@hot-updater/supabase 0.36.7 → 1.0.0-rc.0

package/dist/iac/index.mjs

@@ -1,7 +1,8 @@
 import { createRequire } from "node:module";
 import fs from "fs/promises";
 import path from "path";
-import { ConfigBuilder, InitError, MissingInitInputsError, assertInitInputs, assertInitProviderInputs, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, readHotUpdaterInitEnv, resolveInitProviderInput, resolvePackageVersion, transformEnv, transformTemplate, writeHotUpdaterConfig } from "@hot-updater/cli-tools";
+import { ConfigBuilder, InitError, MissingInitInputsError, assertInfrastructureGenerationAtUrl, assertInitInputs, assertInitProviderInputs, confirmInitInputPersistence, copyDirToTmp, createHotUpdaterConfigScaffoldFromBuilder, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, readHotUpdaterInitEnv, resolveInitProviderInput, resolvePackageVersion, transformEnv, transformTemplate, writeHotUpdaterConfig } from "@hot-updater/cli-tools";
+import { provisionApiKey } from "@hot-updater/server";
 import { fileURLToPath } from "node:url";
 import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
@@ -17,6 +18,8 @@ import { appendFileSync, createReadStream, createWriteStream, readFileSync, stat
 import { finished } from "node:stream/promises";
 import { Duplex, PassThrough, Readable, Transform, Writable, getDefaultHighWaterMark } from "node:stream";
 import { Buffer as Buffer$1 } from "node:buffer";
+import { DatabasePluginInputError, createDatabasePlugin } from "@hot-updater/plugin-core";
+import { DatabaseRowReferencedError, createDatabasePluginAdapter } from "@hot-updater/plugin-core/internal";
 import { createClient } from "@supabase/supabase-js";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
@@ -6271,6 +6274,437 @@ createExeca(mapNode);
 createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 const { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
+//#region src/supabaseConfig.ts
+const resolveSupabaseServiceRoleKey = (config) => {
+	if (!config.supabaseServiceRoleKey) throw new Error("Supabase service role key is required. Set supabaseServiceRoleKey.");
+	return config.supabaseServiceRoleKey;
+};
+//#endregion
+//#region src/supabaseFilter.ts
+var InvalidSupabasePredicateError = class extends Error {
+	name = "InvalidSupabasePredicateError";
+};
+const encodeValue = (value) => {
+	if (typeof value !== "string") return String(value);
+	return `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}"`;
+};
+const encodePattern = (value) => encodeValue(value.replaceAll("*", "\\*").replaceAll("%", "\\%").replaceAll("_", "\\_"));
+const predicate = (condition) => {
+	const operator = condition.operator ?? "eq";
+	const field = condition.field;
+	switch (operator) {
+		case "eq":
+		case "ne":
+			if (condition.value === null) return `${field}.${operator === "eq" ? "is" : "not.is"}.null`;
+			if (typeof condition.value !== "boolean" && typeof condition.value !== "number" && typeof condition.value !== "string") throw new InvalidSupabasePredicateError();
+			if ("mode" in condition && condition.mode === "insensitive") {
+				const comparison = encodePattern(condition.value);
+				return `${field}.${operator === "eq" ? "ilike" : "not.ilike"}.${comparison}`;
+			}
+			return `${field}.${operator === "eq" ? "eq" : "neq"}.${encodeValue(condition.value)}`;
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+			if (typeof condition.value !== "number" && typeof condition.value !== "string") throw new InvalidSupabasePredicateError();
+			return `${field}.${operator}.${encodeValue(condition.value)}`;
+		case "in":
+		case "not_in": {
+			if (!Array.isArray(condition.value)) throw new InvalidSupabasePredicateError();
+			if (condition.value.length === 0) return operator === "in" ? `and(${field}.is.null,${field}.not.is.null)` : `or(${field}.is.null,${field}.not.is.null)`;
+			const values = condition.value.map(encodeValue).join(",");
+			return `${field}.${operator === "in" ? "in" : "not.in"}.(${values})`;
+		}
+		case "contains":
+		case "starts_with":
+		case "ends_with": {
+			if (typeof condition.value !== "string") throw new InvalidSupabasePredicateError();
+			const value = encodePattern(condition.value).slice(1, -1);
+			const pattern = operator === "contains" ? `"*${value}*"` : operator === "starts_with" ? `"${value}*"` : `"*${value}"`;
+			return `${field}.${"mode" in condition && condition.mode === "insensitive" ? "ilike" : "like"}.${pattern}`;
+		}
+	}
+};
+const buildSupabaseFilter = (where) => {
+	const [first, ...rest] = where ?? [];
+	if (first === void 0) return;
+	let expression = predicate(first);
+	for (const condition of rest) {
+		const next = predicate(condition);
+		expression = condition.connector === "OR" ? `or(${expression},${next})` : `and(${expression},${next})`;
+	}
+	return expression;
+};
+//#endregion
+//#region src/supabaseInfrastructureNames.ts
+const SUPABASE_V1_FUNCTION_NAME = "hot-updater-v1";
+const SUPABASE_V1_TABLE_NAMES = {
+	apiKeys: "hot_updater_v1_api_keys",
+	bundleEvents: "hot_updater_v1_bundle_events",
+	bundlePatches: "hot_updater_v1_bundle_patches",
+	bundles: "hot_updater_v1_bundles",
+	channels: "hot_updater_v1_channels",
+	releaseCatalogs: "hot_updater_v1_release_catalogs",
+	releases: "hot_updater_v1_releases",
+	settings: "hot_updater_v1_private_settings"
+};
+const SUPABASE_V1_FUNCTION_NAMES = {
+	commit: "hot_updater_v1_commit",
+	deleteChannel: "hot_updater_v1_delete_channel"
+};
+//#endregion
+//#region src/supabaseResult.ts
+var SupabaseDatabaseError = class extends Error {
+	name = "SupabaseDatabaseError";
+	constructor(operation, cause) {
+		super(`Supabase database operation failed: ${operation}`, { cause });
+		this.operation = operation;
+	}
+};
+var SupabaseMissingDataError = class extends Error {
+	name = "SupabaseMissingDataError";
+	constructor(operation) {
+		super(`Supabase database operation returned no row: ${operation}`);
+		this.operation = operation;
+	}
+};
+const throwSupabaseError = (operation, error) => {
+	if (error !== null) throw new SupabaseDatabaseError(operation, error);
+};
+//#endregion
+//#region src/supabaseDatabase.ts
+const isForeignKeyViolation = (error) => typeof error === "object" && error !== null && Reflect.get(error, "code") === "23503";
+const createSupabaseImplementation = (supabase) => {
+	const implementation = {
+		async create(input) {
+			switch (input.model) {
+				case "bundles": {
+					const { data, error } = await supabase.from(SUPABASE_V1_TABLE_NAMES.bundles).insert(input.data).select("*").single();
+					throwSupabaseError("create bundles", error);
+					if (data === null) throw new SupabaseMissingDataError("create bundles");
+					return data;
+				}
+				case "bundle_patches": {
+					const { data, error } = await supabase.from(SUPABASE_V1_TABLE_NAMES.bundlePatches).insert(input.data).select("*").single();
+					throwSupabaseError("create bundle_patches", error);
+					if (data === null) throw new SupabaseMissingDataError("create bundle_patches");
+					return data;
+				}
+				case "channels": {
+					if (input.onConflict === "ignore") {
+						const { data, error } = await supabase.from(SUPABASE_V1_TABLE_NAMES.channels).upsert(input.data, {
+							onConflict: "name",
+							ignoreDuplicates: true
+						}).select("*").maybeSingle();
+						throwSupabaseError("create channels", error);
+						return data ?? input.data;
+					}
+					const { data, error } = await supabase.from(SUPABASE_V1_TABLE_NAMES.channels).insert(input.data).select("*").single();
+					throwSupabaseError("create channels", error);
+					if (data === null) throw new SupabaseMissingDataError("create channels");
+					return data;
+				}
+				case "bundle_events": {
+					const { data, error } = await supabase.from(SUPABASE_V1_TABLE_NAMES.bundleEvents).insert(input.data).select("*").single();
+					throwSupabaseError("create bundle_events", error);
+					if (data === null) throw new SupabaseMissingDataError("create bundle_events");
+					return data;
+				}
+				case "releases": {
+					const { data, error } = await supabase.from(SUPABASE_V1_TABLE_NAMES.releases).insert(input.data).select("*").single();
+					throwSupabaseError("create releases", error);
+					if (data === null) throw new SupabaseMissingDataError("create releases");
+					return data;
+				}
+				case "release_catalogs": {
+					const { data, error } = await supabase.from(SUPABASE_V1_TABLE_NAMES.releaseCatalogs).insert(input.data).select("*").single();
+					throwSupabaseError("create release_catalogs", error);
+					if (data === null) throw new SupabaseMissingDataError("create release_catalogs");
+					return data;
+				}
+				case "api_keys": {
+					const { data, error } = await (input.onConflict === "ignore" ? supabase.from(SUPABASE_V1_TABLE_NAMES.apiKeys).upsert(input.data, {
+						onConflict: "hash",
+						ignoreDuplicates: true
+					}) : supabase.from(SUPABASE_V1_TABLE_NAMES.apiKeys).insert(input.data)).select("*").maybeSingle();
+					throwSupabaseError("create api_keys", error);
+					if (data === null && input.onConflict !== "ignore") throw new SupabaseMissingDataError("create api_keys");
+					return data ?? input.data;
+				}
+			}
+		},
+		async update(input) {
+			const filter = buildSupabaseFilter(input.where);
+			if (input.model === "api_keys") {
+				let query = supabase.from(SUPABASE_V1_TABLE_NAMES.apiKeys).update(input.update);
+				if (filter !== void 0) query = query.or(filter);
+				const { data, error } = await query.select("*").maybeSingle();
+				throwSupabaseError("update api_keys", error);
+				return data;
+			}
+			if (input.model === "releases") {
+				let query = supabase.from(SUPABASE_V1_TABLE_NAMES.releases).update(input.update);
+				if (filter !== void 0) query = query.or(filter);
+				const { data, error } = await query.select("*").maybeSingle();
+				throwSupabaseError("update releases", error);
+				return data;
+			}
+			if (input.model === "release_catalogs") {
+				let query = supabase.from(SUPABASE_V1_TABLE_NAMES.releaseCatalogs).update(input.update);
+				if (filter !== void 0) query = query.or(filter);
+				const { data, error } = await query.select("*").maybeSingle();
+				throwSupabaseError("update release_catalogs", error);
+				return data;
+			}
+			let query = supabase.from(SUPABASE_V1_TABLE_NAMES.bundles).update(input.update);
+			if (filter !== void 0) query = query.or(filter);
+			const { data, error } = await query.select("*").maybeSingle();
+			throwSupabaseError("update bundles", error);
+			return data;
+		},
+		async delete(input) {
+			const filter = buildSupabaseFilter(input.where);
+			switch (input.model) {
+				case "bundles": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.bundles).delete();
+					if (filter !== void 0) query = query.or(filter);
+					const { error } = await query;
+					throwSupabaseError("delete bundles", error);
+					return;
+				}
+				case "bundle_patches": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.bundlePatches).delete();
+					if (filter !== void 0) query = query.or(filter);
+					const { error } = await query;
+					throwSupabaseError("delete bundle_patches", error);
+					return;
+				}
+				case "channels": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.channels).delete();
+					if (filter !== void 0) query = query.or(filter);
+					const { error } = await query;
+					if (isForeignKeyViolation(error)) throw new DatabaseRowReferencedError();
+					throwSupabaseError("delete channels", error);
+				}
+				case "releases": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.releases).delete();
+					if (filter !== void 0) query = query.or(filter);
+					const { error } = await query;
+					throwSupabaseError("delete releases", error);
+				}
+			}
+		},
+		async count(input) {
+			if (input.distinct !== void 0) throw new DatabasePluginInputError("invalid-operation");
+			const filter = buildSupabaseFilter(input.where);
+			switch (input.model) {
+				case "bundles": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.bundles).select("*", {
+						count: "exact",
+						head: true
+					});
+					if (filter !== void 0) query = query.or(filter);
+					const { count, error } = await query;
+					throwSupabaseError("count bundles", error);
+					return count ?? 0;
+				}
+				case "bundle_patches": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.bundlePatches).select("*", {
+						count: "exact",
+						head: true
+					});
+					if (filter !== void 0) query = query.or(filter);
+					const { count, error } = await query;
+					throwSupabaseError("count bundle_patches", error);
+					return count ?? 0;
+				}
+				case "releases": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.releases).select("*", {
+						count: "exact",
+						head: true
+					});
+					if (filter !== void 0) query = query.or(filter);
+					const { count, error } = await query;
+					throwSupabaseError("count releases", error);
+					return count ?? 0;
+				}
+			}
+		},
+		async findOne(input) {
+			const filter = buildSupabaseFilter(input.where);
+			switch (input.model) {
+				case "bundles": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.bundles).select("*");
+					if (filter !== void 0) query = query.or(filter);
+					const { data, error } = await query.limit(1).maybeSingle();
+					throwSupabaseError("findOne bundles", error);
+					return data;
+				}
+				case "api_keys": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.apiKeys).select("*");
+					if (filter !== void 0) query = query.or(filter);
+					const { data, error } = await query.limit(1).maybeSingle();
+					throwSupabaseError("findOne api_keys", error);
+					return data;
+				}
+				case "channels": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.channels).select("*");
+					if (filter !== void 0) query = query.or(filter);
+					const { data, error } = await query.limit(1).maybeSingle();
+					throwSupabaseError("findOne channels", error);
+					return data;
+				}
+				case "bundle_patches": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.bundlePatches).select("*");
+					if (filter !== void 0) query = query.or(filter);
+					const { data, error } = await query.limit(1).maybeSingle();
+					throwSupabaseError("findOne bundle_patches", error);
+					return data;
+				}
+				case "releases": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.releases).select("*");
+					if (filter !== void 0) query = query.or(filter);
+					const { data, error } = await query.limit(1).maybeSingle();
+					throwSupabaseError("findOne releases", error);
+					return data;
+				}
+				case "release_catalogs": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.releaseCatalogs).select("*");
+					if (filter !== void 0) query = query.or(filter);
+					const { data, error } = await query.limit(1).maybeSingle();
+					throwSupabaseError("findOne release_catalogs", error);
+					return data;
+				}
+			}
+		},
+		async findMany(input) {
+			if (input.distinctOn !== void 0) throw new DatabasePluginInputError("invalid-operation");
+			if (input.limit === 0) return [];
+			const filter = buildSupabaseFilter(input.where);
+			const rangeEnd = input.offset + input.limit - 1;
+			const orderBy = input.orderBy ?? [];
+			switch (input.model) {
+				case "bundles": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.bundles).select("*");
+					if (filter !== void 0) query = query.or(filter);
+					for (const clause of orderBy) query = query.order(clause.field, {
+						ascending: clause.direction === "asc",
+						...clause.nulls ? { nullsFirst: clause.nulls === "first" } : {}
+					});
+					const { data, error } = await query.range(input.offset, rangeEnd);
+					throwSupabaseError("findMany bundles", error);
+					return data ?? [];
+				}
+				case "bundle_events": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.bundleEvents).select("*");
+					if (filter !== void 0) query = query.or(filter);
+					for (const clause of orderBy) query = query.order(clause.field, {
+						ascending: clause.direction === "asc",
+						...clause.nulls ? { nullsFirst: clause.nulls === "first" } : {}
+					});
+					const { data, error } = await query.range(input.offset, rangeEnd);
+					throwSupabaseError("findMany bundle_events", error);
+					return data ?? [];
+				}
+				case "api_keys": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.apiKeys).select("*");
+					if (filter !== void 0) query = query.or(filter);
+					for (const clause of orderBy) query = query.order(clause.field, {
+						ascending: clause.direction === "asc",
+						...clause.nulls ? { nullsFirst: clause.nulls === "first" } : {}
+					});
+					const { data, error } = await query.range(input.offset, rangeEnd);
+					throwSupabaseError("findMany api_keys", error);
+					return data ?? [];
+				}
+				case "bundle_patches": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.bundlePatches).select("*");
+					if (filter !== void 0) query = query.or(filter);
+					for (const clause of orderBy) query = query.order(clause.field, {
+						ascending: clause.direction === "asc",
+						...clause.nulls ? { nullsFirst: clause.nulls === "first" } : {}
+					});
+					const { data, error } = await query.range(input.offset, rangeEnd);
+					throwSupabaseError("findMany bundle_patches", error);
+					return data ?? [];
+				}
+				case "channels": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.channels).select("*");
+					if (filter !== void 0) query = query.or(filter);
+					for (const clause of orderBy) query = query.order(clause.field, {
+						ascending: clause.direction === "asc",
+						...clause.nulls ? { nullsFirst: clause.nulls === "first" } : {}
+					});
+					const { data, error } = await query.range(input.offset, rangeEnd);
+					throwSupabaseError("findMany channels", error);
+					return data ?? [];
+				}
+				case "releases": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.releases).select("*");
+					if (filter !== void 0) query = query.or(filter);
+					for (const clause of orderBy) query = query.order(clause.field, {
+						ascending: clause.direction === "asc",
+						...clause.nulls ? { nullsFirst: clause.nulls === "first" } : {}
+					});
+					const { data, error } = await query.range(input.offset, rangeEnd);
+					throwSupabaseError("findMany releases", error);
+					return data ?? [];
+				}
+				case "release_catalogs": {
+					let query = supabase.from(SUPABASE_V1_TABLE_NAMES.releaseCatalogs).select("*");
+					if (filter !== void 0) query = query.or(filter);
+					for (const clause of orderBy) query = query.order(clause.field, {
+						ascending: clause.direction === "asc",
+						...clause.nulls ? { nullsFirst: clause.nulls === "first" } : {}
+					});
+					const { data, error } = await query.range(input.offset, rangeEnd);
+					throwSupabaseError("findMany release_catalogs", error);
+					return data ?? [];
+				}
+			}
+		},
+		async insertChannel(input) {
+			const { data: inserted, error: insertError } = await supabase.from(SUPABASE_V1_TABLE_NAMES.channels).upsert(input.row, {
+				onConflict: "name",
+				ignoreDuplicates: true
+			}).select("*").maybeSingle();
+			throwSupabaseError("insert channel", insertError);
+			if (inserted !== null) return {
+				row: inserted,
+				inserted: true
+			};
+			const { data: existing, error: findError } = await supabase.from(SUPABASE_V1_TABLE_NAMES.channels).select("*").eq("name", input.row.name).single();
+			throwSupabaseError("find canonical channel", findError);
+			if (existing === null) throw new SupabaseMissingDataError("find canonical channel");
+			return {
+				row: existing,
+				inserted: false
+			};
+		},
+		async deleteChannel(input) {
+			const { data, error } = await supabase.rpc(SUPABASE_V1_FUNCTION_NAMES.deleteChannel, { p_id: input.id });
+			throwSupabaseError("delete channel", error);
+			if (data === null || typeof data !== "object" || !("deleted" in data) || typeof data.deleted !== "boolean") throw new SupabaseMissingDataError("delete channel");
+			return data;
+		}
+	};
+	implementation.commit = async (input) => {
+		const { data, error } = await supabase.rpc(SUPABASE_V1_FUNCTION_NAMES.commit, { p_commit: input });
+		throwSupabaseError("commit database changes", error);
+		if (data === null || typeof data !== "object" || !("committed" in data) || typeof data.committed !== "boolean") throw new SupabaseMissingDataError("commit database changes");
+		return data;
+	};
+	return implementation;
+};
+const supabaseDatabase = (config) => {
+	const adapter = createDatabasePluginAdapter("supabaseDatabase", createSupabaseImplementation(createClient(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))));
+	return createDatabasePlugin({
+		name: "supabaseDatabase",
+		models: adapter.models,
+		commit: adapter.commit
+	});
+};
+//#endregion
 //#region iac/init/index.ts
 const SUPABASE_DATABASE_PASSWORD_PROJECT_ID_ENV_KEY = "HOT_UPDATER_SUPABASE_DB_PASSWORD_PROJECT_ID";
 const SUPABASE_REGION_VALUES = [
@@ -6357,9 +6791,9 @@ const initProvider = {
 			envKey: "HOT_UPDATER_SUPABASE_FUNCTION_NAME",
 			help: "Edge Function name",
 			prompt: {
-				defaultValue: "update-server",
+				defaultValue: SUPABASE_V1_FUNCTION_NAME,
 				message: "Enter a name for the edge function",
-				placeholder: "update-server",
+				placeholder: SUPABASE_V1_FUNCTION_NAME,
 				type: "text"
 			},
 			validate: isSupabaseFunctionName
@@ -6381,6 +6815,12 @@ const initProvider = {
 const supabaseApi = (supabaseUrl, supabaseServiceRoleKey) => {
 	const supabase = createClient(supabaseUrl, supabaseServiceRoleKey);
 	return {
+		getInfrastructureState: async () => {
+			const marker = await supabase.from(SUPABASE_V1_TABLE_NAMES.settings).select("value").eq("key", "schema.core").maybeSingle();
+			if (!marker.error) return marker.data?.value === "1.0.0" ? "v1" : "incompatible";
+			if (marker.error.code === "42P01" || marker.error.code === "PGRST205") return "fresh";
+			throw marker.error;
+		},
 		listBuckets: async () => {
 			const { data, error } = await supabase.storage.listBuckets();
 			if (error) throw error;
@@ -6395,10 +6835,6 @@ const supabaseApi = (supabaseUrl, supabaseServiceRoleKey) => {
 			const { data, error } = await supabase.storage.createBucket(bucketName, options);
 			if (error) throw error;
 			return data;
-		},
-		updateBucket: async (bucketId, options) => {
-			const { error } = await supabase.storage.updateBucket(bucketId, options);
-			if (error) throw error;
 		}
 	};
 };
@@ -6484,30 +6920,9 @@ const inputSupabaseAccessToken = async (accessToken) => {
 };
 //#endregion
 //#region iac/supabaseBucketPrivacy.ts
-var PublicSupabaseBucketError = class extends InitError {
-	name = "PublicSupabaseBucketError";
-	constructor(bucketName) {
-		super([
-			`Supabase bucket "${bucketName}" is public.`,
-			"Make the bucket private in Supabase Storage, then rerun init.",
-			"Alternatively, rerun without --from-env-file to approve the change interactively."
-		].join("\n"));
-		this.bucketName = bucketName;
-	}
-};
-const ensureSupabaseBucketPrivate = async ({ api, nonInteractive, selection }) => {
+const preserveSupabaseBucketPrivacy = ({ selection }) => {
 	if (selection.create || !selection.isPublic) return;
-	if (nonInteractive) throw new PublicSupabaseBucketError(selection.name);
-	const confirmed = await p.confirm({
-		message: `Bucket "${selection.name}" is public. Make it private?`,
-		initialValue: true
-	});
-	if (p.isCancel(confirmed) || !confirmed) {
-		p.log.info("Init cancelled.");
-		process.exit(1);
-	}
-	await api.updateBucket(selection.id, { public: false });
-	p.log.success(`Bucket "${selection.name}" is now private.`);
+	p.log.warn(`Bucket "${selection.name}" is public. Its access level will be preserved for existing apps.`);
 };
 //#endregion
 //#region iac/supabaseCli.ts
@@ -6576,12 +6991,26 @@ const linkSupabase = async (workdir, { accessToken, projectId, dbPassword }) =>
 };
 const pushDB = async (workdir, { accessToken, dbPassword }) => {
 	try {
+		await execa("npx", [
+			"supabase",
+			"migration",
+			"fetch",
+			"--linked",
+			"--yes",
+			"--workdir",
+			workdir
+		], {
+			cwd: workdir,
+			env: getSupabaseCommandEnv(accessToken, dbPassword)
+		});
 		const dbPush = await execa("npx", [
 			"supabase",
 			"db",
 			"push",
 			"--include-all",
-			"--yes"
+			"--yes",
+			"--workdir",
+			workdir
 		], {
 			cwd: workdir,
 			env: getSupabaseCommandEnv(accessToken, dbPassword),
@@ -6599,6 +7028,20 @@ const pushDB = async (workdir, { accessToken, dbPassword }) => {
 	}
 };
 //#endregion
+//#region iac/supabaseInfrastructureState.ts
+const assertSupabaseInfrastructureCanInitialize = async (api, projectId) => {
+	if (await api.getInfrastructureState() === "incompatible") throw new InitError(`Supabase v1 infrastructure in project ${projectId} is incomplete or uses an unsupported database version.`);
+};
+const assertSupabaseFunctionCanInitialize = async ({ fetchImpl, functionName, functionSlugs, projectId }) => {
+	if (!functionSlugs.includes(functionName)) return;
+	await assertInfrastructureGenerationAtUrl({
+		fetchImpl,
+		provider: "Supabase",
+		resource: `Edge Function ${functionName}`,
+		versionUrl: `https://${projectId}.supabase.co/functions/v1/${encodeURIComponent(functionName)}/version`
+	});
+};
+//#endregion
 //#region iac/supabaseDeploymentInputs.ts
 const assertSupabaseNonInteractiveInputs = async (inputs, nonInteractive, validateCliLogin = hasValidSupabaseCliLogin) => {
 	assertInitProviderInputs({
@@ -6740,6 +7183,14 @@ const supabaseCliManagementApi = () => ({
 			slug: organization.slug
 		}] : []);
 	},
+	listFunctions: async (projectId) => parseSupabaseFunctionSlugs(await runSupabaseCli([
+		"functions",
+		"list",
+		"--project-ref",
+		projectId,
+		"--output",
+		"json"
+	])),
 	createProject: async ({ name, organizationSlug, region }) => {
 		await execa("npx", [
 			"-y",
@@ -6787,6 +7238,13 @@ const supabaseCliManagementApi = () => ({
 const SUPABASE_MANAGEMENT_API_URL = "https://api.supabase.com/v1";
 const SUPABASE_MANAGEMENT_API_TIMEOUT_MS = 3e4;
 const isRecord = (value) => typeof value === "object" && value !== null;
+const parseSupabaseFunctionSlugs = (body) => {
+	if (!Array.isArray(body)) throw new Error("Supabase functions response was invalid.");
+	return body.map((item) => {
+		if (!isRecord(item) || typeof item.slug !== "string") throw new Error("Supabase functions response was invalid.");
+		return item.slug;
+	});
+};
 var SupabaseManagementApiStatusError = class extends Error {};
 const projectCreationMayHaveSucceededError = (message = "Supabase project creation could not be confirmed.", cause) => new Error(`${message} The request may have succeeded; check the organization's projects before retrying init.`, { cause });
 const request = async (accessToken, path, init) => {
@@ -6827,6 +7285,7 @@ const supabaseManagementApi = (accessToken) => accessToken === void 0 ? supabase
 			slug: organization.slug
 		}] : []);
 	},
+	listFunctions: async (projectId) => parseSupabaseFunctionSlugs(await request(accessToken, `/projects/${encodeURIComponent(projectId)}/functions`)),
 	createProject: async ({ databasePassword, name, organizationSlug, region }) => {
 		const body = await request(accessToken, "/projects", {
 			body: {
@@ -6859,6 +7318,11 @@ const SUPABASE_PROJECT_READY_STATUS = "ACTIVE_HEALTHY";
 const SUPABASE_PROJECT_PROVISIONING_STATUS = "COMING_UP";
 const SUPABASE_PROJECT_READINESS_MAX_ATTEMPTS = 300;
 const SUPABASE_PROJECT_READINESS_POLL_INTERVAL_MS = 1e3;
+const SUPABASE_STORAGE_READINESS_MAX_ATTEMPTS = 300;
+const SUPABASE_STORAGE_READINESS_POLL_INTERVAL_MS = 1e3;
+const SUPABASE_SCHEMA_READINESS_MAX_ATTEMPTS = 60;
+const SUPABASE_SCHEMA_READINESS_POLL_INTERVAL_MS = 1e3;
+const LEGACY_SUPABASE_CATALOG_CDN_URL_ENV_KEY = "HOT_UPDATER_SUPABASE_CATALOG_CDN_URL";
 const STATIC_IMPORT_SPECIFIER_PATTERN = /^\s*(?:import|export)\s+(?:type\s+)?(?:[^"'`]+?\s+from\s+)?["']([^"']+)["'];?/gm;
 const DYNAMIC_IMPORT_SPECIFIER_PATTERN = /\bimport\s*\(\s*["']([^"']+)["']\s*\)/g;
 const getConfigScaffold = (build) => {
@@ -6907,10 +7371,28 @@ function App() {
   return null; // Replace with your app root
 }
 
-export default HotUpdater.wrap({
+HotUpdater.init({
   baseURL: "%%source%%",
-  updateStrategy: "appVersion", // or "fingerprint"
-})(App);`;
+  requestHeaders: {
+    "x-api-key": %%apiKey%%,
+  },
+});
+
+// Call HotUpdater.checkForUpdate({ updateStrategy: "appVersion" })
+// when your app is ready to check.
+export default App;`;
+const getSupabaseReactNativeSource = ({ apiKey, functionName, projectId }) => transformTemplate(SOURCE_TEMPLATE, {
+	apiKey: JSON.stringify(apiKey),
+	source: `https://${projectId}.supabase.co/functions/v1/${functionName}`
+});
+const reportSupabaseOriginCatalogReady = () => {
+	p.log.success("Release catalog endpoint is ready in origin-only mode.");
+	p.log.info("Catalog checks still invoke the Supabase Edge Function.");
+};
+const reportSupabaseApiKey = (apiKey) => {
+	p.note(apiKey, "API Key");
+	p.log.message("Store this API key separately in a secure place.");
+};
 const resolvePackageExportPath = async (packageName, exportName) => {
 	const packageJsonPath = require$1.resolve(`${packageName}/package.json`);
 	const exportTarget = JSON.parse(await fs.readFile(packageJsonPath, "utf-8")).exports?.[exportName];
@@ -7012,10 +7494,11 @@ const buildEdgeFunctionImports = async (targetDir) => {
 		for (const nestedSpecifier of nestedSpecifiers) {
 			if (imports[nestedSpecifier]) continue;
 			if (nestedSpecifier.startsWith(WORKSPACE_PACKAGE_PREFIX)) {
+				const [scope, name, ...subpath] = nestedSpecifier.split("/");
 				await addWorkspacePackage({
 					importSpecifier: nestedSpecifier,
-					packageName: nestedSpecifier,
-					exportName: "."
+					packageName: `${scope}/${name}`,
+					exportName: subpath.length === 0 ? "." : `./${subpath.join("/")}`
 				});
 				continue;
 			}
@@ -7029,7 +7512,7 @@ const buildEdgeFunctionImports = async (targetDir) => {
 		exportName: "."
 	});
 	const supabasePackage = await addWorkspacePackage({
-		importSpecifier: "@hot-updater/supabase",
+		importSpecifier: "@hot-updater/supabase/edge",
 		packageName: "@hot-updater/supabase",
 		exportName: "./edge"
 	});
@@ -7098,6 +7581,17 @@ const selectProject = async (preferredProjectId, nonInteractive = false, accessT
 		project: selectedProject
 	};
 };
+const isMissingSupabaseStorageTenantError = (error) => error instanceof Error && /Missing tenant config for tenant/u.test(error.message) && (Reflect.get(error, "status") === 400 || Reflect.get(error, "statusCode") === "400");
+const retryWhileSupabaseStorageTenantIsProvisioning = async (operation) => {
+	for (let attempt = 1; attempt <= SUPABASE_STORAGE_READINESS_MAX_ATTEMPTS; attempt++) try {
+		return await operation();
+	} catch (error) {
+		if (!isMissingSupabaseStorageTenantError(error) || attempt === SUPABASE_STORAGE_READINESS_MAX_ATTEMPTS) throw error;
+		if (attempt === 1) p.log.info("Waiting for Supabase Storage to become ready...");
+		await delay(SUPABASE_STORAGE_READINESS_POLL_INTERVAL_MS);
+	}
+	throw new Error("Supabase Storage did not become ready.");
+};
 const selectBucket = async (api, preferredBucketName, nonInteractive = false) => {
 	let buckets = [];
 	let retryCount = 0;
@@ -7170,18 +7664,21 @@ const selectBucket = async (api, preferredBucketName, nonInteractive = false) =>
 };
 const createSelectedBucket = async (api, selection) => {
 	if (!selection.create) return selection;
-	await api.createBucket(selection.name, { public: false });
+	await retryWhileSupabaseStorageTenantIsProvisioning(() => api.createBucket(selection.name, { public: false }));
 	p.log.success(`Bucket "${selection.name}" created successfully.`);
-	const bucket = (await api.listBuckets()).find((item) => item.name === selection.name);
+	const bucket = (await retryWhileSupabaseStorageTenantIsProvisioning(() => api.listBuckets())).find((item) => item.name === selection.name);
 	if (!bucket) throw new Error("Failed to create and select new bucket");
 	return {
 		id: bucket.id,
 		name: bucket.name
 	};
 };
-const deployEdgeFunction = async (accessToken, workdir, projectId, functionName) => {
+const deployEdgeFunction = async (accessToken, workdir, projectId, functionName, bucketName) => {
 	const edgeFunctionsLibPath = path.join(workdir, "supabase", "edge-functions");
-	const edgeFunctionsCode = transformEnv(path.join(edgeFunctionsLibPath, "index.ts"), { FUNCTION_NAME: functionName });
+	const edgeFunctionsCode = transformEnv(path.join(edgeFunctionsLibPath, "index.ts"), {
+		BUCKET_NAME: bucketName,
+		FUNCTION_NAME: functionName
+	});
 	if (!isSupabaseFunctionName(functionName)) throw new Error("Invalid Supabase Edge Function name.");
 	const functionsDir = path.resolve(workdir, "supabase", "functions");
 	const targetDir = path.resolve(functionsDir, functionName);
@@ -7228,6 +7725,15 @@ const waitForSupabaseProjectReady = async ({ getProjectStatus, maxAttempts = SUP
 	}
 	throw new Error(`Timed out while waiting for the Supabase project. Last status: ${lastStatus ?? "unknown"}.`);
 };
+const waitForSupabaseSchemaReady = async ({ getInfrastructureState, maxAttempts = SUPABASE_SCHEMA_READINESS_MAX_ATTEMPTS, pollIntervalMs = SUPABASE_SCHEMA_READINESS_POLL_INTERVAL_MS }) => {
+	for (let attempt = 0; attempt < maxAttempts; attempt++) {
+		const state = await getInfrastructureState();
+		if (state === "v1") return;
+		if (state === "incompatible") throw new Error("Supabase database schema is incompatible after migration.");
+		if (attempt < maxAttempts - 1) await delay(pollIntervalMs);
+	}
+	throw new Error("Timed out while waiting for the Supabase database schema cache.");
+};
 const getSupabaseProjectAccess = async ({ accessToken, managementApi, project, waitForProject }) => {
 	const getServiceRoleApiKey = async () => {
 		const keysProcess = await execa("npx", [
@@ -7274,11 +7780,30 @@ const getSupabaseProjectAccess = async ({ accessToken, managementApi, project, w
 		serviceRoleApiKey
 	};
 };
-const runInit = async ({ build, envFile }) => {
+const withSupabaseCliMetadataCleanup = async (cwd, operation) => {
+	const cliDirectory = path.join(cwd, "supabase");
+	let shouldCleanup = false;
+	try {
+		await fs.access(cliDirectory);
+	} catch (error) {
+		if (!(error instanceof Error) || Reflect.get(error, "code") !== "ENOENT") throw error;
+		shouldCleanup = true;
+	}
+	try {
+		return await operation();
+	} finally {
+		if (shouldCleanup) await fs.rm(cliDirectory, {
+			recursive: true,
+			force: true
+		});
+	}
+};
+const runInitWithoutCliMetadata = async ({ build, envFile }) => {
 	const nonInteractive = envFile !== void 0;
 	const initEnvSources = await readHotUpdaterInitEnv(process.cwd(), envFile);
 	const { inputEnv, managedEnv } = initEnvSources;
-	const savedInputs = resolveSupabaseInitInputs(getHotUpdaterInitInputEnv(initEnvSources, nonInteractive), {
+	const initInputEnv = getHotUpdaterInitInputEnv(initEnvSources, nonInteractive);
+	const savedInputs = resolveSupabaseInitInputs(initInputEnv, {
 		inputEnv,
 		managedEnv
 	});
@@ -7317,11 +7842,15 @@ const runInit = async ({ build, envFile }) => {
 		name: projectCreationInputs.bucketName
 	};
 	else throw new Error("Failed to plan the Supabase storage bucket.");
-	if (projectAccess) await ensureSupabaseBucketPrivate({
-		api: projectAccess.api,
-		nonInteractive,
-		selection: bucketSelection
-	});
+	if (projectAccess) {
+		await assertSupabaseInfrastructureCanInitialize(projectAccess.api, project.id);
+		await assertSupabaseFunctionCanInitialize({
+			functionName,
+			functionSlugs: await managementApi.listFunctions(project.id),
+			projectId: project.id
+		});
+		preserveSupabaseBucketPrivacy({ selection: bucketSelection });
+	}
 	const inputsBeforeProvisioning = {
 		...savedInputs,
 		...projectCreationInputs,
@@ -7371,7 +7900,7 @@ const runInit = async ({ build, envFile }) => {
 	});
 	const persistDatabasePassword = persistCredentialInputs && dbPassword !== "";
 	if (persistDatabasePassword) providerEnv[SUPABASE_DATABASE_PASSWORD_PROJECT_ID_ENV_KEY] = project.id;
-	await makeEnv(providerEnv, ".env.hotupdater", { removeKeys: persistDatabasePassword ? [] : [databasePasswordKey, SUPABASE_DATABASE_PASSWORD_PROJECT_ID_ENV_KEY] });
+	await makeEnv(providerEnv, ".env.hotupdater", { removeKeys: [LEGACY_SUPABASE_CATALOG_CDN_URL_ENV_KEY, ...persistDatabasePassword ? [] : [databasePasswordKey, SUPABASE_DATABASE_PASSWORD_PROJECT_ID_ENV_KEY]] });
 	const bucket = await createSelectedBucket(projectAccess.api, bucketSelection);
 	await makeEnv({
 		[initProvider.inputs.projectId.envKey]: project.id,
@@ -7396,7 +7925,23 @@ const runInit = async ({ build, envFile }) => {
 		accessToken,
 		dbPassword
 	});
-	await deployEdgeFunction(accessToken, tmpDir, project.id, functionName);
+	await waitForSupabaseSchemaReady({ getInfrastructureState: projectAccess.api.getInfrastructureState });
+	const databasePlugin = supabaseDatabase({
+		supabaseServiceRoleKey: projectAccess.serviceRoleApiKey,
+		supabaseUrl: `https://${project.id}.supabase.co`
+	});
+	let apiKey;
+	try {
+		apiKey = (await provisionApiKey({
+			apiKeys: databasePlugin.models.apiKeys,
+			existingApiKey: initInputEnv.HOT_UPDATER_API_KEY,
+			name: "Supabase init"
+		})).apiKey;
+		await makeEnv({ HOT_UPDATER_API_KEY: apiKey });
+	} finally {
+		await databasePlugin.dispose?.();
+	}
+	await deployEdgeFunction(accessToken, tmpDir, project.id, functionName, bucket.name);
 	await removeTmpDir();
 	const configWriteResult = await writeHotUpdaterConfig(getConfigScaffold(build));
 	await assertSkippedConfigDoesNotUseLegacySupabaseKey(configWriteResult);
@@ -7404,9 +7949,16 @@ const runInit = async ({ build, envFile }) => {
 	if (configWriteResult.status === "created") p.log.success("Generated 'hot-updater.config.ts' file with Supabase settings.");
 	else if (configWriteResult.status === "merged") p.log.success("Updated 'hot-updater.config.ts' file with Supabase settings.");
 	else p.log.warn(`Kept existing 'hot-updater.config.ts' unchanged: ${configWriteResult.reason}`);
-	p.note(transformTemplate(SOURCE_TEMPLATE, { source: `https://${project.id}.supabase.co/functions/v1/${functionName}` }));
+	p.note(getSupabaseReactNativeSource({
+		apiKey,
+		functionName,
+		projectId: project.id
+	}));
+	reportSupabaseApiKey(apiKey);
+	reportSupabaseOriginCatalogReady();
 	p.log.message(`Next step: ${link("https://hot-updater.dev/docs/managed/supabase#step-4-add-hotupdater-to-your-project")}`);
 	p.log.success("Done! 🎉");
 };
+const runInit = (options) => withSupabaseCliMetadataCleanup(process.cwd(), () => runInitWithoutCliMetadata(options));
 //#endregion
-export { createSelectedBucket, getLegacySupabaseConfigReference, getSupabaseProjectAccess, resolveEdgeFunctionDenoConfig, runInit, selectBucket, selectProject, waitForSupabaseProjectReady };
+export { createSelectedBucket, getLegacySupabaseConfigReference, getSupabaseProjectAccess, getSupabaseReactNativeSource, reportSupabaseApiKey, reportSupabaseOriginCatalogReady, resolveEdgeFunctionDenoConfig, runInit, selectBucket, selectProject, waitForSupabaseProjectReady, waitForSupabaseSchemaReady, withSupabaseCliMetadataCleanup };