better-supabase 0.13.0 → 0.14.0

package/dist/cli/config-D9k5ckqV.js

@@ -0,0 +1 @@
+export { t as applyEnvironment, n as databaseUrl, r as defaultConfig, i as discoverConfig, a as findConfig, o as importExport, s as loadConfig, c as readSupabasePort, l as stdinDatabaseUrl } from "./config-CjgXMZW2.js";

package/dist/cli/db-CeagtENM.js

@@ -0,0 +1,473 @@
+import { p as commandMeta, r as defineCliCommand } from "./command-33pu13LT.js";
+import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
+import { i as isLocalDatabaseUrl, r as databaseHost } from "./agent-CbuPvI2x.js";
+import { t as display } from "./io-DH1kcmmP.js";
+import { d as readSupabaseToml, f as schemaPaths, n as declarativeSchemasDir, p as sqlWorkflow } from "./supabase-toml-CncmQbO0.js";
+import { l as stdinDatabaseUrl, n as databaseUrl } from "./config-CjgXMZW2.js";
+import { r as supabaseCli, t as runProcess } from "./exec--Q1ZEWUW.js";
+import { t as connect } from "./db-CQCLx7cx.js";
+import { r as STACK_ARG, t as DB_URL_STDIN_ARG } from "./source-args-DZV4RnZL.js";
+import { basename, dirname, join, resolve } from "node:path";
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+//#region src/cli/in-stack-diff.ts
+/**
+* Schemas the platform owns. The declarative files may add policies to their
+* tables (`storage.objects`), so those policies are dropped and replayed, but
+* the schemas themselves are kept.
+*/
+const PLATFORM_SCHEMAS = /* @__PURE__ */ new Set([
+	"_analytics",
+	"_realtime",
+	"auth",
+	"cron",
+	"extensions",
+	"graphql",
+	"graphql_public",
+	"information_schema",
+	"net",
+	"pgbouncer",
+	"pgmq",
+	"pgsodium",
+	"pgsodium_masks",
+	"pgtle",
+	"realtime",
+	"repack",
+	"storage",
+	"supabase_functions",
+	"supabase_migrations",
+	"tiger",
+	"tiger_data",
+	"topology",
+	"vault"
+]);
+/** The local stack's superuser; pg-delta skips objects it owns. */
+const ADMIN_ROLE = "supabase_admin";
+/** Why the Supabase CLI could not start its shadow database. */
+const SHADOW_FAILURE = /could not create shared memory segment|No space left on device|shmget|shadow database/i;
+function isShadowFailure(output) {
+	return SHADOW_FAILURE.test(output);
+}
+/**
+* The same database as `supabase_admin`, which may create databases and read
+* every schema.
+*/
+function adminUrl(url) {
+	const parsed = new URL(url);
+	parsed.username = ADMIN_ROLE;
+	return parsed.toString();
+}
+function withDatabase(url, database) {
+	const parsed = new URL(url);
+	parsed.pathname = `/${database}`;
+	return parsed.toString();
+}
+/** The migration versions (`<digits>_name.sql`) the stack has not applied. */
+function pendingMigrations(files, applied) {
+	return files.filter((file) => {
+		const version = /^(\d+)_/.exec(basename(file))?.[1];
+		return version !== void 0 && !applied.has(version);
+	});
+}
+/** The SQL from `supabase db diff --output-format json`, or its text output. */
+function diffSql(stdout) {
+	const start = stdout.indexOf("{");
+	if (start !== -1) try {
+		const parsed = JSON.parse(stdout.slice(start));
+		if (typeof parsed === "object" && parsed !== null && "diff" in parsed && typeof parsed.diff === "string") return parsed.diff;
+	} catch {}
+	return stdout;
+}
+/** The postmaster's `bin` directory, from `ps` lines and its data directory. */
+function postgresBin(psOutput, dataDirectory) {
+	for (const line of psOutput.split("\n")) {
+		const command = line.trim().replace(/^\d+\s+/, "");
+		const executable = command.split(/\s+/)[0];
+		if (executable !== void 0 && basename(executable).includes("postgres") && command.includes(` -D ${dataDirectory}`)) return dirname(executable);
+	}
+}
+const MIGRATION_HEADER = `-- Generated by better-supabase db diff from the running stack with pg-delta.
+-- The SQL compares two databases, so review it before you apply it: check
+-- the order of the statements and drop the ones you didn't mean to change.
+`;
+/** UTC `YYYYMMDDHHMMSS`, the Supabase CLI's migration version. */
+function migrationVersion(now) {
+	return now.toISOString().replaceAll(/[-:T]/g, "").slice(0, 14);
+}
+async function queryRows(client, sql) {
+	return (await client.query(sql)).rows;
+}
+async function findPostgresBin(options, client) {
+	const fromEnv = options.env.BSB_PG_BIN;
+	if (fromEnv !== void 0 && fromEnv !== "") return fromEnv;
+	const [row] = await queryRows(client, "show data_directory");
+	const ps = await (options.run ?? runProcess)("ps", ["-axo", "pid=,command="], options.root, options.env);
+	return row === void 0 ? void 0 : postgresBin(ps.stdout, row.data_directory);
+}
+const tool = (bin, name) => bin === void 0 ? name : join(bin, name);
+async function dropManagedObjects(client, replayedPlatformSchemas) {
+	const schemas = await queryRows(client, String.raw`select nspname from pg_namespace where nspname not like 'pg\_%' and nspname not in (select n.nspname from pg_namespace n join pg_depend d on d.objid = n.oid and d.deptype = 'e')`);
+	for (const { nspname } of schemas) {
+		if (PLATFORM_SCHEMAS.has(nspname)) continue;
+		if (nspname === "public") await client.query(EMPTY_PUBLIC);
+		else await client.query(`drop schema ${quoteIdent(nspname)} cascade`);
+	}
+	for (const schema of replayedPlatformSchemas) {
+		const policies = await client.query("select tablename, policyname from pg_policies where schemaname = $1", [schema]);
+		for (const policy of policies.rows) await client.query(`drop policy ${quoteIdent(policy.policyname)} on ${quoteIdent(schema)}.${quoteIdent(policy.tablename)}`);
+	}
+}
+const quoteIdent = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
+/**
+* Empties `public` without dropping it, so its default privileges stay. Objects
+* an extension owns stay too.
+*/
+const EMPTY_PUBLIC = `do $$
+declare r record;
+begin
+  for r in select format('drop %s if exists public.%I cascade',
+      case c.relkind when 'v' then 'view' when 'm' then 'materialized view' when 'S' then 'sequence' when 'f' then 'foreign table' else 'table' end,
+      c.relname) as s
+    from pg_class c join pg_namespace n on n.oid = c.relnamespace
+    where n.nspname = 'public' and c.relkind in ('v', 'm', 'r', 'p', 'f', 'S')
+      and not exists (select 1 from pg_depend d where d.objid = c.oid and d.deptype = 'e')
+    order by case c.relkind when 'v' then 0 when 'm' then 0 when 'S' then 2 else 1 end
+  loop execute r.s; end loop;
+  for r in select format('drop routine if exists %s cascade', p.oid::regprocedure) as s
+    from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'public'
+      and not exists (select 1 from pg_depend d where d.objid = p.oid and d.deptype = 'e')
+  loop execute r.s; end loop;
+  for r in select format('drop type if exists public.%I cascade', t.typname) as s
+    from pg_type t join pg_namespace n on n.oid = t.typnamespace
+    where n.nspname = 'public' and t.typtype in ('e', 'd', 'c')
+      and (t.typtype <> 'c' or (select relkind from pg_class where oid = t.typrelid) = 'c')
+      and not exists (select 1 from pg_depend d where d.objid = t.oid and d.deptype = 'e')
+  loop execute r.s; end loop;
+end $$`;
+/**
+* Applies each file in its own transaction and retries the ones that failed
+* until a round applies nothing, so files that depend on a later file still
+* apply. Returns the files that never applied, with the last error.
+*/
+async function applyInRounds(client, root, files) {
+	let pending = await Promise.all(files.map(async (file) => ({
+		file,
+		sql: await readFile(join(root, file), "utf-8")
+	})));
+	let error;
+	while (pending.length > 0) {
+		const failed = [];
+		for (const script of pending) try {
+			await client.query("begin");
+			await client.query(script.sql);
+			await client.query("commit");
+		} catch (cause) {
+			await client.query("rollback");
+			failed.push(script);
+			error = `${script.file}: ${errorText(cause)}`;
+		}
+		if (failed.length === pending.length) return {
+			failed: failed.map((script) => script.file),
+			...error === void 0 ? {} : { error }
+		};
+		pending = failed;
+	}
+	return { failed: [] };
+}
+/**
+* Diffs the declarative schema against the running stack without a shadow
+* database: copies the stack's database into a temporary one in the same
+* Postgres, replaces the objects the files manage with the files, and lets the
+* CLI's pg-delta diff the stack against the copy. The temporary database is
+* always dropped.
+*/
+async function inStackDiff(options) {
+	const open = options.open ?? connect;
+	const run = options.run ?? runProcess;
+	const supabase = options.supabase ?? supabaseCli;
+	const log = options.log ?? (() => {});
+	const admin = adminUrl(options.url);
+	const temp = `bsb_diff_${Date.now().toString(36)}`;
+	const tempUrl = withDatabase(admin, temp);
+	const main = await open(admin);
+	const scratch = await mkdtemp(join(tmpdir(), "bsb-diff-"));
+	let created = false;
+	try {
+		const applied = new Set((await queryRows(main.client, "select version from supabase_migrations.schema_migrations").catch(() => [])).map((row) => row.version));
+		const behind = pendingMigrations(options.migrations, applied);
+		if (behind.length > 0) throw new CliError("check_failed", `The stack has not applied ${String(behind.length)} migration(s) (${behind.slice(0, 3).join(", ")}${behind.length > 3 ? ", ..." : ""}), so the diff would repeat them. Run supabase migration up, then diff again.`, { suggestion: "supabase migration up" });
+		const bin = await findPostgresBin(options, main.client);
+		const dump = join(scratch, "schema.sql");
+		log("Copying the stack's schema into a temporary database");
+		const dumped = await run(tool(bin, "pg_dump"), [
+			"--schema-only",
+			"--file",
+			dump,
+			admin
+		], options.root, options.env);
+		if (dumped.code !== 0) throw new CliError(dumped.code === 127 ? "dependency_missing" : "failed", dumped.code === 127 ? "db diff --in-stack needs pg_dump and psql from the stack's Postgres. Set BSB_PG_BIN to their directory." : `pg_dump failed: ${dumped.stderr.trim()}`);
+		await main.client.query(`create database ${quoteIdent(temp)} owner postgres`);
+		created = true;
+		if ((await run(tool(bin, "psql"), [
+			"-X",
+			"-q",
+			"-v",
+			"ON_ERROR_STOP=0",
+			"-d",
+			tempUrl,
+			"-f",
+			dump
+		], options.root, options.env)).code === 127) throw new CliError("dependency_missing", "db diff --in-stack needs psql from the stack's Postgres. Set BSB_PG_BIN to its directory.");
+		const copy = await open(tempUrl);
+		try {
+			await copy.client.query("set check_function_bodies = off");
+			const topLevel = new Set(options.files.map((file) => file.slice(options.schemasDir.length + 1).split("/")[0] ?? ""));
+			await dropManagedObjects(copy.client, new Set([...topLevel].filter((schema) => PLATFORM_SCHEMAS.has(schema))));
+			await copy.client.query("set role postgres");
+			log(`Applying ${String(options.files.length)} schema file(s)`);
+			const result = await applyInRounds(copy.client, options.root, options.files);
+			if (result.failed.length > 0) throw new CliError("failed", `${String(result.failed.length)} schema file(s) did not apply. ${result.error ?? ""}`.trim());
+		} finally {
+			await copy.close();
+		}
+		log("Diffing the stack against the schema files with pg-delta");
+		const diff = await supabase([
+			"db",
+			"diff",
+			"--use-pg-delta",
+			"--from",
+			"local",
+			"--to",
+			`${tempUrl}${tempUrl.includes("?") ? "&" : "?"}sslmode=disable`,
+			"--output-format",
+			"json"
+		], options.root, options.env);
+		if (diff.code !== 0) throw new CliError("supabase_cli_failed", `supabase db diff failed: ${(diff.stderr || diff.stdout).trim()}`);
+		return diffSql(diff.stdout).trim();
+	} finally {
+		if (created) await main.client.query(`drop database if exists ${quoteIdent(temp)} with (force)`).catch(() => void 0);
+		await main.close();
+		await rm(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/** The migration files under `supabase/migrations`, relative to the root. */
+async function migrationFiles(root, supabaseDir) {
+	const dir = join(supabaseDir, "migrations");
+	return (await readdir(join(root, dir)).catch(() => [])).filter((name) => name.endsWith(".sql")).toSorted().map((name) => join(dir, name));
+}
+//#endregion
+//#region src/cli/commands/db.ts
+const ARGS = {
+	file: {
+		type: "positional",
+		required: true,
+		variadic: true,
+		description: "SQL files, run in the order given"
+	},
+	"single-transaction": {
+		type: "boolean",
+		description: "Wrap every file in one transaction, so a failure keeps none"
+	}
+};
+/** Runs each file as one multi-statement script and reports the files it ran. */
+async function runDbQuery(config, args, env, open = connect, dbUrl, requireConsent = () => {}) {
+	const files = [...args._];
+	if (files.length === 0) throw new CliError("usage", "Pass at least one SQL file.", { flag: "file" });
+	const scripts = [];
+	for (const file of files) {
+		const path = resolve(config.root, file);
+		try {
+			scripts.push({
+				name: display(config.root, path),
+				sql: await readFile(path, "utf-8")
+			});
+		} catch (cause) {
+			throw new CliError("invalid_input", `Could not read ${file}: ${errorText(cause)}.`);
+		}
+	}
+	const url = await databaseUrl(config, env, dbUrl, args.stack ?? env.BSB_STACK);
+	if (!isLocalDatabaseUrl(url)) requireConsent({
+		effect: "database-write",
+		detail: `db query runs ${String(files.length)} file(s) against ${databaseHost(url)}`
+	});
+	const single = args["single-transaction"] === true;
+	const { client, close } = await open(url);
+	const ran = [];
+	try {
+		if (single) await client.query("begin");
+		for (const script of scripts) try {
+			await client.query(script.sql);
+			ran.push(script.name);
+		} catch (cause) {
+			if (single) await client.query("rollback");
+			return {
+				code: 1,
+				errorCode: "failed",
+				error: `${script.name}: ${errorText(cause)}${single ? " (nothing was kept)" : ""}`,
+				data: {
+					ran,
+					failed: script.name
+				}
+			};
+		}
+		if (single) await client.query("commit");
+	} finally {
+		await close();
+	}
+	return {
+		code: 0,
+		output: ran.map((name) => `Ran ${name}`).join("\n"),
+		data: {
+			ran,
+			singleTransaction: single
+		}
+	};
+}
+const dbQueryCommand = defineCliCommand({
+	meta: commandMeta("db query"),
+	args: {
+		...ARGS,
+		...DB_URL_STDIN_ARG,
+		...STACK_ARG
+	},
+	run: async (args, { config, env, io, log, requireConsent }) => {
+		const dbUrl = await stdinDatabaseUrl(args["db-url-stdin"], io);
+		return log.progress("Running the SQL files", () => runDbQuery(config, args, env, connect, dbUrl, requireConsent));
+	}
+});
+const DIFF_ARGS = {
+	file: {
+		type: "string",
+		alias: "f",
+		description: "Save the diff as supabase/migrations/<timestamp>_<name>.sql instead of printing it",
+		valueHint: "name"
+	},
+	"in-stack": {
+		type: "boolean",
+		description: "Diff inside the running stack with pg-delta, without the Supabase CLI's shadow database"
+	}
+};
+const DEFAULT_DIFF_DEPS = {
+	supabase: (args, root, env) => supabaseCli(args, root, env),
+	inStackDiff,
+	now: () => /* @__PURE__ */ new Date(),
+	log: () => {}
+};
+/**
+* The Supabase CLI's diff for the workflow. pg-delta's `declarative sync`
+* always writes a migration, so printing a diff under pg-delta runs in the
+* stack.
+*/
+function cliDiffCommand(workflow, name) {
+	switch (workflow) {
+		case "pg-delta": return name === void 0 ? void 0 : [
+			"db",
+			"schema",
+			"declarative",
+			"sync",
+			"--no-apply",
+			"-f",
+			name
+		];
+		case "migra": return name === void 0 ? ["db", "diff"] : [
+			"db",
+			"diff",
+			"-f",
+			name
+		];
+		default: return workflow;
+	}
+}
+/**
+* Turns the declarative schema into a migration with the Supabase CLI's command
+* for the project's workflow. When the CLI can't start its shadow database (no
+* shared memory segment left), or with `--in-stack`, it diffs inside the
+* running stack instead.
+*/
+async function runDbDiff(config, args, env, deps = DEFAULT_DIFF_DEPS) {
+	const name = args.file;
+	if (name !== void 0 && !/^[\w-]+$/u.test(name)) throw new CliError("invalid_value", `--file "${name}" must be letters, digits, dashes or underscores.`, { flag: "--file" });
+	const toml = await readSupabaseToml(config.root);
+	const workflow = sqlWorkflow(config, toml);
+	if (workflow === "migrations") throw new CliError("usage", "db diff turns declarative schema files into a migration, and this project writes migrations directly (sql.workflow = migrations).");
+	let fellBack = false;
+	const command = cliDiffCommand(workflow, name);
+	if (args["in-stack"] !== true && command !== void 0) {
+		const result = await deps.supabase(command, config.root, env);
+		if (result.code === 0) return {
+			code: 0,
+			output: result.stdout.trim() || "No schema changes.",
+			data: {
+				engine: "supabase",
+				command: ["supabase", ...command]
+			}
+		};
+		const output = `${result.stderr}\n${result.stdout}`;
+		if (!isShadowFailure(output)) return {
+			code: 1,
+			errorCode: "supabase_cli_failed",
+			error: `supabase ${command.join(" ")} failed: ${output.trim()}`,
+			data: {
+				engine: "supabase",
+				command: ["supabase", ...command]
+			}
+		};
+		fellBack = true;
+		deps.log("The Supabase CLI could not start its shadow database (no shared memory segment left), so db diff diffs inside the running stack. better-supabase stack prune frees segments.");
+	}
+	const url = await databaseUrl(config, env, void 0, args.stack ?? env.BSB_STACK);
+	if (!isLocalDatabaseUrl(url)) throw new CliError("usage", `db diff --in-stack works on a local stack, and the database is ${databaseHost(url)}.`);
+	const dir = toml?.dir ?? "supabase";
+	const sql = await deps.inStackDiff({
+		url,
+		root: config.root,
+		env,
+		files: (await schemaPaths(config.root, toml, workflow)).files,
+		schemasDir: declarativeSchemasDir(toml, workflow),
+		migrations: await migrationFiles(config.root, dir),
+		log: deps.log
+	});
+	const data = {
+		engine: "in-stack",
+		fellBack,
+		changes: sql !== ""
+	};
+	if (sql === "") return {
+		code: 0,
+		output: "No schema changes.",
+		data
+	};
+	if (name === void 0) return {
+		code: 0,
+		output: sql,
+		data
+	};
+	const path = join(config.root, dir, "migrations", `${migrationVersion(deps.now())}_${name}.sql`);
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, `${MIGRATION_HEADER}\n${sql}\n`);
+	return {
+		code: 0,
+		output: `Wrote ${display(config.root, path)}. Review it before you apply it.`,
+		data: {
+			...data,
+			file: display(config.root, path)
+		}
+	};
+}
+const dbDiffCommand = defineCliCommand({
+	meta: commandMeta("db diff"),
+	args: {
+		...DIFF_ARGS,
+		...STACK_ARG
+	},
+	run: (args, { config, env, log }) => log.progress("Diffing the schema files", () => runDbDiff(config, args, env, {
+		...DEFAULT_DIFF_DEPS,
+		log: log.info
+	}))
+});
+//#endregion
+export { dbDiffCommand, dbQueryCommand };

package/dist/cli/design-edit-B40ljpGZ.js

@@ -0,0 +1,205 @@
+import { n as CliError } from "./errors-BTe6A15O.js";
+import { t as isRecord } from "./guards-CUlDNYZs.js";
+import { f as setPathInConfig, p as setPathInJson } from "./config-edit-D46H0UHp.js";
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { readFile } from "node:fs/promises";
+import { DEFAULT_CONVENTIONS, PRESET_TENANT_NAMES, designOf, isPresetName, presetField, presetOf, presetValueLabel, readDesignFile, withPresetField } from "better-supabase/preset";
+//#region src/cli/conventions.ts
+const arg = (key, description) => ({
+	type: "string",
+	description,
+	valueHint: presetField(key).values.join("|")
+});
+/** The convention flags `init` and `apply` take; each one overrides the preset. */
+const CONVENTION_ARGS = {
+	casing: arg("casing", "Row keys: snake keeps the database's names (the default), camel renames them in the query"),
+	scope: arg("scope", "Row ownership (sql.scope): tenant (the default), user or none for one shared space"),
+	"tenant-name": {
+		type: "string",
+		description: "What a tenant is called (blocks.tenant.entities.organization): organization (the default), workspace, team or another lowercase name",
+		valueHint: "name"
+	},
+	access: arg("access", "Auth and permissions (blocks.access.model): roles (the default), catalog, provider or custom"),
+	"id-type": arg("idType", "The type of the access block's ids (blocks.access.idType): uuid (the default), text, bigint or integer"),
+	api: arg("api", "API schema (sql.api): none (the default) or api for security invoker wrappers in an api schema")
+};
+/** The flag of each convention. */
+const FLAGS = {
+	casing: "casing",
+	scope: "scope",
+	tenantName: "tenant-name",
+	access: "access",
+	idType: "id-type",
+	api: "api"
+};
+/** Every convention, in the order `init` asks for them (as on /create). */
+const KEYS = [
+	"casing",
+	"scope",
+	"tenantName",
+	"access",
+	"idType",
+	"api"
+];
+const TENANT_NAME = /^[a-z][a-z0-9_]{0,40}$/;
+/** The convention flags that were passed, each checked against its values. */
+function conventionFlags(args) {
+	const out = {};
+	for (const key of KEYS) {
+		const flag = FLAGS[key];
+		const value = args[flag];
+		if (value === void 0) continue;
+		if (key === "tenantName") {
+			if (!TENANT_NAME.test(value)) throw new CliError("usage", `--${flag} must be a lowercase name that starts with a letter (letters, digits and _), like workspace.`);
+		} else if (!presetField(key).values.some((each) => each === value)) throw new CliError("invalid_value", `--${flag} must be one of ${presetField(key).values.join(", ")}.`);
+		out[key] = value;
+	}
+	return out;
+}
+/** Whether any convention flag was passed. */
+const hasConventionFlags = (flags) => Object.keys(flags).length > 0;
+/**
+* `preset` with the flags' conventions. A preset code stores the tenant names
+* /create offers, so another `--tenant-name` throws.
+*/
+function withConventions(preset, flags) {
+	let next = preset;
+	for (const key of KEYS) {
+		const value = flags[key];
+		if (value === void 0) continue;
+		if (key === "tenantName" && !PRESET_TENANT_NAMES.some((name) => name === value)) throw new CliError("usage", `--tenant-name with a preset takes ${PRESET_TENANT_NAMES.join(", ")}. Leave it out and set blocks.tenant.entities.organization in the config for another name.`);
+		next = withPresetField(next, key, value);
+	}
+	return next;
+}
+/** The conventions with the flags over the defaults, for `--yes` and CI. */
+const defaultConventions = (flags) => ({
+	...DEFAULT_CONVENTIONS,
+	...flags
+});
+/**
+* Asks for each convention in /create's order, with its labels and hints. The
+* tenant name is asked only for tenant scope. Undefined when the person
+* cancels.
+*/
+async function promptConventions(prompts) {
+	const defaults = DEFAULT_CONVENTIONS;
+	const answers = {};
+	for (const key of KEYS) {
+		const scope = answers.scope ?? defaults.scope;
+		if (key === "tenantName" && scope !== "tenant") continue;
+		const field = presetField(key);
+		const values = key === "tenantName" ? PRESET_TENANT_NAMES : field.values;
+		const picked = await prompts.select(field.label, values.map((value) => {
+			const info = presetValueLabel(key, value);
+			return {
+				value,
+				label: info.label,
+				...info.hint === void 0 ? {} : { hint: info.hint }
+			};
+		}), defaults[key]);
+		if (picked === void 0) return;
+		answers[FLAGS[key]] = picked;
+	}
+	return {
+		...defaults,
+		...conventionFlags(answers)
+	};
+}
+/** The values a shell offers for each convention flag. */
+const CONVENTION_COMPLETIONS = {
+	casing: () => presetField("casing").values,
+	scope: () => presetField("scope").values,
+	"tenant-name": () => PRESET_TENANT_NAMES,
+	access: () => presetField("access").values,
+	"id-type": () => presetField("idType").values,
+	api: () => presetField("api").values
+};
+//#endregion
+//#region src/cli/create-url.ts
+/**
+* A query parameter of a `/create` URL, decoded; undefined for a name or a
+* code.
+*/
+function createUrlParam(input, name) {
+	const value = input?.match(new RegExp(`[?&]${name}=([^&#]*)`))?.[1];
+	return value === void 0 || value === "" ? void 0 : decodeURIComponent(value);
+}
+/** What `init` and `apply` print for a URL with `&authz=`. */
+const AUTHZ_NOTE = "The authorization library chosen on Create isn't part of the preset. Open Get code on Create for its setup, then set `authorization` in the config to its adapter.";
+//#endregion
+//#region src/cli/preset-input.ts
+/** Whether `--preset` names a design file rather than a preset or URL. */
+const isDesignFilePath = (input) => input.endsWith(".json");
+/**
+* Reads `--preset`: a named preset, a code, a `/create` URL, or the path of a
+* design file Create downloaded (relative to `root`). Throws a usage error
+* naming the problem.
+*/
+async function readPresetInput(input, root) {
+	try {
+		if (isDesignFilePath(input)) {
+			const path = resolve(root, input);
+			if (!existsSync(path)) throw new TypeError(`${input} doesn't exist. Download the design file from Create, or pass a preset name, code or URL.`);
+			return readDesignFile(await readFile(path, "utf-8"));
+		}
+		return {
+			preset: presetOf(input),
+			design: isPresetName(input) ? void 0 : await designOf(input)
+		};
+	} catch (error) {
+		throw new CliError("usage", error instanceof Error ? error.message : String(error));
+	}
+}
+//#endregion
+//#region src/cli/sql/design-edit.ts
+/** The `extraColumns` a block already has in the config, as plain strings. */
+function currentExtraColumns(config, module) {
+	const value = config?.blocks[module]?.options?.["extraColumns"];
+	if (!isRecord(value)) return {};
+	return Object.fromEntries(Object.entries(value).flatMap(([name, type]) => typeof type === "string" ? [[name, type]] : []));
+}
+/**
+* `source` with a `/create` design written into it: each block's
+* `options.extraColumns` (merged over the columns `config` already gives it)
+* and each table in `appTables`, replacing a table of the same name and keeping
+* the others. Positions only matter to the canvas and stay out.
+*/
+function writeDesign(file, source, design, config) {
+	const set = file.endsWith(".json") ? setPathInJson : setPathInConfig;
+	let text = source;
+	const apply = (path, value) => {
+		const edit = set(text, path, value);
+		if (!edit.ok) return `${path.join(".")} can't be set: ${edit.reason}`;
+		text = edit.text;
+	};
+	for (const [module, columns] of Object.entries(design.extraColumns ?? {})) {
+		const problem = apply([
+			"blocks",
+			module,
+			"options",
+			"extraColumns"
+		], {
+			...currentExtraColumns(config, module),
+			...columns
+		});
+		if (problem !== void 0) return {
+			ok: false,
+			reason: problem
+		};
+	}
+	for (const [name, table] of Object.entries(design.appTables ?? {})) {
+		const problem = apply(["appTables", name], table);
+		if (problem !== void 0) return {
+			ok: false,
+			reason: problem
+		};
+	}
+	return {
+		ok: true,
+		text
+	};
+}
+//#endregion
+export { CONVENTION_ARGS as a, defaultConventions as c, withConventions as d, createUrlParam as i, hasConventionFlags as l, readPresetInput as n, CONVENTION_COMPLETIONS as o, AUTHZ_NOTE as r, conventionFlags as s, writeDesign as t, promptConventions as u };