients read active shared bundles" on storage.objects;
+create policy "Recipients read active shared bundles"
+  on storage.objects
+  for select
+  to anon, authenticated
+  using (
+    bucket_id = 'memoir-backups'
+    and (storage.foldername(name))[2] = 'shares'
+    and public.memoir_can_read_shared_object(name)
+  );
+
+commit;

package/supabase/migrations/202610190001_share_download_via_edge_function.sql

@@ -0,0 +1,9 @@
+-- Share bundles: replace the anonymous Storage read rule from
+-- 202610180001 with the share-download edge function
+-- (supabase/functions/share-download). The rule let anyone list every active
+-- bundle, and each bundle name contains its share token.
+drop policy if exists "Recipients read active shared bundles" on storage.objects;
+drop function if exists public.memoir_can_read_shared_object(text);
+
+-- Only share-download (service role) uses up a share now, at download time.
+revoke execute on function public.memoir_consume_shared_link(text) from anon, authenticated;