better-supabase 0.11.0 → 0.12.0

package/dist/cli/{design-edit-B-WsnhUF.js → design-edit-0U9iCTiS.js}

@@ -1,7 +1,10 @@
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { t as isRecord } from "./guards-CUlDNYZs.js";
 import { f as setPathInConfig, p as setPathInJson } from "./config-edit-Ct1lXe8a.js";
-import { DEFAULT_CONVENTIONS, PRESET_TENANT_NAMES, presetField, presetValueLabel, withPresetField } from "better-supabase/preset";
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { readFile } from "node:fs/promises";
+import { DEFAULT_CONVENTIONS, PRESET_TENANT_NAMES, designOf, isPresetName, presetField, presetOf, presetValueLabel, readDesignFile, withPresetField } from "better-supabase/preset";
 //#region src/cli/conventions.ts
 const arg = (key, description) => ({
 	type: "string",
@@ -123,6 +126,30 @@ function createUrlParam(input, name) {
 /** What `init` and `apply` print for a URL with `&authz=`. */
 const AUTHZ_NOTE = "The authorization library chosen on Create isn't part of the preset. Open Get code on Create for its setup, then set `authorization` in the config to its adapter.";
 //#endregion
+//#region src/cli/preset-input.ts
+/** Whether `--preset` names a design file rather than a preset or URL. */
+const isDesignFilePath = (input) => input.endsWith(".json");
+/**
+* Reads `--preset`: a named preset, a code, a `/create` URL, or the path of
+* a design file Create downloaded (relative to `root`). Throws a usage
+* error naming the problem.
+*/
+async function readPresetInput(input, root) {
+	try {
+		if (isDesignFilePath(input)) {
+			const path = resolve(root, input);
+			if (!existsSync(path)) throw new TypeError(`${input} doesn't exist. Download the design file from Create, or pass a preset name, code or URL.`);
+			return readDesignFile(await readFile(path, "utf-8"));
+		}
+		return {
+			preset: presetOf(input),
+			design: isPresetName(input) ? void 0 : await designOf(input)
+		};
+	} catch (error) {
+		throw new CliError("usage", error instanceof Error ? error.message : String(error));
+	}
+}
+//#endregion
 //#region src/cli/sql/design-edit.ts
 /** The `extraColumns` a block already has in the config, as plain strings. */
 function currentExtraColumns(config, module) {
@@ -172,4 +199,4 @@ function writeDesign(file, source, design, config) {
 	};
 }
 //#endregion
-export { CONVENTION_COMPLETIONS as a, hasConventionFlags as c, CONVENTION_ARGS as i, promptConventions as l, AUTHZ_NOTE as n, conventionFlags as o, createUrlParam as r, defaultConventions as s, writeDesign as t, withConventions as u };
+export { CONVENTION_ARGS as a, defaultConventions as c, withConventions as d, createUrlParam as i, hasConventionFlags as l, readPresetInput as n, CONVENTION_COMPLETIONS as o, AUTHZ_NOTE as r, conventionFlags as s, writeDesign as t, promptConventions as u };

package/dist/cli/{doctor-D47sFjh9.js → doctor-DOfy6kjt.js}

@@ -1,25 +1,28 @@
-import { a as list, p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
 import { i as plain } from "./style-2JfIPVMQ.js";
-import { t as VERSION } from "./version-CUKjFbNd.js";
+import { t as VERSION } from "./version-B7akdvDv.js";
 import { n as CliError, r as errorText } from "./errors-Caiz_0so.js";
 import { a as sameText, t as display } from "./io-BiPX-_J1.js";
-import { t as CACHE_DIR } from "./cache-CVJmPGpd.js";
+import { t as CACHE_DIR } from "./cache-DQwgb3rg.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
 import { h as satisfies, m as peerVersions, t as MetadataRejectedError } from "./typegen--TfvOPLh.js";
 import { t as isRecord } from "./guards-CUlDNYZs.js";
 import { c as configFor, s as notNullTag } from "./emit-56LAG_Px.js";
-import { _ as withoutStrings, a as METADATA_GAPS_TEXT, c as accessModule, d as RLS_RULES, f as appliesTo, g as policyHelpers, h as functionObject, l as entitlementsModule, m as functionBody, p as escape$1, s as AUTHORIZATION_RULES, u as COMMANDS$1, v as advisorRule, x as renderFiles, y as splinterTables } from "./run-Bb8Nn8Ax.js";
+import { _ as withoutStrings, a as METADATA_GAPS_TEXT, c as accessModule, d as RLS_RULES, f as appliesTo, g as policyHelpers, h as functionObject, l as entitlementsModule, m as functionBody, p as escape$1, s as AUTHORIZATION_RULES, u as COMMANDS$1, v as advisorRule, x as renderFiles, y as splinterTables } from "./run-BhJKAanr.js";
 import { D as providerLabel, a as migrationModules, i as migrationHolds, r as latestMigration, t as MODULES_SUFFIX, v as migrationsDir, x as compiledReadSets, y as moduleLayoutFor } from "./module-migration-CPhuiY8C.js";
-import { l as stdinDatabaseUrl } from "./config-C4e_RrmL.js";
+import { l as stdinDatabaseUrl } from "./config-yZ55rsKZ.js";
 import { a as findRepoRoot, c as httpHooks, d as readSupabaseToml, f as schemaPaths, h as tomlGet, i as diffEngine, l as migrationCommand, n as declarativeSchemasDir, p as sqlWorkflow, u as pgFunctionHooks } from "./supabase-toml-BC5sNVKU.js";
+import { t as PROCESS_ENV } from "./env-C8R7Nf0a.js";
+import { n as readStackStatus } from "./stack-status-_NUgd-g5.js";
 import { t as connect } from "./db-DT1bGB02.js";
-import { c as isSqliteLiteDriver, n as managementTarget, o as snapshotFile, p as request, r as openSource, s as liteDriverOf, t as loadSnapshot } from "./snapshot-ClgWGd-b.js";
+import { c as isSqliteLiteDriver, n as managementTarget, o as snapshotFile, p as request, r as openSource, s as liteDriverOf, t as loadSnapshot } from "./snapshot-BBKFojqM.js";
 import { n as applyPlan, o as insideRoot, r as changeLines } from "./files-DDvAwTko.js";
 import { a as permissionCatalogKeys, i as lineOf, l as tableObject, n as exposed, o as policyObject, r as exposedSchemas, s as qualified, t as catalogOf, u as workflowOf } from "./shared-DKLuA1Tp.js";
 import { t as MIGRATION_SAFETY_RULES } from "./migration-safety-DjVpz2D6.js";
-import { a as sourceFlags, n as SOURCE_ARGS } from "./source-args-BDiUhsH8.js";
-import { i as reservedRoles, n as ident$1, r as literal$1, t as LIVE_RULES } from "./live-CLxJNC0r.js";
-import { i as refuseWithMetadata, r as readMetadataSnapshot } from "./metadata-BRywyPvv.js";
+import { a as sourceFlags, n as SOURCE_ARGS } from "./source-args-Cwo7zwvq.js";
+import { i as reservedRoles, n as ident$1, r as literal$1, t as LIVE_RULES } from "./live-CkV3d3yp.js";
+import { i as staleVariables, r as stackEnvValues, t as PREFIX_NAMES } from "./stack-env-_uWWNHWq.js";
+import { i as refuseWithMetadata, r as readMetadataSnapshot } from "./metadata-BGkle6WM.js";
 import { existsSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { createHash } from "node:crypto";
@@ -27,6 +30,107 @@ import { glob, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { SECRET_COLUMNS, SQL_MODULES, adoptedTables, contractSignature, customContracts, dataExportPlan, excludedColumns, expiredFlagsQuery, migrationOptionUses, moduleDeprecations, moduleEventTriggers, moduleFileVersion, moduleLayout, moduleVersion, renderModules, sameModuleFile, sameTenantColumn, sameTenantTrigger, sharedRolesProblems, subjectColumns } from "better-supabase/sql";
 import { DEFAULT_ACTIVE_TENANT, tenantClaimPaths } from "better-supabase/config";
 import { defineBucket, parseSize } from "better-supabase/storage";
+//#region src/cli/doctor/env.ts
+const PUBLIC_PREFIXES = [
+	"NEXT_PUBLIC_",
+	"VITE_",
+	"PUBLIC_",
+	"EXPO_PUBLIC_",
+	"NUXT_PUBLIC_"
+];
+function envEntries(file) {
+	return file.text.split("\n").flatMap((raw, index) => {
+		const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(raw);
+		if (!match) return [];
+		const value = match[2].trim().replace(/^(['"])(.*)\1$/, "$2");
+		return [{
+			key: match[1],
+			value,
+			line: index + 1
+		}];
+	});
+}
+const PREFIXES = [...new Set(Object.values(PREFIX_NAMES).filter((prefix) => prefix !== ""))];
+/** The names `stackEnvValues` writes, with or without a browser prefix; not the CLI's own `SUPABASE_BIN` or `SUPABASE_ACCESS_TOKEN`. */
+const STACK_VARIABLE = /(?:^|_)SUPABASE_(?:URL|PUBLISHABLE_KEY|SECRET_KEY|JWKS_URL|DB_URL|JWT_SECRET)$/;
+const exportsStackVariable = (shell) => Object.entries(shell).some(([name, value]) => value !== void 0 && value !== "" && STACK_VARIABLE.test(name));
+/**
+* Reads the running stack only when the shell exports a `SUPABASE_*`
+* variable, so a doctor run without one never starts `supabase status`.
+*/
+async function loadStackEnvCheck(root, env, signal) {
+	const shell = env[PROCESS_ENV] ?? {};
+	if (!exportsStackVariable(shell)) return { skipped: "No SUPABASE_* variable is exported." };
+	try {
+		const result = await readStackStatus(root, env, { signal });
+		if (!result.ok) return { skipped: "The local stack is not running." };
+		const values = { ...stackEnvValues(result.status, "") };
+		if (values["SUPABASE_URL"] === void 0) return { skipped: "supabase status has no API_URL." };
+		for (const prefix of PREFIXES) {
+			values[`${prefix}SUPABASE_URL`] = values["SUPABASE_URL"];
+			if (values["SUPABASE_PUBLISHABLE_KEY"] !== void 0) values[`${prefix}SUPABASE_PUBLISHABLE_KEY`] = values["SUPABASE_PUBLISHABLE_KEY"];
+		}
+		return {
+			shell,
+			values
+		};
+	} catch (cause) {
+		return { skipped: errorText(cause) };
+	}
+}
+/** Checks on env files and the variables the shell exports (BS501 to BS503). */
+const ENV_RULES = [
+	{
+		code: "BS501",
+		severity: "error",
+		title: "Secret in a browser variable",
+		description: "Variables with a public prefix are bundled into client code. A secret key there gives every visitor full access.",
+		check: (context) => context.envFiles.flatMap((file) => envEntries(file).filter((entry) => PUBLIC_PREFIXES.some((prefix) => entry.key.startsWith(prefix)) && (entry.value.startsWith("sb_secret_") || /SECRET|SERVICE_ROLE/.test(entry.key))).map((entry) => ({
+			message: `${entry.key} in ${file.path} is exposed to the browser but holds a secret. Rename it without the public prefix and rotate the key.`,
+			target: `${file.path}:${entry.key}`,
+			location: {
+				file: file.path,
+				line: entry.line
+			}
+		})))
+	},
+	{
+		code: "BS502",
+		severity: "warning",
+		title: "Env file with secrets is not ignored by git",
+		description: "Env files holding a secret key or database password should never be committed.",
+		check: (context) => {
+			const patterns = context.gitignore.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
+			const ignored = (path) => patterns.some((pattern) => {
+				const source = pattern.replace(/^\//, "").replaceAll(/[.+^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
+				return new RegExp(`^${source}$`).test(path) || new RegExp(`(^|/)${source}$`).test(path);
+			});
+			return context.envFiles.flatMap((file) => {
+				const secret = envEntries(file).find((entry) => entry.value.startsWith("sb_secret_") || /SECRET_KEY|SERVICE_ROLE|DB_URL|DATABASE_URL/.test(entry.key));
+				if (!secret || ignored(file.path) || file.path.endsWith(".example")) return [];
+				return [{
+					message: `${file.path} contains ${secret.key} but isn't in .gitignore.`,
+					target: file.path,
+					location: {
+						file: file.path,
+						line: secret.line
+					}
+				}];
+			});
+		}
+	},
+	{
+		code: "BS503",
+		severity: "warning",
+		title: "Exported Supabase variable differs from the running stack",
+		description: "A SUPABASE_* variable exported in the shell has another value than the local stack, so the app talks to a stale stack (often another worktree's port). Values are redacted: host and port for URLs, a SHA-256 fingerprint for keys. Unset the variable, or start the app with `better-supabase run -- <cmd>`, which overrides it.",
+		check: ({ stackEnv }) => stackEnv === void 0 || "skipped" in stackEnv ? [] : staleVariables(stackEnv.shell, stackEnv.values).map((stale) => ({
+			target: stale.variable,
+			message: `${stale.message} Unset it or start the app with better-supabase run -- <cmd>.`
+		}))
+	}
+];
+//#endregion
 //#region src/cli/doctor/adoption.ts
 const tagText = (notNull) => notNull === true ? "@notNull" : `@notNull(${notNull.join(", ")})`;
 const sameNotNull = (a, b) => a === true || b === true ? a === b : a !== void 0 && a.length === b.length && a.every((name) => b.includes(name));
@@ -2544,25 +2648,6 @@ function tomlLocation(context, key) {
 		line
 	} : void 0;
 }
-const PUBLIC_PREFIXES = [
-	"NEXT_PUBLIC_",
-	"VITE_",
-	"PUBLIC_",
-	"EXPO_PUBLIC_",
-	"NUXT_PUBLIC_"
-];
-function envEntries(file) {
-	return file.text.split("\n").flatMap((raw, index) => {
-		const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(raw);
-		if (!match) return [];
-		const value = match[2].trim().replace(/^(['"])(.*)\1$/, "$2");
-		return [{
-			key: match[1],
-			value,
-			line: index + 1
-		}];
-	});
-}
 /**
 * `db.x.aggregate(`, an `_sum:`/`_avg:`/`_min:`/`_max:` include or a list
 * with `facetCounts: true`.
@@ -2968,45 +3053,6 @@ const RULES = [
 				target: `${qualified(table)}.${key.name}`,
 				object: tableObject(table)
 			})))
-		},
-		{
-			code: "BS501",
-			severity: "error",
-			title: "Secret in a browser variable",
-			description: "Variables with a public prefix are bundled into client code. A secret key there gives every visitor full access.",
-			check: (context) => context.envFiles.flatMap((file) => envEntries(file).filter((entry) => PUBLIC_PREFIXES.some((prefix) => entry.key.startsWith(prefix)) && (entry.value.startsWith("sb_secret_") || /SECRET|SERVICE_ROLE/.test(entry.key))).map((entry) => ({
-				message: `${entry.key} in ${file.path} is exposed to the browser but holds a secret. Rename it without the public prefix and rotate the key.`,
-				target: `${file.path}:${entry.key}`,
-				location: {
-					file: file.path,
-					line: entry.line
-				}
-			})))
-		},
-		{
-			code: "BS502",
-			severity: "warning",
-			title: "Env file with secrets is not ignored by git",
-			description: "Env files holding a secret key or database password should never be committed.",
-			check: (context) => {
-				const patterns = context.gitignore.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
-				const ignored = (path) => patterns.some((pattern) => {
-					const source = pattern.replace(/^\//, "").replaceAll(/[.+^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
-					return new RegExp(`^${source}$`).test(path) || new RegExp(`(^|/)${source}$`).test(path);
-				});
-				return context.envFiles.flatMap((file) => {
-					const secret = envEntries(file).find((entry) => entry.value.startsWith("sb_secret_") || /SECRET_KEY|SERVICE_ROLE|DB_URL|DATABASE_URL/.test(entry.key));
-					if (!secret || ignored(file.path) || file.path.endsWith(".example")) return [];
-					return [{
-						message: `${file.path} contains ${secret.key} but isn't in .gitignore.`,
-						target: file.path,
-						location: {
-							file: file.path,
-							line: secret.line
-						}
-					}];
-				});
-			}
 		}
 	],
 	...RLS_RULES,
@@ -3024,7 +3070,8 @@ const RULES = [
 	...FLAG_RULES,
 	...REALTIME_RULES,
 	...ADOPTION_RULES,
-	...MIGRATION_SAFETY_RULES
+	...MIGRATION_SAFETY_RULES,
+	...ENV_RULES
 ].sort((a, b) => byCodePoint(a.code, b.code));
 const RULE_CODES = RULES.map((rule) => rule.code);
 async function runRules(context, rules = RULES) {
@@ -3512,14 +3559,15 @@ async function runDoctor(config, args, env, options = {}) {
 		...options.advisors === void 0 ? {} : { advisors: options.advisors },
 		...options.database === void 0 ? {} : { database: options.database }
 	};
-	const [snapshot, envFiles, [configToml, sql], gitignore, sources, readSets, peers] = await Promise.all([
+	const [snapshot, envFiles, [configToml, sql], gitignore, sources, readSets, peers, stackEnv] = await Promise.all([
 		options.snapshot ?? loadSnapshot(config, env, source, pg, opened.open),
 		Promise.all(ENV_FILES.map((path) => readText(config.root, path))).then((files) => files.filter((file) => file !== void 0)),
 		readSupabaseToml(config.root).then(async (toml) => [toml, await sqlFiles(config.root, toml, sqlWorkflow(config, toml))]),
 		readText(config.root, ".gitignore"),
 		sourceFiles(config),
 		compiledReadSets(config).catch((cause) => ({ skipped: errorText(cause) })),
-		options.peers ?? peerVersions(config.root).catch(() => [])
+		options.peers ?? peerVersions(config.root).catch(() => []),
+		options.stackEnv ?? (rules.some((rule) => rule.code === "BS503") ? loadStackEnvCheck(config.root, env, options.signal) : void 0)
 	]).catch(async (cause) => {
 		await opened.close();
 		throw cause;
@@ -3539,6 +3587,7 @@ async function runDoctor(config, args, env, options = {}) {
 		sources,
 		readSets,
 		peers,
+		...stackEnv ? { stackEnv } : {},
 		...live.advisors ? { advisors: live.advisors } : {},
 		...live.database ? { database: live.database } : {},
 		...stats ? { stats } : {},

package/dist/cli/env-Cmu99uKR.js

@@ -0,0 +1 @@
+export { n as envCommand } from "./env-Dh5K5t2U.js";

package/dist/cli/{env--JFvv45k.js → env-Dh5K5t2U.js}

@@ -1,22 +1,24 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { r as readIfExists, t as display } from "./io-BiPX-_J1.js";
-import { n as readStackStatus, t as parseStackStatus } from "./stack-status-Cb_D79ZR.js";
+import { n as readStackStatus, t as parseStackStatus } from "./stack-status-_NUgd-g5.js";
 import { n as applyPlan, o as insideRoot, r as changeLines, s as planResult, t as PLAN_ARGS } from "./files-DDvAwTko.js";
 import { r as publicPrefix, t as detectProject } from "./detect-DQsVeBHg.js";
+import { n as prefixFromFlag, r as stackEnvValues } from "./stack-env-_uWWNHWq.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { readFile } from "node:fs/promises";
 //#region src/cli/commands/env.ts
 const ARGS = {
-	out: {
+	write: {
 		type: "string",
+		alias: "out",
 		description: "Env file to write, or - to print the variables. Defaults to env.output, then .env.local",
 		valueHint: "file"
 	},
 	prefix: {
 		type: "string",
-		description: "Prefix for browser variables. Defaults to env.prefix, then one detected from your framework; \"none\" for no prefix",
+		description: "Browser variable prefix: next, vite, expo, nuxt, astro, sveltekit, a literal prefix, or \"none\". Defaults to env.prefix, then one detected from your framework",
 		valueHint: "prefix"
 	},
 	"status-file": {
@@ -40,12 +42,22 @@ async function readStatus(config, args, env, signal) {
 	if (!result.ok) throw new CliError("supabase_cli_failed", `supabase status failed (${result.code}). Is the local stack running (supabase start)?`, { suggestion: "supabase start" });
 	return result.status;
 }
-const text = (status, ...keys) => {
-	for (const key of keys) {
-		const value = status[key];
-		if (typeof value === "string" && value.length > 0) return value;
-	}
-};
+/** The browser prefix: `--prefix`, then `env.prefix`, then the framework's. */
+async function browserPrefix(config, flag) {
+	const prefix = flag ?? config.env.prefix;
+	return prefix === void 0 ? publicPrefix(await detectProject(config.root)) : prefixFromFlag(prefix);
+}
+/** The running stack's variables, as `env` writes them and `run` sets them. */
+async function readStackEnv(config, args, env, signal) {
+	const status = await readStatus(config, args, env, signal);
+	const prefix = await browserPrefix(config, args.prefix);
+	const values = stackEnvValues(status, prefix);
+	if (!values) throw new CliError("supabase_cli_failed", "supabase status has no API_URL or publishable key. Is the stack running?", { suggestion: "supabase start" });
+	return {
+		status,
+		values
+	};
+}
 /** Replaces `KEY=` lines in place and appends the rest under a header. */
 function mergeEnv(current, values) {
 	const pending = new Map(Object.entries(values));
@@ -65,32 +77,20 @@ function mergeEnv(current, values) {
 }
 async function runEnv(config, args, env, signal) {
 	const status = await readStatus(config, args, env, signal);
-	const project = await detectProject(config.root);
-	const prefixFlag = args.prefix ?? config.env.prefix;
-	const prefix = prefixFlag === void 0 ? publicPrefix(project) : prefixFlag === "none" ? "" : prefixFlag;
-	const url = text(status, "API_URL");
-	const publishableKey = text(status, "PUBLISHABLE_KEY", "ANON_KEY");
-	const secretKey = text(status, "SECRET_KEY", "SERVICE_ROLE_KEY");
-	if (!url || !publishableKey) return {
+	const prefix = await browserPrefix(config, args.prefix);
+	const values = stackEnvValues(status, prefix);
+	if (!values) return {
 		code: 1,
 		error: "supabase status has no API_URL or publishable key. Is the stack running?"
 	};
-	const values = {
-		[`${prefix}SUPABASE_URL`]: url,
-		[`${prefix}SUPABASE_PUBLISHABLE_KEY`]: publishableKey
-	};
-	if (secretKey) values["SUPABASE_SECRET_KEY"] = secretKey;
-	const dbUrl = text(status, "DB_URL");
-	if (dbUrl) values["SUPABASE_DB_URL"] = dbUrl;
-	const jwtSecret = text(status, "JWT_SECRET");
-	if (jwtSecret) values["SUPABASE_JWT_SECRET"] = jwtSecret;
-	if (args.out === "-") return {
+	const write = args.write;
+	if (write === "-") return {
 		code: 0,
 		output: Object.entries(values).map(([key, value]) => `${key}=${value}`).join("\n"),
 		data: { values }
 	};
-	const out = args.out ?? config.env.output;
-	const path = insideRoot(config.root, out, args.out ? "--out" : "env.output");
+	const out = write ?? config.env.output;
+	const path = insideRoot(config.root, out, write ? "--write" : "env.output");
 	const current = await readIfExists(path) ?? "";
 	const file = display(config.root, out);
 	const plan = {
@@ -110,7 +110,8 @@ async function runEnv(config, args, env, signal) {
 		keys: Object.keys(values)
 	} });
 	const warnings = [];
-	if (!text(status, "PUBLISHABLE_KEY")) warnings.push("This Supabase CLI prints only legacy JWT keys. Upgrade it to get sb_publishable_/sb_secret_ keys.");
+	const publishable = status["PUBLISHABLE_KEY"];
+	if (typeof publishable !== "string" || publishable.length === 0) warnings.push("This Supabase CLI prints only legacy JWT keys. Upgrade it to get sb_publishable_/sb_secret_ keys.");
 	const gitignore = resolve(config.root, ".gitignore");
 	if (!(existsSync(gitignore) && (await readFile(gitignore, "utf-8")).split("\n").some((line) => [
 		out,
@@ -139,4 +140,4 @@ const envCommand = defineCliCommand({
 	run: (args, { config, env, signal }) => runEnv(config, args, env, signal)
 });
 //#endregion
-export { mergeEnv as n, runEnv as r, envCommand as t };
+export { runEnv as a, readStackEnv as i, envCommand as n, mergeEnv as r, browserPrefix as t };

package/dist/cli/{gen-D2E8osBE.js → gen-D3sC5jDn.js}

@@ -1,17 +1,17 @@
-import { a as list, p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
 import { i as plain } from "./style-2JfIPVMQ.js";
 import { a as parseNames, i as failedResult, n as CliError } from "./errors-Caiz_0so.js";
-import { a as catalogFingerprint } from "./cache-CVJmPGpd.js";
-import { n as runGen } from "./run-Bb8Nn8Ax.js";
+import { a as catalogFingerprint } from "./cache-DQwgb3rg.js";
+import { n as runGen } from "./run-BhJKAanr.js";
 import { r as isGenTask, t as GEN_TASKS } from "./names-D6LrQnOv.js";
-import { o as snapshotFile, r as openSource, t as loadSnapshot } from "./snapshot-ClgWGd-b.js";
-import { a as sourceFlags, i as sourceArgs, n as SOURCE_ARGS } from "./source-args-BDiUhsH8.js";
-import { a as runMetadataGen, n as checkMetadataFlags, t as EMITS } from "./metadata-BRywyPvv.js";
-import { r as runEnv } from "./env--JFvv45k.js";
-import { c as watchLoop, o as parseInterval, r as specOptionsFromConfig, s as stampFiles, t as runSpec } from "./spec-CM7iyRnE.js";
-import { t as runScaffoldApi } from "./scaffold-DcXr4z7M.js";
-import { t as runSeed } from "./seed-BmOC6_iz.js";
-import { t as runSql } from "./sql-ybcjbz20.js";
+import { o as snapshotFile, r as openSource, t as loadSnapshot } from "./snapshot-BBKFojqM.js";
+import { a as sourceFlags, i as sourceArgs, n as SOURCE_ARGS } from "./source-args-Cwo7zwvq.js";
+import { a as runMetadataGen, n as checkMetadataFlags, t as EMITS } from "./metadata-BGkle6WM.js";
+import { a as runEnv } from "./env-Dh5K5t2U.js";
+import { c as watchLoop, o as parseInterval, r as specOptionsFromConfig, s as stampFiles, t as runSpec } from "./spec-DZeIP9ta.js";
+import { t as runScaffoldApi } from "./scaffold-DoURlDEI.js";
+import { t as runSeed } from "./seed-CIdg6s7m.js";
+import { t as runSql } from "./sql-DLOvvnBV.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/commands/gen-pipeline.ts

package/dist/cli/index.d.ts

@@ -688,6 +688,6 @@ export declare function emitModule(model: Model, options: EmitOptions): string;
 export declare function loadConfig(cwd: string, explicit?: string, environment?: string, path?: string | undefined): Promise<ResolvedConfig>;
 //#endregion
 //#region src/cli/version.d.ts
-export declare const VERSION = "0.11.0";
+export declare const VERSION = "0.12.0";
 //#endregion
 export type { Catalog, CatalogCheck, CatalogColumn, CatalogColumnGrant, CatalogEnum, CatalogForeignKey, CatalogFunction, CatalogFunctionArg, CatalogGrant, CatalogIndex, CatalogPolicy, CatalogTable, CatalogTrigger, CatalogUnique, Choice, Cli, CliArgs, CliCommand, CliCommandDef, CliContext, CliEnv, CliErrorCode, CliErrorOptions, CliIo, CliLog, CliProblem, CliProblemExtensions, CommandResult, CreateCliOptions, ExitCode, ExtrasFunction, ExtrasHook, ExtrasHookFunction, ExtrasTable, ForeignKeyAction, Format, GeneratorMetadata, IntrospectionSource, ManagementSourceOptions, NextStep, Paint, Prompter, Queryable, RunOptions, RunResult, Snapshot, SnapshotBucket, SnapshotExtras };

package/dist/cli/index.js

@@ -1,12 +1,12 @@
-import { a as list, r as defineCliCommand } from "./command-DLCZeHdo.js";
-import { i as run, n as createCli, r as help, t as commandNames } from "./run-nX5ffQM_.js";
-import { t as VERSION } from "./version-CUKjFbNd.js";
+import { a as list, r as defineCliCommand } from "./command-dfdVhU_2.js";
+import { i as run, n as createCli, r as help, t as commandNames } from "./run-DRZ10srj.js";
+import { t as VERSION } from "./version-B7akdvDv.js";
 import { n as CliError, t as CLI_ERRORS_URL } from "./errors-Caiz_0so.js";
 import { t as toCatalog } from "./catalog-Cm6BtquM.js";
 import { a as buildModel, r as emitModule, t as GENERATED_HEADER } from "./emit-56LAG_Px.js";
-import { S as emitBlockConfig, n as runGen, x as renderFiles } from "./run-Bb8Nn8Ax.js";
-import { s as loadConfig } from "./config-C4e_RrmL.js";
-import { a as serializeSnapshot, d as managementSource, f as pgSource, i as parseSnapshot, l as introspect, t as loadSnapshot } from "./snapshot-ClgWGd-b.js";
+import { S as emitBlockConfig, n as runGen, x as renderFiles } from "./run-BhJKAanr.js";
+import { s as loadConfig } from "./config-yZ55rsKZ.js";
+import { a as serializeSnapshot, d as managementSource, f as pgSource, i as parseSnapshot, l as introspect, t as loadSnapshot } from "./snapshot-BBKFojqM.js";
 //#region src/cli/introspect/from-catalog.ts
 /**
 * Builds a snapshot from catalog records: the inverse of `toCatalog`. Tests

package/dist/cli/{init-Cx7DDAdQ.js → init-DNomoycJ.js}

@@ -1,19 +1,19 @@
-import { a as list, p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
 import { i as plain } from "./style-2JfIPVMQ.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { t as TYPEGEN_VERSION } from "./typegen-version-BNBPI4Eu.js";
-import { a as findConfig, s as loadConfig } from "./config-C4e_RrmL.js";
+import { a as findConfig, s as loadConfig } from "./config-yZ55rsKZ.js";
 import { n as applyPlan, r as changeLines, s as planResult, t as PLAN_ARGS } from "./files-DDvAwTko.js";
-import { _ as suggestedIntegrations, a as CANCELLED, c as overwrite, d as templateContextFor, f as templatePlan, g as resolveIntegrations, h as needsLib, l as packagesFor, m as baseFiles, n as blockConfigImport, o as chooseIntegrations, p as TEMPLATES, r as blocksWiringPath, s as integrationFiles, u as parseIntegrations } from "./add-B5V6uokQ.js";
+import { _ as suggestedIntegrations, a as CANCELLED, c as overwrite, d as templateContextFor, f as templatePlan, g as resolveIntegrations, h as needsLib, l as packagesFor, m as baseFiles, n as blockConfigImport, o as chooseIntegrations, p as TEMPLATES, r as blocksWiringPath, s as integrationFiles, u as parseIntegrations } from "./add-TT72pQk6.js";
 import { n as installCommand, t as detectProject } from "./detect-DQsVeBHg.js";
 import { s as enablePgDelta } from "./write-VZljwoTB.js";
 import { n as latestMigrationVersion } from "./migration-safety-DjVpz2D6.js";
-import { a as CONVENTION_COMPLETIONS, c as hasConventionFlags, i as CONVENTION_ARGS, l as promptConventions, n as AUTHZ_NOTE, o as conventionFlags, r as createUrlParam, s as defaultConventions, t as writeDesign, u as withConventions } from "./design-edit-B-WsnhUF.js";
+import { a as CONVENTION_ARGS, c as defaultConventions, d as withConventions, i as createUrlParam, l as hasConventionFlags, n as readPresetInput, o as CONVENTION_COMPLETIONS, r as AUTHZ_NOTE, s as conventionFlags, t as writeDesign, u as promptConventions } from "./design-edit-0U9iCTiS.js";
 import { t as syncModules } from "./sync-DBvknfOK.js";
 import { existsSync } from "node:fs";
 import { join, posix, resolve } from "node:path";
 import { glob, readFile } from "node:fs/promises";
-import { PRESETS, PRESET_NAMES, conventionConfig, designConfig, designOf, encodePreset, glueCommand, integrationsForFramework, isPresetName, presetBlocksSource, presetGlue, presetOf, resolvePreset } from "better-supabase/preset";
+import { PRESETS, PRESET_NAMES, conventionConfig, designConfig, encodePreset, glueCommand, integrationsForFramework, isPresetName, presetBlocksSource, presetGlue, resolvePreset } from "better-supabase/preset";
 import { resolveConfig } from "better-supabase/config";
 //#region src/cli/project/workspace.ts
 const unquote = (value) => value.replace(/\s+#.*$/, "").trim().replace(/^(["'])(.*)\1$/, "$2");
@@ -120,8 +120,8 @@ const INIT_ARGS = {
 	},
 	preset: {
 		type: "string",
-		description: "A named preset, a code from /create or its URL: the config starts from it, and init writes its modules and lib/blocks.ts",
-		valueHint: "name|code|url"
+		description: "A named preset, a code from /create, its URL or a downloaded design file: the config starts from it, and init writes its modules and lib/blocks.ts",
+		valueHint: "name|code|url|file"
 	},
 	lite: {
 		type: "boolean",
@@ -175,7 +175,7 @@ async function initTarget(cwd, pkg, prompts) {
 	return dir === void 0 ? CANCELLED : { dir };
 }
 /** The preset `--preset` names, or the one the person picks; `null` for none. */
-async function chosenPreset(args, flags, prompts) {
+async function chosenPreset(args, flags, prompts, root) {
 	let value = args.preset;
 	if (value === void 0 && prompts && !hasConventionFlags(flags) && args.integration === void 0) {
 		const picked = await prompts.select("Preset", [{
@@ -191,15 +191,9 @@ async function chosenPreset(args, flags, prompts) {
 		if (picked !== "none") value = picked;
 	}
 	if (value === void 0) return null;
-	let preset;
-	let design;
-	try {
-		preset = presetOf(value);
-		design = isPresetName(value) ? void 0 : await designOf(value);
-	} catch (error) {
-		throw new CliError("usage", error instanceof Error ? error.message : String(error));
-	}
-	preset = withConventions(preset, flags);
+	const input = await readPresetInput(value, root);
+	const design = input.design;
+	const preset = withConventions(input.preset, flags);
 	const resolved = resolvePreset(preset);
 	if (resolved.conflicts.length > 0) throw new CliError("usage", `The preset can't install: ${resolved.conflicts.map((conflict) => `${conflict.block ?? conflict.field ?? ""} (${conflict.reason})`).join("; ")}.`);
 	if (design !== void 0) try {
@@ -233,7 +227,7 @@ function withDesign(files, design) {
 }
 async function runInit(config, args, prompts, now = () => /* @__PURE__ */ new Date()) {
 	const flags = conventionFlags(args);
-	const chosen = await chosenPreset(args, flags, prompts);
+	const chosen = await chosenPreset(args, flags, prompts, config.root);
 	if (chosen !== null && "code" in chosen) return chosen;
 	let conventions = chosen?.resolved.preset;
 	conventions ??= prompts && !hasConventionFlags(flags) ? await promptConventions(prompts) : defaultConventions(flags);

package/dist/cli/{introspect-Ck7aa6v0.js → introspect-kYX06Q2g.js}

@@ -1,9 +1,9 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { c as serializeGenerator, s as restrictSchemas } from "./typegen--TfvOPLh.js";
-import { a as serializeSnapshot, t as loadSnapshot } from "./snapshot-ClgWGd-b.js";
+import { a as serializeSnapshot, t as loadSnapshot } from "./snapshot-BBKFojqM.js";
 import { n as applyPlan, o as insideRoot, s as planResult, t as PLAN_ARGS } from "./files-DDvAwTko.js";
-import { i as sourceArgs, n as SOURCE_ARGS } from "./source-args-BDiUhsH8.js";
+import { i as sourceArgs, n as SOURCE_ARGS } from "./source-args-Cwo7zwvq.js";
 //#region src/cli/commands/introspect.ts
 const ARGS = {
 	out: {

package/dist/cli/{keys-6ufnWeZl.js → keys-B8dIJwwi.js}

@@ -1,4 +1,4 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
 import { t as display } from "./io-BiPX-_J1.js";
 import { m as supabaseDir } from "./supabase-toml-BC5sNVKU.js";
 import { n as applyPlan, r as changeLines } from "./files-DDvAwTko.js";

package/dist/cli/{live-CLxJNC0r.js → live-CkV3d3yp.js}

@@ -1,5 +1,5 @@
 import { r as errorText } from "./errors-Caiz_0so.js";
-import "./snapshot-ClgWGd-b.js";
+import "./snapshot-BBKFojqM.js";
 import { l as tableObject, n as exposed, s as qualified, t as catalogOf } from "./shared-DKLuA1Tp.js";
 //#region src/cli/doctor/reserved-roles.ts
 /**

package/dist/cli/{mcp-BVWvEoKo.js → mcp-DrxB2Wuw.js}

@@ -1,6 +1,6 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
-import { a as envelope, i as run } from "./run-nX5ffQM_.js";
-import { t as VERSION } from "./version-CUKjFbNd.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
+import { a as envelope, i as run } from "./run-DRZ10srj.js";
+import { t as VERSION } from "./version-B7akdvDv.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { n as consentToken } from "./agent-CCrTYK3W.js";
 import { A as string$1, E as record, M as unknown, O as safeParse, S as optional, a as array, b as object, d as is, o as boolean, t as PROCESS_ENV } from "./env-C8R7Nf0a.js";

package/dist/cli/{metadata-BRywyPvv.js → metadata-BGkle6WM.js}

@@ -2,7 +2,7 @@ import { n as CliError, r as errorText } from "./errors-Caiz_0so.js";
 import { i as readStdin } from "./io-BiPX-_J1.js";
 import { a as parseMetadataDocument, t as MetadataRejectedError } from "./typegen--TfvOPLh.js";
 import { i as metaPaths } from "./emit-56LAG_Px.js";
-import { b as render, i as generationNotices, n as runGen, o as fromMetadata, r as UNFORMATTED, t as refuseRowConditionedBuckets } from "./run-Bb8Nn8Ax.js";
+import { b as render, i as generationNotices, n as runGen, o as fromMetadata, r as UNFORMATTED, t as refuseRowConditionedBuckets } from "./run-BhJKAanr.js";
 import { basename, join, relative, resolve, sep } from "node:path";
 import { readFile } from "node:fs/promises";
 import { jsonSchema, standardSchema, valibot, zod } from "better-supabase/config";

package/dist/cli/{moved-BmtFuMK3.js → moved-BMQu1YNY.js}

@@ -1,5 +1,5 @@
 import { n as CliError } from "./errors-Caiz_0so.js";
-import { s as positionalIndex } from "./parse-ksnw4phM.js";
+import { s as positionalIndex } from "./parse-QzDvMpXH.js";
 //#region src/cli/core/moved.ts
 /** Commands renamed in 0.9, longest prefix first. */
 const MOVED_COMMANDS = [

package/dist/cli/{parse-ksnw4phM.js → parse-QzDvMpXH.js}

@@ -1,5 +1,5 @@
 import { r as __toESM } from "./rolldown-runtime-kJ_i4yPo.js";
-import { t as GLOBAL_ARGS } from "./command-DLCZeHdo.js";
+import { t as GLOBAL_ARGS } from "./command-dfdVhU_2.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 //#region src/cli/core/parse.ts
 /** Global options that take a value, so a command name is never the token after them. */

package/dist/cli/{preset-B1o6KbFp.js → preset-CfIs24cc.js}

@@ -1,4 +1,4 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { PRESET_FIELDS, decodePreset, encodePreset, isPresetCode, listNames, presetConfig, presetOf, resolvePreset } from "better-supabase/preset";
 //#region src/cli/commands/preset.ts