Alibabacloud Analyticdb Postgresql Supabase Ops

ADBPG Supabase Project Management

Manage the full lifecycle of Supabase projects based on AnalyticDB PostgreSQL (ADBPG).

Architecture: ADBPG (AnalyticDB PostgreSQL) + Supabase + VPC + VSwitch

Scope — Alibaba Cloud ADBPG only (not Supabase CLI)

• This skill controls projects provisioned on Alibaba Cloud via GPDB / `aliyun gpdb` APIs.
• Do not use the standalone `supabase` CLI (supabase login, supabase projects list, etc.) for create/list/pause/resume here — that targets Supabase Cloud or self-hosted stacks, not ADBPG-managed Supabase instances.
• All lifecycle and query operations in this skill are `aliyun gpdb …` with `--user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops`.

ProjectId format (spb-)

• `ProjectId` from create/list/get APIs uses the prefix `spb-` plus an alphanumeric suffix (e.g. spb-2zen7c8752x12328). Use this exact value in `--project-id`.
• If the user’s string does not match any instance, run `list-supabase-projects` in the right `--biz-region-id` and match `ProjectName` or the returned `ProjectId`.

Prerequisites

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low,

run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to install/update,

or see references/cli-installation-guide.md for installation instructions.

Then [MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.

Then [MUST] run aliyun plugin update to ensure that any existing plugins on your local machine are always up-to-date.

[MUST] CLI User-Agent — Every aliyun CLI command invocation must include: --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

At the start of the Core Workflow (before any CLI invocation): [MUST] Enable AI-Mode — AI-mode is required for Agent Skill execution. Run the following commands before any CLI invocation:

aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops"

[MUST] Disable AI-Mode at EVERY exit point — Before delivering the final response for ANY reason, always disable AI-mode first. This applies to ALL exit paths: workflow success, workflow failure, error/exception, user cancellation, session end, or any other scenario where no further CLI commands will be executed. AI-mode is only used for Agent Skill invocation scenarios and MUST NOT remain enabled after the skill stops running.

aliyun configure ai-mode disable

Credential Verification

Pre-check: Alibaba Cloud Credentials Required

>

Security Rules:

- NEVER read, echo, or print AK/SK values (e.g., echo $ALIBABA_CLOUD_ACCESS_KEY_ID is FORBIDDEN)

- NEVER ask the user to input AK/SK directly in the conversation or command line

- NEVER use aliyun configure set with literal credential values

- ONLY use aliyun configure list to check credential status

>

```bash

aliyun configure list

```

Check the output for a valid profile (AK, STS, or OAuth identity).

>

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console

2. Configure credentials outside of this session (via aliyun configure in terminal or environment variables in shell profile)

3. Return and re-run after aliyun configure list shows a valid profile

RAM Permissions

Ensure the current account has the required permissions before executing operations. See references/ram-policies.md for details.

Permission Pre-check: Use ram-permission-diagnose skill to check current user permissions, compare against references/ram-policies.md, and abort with prompt if any permission is missing.

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call,

ALL user-customizable parameters (e.g., RegionId, ProjectId, instance names, CIDR blocks,

passwords, VPC/VSwitch IDs, etc.) MUST be confirmed with the user.

For create, the skill supplies recommended defaults (and optional auto-discovery). You must present that full plan and obtain explicit user approval (or replaced values) before running create-supabase-project.

Final execution confirmation (read-only vs mutating)

• No separate final “execute” step — only for read-only information retrieval: `aliyun gpdb list-supabase-projects`, `aliyun gpdb get-supabase-project`, `get-supabase-project-api-keys`, `get-supabase-project-dashboard-account`, and discovery-only calls such as `aliyun vpc describe-vpcs`, `aliyun vpc describe-vswitches`, `aliyun gpdb describe-regions` (same class as list / describe: no resource state change).
• Final user confirmation [MUST] — before the CLI runs, for every mutating operation: create, pause, resume, reset password, modify security IPs. Show what will execute and key parameters (e.g. project-id, new password hint without logging secret, new whitelist). Obtain explicit approval.
• After create, provisioning poll via `get-supabase-project` does not need a new confirmation — the user already approved create; polling is verification only.

CreateSupabaseProject is defined in the official API reference. Full CLI mapping, VPC/VSwitch discovery, name/password rules: references/create-supabase-project-parameters.md.

Timeout Configuration

Timeout Settings

- Default CLI read timeout is often ~60 seconds per HTTP read — usually enough for `create-supabase-project`, because creation is asynchronous: the API accepts the request and returns `ProjectId` quickly; it does not block until the instance is ready.

- 3–5 minutes is the typical time for background provisioning to finish — not the duration of the create HTTP response. Use Success Verification (poll get-supabase-project until Status is running) to wait for that phase.

- Create success criterion: after create-supabase-project returns `ProjectId`, the instance is not ready until `get-supabase-project` reports `Status` = `running` (API uses lowercase) — that state means provisioning succeeded and the project is usable.

- If any command hits read timeouts in practice, raise --read-timeout for that call (e.g. --read-timeout 120).

Core Workflow

All commands use aliyun gpdb <command> format, must include `--user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops`.

Per [Final execution confirmation](#final-execution-confirmation-read-only-vs-mutating): read-only list / get / describe may run without a final execute prompt; create, pause, resume, reset password, modify IPs require explicit final user confirmation before invocation.

List Projects

aliyun gpdb list-supabase-projects \
  --biz-region-id cn-beijing \
  --max-results 20 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

• Risk: Low | Read-only — no final execution confirmation

Get Project Details

aliyun gpdb get-supabase-project \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

• Risk: Low | Read-only — no final execution confirmation

Get API Keys

aliyun gpdb get-supabase-project-api-keys \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

• Risk: Low | Read-only — no final execution confirmation
• Policy: Fulfilling a request to read keys via this official Alibaba Cloud API (with RAM/account access) is not the same as scraping secrets from an unrelated codebase. Decline only when the task is clearly exfiltration from repos or third-party systems; otherwise run `get-supabase-project-api-keys`, return keys minimally (no logging full secrets), and remind the user to rotate if exposed.

Get Dashboard Account

aliyun gpdb get-supabase-project-dashboard-account \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

• Risk: Low | Read-only — no final execution confirmation

Create Project

Automated workflow — When user provides intent like "帮我在北京 i 创建 ADBPG Supabase 项目", run these steps:

Step 1: Auto-discover all information (no user input needed yet)

1. Region + Zone — Use user-specified values or defaults (cn-beijing, cn-beijing-i). 2. ProjectName — Run scripts/generate-project-name.sh to get 1-3 candidates (timestamp-based). 3. Password — Run scripts/generate-password.py to generate a compliant password. 4. VPC/VSwitch discovery — Run scripts/discover-vswitch.sh --biz-region-id <region> --zone-id <zone> to get the VSwitch with the most available IPs. 5. SecurityIPList — Default 127.0.0.1. 6. Optional flags — Use defaults: 2C2G, 20 GB, POSTPAY, PL0. 7. ClientToken — Generate one UUID.

Step 2: Present creation plan (single confirmation)

Display the full parameter table to the user with options:

=== Create Supabase Project Plan ===
Project Name:   <generated-or-user-confirmed>
Region:         <biz-region-id>
Zone:           <zone-id>
VPC:            <vpc-id from discovery>
VSwitch:        <vswitch-id from discovery> (Available IPs: <count>)
Instance Spec:  2C2G
Storage:        20 GB
Pay Type:       POSTPAY
Security IP:    127.0.0.1
Password:       <generated, shown once or masked>
=================================

Select an option:
1. Confirm and create (default)
2. Modify parameters
3. Cancel

Press Enter for [1], or type option number:

Step 3: Execute after confirmation

If user selects "1" or presses Enter (confirm), run:

aliyun gpdb create-supabase-project \
  --biz-region-id <BizRegionId> \
  --zone-id <ZoneId> \
  --project-name <ProjectName> \
  --account-password ‘<Password>’ \
  --security-ip-list "127.0.0.1" \
  --vpc-id <VpcId> \
  --vswitch-id <VSwitchId> \
  --project-spec 2C2G \
  --storage-size 20 \
  --disk-performance-level PL0 \
  --pay-type POSTPAY \
  --client-token "<ClientToken>" \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

Then proceed to Success Verification (polling) as described below.

Async create — HTTP retries (before you have `ProjectId`)

• Goal: absorb transient CLI/network/API errors without double-creating a different resource.
• Reuse the same `--client-token` on every create attempt in this session for this intended project.
• Retry create (max 3 attempts total, including the first) only if the response has no ProjectId and the error looks transient: e.g. throttling, connection reset, read timeout, ServiceUnavailable. Backoff: 5s → 15s → 45s between attempts.
• Do not blindly retry create for business errors (e.g. VSwitchIp.NotEnough, invalid parameter) — stop, explain, fix with the user.
• If any attempt returns `ProjectId` → stop calling create; switch to provisioning poll (Success Verification).
• If create times out but might have succeeded server-side → poll `get-supabase-project` by name/region (e.g. list-supabase-projects filtered by ProjectName) before issuing another create with the same token/name.

# CLIENT_TOKEN: generate once (e.g. uuidgen) before first attempt; reuse on safe create retries.
aliyun gpdb create-supabase-project \
  --biz-region-id cn-beijing \
  --zone-id cn-beijing-i \
  --project-name my_supabase \
  --account-password '<user-or-generated>' \
  --security-ip-list "127.0.0.1" \
  --vpc-id vpc-xxxxx \
  --vswitch-id vsw-xxxxx \
  --project-spec 2C2G \
  --storage-size 20 \
  --disk-performance-level PL0 \
  --pay-type POSTPAY \
  --client-token "$CLIENT_TOKEN" \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

• Risk: High | Final user confirmation — full parameter plan approved before execution
• Password: at least 3 of uppercase, lowercase, digits, specials from !@#$%^&*()_+-=; length 8–32 (per API)
• Project name: letters/numbers/hyphens/underscores; must start with letter or _; length 1–128

Pause Project

aliyun gpdb pause-supabase-project \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

• Risk: Medium | Final user confirmation required before execution
• Service unavailable after pause, but data is retained

Resume Project

aliyun gpdb resume-supabase-project \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

• Risk: Medium | Final user confirmation required before execution (mutating)

Reset Database Password

aliyun gpdb reset-supabase-project-password \
  --project-id spb-xxxxx \
  --account-password 'NewPass456!' \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

• Risk: Medium | Final user confirmation required before execution
• Existing connections using old password will be disconnected

Modify Security IPs

aliyun gpdb modify-supabase-project-security-ips \
  --project-id spb-xxxxx \
  --security-ip-list "10.0.0.1,10.0.0.2/24" \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

• Risk: Medium | Final user confirmation required before execution
• Multiple IPs separated by commas, CIDR format supported

Success Verification

Use the steps below first; extended tables and edge cases are in references/verification-method.md.

After create (create-supabase-project)

1. Capture `ProjectId` from the create response (format `spb-` + suffix). The create call returns after the request is accepted, not when provisioning finishes. If create fails or times out, list or get to see if the project already exists before another create (same `--client-token` if retrying create per Create Project).

2. Provisioning poll until `running` or terminal failure — async work often finishes in 3–5 minutes but can run longer under load. Use a two-tier wait:

• Tier A — primary: every 30 seconds, call `get-supabase-project`, up to 20 attempts (~10 minutes).
• Tier B — extension (optional): if Status is still a non-terminal provisioning state (e.g. creating / pending — exact strings depend on API), inform the user and add up to 10 more attempts (~5 minutes) before giving up.

3. Per-poll retry (transient): For each scheduled poll, if get fails with network/read timeout or throttling, retry the same get up to 3 times with 5 seconds between tries, then continue the outer loop (still count as one poll cycle).

4. Interpret `Status`:

• `running` → create / provisioning succeeded; instance is ready — report success to the user.
• Terminal failure (if API returns explicit failure/cancelled states) → stop polling; report error code/message; do not assume success.
• Empty / unknown / in-progress → keep polling within Tier A/B limits.

PROJECT_ID="spb-xxxxx"
STATUS=""
MAX_PRIMARY=20
SLEEP=30
for attempt in $(seq 1 "$MAX_PRIMARY"); do
  RAW=""
  for inner in 1 2 3; do
    RAW=$(aliyun gpdb get-supabase-project \
      --project-id "$PROJECT_ID" \
      --read-timeout 90 \
      --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops \
      2>/dev/null) && break
    sleep 5
  done
  STATUS=$(echo "$RAW" | jq -r '.Status // empty')
  [ "$STATUS" = "running" ] && break
  sleep "$SLEEP"
done
# Optional: extend with user consent +10 polls if still provisioning
[ "$STATUS" = "running" ] || exit 1

If jq is unavailable, inspect the get output for Status each time; same retry and tier rules apply.

After other operations

Best Practices

1. Read-only list/get/describe (see Final execution confirmation) may run without a final execute prompt; never run create/pause/resume/reset-password/modify-IPs without explicit final user confirmation 2. If users lack VPC/VSwitch IDs, discover with vpc describe-vswitches (and optionally vpc describe-vpcs) before create 3. Must issue warning before pausing projects (service will become unavailable) 4. Do not recommend setting whitelist to 0.0.0.0/0 due to security risks 5. `ProjectId` is always `spb-…` — if the user’s id is wrong or unknown, use `list-supabase-projects` to resolve by name or id 6. Never substitute `supabase` CLI for `aliyun gpdb` on this product 7. Pausing projects saves costs while data is preserved 8. All commands must include --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops 9. After create, always run provisioning poll (or confirm terminal failure) — do not treat “create returned ProjectId” as “instance ready”

Reference Documents

Acceptance Criteria: ADBPG Supabase Management

Scenario: ADBPG Supabase Project Management Purpose: Skill testing acceptance criteria

Table of Contents

• Correct CLI Command Patterns
• 1. Product
• 2. Command
• 3. Parameters
• 4. User-Agent
• 5. Complete Command Examples
• Security Patterns
• 1. Credential Handling
• 2. Password Requirements
• 3. Security IP List
• User confirmation

---

User confirmation

Per the main skill (SKILL.md):

• No final “execute” confirmation for read-only list / get / describe (e.g. list-supabase-projects, get-supabase-project*, vpc describe-vpcs, vpc describe-vswitches, gpdb describe-regions).
• Explicit final user confirmation before CLI for create, pause, resume, reset-supabase-project-password, modify-supabase-project-security-ips.

---

Correct CLI Command Patterns

1. Product — verify product name exists

✅ CORRECT

aliyun gpdb ...

❌ INCORRECT

aliyun GPDB ...        # Error: product name must be lowercase
aliyun adbpg ...       # Error: product name is gpdb, not adbpg

2. Command — verify action exists under the product

✅ CORRECT (Plugin Mode - lowercase with hyphens)

aliyun gpdb list-supabase-projects
aliyun gpdb get-supabase-project
aliyun gpdb create-supabase-project
aliyun gpdb pause-supabase-project
aliyun gpdb resume-supabase-project
aliyun gpdb reset-supabase-project-password
aliyun gpdb modify-supabase-project-security-ips
aliyun gpdb get-supabase-project-api-keys
aliyun gpdb get-supabase-project-dashboard-account

❌ INCORRECT (Traditional API Mode)

aliyun gpdb ListSupabaseProjects       # Error: use list-supabase-projects
aliyun gpdb GetSupabaseProject         # Error: use get-supabase-project
aliyun gpdb CreateSupabaseProject      # Error: use create-supabase-project

3. Parameters — verify each parameter name exists

✅ CORRECT (Plugin Mode - lowercase with hyphens)

--project-id spb-xxxxx
--biz-region-id cn-beijing
--project-name my_project
--zone-id cn-beijing-i
--account-password 'MyPass123!'
--security-ip-list "127.0.0.1"
--vpc-id vpc-xxxxx
--vswitch-id vsw-xxxxx
--project-spec 2C2G
--max-results 20
--user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT (Traditional API Mode)

--ProjectId spb-xxxxx        # Error: use --project-id
--RegionId cn-beijing       # Error: use --biz-region-id or --region
--ProjectName my_project     # Error: use --project-name
--ZoneId cn-beijing-i       # Error: use --zone-id
--AccountPassword 'xxx'      # Error: use --account-password
--SecurityIPList "xxx"       # Error: use --security-ip-list
--VpcId vpc-xxxxx            # Error: use --vpc-id
--VSwitchId vsw-xxxxx        # Error: use --vswitch-id
--MaxResults 20              # Error: use --max-results

4. User-Agent — every command must include

✅ CORRECT

aliyun gpdb list-supabase-projects --user-agent AlibabaCloud-Agent-Skills
aliyun gpdb get-supabase-project --project-id spb-xxx --user-agent AlibabaCloud-Agent-Skills

❌ INCORRECT

aliyun gpdb list-supabase-projects                    # Missing --user-agent
aliyun gpdb get-supabase-project --project-id spb-xxx # Missing --user-agent

5. Complete Command Examples

List Projects

✅ CORRECT

aliyun gpdb list-supabase-projects \
  --biz-region-id cn-beijing \
  --max-results 20 \
  --user-agent AlibabaCloud-Agent-Skills

Get Project Details

✅ CORRECT

aliyun gpdb get-supabase-project \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills

Create Project

✅ CORRECT

aliyun gpdb create-supabase-project \
  --biz-region-id cn-beijing \
  --zone-id cn-beijing-i \
  --project-name my_supabase \
  --account-password 'MyPass123!' \
  --security-ip-list "127.0.0.1" \
  --vpc-id vpc-xxxxx \
  --vswitch-id vsw-xxxxx \
  --project-spec 2C2G \
  --storage-size 20 \
  --disk-performance-level PL0 \
  --pay-type POSTPAY \
  --user-agent AlibabaCloud-Agent-Skills

Pause Project

✅ CORRECT

aliyun gpdb pause-supabase-project \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills

Resume Project

✅ CORRECT

aliyun gpdb resume-supabase-project \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills

Reset Password

✅ CORRECT

aliyun gpdb reset-supabase-project-password \
  --project-id spb-xxxxx \
  --account-password 'NewPass456!' \
  --user-agent AlibabaCloud-Agent-Skills

Modify Security IPs

✅ CORRECT

aliyun gpdb modify-supabase-project-security-ips \
  --project-id spb-xxxxx \
  --security-ip-list "10.0.0.1,10.0.0.2/24" \
  --user-agent AlibabaCloud-Agent-Skills

Get API Keys

✅ CORRECT

aliyun gpdb get-supabase-project-api-keys \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills

Get Dashboard Account

✅ CORRECT

aliyun gpdb get-supabase-project-dashboard-account \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills

---

Security Patterns

1. Credential Handling

✅ CORRECT

# Only check credential status, do not output sensitive information
aliyun configure list

❌ INCORRECT

echo $ALIBABA_CLOUD_ACCESS_KEY_ID           # FORBIDDEN: do not output AK
echo $ALIBABA_CLOUD_ACCESS_KEY_SECRET       # FORBIDDEN: do not output SK
aliyun configure set --access-key-id xxx    # FORBIDDEN: do not set credentials directly in session

2. Password Requirements

✅ CORRECT

MyPass123!     # Uppercase + lowercase + numbers + special chars
Abc@12345      # At least 3 character types
Test_Pass1!    # 8-32 characters length

❌ INCORRECT

password       # Only lowercase letters
12345678       # Only numbers
abc123         # Missing special chars or uppercase
Pass1!         # Less than 8 characters

3. Security IP List

✅ CORRECT

127.0.0.1                    # No external access allowed
10.0.0.1                     # Single IP
10.0.0.1,10.0.0.2           # Multiple IPs
10.0.0.0/24                  # CIDR format
10.0.0.1,192.168.1.0/24     # Mixed format

❌ INCORRECT (Security Risk)

0.0.0.0/0                    # Allows all IPs, serious security risk

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Table of Contents

• Installation
• macOS
• Linux
• Windows
• Configuration
• Quick Start
• Environment Variables
• Managing Multiple Profiles
• Verification
• Troubleshooting
• References

Aliyun CLI 3.3.3+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.3 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.3)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

Quick Start

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-beijing

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-beijing

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-beijing

Use Specific Profile

aliyun ecs describe-instances --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions

# Expected output: JSON array of regions

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunGPDBFullAccess for GPDB operations

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak

CreateSupabaseProject — parameters & defaults

Official API: CreateSupabaseProject (ADBPG / GPDB).

CLI command: aliyun gpdb create-supabase-project (plugin mode). Every invocation must include --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops.

Rule: The skill proposes defaults in the table below. The agent must show the user a filled-in plan (or short list of options) and obtain explicit confirmation or replacement values before calling create.

Global policy (see main SKILL.md Final execution confirmation): only list / get / describe (read-only) skip a final execute prompt; create and all other mutating GPDB operations require final user confirmation before the CLI runs.

Parameter matrix (API → CLI)

ProjectName from scenario

1. Take the user’s intent (e.g. “user auth production”, “demo app”). 2. Normalize to API rules: length 1–128; only [A-Za-z0-9_-]; must start with [A-Za-z_]. 3. Replace spaces with _, remove invalid characters, collapse repeats. 4. Examples: User Auth Prod → user_auth_prod; demo-app → demo_app or keep demo-app if valid. 5. Offer 1–2 candidates; user confirms or supplies another name.

AccountPassword when user does not provide one

Per API: length 8–32; at least three of: uppercase, lowercase, digit, special from *`!@#$%^&()_+-=`**.

1. Generate a random password meeting rules (e.g. use a cryptographically secure RNG in code, or python3 -c / openssl in a pinch). 2. Do not paste the full password into logs or transcripts; show once for user confirmation/storage, or confirm “generated and will be used” per session policy. 3. User may replace with their own password before create; validate rules before submit.

SecurityIPList

• Default: 127.0.0.1 (per product semantics: blocks external access until whitelist is widened).
• User may set comma-separated IPs or CIDRs (e.g. 10.0.0.0/16,203.0.113.10).
• Avoid recommending 0.0.0.0/0 unless user explicitly accepts risk.

VPC / VSwitch discovery (when VpcId or VSwitchId is missing)

Use VPC OpenAPI via CLI (requires vpc:DescribeVSwitches and usually vpc:DescribeVpcs — see ram-policies.md). Always add --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops.

Step A — list VSwitches in the target zone (primary path)

aliyun vpc describe-vswitches \
  --biz-region-id <BizRegionId> \
  --zone-id <ZoneId> \
  --page-size 50 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

Use `--pager` (see aliyun vpc describe-vswitches --help) or increase `--page-number` until all VSwitches are collected.

• Parse the JSON: each item includes `VSwitchId`, `VpcId`, `ZoneId`, and typically `AvailableIpAddressCount` (or equivalent field in output).
• Keep only switches where ZoneId equals the chosen <ZoneId> (should already match filter).
• If the user already provided `VpcId`, filter to that VPC only.
• Sort by `AvailableIpAddressCount` descending (missing → 0).
• Recommend the first row’s VSwitchId + VpcId; also show top 3–5 with VPC ID, VSwitch ID, and available IP count so the user can pick another.

Step B — optional describe-vpcs (when user asks for VPC list first)

aliyun vpc describe-vpcs \
  --biz-region-id <BizRegionId> \
  --page-size 50 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

Note: some CLI versions default `--is-default` in a way that limits results. If the list looks incomplete, run additional calls with --is-default true and --is-default false and merge by VpcId, or follow local aliyun vpc describe-vpcs --help.

After user picks a VPC, run Step A with --vpc-id <VpcId> (still require --zone-id to match the Supabase zone).

Final check before create

• ZoneId matches the selected VSwitch’s zone.
• All required CLI flags are set; optional flags only if user confirmed.
• User gave final OK on the full parameter set (including generated password if any).
• `CLIENT_TOKEN` is set once for this create intent and passed as --client-token (recommended for correct retry behavior).

Async create retries (skill)

Aligned with SKILL.md Create Project and Success Verification:

1. Create HTTP: max 3 attempts with backoff 5s / 15s / 45s only when no ProjectId and error is transient; same --client-token every time. Never retry blindly on business errors. 2. After `ProjectId`: only `get-supabase-project` polling — no second create. 3. Timeout without `ProjectId`: `list-supabase-projects` (filter by name/region) before another create. 4. Provisioning: poll every 30s, 20 attempts primary + optional 10 with user notice; each poll: up to 3 inner get retries, 5s apart. 5. Create success: when `get-supabase-project` returns `Status` = `running`, provisioning succeeded — report create success to the user (not merely having ProjectId from create).

Full scripts: main skill file and verification-method.md § Create.

RAM Policies for ADBPG Supabase Management

This document lists the RAM permissions required for ADBPG Supabase management operations.

Required Permissions

RAM Policy Examples

Read-Only Permissions (Query Operations)

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "gpdb:ListSupabaseProjects",
        "gpdb:GetSupabaseProject",
        "gpdb:GetSupabaseProjectApiKeys",
        "gpdb:GetSupabaseProjectDashboardAccount",
        "gpdb:DescribeRegions"
      ],
      "Resource": "*"
    }
  ]
}

Full Management Permissions

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "gpdb:ListSupabaseProjects",
        "gpdb:GetSupabaseProject",
        "gpdb:GetSupabaseProjectApiKeys",
        "gpdb:GetSupabaseProjectDashboardAccount",
        "gpdb:CreateSupabaseProject",
        "gpdb:PauseSupabaseProject",
        "gpdb:ResumeSupabaseProject",
        "gpdb:ResetSupabaseProjectPassword",
        "gpdb:ModifySupabaseProjectSecurityIps",
        "gpdb:DescribeRegions",
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches"
      ],
      "Resource": "*"
    }
  ]
}

VPC-Related Permissions (Required for Project Creation)

Creating a Supabase project requires VPC and VSwitch IDs. If the skill discovers them with aliyun vpc describe-vpcs / describe-vswitches, grant these read permissions in addition to GPDB:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches"
      ],
      "Resource": "*"
    }
  ]
}

Permission Risk Levels

Low-Risk Operations (No Special Approval Required)

• ListSupabaseProjects - List projects
• GetSupabaseProject - Get project details
• GetSupabaseProjectApiKeys - Get API Keys
• GetSupabaseProjectDashboardAccount - Get Dashboard account
• ResumeSupabaseProject - Resume paused project

Medium-Risk Operations (Approval Recommended)

• CreateSupabaseProject - Create project (incurs costs)
• PauseSupabaseProject - Pause project (service unavailable)
• ResetSupabaseProjectPassword - Reset password (disconnects existing connections)
• ModifySupabaseProjectSecurityIps - Modify whitelist (affects access control)

Reference Links

• RAM Access Control Documentation
• GPDB Authorization Information

Related APIs - ADBPG Supabase Management

本文档列出了 ADBPG Supabase 管理相关的所有 CLI 命令和 API。

CLI 命令列表

命令参数详情

list-supabase-projects

查询 Supabase 实例列表。

get-supabase-project

查询 Supabase 实例详情。

get-supabase-project-api-keys

查询 Supabase 实例 API Keys。

get-supabase-project-dashboard-account

查询 Supabase 项目 Dashboard 账号信息。

create-supabase-project

创建 Supabase 项目（异步：接口较快返回 ProjectId，后台开通约 3–5 分钟；开通成功以 get-supabase-project 的 `Status` = `running` 为准）。

详见 create-supabase-project-parameters.md（默认值、场景命名、密码生成、VPC/VSwitch 发现）。

pause-supabase-project

暂停 Supabase 实例。暂停后服务不可用，但数据保留。

resume-supabase-project

恢复 Supabase 实例。

reset-supabase-project-password

重置 Supabase 数据库密码。重置后使用旧密码的连接将断开。

modify-supabase-project-security-ips

修改 Supabase 项目白名单。

参考链接

• GPDB API 文档
• Supabase 产品文档

Verification Methods - ADBPG Supabase Management

This document describes how to verify whether ADBPG Supabase management operations are successful.

Operation Verification Methods

1. List Query Verification

Operation: list-supabase-projects

aliyun gpdb list-supabase-projects \
  --biz-region-id cn-beijing \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

Success Indicators:

• Response JSON contains Projects array
• HTTP status code 200
• Response includes RequestId

2. Detail Query Verification

Operation: get-supabase-project

aliyun gpdb get-supabase-project \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

Success Indicators:

• Response JSON contains complete project information
• Contains fields: ProjectId, ProjectName, Status, RegionId, CreateTime

3. Create Project Verification

Operation: create-supabase-project

Async model: Create is asynchronous. The CLI/API usually returns within the default read timeout (~60s) with a `ProjectId`. 3–5 minutes is the typical provisioning time after that — not how long the create HTTP call blocks. Heavy load may need longer; the skill uses longer polling and optional extension.

Before `ProjectId` — create HTTP retries (see also create-supabase-project-parameters.md):

• Generate `CLIENT_TOKEN` once; pass `--client-token` on every create attempt for this intent.
• Retry create (max 3 tries, backoff 5s → 15s → 45s) only if no ProjectId and the failure is transient (throttle, timeout, connection, ServiceUnavailable). Do not retry on parameter / quota / VSwitchIp.NotEnough style errors.
• If `ProjectId` appears → stop create; start provisioning poll below.
• If create times out with no id → `list-supabase-projects` by region/name before a second create.

After `ProjectId` — provisioning poll:

1. Query project status (use --read-timeout 90 on each get).

2. Primary tier: every 30s, up to 20 attempts (~10 min). Optional extension: if status is still non-terminal provisioning, notify user and add up to 10 more attempts (~5 min).

3. Inner retry per poll cycle: if get fails (network, timeout, throttle), retry the same get up to 3 times with 5s between tries, then sleep 30 and continue the outer loop.

Example (primary tier + inner retries):

PROJECT_ID="<returned-ProjectId>"
STATUS=""
MAX_PRIMARY=20
SLEEP=30
for attempt in $(seq 1 "$MAX_PRIMARY"); do
  RAW=""
  for inner in 1 2 3; do
    RAW=$(aliyun gpdb get-supabase-project \
      --project-id "$PROJECT_ID" \
      --read-timeout 90 \
      --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops \
      2>/dev/null) && break
    sleep 5
  done
  STATUS=$(echo "$RAW" | jq -r '.Status // empty')
  [ "$STATUS" = "running" ] && break
  sleep "$SLEEP"
done

4. Status handling: `running` → create / provisioning succeeded (success). Explicit API failure/cancelled states → stop and report (do not claim success). Empty or in-progress → keep polling within tier limits.

Success Indicators:

• Create command returns ProjectId (format: spb- + suffix) — request accepted only
• `get-supabase-project` shows `Status` = `running` — provisioning succeeded; treat as create success for user messaging (instance ready)
• If polling exhausts tiers without running, report failure honestly (do not claim success)

5. Pause Project Verification

Operation: pause-supabase-project

Verification Steps:

# 1. Execute pause
aliyun gpdb pause-supabase-project \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

# 2. Query status
aliyun gpdb get-supabase-project \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

Success Indicators:

• Project status becomes Paused or Stopped

6. Resume Project Verification

Operation: resume-supabase-project

Verification Steps:

# 1. Execute resume
aliyun gpdb resume-supabase-project \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

# 2. Query status
aliyun gpdb get-supabase-project \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

Success Indicators:

• Project status becomes running

7. Reset Password Verification

Operation: reset-supabase-project-password

Verification Methods:

• Command executes successfully
• Can connect to database with new password
• Connection with old password fails

Note: Cannot verify password change directly via API, requires actual connection test

8. Modify Security IPs Verification

Operation: modify-supabase-project-security-ips

Verification Steps:

# 1. Execute modification
aliyun gpdb modify-supabase-project-security-ips \
  --project-id spb-xxxxx \
  --security-ip-list "10.0.0.1,10.0.0.2/24" \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

# 2. Query project details to confirm whitelist
aliyun gpdb get-supabase-project \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

Success Indicators:

• SecurityIPList in project details has been updated

9. API Keys Query Verification

Operation: get-supabase-project-api-keys

aliyun gpdb get-supabase-project-api-keys \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

Success Indicators:

• Response JSON contains API Keys information
• Contains AnonKey and ServiceRoleKey

10. Dashboard Account Query Verification

Operation: get-supabase-project-dashboard-account

aliyun gpdb get-supabase-project-dashboard-account \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-analyticdb-postgresql-supabase-ops

Success Indicators:

• Response JSON contains Dashboard account information
• Contains login URL and credentials

Common Error Handling