tthr 0.3.1 → 0.3.2

package/dist/chunk-GYMF5VG7.js

@@ -0,0 +1,617 @@
+// src/commands/generate.ts
+import chalk2 from "chalk";
+import ora from "ora";
+import fs3 from "fs-extra";
+import path3 from "path";
+
+// src/utils/auth.ts
+import chalk from "chalk";
+import fs from "fs-extra";
+import path from "path";
+var CONFIG_DIR = path.join(process.env.HOME || process.env.USERPROFILE || "", ".tether");
+var CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
+var isDev = process.env.NODE_ENV === "development" || process.env.TETHER_DEV === "true";
+var API_URL = isDev ? "http://localhost:3001/api/v1" : "https://tether-api.strands.gg/api/v1";
+var REFRESH_THRESHOLD_DAYS = 7;
+async function getCredentials() {
+  try {
+    if (await fs.pathExists(CREDENTIALS_FILE)) {
+      return await fs.readJSON(CREDENTIALS_FILE);
+    }
+  } catch {
+  }
+  return null;
+}
+async function refreshSession(credentials) {
+  try {
+    const response = await fetch(`${API_URL}/auth/session/refresh`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Authorization": `Bearer ${credentials.accessToken}`
+      }
+    });
+    if (!response.ok) {
+      return null;
+    }
+    const data = await response.json();
+    const updated = {
+      ...credentials,
+      expiresAt: data.expiresAt
+    };
+    await saveCredentials(updated);
+    return updated;
+  } catch {
+    return null;
+  }
+}
+async function requireAuth() {
+  const credentials = await getCredentials();
+  if (!credentials) {
+    console.error(chalk.red("\n\u2717 Not logged in\n"));
+    console.log(chalk.dim("Run `tthr login` to authenticate\n"));
+    process.exit(1);
+  }
+  if (credentials.expiresAt) {
+    const expiresAt = new Date(credentials.expiresAt);
+    const now = /* @__PURE__ */ new Date();
+    if (now > expiresAt) {
+      await clearCredentials();
+      console.error(chalk.red("\n\u2717 Session expired \u2014 you have been signed out\n"));
+      console.log(chalk.dim("Run `tthr login` to authenticate\n"));
+      process.exit(1);
+    }
+    const daysUntilExpiry = (expiresAt.getTime() - now.getTime()) / (1e3 * 60 * 60 * 24);
+    if (daysUntilExpiry <= REFRESH_THRESHOLD_DAYS) {
+      const refreshed = await refreshSession(credentials);
+      if (refreshed) {
+        return refreshed;
+      }
+    }
+  }
+  return credentials;
+}
+async function saveCredentials(credentials) {
+  await fs.ensureDir(CONFIG_DIR);
+  await fs.writeJSON(CREDENTIALS_FILE, credentials, { spaces: 2, mode: 384 });
+}
+async function clearCredentials() {
+  try {
+    await fs.remove(CREDENTIALS_FILE);
+  } catch {
+  }
+}
+
+// src/utils/config.ts
+import fs2 from "fs-extra";
+import path2 from "path";
+var DEFAULT_CONFIG = {
+  schema: "./tether/schema.ts",
+  functions: "./tether/functions",
+  output: "./tether/_generated",
+  dev: {
+    port: 3001,
+    host: "localhost"
+  },
+  database: {
+    walMode: true
+  }
+};
+async function loadConfig(cwd = process.cwd()) {
+  const configPath = path2.resolve(cwd, "tether.config.ts");
+  if (!await fs2.pathExists(configPath)) {
+    return DEFAULT_CONFIG;
+  }
+  const configSource = await fs2.readFile(configPath, "utf-8");
+  const config = {};
+  const schemaMatch = configSource.match(/schema\s*:\s*['"]([^'"]+)['"]/);
+  if (schemaMatch) {
+    config.schema = schemaMatch[1];
+  }
+  const functionsMatch = configSource.match(/functions\s*:\s*['"]([^'"]+)['"]/);
+  if (functionsMatch) {
+    config.functions = functionsMatch[1];
+  }
+  const outputMatch = configSource.match(/output\s*:\s*['"]([^'"]+)['"]/);
+  if (outputMatch) {
+    config.output = outputMatch[1];
+  }
+  const envMatch = configSource.match(/environment\s*:\s*['"]([^'"]+)['"]/);
+  if (envMatch) {
+    config.environment = envMatch[1];
+  }
+  const portMatch = configSource.match(/port\s*:\s*(\d+)/);
+  if (portMatch) {
+    config.dev = { ...config.dev, port: parseInt(portMatch[1], 10) };
+  }
+  const hostMatch = configSource.match(/host\s*:\s*['"]([^'"]+)['"]/);
+  if (hostMatch) {
+    config.dev = { ...config.dev, host: hostMatch[1] };
+  }
+  return {
+    ...DEFAULT_CONFIG,
+    ...config,
+    dev: { ...DEFAULT_CONFIG.dev, ...config.dev },
+    database: { ...DEFAULT_CONFIG.database, ...config.database }
+  };
+}
+function resolvePath(configPath, cwd = process.cwd()) {
+  const normalised = configPath.replace(/^\.\//, "");
+  return path2.resolve(cwd, normalised);
+}
+async function detectFramework(cwd = process.cwd()) {
+  const packageJsonPath = path2.resolve(cwd, "package.json");
+  if (!await fs2.pathExists(packageJsonPath)) {
+    return "unknown";
+  }
+  try {
+    const packageJson = await fs2.readJson(packageJsonPath);
+    const deps = {
+      ...packageJson.dependencies,
+      ...packageJson.devDependencies
+    };
+    if (deps.nuxt || deps["@nuxt/kit"]) {
+      return "nuxt";
+    }
+    if (deps.next) {
+      return "next";
+    }
+    if (deps["@sveltejs/kit"]) {
+      return "sveltekit";
+    }
+    if (deps.vite && !deps.nuxt && !deps.next && !deps["@sveltejs/kit"]) {
+      return "vite";
+    }
+    return "vanilla";
+  } catch {
+    return "unknown";
+  }
+}
+function getFrameworkDevCommand(framework) {
+  switch (framework) {
+    case "nuxt":
+      return "nuxt dev";
+    case "next":
+      return "next dev";
+    case "sveltekit":
+      return "vite dev";
+    case "vite":
+      return "vite dev";
+    case "vanilla":
+      return null;
+    // No default dev server for vanilla
+    default:
+      return null;
+  }
+}
+
+// src/commands/generate.ts
+var isDev2 = process.env.NODE_ENV === "development" || process.env.TETHER_DEV === "true";
+var API_URL2 = isDev2 ? "http://localhost:3001/api/v1" : "https://tether-api.strands.gg/api/v1";
+function parseSchemaFile(source) {
+  const tables = [];
+  const schemaMatch = source.match(/defineSchema\s*\(\s*\{([\s\S]*)\}\s*\)/);
+  if (!schemaMatch) return tables;
+  const schemaContent = schemaMatch[1];
+  const tableStartRegex = /(\w+)\s*:\s*\{/g;
+  let match;
+  while ((match = tableStartRegex.exec(schemaContent)) !== null) {
+    const tableName = match[1];
+    const startOffset = match.index + match[0].length;
+    let braceCount = 1;
+    let endOffset = startOffset;
+    for (let i = startOffset; i < schemaContent.length && braceCount > 0; i++) {
+      const char = schemaContent[i];
+      if (char === "{") braceCount++;
+      else if (char === "}") braceCount--;
+      endOffset = i;
+    }
+    const columnsContent = schemaContent.slice(startOffset, endOffset);
+    const columns = parseColumns(columnsContent);
+    tables.push({ name: tableName, columns });
+  }
+  return tables;
+}
+function parseColumns(content) {
+  const columns = [];
+  const columnRegex = /(\w+)\s*:\s*(\w+)(?:<([^>]+)>)?\s*\(\s*\)((?:\[.*?\]|[^,\n}])*)/g;
+  let match;
+  while ((match = columnRegex.exec(content)) !== null) {
+    const name = match[1];
+    const schemaType = match[2];
+    const genericType = match[3];
+    const modifiers = match[4] || "";
+    const nullable = !modifiers.includes(".notNull()");
+    const oneOfMatch = modifiers.match(/\.oneOf\s*\(\s*\[(.*?)\]\s*\)/);
+    let oneOf;
+    if (oneOfMatch) {
+      oneOf = [...oneOfMatch[1].matchAll(/['"]([^'"]+)['"]/g)].map((m) => m[1]);
+    }
+    columns.push({
+      name,
+      type: schemaTypeToTS(schemaType),
+      nullable,
+      jsonType: genericType,
+      // Store the generic type for json columns
+      oneOf
+    });
+  }
+  return columns;
+}
+function schemaTypeToTS(schemaType) {
+  switch (schemaType) {
+    case "text":
+      return "string";
+    case "integer":
+      return "number";
+    case "real":
+      return "number";
+    case "boolean":
+      return "boolean";
+    case "timestamp":
+      return "string";
+    case "json":
+      return "unknown";
+    case "blob":
+      return "Uint8Array";
+    case "asset":
+      return "TetherAsset";
+    // Asset object returned by API
+    default:
+      return "unknown";
+  }
+}
+function tableNameToInterface(tableName) {
+  let name = tableName;
+  if (name.endsWith("ies")) {
+    name = name.slice(0, -3) + "y";
+  } else if (name.endsWith("s") && !name.endsWith("ss")) {
+    name = name.slice(0, -1);
+  }
+  return name.charAt(0).toUpperCase() + name.slice(1);
+}
+function generateDbFile(tables) {
+  const TS_PRIMITIVES = /* @__PURE__ */ new Set(["number", "string", "boolean", "unknown", "any", "void", "never", "undefined", "null", "object"]);
+  const jsonTypes = /* @__PURE__ */ new Set();
+  for (const table of tables) {
+    for (const col of table.columns) {
+      if (col.jsonType) {
+        const baseType = col.jsonType.replace(/\[\]$/, "");
+        if (!TS_PRIMITIVES.has(baseType)) {
+          jsonTypes.add(baseType);
+        }
+      }
+    }
+  }
+  const lines = [
+    "// Auto-generated by Tether CLI - do not edit manually",
+    `// Generated at: ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    "",
+    "import { createDatabaseProxy, type TetherDatabase } from '@tthr/client';",
+    "import {",
+    "  query as baseQuery,",
+    "  mutation as baseMutation,",
+    "  type QueryDefinition,",
+    "  type MutationDefinition,",
+    "  z,",
+    "} from '@tthr/server';",
+    "import type { TetherEnv } from './env';"
+  ];
+  if (jsonTypes.size > 0) {
+    const typeImports = Array.from(jsonTypes).sort().join(", ");
+    lines.push(`import type { ${typeImports} } from '../schema';`);
+  }
+  lines.push("");
+  lines.push("// Asset type returned by the API for asset columns");
+  lines.push("export interface TetherAsset {");
+  lines.push("  id: string;");
+  lines.push("  filename: string;");
+  lines.push("  contentType: string;");
+  lines.push("  size: number;");
+  lines.push("  url: string;");
+  lines.push("  createdAt: string;");
+  lines.push("}");
+  lines.push("");
+  for (const table of tables) {
+    const interfaceName = tableNameToInterface(table.name);
+    lines.push(`export interface ${interfaceName} {`);
+    lines.push("  _id: string;");
+    for (const col of table.columns) {
+      let colType;
+      if (col.oneOf && col.oneOf.length > 0) {
+        colType = col.oneOf.map((v) => `'${v}'`).join(" | ");
+      } else {
+        colType = col.jsonType || col.type;
+      }
+      const typeStr = col.nullable ? `${colType} | null` : colType;
+      const optional = col.nullable ? "?" : "";
+      lines.push(`  ${col.name}${optional}: ${typeStr};`);
+    }
+    lines.push("  _createdAt: string;");
+    lines.push("  _updatedAt?: string | null;");
+    lines.push("  _deletedAt?: string | null;");
+    lines.push("}");
+    lines.push("");
+  }
+  lines.push("export interface Schema {");
+  for (const table of tables) {
+    const interfaceName = tableNameToInterface(table.name);
+    lines.push(`  ${table.name}: ${interfaceName};`);
+  }
+  lines.push("}");
+  lines.push("");
+  lines.push("// Database client with typed tables");
+  lines.push("// This is a proxy that will be populated by the Tether runtime");
+  lines.push("export const db: TetherDatabase<Schema> = createDatabaseProxy<Schema>();");
+  lines.push("");
+  lines.push("// ============================================================================");
+  lines.push("// Typed function wrappers - use these instead of importing from @tthr/server");
+  lines.push("// This ensures the `db` parameter in handlers is properly typed with Schema");
+  lines.push("// ============================================================================");
+  lines.push("");
+  lines.push("/**");
+  lines.push(" * Define a query function with typed database and environment variable access.");
+  lines.push(" * The `db` and `env` parameters in the handler will have full type safety.");
+  lines.push(" */");
+  lines.push("export function query<TArgs = void, TResult = unknown>(");
+  lines.push("  definition: QueryDefinition<TArgs, TResult, Schema, TetherEnv>");
+  lines.push("): QueryDefinition<TArgs, TResult, Schema, TetherEnv> {");
+  lines.push("  return baseQuery(definition);");
+  lines.push("}");
+  lines.push("");
+  lines.push("/**");
+  lines.push(" * Define a mutation function with typed database and environment variable access.");
+  lines.push(" * The `db` and `env` parameters in the handler will have full type safety.");
+  lines.push(" */");
+  lines.push("export function mutation<TArgs = void, TResult = unknown>(");
+  lines.push("  definition: MutationDefinition<TArgs, TResult, Schema, TetherEnv>");
+  lines.push("): MutationDefinition<TArgs, TResult, Schema, TetherEnv> {");
+  lines.push("  return baseMutation(definition);");
+  lines.push("}");
+  lines.push("");
+  lines.push("// Re-export z for convenience");
+  lines.push("export { z };");
+  if (jsonTypes.size > 0) {
+    lines.push("");
+    lines.push("// Re-export JSON schema types");
+    const typeExports = Array.from(jsonTypes).sort().join(", ");
+    lines.push(`export type { ${typeExports} } from '../schema';`);
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+async function parseFunctionsDir(functionsDir) {
+  const functions = [];
+  if (!await fs3.pathExists(functionsDir)) {
+    return functions;
+  }
+  const files = await fs3.readdir(functionsDir);
+  for (const file of files) {
+    if (!file.endsWith(".ts") && !file.endsWith(".js")) continue;
+    const filePath = path3.join(functionsDir, file);
+    const stat = await fs3.stat(filePath);
+    if (!stat.isFile()) continue;
+    const moduleName = file.replace(/\.(ts|js)$/, "");
+    const source = await fs3.readFile(filePath, "utf-8");
+    const exportRegex = /export\s+const\s+(\w+)\s*=\s*(query|mutation)\s*\(/g;
+    let match;
+    while ((match = exportRegex.exec(source)) !== null) {
+      functions.push({
+        name: match[1],
+        moduleName
+      });
+    }
+  }
+  return functions;
+}
+async function generateApiFile(functionsDir) {
+  const functions = await parseFunctionsDir(functionsDir);
+  const moduleMap = /* @__PURE__ */ new Map();
+  for (const fn of functions) {
+    if (!moduleMap.has(fn.moduleName)) {
+      moduleMap.set(fn.moduleName, []);
+    }
+    moduleMap.get(fn.moduleName).push(fn.name);
+  }
+  const lines = [
+    "// Auto-generated by Tether CLI - do not edit manually",
+    `// Generated at: ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    "",
+    "import { createApiProxy } from '@tthr/client';",
+    "",
+    "/**",
+    " * API function reference type for useQuery/useMutation.",
+    ' * The _name property contains the function path (e.g., "users.list").',
+    " */",
+    "export interface ApiFunction<TArgs = unknown, TResult = unknown> {",
+    "  _name: string;",
+    "  _args?: TArgs;",
+    "  _result?: TResult;",
+    "}",
+    ""
+  ];
+  if (moduleMap.size > 0) {
+    for (const [moduleName, fnNames] of moduleMap) {
+      const interfaceName = moduleName.charAt(0).toUpperCase() + moduleName.slice(1) + "Api";
+      lines.push(`export interface ${interfaceName} {`);
+      for (const fnName of fnNames) {
+        lines.push(`  ${fnName}: ApiFunction;`);
+      }
+      lines.push("}");
+      lines.push("");
+    }
+    lines.push("export interface Api {");
+    for (const moduleName of moduleMap.keys()) {
+      const interfaceName = moduleName.charAt(0).toUpperCase() + moduleName.slice(1) + "Api";
+      lines.push(`  ${moduleName}: ${interfaceName};`);
+    }
+    lines.push("}");
+  } else {
+    lines.push("/**");
+    lines.push(" * Flexible API type that allows access to any function path.");
+    lines.push(" * Functions are accessed as api.moduleName.functionName");
+    lines.push(" * The actual types depend on your function definitions.");
+    lines.push(" */");
+    lines.push("export type Api = {");
+    lines.push("  [module: string]: {");
+    lines.push("    [fn: string]: ApiFunction;");
+    lines.push("  };");
+    lines.push("};");
+  }
+  lines.push("");
+  lines.push("// API client proxy - provides typed access to your functions");
+  lines.push("// On the client: returns { _name } references for useQuery/useMutation");
+  lines.push("// In Tether functions: calls the actual function implementation");
+  lines.push("export const api = createApiProxy<Api>();");
+  lines.push("");
+  return lines.join("\n");
+}
+async function fetchEnvVarKeys(projectId, environment) {
+  const credentials = await getCredentials();
+  if (!credentials) return [];
+  const envPath = environment !== "production" ? `/projects/${projectId}/env/${environment}/env-vars` : `/projects/${projectId}/env-vars`;
+  try {
+    const response = await fetch(`${API_URL2}${envPath}`, {
+      headers: {
+        "Authorization": `Bearer ${credentials.accessToken}`
+      }
+    });
+    if (!response.ok) return [];
+    const data = await response.json();
+    return (data.envVars || []).map((v) => v.key).sort();
+  } catch {
+    return [];
+  }
+}
+function generateEnvFile(keys) {
+  const lines = [
+    "// Auto-generated by Tether CLI - do not edit manually",
+    `// Generated at: ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    "",
+    "/**",
+    " * Typed environment variables for this project.",
+    " * Keys are fetched from the Tether API \u2014 values are never exposed.",
+    ' * Use `env.get("KEY")` in your functions to access them.',
+    " */",
+    ""
+  ];
+  if (keys.length > 0) {
+    lines.push("export type EnvVarKey =");
+    for (let i = 0; i < keys.length; i++) {
+      const sep = i === keys.length - 1 ? ";" : "";
+      lines.push(`  | '${keys[i]}'${sep}`);
+    }
+    lines.push("");
+    lines.push("export interface TetherEnv {");
+    for (const key of keys) {
+      lines.push(`  ${key}: string;`);
+    }
+    lines.push("}");
+  } else {
+    lines.push("export type EnvVarKey = string;");
+    lines.push("");
+    lines.push("export interface TetherEnv {");
+    lines.push("  [key: string]: string;");
+    lines.push("}");
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+async function generateTypes(options = {}) {
+  const config = await loadConfig();
+  const schemaPath = resolvePath(config.schema);
+  const outputDir = resolvePath(config.output);
+  const functionsDir = resolvePath(config.functions);
+  if (!await fs3.pathExists(schemaPath)) {
+    throw new Error(`Schema file not found: ${schemaPath}`);
+  }
+  const schemaSource = await fs3.readFile(schemaPath, "utf-8");
+  const tables = parseSchemaFile(schemaSource);
+  const environment = config.environment || "development";
+  let projectId;
+  const envFilePath = path3.resolve(process.cwd(), ".env");
+  if (await fs3.pathExists(envFilePath)) {
+    const envContent = await fs3.readFile(envFilePath, "utf-8");
+    const match = envContent.match(/TETHER_PROJECT_ID=(.+)/);
+    projectId = match?.[1]?.trim();
+  }
+  const envVarKeys = projectId ? await fetchEnvVarKeys(projectId, environment) : [];
+  await fs3.ensureDir(outputDir);
+  await fs3.writeFile(
+    path3.join(outputDir, "db.ts"),
+    generateDbFile(tables)
+  );
+  await fs3.writeFile(
+    path3.join(outputDir, "api.ts"),
+    await generateApiFile(functionsDir)
+  );
+  await fs3.writeFile(
+    path3.join(outputDir, "env.ts"),
+    generateEnvFile(envVarKeys)
+  );
+  await fs3.writeFile(
+    path3.join(outputDir, "index.ts"),
+    `// Auto-generated by Tether CLI - do not edit manually
+export * from './db';
+export * from './api';
+export * from './env';
+`
+  );
+  return { tables, envVarKeys, outputDir };
+}
+async function generateCommand() {
+  await requireAuth();
+  const configPath = path3.resolve(process.cwd(), "tether.config.ts");
+  if (!await fs3.pathExists(configPath)) {
+    console.log(chalk2.red("\nError: Not a Tether project"));
+    console.log(chalk2.dim("Run `tthr init` to create a new project\n"));
+    process.exit(1);
+  }
+  console.log(chalk2.bold("\n\u26A1 Generating types from schema\n"));
+  const spinner = ora("Reading schema...").start();
+  try {
+    spinner.text = "Generating types...";
+    const { tables, envVarKeys, outputDir } = await generateTypes();
+    if (tables.length === 0) {
+      spinner.warn("No tables found in schema");
+      console.log(chalk2.dim("  Make sure your schema uses defineSchema({ ... })\n"));
+      return;
+    }
+    spinner.succeed(`Types generated for ${tables.length} table(s)`);
+    console.log("\n" + chalk2.green("\u2713") + " Tables:");
+    for (const table of tables) {
+      console.log(chalk2.dim(`  - ${table.name} (${table.columns.length} columns)`));
+    }
+    if (envVarKeys.length > 0) {
+      console.log("\n" + chalk2.green("\u2713") + ` Environment variables: ${envVarKeys.length} key(s)`);
+      for (const key of envVarKeys) {
+        console.log(chalk2.dim(`  - ${key}`));
+      }
+    }
+    const relativeOutput = path3.relative(process.cwd(), outputDir);
+    console.log("\n" + chalk2.green("\u2713") + " Generated files:");
+    console.log(chalk2.dim(`  ${relativeOutput}/db.ts`));
+    console.log(chalk2.dim(`  ${relativeOutput}/api.ts`));
+    console.log(chalk2.dim(`  ${relativeOutput}/env.ts`));
+    console.log(chalk2.dim(`  ${relativeOutput}/index.ts
+`));
+  } catch (error) {
+    spinner.fail("Failed to generate types");
+    console.error(chalk2.red(error instanceof Error ? error.message : "Unknown error"));
+    process.exit(1);
+  }
+}
+
+export {
+  API_URL,
+  getCredentials,
+  requireAuth,
+  saveCredentials,
+  clearCredentials,
+  loadConfig,
+  resolvePath,
+  detectFramework,
+  getFrameworkDevCommand,
+  generateTypes,
+  generateCommand
+};

package/dist/generate-ZY23LDYI.js

@@ -0,0 +1,8 @@
+import {
+  generateCommand,
+  generateTypes
+} from "./chunk-GYMF5VG7.js";
+export {
+  generateCommand,
+  generateTypes
+};

package/dist/index.js

@@ -11,10 +11,13 @@ import {
   requireAuth,
   resolvePath,
   saveCredentials
-} from "./chunk-HNRJ3DYB.js";
+} from "./chunk-GYMF5VG7.js";
 
 // src/index.ts
 import { Command } from "commander";
+import fs8 from "fs-extra";
+import { fileURLToPath } from "url";
+import path8 from "path";
 
 // src/commands/init.ts
 import chalk2 from "chalk";
@@ -111,6 +114,12 @@ async function deploySchemaToServer(projectId, token, schemaPath, environment, d
     const schemaUrl = `${API_URL2}/projects/${projectId}/env/${environment}/deploy/schema`;
     console.log(chalk.dim(`
   URL: ${schemaUrl}`));
+    const rlsConfigs = tables.filter((t) => t.rls).map((t) => ({
+      tableName: t.name,
+      enabled: t.rls.enabled,
+      defaultDeny: t.rls.defaultDeny ?? true,
+      policies: t.rls.policies
+    }));
     const requestBody = {
       sql,
       tables: tables.map((t) => ({
@@ -119,6 +128,9 @@ async function deploySchemaToServer(projectId, token, schemaPath, environment, d
         columns: t.columns
       }))
     };
+    if (rlsConfigs.length > 0) {
+      requestBody.rls = rlsConfigs;
+    }
     const response = await fetch(schemaUrl, {
       method: "POST",
       headers: {
@@ -277,10 +289,11 @@ function parseSchema(source) {
   if (!schemaMatch) return tables;
   const schemaContent = schemaMatch[1];
   const schemaStartIndex = source.indexOf(schemaMatch[0]) + "defineSchema({".length;
-  const tableStartRegex = /(\w+)\s*:\s*\{/g;
+  const tableStartRegex = /(\w+)\s*:\s*(?:defineTable\s*\(\s*)?\{/g;
   let match;
   while ((match = tableStartRegex.exec(schemaContent)) !== null) {
     const tableName = match[1];
+    const isDefineTable = match[0].includes("defineTable");
     const startOffset = match.index + match[0].length;
     let braceCount = 1;
     let endOffset = startOffset;
@@ -290,7 +303,28 @@ function parseSchema(source) {
       else if (char === "}") braceCount--;
       endOffset = i;
     }
-    const columnsContent = schemaContent.slice(startOffset, endOffset);
+    let rawContent = schemaContent.slice(startOffset, endOffset);
+    let rlsConfig;
+    let columnsContent;
+    if (isDefineTable) {
+      const columnsBlockMatch = rawContent.match(/columns\s*:\s*\{/);
+      if (columnsBlockMatch) {
+        const colStart = rawContent.indexOf(columnsBlockMatch[0]) + columnsBlockMatch[0].length;
+        let colBraceCount = 1;
+        let colEnd = colStart;
+        for (let i = colStart; i < rawContent.length && colBraceCount > 0; i++) {
+          if (rawContent[i] === "{") colBraceCount++;
+          else if (rawContent[i] === "}") colBraceCount--;
+          colEnd = i;
+        }
+        columnsContent = rawContent.slice(colStart, colEnd);
+      } else {
+        columnsContent = rawContent;
+      }
+      rlsConfig = parseRlsConfig(rawContent);
+    } else {
+      columnsContent = rawContent;
+    }
     const lines = columnsContent.split("\n");
     const nonEmptyLines = lines.filter((line) => line.trim().length > 0);
     const minIndent = nonEmptyLines.reduce((min, line) => {
@@ -334,10 +368,74 @@ function parseSchema(source) {
         oneOf
       };
     }
-    tables.push({ name: tableName, columns, source: tableSource });
+    tables.push({ name: tableName, columns, source: tableSource, rls: rlsConfig });
   }
   return tables;
 }
+function parseRlsConfig(content) {
+  const rlsMatch = content.match(/rls\s*:\s*\{/);
+  if (!rlsMatch) return void 0;
+  const rlsStart = content.indexOf(rlsMatch[0]) + rlsMatch[0].length;
+  let braceCount = 1;
+  let rlsEnd = rlsStart;
+  for (let i = rlsStart; i < content.length && braceCount > 0; i++) {
+    if (content[i] === "{") braceCount++;
+    else if (content[i] === "}") braceCount--;
+    rlsEnd = i;
+  }
+  const rlsContent = content.slice(rlsStart, rlsEnd);
+  const enabledMatch = rlsContent.match(/enabled\s*:\s*(true|false)/);
+  const enabled = enabledMatch ? enabledMatch[1] === "true" : false;
+  const defaultDenyMatch = rlsContent.match(/defaultDeny\s*:\s*(true|false)/);
+  const defaultDeny = defaultDenyMatch ? defaultDenyMatch[1] === "true" : true;
+  const policies = [];
+  const policiesMatch = rlsContent.match(/policies\s*:\s*\[/);
+  if (policiesMatch) {
+    const pStart = rlsContent.indexOf(policiesMatch[0]) + policiesMatch[0].length;
+    let bracketCount = 1;
+    let pEnd = pStart;
+    for (let i = pStart; i < rlsContent.length && bracketCount > 0; i++) {
+      if (rlsContent[i] === "[") bracketCount++;
+      else if (rlsContent[i] === "]") bracketCount--;
+      pEnd = i;
+    }
+    const policiesContent = rlsContent.slice(pStart, pEnd);
+    const policyRegex = /\{([^}]*(?:\{[^}]*\}[^}]*)*)\}/g;
+    let policyMatch;
+    while ((policyMatch = policyRegex.exec(policiesContent)) !== null) {
+      const pBody = policyMatch[1];
+      const name = pBody.match(/name\s*:\s*['"]([^'"]+)['"]/)?.[1];
+      const operation = pBody.match(/operation\s*:\s*['"]([^'"]+)['"]/)?.[1];
+      const role = pBody.match(/role\s*:\s*['"]([^'"]+)['"]/)?.[1];
+      if (!name || !operation) continue;
+      const usingExpr = extractJsonExpression(pBody, "using");
+      const checkExpr = extractJsonExpression(pBody, "check");
+      policies.push({ name, operation, using: usingExpr, check: checkExpr, role });
+    }
+  }
+  if (!enabled && policies.length === 0) return void 0;
+  return { enabled, defaultDeny, policies };
+}
+function extractJsonExpression(text, key) {
+  const keyRegex = new RegExp(`${key}\\s*:\\s*\\{`);
+  const keyMatch = text.match(keyRegex);
+  if (!keyMatch) return void 0;
+  const start = text.indexOf(keyMatch[0]) + keyMatch[0].length;
+  let braceCount = 1;
+  let end = start;
+  for (let i = start; i < text.length && braceCount > 0; i++) {
+    if (text[i] === "{") braceCount++;
+    else if (text[i] === "}") braceCount--;
+    end = i;
+  }
+  const raw = "{" + text.slice(start, end) + "}";
+  try {
+    const jsonStr = raw.replace(/(\w+)\s*:/g, '"$1":').replace(/'/g, '"').replace(/,\s*([}\]])/g, "$1").replace(/"(\$\w+(?:\.\w+)?)"/g, '"$1"');
+    return JSON.parse(jsonStr);
+  } catch {
+    return void 0;
+  }
+}
 function getColumnSqlType(type) {
   switch (type) {
     case "text":
@@ -1586,7 +1684,7 @@ async function runGenerate(spinner) {
   }
   isGenerating = true;
   try {
-    const { generateTypes: generateTypes2 } = await import("./generate-O66KTG5U.js");
+    const { generateTypes: generateTypes2 } = await import("./generate-ZY23LDYI.js");
     spinner.text = "Regenerating types...";
     await generateTypes2({ silent: true });
     spinner.succeed("Types regenerated");
@@ -1806,7 +1904,7 @@ async function devCommand(options) {
       }
     }
     spinner.text = "Generating types...";
-    const { generateTypes: generateTypes2 } = await import("./generate-O66KTG5U.js");
+    const { generateTypes: generateTypes2 } = await import("./generate-ZY23LDYI.js");
     await generateTypes2({ silent: true });
     spinner.succeed("Types generated");
     if (config.projectId) {
@@ -2141,12 +2239,12 @@ async function updateCommand(options) {
   const deps = packageJson.dependencies || {};
   const devDeps = packageJson.devDependencies || {};
   const installedDeps = [];
-  for (const pkg of TETHER_PACKAGES) {
-    if (deps[pkg] && !deps[pkg].startsWith("workspace:")) {
-      installedDeps.push({ name: pkg, current: deps[pkg], isDev: false });
+  for (const pkg2 of TETHER_PACKAGES) {
+    if (deps[pkg2] && !deps[pkg2].startsWith("workspace:")) {
+      installedDeps.push({ name: pkg2, current: deps[pkg2], isDev: false });
     }
-    if (devDeps[pkg] && !devDeps[pkg].startsWith("workspace:")) {
-      installedDeps.push({ name: pkg, current: devDeps[pkg], isDev: true });
+    if (devDeps[pkg2] && !devDeps[pkg2].startsWith("workspace:")) {
+      installedDeps.push({ name: pkg2, current: devDeps[pkg2], isDev: true });
     }
   }
   if (installedDeps.length === 0) {
@@ -2158,19 +2256,19 @@ async function updateCommand(options) {
 `));
   const spinner = ora5("Checking for updates...").start();
   const packagesToUpdate = [];
-  for (const pkg of installedDeps) {
-    const latestVersion = await getLatestVersion2(pkg.name);
+  for (const pkg2 of installedDeps) {
+    const latestVersion = await getLatestVersion2(pkg2.name);
     if (latestVersion) {
-      const currentClean = pkg.current.replace(/^[\^~>=<]+/, "");
+      const currentClean = pkg2.current.replace(/^[\^~>=<]+/, "");
       if (currentClean !== latestVersion) {
         packagesToUpdate.push({
-          name: pkg.name,
+          name: pkg2.name,
           current: currentClean,
           latest: latestVersion,
-          isDev: pkg.isDev
+          isDev: pkg2.isDev
         });
       } else {
-        console.log(chalk5.dim(`  ${pkg.name}@${currentClean} (up to date)`));
+        console.log(chalk5.dim(`  ${pkg2.name}@${currentClean} (up to date)`));
       }
     }
   }
@@ -2180,9 +2278,9 @@ async function updateCommand(options) {
     return;
   }
   console.log(chalk5.cyan("\n  Updates available:\n"));
-  for (const pkg of packagesToUpdate) {
+  for (const pkg2 of packagesToUpdate) {
     console.log(
-      chalk5.white(`  ${pkg.name}`) + chalk5.red(` ${pkg.current}`) + chalk5.dim(" \u2192 ") + chalk5.green(`${pkg.latest}`) + (pkg.isDev ? chalk5.dim(" (dev)") : "")
+      chalk5.white(`  ${pkg2.name}`) + chalk5.red(` ${pkg2.current}`) + chalk5.dim(" \u2192 ") + chalk5.green(`${pkg2.latest}`) + (pkg2.isDev ? chalk5.dim(" (dev)") : "")
     );
   }
   if (options.dryRun) {
@@ -2601,8 +2699,11 @@ function askConfirmation(prompt) {
 }
 
 // src/index.ts
+var __filename = fileURLToPath(import.meta.url);
+var __dirname = path8.dirname(__filename);
+var pkg = fs8.readJsonSync(path8.resolve(__dirname, "../package.json"));
 var program = new Command();
-program.name("tthr").description("Tether CLI - Realtime SQLite for modern applications").version("0.0.1").enablePositionalOptions();
+program.name("tthr").description("Tether CLI - Realtime SQLite for modern applications").version(pkg.version).enablePositionalOptions();
 program.command("init [name]").description("Create a new Tether project").option("-t, --template <template>", "Project template (vue, svelte, react, vanilla)", "vue").action(initCommand);
 program.command("dev").description("Start local development server with hot reload").option("-p, --port <port>", "Port to run on").option("-e, --env <environment>", "Target environment (default: development)").option("--local", "Run fully local (do not connect to cloud)").option("--skip-framework", "Only run Tether watchers, skip framework dev server").allowUnknownOption().passThroughOptions().action((options, command) => {
   const extraArgs = command.args || [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tthr",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Tether CLI - project scaffolding and deployment",
   "type": "module",
   "bin": {