better-supabase 0.14.0 → 0.15.0

package/dist/cli/index.d.ts

@@ -454,9 +454,6 @@ export declare const help: Cli["help"];
 /** The names `run()` dispatches. */
 export declare const commandNames: Cli["commandNames"];
 //#endregion
-//#region src/cli/project/detect.d.ts
-type Framework = "next" | "hono" | "orpc" | "vite" | "expo" | "tanstack-query";
-//#endregion
 //#region src/cli/gen/render.d.ts
 interface RenderOptions {
   /**
@@ -467,10 +464,16 @@ interface RenderOptions {
   /** Writes the metadata into the main module, so it stands alone on stdout. */
   readonly inlineMeta?: boolean;
   /**
-   * The frameworks the record features get bindings for. Defaults to the ones
-   * the project's dependencies show.
+   * Whether the schema carries the installed blocks' repository extensions and
+   * the `validation` extension. `false` emits a bare `defineSchema(meta)`, for
+   * code that installs them with `.use()` itself. Defaults to `true`.
+   */
+  readonly extensions?: boolean;
+  /**
+   * Also renders the module the content mapper serves for `schema.bsb`, in
+   * `typesModule`. Mapper mode (`gen.contentMapper`) always renders it.
    */
-  readonly frameworks?: readonly Framework[];
+  readonly typesModule?: boolean;
 }
 /**
  * Renders every generated file for a snapshot, without touching disk:
@@ -481,12 +484,21 @@ interface RenderOptions {
 export declare function renderFiles(config: ResolvedConfig, snapshot: Snapshot, options?: RenderOptions): Promise<GeneratedFile[]>;
 //#endregion
 //#region src/cli/gen/blocks.d.ts
+/** A repository extension the generated schema installs. */
+interface SchemaExtension {
+  /** The export that builds it, from `subpath`. */
+  readonly export: string;
+  /** `blocks/<name>`, under the runtime import. */
+  readonly subpath: string;
+  /** The argument list of the call, `""` for none. */
+  readonly args: string;
+}
 /**
  * `blocks.generated.ts`: each installed block's schema, API schema and the
  * options its TypeScript side reads, for `defineBlocks(blockConfig, ...)`, and
  * the app table events. `undefined` when the config installs no blocks.
  */
-export declare function emitBlockConfig(config: Pick<ResolvedConfig, "appTables" | "blocks" | "blockNames" | "buckets" | "casing" | "output" | "sql" | "subjects">, options?: {
+export declare function emitBlockConfig(config: Pick<ResolvedConfig, "appTables" | "blocks" | "blockNames" | "buckets" | "casing" | "instances" | "output" | "sql" | "subjects">, options?: {
   readonly runtimeImport?: string;
 }): GeneratedFile | undefined;
 //#endregion
@@ -593,6 +605,11 @@ interface GenOptions extends SnapshotSource {
   readonly force?: boolean;
   /** Colors the `--check` diffs. */
   readonly paint?: Paint;
+  /**
+   * The config file, whose text keys the content mapper's cache; mapper mode
+   * stores the module it serves there.
+   */
+  readonly configFile?: string;
   /** Pre-loaded snapshot (tests, watch mode). */
   readonly snapshot?: Snapshot;
   /**
@@ -736,6 +753,17 @@ interface EmitOptions {
   readonly runtimeImport?: string;
   /** Import path from the generated module to `database.types.ts`. */
   readonly databaseTypesImport?: string;
+  /**
+   * The text of `database.types.ts`, written into the module instead of
+   * imported. The content mapper serves one virtual file, which has no sibling
+   * it could import.
+   */
+  readonly databaseTypes?: string;
+  /**
+   * Declares `meta` instead of importing it: a type-only module (the content
+   * mapper's) never reads the metadata.
+   */
+  readonly declareMeta?: boolean;
   /** Import path for each JSON type import, keyed by the configured path. */
   readonly importPathFor: (from: string) => string;
   /** Import path from the generated module to the metadata module (`emitMeta`). */
@@ -745,6 +773,13 @@ interface EmitOptions {
    * file.
    */
   readonly inlineMeta?: boolean;
+  /** The installed blocks' repository extensions, which the schema carries. */
+  readonly extensions?: readonly SchemaExtension[];
+  /**
+   * Import path to a generated module that exports `validators`; the schema
+   * then installs `validation` with them, so writes are checked.
+   */
+  readonly validatorsImport?: string;
 }
 /** Renders the generated module. */
 export declare function emitModule(model: Model, options: EmitOptions): string;
@@ -763,6 +798,6 @@ export declare function emitModule(model: Model, options: EmitOptions): string;
 export declare function loadConfig(cwd: string, explicit?: string, environment?: string, path?: string | undefined): Promise<ResolvedConfig>;
 //#endregion
 //#region src/cli/version.d.ts
-export declare const VERSION = "0.14.0";
+export declare const VERSION = "0.15.0";
 //#endregion
 export type { Catalog, CatalogCheck, CatalogColumn, CatalogColumnGrant, CatalogEnum, CatalogForeignKey, CatalogFunction, CatalogFunctionArg, CatalogGrant, CatalogIndex, CatalogPolicy, CatalogTable, CatalogTrigger, CatalogUnique, Choice, Cli, CliArgs, CliCommand, CliCommandDef, CliContext, CliEnv, CliErrorCode, CliErrorOptions, CliIo, CliLog, CliProblem, CliProblemExtensions, CommandResult, CreateCliOptions, ExitCode, ExtrasFunction, ExtrasHook, ExtrasHookFunction, ExtrasTable, ForeignKeyAction, Format, GeneratorMetadata, IntrospectionSource, ManagementSourceOptions, NextStep, Paint, Prompter, Queryable, RunOptions, RunResult, Snapshot, SnapshotBucket, SnapshotExtras };

package/dist/cli/index.js

@@ -1,12 +1,12 @@
-import { a as list, r as defineCliCommand } from "./command-33pu13LT.js";
-import { i as run, n as createCli, r as help, t as commandNames } from "./run-CE2s5TDh.js";
-import { t as VERSION } from "./version-CTqnp3HO.js";
+import { a as list, r as defineCliCommand } from "./command-CQ61x6gN.js";
+import { i as run, n as createCli, r as help, t as commandNames } from "./run-DYhLBcFW.js";
+import { t as VERSION } from "./version-Du4CgONY.js";
 import { n as CliError, t as CLI_ERRORS_URL } from "./errors-BTe6A15O.js";
-import { a as buildModel, r as emitModule, t as GENERATED_HEADER } from "./emit-DbQeLlHt.js";
-import { S as emitBlockConfig, n as runGen, x as renderFiles } from "./run-KXjrgNCH.js";
-import { t as toCatalog } from "./catalog-CNM0ViIh.js";
-import { s as loadConfig } from "./config-CjgXMZW2.js";
-import { a as serializeSnapshot, d as managementSource, f as pgSource, i as parseSnapshot, l as introspect, t as loadSnapshot } from "./snapshot-Dkwxc1uV.js";
+import { a as serializeSnapshot, i as parseSnapshot, l as introspect, t as loadSnapshot } from "./snapshot-C8MVPyO8.js";
+import { a as emitBlockConfig, l as buildModel, o as GENERATED_HEADER, r as renderFiles, s as emitModule } from "./render-ucJmUyuM.js";
+import { a as toCatalog, n as managementSource, r as pgSource } from "./source-DANaJJVc.js";
+import { s as loadConfig } from "./config-9t5ec_N7.js";
+import { n as runGen } from "./run-CvYVAztY.js";
 //#region src/cli/introspect/from-catalog.ts
 /**
 * Builds a snapshot from catalog records: the inverse of `toCatalog`. Tests and

package/dist/cli/init-D-aDv9r5.js

@@ -0,0 +1,440 @@
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
+import { i as plain } from "./style-Bm2X5JrN.js";
+import { n as CliError } from "./errors-BTe6A15O.js";
+import { r as readIfExists } from "./io-DH1kcmmP.js";
+import { l as TYPEGEN_VERSION } from "./cache-CXgR_Ahi.js";
+import { a as findConfig, s as loadConfig } from "./config-9t5ec_N7.js";
+import { r as contentMapperFiles } from "./content-mapper-DNs7lTu7.js";
+import { i as changeLines, n as PLAN_ARGS, r as applyPlan, u as planResult } from "./files-CX71yBm8.js";
+import { C as promptConventions, S as hasConventionFlags, _ as templatePlan, b as conventionFlags, c as AUTHZ_NOTE, d as chooseIntegrations, f as integrationFiles, g as templateContextFor, h as parseIntegrations, i as blocksWiringPath, l as createUrlParam, m as packagesFor, o as writeDesign, p as overwrite, r as blockConfigImport, s as readPresetInput, u as CANCELLED, v as CONVENTION_ARGS, w as withConventions, x as defaultConventions, y as CONVENTION_COMPLETIONS } from "./add-BgsUjCan.js";
+import { a as wiringFiles, c as baseFiles, f as needsLib, i as wiringChecklist, m as suggestedIntegrations, n as latestMigrationVersion, o as wiringFor, p as resolveIntegrations, r as configInstances, s as TEMPLATES } from "./migration-safety-D7PhzFxm.js";
+import { n as installCommand, t as detectProject } from "./detect-D9JaAX20.js";
+import { s as enablePgDelta, t as syncModules } from "./sync-btj01bcM.js";
+import { existsSync } from "node:fs";
+import { join, posix, resolve } from "node:path";
+import { glob, readFile } from "node:fs/promises";
+import { groupConfig, resolveConfig } from "better-supabase/config";
+import { PRESETS, PRESET_NAMES, conventionConfig, designConfig, glueCommand, integrationsForFramework, isPresetName, presetBlocksSource, presetGlue, presetSpec, resolvePreset } from "better-supabase/preset";
+//#region src/cli/project/workspace.ts
+const unquote = (value) => value.replace(/\s+#.*$/, "").trim().replace(/^(["'])(.*)\1$/, "$2");
+/** The `packages` globs of `pnpm-workspace.yaml`, in block or flow style. */
+function pnpmWorkspacePatterns(text) {
+	const lines = text.split(/\r?\n/);
+	const start = lines.findIndex((line) => /^packages\s*:/.test(line));
+	if (start === -1) return [];
+	const inline = /^packages\s*:\s*\[(.*)\]\s*(?:#.*)?$/.exec(lines[start]);
+	if (inline) return inline[1].split(",").map(unquote).filter((entry) => entry !== "");
+	const patterns = [];
+	for (const line of lines.slice(start + 1)) {
+		if (/^\s*(?:#.*)?$/.test(line)) continue;
+		const item = /^\s+-\s*(.+)$/.exec(line);
+		if (!item) break;
+		patterns.push(unquote(item[1]));
+	}
+	return patterns.filter((entry) => entry !== "");
+}
+function packageJsonPatterns(workspaces) {
+	let list = workspaces;
+	if (typeof workspaces === "object" && workspaces !== null && "packages" in workspaces) list = workspaces.packages;
+	return Array.isArray(list) ? list.filter((entry) => typeof entry === "string") : [];
+}
+async function matches(root, pattern) {
+	const dirs = [];
+	const base = pattern.replace(/^\.\//, "").replace(/\/$/, "");
+	for await (const path of glob(`${base}/package.json`, {
+		cwd: root,
+		exclude: (name) => name === "node_modules"
+	})) dirs.push(posix.dirname(path.replaceAll("\\", "/")));
+	return dirs;
+}
+/**
+* The workspace declared at `root` by `pnpm-workspace.yaml` or the `workspaces`
+* field of `package.json`, with its packages in path order. `undefined` when
+* `root` declares none.
+*/
+async function detectWorkspace(root) {
+	let file;
+	let patterns;
+	const yaml = join(root, "pnpm-workspace.yaml");
+	if (existsSync(yaml)) {
+		file = "pnpm-workspace.yaml";
+		patterns = pnpmWorkspacePatterns(await readFile(yaml, "utf-8"));
+	} else {
+		const path = join(root, "package.json");
+		if (!existsSync(path)) return;
+		let pkg;
+		try {
+			pkg = JSON.parse(await readFile(path, "utf-8"));
+		} catch {
+			return;
+		}
+		if (typeof pkg !== "object" || pkg === null || !("workspaces" in pkg)) return;
+		file = "package.json";
+		patterns = packageJsonPatterns(pkg.workspaces);
+		if (patterns.length === 0) return;
+	}
+	const included = /* @__PURE__ */ new Set();
+	const excluded = /* @__PURE__ */ new Set();
+	for (const pattern of patterns) {
+		const negated = pattern.startsWith("!");
+		for (const dir of await matches(root, negated ? pattern.slice(1) : pattern)) (negated ? excluded : included).add(dir);
+	}
+	const dirs = [...included].filter((dir) => dir !== "." && !excluded.has(dir)).toSorted();
+	const packages = await Promise.all(dirs.map(async (dir) => ({
+		dir,
+		project: await detectProject(join(root, dir))
+	})));
+	return {
+		file,
+		packages
+	};
+}
+/**
+* The package `init` suggests: one that uses better-supabase, then one with a
+* framework.
+*/
+function suggestedPackage(workspace) {
+	const packages = workspace.packages;
+	return (packages.find((entry) => "better-supabase" in entry.project.dependencies) ?? packages.find((entry) => entry.project.frameworks.length > 0) ?? packages[0])?.dir;
+}
+//#endregion
+//#region src/cli/commands/init.ts
+const SQL_WORKFLOWS = [
+	"pg-delta",
+	"migra",
+	"migrations"
+];
+const isSqlWorkflow = (value) => SQL_WORKFLOWS.some((workflow) => workflow === value);
+const INIT_ARGS = {
+	integration: {
+		type: "string",
+		description: "Integrations to add next to the detected ones: next, hono, orpc, edge, expo, mcp, client, react",
+		valueHint: "integration,..."
+	},
+	package: {
+		type: "string",
+		description: "Workspace package to write to, relative to --cwd",
+		valueHint: "dir"
+	},
+	workflow: {
+		type: "string",
+		description: "How the SQL modules reach the database: pg-delta (the default), migra or migrations",
+		valueHint: "pg-delta|migra|migrations"
+	},
+	preset: {
+		type: "string",
+		description: "A named preset, a design code from /create, its URL or a downloaded design file: the config starts from it, and init writes its modules and lib/blocks.ts",
+		valueHint: "name|code|url|file"
+	},
+	lite: {
+		type: "boolean",
+		description: "Run on Supabase Lite: install @supabase/lite and use its CLI in the next steps"
+	},
+	"content-mapper": {
+		type: "boolean",
+		description: "Serve the schema types through the TypeScript 7.1 content mapper: sets gen.contentMapper and adds it to tsconfig.json"
+	}
+};
+/** The minor of `@supabase/lite` the `backend: 'lite'` option targets. */
+const LITE_VERSION = "0.11";
+/**
+* Pg (or `@supabase/lite`, with `lite`) and the pinned postgrest-typegen as dev
+* dependencies, the ones the project lacks.
+*/
+function devPackages(project, lite) {
+	const database = lite ? "@supabase/lite" : "pg";
+	const missing = [...database in project.dependencies ? [] : [lite ? `${database}@${LITE_VERSION}` : database], ..."@supabase/postgrest-typegen" in project.dependencies ? [] : [`@supabase/postgrest-typegen@${TYPEGEN_VERSION}`]];
+	return missing.length === 0 ? [] : [missing];
+}
+/**
+* Where `init` writes: `--cwd`, `--package` (or the `package=` of a Create
+* URL), or the workspace package the person picks.
+*/
+async function initTarget(cwd, pkg, prompts) {
+	if (pkg !== void 0) {
+		const dir = posix.normalize(pkg.replaceAll("\\", "/"));
+		if (!existsSync(join(cwd, dir, "package.json"))) throw new CliError("usage", `--package ${pkg} has no package.json. Pass the directory of a workspace package, relative to --cwd.`);
+		return { dir: dir.replace(/\/$/, "") || "." };
+	}
+	const workspace = await detectWorkspace(cwd);
+	if (!workspace || workspace.packages.length === 0) return { dir: "." };
+	const suggested = suggestedPackage(workspace) ?? ".";
+	if (!prompts) {
+		const others = workspace.packages.map((entry) => entry.dir).filter((dir) => dir !== suggested);
+		throw new CliError("input_required", `${workspace.file} makes this a workspace root. Pass --package with the package that owns the runtime (${workspace.packages.map((entry) => entry.dir).join(", ")}), or --package . to write here.`, {
+			missing: ["--package"],
+			choices: { "--package": [.../* @__PURE__ */ new Set([
+				suggested,
+				...others,
+				"."
+			])] }
+		});
+	}
+	const dir = await prompts.select("Package that owns the runtime", [...workspace.packages.map((entry) => ({
+		value: entry.dir,
+		label: entry.dir,
+		...entry.project.name ? { hint: entry.project.name } : {}
+	})), {
+		value: ".",
+		label: ".",
+		hint: "the workspace root"
+	}], suggested);
+	return dir === void 0 ? CANCELLED : { dir };
+}
+/** The preset `--preset` names, or the one the person picks; `null` for none. */
+async function chosenPreset(args, flags, prompts, root) {
+	let value = args.preset;
+	if (value === void 0 && prompts && !hasConventionFlags(flags) && args.integration === void 0) {
+		const picked = await prompts.select("Preset", [{
+			value: "none",
+			label: "None",
+			hint: "add blocks later"
+		}, ...PRESET_NAMES.map((name) => ({
+			value: name,
+			label: PRESETS[name].title,
+			hint: PRESETS[name].description
+		}))], "none");
+		if (picked === void 0) return CANCELLED;
+		if (picked !== "none") value = picked;
+	}
+	if (value === void 0) return null;
+	const input = await readPresetInput(value, root);
+	const design = input.design;
+	const preset = withConventions(input.preset, flags);
+	const resolved = resolvePreset(preset);
+	if (resolved.conflicts.length > 0) throw new CliError("usage", `The preset can't install: ${resolved.conflicts.map((conflict) => `${conflict.block ?? conflict.field ?? ""} (${conflict.reason})`).join("; ")}.`);
+	if (design !== void 0) try {
+		designConfig(resolved, design);
+	} catch (error) {
+		throw new CliError("usage", error instanceof Error ? error.message : String(error));
+	}
+	return {
+		value: isPresetName(value) && !hasConventionFlags(flags) ? value : presetSpec(preset),
+		resolved,
+		design
+	};
+}
+/** `files` with the design's keys written into the config file. */
+function withDesign(files, design) {
+	if (design === void 0) return [...files];
+	const out = [];
+	for (const file of files) {
+		if (posix.basename(file.path) !== "better-supabase.config.ts") {
+			out.push(file);
+			continue;
+		}
+		const edit = writeDesign(file.path, file.contents, design);
+		if (!edit.ok) return `The design can't be written to ${file.path}: ${edit.reason}`;
+		out.push({
+			...file,
+			contents: edit.text
+		});
+	}
+	return out;
+}
+async function runInit(config, args, prompts, now = () => /* @__PURE__ */ new Date()) {
+	const flags = conventionFlags(args);
+	const chosen = await chosenPreset(args, flags, prompts, config.root);
+	if (chosen !== null && "code" in chosen) return chosen;
+	let conventions = chosen?.resolved.preset;
+	conventions ??= prompts && !hasConventionFlags(flags) ? await promptConventions(prompts) : defaultConventions(flags);
+	if (conventions === void 0) return CANCELLED;
+	const casing = conventions.casing;
+	const keys = conventionConfig(conventions);
+	const workflow = args.workflow ?? "pg-delta";
+	if (!isSqlWorkflow(workflow)) throw new CliError("usage", "--workflow must be \"pg-delta\", \"migra\" or \"migrations\"");
+	const target = await initTarget(config.root, args.package ?? createUrlParam(args.preset, "package"), prompts);
+	if ("code" in target) return target;
+	const root = resolve(config.root, target.dir);
+	const inPackage = target.dir !== ".";
+	const workspaceProject = await detectProject(config.root);
+	const project = inPackage ? {
+		...await detectProject(root),
+		packageManager: workspaceProject.packageManager
+	} : workspaceProject;
+	const lite = args.lite === true;
+	const contentMapper = args["content-mapper"] === true;
+	const mapperKey = contentMapper ? { contentMapper } : {};
+	const installTarget = inPackage ? {
+		dir: target.dir,
+		name: project.name
+	} : void 0;
+	const requested = parseIntegrations(list(args.integration));
+	if (typeof requested === "string") throw new CliError("usage", requested);
+	const fromPreset = parseIntegrations(chosen === null ? [] : [...chosen.resolved.preset.integrations, ...integrationsForFramework(chosen.resolved.preset.framework)]);
+	if (typeof fromPreset === "string") throw new CliError("usage", fromPreset);
+	const detected = resolveIntegrations([
+		...suggestedIntegrations(project.frameworks),
+		...requested,
+		...fromPreset
+	]);
+	const picked = args.integration === void 0 && prompts && chosen === null ? await chooseIntegrations(prompts, detected) : detected;
+	if (picked === void 0) return CANCELLED;
+	const integrations = resolveIntegrations(picked);
+	const hasConfig = findConfig(root) !== void 0;
+	let generated = posix.normalize(posix.join(project.srcDir, "lib/supabase/generated.ts"));
+	if (hasConfig) generated = inPackage ? (await loadConfig(root)).output : config.output;
+	const templateContext = templateContextFor(project, generated, chosen !== null || keys.blocks !== void 0);
+	const migrationSince = await latestMigrationVersion(root) ?? await latestMigrationVersion(config.root);
+	const since = migrationSince === void 0 ? {} : { migrationSince };
+	const files = withDesign([
+		...baseFiles(templateContext, casing, needsLib(integrations), integrations, workflow, chosen?.value, chosen === null ? {
+			...keys.sql === void 0 ? {} : { sql: keys.sql },
+			...keys.blocks === void 0 ? {} : { blocks: keys.blocks },
+			provider: conventions.access === "provider",
+			...mapperKey,
+			...since
+		} : {
+			provider: conventions.access === "provider",
+			...mapperKey,
+			...since
+		}),
+		...integrationFiles(integrations, templateContext),
+		...chosen === null ? [] : [{
+			path: blocksWiringPath(templateContext),
+			contents: presetBlocksSource(chosen.resolved, blockConfigImport(templateContext))
+		}]
+	], chosen?.design);
+	if (typeof files === "string") return {
+		code: 1,
+		error: files
+	};
+	const force = await overwrite(root, files, args, prompts, config.root);
+	if (force === void 0) return CANCELLED;
+	const where = inPackage ? ` in ${target.dir}` : "";
+	const applied = await applyPlan(templatePlan(root, files, "better-supabase init", config.root), {
+		...args,
+		force
+	});
+	if (applied.mode === "check" && applied.drift) return planResult(templatePlan(root, files, "better-supabase init", config.root), applied);
+	const lines = [
+		project.frameworks.length > 0 ? `Found ${project.frameworks.join(", ")}${where}.` : `No framework found${where}.`,
+		"",
+		...changeLines(applied),
+		...workflow === "pg-delta" ? await enablePgDelta(root, args["dry-run"] === true, config.root) : []
+	];
+	const mapper = contentMapper ? await contentMapperFiles(root) : {
+		files: [],
+		notes: []
+	};
+	if (mapper.files.length > 0) {
+		const wrote = await applyPlan({
+			root,
+			regenerate: "better-supabase init",
+			files: mapper.files
+		}, {
+			...args,
+			force: true
+		});
+		lines.push(...changeLines(wrote));
+	}
+	if (createUrlParam(args.preset, "authz") !== void 0) lines.push("", AUTHZ_NOTE);
+	if (chosen !== null) {
+		const presetConfig = resolveConfig(groupConfig({
+			preset: chosen.value,
+			casing,
+			output: generated,
+			...designKeys(chosen.resolved, chosen.design),
+			...workflow === "pg-delta" ? {} : { sql: { workflow } }
+		}), root);
+		const synced = await syncModules(presetConfig, { "dry-run": args["dry-run"] === true }, plain, now);
+		lines.push("", synced.output ?? synced.error ?? "");
+		const glue = presetGlue(chosen.resolved);
+		const glueLine = glue.length > 0 ? glueCommand(glue) : void 0;
+		const wiring = wiringFor(configInstances(presetConfig));
+		const written = await wiringFiles(templateContext, wiring, (path) => readIfExists(resolve(root, path)));
+		if (written.files.length > 0) {
+			const wrote = await applyPlan({
+				root,
+				regenerate: "better-supabase init",
+				files: written.files
+			}, {
+				...args,
+				force: true
+			});
+			lines.push("", ...changeLines(wrote));
+		}
+		lines.push(...written.notes.length > 0 ? ["", ...written.notes] : []);
+		const checklist = wiringChecklist(templateContext, wiring, glueLine);
+		if (checklist.length > 0) lines.push("", "To finish the wiring:", ...checklist);
+	}
+	const packages = packagesFor(project, integrations);
+	const cwdFlag = inPackage ? ` --cwd ${target.dir}` : "";
+	const install = (names, dev) => installCommand(project.packageManager, names, dev, installTarget);
+	const next = [
+		...packages.length > 0 ? [{
+			command: install(packages, false),
+			when: "installs the packages"
+		}] : [],
+		...devPackages(project, lite).map((names) => ({
+			command: install(names, true),
+			when: "installs the dev tools"
+		})),
+		...project.hasSupabase || workspaceProject.hasSupabase ? [] : [{
+			command: lite ? "npx lite init" : "supabase init",
+			when: "creates the supabase folder"
+		}],
+		...lite ? [{
+			command: "npx lite dev",
+			when: "starts the local stack"
+		}] : [{
+			command: "supabase start",
+			when: "starts the local stack"
+		}, {
+			command: `better-supabase dev env${cwdFlag}`,
+			when: "writes the stack's keys to .env"
+		}],
+		{
+			command: `better-supabase gen${cwdFlag}`,
+			when: "generates the typed client"
+		},
+		{
+			command: "better-supabase skills install",
+			when: "installs the agent skills"
+		}
+	];
+	const hints = [
+		...lite ? ["Before npx lite dev, set jwt_secret = \"env(SUPABASE_JWT_SECRET)\" under [auth] in supabase/config.toml, and add SUPABASE_URL=http://127.0.0.1:54321 and a SUPABASE_JWT_SECRET of 32 or more characters to .env", "Pass backend: 'lite' to createServer (or createNext, createHono, createEdge, createOrpc): https://bettersupabase.com/docs/platform/lite"] : [],
+		...mapper.notes,
+		...integrations.flatMap((name) => TEMPLATES[name].next ?? [])
+	];
+	if (hints.length > 0) lines.push("", ...hints.map((hint) => `- ${hint}`));
+	return {
+		code: 0,
+		output: lines.join("\n"),
+		data: {
+			frameworks: project.frameworks,
+			...inPackage ? { package: target.dir } : {},
+			integrations,
+			...chosen === null ? {} : { preset: chosen.value },
+			files: applied.changes,
+			hints
+		},
+		next
+	};
+}
+const initCommand = defineCliCommand({
+	meta: commandMeta("init"),
+	args: {
+		...CONVENTION_ARGS,
+		...INIT_ARGS,
+		...PLAN_ARGS
+	},
+	lists: ["integration"],
+	completions: {
+		...CONVENTION_COMPLETIONS,
+		preset: () => PRESET_NAMES
+	},
+	run: (args, { config, io }) => runInit(config, args, io.prompts)
+});
+/** The `blocks` and `appTables` keys a design adds to the preset's config. */
+function designKeys(resolved, design) {
+	if (design === void 0) return {};
+	const { blocks, appTables } = designConfig(resolved, design);
+	return {
+		blocks,
+		...appTables === void 0 ? {} : { appTables }
+	};
+}
+//#endregion
+export { initCommand };

package/dist/cli/keys-DGEpMbeB.js

@@ -0,0 +1,106 @@
+import { p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
+import { t as display } from "./io-DH1kcmmP.js";
+import { m as supabaseDir } from "./supabase-toml-CncmQbO0.js";
+import { i as changeLines, r as applyPlan } from "./files-CX71yBm8.js";
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { readFile } from "node:fs/promises";
+//#region src/cli/commands/keys.ts
+const ARGS = {
+	out: {
+		type: "string",
+		description: "Defaults to keys.output, then supabase/signing_keys.json",
+		valueHint: "file"
+	},
+	rotate: {
+		type: "boolean",
+		description: "Put a new key first (it signs) and keep the old ones (they still verify)"
+	},
+	force: {
+		type: "boolean",
+		description: "Replace the file"
+	},
+	"dry-run": {
+		type: "boolean",
+		description: "Print what would change and write nothing"
+	}
+};
+async function createSigningKey() {
+	const pair = await crypto.subtle.generateKey({
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, true, ["sign", "verify"]);
+	const jwk = await crypto.subtle.exportKey("jwk", pair.privateKey);
+	return {
+		kty: "EC",
+		kid: crypto.randomUUID(),
+		use: "sig",
+		key_ops: ["sign", "verify"],
+		alg: "ES256",
+		ext: true,
+		crv: jwk.crv,
+		x: jwk.x,
+		y: jwk.y,
+		d: jwk.d
+	};
+}
+async function runKeys(config, args) {
+	const dir = supabaseDir(config.root);
+	const out = args.out ?? config.keys.output ?? `${dir}/signing_keys.json`;
+	const path = resolve(config.root, out);
+	const rotate = args.rotate === true;
+	const exists = existsSync(path);
+	if (exists && !rotate && args.force !== true) return {
+		code: 1,
+		error: `${display(config.root, out)} exists. Use --rotate to add a key or --force to replace it.`
+	};
+	const previous = exists && rotate ? JSON.parse(await readFile(path, "utf-8")) : [];
+	if (!Array.isArray(previous)) return {
+		code: 1,
+		errorCode: "invalid_input",
+		error: `${display(config.root, out)} is not a JSON array of keys.`
+	};
+	const key = await createSigningKey();
+	const applied = await applyPlan({
+		root: args.out === void 0 && config.keys.output === void 0 ? resolve(config.root, dir, "..") : config.root,
+		base: config.root,
+		regenerate: "better-supabase dev keys --rotate",
+		files: [{
+			path,
+			contents: `${JSON.stringify([key, ...previous], null, 2)}\n`,
+			mode: 384,
+			secret: true,
+			note: `key ${key.kid}${previous.length > 0 ? `, ${previous.length} older key${previous.length === 1 ? "" : "s"} kept for verification` : ""}`
+		}]
+	}, { "dry-run": args["dry-run"] });
+	const lines = changeLines(applied);
+	const toml = resolve(config.root, dir, "config.toml");
+	const configured = existsSync(toml) && /^\s*signing_keys_path\s*=/m.test(await readFile(toml, "utf-8"));
+	if (!configured) {
+		const relativeToSupabase = out.startsWith(`${dir}/`) ? `./${out.slice(dir.length + 1)}` : out;
+		lines.push("", `Add it to ${dir}/config.toml and restart the stack:`, "  [auth]", `  signing_keys_path = "${relativeToSupabase}"`);
+	}
+	const gitignored = [resolve(config.root, ".gitignore"), resolve(config.root, dir, ".gitignore")];
+	let ignored = false;
+	for (const file of gitignored) if (existsSync(file) && (await readFile(file, "utf-8")).includes("signing_keys")) ignored = true;
+	if (!ignored) lines.push("", `Warning: add ${out} to .gitignore; it holds a private key.`);
+	return {
+		code: 0,
+		output: lines.join("\n"),
+		data: {
+			file: display(config.root, out),
+			files: applied.changes,
+			kid: key.kid,
+			kept: previous.length,
+			configured,
+			gitignored: ignored
+		}
+	};
+}
+const keysCommand = defineCliCommand({
+	meta: commandMeta("dev keys"),
+	args: ARGS,
+	run: (args, { config }) => runKeys(config, args)
+});
+//#endregion
+export { keysCommand };