/alibabacloud-analyticdb-postgresql-supabase-ops

name: alibabacloud-analyticdb-postgresql-supabase-ops
description: |
  Manage the full lifecycle of ADBPG Supabase projects.
  Use for listing/querying projects, create, pause/resume, reset password, API Keys, and security IP management.
  Triggers: "Supabase", "supabase project", "spb-xxx", "ADBPG Supabase"

ADBPG Supabase Project Management

Manage the full lifecycle of Supabase projects based on AnalyticDB PostgreSQL (ADBPG).

**Architecture**: `ADBPG (AnalyticDB PostgreSQL) + Supabase + VPC + VSwitch`

Scope — Alibaba Cloud ADBPG only (not Supabase CLI)

• This skill controls projects **provisioned on Alibaba Cloud** via **GPDB / `aliyun gpdb`** APIs.
• **Do not** use the standalone **`supabase`** CLI (`supabase login`, `supabase projects list`, etc.) for create/list/pause/resume here — that targets **Supabase Cloud or self-hosted** stacks, **not** ADBPG-managed Supabase instances.
• All lifecycle and query operations in this skill are **`aliyun gpdb …`** with **`--user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops`**.

ProjectId format (`spb-`)

• **`ProjectId`** from create/list/get APIs uses the prefix **`spb-`** plus an alphanumeric suffix (e.g. `spb-2zen7c8752x12328`). Use this exact value in **`--project-id`**.
• If the user’s string does not match any instance, run **`list-supabase-projects`** in the right **`--biz-region-id`** and match **`ProjectName`** or the returned **`ProjectId`**.

Prerequisites

> **Pre-check: Aliyun CLI >= 3.3.3 required** > Run `aliyun version` to verify >= 3.3.3. If not installed or version too low, > run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install/update, > or see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation instructions. > Then **[MUST]** run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation. > Then **[MUST]** run `aliyun plugin update` to ensure that any existing plugins on your local machine are always up-to-date.

**[MUST] CLI User-Agent** — Every `aliyun` CLI command invocation must include: `--user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops`

At the **start** of the Core Workflow (before any CLI invocation): **[MUST] Enable AI-Mode** — AI-mode is required for Agent Skill execution. Run the following commands before any CLI invocation:

aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops"

**[MUST] Disable AI-Mode at EVERY exit point** — Before delivering the final response for ANY reason, always disable AI-mode first. This applies to ALL exit paths: workflow success, workflow failure, error/exception, user cancellation, session end, or any other scenario where no further CLI commands will be executed. AI-mode is only used for Agent Skill invocation scenarios and MUST NOT remain enabled after the skill stops running.

aliyun configure ai-mode disable

Credential Verification

> **Pre-check: Alibaba Cloud Credentials Required** > > **Security Rules:** > - **NEVER** read, echo, or print AK/SK values (e.g., `echo $ALIBABA_CLOUD_ACCESS_KEY_ID` is FORBIDDEN) > - **NEVER** ask the user to input AK/SK directly in the conversation or command line > - **NEVER** use `aliyun configure set` with literal credential values > - **ONLY** use `aliyun configure list` to check credential status > > ```bash > aliyun configure list > ``` > Check the output for a valid profile (AK, STS, or OAuth identity). > > **If no valid profile exists, STOP here.** > 1. Obtain credentials from [Alibaba Cloud Console](https://ram.console.aliyun.com/manage/ak) > 2. Configure credentials **outside of this session** (via `aliyun configure` in terminal or environment variables in shell profile) > 3. Return and re-run after `aliyun configure list` shows a valid profile

RAM Permissions

Ensure the current account has the required permissions before executing operations. See [references/ram-policies.md](references/ram-policies.md) for details.

**Permission Pre-check**: Use `ram-permission-diagnose` skill to check current user permissions, compare against `references/ram-policies.md`, and abort with prompt if any permission is missing.

Parameter Confirmation

> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call, > ALL user-customizable parameters (e.g., RegionId, ProjectId, instance names, CIDR blocks, > passwords, VPC/VSwitch IDs, etc.) MUST be confirmed with the user. > For **create**, the skill supplies **recommended defaults** (and optional auto-discovery). You **must** present that full plan and obtain **explicit user approval** (or replaced values) before running `create-supabase-project`.

Final execution confirmation (read-only vs mutating)

• **No separate final “execute” step** — only for **read-only information retrieval**: **`aliyun gpdb list-supabase-projects`**, **`aliyun gpdb get-supabase-project`**, **`get-supabase-project-api-keys`**, **`get-supabase-project-dashboard-account`**, and **discovery-only** calls such as **`aliyun vpc describe-vpcs`**, **`aliyun vpc describe-vswitches`**, **`aliyun gpdb describe-regions`** (same class as **list / describe**: no resource state change).
• **Final user confirmation [MUST]** — before the CLI runs, for **every mutating operation**: **create**, **pause**, **resume**, **reset password**, **modify security IPs**. Show **what** will execute and **key parameters** (e.g. `project-id`, new password hint without logging secret, new whitelist). Obtain **explicit approval**.
• **After create**, **provisioning poll** via **`get-supabase-project`** does **not** need a new confirmation — the user already approved create; polling is verification only.

**CreateSupabaseProject** is defined in the [official API reference](https://help.aliyun.com/zh/analyticdb/analyticdb-f