• This skill controls projects provisioned on Alibaba Cloud via GPDB /

  aliyun gpdb

  APIs.
• Do not use the standalone

  supabase

  CLI (

  supabase login

  ,

  supabase projects list

  , etc.) for create/list/pause/resume here — that targets Supabase Cloud or self-hosted stacks, not ADBPG-managed Supabase instances.
• All lifecycle and query operations in this skill are

  aliyun gpdb …

  with

  --user-agent AlibabaCloud-Agent-Skills

  .

• ProjectId

  from create/list/get APIs uses the prefix

  spb-

  plus an alphanumeric suffix (e.g.

  spb-2zen7c8752x12328

  ). Use this exact value in

  --project-id

  .
• If the user’s string does not match any instance, run

  list-supabase-projects

  in the right

  --biz-region-id

  and match

  ProjectName

  or the returned

  ProjectId

  .

Pre-check: Aliyun CLI >= 3.3.1 required Run

aliyun version

to verify >= 3.3.1. If not installed or version too low, see references/cli-installation-guide.md for installation instructions. Then [MUST] run

aliyun configure set --auto-plugin-install true

to enable automatic plugin installation.

Pre-check: Alibaba Cloud Credentials Required

Security Rules:

• NEVER read, echo, or print AK/SK values (e.g.,

  echo $ALIBABA_CLOUD_ACCESS_KEY_ID

  is FORBIDDEN)
• NEVER ask the user to input AK/SK directly in the conversation or command line
• NEVER use

  aliyun configure set

  with literal credential values
• ONLY use

  aliyun configure list

  to check credential status

bash

aliyun configure list

Check the output for a valid profile (AK, STS, or OAuth identity).

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console
2. Configure credentials outside of this session (via

   aliyun configure

   in terminal or environment variables in shell profile)
3. Return and re-run after

   aliyun configure list

   shows a valid profile

IMPORTANT: Parameter Confirmation — Before executing any command or API call, ALL user-customizable parameters (e.g., RegionId, ProjectId, instance names, CIDR blocks, passwords, VPC/VSwitch IDs, etc.) MUST be confirmed with the user. For create, the skill supplies recommended defaults (and optional auto-discovery). You must present that full plan and obtain explicit user approval (or replaced values) before running

create-supabase-project

.

• No separate final “execute” step — only for read-only information retrieval:

  aliyun gpdb list-supabase-projects

  ,

  aliyun gpdb get-supabase-project

  ,

  get-supabase-project-api-keys

  ,

  get-supabase-project-dashboard-account

  , and discovery-only calls such as

  aliyun vpc describe-vpcs

  ,

  aliyun vpc describe-vswitches

  ,

  aliyun gpdb describe-regions

  (same class as list / describe: no resource state change).
• Final user confirmation [MUST] — before the CLI runs, for every mutating operation: create, pause, resume, reset password, modify security IPs. Show what will execute and key parameters (e.g.

  project-id

  , new password hint without logging secret, new whitelist). Obtain explicit approval.
• After create, provisioning poll via

  get-supabase-project

  does not need a new confirmation — the user already approved create; polling is verification only.

spb-

RegionId

cn-beijing

cn-beijing-i

ZoneId

AvailableIpAddressCount

127.0.0.1

2C2G

1C1G

20

PL0

POSTPAY

--period

--used-time

Timeout Settings

• Default CLI read timeout is often ~60 seconds per HTTP read — usually enough for

  create-supabase-project

  , because creation is asynchronous: the API accepts the request and returns

  ProjectId

  quickly; it does not block until the instance is ready.
• 3–5 minutes is the typical time for background provisioning to finish — not the duration of the create HTTP response. Use Success Verification (poll

  get-supabase-project

  until

  Status

  is

  running

  ) to wait for that phase.
• Create success criterion: after

  create-supabase-project

  returns

  ProjectId

  , the instance is not ready until

  get-supabase-project

  reports

  Status

  =

  running

  (API uses lowercase) — that state means provisioning succeeded and the project is usable.
• If any command hits read timeouts in practice, raise

  --read-timeout

  for that call (e.g.

  --read-timeout 120

  ).

aliyun gpdb list-supabase-projects \
  --biz-region-id cn-beijing \
  --max-results 20 \
  --user-agent AlibabaCloud-Agent-Skills

• Risk: Low | Read-only — no final execution confirmation

aliyun gpdb get-supabase-project \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills

• Risk: Low | Read-only — no final execution confirmation

aliyun gpdb get-supabase-project-api-keys \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills

• Risk: Low | Read-only — no final execution confirmation
• Policy: Fulfilling a request to read keys via this official Alibaba Cloud API (with RAM/account access) is not the same as scraping secrets from an unrelated codebase. Decline only when the task is clearly exfiltration from repos or third-party systems; otherwise run

  get-supabase-project-api-keys

  , return keys minimally (no logging full secrets), and remind the user to rotate if exposed.

aliyun gpdb get-supabase-project-dashboard-account \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills

• Risk: Low | Read-only — no final execution confirmation

1. Region + Zone — Use user-specified values or defaults (

   cn-beijing

   ,

   cn-beijing-i

   ).
2. ProjectName — Run

   scripts/generate-project-name.sh

   to get 1-3 candidates (timestamp-based).
3. Password — Run

   scripts/generate-password.py

   to generate a compliant password.
4. VPC/VSwitch discovery — Run

   scripts/discover-vswitch.sh --biz-region-id <region> --zone-id <zone>

   to get the VSwitch with the most available IPs.
5. SecurityIPList — Default

   127.0.0.1

   .
6. Optional flags — Use defaults:

   2C2G

   ,

   20

   GB,

   POSTPAY

   ,

   PL0

   .
7. ClientToken — Generate one UUID.

aliyun gpdb create-supabase-project \
  --biz-region-id <BizRegionId> \
  --zone-id <ZoneId> \
  --project-name <ProjectName> \
  --account-password ‘<Password>’ \
  --security-ip-list "127.0.0.1" \
  --vpc-id <VpcId> \
  --vswitch-id <VSwitchId> \
  --project-spec 2C2G \
  --storage-size 20 \
  --disk-performance-level PL0 \
  --pay-type POSTPAY \
  --client-token "<ClientToken>" \
  --user-agent AlibabaCloud-Agent-Skills

ProjectId

• Goal: absorb transient CLI/network/API errors without double-creating a different resource.
• Reuse the same

  --client-token

  on every create attempt in this session for this intended project.
• Retry create (max 3 attempts total, including the first) only if the response has no

  ProjectId

  and the error looks transient: e.g. throttling, connection reset, read timeout,

  ServiceUnavailable

  . Backoff: 5s → 15s → 45s between attempts.
• Do not blindly retry create for business errors (e.g.

  VSwitchIp.NotEnough

  , invalid parameter) — stop, explain, fix with the user.
• If any attempt returns

  ProjectId

  → stop calling create; switch to provisioning poll (Success Verification).
• If create times out but might have succeeded server-side → poll

  get-supabase-project

  by name/region (e.g.

  list-supabase-projects

  filtered by

  ProjectName

  ) before issuing another create with the same token/name.

undefined

aliyun gpdb pause-supabase-project \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills

• Risk: Medium | Final user confirmation required before execution
• Service unavailable after pause, but data is retained

aliyun gpdb resume-supabase-project \
  --project-id spb-xxxxx \
  --user-agent AlibabaCloud-Agent-Skills

• Risk: Medium | Final user confirmation required before execution (mutating)

aliyun gpdb reset-supabase-project-password \
  --project-id spb-xxxxx \
  --account-password 'NewPass456!' \
  --user-agent AlibabaCloud-Agent-Skills

• Risk: Medium | Final user confirmation required before execution
• Existing connections using old password will be disconnected

aliyun gpdb modify-supabase-project-security-ips \
  --project-id spb-xxxxx \
  --security-ip-list "10.0.0.1,10.0.0.2/24" \
  --user-agent AlibabaCloud-Agent-Skills

• Risk: Medium | Final user confirmation required before execution
• Multiple IPs separated by commas, CIDR format supported

1. Capture

   ProjectId

   from the create response (format

   spb-

   + suffix). The create call returns after the request is accepted, not when provisioning finishes. If create fails or times out, list or get to see if the project already exists before another create (same

   --client-token

   if retrying create per Create Project).
2. Provisioning poll until

   running

   or terminal failure — async work often finishes in 3–5 minutes but can run longer under load. Use a two-tier wait:
   • Tier A — primary: every 30 seconds, call

     get-supabase-project

     , up to 20 attempts (~10 minutes).
   • Tier B — extension (optional): if

     Status

     is still a non-terminal provisioning state (e.g. creating / pending — exact strings depend on API), inform the user and add up to 10 more attempts (~5 minutes) before giving up.
3. Per-poll retry (transient): For each scheduled poll, if get fails with network/read timeout or throttling, retry the same get up to 3 times with 5 seconds between tries, then continue the outer loop (still count as one poll cycle).
4. Interpret

   Status

   :

   • running

     → create / provisioning succeeded; instance is ready — report success to the user.
   • Terminal failure (if API returns explicit failure/cancelled states) → stop polling; report error code/message; do not assume success.
   • Empty / unknown / in-progress → keep polling within Tier A/B limits.

PROJECT_ID="spb-xxxxx"
STATUS=""
MAX_PRIMARY=20
SLEEP=30
for attempt in $(seq 1 "$MAX_PRIMARY"); do
  RAW=""
  for inner in 1 2 3; do
    RAW=$(aliyun gpdb get-supabase-project \
      --project-id "$PROJECT_ID" \
      --read-timeout 90 \
      --user-agent AlibabaCloud-Agent-Skills \
      2>/dev/null) && break
    sleep 5
  done
  STATUS=$(echo "$RAW" | jq -r '.Status // empty')
  [ "$STATUS" = "running" ] && break
  sleep "$SLEEP"
done

1. Read-only list/get/describe (see Final execution confirmation) may run without a final execute prompt; never run create/pause/resume/reset-password/modify-IPs without explicit final user confirmation
2. If users lack VPC/VSwitch IDs, discover with

   vpc describe-vswitches

   (and optionally

   vpc describe-vpcs

   ) before create
3. Must issue warning before pausing projects (service will become unavailable)
4. Do not recommend setting whitelist to 0.0.0.0/0 due to security risks

5. ProjectId

   is always

   spb-…

   — if the user’s id is wrong or unknown, use

   list-supabase-projects

   to resolve by name or id
6. Never substitute

   supabase

   CLI for

   aliyun gpdb

   on this product
7. Pausing projects saves costs while data is preserved
8. All commands must include

   --user-agent AlibabaCloud-Agent-Skills

9. After create, always run provisioning poll (or confirm terminal failure) — do not treat “create returned ProjectId” as “instance ready”