agentlink-sh 0.26.0 → 0.28.0

package/README.md

@@ -6,28 +6,10 @@ Teach AI agents the right way to build on Supabase.
 
 ## Install & Run
 
-### macOS
+Install cli globally.
 
 ```bash
-curl -fsSL https://agentlink.sh/install | sh
-```
-
-### Linux
-
-```bash
-wget -qO- https://agentlink.sh/install | sh
-```
-
-### Windows (PowerShell)
-
-```powershell
-irm https://agentlink.sh/install.ps1 | iex
-```
-
-### npx (any platform with Node.js 18+)
-
-```bash
-npx agentlink-sh@latest
+npm i -g agentlink-sh@latest
 ```
 
 Or run directly with npx (requires Node.js 18+):
@@ -36,8 +18,6 @@ Or run directly with npx (requires Node.js 18+):
 npx agentlink-sh@latest
 ```
 
-The install scripts automatically detect your OS, install Node.js if needed, and set up the CLI globally.
-
 ## Quick start
 
 ```bash
@@ -312,7 +292,7 @@ Apply one or more server-side config sections to a cloud env. The three subsyste
 
 | Subcommand | What it does |
 |-----------|--------------|
-| `secrets` | Seed Vault (`SUPABASE_URL` / `SUPABASE_PUBLISHABLE_KEY` / `SUPABASE_SECRET_KEY`) **and** mirror to edge-function secrets under `SB_*` prefix (set-if-absent — user-set custom values survive). |
+| `secrets` | Seed Vault (`SUPABASE_URL` / `SUPABASE_PUBLISHABLE_KEY` / `SUPABASE_SECRET_KEY`). Edge functions read the platform-injected `SUPABASE_*` env vars directly — no `SB_*` mirror. |
 | `db` | PATCH PostgREST to expose the `api` schema. |
 | `auth` | PATCH auth config (hooks + signup settings). |
 | `all` | Run all three in order. |
@@ -392,7 +372,7 @@ agentlink db rebuild              # Wipes migrations, re-applies schemas, create
 
 The scaffold runs a multi-step process:
 
-1. **Prerequisites** — Checks for Supabase CLI, pg-delta, and psql
+1. **Prerequisites** — Supabase CLI and pgdelta come bundled with `agentlink-sh` (no manual install). Local mode also checks for psql and Docker.
 2. **Configure files** — Writes template files, `config.toml`, and `.env.local`
 3. **Start Supabase** — Starts locally (Docker) or creates a Cloud project
 4. **Read config** — Reads Supabase API keys and connection info

package/dist/{chunk-7NV5CYOF.js → chunk-DFDS5V5Z.js}

@@ -5,7 +5,7 @@ import {
   loadProjectCredential,
   resolvePoolerDbUrl,
   saveProjectCredential
-} from "./chunk-4CW46BPC.js";
+} from "./chunk-K5XVJEHP.js";
 import {
   ensureGitignorePattern,
   runCommand
@@ -20,7 +20,7 @@ import {
 import {
   pgd,
   sb
-} from "./chunk-DM6KG5YU.js";
+} from "./chunk-ILLYV7U7.js";
 
 // src/db.ts
 import fs3 from "fs";
@@ -212,7 +212,7 @@ import fs2 from "fs";
 import path2 from "path";
 
 // src/sql/check_setup.sql
-var check_setup_default = "SELECT jsonb_build_object(\n  'extensions', jsonb_build_object(\n    'pg_net',  EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_net'),\n    'pg_cron', EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_cron'),\n    'vault',   EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'supabase_vault'),\n    'pgmq',    EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pgmq'),\n    -- pg_graphql must be dropped to enforce schema isolation (reported true when absent)\n    'pg_graphql_dropped', NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_graphql')\n  ),\n  'queues', jsonb_build_object(\n    'agentlink_tasks', EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'pgmq' AND table_name = 'q_agentlink_tasks'\n    )\n  ),\n  'tables', jsonb_build_object(\n    'profiles', EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'profiles'\n    ),\n    'tenants', EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'tenants'\n    ),\n    'memberships', EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'memberships'\n    ),\n    'invitations', EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'invitations'\n    )\n  ),\n  'functions', jsonb_build_object(\n    '_internal_admin_get_secret',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_internal_admin_get_secret'\n      ),\n    '_internal_admin_call_edge_function',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_internal_admin_call_edge_function'\n      ),\n    'api._admin_enqueue_task',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = '_admin_enqueue_task'\n      ),\n    'api._admin_queue_read',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = '_admin_queue_read'\n      ),\n    'api._admin_queue_delete',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = '_admin_queue_delete'\n      ),\n    'api._admin_queue_archive',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = '_admin_queue_archive'\n      ),\n    'set_updated_at',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = 'set_updated_at'\n      ),\n    '_internal_admin_handle_new_user',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_internal_admin_handle_new_user'\n      ),\n    'api.profile_get',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'profile_get'\n      ),\n    'api.profile_update',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'profile_update'\n      ),\n    '_hook_before_user_created',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_hook_before_user_created'\n      ),\n    '_hook_send_email',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_hook_send_email'\n      ),\n    '_auth_tenant_id',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_auth_tenant_id'\n      ),\n    '_auth_tenant_role',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_auth_tenant_role'\n      ),\n    '_auth_has_role',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_auth_has_role'\n      ),\n    '_auth_is_tenant_member',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_auth_is_tenant_member'\n      ),\n    'api.tenant_select',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'tenant_select'\n      ),\n    'api.tenant_list',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'tenant_list'\n      ),\n    'api.tenant_create',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'tenant_create'\n      ),\n    'api.invitation_create',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'invitation_create'\n      ),\n    'api.invitation_accept',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'invitation_accept'\n      ),\n    'api.membership_list',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'membership_list'\n      )\n  ),\n  'triggers', jsonb_build_object(\n    'trg_profiles_updated_at',\n      EXISTS (\n        SELECT 1 FROM pg_trigger WHERE tgname = 'trg_profiles_updated_at'\n      ),\n    'trg_auth_users_new_user',\n      EXISTS (\n        SELECT 1 FROM pg_trigger WHERE tgname = 'trg_auth_users_new_user'\n      ),\n    'trg_tenants_updated_at',\n      EXISTS (\n        SELECT 1 FROM pg_trigger WHERE tgname = 'trg_tenants_updated_at'\n      )\n  ),\n  'secrets', jsonb_build_object(\n    'SUPABASE_URL',\n      EXISTS (SELECT 1 FROM vault.secrets WHERE name = 'SUPABASE_URL'),\n    'SUPABASE_PUBLISHABLE_KEY',\n      EXISTS (SELECT 1 FROM vault.secrets WHERE name = 'SUPABASE_PUBLISHABLE_KEY'),\n    'SUPABASE_SECRET_KEY',\n      EXISTS (SELECT 1 FROM vault.secrets WHERE name = 'SUPABASE_SECRET_KEY')\n  ),\n  'api_schema', EXISTS (\n    SELECT 1 FROM information_schema.schemata WHERE schema_name = 'api'\n  ),\n  'api_schema_anon_usage',\n    has_schema_privilege('anon', 'api', 'USAGE'),\n  'ready', (\n    EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_net')\n    AND EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_cron')\n    AND EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'supabase_vault')\n    AND EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pgmq')\n    AND NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_graphql')\n    AND EXISTS (SELECT 1 FROM information_schema.schemata WHERE schema_name = 'api')\n    AND has_schema_privilege('anon', 'api', 'USAGE')\n    AND EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'pgmq' AND table_name = 'q_agentlink_tasks'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_internal_admin_get_secret'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_internal_admin_call_edge_function'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = '_admin_enqueue_task'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = '_admin_queue_read'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = '_admin_queue_delete'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = '_admin_queue_archive'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'profiles'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'tenants'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'memberships'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'invitations'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = 'set_updated_at'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_internal_admin_handle_new_user'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'profile_get'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'profile_update'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_hook_before_user_created'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_hook_send_email'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_auth_tenant_id'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_auth_tenant_role'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_auth_has_role'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_auth_is_tenant_member'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'tenant_select'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'tenant_list'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'tenant_create'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'invitation_create'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'invitation_accept'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'membership_list'\n    )\n    AND EXISTS (\n      SELECT 1 FROM pg_trigger WHERE tgname = 'trg_profiles_updated_at'\n    )\n    AND EXISTS (\n      SELECT 1 FROM pg_trigger WHERE tgname = 'trg_auth_users_new_user'\n    )\n    AND EXISTS (\n      SELECT 1 FROM pg_trigger WHERE tgname = 'trg_tenants_updated_at'\n    )\n    AND EXISTS (SELECT 1 FROM vault.secrets WHERE name = 'SUPABASE_URL')\n    AND EXISTS (SELECT 1 FROM vault.secrets WHERE name = 'SUPABASE_PUBLISHABLE_KEY')\n    AND EXISTS (SELECT 1 FROM vault.secrets WHERE name = 'SUPABASE_SECRET_KEY')\n  )\n) AS setup_status;\n";
+var check_setup_default = "SELECT jsonb_build_object(\n  'extensions', jsonb_build_object(\n    'pg_net',  EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_net'),\n    'pg_cron', EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_cron'),\n    'vault',   EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'supabase_vault'),\n    'pgmq',    EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pgmq'),\n    -- pg_graphql must be dropped to enforce schema isolation (reported true when absent)\n    'pg_graphql_dropped', NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_graphql')\n  ),\n  'queues', jsonb_build_object(\n    'agentlink_tasks', EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'pgmq' AND table_name = 'q_agentlink_tasks'\n    )\n  ),\n  'tables', jsonb_build_object(\n    'profiles', EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'profiles'\n    ),\n    'tenants', EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'tenants'\n    ),\n    'memberships', EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'memberships'\n    ),\n    'invitations', EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'invitations'\n    ),\n    'roles', EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'roles'\n    ),\n    'permissions', EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'permissions'\n    ),\n    'role_permissions', EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'role_permissions'\n    ),\n    'session_tenants', EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'session_tenants'\n    )\n  ),\n  'functions', jsonb_build_object(\n    '_internal_admin_get_secret',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_internal_admin_get_secret'\n      ),\n    '_internal_admin_call_edge_function',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_internal_admin_call_edge_function'\n      ),\n    'api._admin_enqueue_task',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = '_admin_enqueue_task'\n      ),\n    'api._admin_queue_read',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = '_admin_queue_read'\n      ),\n    'api._admin_queue_delete',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = '_admin_queue_delete'\n      ),\n    'api._admin_queue_archive',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = '_admin_queue_archive'\n      ),\n    'set_updated_at',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = 'set_updated_at'\n      ),\n    '_internal_admin_handle_new_user',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_internal_admin_handle_new_user'\n      ),\n    'api.profile_get',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'profile_get'\n      ),\n    'api.profile_update',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'profile_update'\n      ),\n    '_hook_before_user_created',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_hook_before_user_created'\n      ),\n    '_hook_custom_access_token',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_hook_custom_access_token'\n      ),\n    '_hook_send_email',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_hook_send_email'\n      ),\n    '_auth_tenant_id',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_auth_tenant_id'\n      ),\n    '_auth_tenant_role',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_auth_tenant_role'\n      ),\n    '_auth_has_role',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_auth_has_role'\n      ),\n    '_auth_has_permission',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_auth_has_permission'\n      ),\n    '_auth_is_tenant_member',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'public'\n          AND routine_name = '_auth_is_tenant_member'\n      ),\n    'api.tenant_select',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'tenant_select'\n      ),\n    'api.tenant_list',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'tenant_list'\n      ),\n    'api.tenant_create',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'tenant_create'\n      ),\n    'api.invitation_create',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'invitation_create'\n      ),\n    'api.invitation_accept',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'invitation_accept'\n      ),\n    'api.membership_list',\n      EXISTS (\n        SELECT 1 FROM information_schema.routines\n        WHERE routine_schema = 'api'\n          AND routine_name = 'membership_list'\n      )\n  ),\n  'triggers', jsonb_build_object(\n    'trg_profiles_updated_at',\n      EXISTS (\n        SELECT 1 FROM pg_trigger WHERE tgname = 'trg_profiles_updated_at'\n      ),\n    'trg_auth_users_new_user',\n      EXISTS (\n        SELECT 1 FROM pg_trigger WHERE tgname = 'trg_auth_users_new_user'\n      ),\n    'trg_tenants_updated_at',\n      EXISTS (\n        SELECT 1 FROM pg_trigger WHERE tgname = 'trg_tenants_updated_at'\n      )\n  ),\n  'secrets', jsonb_build_object(\n    'SUPABASE_URL',\n      EXISTS (SELECT 1 FROM vault.secrets WHERE name = 'SUPABASE_URL'),\n    'SUPABASE_PUBLISHABLE_KEY',\n      EXISTS (SELECT 1 FROM vault.secrets WHERE name = 'SUPABASE_PUBLISHABLE_KEY'),\n    'SUPABASE_SECRET_KEY',\n      EXISTS (SELECT 1 FROM vault.secrets WHERE name = 'SUPABASE_SECRET_KEY')\n  ),\n  'api_schema', EXISTS (\n    SELECT 1 FROM information_schema.schemata WHERE schema_name = 'api'\n  ),\n  'api_schema_anon_usage',\n    has_schema_privilege('anon', 'api', 'USAGE'),\n  'ready', (\n    EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_net')\n    AND EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_cron')\n    AND EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'supabase_vault')\n    AND EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pgmq')\n    AND NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_graphql')\n    AND EXISTS (SELECT 1 FROM information_schema.schemata WHERE schema_name = 'api')\n    AND has_schema_privilege('anon', 'api', 'USAGE')\n    AND EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'pgmq' AND table_name = 'q_agentlink_tasks'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_internal_admin_get_secret'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_internal_admin_call_edge_function'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = '_admin_enqueue_task'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = '_admin_queue_read'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = '_admin_queue_delete'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = '_admin_queue_archive'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'profiles'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'tenants'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'memberships'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'invitations'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'roles'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'permissions'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'role_permissions'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.tables\n      WHERE table_schema = 'public' AND table_name = 'session_tenants'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = 'set_updated_at'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_internal_admin_handle_new_user'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'profile_get'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'profile_update'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_hook_before_user_created'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_hook_custom_access_token'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_hook_send_email'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_auth_tenant_id'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_auth_tenant_role'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_auth_has_role'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_auth_has_permission'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'public' AND routine_name = '_auth_is_tenant_member'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'tenant_select'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'tenant_list'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'tenant_create'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'invitation_create'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'invitation_accept'\n    )\n    AND EXISTS (\n      SELECT 1 FROM information_schema.routines\n      WHERE routine_schema = 'api' AND routine_name = 'membership_list'\n    )\n    AND EXISTS (\n      SELECT 1 FROM pg_trigger WHERE tgname = 'trg_profiles_updated_at'\n    )\n    AND EXISTS (\n      SELECT 1 FROM pg_trigger WHERE tgname = 'trg_auth_users_new_user'\n    )\n    AND EXISTS (\n      SELECT 1 FROM pg_trigger WHERE tgname = 'trg_tenants_updated_at'\n    )\n    AND EXISTS (SELECT 1 FROM vault.secrets WHERE name = 'SUPABASE_URL')\n    AND EXISTS (SELECT 1 FROM vault.secrets WHERE name = 'SUPABASE_PUBLISHABLE_KEY')\n    AND EXISTS (SELECT 1 FROM vault.secrets WHERE name = 'SUPABASE_SECRET_KEY')\n  )\n) AS setup_status;\n";
 
 // src/sql.ts
 function upsertSecret(value, name) {
@@ -295,39 +295,6 @@ function runSQL(sql, dbUrl) {
     child.stdin.end();
   });
 }
-function writeMigrationTemplates(projectDir, templates, baseTimestamp, options) {
-  const dryRun = options?.dryRun ?? false;
-  const migrationsDir = path2.join(projectDir, "supabase", "migrations");
-  if (!dryRun) fs2.mkdirSync(migrationsDir, { recursive: true });
-  const createdVersions = [];
-  const createdFilenames = [];
-  const base = baseTimestamp ?? /* @__PURE__ */ new Date();
-  let offsetSeconds = 0;
-  const existingFiles = fs2.existsSync(migrationsDir) ? fs2.readdirSync(migrationsDir) : [];
-  for (const [name, content] of Object.entries(templates)) {
-    const existing = existingFiles.find((f) => f.endsWith(`_agentlink_${name}.sql`));
-    if (existing) continue;
-    const ts = new Date(base.getTime() + offsetSeconds * 1e3);
-    const version = ts.toISOString().replace(/\D/g, "").slice(0, 14);
-    const filename = `${version}_agentlink_${name}.sql`;
-    if (!dryRun) fs2.writeFileSync(path2.join(migrationsDir, filename), content);
-    createdVersions.push(version);
-    createdFilenames.push(filename);
-    offsetSeconds++;
-  }
-  return { createdVersions, createdFilenames };
-}
-async function repairMigrations(projectDir, versions, local = true, env) {
-  const localFlag = local ? " --local" : "";
-  for (const version of versions) {
-    await runCommand(
-      `${sb()} migration repair ${version} --status applied${localFlag}`,
-      projectDir,
-      void 0,
-      env
-    );
-  }
-}
 function updateConfigToml(projectDir, options) {
   const dryRun = options?.dryRun ?? false;
   const configPath = path2.join(projectDir, "supabase", "config.toml");
@@ -372,6 +339,7 @@ sql_paths = [${seedPath}]
   }
   patches.push(...updateConfigTomlSendEmailHook(projectDir, { dryRun }));
   patches.push(...updateConfigTomlBeforeUserCreatedHook(projectDir, { dryRun }));
+  patches.push(...updateConfigTomlCustomAccessTokenHook(projectDir, { dryRun }));
   patches.push(...updateConfigTomlAuthEmailConfirmations(projectDir, { dryRun }));
   patches.push(...renameInternalEdgeFunctionSections(projectDir, { dryRun }));
   return patches;
@@ -450,7 +418,19 @@ sql_paths = ["./seed.sql", "./seeds/local-secrets.seed.sql"]
 [auth]
 enabled = true
 site_url = "http://127.0.0.1:3000"
-additional_redirect_urls = ["https://127.0.0.1:3000"]
+# Wildcards cover the full canonical auth flow:
+#   /auth/confirm           \u2014 single PKCE callback for signup, magiclink, recovery, email_change
+#   /auth/update-password   \u2014 recovery destination after confirm exchange
+#   /accept-invite          \u2014 workspace invitation acceptance
+#   /auth/check-inbox       \u2014 pending state (no PKCE redirect ever lands here, but allowing
+#                              the prefix prevents accidental denies during dev)
+additional_redirect_urls = [
+  "http://127.0.0.1:3000/**",
+  "http://localhost:3000/**",
+  "http://127.0.0.1:5173/**",
+  "http://localhost:5173/**",
+  "https://127.0.0.1:3000/**",
+]
 jwt_expiry = 3600
 enable_refresh_token_rotation = true
 refresh_token_reuse_interval = 10
@@ -479,6 +459,10 @@ uri = "pg-functions://postgres/public/_hook_send_email"
 enabled = true
 uri = "pg-functions://postgres/public/_hook_before_user_created"
 
+[auth.hook.custom_access_token]
+enabled = true
+uri = "pg-functions://postgres/public/_hook_custom_access_token"
+
 [functions.internal-queue-worker]
 enabled = true
 verify_jwt = false
@@ -529,6 +513,22 @@ uri = "pg-functions://postgres/public/_hook_before_user_created"
   }
   return [];
 }
+function updateConfigTomlCustomAccessTokenHook(projectDir, options) {
+  const dryRun = options?.dryRun ?? false;
+  const configPath = path2.join(projectDir, "supabase", "config.toml");
+  let content = fs2.readFileSync(configPath, "utf-8");
+  if (!content.includes("[auth.hook.custom_access_token]")) {
+    content = content.trimEnd() + `
+
+[auth.hook.custom_access_token]
+enabled = true
+uri = "pg-functions://postgres/public/_hook_custom_access_token"
+`;
+    if (!dryRun) fs2.writeFileSync(configPath, content);
+    return ["auth.hook.custom_access_token: add section"];
+  }
+  return [];
+}
 function updateConfigTomlAuthEmailConfirmations(projectDir, options) {
   const dryRun = options?.dryRun ?? false;
   const configPath = path2.join(projectDir, "supabase", "config.toml");
@@ -788,11 +788,19 @@ async function dbApply(options) {
   }
   const dbUrl = await resolveDbUrl(options.cwd, options.dbUrl);
   if (!options.quiet) console.log("Applying schemas...");
-  await runCommand(
+  const applyOutput = await runCommand(
     `${pgd()} declarative apply --path ./supabase/schemas/ --target ${JSON.stringify(dbUrl)}`,
     options.cwd,
     options.quiet ? void 0 : (line) => console.log(line)
   );
+  if (/^Stuck after \d+ round/m.test(applyOutput)) {
+    if (options.quiet) {
+      console.error(applyOutput);
+    }
+    throw new Error(
+      "pg-delta declarative apply did not complete cleanly \u2014 some statements failed and the database state is inconsistent with supabase/schemas/. Fix the errors listed above (typically duplicate definitions or unresolved references) and re-run."
+    );
+  }
   if (!options.skipTypes) {
     if (!options.quiet) console.log("\nGenerating types...");
     try {
@@ -1038,8 +1046,6 @@ export {
   cloudSeedSQL,
   parseSupabaseStatus,
   runSQL,
-  writeMigrationTemplates,
-  repairMigrations,
   updateConfigToml,
   migrateRenamedEdgeFunctionDirs,
   writeConfigToml,

package/dist/{chunk-DM6KG5YU.js → chunk-ILLYV7U7.js}

@@ -53,6 +53,8 @@ var AUTH_CONFIG = {
   hook_send_email_uri: "pg-functions://postgres/public/_hook_send_email",
   hook_before_user_created_enabled: true,
   hook_before_user_created_uri: "pg-functions://postgres/public/_hook_before_user_created",
+  hook_custom_access_token_enabled: true,
+  hook_custom_access_token_uri: "pg-functions://postgres/public/_hook_custom_access_token",
   external_email_enabled: true,
   enable_signup: true,
   jwt_exp: 3600,
@@ -65,6 +67,11 @@ var AUTH_CONFIG = {
 var AUTH_CONFIG_DEV_OVERRIDES = {
   mailer_autoconfirm: true
 };
+var RESEND_SMTP = {
+  host: "smtp.resend.com",
+  port: "465",
+  user: "resend"
+};
 
 export {
   SUPPORTED_SUPABASE_CLI,
@@ -77,5 +84,6 @@ export {
   pgd,
   POSTGREST_CONFIG,
   AUTH_CONFIG,
-  AUTH_CONFIG_DEV_OVERRIDES
+  AUTH_CONFIG_DEV_OVERRIDES,
+  RESEND_SMTP
 };

package/dist/{chunk-4CW46BPC.js → chunk-K5XVJEHP.js}

@@ -13,7 +13,7 @@ import {
 } from "./chunk-MHI6VJ75.js";
 import {
   sb
-} from "./chunk-DM6KG5YU.js";
+} from "./chunk-ILLYV7U7.js";
 
 // src/cloud.ts
 import fs from "fs";
@@ -77,7 +77,7 @@ async function refreshIfNeeded(entry) {
   }
   if (!entry.refresh_token) return null;
   try {
-    const { refreshOAuthToken } = await import("./oauth-JGWRORJM.js");
+    const { refreshOAuthToken } = await import("./oauth-2QHJGBWP.js");
     const tokens = await refreshOAuthToken(entry.refresh_token);
     return {
       ...entry,
@@ -313,7 +313,7 @@ async function ensureAccessToken(opts = {}) {
     ]
   });
   if (method === "oauth") {
-    const { oauthLogin } = await import("./oauth-JGWRORJM.js");
+    const { oauthLogin } = await import("./oauth-2QHJGBWP.js");
     const tokens = await oauthLogin({ organizationSlug: orgSlug });
     process.env.SUPABASE_ACCESS_TOKEN = tokens.access_token;
     let derivedOrg;
@@ -586,6 +586,18 @@ async function updateAuthConfig(projectRef, config) {
     throw new Error(`Failed to update auth config (${res.status}): ${body}`);
   }
 }
+async function getAuthConfig(projectRef) {
+  try {
+    const res = await authenticatedFetch(
+      `https://api.supabase.com/v1/projects/${projectRef}/config/auth`,
+      { method: "GET" }
+    );
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
 async function waitForProjectReady(ref, spinner, timeoutMs = 3e5) {
   const start = Date.now();
   while (Date.now() - start < timeoutMs) {
@@ -771,6 +783,7 @@ export {
   runCloudSQL,
   updatePostgrestConfig,
   updateAuthConfig,
+  getAuthConfig,
   waitForProjectReady,
   waitForDatabaseReady,
   fetchPoolerUrl,

package/dist/{cloud-ZXVJMV5Q.js → cloud-L4LRFCKV.js}

@@ -9,6 +9,7 @@ import {
   ensureAccessToken,
   fetchPoolerUrl,
   getApiKeys,
+  getAuthConfig,
   getProject,
   getProjectOrg,
   listOrganizations,
@@ -35,10 +36,10 @@ import {
   updatePostgrestConfig,
   waitForDatabaseReady,
   waitForProjectReady
-} from "./chunk-4CW46BPC.js";
+} from "./chunk-K5XVJEHP.js";
 import "./chunk-IV5ZSOKF.js";
 import "./chunk-MHI6VJ75.js";
-import "./chunk-DM6KG5YU.js";
+import "./chunk-ILLYV7U7.js";
 export {
   authenticatedFetch,
   clearOrgCredential,
@@ -49,6 +50,7 @@ export {
   ensureAccessToken,
   fetchPoolerUrl,
   getApiKeys,
+  getAuthConfig,
   getProject,
   getProjectOrg,
   listOrganizations,

package/dist/{constants-PWT7TUWD.js → constants-TCRAHGH6.js}

@@ -5,19 +5,21 @@ import {
   OAUTH_CLIENT_ID,
   OAUTH_CLIENT_SECRET,
   POSTGREST_CONFIG,
+  RESEND_SMTP,
   SUPPORTED_PGDELTA,
   SUPPORTED_SUPABASE_CLI,
   pgd,
   pgdeltaBin,
   sb,
   supabaseBin
-} from "./chunk-DM6KG5YU.js";
+} from "./chunk-ILLYV7U7.js";
 export {
   AUTH_CONFIG,
   AUTH_CONFIG_DEV_OVERRIDES,
   OAUTH_CLIENT_ID,
   OAUTH_CLIENT_SECRET,
   POSTGREST_CONFIG,
+  RESEND_SMTP,
   SUPPORTED_PGDELTA,
   SUPPORTED_SUPABASE_CLI,
   pgd,

package/dist/{db-DNK3TD5Y.js → db-7M37DHEA.js}

@@ -11,11 +11,11 @@ import {
   readEnvValue,
   resolveDbMode,
   resolveDbUrl
-} from "./chunk-7NV5CYOF.js";
-import "./chunk-4CW46BPC.js";
+} from "./chunk-DFDS5V5Z.js";
+import "./chunk-K5XVJEHP.js";
 import "./chunk-IV5ZSOKF.js";
 import "./chunk-MHI6VJ75.js";
-import "./chunk-DM6KG5YU.js";
+import "./chunk-ILLYV7U7.js";
 export {
   dbApply,
   dbBackup,