@hot-updater/supabase 0.35.7 → 0.35.9

package/dist/iac/index.mjs

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 import fs from "fs/promises";
 import path from "path";
-import { ConfigBuilder, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, link, makeEnv, p, resolvePackageVersion, transformEnv, transformTemplate, writeHotUpdaterConfig } from "@hot-updater/cli-tools";
+import { ConfigBuilder, InitError, MissingInitInputsError, assertInitInputs, assertInitProviderInputs, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, readHotUpdaterInitEnv, resolveInitProviderInput, resolvePackageVersion, transformEnv, transformTemplate, writeHotUpdaterConfig } from "@hot-updater/cli-tools";
 import { fileURLToPath } from "node:url";
 import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
@@ -6271,6 +6271,112 @@ createExeca(mapNode);
 createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 const { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
+//#region iac/init/index.ts
+const SUPABASE_DATABASE_PASSWORD_PROJECT_ID_ENV_KEY = "HOT_UPDATER_SUPABASE_DB_PASSWORD_PROJECT_ID";
+const SUPABASE_REGION_VALUES = [
+	"ap-east-1",
+	"ap-northeast-1",
+	"ap-northeast-2",
+	"ap-south-1",
+	"ap-southeast-1",
+	"ap-southeast-2",
+	"ca-central-1",
+	"eu-central-1",
+	"eu-central-2",
+	"eu-north-1",
+	"eu-west-1",
+	"eu-west-2",
+	"eu-west-3",
+	"sa-east-1",
+	"us-east-1",
+	"us-east-2",
+	"us-west-1",
+	"us-west-2"
+];
+const isSupabaseRegion = (value) => value !== void 0 && SUPABASE_REGION_VALUES.some((region) => region === value);
+const isSupabaseFunctionName = (value) => value !== void 0 && /^[A-Za-z][A-Za-z0-9_-]*$/.test(value);
+const initProvider = {
+	label: "Supabase",
+	inputs: {
+		projectId: {
+			envKey: "HOT_UPDATER_SUPABASE_PROJECT_ID",
+			help: "Supabase project reference"
+		},
+		projectName: {
+			envKey: "HOT_UPDATER_SUPABASE_PROJECT_NAME",
+			help: "Project name used when creating a Supabase project",
+			optional: true,
+			prompt: {
+				defaultValue: "hot-updater",
+				message: "Enter a name for the new Supabase project",
+				placeholder: "hot-updater",
+				type: "text"
+			}
+		},
+		organizationSlug: {
+			envKey: "HOT_UPDATER_SUPABASE_ORGANIZATION_SLUG",
+			help: "Organization slug used when creating a Supabase project",
+			optional: true,
+			prompt: {
+				message: "Select a Supabase organization",
+				type: "select"
+			}
+		},
+		region: {
+			envKey: "HOT_UPDATER_SUPABASE_REGION",
+			help: "Region used when creating a Supabase project",
+			optional: true,
+			prompt: {
+				defaultValue: "us-east-1",
+				message: "Select a region for the new Supabase project",
+				type: "select"
+			},
+			validate: isSupabaseRegion
+		},
+		accessToken: {
+			envKey: "SUPABASE_ACCESS_TOKEN",
+			help: "Supabase personal access token",
+			persistence: "with-consent",
+			preflight: false,
+			prompt: {
+				message: "Enter your Supabase personal access token",
+				type: "password"
+			}
+		},
+		bucketName: {
+			envKey: "HOT_UPDATER_SUPABASE_BUCKET_NAME",
+			help: "Storage bucket name",
+			prompt: {
+				defaultValue: "hot-updater-storage",
+				message: "Enter a name for the new storage bucket",
+				placeholder: "hot-updater-storage",
+				type: "text"
+			}
+		},
+		functionName: {
+			envKey: "HOT_UPDATER_SUPABASE_FUNCTION_NAME",
+			help: "Edge Function name",
+			prompt: {
+				defaultValue: "update-server",
+				message: "Enter a name for the edge function",
+				placeholder: "update-server",
+				type: "text"
+			},
+			validate: isSupabaseFunctionName
+		},
+		databasePassword: {
+			envKey: "HOT_UPDATER_SUPABASE_DB_PASSWORD",
+			help: "Database password, when required by the linked project",
+			optional: true,
+			persistence: "with-consent",
+			prompt: {
+				message: "Enter your Supabase database password (press Enter to skip if none)",
+				type: "password"
+			}
+		}
+	}
+};
+//#endregion
 //#region iac/supabaseApi.ts
 const supabaseApi = (supabaseUrl, supabaseServiceRoleKey) => {
 	const supabase = createClient(supabaseUrl, supabaseServiceRoleKey);
@@ -6289,10 +6395,121 @@ const supabaseApi = (supabaseUrl, supabaseServiceRoleKey) => {
 			const { data, error } = await supabase.storage.createBucket(bucketName, options);
 			if (error) throw error;
 			return data;
+		},
+		updateBucket: async (bucketId, options) => {
+			const { error } = await supabase.storage.updateBucket(bucketId, options);
+			if (error) throw error;
 		}
 	};
 };
 //#endregion
+//#region iac/supabaseAuthentication.ts
+const SUPABASE_AUTH_METHOD = {
+	accessToken: "access-token",
+	cliLogin: "cli-login"
+};
+const SUPABASE_LOGIN_URL_PATTERN = /https:\/\/supabase\.com\/dashboard\/cli\/login\?[A-Za-z0-9._~!$&'()*+,;=:@/?%-]+/;
+const openBrowser = async (url) => {
+	if (process.platform === "darwin") {
+		await execa("open", [url]);
+		return;
+	}
+	if (process.platform === "win32") {
+		await execa("rundll32.exe", ["url.dll,FileProtocolHandler", url]);
+		return;
+	}
+	await execa("xdg-open", [url]);
+};
+const hasValidSupabaseCliLogin = async () => {
+	return (await execa("npx", [
+		"-y",
+		"supabase",
+		"projects",
+		"list",
+		"--output",
+		"json",
+		"--agent",
+		"no"
+	], { reject: false })).exitCode === 0;
+};
+const getSupabaseCliEnv = (accessToken) => accessToken ? { [initProvider.inputs.accessToken.envKey]: accessToken } : void 0;
+const inputSupabaseAccessToken = async (accessToken) => {
+	if (accessToken) return accessToken;
+	const authMethod = await p.select({
+		message: "How do you want to authenticate with Supabase?",
+		options: [{
+			label: "Use Supabase CLI login",
+			value: SUPABASE_AUTH_METHOD.cliLogin
+		}, {
+			label: "Enter a personal access token",
+			value: SUPABASE_AUTH_METHOD.accessToken
+		}]
+	});
+	if (p.isCancel(authMethod)) process.exit(0);
+	if (authMethod === SUPABASE_AUTH_METHOD.cliLogin) {
+		if (await hasValidSupabaseCliLogin()) return;
+		const loginProcess = execa("npx", [
+			"-y",
+			"supabase",
+			"login",
+			"--no-browser",
+			"--agent",
+			"no"
+		], {
+			stdin: "inherit",
+			stderr: "inherit",
+			stdout: "pipe"
+		});
+		let output = "";
+		let browserOpenPromise;
+		loginProcess.stdout?.on("data", (chunk) => {
+			process.stdout.write(chunk);
+			output += chunk.toString();
+			const loginUrl = output.match(SUPABASE_LOGIN_URL_PATTERN)?.[0];
+			if (loginUrl && !browserOpenPromise) browserOpenPromise = openBrowser(loginUrl).catch(() => {
+				p.log.warn("Could not open the Supabase login page automatically.");
+			});
+		});
+		await loginProcess;
+		await browserOpenPromise;
+		return;
+	}
+	p.log.step(`Personal access token: ${link("https://supabase.com/dashboard/account/tokens")}`);
+	const selectedAccessToken = await p.password({
+		message: "Enter your Supabase personal access token",
+		validate: (value) => value ? void 0 : "Supabase access token is required"
+	});
+	if (p.isCancel(selectedAccessToken)) process.exit(0);
+	return selectedAccessToken;
+};
+//#endregion
+//#region iac/supabaseBucketPrivacy.ts
+var PublicSupabaseBucketError = class extends InitError {
+	name = "PublicSupabaseBucketError";
+	constructor(bucketName) {
+		super([
+			`Supabase bucket "${bucketName}" is public.`,
+			"Make the bucket private in Supabase Storage, then rerun init.",
+			"Alternatively, rerun without --env-file to approve the change interactively."
+		].join("\n"));
+		this.bucketName = bucketName;
+	}
+};
+const ensureSupabaseBucketPrivate = async ({ api, nonInteractive, selection }) => {
+	if (selection.create || !selection.isPublic) return;
+	if (nonInteractive) throw new PublicSupabaseBucketError(selection.name);
+	const confirmed = await p.confirm({
+		message: `Bucket "${selection.name}" is public. Make it private?`,
+		initialValue: true
+	});
+	if (p.isCancel(confirmed) || !confirmed) {
+		p.log.info("Init cancelled.");
+		process.exit(1);
+	}
+	await api.updateBucket(selection.id, { public: false });
+	p.log.success(`Bucket "${selection.name}" is now private.`);
+};
+//#endregion
 //#region iac/supabaseCli.ts
 const SUPABASE_CONFIG_TEMPLATE = `
 project_id = "%%projectId%%"
@@ -6307,6 +6524,10 @@ const SUPABASE_DATABASE_AUTH_ERROR_PATTERNS = [
 	/SQLSTATE 28P01/i,
 	/invalid SCRAM server-final-message/i
 ];
+const getSupabaseCommandEnv = (accessToken, dbPassword) => accessToken || dbPassword ? {
+	...getSupabaseCliEnv(accessToken),
+	...dbPassword ? { SUPABASE_DB_PASSWORD: dbPassword } : {}
+} : void 0;
 const isSupabaseDatabaseAuthError = (err) => {
 	const stderr = err.stderr;
 	return typeof stderr === "string" && SUPABASE_DATABASE_AUTH_ERROR_PATTERNS.some((pattern) => pattern.test(stderr));
@@ -6314,11 +6535,18 @@ const isSupabaseDatabaseAuthError = (err) => {
 const handleSupabaseDatabaseCommandError = (err, { dbPassword, stderrInherited = false }) => {
 	if (err instanceof ExecaError) if (dbPassword && isSupabaseDatabaseAuthError(err)) p.log.error(SUPABASE_DATABASE_CONNECTION_ERROR);
 	else if (!stderrInherited && err.stderr) p.log.error(err.stderr);
-	else console.error(err);
+	else p.log.error(err.message);
 	else console.error(err);
 	process.exit(1);
 };
-const linkSupabase = async (workdir, { projectId, dbPassword }) => {
+const confirmSupabaseDatabaseMigrations = async ({ nonInteractive }) => {
+	if (nonInteractive) return true;
+	return await p.confirm({
+		message: "Apply Hot Updater database migrations to the selected Supabase project?",
+		initialValue: true
+	}) === true;
+};
+const linkSupabase = async (workdir, { accessToken, projectId, dbPassword }) => {
 	const spinner = p.spinner();
 	try {
 		await fs.writeFile(path.join(workdir, "supabase", "config.toml"), transformTemplate(SUPABASE_CONFIG_TEMPLATE, { projectId }));
@@ -6332,7 +6560,7 @@ const linkSupabase = async (workdir, { projectId, dbPassword }) => {
 			workdir
 		], {
 			cwd: workdir,
-			env: dbPassword ? { SUPABASE_DB_PASSWORD: dbPassword } : void 0,
+			env: getSupabaseCommandEnv(accessToken, dbPassword),
 			input: "",
 			stdio: [
 				"pipe",
@@ -6343,19 +6571,20 @@ const linkSupabase = async (workdir, { projectId, dbPassword }) => {
 		spinner.stop("Supabase linked ✔");
 	} catch (err) {
 		spinner.stop();
-		handleSupabaseDatabaseCommandError(err, { dbPassword });
+		handleSupabaseDatabaseCommandError(err instanceof Error ? err : new Error(String(err)), { dbPassword });
 	}
 };
-const pushDB = async (workdir, { dbPassword }) => {
+const pushDB = async (workdir, { accessToken, dbPassword }) => {
 	try {
 		const dbPush = await execa("npx", [
 			"supabase",
 			"db",
 			"push",
-			"--include-all"
+			"--include-all",
+			"--yes"
 		], {
 			cwd: workdir,
-			env: dbPassword ? { SUPABASE_DB_PASSWORD: dbPassword } : void 0,
+			env: getSupabaseCommandEnv(accessToken, dbPassword),
 			stderr: ["pipe", "inherit"],
 			stdin: "inherit",
 			stdout: "inherit"
@@ -6363,17 +6592,273 @@ const pushDB = async (workdir, { dbPassword }) => {
 		p.log.success("DB pushed ✔");
 		return dbPush.stdout;
 	} catch (err) {
-		handleSupabaseDatabaseCommandError(err, {
+		handleSupabaseDatabaseCommandError(err instanceof Error ? err : new Error(String(err)), {
 			dbPassword,
 			stderrInherited: true
 		});
 	}
 };
 //#endregion
+//#region iac/supabaseDeploymentInputs.ts
+const assertSupabaseNonInteractiveInputs = async (inputs, nonInteractive, validateCliLogin = hasValidSupabaseCliLogin) => {
+	assertInitProviderInputs({
+		inputs: nonInteractive && inputs.accessToken === void 0 && await validateCliLogin() ? {
+			...inputs,
+			accessToken: "supabase-cli-login"
+		} : inputs,
+		provider: initProvider,
+		strict: nonInteractive
+	});
+};
+const inputSupabaseDeploymentInputs = async ({ accessToken, functionName, nonInteractive }) => {
+	const { inputs } = initProvider;
+	assertInitInputs({
+		inputs: { [inputs.functionName.envKey]: functionName },
+		strict: nonInteractive
+	});
+	if (nonInteractive && functionName) return {
+		accessToken,
+		functionName
+	};
+	const savedFunctionName = isSupabaseFunctionName(functionName) ? functionName : void 0;
+	return p.group({
+		accessToken: () => nonInteractive && accessToken ? Promise.resolve(accessToken) : inputSupabaseAccessToken(),
+		functionName: () => nonInteractive && savedFunctionName ? Promise.resolve(savedFunctionName) : p.text({
+			...getInitProviderTextPromptValues(inputs.functionName.prompt, savedFunctionName),
+			message: inputs.functionName.prompt.message,
+			validate: (value) => isSupabaseFunctionName(value) ? void 0 : "Start with a letter and use only letters, numbers, underscores, or hyphens"
+		})
+	}, { onCancel: () => process.exit(0) });
+};
+//#endregion
+//#region iac/supabaseInitInputs.ts
+const resolveSupabaseInitInputs = (existingEnv, sources = {}) => {
+	const { inputs } = initProvider;
+	const managedEnv = sources.managedEnv ?? existingEnv;
+	const projectId = resolveInitProviderInput(existingEnv, inputs.projectId) ?? getHotUpdaterEnvValue(existingEnv, "HOT_UPDATER_SUPABASE_URL")?.match(/^https:\/\/([^.]+)\.supabase\.co/)?.[1];
+	const databasePasswordKey = inputs.databasePassword.envKey;
+	const hasProcessDatabasePassword = process.env[databasePasswordKey] !== void 0;
+	const hasInputDatabasePassword = sources.inputEnv !== void 0 && Object.hasOwn(sources.inputEnv, databasePasswordKey);
+	const managedDatabasePasswordProjectId = managedEnv[SUPABASE_DATABASE_PASSWORD_PROJECT_ID_ENV_KEY]?.trim();
+	const region = resolveInitProviderInput(existingEnv, inputs.region);
+	const databasePassword = hasProcessDatabasePassword ? process.env[databasePasswordKey]?.trim() || void 0 : hasInputDatabasePassword ? sources.inputEnv?.[databasePasswordKey]?.trim() || void 0 : managedDatabasePasswordProjectId === projectId ? managedEnv[databasePasswordKey]?.trim() || void 0 : void 0;
+	return {
+		accessToken: resolveInitProviderInput(existingEnv, inputs.accessToken),
+		bucketName: resolveInitProviderInput(existingEnv, inputs.bucketName),
+		databasePassword,
+		functionName: resolveInitProviderInput(existingEnv, inputs.functionName),
+		organizationSlug: resolveInitProviderInput(existingEnv, inputs.organizationSlug),
+		projectId,
+		projectName: resolveInitProviderInput(existingEnv, inputs.projectName),
+		region: isSupabaseRegion(region) ? region : void 0
+	};
+};
+const inputSupabaseDatabasePassword = async ({ cliHandlesPrompt = false, databasePassword, nonInteractive, required = false }) => {
+	if (cliHandlesPrompt) return "";
+	if (nonInteractive) {
+		if (required && !databasePassword) throw new MissingInitInputsError([initProvider.inputs.databasePassword.envKey]);
+		return databasePassword ?? "";
+	}
+	const password = await p.password({
+		message: initProvider.inputs.databasePassword.prompt.message,
+		validate: (value) => required && !value ? "A database password is required to create a Supabase project" : void 0
+	});
+	if (p.isCancel(password)) process.exit(0);
+	return password;
+};
+const inputSupabaseProjectCreationInputs = async ({ bucketName, organizationSlug, organizations, projectName, region }) => {
+	if (organizations.length === 0) throw new Error("No Supabase organization is available for project creation.");
+	const savedOrganization = organizations.find((organization) => organization.slug === organizationSlug);
+	if (organizationSlug && !savedOrganization) p.log.warn("Saved Supabase organization was not found. Select an organization again.");
+	const defaultRegion = initProvider.inputs.region.prompt.defaultValue;
+	const selectedProjectName = await p.text({
+		...getInitProviderTextPromptValues(initProvider.inputs.projectName.prompt, projectName),
+		message: initProvider.inputs.projectName.prompt.message,
+		validate: (value) => value ? void 0 : "Supabase project name is required"
+	});
+	if (p.isCancel(selectedProjectName)) process.exit(0);
+	const selectedOrganizationSlug = await p.select({
+		initialValue: savedOrganization?.slug ?? organizations[0]?.slug,
+		message: initProvider.inputs.organizationSlug.prompt.message,
+		options: organizations.map((organization) => ({
+			label: organization.name,
+			value: organization.slug
+		}))
+	});
+	if (p.isCancel(selectedOrganizationSlug)) process.exit(0);
+	const selectedRegion = await p.select({
+		message: initProvider.inputs.region.prompt.message,
+		initialValue: region ?? (isSupabaseRegion(defaultRegion) ? defaultRegion : void 0),
+		options: SUPABASE_REGION_VALUES.map((value) => ({
+			label: value,
+			value
+		}))
+	});
+	if (p.isCancel(selectedRegion)) process.exit(0);
+	const selectedBucketName = await p.text({
+		...getInitProviderTextPromptValues(initProvider.inputs.bucketName.prompt, bucketName),
+		message: initProvider.inputs.bucketName.prompt.message,
+		validate: (value) => value ? void 0 : "Storage bucket name is required"
+	});
+	if (p.isCancel(selectedBucketName)) process.exit(0);
+	return {
+		bucketName: selectedBucketName,
+		organizationSlug: selectedOrganizationSlug,
+		projectName: selectedProjectName,
+		region: selectedRegion
+	};
+};
+//#endregion
+//#region iac/supabaseCliManagementApi.ts
+var SupabaseCliResponseError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SupabaseCliResponseError";
+	}
+};
+const isRecord$1 = (value) => typeof value === "object" && value !== null;
+const runSupabaseCli = async (args) => {
+	const result = await execa("npx", [
+		"-y",
+		"supabase",
+		...args
+	], { env: void 0 });
+	return JSON.parse(result.stdout);
+};
+const supabaseCliManagementApi = () => ({
+	listOrganizations: async () => {
+		const body = await runSupabaseCli([
+			"orgs",
+			"list",
+			"--output",
+			"json"
+		]);
+		if (!Array.isArray(body)) throw new SupabaseCliResponseError("Supabase organizations response was invalid.");
+		return body.flatMap((organization) => isRecord$1(organization) && typeof organization.id === "string" && typeof organization.name === "string" && typeof organization.slug === "string" ? [{
+			id: organization.id,
+			name: organization.name,
+			slug: organization.slug
+		}] : []);
+	},
+	createProject: async ({ name, organizationSlug, region }) => {
+		await execa("npx", [
+			"-y",
+			"supabase",
+			"projects",
+			"create",
+			name,
+			"--org-id",
+			organizationSlug,
+			"--region",
+			region,
+			"--agent",
+			"no"
+		], { stdio: "inherit" });
+		const body = await runSupabaseCli([
+			"projects",
+			"list",
+			"--output",
+			"json"
+		]);
+		if (!Array.isArray(body)) throw new SupabaseCliResponseError("Supabase projects response was invalid after project creation.");
+		const project = body.find((candidate) => isRecord$1(candidate) && candidate.name === name && candidate.organization_slug === organizationSlug && candidate.region === region);
+		if (!isRecord$1(project) || typeof project.id !== "string" || typeof project.name !== "string" || typeof project.region !== "string") throw new SupabaseCliResponseError("Created Supabase project was not found.");
+		return {
+			id: project.id,
+			name: project.name,
+			region: project.region
+		};
+	},
+	getProjectStatus: async (projectId) => {
+		const body = await runSupabaseCli([
+			"projects",
+			"list",
+			"--output",
+			"json"
+		]);
+		if (!Array.isArray(body)) throw new SupabaseCliResponseError("Supabase projects response was invalid.");
+		const project = body.find((candidate) => isRecord$1(candidate) && (candidate.id === projectId || candidate.ref === projectId));
+		if (!isRecord$1(project) || typeof project.status !== "string") throw new SupabaseCliResponseError("Supabase project status was not found.");
+		return project.status;
+	}
+});
+//#endregion
+//#region iac/supabaseManagementApi.ts
+const SUPABASE_MANAGEMENT_API_URL = "https://api.supabase.com/v1";
+const SUPABASE_MANAGEMENT_API_TIMEOUT_MS = 3e4;
+const isRecord = (value) => typeof value === "object" && value !== null;
+var SupabaseManagementApiStatusError = class extends Error {};
+const projectCreationMayHaveSucceededError = (message = "Supabase project creation could not be confirmed.", cause) => new Error(`${message} The request may have succeeded; check the organization's projects before retrying init.`, { cause });
+const request = async (accessToken, path, init) => {
+	const method = init?.method ?? "GET";
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), SUPABASE_MANAGEMENT_API_TIMEOUT_MS);
+	timeout.unref();
+	try {
+		const response = await fetch(`${SUPABASE_MANAGEMENT_API_URL}${path}`, {
+			body: init?.body ? JSON.stringify(init.body) : void 0,
+			headers: {
+				Authorization: `Bearer ${accessToken}`,
+				"Content-Type": "application/json"
+			},
+			method,
+			signal: controller.signal
+		});
+		if (!response.ok) throw new SupabaseManagementApiStatusError(`Supabase Management API request failed with status ${response.status}.`);
+		return await response.json();
+	} catch (error) {
+		if (!controller.signal.aborted) {
+			if (method === "POST" && !(error instanceof SupabaseManagementApiStatusError)) throw projectCreationMayHaveSucceededError(void 0, error);
+			throw error;
+		}
+		if (method === "POST") throw projectCreationMayHaveSucceededError("Supabase project creation timed out.", error);
+		throw new Error("Supabase Management API request timed out.");
+	} finally {
+		clearTimeout(timeout);
+	}
+};
+const supabaseManagementApi = (accessToken) => accessToken === void 0 ? supabaseCliManagementApi() : {
+	listOrganizations: async () => {
+		const body = await request(accessToken, "/organizations");
+		if (!Array.isArray(body)) throw new Error("Supabase organizations response was invalid.");
+		return body.flatMap((organization) => isRecord(organization) && typeof organization.id === "string" && typeof organization.name === "string" && typeof organization.slug === "string" ? [{
+			id: organization.id,
+			name: organization.name,
+			slug: organization.slug
+		}] : []);
+	},
+	createProject: async ({ databasePassword, name, organizationSlug, region }) => {
+		const body = await request(accessToken, "/projects", {
+			body: {
+				db_pass: databasePassword,
+				name,
+				organization_slug: organizationSlug,
+				region
+			},
+			method: "POST"
+		});
+		if (!isRecord(body) || typeof body.ref !== "string" || typeof body.name !== "string" || typeof body.region !== "string") throw projectCreationMayHaveSucceededError("Supabase project creation response was invalid.");
+		return {
+			id: body.ref,
+			name: body.name,
+			region: body.region
+		};
+	},
+	getProjectStatus: async (projectId) => {
+		const body = await request(accessToken, `/projects/${encodeURIComponent(projectId)}`);
+		if (!isRecord(body) || typeof body.status !== "string") throw new Error("Supabase project response was invalid.");
+		return body.status;
+	}
+};
+//#endregion
 //#region iac/index.ts
 const require$1 = createRequire(import.meta.url);
 const EDGE_VENDOR_DIR = "_hot-updater";
 const WORKSPACE_PACKAGE_PREFIX = "@hot-updater/";
+const SUPABASE_PROJECT_READY_STATUS = "ACTIVE_HEALTHY";
+const SUPABASE_PROJECT_PROVISIONING_STATUS = "COMING_UP";
+const SUPABASE_PROJECT_READINESS_MAX_ATTEMPTS = 300;
+const SUPABASE_PROJECT_READINESS_POLL_INTERVAL_MS = 1e3;
 const STATIC_IMPORT_SPECIFIER_PATTERN = /^\s*(?:import|export)\s+(?:type\s+)?(?:[^"'`]+?\s+from\s+)?["']([^"']+)["'];?/gm;
 const DYNAMIC_IMPORT_SPECIFIER_PATTERN = /\bimport\s*\(\s*["']([^"']+)["']\s*\)/g;
 const getConfigScaffold = (build) => {
@@ -6551,7 +7036,7 @@ const buildEdgeFunctionImports = async (targetDir) => {
 const resolveEdgeFunctionDenoConfig = async (targetDir) => {
 	return { imports: await buildEdgeFunctionImports(targetDir) };
 };
-const selectProject = async () => {
+const selectProject = async (preferredProjectId, nonInteractive = false, accessToken) => {
 	const spinner = p.spinner();
 	spinner.start("Fetching Supabase projects...");
 	let projectsProcess = [];
@@ -6563,16 +7048,28 @@ const selectProject = async () => {
 			"list",
 			"--output",
 			"json"
-		], {});
+		], { env: accessToken ? { [initProvider.inputs.accessToken.envKey]: accessToken } : void 0 });
 		projectsProcess = listProjects.stdout === "null" ? [] : JSON.parse(listProjects?.stdout ?? "[]");
 	} catch (err) {
 		spinner.stop();
-		console.error("Failed to fetch Supabase projects:", err);
+		const message = err instanceof Error ? err.message : String(err);
+		console.error(`Failed to fetch Supabase projects: ${message}`);
 		process.exit(1);
 	}
 	spinner.stop();
+	const preferredProject = projectsProcess.find((project) => project.id === preferredProjectId);
+	if (nonInteractive && preferredProject) {
+		p.log.info(`Using saved Supabase project: ${preferredProject.name}`);
+		return {
+			create: false,
+			project: preferredProject
+		};
+	}
+	if (preferredProjectId && !preferredProject) p.log.warn("Saved Supabase project was not found. Select a project again.");
+	if (nonInteractive) throw new MissingInitInputsError(["HOT_UPDATER_SUPABASE_PROJECT_ID"]);
 	const createProjectOption = `create/${Math.random().toString(36).substring(2, 15)}`;
 	const selectedProjectId = await p.select({
+		initialValue: preferredProject?.id ?? projectsProcess[0]?.id,
 		message: "Select a Supabase project",
 		options: [...projectsProcess.map((project) => ({
 			label: `${project.name} (${project.region})`,
@@ -6583,29 +7080,15 @@ const selectProject = async () => {
 		}]
 	});
 	if (p.isCancel(selectedProjectId)) process.exit(0);
-	if (selectedProjectId === createProjectOption) {
-		try {
-			await execa("npx", [
-				"-y",
-				"supabase",
-				"projects",
-				"create"
-			], {
-				stdio: "inherit",
-				shell: true
-			});
-		} catch (err) {
-			if (err instanceof ExecaError) console.error(err.stderr);
-			else console.error(err);
-			process.exit(1);
-		}
-		return selectProject();
-	}
+	if (selectedProjectId === createProjectOption) return { create: true };
 	const selectedProject = projectsProcess.find((project) => project.id === selectedProjectId);
 	if (!selectedProject) throw new Error("Project not found");
-	return selectedProject;
+	return {
+		create: false,
+		project: selectedProject
+	};
 };
-const selectBucket = async (api) => {
+const selectBucket = async (api, preferredBucketName, nonInteractive = false) => {
 	let buckets = [];
 	let retryCount = 0;
 	await p.tasks([{
@@ -6623,15 +7106,31 @@ const selectBucket = async (api) => {
 			process.exit(1);
 		}
 	}]);
+	const preferredBucket = buckets.find((bucket) => bucket.name === preferredBucketName);
+	if (nonInteractive && preferredBucket) {
+		p.log.info(`Using saved Supabase bucket: ${preferredBucket.name}`);
+		return {
+			create: false,
+			id: preferredBucket.id,
+			isPublic: preferredBucket.isPublic,
+			name: preferredBucket.name
+		};
+	}
+	if (preferredBucketName && !preferredBucket) {
+		if (nonInteractive) return {
+			create: true,
+			name: preferredBucketName
+		};
+		p.log.warn("Saved Supabase bucket was not found. Select a bucket again.");
+	}
+	if (nonInteractive) throw new MissingInitInputsError(["HOT_UPDATER_SUPABASE_BUCKET_NAME"]);
 	const createBucketOption = `create/${Math.random().toString(36).substring(2, 15)}`;
 	const selectedBucketId = await p.select({
+		initialValue: preferredBucket?.id ?? buckets[0]?.id,
 		message: "Select a storage bucket",
 		options: [...buckets.map((bucket) => ({
 			label: bucket.name,
-			value: JSON.stringify({
-				id: bucket.id,
-				name: bucket.name
-			})
+			value: bucket.id
 		})), {
 			label: "Create a new private bucket",
 			value: createBucketOption
@@ -6639,34 +7138,44 @@ const selectBucket = async (api) => {
 	});
 	if (p.isCancel(selectedBucketId)) process.exit(0);
 	if (selectedBucketId === createBucketOption) {
-		const bucketName = await p.text({ message: "Enter a name for the new bucket" });
+		const prompt = initProvider.inputs.bucketName.prompt;
+		const bucketName = await p.text({
+			...getInitProviderTextPromptValues(prompt, preferredBucketName),
+			message: prompt.message
+		});
 		if (p.isCancel(bucketName)) process.exit(0);
-		try {
-			await api.createBucket(bucketName, { public: false });
-			p.log.success(`Bucket "${bucketName}" created successfully.`);
-			const newBucket = (await api.listBuckets()).find((bucket) => bucket.name === bucketName);
-			if (!newBucket) throw new Error("Failed to create and select new bucket");
-			return {
-				id: newBucket.id,
-				name: newBucket.name
-			};
-		} catch (err) {
-			p.log.error(`Failed to create new bucket: ${err}`);
-			process.exit(1);
-		}
+		return {
+			create: true,
+			name: bucketName
+		};
 	}
-	return JSON.parse(selectedBucketId);
+	const selectedBucket = buckets.find((bucket) => bucket.id === selectedBucketId);
+	if (!selectedBucket) throw new Error("Selected Supabase bucket was not found.");
+	return {
+		create: false,
+		id: selectedBucket.id,
+		isPublic: selectedBucket.isPublic,
+		name: selectedBucket.name
+	};
 };
-const deployEdgeFunction = async (workdir, projectId) => {
-	const functionName = await p.text({
-		message: "Enter a name for the edge function",
-		initialValue: "update-server",
-		placeholder: "update-server"
-	});
-	if (p.isCancel(functionName)) process.exit(0);
+const createSelectedBucket = async (api, selection) => {
+	if (!selection.create) return selection;
+	await api.createBucket(selection.name, { public: false });
+	p.log.success(`Bucket "${selection.name}" created successfully.`);
+	const bucket = (await api.listBuckets()).find((item) => item.name === selection.name);
+	if (!bucket) throw new Error("Failed to create and select new bucket");
+	return {
+		id: bucket.id,
+		name: bucket.name
+	};
+};
+const deployEdgeFunction = async (accessToken, workdir, projectId, functionName) => {
 	const edgeFunctionsLibPath = path.join(workdir, "supabase", "edge-functions");
 	const edgeFunctionsCode = transformEnv(path.join(edgeFunctionsLibPath, "index.ts"), { FUNCTION_NAME: functionName });
-	const targetDir = path.join(workdir, "supabase", "functions", functionName);
+	if (!isSupabaseFunctionName(functionName)) throw new Error("Invalid Supabase Edge Function name.");
+	const functionsDir = path.resolve(workdir, "supabase", "functions");
+	const targetDir = path.resolve(functionsDir, functionName);
+	if (!targetDir.startsWith(`${functionsDir}${path.sep}`)) throw new Error("Supabase Edge Function path escaped its output directory.");
 	await fs.mkdir(targetDir, { recursive: true });
 	const denoConfig = await resolveEdgeFunctionDenoConfig(targetDir);
 	const targetPath = path.join(targetDir, "index.ts");
@@ -6686,21 +7195,31 @@ const deployEdgeFunction = async (workdir, projectId) => {
 					"--no-verify-jwt",
 					"--workdir",
 					workdir
-				], { cwd: workdir })).stdout;
+				], {
+					cwd: workdir,
+					env: getSupabaseCliEnv(accessToken)
+				})).stdout;
 			} catch (err) {
 				if (err instanceof ExecaError && err.stderr) p.log.error(err.stderr);
-				else console.error(err);
+				else if (err instanceof Error) p.log.error(err.message);
 				process.exit(1);
 			}
 		}
 	}]);
 };
-const runInit = async ({ build }) => {
-	const project = await selectProject();
-	const spinner = p.spinner();
-	spinner.start(`Getting API keys for ${project.name}...`);
-	let apiKeys = [];
-	try {
+const waitForSupabaseProjectReady = async ({ getProjectStatus, maxAttempts = SUPABASE_PROJECT_READINESS_MAX_ATTEMPTS, onLongWait, pollIntervalMs = SUPABASE_PROJECT_READINESS_POLL_INTERVAL_MS }) => {
+	let lastStatus;
+	for (let attempt = 0; attempt < maxAttempts; attempt++) {
+		lastStatus = await getProjectStatus();
+		if (lastStatus === SUPABASE_PROJECT_READY_STATUS) return;
+		if (lastStatus !== SUPABASE_PROJECT_PROVISIONING_STATUS) throw new Error(`Supabase project entered unexpected status: ${lastStatus}.`);
+		if (attempt === 5) onLongWait();
+		if (attempt < maxAttempts - 1) await delay(pollIntervalMs);
+	}
+	throw new Error(`Timed out while waiting for the Supabase project. Last status: ${lastStatus ?? "unknown"}.`);
+};
+const getSupabaseProjectAccess = async ({ accessToken, managementApi, project, waitForProject }) => {
+	const getServiceRoleApiKey = async () => {
 		const keysProcess = await execa("npx", [
 			"-y",
 			"supabase",
@@ -6710,17 +7229,146 @@ const runInit = async ({ build }) => {
 			project.id,
 			"--output",
 			"json"
-		]);
-		apiKeys = JSON.parse(keysProcess.stdout ?? "[]");
-	} catch (err) {
-		spinner.stop();
-		console.error("Failed to get API keys:", err);
-		process.exit(1);
+		], { env: getSupabaseCliEnv(accessToken) });
+		return JSON.parse(keysProcess.stdout ?? "[]").find((key) => key.name === "service_role")?.api_key;
+	};
+	let serviceRoleApiKey;
+	if (waitForProject) await p.tasks([{
+		title: `Waiting for ${project.name} to become ready...`,
+		task: async (message) => {
+			await waitForSupabaseProjectReady({
+				getProjectStatus: () => managementApi.getProjectStatus(project.id),
+				onLongWait: () => {
+					message("Supabase project is still provisioning. This might take a few minutes.");
+				}
+			});
+			serviceRoleApiKey = await getServiceRoleApiKey();
+			return "Supabase project is ready.";
+		}
+	}]);
+	else {
+		const spinner = p.spinner();
+		spinner.start(`Getting API keys for ${project.name}...`);
+		try {
+			serviceRoleApiKey = await getServiceRoleApiKey();
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			throw new Error(`Failed to get Supabase API keys: ${message}`);
+		} finally {
+			spinner.stop();
+		}
 	}
-	spinner.stop();
-	const serviceRoleApiKey = apiKeys.find((key) => key.name === "service_role");
 	if (!serviceRoleApiKey) throw new Error("Service role key not found, is your project paused?");
-	const bucket = await selectBucket(supabaseApi(`https://${project.id}.supabase.co`, serviceRoleApiKey.api_key));
+	return {
+		api: supabaseApi(`https://${project.id}.supabase.co`, serviceRoleApiKey),
+		serviceRoleApiKey
+	};
+};
+const runInit = async ({ build, envFile }) => {
+	const nonInteractive = envFile !== void 0;
+	const initEnvSources = await readHotUpdaterInitEnv(process.cwd(), envFile);
+	const { inputEnv, managedEnv } = initEnvSources;
+	const savedInputs = resolveSupabaseInitInputs(getHotUpdaterInitInputEnv(initEnvSources, nonInteractive), {
+		inputEnv,
+		managedEnv
+	});
+	await assertSupabaseNonInteractiveInputs(savedInputs, nonInteractive);
+	const initInputs = await inputSupabaseDeploymentInputs({
+		...savedInputs,
+		nonInteractive
+	});
+	const { accessToken, functionName } = initInputs;
+	const projectSelection = await selectProject(savedInputs.projectId, nonInteractive, accessToken);
+	let project = projectSelection.create ? void 0 : projectSelection.project;
+	const dbPassword = await inputSupabaseDatabasePassword({
+		cliHandlesPrompt: projectSelection.create && initInputs.accessToken === void 0,
+		databasePassword: savedInputs.databasePassword,
+		nonInteractive,
+		required: projectSelection.create
+	});
+	const managementApi = supabaseManagementApi(accessToken);
+	const projectCreationInputs = projectSelection.create ? await inputSupabaseProjectCreationInputs({
+		bucketName: savedInputs.bucketName,
+		organizationSlug: savedInputs.organizationSlug,
+		organizations: await managementApi.listOrganizations(),
+		projectName: savedInputs.projectName,
+		region: savedInputs.region
+	}) : void 0;
+	let projectAccess = project === void 0 ? void 0 : await getSupabaseProjectAccess({
+		accessToken,
+		managementApi,
+		project,
+		waitForProject: false
+	});
+	let bucketSelection;
+	if (project && projectAccess) bucketSelection = await selectBucket(projectAccess.api, savedInputs.bucketName, nonInteractive);
+	else if (projectCreationInputs) bucketSelection = {
+		create: true,
+		name: projectCreationInputs.bucketName
+	};
+	else throw new Error("Failed to plan the Supabase storage bucket.");
+	if (projectAccess) await ensureSupabaseBucketPrivate({
+		api: projectAccess.api,
+		nonInteractive,
+		selection: bucketSelection
+	});
+	const inputsBeforeProvisioning = {
+		...savedInputs,
+		...projectCreationInputs,
+		accessToken,
+		bucketName: bucketSelection.name,
+		databasePassword: dbPassword,
+		functionName,
+		projectId: project?.id
+	};
+	const databasePasswordKey = initProvider.inputs.databasePassword.envKey;
+	const persistCredentialInputs = await confirmInitInputPersistence({
+		existingEnv: dbPassword !== "" && (projectSelection.create || managedEnv["HOT_UPDATER_SUPABASE_DB_PASSWORD_PROJECT_ID"] !== project?.id) ? {
+			...managedEnv,
+			[databasePasswordKey]: ""
+		} : managedEnv,
+		inputs: inputsBeforeProvisioning,
+		nonInteractive,
+		provider: initProvider
+	});
+	if (!await confirmSupabaseDatabaseMigrations({ nonInteractive })) {
+		p.log.info("Init cancelled.");
+		process.exit(1);
+	}
+	if (projectSelection.create) {
+		if (!projectCreationInputs) throw new Error("Supabase project creation inputs were not resolved.");
+		project = await managementApi.createProject({
+			databasePassword: dbPassword,
+			name: projectCreationInputs.projectName,
+			organizationSlug: projectCreationInputs.organizationSlug,
+			region: projectCreationInputs.region
+		});
+		projectAccess = await getSupabaseProjectAccess({
+			accessToken,
+			managementApi,
+			project,
+			waitForProject: true
+		});
+	}
+	if (!project || !projectAccess) throw new Error("Failed to resolve the Supabase project.");
+	const providerEnv = getInitProviderEnvVars({
+		includeConsentInputs: persistCredentialInputs,
+		inputs: {
+			...inputsBeforeProvisioning,
+			projectId: project.id
+		},
+		provider: initProvider
+	});
+	const persistDatabasePassword = persistCredentialInputs && dbPassword !== "";
+	if (persistDatabasePassword) providerEnv[SUPABASE_DATABASE_PASSWORD_PROJECT_ID_ENV_KEY] = project.id;
+	await makeEnv(providerEnv, ".env.hotupdater", { removeKeys: persistDatabasePassword ? [] : [databasePasswordKey, SUPABASE_DATABASE_PASSWORD_PROJECT_ID_ENV_KEY] });
+	const bucket = await createSelectedBucket(projectAccess.api, bucketSelection);
+	await makeEnv({
+		[initProvider.inputs.projectId.envKey]: project.id,
+		HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY: projectAccess.serviceRoleApiKey,
+		[initProvider.inputs.bucketName.envKey]: bucket.name,
+		HOT_UPDATER_SUPABASE_URL: `https://${project.id}.supabase.co`
+	});
 	const { tmpDir, removeTmpDir } = await copyDirToTmp(path.dirname(path.resolve(require$1.resolve("@hot-updater/supabase/scaffold"))), "supabase");
 	const migrationPath = await path.join(tmpDir, "supabase", "migrations");
 	const migrationFiles = await fs.readdir(migrationPath);
@@ -6729,29 +7377,26 @@ const runInit = async ({ build }) => {
 		const content = await fs.readFile(filePath, "utf-8");
 		await fs.writeFile(filePath, transformTemplate(content, { BUCKET_NAME: bucket.name }));
 	}
-	const dbPassword = await p.password({ message: "Enter your Supabase database password (press Enter to skip if none)" });
-	if (p.isCancel(dbPassword)) process.exit(0);
 	await linkSupabase(tmpDir, {
+		accessToken,
 		projectId: project.id,
 		dbPassword
 	});
-	await pushDB(tmpDir, { dbPassword });
-	await deployEdgeFunction(tmpDir, project.id);
+	await pushDB(tmpDir, {
+		accessToken,
+		dbPassword
+	});
+	await deployEdgeFunction(accessToken, tmpDir, project.id, functionName);
 	await removeTmpDir();
 	const configWriteResult = await writeHotUpdaterConfig(getConfigScaffold(build));
 	await assertSkippedConfigDoesNotUseLegacySupabaseKey(configWriteResult);
-	await makeEnv({
-		HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY: serviceRoleApiKey.api_key,
-		HOT_UPDATER_SUPABASE_BUCKET_NAME: bucket.name,
-		HOT_UPDATER_SUPABASE_URL: `https://${project.id}.supabase.co`
-	});
 	p.log.success("Generated '.env.hotupdater' file with Supabase settings.");
 	if (configWriteResult.status === "created") p.log.success("Generated 'hot-updater.config.ts' file with Supabase settings.");
 	else if (configWriteResult.status === "merged") p.log.success("Updated 'hot-updater.config.ts' file with Supabase settings.");
 	else p.log.warn(`Kept existing 'hot-updater.config.ts' unchanged: ${configWriteResult.reason}`);
-	p.note(transformTemplate(SOURCE_TEMPLATE, { source: `https://${project.id}.supabase.co/functions/v1/update-server` }));
+	p.note(transformTemplate(SOURCE_TEMPLATE, { source: `https://${project.id}.supabase.co/functions/v1/${functionName}` }));
 	p.log.message(`Next step: ${link("https://hot-updater.dev/docs/managed/supabase#step-4-add-hotupdater-to-your-project")}`);
 	p.log.success("Done! 🎉");
 };
 //#endregion
-export { getLegacySupabaseConfigReference, resolveEdgeFunctionDenoConfig, runInit, selectBucket, selectProject };
+export { createSelectedBucket, getLegacySupabaseConfigReference, getSupabaseProjectAccess, resolveEdgeFunctionDenoConfig, runInit, selectBucket, selectProject, waitForSupabaseProjectReady };