feat(cli)!: one --remote flag, local target defaults and one hosted-mutation consent rule

.oxlintrc.effect.json

@@ -120,6 +120,7 @@
     "!apps/cli/src/command-internal/string-slice-flag.*",
     "!apps/cli/src/command-internal/struct-output.*",
     "!apps/cli/src/command-internal/supabase-env.*",
+    "!apps/cli/src/command-internal/target/parent-scoped-project-ref.*",
     "!apps/cli/src/command-internal/tenant-*",
     "!apps/cli/src/command-internal/test-db.*",
     "!apps/cli/src/command-internal/timestamp.format.*",

README.md

@@ -77,12 +77,14 @@ supabase link
 
 ## Manage Your Database
 
-Create migrations, compare schemas, and apply changes locally or to your linked project:
+Create migrations, compare schemas, and apply changes to your local database. Add `--remote` to act
+on your linked project instead:
 
 ```sh
 supabase migration new create_profiles
 supabase db diff
 supabase db push
+supabase db push --remote
 supabase db reset
 ```
 
@@ -101,8 +103,8 @@ supabase functions deploy hello-world
 Generate TypeScript types from your local database or linked project:
 
 ```sh
-supabase gen types --local
-supabase gen types --linked
+supabase gen types
+supabase gen types --remote
 ```
 
 ## Reference

apps/cli-e2e/AGENTS.md

@@ -64,7 +64,7 @@ the running tests exercise. The implications:
 import { testBehaviour } from "./test-context.ts";
 
 testBehaviour("does the thing", async ({ run, projectRef, orgId, apiUrl, workspace }) => {
-  const result = await run(["command", "--project-ref", projectRef]);
+  const result = await run(["command", `--remote=${projectRef}`]);
   expect(result.exitCode).toBe(0);
   expect(result.stdout).toContain("Expected output");
 });
@@ -91,7 +91,7 @@ testBehaviour("exits non-zero on 401", async ({ run, apiUrl }) => {
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ status: 401, body: { message: "Invalid token" } }),
   });
-  const result = await run(["command", "--project-ref", PROJECT_REF]);
+  const result = await run(["command", `--remote=${PROJECT_REF}`]);
   expect(result.exitCode).not.toBe(0);
 });
 ```

apps/cli-e2e/fixtures/scenarios/db-query-linked-returns-json-with-output-json/interactions.json → apps/cli-e2e/fixtures/scenarios/db-query-remote-returns-json-with-output-json/interactions.json

@@ -13,7 +13,8 @@
         "user-agent": "SupabaseCLI/"
       },
       "body": {
-        "query": "SELECT 1"
+        "query": "SELECT 1",
+        "read_only": true
       }
     },
     "response": {

apps/cli-e2e/fixtures/scenarios/db-query-linked-returns-select-1-result-in-table-format/interactions.json → apps/cli-e2e/fixtures/scenarios/db-query-remote-returns-select-1-result-in-table-format/interactions.json

@@ -13,7 +13,8 @@
         "user-agent": "SupabaseCLI/"
       },
       "body": {
-        "query": "SELECT 1"
+        "query": "SELECT 1",
+        "read_only": true
       }
     },
     "response": {

apps/cli-e2e/fixtures/scenarios/remote-target-selection-reads-a-space-separated-remote-ref-as-remote-ref/interactions.json

@@ -0,0 +1,69 @@
+[
+  {
+    "request": {
+      "method": "GET",
+      "path": "/v1/projects/replayfixtureprojref/advisors/security",
+      "query": {},
+      "headers": {
+        "accept-encoding": "gzip",
+        "authorization": "Bearer __ACCESS_TOKEN__",
+        "host": "localhost:__PORT__",
+        "user-agent": "SupabaseCLI/"
+      },
+      "body": null
+    },
+    "response": {
+      "status": 200,
+      "headers": {
+        "content-type": "application/json; charset=utf-8",
+        "x-gotrue-id": "__UUID__",
+        "x-ratelimit-limit": "120",
+        "x-ratelimit-remaining": "119",
+        "x-ratelimit-reset": "60"
+      },
+      "body": {
+        "lints": []
+      }
+    }
+  },
+  {
+    "request": {
+      "method": "GET",
+      "path": "/v1/projects/replayfixtureprojref",
+      "query": {},
+      "headers": {
+        "accept-encoding": "gzip",
+        "authorization": "Bearer __ACCESS_TOKEN__",
+        "host": "localhost:__PORT__",
+        "user-agent": "SupabaseCLI/"
+      },
+      "body": null
+    },
+    "response": {
+      "status": 200,
+      "headers": {
+        "content-type": "application/json; charset=utf-8",
+        "x-gotrue-id": "__UUID__",
+        "x-ratelimit-limit": "120",
+        "x-ratelimit-remaining": "116",
+        "x-ratelimit-reset": "54"
+      },
+      "body": {
+        "id": "replayfixtureprojref",
+        "ref": "replayfixtureprojref",
+        "organization_id": "replayfixtureprojref",
+        "organization_slug": "replayfixtureprojref",
+        "name": "cli-e2e-test",
+        "region": "us-east-1",
+        "status": "ACTIVE_HEALTHY",
+        "database": {
+          "host": "db.replayfixtureprojref.supabase.red",
+          "version": "17.6.1.111",
+          "postgres_engine": "17",
+          "release_channel": "ga"
+        },
+        "created_at": "2000-01-01T00:00:00Z"
+      }
+    }
+  }
+]

apps/cli-e2e/fixtures/scenarios/test-db-exits-non-zero-on-connection-refused-without-remote/interactions.json

@@ -0,0 +1 @@
+[]