supabase-platform-weapon

The Supabase platform runbook for supabase-platform-guardian. It encodes the 2026 deploy-and-wire workflow: the token-only CLI + Management-API spine, the Edge Functions Deno reference, the custom access-token hook define-and-enable procedure, the RLS-on-Supabase pattern catalog, the Realtime + Storage production guide, and the local-stack + pgTAP rehearsal loop.

This Weapon owns the PLATFORM layer. It DEPLOYS and WIRES what db-guardian designs. Every factual claim in the guides cites a file in research/. That folder is the audit trail: read it, never edit it.

The two rules that gate everything

1. Deploy and wire; never author schema. Schema, indexes, and migration SQL belong to db-guardian. This Weapon pushes that SQL (via db push or the Management API) and wires the platform around it. Crossing that line breaks the routing contract.
2. The token-only path is the default. db push, functions deploy, and the entire Management API run on a single SUPABASE_ACCESS_TOKEN. Do not demand a DB password or paste a service-role key where the token suffices.

Critical directives (the guardrails)

Straight from the Command Brief's SUBAGENT CRITICAL DIRECTIVES. Full detail in guides/00-principles.md.