@svgrid/enterprise 2.2.1 → 2.3.1

package/src/studio/emit-schema.test.ts

@@ -91,4 +91,21 @@ describe('emitStudioApp', () => {
   it('throws on an empty entity set', () => {
     expect(() => emitStudioApp([])).toThrow(/no schemas/)
   })
+
+  it('types a chips/tags field as string[] (it holds + seeds an array)', () => {
+    const files = emitStudioApp([
+      {
+        name: 'contacts',
+        label: 'Contact',
+        idField: 'id',
+        fields: [
+          { field: 'id', type: 'text', primaryKey: true },
+          { field: 'tags', type: 'text', input: { editorType: 'chips' } },
+        ],
+      },
+    ])
+    const schemas = files.find((f) => f.path === 'src/lib/schemas.ts')!.contents
+    expect(schemas).toMatch(/tags: string\[\]/)
+    expect(schemas).not.toMatch(/tags: string(?!\[)/) // not the scalar `string`
+  })
 })

package/src/studio/emit-schema.ts

@@ -10,9 +10,9 @@
  * build. It targets the template's conventions: `$lib/EntityScreen.svelte`,
  * `$lib/schemas`, `$lib/data`, and the `st-*` / `.home` CSS classes.
  */
-import { resolveIdField, titleCase, type EntityField, type EntityFieldType, type EntitySchema, type ValidationRuleSpec } from '../schema.js'
+import { resolveIdField, titleCase, type EntityField, type EntitySchema, type ValidationRuleSpec } from '../schema.js'
 import type { GeneratedFile } from './scaffold.js'
-import type { EntityDataSource, RestSource, ShellConfig, ShellStyle, SqlDialectKind, EntityTriggers, TriggerEvent } from './project.js'
+import type { EntityDataSource, RestAdapterConfig, RestSource, ShellConfig, ShellStyle, SqlDialectKind, SqlSource, EntityTriggers, TriggerEvent } from './project.js'
 import { sanitizeClassName, compileTriggerSteps, TRIGGER_EVENTS } from './project.js'
 
 /** Build the createKitHandlers `hooks: {...}` option from an entity's triggers.
@@ -48,7 +48,11 @@ const camel = (name: string): string => {
 }
 
 /** Entity field type -> a TS property type for the generated row type. */
-function tsType(type: EntityFieldType): string {
+function tsType(field: EntityField): string {
+  // A chips/tags editor stores multiple values (string[]) - its seed rows + form
+  // value are arrays, so the row type must be string[] even on a `text` field.
+  if (field.input?.editorType === 'chips') return 'string[]'
+  const type = field.type
   if (type === 'number') return 'number'
   if (type === 'boolean') return 'boolean'
   if (type === 'json') return 'unknown'
@@ -82,8 +86,10 @@ export function namesFor(schema: EntitySchema): Names {
 export const lookupVar = (schema: EntitySchema, field: string) => `${camel(schema.name)}${pascal(field)}Lookup`
 
 function rowType(schema: EntitySchema, derived: Set<string>): string {
-  // Derived columns (relation labels) are filled at runtime, so they're optional.
-  const lines = schema.fields.map((f) => `  ${f.field}${derived.has(f.field) ? '?' : ''}: ${tsType(f.type)}`)
+  // Runtime-filled columns are optional in the row type: relation labels (`derived`)
+  // and computed / no-code-formula fields (not present on seed rows / inserts).
+  const optional = (f: EntityField) => derived.has(f.field) || !!f.formula || !!f.computed
+  const lines = schema.fields.map((f) => `  ${f.field}${optional(f) ? '?' : ''}: ${tsType(f)}`)
   return `export type ${pascal(schema.name)} = {\n${lines.join('\n')}\n}`
 }
 
@@ -293,6 +299,23 @@ function sqlDialectExpr(dialect?: SqlDialectKind): string | null {
 
 const sq = (s: string): string => `'${s.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`
 
+/** The generator name for a REST adapter kind. */
+export function restAdapterImport(a: RestAdapterConfig): string {
+  return a.kind === 'dummyjson' ? 'dummyJsonAdapter' : a.kind === 'jsonServer' ? 'jsonServerAdapter' : 'offsetLimitAdapter'
+}
+/** The adapter spread emitted into the createRestDataSource(...) call - it supplies
+ *  a `buildQuery` (real server paging/sort) + `parse` (row/total unwrap). */
+function restAdapterExpr(a: RestAdapterConfig, T: string): string {
+  if (a.kind === 'dummyjson') return `...dummyJsonAdapter<${T}>(${a.rowsKey ? sq(a.rowsKey) : ''})`
+  if (a.kind === 'jsonServer') return `...jsonServerAdapter<${T}>()`
+  const fields: string[] = []
+  for (const k of ['offsetParam', 'limitParam', 'sortByParam', 'orderParam', 'searchParam', 'rowsKey', 'totalKey'] as const) {
+    const v = a[k]
+    if (v) fields.push(`${k}: ${sq(v)}`)
+  }
+  return `...offsetLimitAdapter<${T}>(${fields.length ? `{ ${fields.join(', ')} }` : ''})`
+}
+
 /** The `createRestDataSource(...)` call for one entity's REST binding. */
 function restStoreExpr(src: RestSource, storeName: string, T: string, schemaVar: string): string {
   const opts: string[] = [`url: ${sq(buildRestUrl(src))}`, `schema: ${schemaVar}`]
@@ -301,7 +324,11 @@ function restStoreExpr(src: RestSource, storeName: string, T: string, schemaVar:
   if (headers.length) opts.push(`headers: { ${headers.map((h) => `${sq(h.name)}: ${sq(h.value ?? '')}`).join(', ')} }`)
   const query = src.params.filter((p) => p.location === 'query' && p.value !== undefined && p.value !== '')
   if (query.length) opts.push(`query: { ${query.map((q) => `${sq(q.name)}: ${sq(q.value ?? '')}`).join(', ')} }`)
-  if (src.rowsPath || src.totalPath) {
+  // An adapter provides both buildQuery (server paging/sort) + parse, so it wins over
+  // the legacy manual rowsPath/totalPath (which only unwraps a single fetched page).
+  if (src.adapter) {
+    opts.push(restAdapterExpr(src.adapter, T))
+  } else if (src.rowsPath || src.totalPath) {
     const rowsExpr = src.rowsPath ? dottedAccess('body', src.rowsPath) : 'body'
     const totalExpr = src.totalPath ? dottedAccess('body', src.totalPath) : `(${rowsExpr})?.length`
     opts.push(`parse: (body: any) => ({ rows: ${rowsExpr} ?? [], rowCount: Number(${totalExpr} ?? 0) })`)
@@ -314,7 +341,7 @@ type DataModuleNeeds = {
   supabaseUrl?: string
   supabaseKey?: string
   /** SQL-bound entities get a connected `+server.ts` API route each. */
-  sqlRoutes: Array<{ schema: EntitySchema; table: string; dialect?: SqlDialectKind }>
+  sqlRoutes: Array<{ schema: EntitySchema; table: string; dialect?: SqlDialectKind; dbSchema?: string }>
   /** Embedded-Postgres (PGlite) entities: one shared client + a table each. */
   pglite?: boolean
   pgliteTables?: Array<{ schema: EntitySchema; table: string; seed?: Record<string, unknown>[] }>
@@ -335,17 +362,19 @@ const SQL_DRIVERS: Record<'postgres' | 'mysql' | 'mssql' | 'sqlite' | 'turso', {
  *  the route imports the shared access policy and rejects unauthorized writes -
  *  server-enforced, so a tampered client can't bypass it. When audit is on, every
  *  successful write is recorded. */
-function sqlRouteFile(schema: EntitySchema, table: string, dialect?: SqlDialectKind, feat: { access?: boolean; audit?: boolean; screenIds?: string[]; triggers?: EntityTriggers } = {}): GeneratedFile {
+function sqlRouteFile(schema: EntitySchema, table: string, dialect?: SqlDialectKind, feat: { access?: boolean; audit?: boolean; screenIds?: string[]; triggers?: EntityTriggers; dbSchema?: string; tenantField?: string } = {}): GeneratedFile {
   const n = namesFor(schema)
   const key = (dialect === 'supabase' ? 'postgres' : (dialect ?? 'postgres')) as 'postgres' | 'mysql' | 'mssql' | 'sqlite' | 'turso'
   const driver = SQL_DRIVERS[key]
   const dialectLiteral = sqlDialectExpr(dialect)
   const accessImport = feat.access ? `\nimport { authorizeAction, getServerRole } from '$lib/access'` : ''
   const auditImport = feat.audit ? `\nimport { recordAudit } from '$lib/audit'` : ''
+  const tenantImport = feat.tenantField ? `\nimport { requireTenant } from '$lib/server/tenant'` : ''
   // Every connected route validates writes against the schema server-side, and
   // (when enabled) authorizes them by role + records an audit entry.
   const opts = [`schema: ${n.schemaVar}`, `source`, `validate: true`]
   if (feat.access) opts.push(`// Server-enforced RBAC: the caller's role comes from the session (event.locals). Reads\n  // are allowed only if the role can open one of this entity's own screens.\n  authorize: ({ action, event }) => authorizeAction(getServerRole(event), action, ${JSON.stringify(feat.screenIds ?? [])})`)
+  if (feat.tenantField) opts.push(`// Multi-tenancy, enforced server-side: reads are filtered to the caller's tenant,\n  // creates are stamped with it, and update/delete re-read the target under the\n  // scope first - so a guessed id cannot reach another tenant's row.\n  scope: ({ event }) => ({ field: ${JSON.stringify(feat.tenantField)}, value: requireTenant(event) })`)
   if (feat.audit) opts.push(`// Record every successful write to the audit trail.\n  audit: (e) => recordAudit({ entity: ${JSON.stringify(schema.name)}, action: e.action, recordId: e.id, values: e.values as Record<string, unknown> | undefined, actor: String(e.event.locals?.role ?? e.event.locals?.user ?? 'system') })`)
   // Server-enforced business rules: the entity's triggers compiled to lifecycle hooks.
   const hooks = triggerHooksOpt(feat.triggers)
@@ -357,13 +386,13 @@ function sqlRouteFile(schema: EntitySchema, table: string, dialect?: SqlDialectK
     contents: `${driver.imports}
 import { env } from '$env/dynamic/private'
 import { createKitHandlers, createSqlDataSource } from '@svgrid/enterprise'
-import { ${n.schemaVar}, type ${n.type} } from '$lib/schemas'${accessImport}${auditImport}
+import { ${n.schemaVar}, type ${n.type} } from '$lib/schemas'${accessImport}${auditImport}${tenantImport}
 
 ${driver.setup}
 
 const source = createSqlDataSource<${n.type}>({
   schema: ${n.schemaVar},
-  table: ${JSON.stringify(table)},${dialectLiteral ? `\n  dialect: ${dialectLiteral},` : ''}
+  table: ${JSON.stringify(table)},${feat.dbSchema ? `\n  dbSchema: ${JSON.stringify(feat.dbSchema)},` : ''}${dialectLiteral ? `\n  dialect: ${dialectLiteral},` : ''}
   execute: async (text, params) => {
     ${driver.exec}
   },
@@ -418,10 +447,89 @@ async function _pgSeed(table: string, rows: Record<string, unknown>[], cols: str
 `
 }
 
+// ---------------------------------------------------------------------------
+// db/schema.sql + db/seed.sql - plain SQL a user runs against their database
+// before first deploy, for SQL entities WITHOUT the Drizzle data layer (which
+// owns DDL via migrations when active). This closes the "tables must already
+// exist" cliff on every dialect - including MSSQL, which Drizzle can't cover.
+// ---------------------------------------------------------------------------
+
+type DdlDialect = 'postgres' | 'mysql' | 'sqlite' | 'mssql'
+
+/** Normalize a source dialect to a DDL family (supabase = postgres, turso = sqlite). */
+const ddlDialect = (d?: SqlDialectKind): DdlDialect =>
+  d === 'mysql' ? 'mysql' : d === 'sqlite' || d === 'turso' ? 'sqlite' : d === 'mssql' ? 'mssql' : 'postgres'
+
+/** Column types per dialect (default column type = the `text` entry). */
+const DDL_COL_TYPES: Record<DdlDialect, Record<string, string>> = {
+  postgres: { text: 'text', number: 'double precision', boolean: 'boolean', date: 'date', dateString: 'date', datetime: 'timestamptz', json: 'jsonb' },
+  mysql: { text: 'varchar(255)', number: 'double', boolean: 'tinyint(1)', date: 'date', dateString: 'date', datetime: 'datetime', json: 'json' },
+  sqlite: { text: 'text', number: 'real', boolean: 'integer', date: 'text', dateString: 'text', datetime: 'text', json: 'text' },
+  mssql: { text: 'nvarchar(255)', number: 'float', boolean: 'bit', date: 'date', dateString: 'date', datetime: 'datetime2', json: 'nvarchar(max)' },
+}
+
+/** Identifier quoter per dialect (doubles the quote char to escape, like sql.ts). */
+function ddlQuoter(dialect: DdlDialect): (name: string) => string {
+  const q = dialect === 'mysql' ? '`' : '"'
+  return (name) => `${q}${name.replaceAll(q, q + q)}${q}`
+}
+
+/** A SQL literal for a seed value, per dialect. */
+function ddlLiteral(v: unknown, dialect: DdlDialect): string {
+  if (v == null || v === '') return 'NULL'
+  if (typeof v === 'number') return Number.isFinite(v) ? String(v) : 'NULL'
+  if (typeof v === 'boolean') return dialect === 'postgres' ? (v ? 'TRUE' : 'FALSE') : v ? '1' : '0'
+  const s = typeof v === 'object' ? JSON.stringify(v) : String(v)
+  const escaped = s.replaceAll("'", "''")
+  return dialect === 'mssql' ? `N'${escaped}'` : `'${escaped}'`
+}
+
+/** `db/schema.sql` + `db/seed.sql` for the project's SQL-bound entities. */
+export function sqlDdlFiles(schemas: EntitySchema[], sources: Record<string, EntityDataSource>): GeneratedFile[] {
+  const { entries, seed } = prepareEntities(schemas)
+  const sqlEntries = entries
+    .map((e) => ({ ...e, src: sources[e.schema.name] }))
+    .filter((e): e is Prepared & { src: SqlSource } => e.src?.kind === 'sql')
+  if (sqlEntries.length === 0) return []
+
+  const create: string[] = []
+  const inserts: string[] = []
+  for (const { schema, infos, src } of sqlEntries) {
+    const dialect = ddlDialect(src.dialect)
+    const q = ddlQuoter(dialect)
+    const types = DDL_COL_TYPES[dialect]
+    const pk = resolveIdField(schema)
+    // Relation display fields are filled at runtime (labels), not stored.
+    const display = new Set(infos.map((i) => i.displayField))
+    const cols = schema.fields.filter((f) => !display.has(f.field) && !f.formula && !f.computed)
+    const colDefs = cols.map((f) => `  ${q(f.field)} ${types[f.type] ?? types.text}${f.field === pk ? ' PRIMARY KEY' : ''}`)
+    const body = `CREATE TABLE ${dialect === 'mssql' ? '' : 'IF NOT EXISTS '}${q(src.table)} (\n${colDefs.join(',\n')}\n)`
+    create.push(dialect === 'mssql' ? `IF OBJECT_ID(N'${src.table.replaceAll("'", "''")}', N'U') IS NULL\n${body};` : `${body};`)
+
+    const rows = seed.get(schema.name) ?? []
+    if (rows.length) {
+      const names = cols.map((f) => q(f.field)).join(', ')
+      const values = rows.map((r) => `  (${cols.map((f) => ddlLiteral(r[f.field], dialect)).join(', ')})`).join(',\n')
+      inserts.push(`INSERT INTO ${q(src.table)} (${names}) VALUES\n${values};`)
+    }
+  }
+
+  const header = (what: string) =>
+    `-- ${what} for the app's SQL entities. Generated by SvGrid Studio.\n` +
+    `-- Run against the database your DATABASE_URL points at (psql/mysql/sqlite3/sqlcmd,\n` +
+    `-- or your provider's SQL console) before first use. Tip: the Drizzle data layer\n` +
+    `-- replaces this file with real, versioned migrations.\n\n`
+  return [
+    { path: 'db/schema.sql', description: 'CREATE TABLE statements for the SQL entities (run once against your database).', contents: header('Table definitions') + create.join('\n\n') + '\n' },
+    ...(inserts.length ? [{ path: 'db/seed.sql', description: 'Optional sample rows for the SQL entities.', contents: header('Sample seed rows (optional)') + inserts.join('\n\n') + '\n' }] : []),
+  ]
+}
+
 function dataModule(
   entries: Prepared[],
   seed: Map<string, Array<Record<string, unknown>>>,
   sources?: Record<string, EntityDataSource>,
+  supabaseConn?: { url?: string; key?: string },
 ): { file: GeneratedFile; needs: DataModuleNeeds } {
   const schemas = entries.map((e) => e.schema)
   // Each type gets its own `type` keyword - SvelteKit enables verbatimModuleSyntax.
@@ -442,15 +550,17 @@ function dataModule(
       switch (src.kind) {
         case 'rest':
           entImports.add('createRestDataSource')
+          if (src.adapter) entImports.add(restAdapterImport(src.adapter))
           return restStoreExpr(src, store, T, sv)
         case 'sql':
           // SQL runs server-side: the client talks to a generated /api/<entity> route.
           entImports.add('createKitDataSource')
-          needs.sqlRoutes.push({ schema: e.schema, table: src.table, dialect: src.dialect })
+          needs.sqlRoutes.push({ schema: e.schema, table: src.table, dialect: src.dialect, dbSchema: src.schema })
           return `const ${store} = createKitDataSource<${T}>({ endpoint: '/api/${namesFor(e.schema).route}' })`
         case 'supabase':
           entImports.add('createSupabaseDataSource')
           needs.supabase = true
+          // Per-entity url/key overrides the project-level connection for the .env hint.
           if (src.url && src.key && !needs.supabaseUrl) { needs.supabaseUrl = src.url; needs.supabaseKey = src.key }
           return `const ${store} = createSupabaseDataSource<${T}>({ client: supabaseClient, table: ${sq(src.table)}, schema: ${sv} })`
         case 'pglite': {
@@ -495,6 +605,11 @@ function dataModule(
     })
     .join('\n')
 
+  // Project-level connection fills the .env hint when no entity carries its own url/key.
+  if (needs.supabase && !needs.supabaseUrl && (supabaseConn?.url || supabaseConn?.key)) {
+    needs.supabaseUrl = supabaseConn.url
+    needs.supabaseKey = supabaseConn.key
+  }
   const connImportLine = needs.supabase ? `\nimport { supabaseClient } from './connections'` : ''
   const pgliteImportLine = needs.pglite ? `\nimport { PGlite } from '@electric-sql/pglite'` : ''
   const pgliteBoot = needs.pglite ? pgliteBootstrap(needs.pgliteTables!, seed) + '\n' : ''
@@ -523,27 +638,30 @@ export const nextId = (prefix: string) => \`\${prefix}\${++seq}\`
   return { file, needs }
 }
 
-/** The connection stubs for SQL / Supabase sources - the one manual wiring step. */
+/** The Supabase client wiring. Reads the project URL + anon key from PUBLIC_ env vars
+ *  (never inlined into source); the anon key is public / browser-safe, so this is a
+ *  secret-hygiene win and matches SvelteKit convention. The designer-entered values are
+ *  shown as a comment so they can be pasted straight into `.env` / `.env.example`. */
 function connectionsModule(needs: DataModuleNeeds): GeneratedFile {
-  const realSupabase = !!(needs.supabaseUrl && needs.supabaseKey)
-  const valueImport = realSupabase ? `import { createClient } from '@supabase/supabase-js'\n` : ''
-  const body = realSupabase
-    ? `/**
- * Supabase client. The anon key is public (browser-safe) - access is protected
- * by your Row Level Security policies. Requires \`@supabase/supabase-js\`
- * (\`npm i @supabase/supabase-js\`).
- */
-export const supabaseClient = createClient(${sq(needs.supabaseUrl!)}, ${sq(needs.supabaseKey!)}) as unknown as SupabaseClientLike`
-    : `/**
- * TODO: connect Supabase. Add your project URL + anon key in the Studio designer,
- * or replace this null stub with a real client:
- * \`import { createClient } from '@supabase/supabase-js'; export const supabaseClient = createClient(url, anonKey)\`.
- */
-export const supabaseClient = null as unknown as SupabaseClientLike`
+  const hint = needs.supabaseUrl || needs.supabaseKey
+    ? `// From the Studio designer - paste into .env:\n//   PUBLIC_SUPABASE_URL=${needs.supabaseUrl ?? ''}\n//   PUBLIC_SUPABASE_ANON_KEY=${needs.supabaseKey ?? ''}\n`
+    : `// Set PUBLIC_SUPABASE_URL and PUBLIC_SUPABASE_ANON_KEY in .env (see .env.example).\n`
   return {
     path: 'src/lib/connections.ts',
-    description: 'Supabase client for Supabase-bound entities.',
-    contents: `${valueImport}import type { SupabaseClientLike } from '@svgrid/enterprise'\n\n${body}\n`,
+    description: 'Supabase client for Supabase-bound entities (reads PUBLIC_SUPABASE_* env vars).',
+    contents: `import { createClient } from '@supabase/supabase-js'
+import { env } from '$env/dynamic/public'
+import type { SupabaseClientLike } from '@svgrid/enterprise'
+
+/**
+ * Supabase client. The anon key is public (browser-safe) - access is protected by
+ * your Row Level Security policies. Requires \`@supabase/supabase-js\`.
+ */
+${hint}export const supabaseClient = createClient(
+  env.PUBLIC_SUPABASE_URL ?? '',
+  env.PUBLIC_SUPABASE_ANON_KEY ?? '',
+) as unknown as SupabaseClientLike
+`,
   }
 }
 
@@ -580,7 +698,7 @@ export function entityScreenPage(schema: EntitySchema, route?: string, title?: s
 
 export type NavItem = { href: string; label: string; id?: string }
 
-export function layoutFile(nav: NavItem[], opts: { accent?: string; shell?: ShellConfig; title?: string; themeVars?: Record<string, string>; lightVars?: Record<string, string>; darkVars?: Record<string, string>; dark?: boolean; access?: boolean; auth?: boolean; authRoutes?: string[]; authAccount?: boolean; i18n?: boolean; appClass?: string } = {}): GeneratedFile {
+export function layoutFile(nav: NavItem[], opts: { accent?: string; shell?: ShellConfig; title?: string; themeVars?: Record<string, string>; lightVars?: Record<string, string>; darkVars?: Record<string, string>; dark?: boolean; access?: boolean; auth?: boolean; supabaseAuth?: boolean; authRoutes?: string[]; authAccount?: boolean; i18n?: boolean; appClass?: string } = {}): GeneratedFile {
   // Nav is the app's own screens; `/` just redirects to the first one, so no separate
   // "Home" link (it would duplicate the first screen).
   const links = nav
@@ -621,7 +739,7 @@ export function layoutFile(nav: NavItem[], opts: { accent?: string; shell?: Shel
 
   // i18n: translate nav labels via `nav.<id>` keys (Home has no id -> literal).
   const navLabel = opts.i18n ? `{item.id ? $t('nav.' + item.id, item.label) : item.label}` : '{item.label}'
-  const anchor = `<a class="sv-app__link" class:is-active={$page.url.pathname === item.href} href={item.href}>${navLabel}</a>`
+  const anchor = `<a class="sv-app__link" class:is-active={page.url.pathname === item.href} href={item.href}>${navLabel}</a>`
   // When RBAC is on, hide nav links the current role can't open.
   const linkGate = opts.access
     ? `{#if !item.id || canScreen($currentRole, item.id)}${anchor}{/if}`
@@ -736,7 +854,9 @@ export function layoutFile(nav: NavItem[], opts: { accent?: string; shell?: Shel
               <button type="button" class="sv-app__menu-item" role="menuitem" onclick={() => (menuOpen = false)}>Settings</button>`}
               ${opts.auth
                 ? `<form method="POST" action="/logout" class="sv-app__signout"><button type="submit" class="sv-app__menu-item sv-app__menu-item--danger" role="menuitem">Sign out</button></form>`
-                : `<button type="button" class="sv-app__menu-item sv-app__menu-item--danger" role="menuitem" onclick={() => (menuOpen = false)}>Sign out</button>`}
+                : opts.supabaseAuth
+                  ? '' // Supabase Auth: the real sign-out lives on SvAuthGate's own bar, so no placeholder here.
+                  : `<button type="button" class="sv-app__menu-item sv-app__menu-item--danger" role="menuitem" onclick={() => (menuOpen = false)}>Sign out</button>`}
             </div>
           {/if}
         </div>
@@ -744,9 +864,17 @@ export function layoutFile(nav: NavItem[], opts: { accent?: string; shell?: Shel
       {#if bellOpen || menuOpen}<button type="button" class="sv-app__scrim" tabindex="-1" aria-label="Close menus" onclick={() => { bellOpen = false; menuOpen = false }}></button>{/if}
     </div>\n    `
     : ''
+  // Supabase Auth: gate the whole app behind a client-side sign-in. SvAuthGate shows
+  // the sign-in form when signed out, and the app + a "signed in as … / Sign out" bar
+  // when signed in. Reads the shared client from $lib/connections.
+  const content = opts.supabaseAuth
+    ? `<SvAuthGate client={supabaseClient as unknown as SupabaseAuthClientLike} title={\`Sign in to \${brand}\`}>
+        {@render children()}
+      </SvAuthGate>`
+    : `{@render children()}`
   const mainMarkup = `<main class="sv-app__main">
     ${toolbarMarkup}<div class="sv-app__content">
-      {@render children()}
+      ${content}
     </div>
   </main>`
 
@@ -842,14 +970,14 @@ export function layoutFile(nav: NavItem[], opts: { accent?: string; shell?: Shel
     contents: `<script lang="ts">
   import '../app.css'
   import '../custom.css'
-  import { page } from '$app/stores'${opts.access ? `\n  import { currentRole, canScreen } from '$lib/access'` : ''}${opts.i18n ? `\n  import { t, currentLocale, locales } from '$lib/i18n'` : ''}${opts.auth ? `\n  import type { LayoutData } from './$types'` : ''}
+  import { page } from '$app/state'${opts.access ? `\n  import { currentRole, canScreen } from '$lib/access'` : ''}${opts.i18n ? `\n  import { t, currentLocale, locales } from '$lib/i18n'` : ''}${opts.auth ? `\n  import type { LayoutData } from './$types'` : ''}${opts.supabaseAuth ? `\n  import { SvAuthGate, type SupabaseAuthClientLike } from '@svgrid/enterprise'\n  import { supabaseClient } from '$lib/connections'` : ''}
 
   let { children${opts.auth ? ', data' : ''} }${opts.auth ? ": { children: import('svelte').Snippet; data: LayoutData }" : ''} = $props()
   const nav = ${JSON.stringify(links)}
   const brand = ${JSON.stringify(brand)}${footConst}${logoConst}
   let navOpen = $state(false)${opts.auth && opts.access ? `\n  // Seed the client role store from the signed-in session (server-resolved).\n  $effect(() => { if (data?.role) currentRole.set(data.role as never) })` : ''}
   // Close the mobile drawer whenever the route changes.
-  $effect(() => { void $page.url.pathname; navOpen = false })${hasSwitch ? `
+  $effect(() => { void page.url.pathname; navOpen = false })${hasSwitch ? `
   // Light/dark switcher: defaults to the mode picked in Studio, then honours the
   // visitor's saved choice. Applies via [data-theme] on <html> (see the token
   // sets in <svelte:head>), and persists per browser.
@@ -888,11 +1016,11 @@ export function layoutFile(nav: NavItem[], opts: { accent?: string; shell?: Shel
     return () => window.removeEventListener('keydown', onKey)
   })
   // Close both menus on route change.
-  $effect(() => { void $page.url.pathname; bellOpen = false; menuOpen = false })` : ''}
+  $effect(() => { void page.url.pathname; bellOpen = false; menuOpen = false })` : ''}
 </script>
 ${themeHead}
 
-${opts.auth ? `{#if ${JSON.stringify(opts.authRoutes ?? ['/login'])}.includes($page.url.pathname)}
+${opts.auth ? `{#if ${JSON.stringify(opts.authRoutes ?? ['/login'])}.includes(page.url.pathname)}
 {@render children()}
 {:else}
 ${body}
@@ -1011,13 +1139,26 @@ export function prepareEntities(schemas: EntitySchema[]): { entries: Prepared[];
 /** Emit the shared entity modules: `src/lib/schemas.ts` + `src/lib/data.ts` (+ `connections.ts`). */
 export function emitEntityModules(
   schemas: EntitySchema[],
-  opts: { sources?: Record<string, EntityDataSource>; accessEnabled?: boolean; auditEnabled?: boolean; screensByEntity?: Map<string, string[]>; triggers?: Record<string, EntityTriggers> } = {},
+  opts: { sources?: Record<string, EntityDataSource>; accessEnabled?: boolean; auditEnabled?: boolean; screensByEntity?: Map<string, string[]>; triggers?: Record<string, EntityTriggers>; supabaseConn?: { url?: string; key?: string }; supabaseAuth?: boolean; tenantField?: string; tenantScoped?: (entity: string) => boolean } = {},
 ): { files: GeneratedFile[]; prepared: EntitySchema[] } {
   const { entries, seed } = prepareEntities(schemas)
-  const { file: data, needs } = dataModule(entries, seed, opts.sources)
+  const { file: data, needs } = dataModule(entries, seed, opts.sources, opts.supabaseConn)
   const files: GeneratedFile[] = [schemasModule(entries), data]
-  if (needs.supabase) files.push(connectionsModule(needs))
-  for (const r of needs.sqlRoutes) files.push(sqlRouteFile(r.schema, r.table, r.dialect, { access: opts.accessEnabled, audit: opts.auditEnabled, screenIds: opts.screensByEntity?.get(r.schema.name) ?? [], triggers: opts.triggers?.[r.schema.name] }))
+  // Supabase Auth needs the shared client even with no Supabase-bound entity; seed
+  // the .env paste hint from the project connection when nothing else did.
+  if ((needs.supabase || opts.supabaseAuth) && !needs.supabaseUrl && (opts.supabaseConn?.url || opts.supabaseConn?.key)) {
+    needs.supabaseUrl = opts.supabaseConn.url; needs.supabaseKey = opts.supabaseConn.key
+  }
+  if (needs.supabase || opts.supabaseAuth) files.push(connectionsModule(needs))
+  for (const r of needs.sqlRoutes) files.push(sqlRouteFile(r.schema, r.table, r.dialect, {
+    access: opts.accessEnabled,
+    audit: opts.auditEnabled,
+    screenIds: opts.screensByEntity?.get(r.schema.name) ?? [],
+    triggers: opts.triggers?.[r.schema.name],
+    dbSchema: r.dbSchema,
+    // A shared (reference-data) entity stays global - no scope on its route.
+    tenantField: opts.tenantField && opts.tenantScoped?.(r.schema.name) !== false ? opts.tenantField : undefined,
+  }))
   return { files, prepared: entries.map((e) => e.schema) }
 }
 

package/src/studio/index.ts

@@ -8,6 +8,7 @@ export { inferType, introspectJson, introspectDrizzle, introspectDrizzleAll } fr
 export { refineField, refineFields } from '../sources/field-inference.js'
 export { parseCsv, detectDelimiter, csvToEntity, type CsvEntity } from './csv.js'
 export { introspectPrisma, introspectPrismaAll } from './introspect-prisma.js'
+export { introspectOpenApi, type OpenApiImport } from './introspect-openapi.js'
 export {
   introspectDatabase,
   listDatabaseTables,
@@ -39,9 +40,37 @@ export {
 } from './scaffold.js'
 export { scaffoldApp, type ScaffoldAppOptions } from './scaffold-app.js'
 export { emitStudioApp, emitEntityModules, entityScreenPage, prepareEntities } from './emit-schema.js'
-export { emitStudioProject, emitStudioAppBundle, studioDeployInfo, screenHandles, screenDataset, ctxCompletions, componentHandleMembers, ctxAmbientDts, GRID_API_MEMBERS, type BlockHandle, type HandleTier } from './emit-project.js'
+export { emitStudioProject, emitStudioAppBundle, emitStudioFragment, runtimeDeps, studioDeployInfo, screenHandles, screenDataset, ctxCompletions, componentHandleMembers, ctxAmbientDts, GRID_API_MEMBERS, type BlockHandle, type HandleTier } from './emit-project.js'
 export { sampleApps, getSampleApp, type SampleApp } from './samples/index.js'
+export { starterProject } from './samples/starter.js'
 export { liveDataSamples, getLiveDataSample } from './samples/live-data.js'
+export { starterDatasets, getStarterDataset, type StarterDataset } from './samples/datasets.js'
+export {
+  runStudioInit,
+  parseSelection,
+  type PromptIO,
+  type DbGateway,
+  type FetchText,
+  type InitFlags,
+  type InitResult,
+} from './init-flow.js'
+export {
+  crudSuiteScreens,
+  addCrudSuite,
+  crudAppFromSchemas,
+  listScreen,
+  formScreen,
+  detailScreen,
+  dashScreen,
+  statusPills,
+  gridConfig,
+  type CrudScreenKind,
+  type CrudEditingMode,
+  type CrudSuiteOptions,
+  type CrudAppOptions,
+  type GridOpts,
+  type Tile,
+} from './screen-suites.js'
 export {
   sanitizeStudioProject,
   buildStudioBugReport,
@@ -132,10 +161,23 @@ export {
   type TriggerStep,
   type TriggerEvent,
   type EntityTriggers,
+  setJob,
+  type ScheduledJob,
+  type ScheduledJobKind,
+  setTenancy,
+  tenantField,
+  isTenantScoped,
+  type TenancyConfig,
   clickSlot,
+  ssrScreenShape,
+  ssrEligible,
+  setScreenRenderMode,
+  eventSlot,
   rowSelectSlot,
   changeSlot,
   FORM_SUBMIT,
+  GRID_EVENTS,
+  type GridEventDef,
   addStateVar,
   updateStateVar,
   removeStateVar,
@@ -263,6 +305,7 @@ export {
   type EntityDataSource,
   type MemorySource,
   type RestSource,
+  type RestAdapterConfig,
   type SqlSource,
   type SupabaseSource,
   type PgliteSource,
@@ -288,10 +331,25 @@ export {
 export {
   UI_COMPONENT_REGISTRY,
   uiComponentSpec,
+  gridPropSurface,
+  gridApiSettableProps,
+  GRID_CURATED_PROPS,
+  STANDARD_UI_EVENTS,
   type UiPropType,
+  type UiPropGroup,
+  type UiComponentEvent,
   type UiComponentProp,
   type UiComponentSpec,
 } from './ui-components.js'
+export { buildCopilotMessages, projectFromModelText, type CopilotMessages } from './copilot-core.js'
+export {
+  resolveDeployTarget,
+  deployCommands,
+  missingEnvKeys,
+  type DeployProvider,
+  type DeployResolution,
+  type DeployPlanCommands,
+} from './deploy-cli.js'
 export {
   runStudioAdd,
   runStudioAddApp,