safe-chains 0.221.0

Auto-allow safe bash commands in agentic coding tools
Documentation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
[[command]]
name = "supabase"
description = "Supabase CLI (v2.x) — manages a Supabase project (managed Postgres + Auth + Storage + Edge Functions) both locally (a Docker stack) and against Supabase Cloud via its management API. Local-only: `init` scaffolds supabase/config.toml; `start`/`stop` run the Docker stack (pulling and running service images); `status` reports the local stack. Cloud reads (contact the management API or the linked database and return state to the caller): `projects/orgs/branches list|get`, `secrets list` (returns each secret's NAME + SHA-256 digest only, not the value), `migration list|fetch`, `functions list|download`, `db pull|dump|diff|lint`, `gen types`, `inspect db …` (read-only diagnostics), `services`, `snippets list|download`, `domains/vanity-subdomains get`, `sso list|show|info`, `network-bans/network-restrictions/ssl-enforcement/postgres-config get`. Cloud writes/control: `db push` and `migration repair` (mutate the remote database / migration-history table), `functions deploy|delete`, `branches create|update|delete|pause|unpause`, `projects create`, `projects delete` (permanent project + data teardown), `secrets set|unset`, `config push`, `postgres-config/network-restrictions/network-bans/ssl-enforcement update`, `domains create|activate|reverify|delete`, `sso add|update|remove`. Credential exposure: `projects api-keys` prints the anon and service_role API-key VALUES (service_role bypasses row-level security — full DB admin); `encryption get-root-key` prints the project's 64-char root encryption key; `gen keys` emits branch API keys; `gen signing-key` generates a private JWT signing key. Auth/link: `login`/`logout` store or remove a personal access token in native credential storage; `link`/`unlink` associate the working directory with a remote project (link may prompt for the database password). Ships continuous 2.x releases (multiple a month) and, since 2026, defaults to JSON output in detected coding-agent environments (override with --agent no)."
url = "https://supabase.com/docs/reference/cli/introduction"
researched_version = "v2.110.0-beta.30 (2026-07-16); Supabase CLI 2.x line"
bare_flags = ["--help", "--version", "-h", "-v"]
examples_safe = [
    "supabase status",
    "supabase version",
    "supabase projects list",
    "supabase branches list",
    "supabase secrets list",
    "supabase migration list",
    "supabase functions list",
    "supabase db diff --linked",
    "supabase inspect db bloat --linked",
    "supabase db dump --data-only",
    "supabase db dump -f dump.sql --linked",
]
examples_denied = [
    "supabase start",
    "supabase db dump -f /etc/passwd",
    "supabase db push",
    "supabase functions deploy myfunc",
    "supabase projects api-keys",
    "supabase encryption get-root-key",
    "supabase gen signing-key",
    "supabase secrets set FOO=bar",
    "supabase projects delete abcdefgh",
]

[[command.sub]]
name = "version"
standalone = ["--help", "-h"]

[[command.sub]]
name = "completion"
level = "Inert"
bare = false
tolerate_unknown_short = true
standalone = ["--help", "-h"]

[[command.sub]]
name = "help"
allow_all = true

[[command.sub]]
name = "status"
level = "SafeRead"
bare = true
standalone = ["--help", "-h"]

[[command.sub]]
name = "init"
level = "SafeWrite"
bare = true
standalone = ["--help", "-h", "--force", "--with-intellij-settings", "--with-vscode-settings", "--use-orioledb"]

# ── Auth / link / local-stack / bootstrap: above the auto-approve line, no matching remote
# archetype. login/logout persist or clear a personal access token in native credential storage
# (HOME/keychain, outside the worktree); link/unlink bind the working dir to a remote project (link
# may prompt for the DB password); start/stop run a local Docker stack that pulls and executes service
# images; bootstrap provisions a remote project and deploys a starter template. Left candidate.
[[command.sub]]
name = "login"
candidate = true

[[command.sub]]
name = "logout"
candidate = true

[[command.sub]]
name = "link"
candidate = true

[[command.sub]]
name = "unlink"
candidate = true

[[command.sub]]
name = "start"
candidate = true

[[command.sub]]
name = "stop"
candidate = true

[[command.sub]]
name = "bootstrap"
candidate = true

# ── inspect: read-only database diagnostics (bloat, blocking, locks, outliers, table/index/role
# stats, replication-slots, …), against --local / --linked / --db-url. Entire subtree is inspection-
# only per upstream. Classified as a leaf remote-read so the whole `inspect db …` surface auto-reads.
[[command.sub]]
name = "inspect"
profile = "remote-read"
fact = "`inspect db` runs read-only diagnostic queries (bloat, blocking, locks, calls, outliers, table/index/role/db stats, replication-slots, vacuum-stats, long-running-queries) against the local or linked (--linked/--db-url) database; no mutation."
source = "https://supabase.com/docs/reference/cli/supabase-inspect-db"
# `inspect` takes a `db <query>` positional pair; the flags select the target database and output.
standalone = ["--linked", "--local", "--debug", "--experimental", "--help", "-h"]
valued = ["--output", "--project-ref", "--workdir", "-o"]

# ── services: reports the running/latest service image versions for the project.
[[command.sub]]
name = "services"
profile = "remote-read"
fact = "Lists the current and latest versions of the project's managed services; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-services"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]

# ── db: schema/data operations spanning local and (via --linked/--db-url) the remote database.
[[command.sub]]
name = "db"
nested_bare = true
[[command.sub.sub]]
name = "pull"
profile = "remote-read"
fact = "Reads the remote database schema and writes the diff as a new local migration file; the remote interaction is a read."
source = "https://supabase.com/docs/reference/cli/supabase-db-pull"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "dump"
profile = "data-export"
output_path_flags = ["-f", "--file"]
fact = "Dumps the remote database schema (and, with --data-only, table data) to stdout or, with -f/--file, a local file; reads remote state, no mutation."
source = "https://supabase.com/docs/reference/cli/supabase-db-dump"
judgment = "A BULK remote read (can export all row data to the caller) — data-export, not a point read: scale=unbounded records the volume, disclosure=local-process the destination (the two together proxy the data's unknowable sensitivity). The -f/--file output form adds a path-gated local write, so a dump to a system path gates on locus while one to the worktree stays local."
standalone = ["--data-only", "--keep-comments", "--linked", "--local", "--role-only", "--use-copy", "--debug", "--experimental", "--help", "-h"]
valued = ["--exclude", "--password", "--project-ref", "--schema", "--workdir", "-p"]
[[command.sub.sub]]
name = "diff"
profile = "remote-read"
fact = "Compares schemas (local containers or the linked remote database via --linked/--db-url) and prints the difference; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-db-diff"
standalone = ["--linked", "--local", "--use-migra", "--use-pgadmin", "--use-pg-schema", "--debug", "--experimental", "--help", "-h"]
valued = ["--file", "--project-ref", "--schema", "--workdir", "-f", "-s"]
[[command.sub.sub]]
name = "lint"
profile = "remote-read"
fact = "Checks the database (local or --linked) for schema errors and prints findings; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-db-lint"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "push"
profile = "remote-mutate"
fact = "Applies pending local migrations to the linked remote database, altering its schema."
source = "https://supabase.com/docs/reference/cli/supabase-db-push"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "reset"
candidate = true
[[command.sub.sub]]
name = "start"
candidate = true

# ── migration: version-controlled schema evolution.
[[command.sub]]
name = "migration"
nested_bare = true
[[command.sub.sub]]
name = "list"
profile = "remote-read"
fact = "Shows migration history for local and (when linked) remote databases; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-migration-list"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "fetch"
profile = "remote-read"
fact = "Fetches migration files from the remote history table into the local project; the remote interaction is a read."
source = "https://supabase.com/docs/reference/cli/supabase-migration-fetch"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "new"
level = "SafeWrite"
bare = false
standalone = ["--help", "-h"]
[[command.sub.sub]]
name = "repair"
profile = "remote-mutate"
fact = "Updates the remote migration-history table to mark migrations as applied or reverted, reconciling drift."
source = "https://supabase.com/docs/reference/cli/supabase-migration-repair"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "up"
candidate = true
[[command.sub.sub]]
name = "down"
candidate = true
[[command.sub.sub]]
name = "squash"
candidate = true

# ── functions: Edge Functions lifecycle.
[[command.sub]]
name = "functions"
nested_bare = true
[[command.sub.sub]]
name = "list"
profile = "remote-read"
fact = "Lists the project's deployed Edge Functions; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-functions-list"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "download"
profile = "remote-read"
fact = "Downloads a deployed function's source from the project to the local project; the remote interaction is a read."
source = "https://supabase.com/docs/reference/cli/supabase-functions-download"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "new"
level = "SafeWrite"
bare = false
standalone = ["--help", "-h"]
[[command.sub.sub]]
name = "deploy"
profile = "remote-control"
fact = "Bundles and uploads function code to Supabase's edge runtime, activating it in production."
source = "https://supabase.com/docs/reference/cli/supabase-functions-deploy"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "delete"
profile = "remote-destroy-recoverable"
fact = "Removes a deployed function from the project via the management API."
source = "https://supabase.com/docs/reference/cli/supabase-functions-delete"
judgment = "Recoverable: the function is redeployable from its local source."
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "serve"
candidate = true

# ── orgs.
[[command.sub]]
name = "orgs"
nested_bare = true
[[command.sub.sub]]
name = "list"
profile = "remote-read"
fact = "Lists the organizations the caller belongs to; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-orgs-list"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "create"
profile = "remote-create"
fact = "Creates a new organization on the Supabase platform."
source = "https://supabase.com/docs/reference/cli/supabase-orgs-create"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]

# ── projects.
[[command.sub]]
name = "projects"
nested_bare = true
[[command.sub.sub]]
name = "list"
profile = "remote-read"
fact = "Lists the projects accessible to the caller; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-projects-list"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "create"
profile = "remote-create"
fact = "Provisions a new Supabase project (a managed Postgres instance); metered."
source = "https://supabase.com/docs/reference/cli/supabase-projects-create"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "delete"
profile = "remote-destroy-irreversible"
fact = "Deletes a Supabase project, permanently tearing down its database and all stored data."
source = "https://supabase.com/docs/reference/cli/supabase-projects-delete"
judgment = "Classified irreversible: project deletion removes the managed database and its data with no CLI-side restore path."
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "api-keys"
profile = "credential-read"
fact = "Prints the project's API keys, including the anon and service_role key VALUES; the service_role key bypasses row-level security (full database admin)."
source = "https://supabase.com/docs/reference/cli/supabase-projects-api-keys"
judgment = "Credential exposure: the printed key material enters the caller's context. This is the narrowing of the projects group's read surface — list is a benign remote-read, api-keys reveals live secrets."
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]

# ── branches: preview/database branches.
[[command.sub]]
name = "branches"
nested_bare = true
[[command.sub.sub]]
name = "list"
profile = "remote-read"
fact = "Lists the project's preview branches; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-branches-list"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "get"
profile = "remote-read"
fact = "Retrieves details of a specific preview branch; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-branches-get"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "create"
profile = "remote-create"
fact = "Provisions a new preview branch (an isolated database environment); metered."
source = "https://supabase.com/docs/reference/cli/supabase-branches-create"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "update"
profile = "remote-mutate"
fact = "Updates a preview branch's configuration via the management API."
source = "https://supabase.com/docs/reference/cli/supabase-branches-update"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "delete"
profile = "remote-destroy-recoverable"
fact = "Deletes a preview branch and its isolated environment."
source = "https://supabase.com/docs/reference/cli/supabase-branches-delete"
judgment = "Recoverable: a branch is recreatable from the parent project and migrations."
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "pause"
profile = "remote-control"
fact = "Suspends a running preview branch."
source = "https://supabase.com/docs/reference/cli/supabase-branches-update"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "unpause"
profile = "remote-control"
fact = "Resumes a paused preview branch."
source = "https://supabase.com/docs/reference/cli/supabase-branches-update"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]

# ── domains: custom hostnames.
[[command.sub]]
name = "domains"
nested_bare = true
[[command.sub.sub]]
name = "get"
profile = "remote-read"
fact = "Retrieves the custom hostname configuration stored for the project; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-domains-get"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "create"
profile = "remote-mutate"
fact = "Registers a custom hostname configuration for the project via the management API."
source = "https://supabase.com/docs/reference/cli/supabase-domains-create"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "activate"
profile = "remote-control"
fact = "Reconfigures the project to serve requests on the custom hostname instead of the default subdomain."
source = "https://supabase.com/docs/reference/cli/supabase-domains-activate"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "reverify"
profile = "remote-mutate"
fact = "Re-validates the custom hostname configuration on the platform."
source = "https://supabase.com/docs/reference/cli/supabase-domains-reverify"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "delete"
profile = "remote-destroy-recoverable"
fact = "Removes the custom hostname configuration from the project."
source = "https://supabase.com/docs/reference/cli/supabase-domains-delete"
judgment = "Recoverable: the hostname can be re-created."
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]

# ── vanity-subdomains.
[[command.sub]]
name = "vanity-subdomains"
nested_bare = true
[[command.sub.sub]]
name = "get"
profile = "remote-read"
fact = "Retrieves the project's current vanity subdomain configuration; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-vanity-subdomains-get"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "check-availability"
profile = "remote-read"
fact = "Checks whether a desired vanity subdomain name is available; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-vanity-subdomains-check-availability"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "activate"
profile = "remote-mutate"
fact = "Reconfigures the project to respond on the vanity subdomain."
source = "https://supabase.com/docs/reference/cli/supabase-vanity-subdomains-activate"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "delete"
profile = "remote-destroy-recoverable"
fact = "Deletes the vanity subdomain and reverts routing to the project ref."
source = "https://supabase.com/docs/reference/cli/supabase-vanity-subdomains-delete"
judgment = "Recoverable: the vanity subdomain can be re-activated."
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]

# ── secrets: Edge Function environment secrets.
[[command.sub]]
name = "secrets"
nested_bare = true
[[command.sub.sub]]
name = "list"
profile = "remote-read"
fact = "Lists the project's secrets returning each secret's NAME and a SHA-256 DIGEST only; the management API never returns plaintext secret values."
source = "https://supabase.com/docs/reference/cli/supabase-secrets-list"
judgment = "Not credential-read: the digest is a hash, not the secret value, so no credential material enters the caller's context."
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "set"
profile = "remote-mutate"
fact = "Stores or updates secret values in the linked project, exposed to Edge Functions as environment variables."
source = "https://supabase.com/docs/reference/cli/supabase-secrets-set"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "unset"
profile = "remote-destroy-recoverable"
fact = "Removes named secrets from the linked project."
source = "https://supabase.com/docs/reference/cli/supabase-secrets-unset"
judgment = "Recoverable: a secret can be re-set."
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]

# ── storage: object operations on Supabase Storage buckets.
[[command.sub]]
name = "storage"
nested_bare = true
[[command.sub.sub]]
name = "ls"
profile = "remote-read"
fact = "Lists objects in a Storage bucket; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-storage-ls"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "cp"
candidate = true
[[command.sub.sub]]
name = "mv"
candidate = true
[[command.sub.sub]]
name = "rm"
candidate = true

# ── test.
[[command.sub]]
name = "test"
nested_bare = true
[[command.sub.sub]]
name = "new"
level = "SafeWrite"
bare = false
standalone = ["--help", "-h"]
[[command.sub.sub]]
name = "db"
candidate = true

# ── gen: code / key generation.
[[command.sub]]
name = "gen"
nested_bare = true
[[command.sub.sub]]
name = "types"
profile = "remote-read"
fact = "Connects to the database (local or --linked/--db-url/--project-id) and prints typed definitions (TypeScript/Go/Swift/Python) matching its schema; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-gen-types"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "keys"
profile = "credential-read"
fact = "Generates and prints the project/branch API keys (anon, service_role, and publishable/secret keys) derived from the JWT secret."
source = "https://supabase.com/docs/reference/cli/supabase-gen-keys"
judgment = "Credential exposure: the emitted API-key values enter the caller's context."
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "signing-key"
profile = "credential-mint"
fact = "Generates a new private JWT signing key (ES256 or RS256) for import into the dashboard or CLI use."
source = "https://supabase.com/docs/reference/cli/supabase-gen-signing-key"
judgment = "Mints fresh private key material returned to the caller; classified credential-mint though generation is local."
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]

# ── snippets: saved SQL snippets.
[[command.sub]]
name = "snippets"
nested_bare = true
[[command.sub.sub]]
name = "list"
profile = "remote-read"
fact = "Lists the SQL snippets saved in the linked project; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-snippets-list"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "download"
profile = "remote-read"
fact = "Retrieves the SQL contents of a snippet by ID; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-snippets-download"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]

# ── sso: enterprise SAML single sign-on.
[[command.sub]]
name = "sso"
nested_bare = true
[[command.sub.sub]]
name = "list"
profile = "remote-read"
fact = "Lists the SSO identity providers configured for the project; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-sso-list"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "show"
profile = "remote-read"
fact = "Shows the configuration of a specific SSO provider; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-sso-show"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "info"
profile = "remote-read"
fact = "Prints the project's SAML SSO metadata (issuer/ACS URLs); read-only."
source = "https://supabase.com/docs/reference/cli/supabase-sso-info"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "add"
profile = "remote-authorize"
fact = "Registers a SAML identity provider for the project, changing who can authenticate."
source = "https://supabase.com/docs/reference/cli/supabase-sso-add"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "update"
profile = "remote-authorize"
fact = "Modifies an existing SSO provider's settings, changing authentication trust."
source = "https://supabase.com/docs/reference/cli/supabase-sso-update"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "remove"
profile = "remote-destroy-recoverable"
fact = "Disconnects a SAML identity provider from the project."
source = "https://supabase.com/docs/reference/cli/supabase-sso-remove"
judgment = "Recoverable: the provider can be re-added."
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]

# ── network-restrictions: database CIDR allowlist.
[[command.sub]]
name = "network-restrictions"
nested_bare = true
[[command.sub.sub]]
name = "get"
profile = "remote-read"
fact = "Displays the project's current database network restrictions; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-network-restrictions-get"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "update"
profile = "remote-authorize"
fact = "Changes which IP/CIDR ranges may connect to the database (append or overwrite the allowlist) — a network access-control policy change."
source = "https://supabase.com/docs/reference/cli/supabase-network-restrictions-update"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]

# ── network-bans: temporarily blocked IPs.
[[command.sub]]
name = "network-bans"
nested_bare = true
[[command.sub.sub]]
name = "get"
profile = "remote-read"
fact = "Lists the currently active network bans (temporarily blocked IPs); read-only."
source = "https://supabase.com/docs/reference/cli/supabase-network-bans-get"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "remove"
profile = "remote-mutate"
fact = "Unblocks (removes the ban on) specified IP addresses on the project."
source = "https://supabase.com/docs/reference/cli/supabase-network-bans-remove"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]

# ── config: project settings as code.
[[command.sub]]
name = "config"
nested_bare = true
[[command.sub.sub]]
name = "push"
profile = "remote-mutate"
fact = "Applies the local supabase/config.toml to the linked remote project, updating its settings."
source = "https://supabase.com/docs/reference/cli/supabase-config-push"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]

# ── encryption: project root encryption key.
[[command.sub]]
name = "encryption"
nested_bare = true
[[command.sub.sub]]
name = "get-root-key"
profile = "credential-read"
fact = "Retrieves and prints the project's 64-character hex root encryption key."
source = "https://supabase.com/docs/reference/cli/supabase-encryption-get-root-key"
judgment = "Credential exposure: the root encryption key is secret material that enters the caller's context."
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "update-root-key"
profile = "remote-mutate"
fact = "Sets/rotates the project's root encryption key on the platform."
source = "https://supabase.com/docs/reference/cli/supabase-encryption-update-root-key"
judgment = "Writes secret material to the remote (secret-write); above the auto-approve line regardless of the exact archetype."
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]

# ── postgres-config: Postgres parameter overrides.
[[command.sub]]
name = "postgres-config"
nested_bare = true
[[command.sub.sub]]
name = "get"
profile = "remote-read"
fact = "Retrieves the project's current Postgres configuration overrides; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-postgres-config-get"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "update"
profile = "remote-mutate"
fact = "Overrides Postgres configuration on the remote database (may destabilize it or override compute add-on tuning)."
source = "https://supabase.com/docs/reference/cli/supabase-postgres-config-update"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "delete"
profile = "remote-mutate"
fact = "Deletes specific Postgres config overrides, reverting them to defaults on the remote database."
source = "https://supabase.com/docs/reference/cli/supabase-postgres-config-delete"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]

# ── ssl-enforcement.
[[command.sub]]
name = "ssl-enforcement"
nested_bare = true
[[command.sub.sub]]
name = "get"
profile = "remote-read"
fact = "Retrieves the project's current SSL enforcement configuration; read-only."
source = "https://supabase.com/docs/reference/cli/supabase-ssl-enforcement-get"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]
[[command.sub.sub]]
name = "update"
profile = "remote-authorize"
fact = "Enables or disables the requirement that database connections use SSL — a connection-security policy change."
source = "https://supabase.com/docs/reference/cli/supabase-ssl-enforcement-update"
standalone = ["--create-ticket", "--debug", "--experimental", "--help", "--linked", "--local", "--yes", "-h"]
valued = ["--dns-resolver", "--network-id", "--output", "--project-ref", "--workdir", "-o"]