Document full manifest in deploy help — rls, secrets, functions, not just name/migrations/files/subdomain

MajorTal · claude · MajorTal · commit 99afc2dd48c3 · 2026-03-17T13:37:31.000+01:00
Co-Authored-By: Claude Opus 4.6 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/cli/lib/deploy.mjs b/cli/lib/deploy.mjs
@@ -14,11 +14,30 @@ Options:
 Manifest format (JSON):
   {
     "name": "my-app",
-    "migrations": "CREATE TABLE items ...",
+    "migrations": "CREATE TABLE items (id serial PRIMARY KEY, title text NOT NULL, done boolean DEFAULT false)",
+    "rls": {
+      "template": "public_read_write",
+      "tables": [{ "table": "items" }]
+    },
+    "secrets": [{ "key": "OPENAI_API_KEY", "value": "sk-..." }],
+    "functions": [{
+      "name": "my-fn",
+      "code": "export default async (req) => new Response('ok')"
+    }],
     "files": [{ "file": "index.html", "data": "<html>...</html>" }],
     "subdomain": "my-app"
   }
 
+  All fields except "name" are optional.
+
+  RLS templates:
+    user_owns_rows   — users see only their rows (requires owner_column per table)
+    public_read      — anyone reads, authenticated users write
+    public_read_write — anyone reads and writes
+
+  ⚠️  Without RLS, tables are read-only via anon_key. If your app writes
+  data from the browser, you almost certainly need an rls block.
+
 Examples:
   run402 deploy --manifest app.json
   cat app.json | run402 deploy
