better-supabase 0.8.0 → 0.10.0

package/dist/cli/init-BwLTO6XG.js

@@ -0,0 +1,400 @@
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
+import { i as plain } from "./style-2JfIPVMQ.js";
+import { n as CliError } from "./errors-Caiz_0so.js";
+import { t as TYPEGEN_VERSION } from "./typegen-version-BNBPI4Eu.js";
+import { a as findConfig, s as loadConfig } from "./config-Bi_UBxXl.js";
+import { n as applyPlan, r as changeLines, s as planResult, t as PLAN_ARGS } from "./files-DDvAwTko.js";
+import { _ as suggestedIntegrations, a as CANCELLED, c as overwrite, d as templateContextFor, f as templatePlan, g as resolveIntegrations, h as needsLib, l as packagesFor, m as baseFiles, n as blockConfigImport, o as chooseIntegrations, p as TEMPLATES, r as blocksWiringPath, s as integrationFiles, u as parseIntegrations } from "./add-CUS0AiBh.js";
+import { n as installCommand, t as detectProject } from "./detect-BeLVeNpA.js";
+import { s as enablePgDelta } from "./write-Dp1XlAVM.js";
+import { n as latestMigrationVersion } from "./migration-safety-LaGVPPuD.js";
+import { a as CONVENTION_COMPLETIONS, c as hasConventionFlags, i as CONVENTION_ARGS, l as promptConventions, n as AUTHZ_NOTE, o as conventionFlags, r as createUrlParam, s as defaultConventions, t as writeDesign, u as withConventions } from "./design-edit-B-WsnhUF.js";
+import { t as syncModules } from "./sync-CJ-ft-tl.js";
+import { existsSync } from "node:fs";
+import { join, posix, resolve } from "node:path";
+import { glob, readFile } from "node:fs/promises";
+import { PRESETS, PRESET_NAMES, conventionConfig, designConfig, designOf, encodePreset, glueCommand, integrationsForFramework, isPresetName, presetBlocksSource, presetGlue, presetOf, resolvePreset } from "better-supabase/preset";
+import { resolveConfig } from "better-supabase/config";
+//#region src/cli/project/workspace.ts
+const unquote = (value) => value.replace(/\s+#.*$/, "").trim().replace(/^(["'])(.*)\1$/, "$2");
+/** The `packages` globs of `pnpm-workspace.yaml`, in block or flow style. */
+function pnpmWorkspacePatterns(text) {
+	const lines = text.split(/\r?\n/);
+	const start = lines.findIndex((line) => /^packages\s*:/.test(line));
+	if (start === -1) return [];
+	const inline = /^packages\s*:\s*\[(.*)\]\s*(?:#.*)?$/.exec(lines[start]);
+	if (inline) return inline[1].split(",").map(unquote).filter((entry) => entry !== "");
+	const patterns = [];
+	for (const line of lines.slice(start + 1)) {
+		if (/^\s*(?:#.*)?$/.test(line)) continue;
+		const item = /^\s+-\s*(.+)$/.exec(line);
+		if (!item) break;
+		patterns.push(unquote(item[1]));
+	}
+	return patterns.filter((entry) => entry !== "");
+}
+function packageJsonPatterns(workspaces) {
+	let list = workspaces;
+	if (typeof workspaces === "object" && workspaces !== null && "packages" in workspaces) list = workspaces.packages;
+	return Array.isArray(list) ? list.filter((entry) => typeof entry === "string") : [];
+}
+async function matches(root, pattern) {
+	const dirs = [];
+	const base = pattern.replace(/^\.\//, "").replace(/\/$/, "");
+	for await (const path of glob(`${base}/package.json`, {
+		cwd: root,
+		exclude: (name) => name === "node_modules"
+	})) dirs.push(posix.dirname(path.replaceAll("\\", "/")));
+	return dirs;
+}
+/**
+* The workspace declared at `root` by `pnpm-workspace.yaml` or the
+* `workspaces` field of `package.json`, with its packages in path order.
+* `undefined` when `root` declares none.
+*/
+async function detectWorkspace(root) {
+	let file;
+	let patterns;
+	const yaml = join(root, "pnpm-workspace.yaml");
+	if (existsSync(yaml)) {
+		file = "pnpm-workspace.yaml";
+		patterns = pnpmWorkspacePatterns(await readFile(yaml, "utf-8"));
+	} else {
+		const path = join(root, "package.json");
+		if (!existsSync(path)) return;
+		let pkg;
+		try {
+			pkg = JSON.parse(await readFile(path, "utf-8"));
+		} catch {
+			return;
+		}
+		if (typeof pkg !== "object" || pkg === null || !("workspaces" in pkg)) return;
+		file = "package.json";
+		patterns = packageJsonPatterns(pkg.workspaces);
+		if (patterns.length === 0) return;
+	}
+	const included = /* @__PURE__ */ new Set();
+	const excluded = /* @__PURE__ */ new Set();
+	for (const pattern of patterns) {
+		const negated = pattern.startsWith("!");
+		for (const dir of await matches(root, negated ? pattern.slice(1) : pattern)) (negated ? excluded : included).add(dir);
+	}
+	const dirs = [...included].filter((dir) => dir !== "." && !excluded.has(dir)).sort();
+	const packages = await Promise.all(dirs.map(async (dir) => ({
+		dir,
+		project: await detectProject(join(root, dir))
+	})));
+	return {
+		file,
+		packages
+	};
+}
+/** The package `init` suggests: one that uses better-supabase, then one with a framework. */
+function suggestedPackage(workspace) {
+	const packages = workspace.packages;
+	return (packages.find((entry) => "better-supabase" in entry.project.dependencies) ?? packages.find((entry) => entry.project.frameworks.length > 0) ?? packages[0])?.dir;
+}
+//#endregion
+//#region src/cli/commands/init.ts
+const SQL_WORKFLOWS = [
+	"pg-delta",
+	"migra",
+	"migrations"
+];
+const isSqlWorkflow = (value) => SQL_WORKFLOWS.some((workflow) => workflow === value);
+const INIT_ARGS = {
+	integration: {
+		type: "string",
+		description: "Integrations to add next to the detected ones: next, hono, orpc, edge, expo, mcp, client, react",
+		valueHint: "integration,..."
+	},
+	package: {
+		type: "string",
+		description: "Workspace package to write to, relative to --cwd",
+		valueHint: "dir"
+	},
+	workflow: {
+		type: "string",
+		description: "How the SQL modules reach the database: pg-delta (the default), migra or migrations",
+		valueHint: "pg-delta|migra|migrations"
+	},
+	preset: {
+		type: "string",
+		description: "A named preset, a code from /create or its URL: the config starts from it, and init writes its modules and lib/blocks.ts",
+		valueHint: "name|code|url"
+	},
+	lite: {
+		type: "boolean",
+		description: "Run on Supabase Lite: install @supabase/lite and use its CLI in the next steps"
+	}
+};
+/** The minor of `@supabase/lite` the `backend: 'lite'` option targets. */
+const LITE_VERSION = "0.11";
+/**
+* pg (or `@supabase/lite`, with `lite`) and the pinned postgrest-typegen as
+* dev dependencies, the ones the project lacks.
+*/
+function devPackages(project, lite) {
+	const database = lite ? "@supabase/lite" : "pg";
+	const missing = [...database in project.dependencies ? [] : [lite ? `${database}@${LITE_VERSION}` : database], ..."@supabase/postgrest-typegen" in project.dependencies ? [] : [`@supabase/postgrest-typegen@${TYPEGEN_VERSION}`]];
+	return missing.length === 0 ? [] : [missing];
+}
+/**
+* Where `init` writes: `--cwd`, `--package` (or the `package=` of a Create
+* URL), or the workspace package the person picks.
+*/
+async function initTarget(cwd, pkg, prompts) {
+	if (pkg !== void 0) {
+		const dir = posix.normalize(pkg.replaceAll("\\", "/"));
+		if (!existsSync(join(cwd, dir, "package.json"))) throw new CliError("usage", `--package ${pkg} has no package.json. Pass the directory of a workspace package, relative to --cwd.`);
+		return { dir: dir.replace(/\/$/, "") || "." };
+	}
+	const workspace = await detectWorkspace(cwd);
+	if (!workspace || workspace.packages.length === 0) return { dir: "." };
+	const suggested = suggestedPackage(workspace) ?? ".";
+	if (!prompts) {
+		const others = workspace.packages.map((entry) => entry.dir).filter((dir) => dir !== suggested);
+		throw new CliError("input_required", `${workspace.file} makes this a workspace root. Pass --package with the package that owns the runtime (${workspace.packages.map((entry) => entry.dir).join(", ")}), or --package . to write here.`, {
+			missing: ["--package"],
+			choices: { "--package": [.../* @__PURE__ */ new Set([
+				suggested,
+				...others,
+				"."
+			])] }
+		});
+	}
+	const dir = await prompts.select("Package that owns the runtime", [...workspace.packages.map((entry) => ({
+		value: entry.dir,
+		label: entry.dir,
+		...entry.project.name ? { hint: entry.project.name } : {}
+	})), {
+		value: ".",
+		label: ".",
+		hint: "the workspace root"
+	}], suggested);
+	return dir === void 0 ? CANCELLED : { dir };
+}
+/** The preset `--preset` names, or the one the person picks; `null` for none. */
+async function chosenPreset(args, flags, prompts) {
+	let value = args.preset;
+	if (value === void 0 && prompts && !hasConventionFlags(flags) && args.integration === void 0) {
+		const picked = await prompts.select("Preset", [{
+			value: "none",
+			label: "None",
+			hint: "add blocks later"
+		}, ...PRESET_NAMES.map((name) => ({
+			value: name,
+			label: PRESETS[name].title,
+			hint: PRESETS[name].description
+		}))], "none");
+		if (picked === void 0) return CANCELLED;
+		if (picked !== "none") value = picked;
+	}
+	if (value === void 0) return null;
+	let preset;
+	let design;
+	try {
+		preset = presetOf(value);
+		design = isPresetName(value) ? void 0 : await designOf(value);
+	} catch (error) {
+		throw new CliError("usage", error instanceof Error ? error.message : String(error));
+	}
+	preset = withConventions(preset, flags);
+	const resolved = resolvePreset(preset);
+	if (resolved.conflicts.length > 0) throw new CliError("usage", `The preset can't install: ${resolved.conflicts.map((conflict) => `${conflict.block ?? conflict.field ?? ""} (${conflict.reason})`).join("; ")}.`);
+	if (design !== void 0) try {
+		designConfig(resolved, design);
+	} catch (error) {
+		throw new CliError("usage", error instanceof Error ? error.message : String(error));
+	}
+	return {
+		value: isPresetName(value) && !hasConventionFlags(flags) ? value : encodePreset(preset),
+		resolved,
+		design
+	};
+}
+/** `files` with the design's keys written into the config file. */
+function withDesign(files, design) {
+	if (design === void 0) return [...files];
+	const out = [];
+	for (const file of files) {
+		if (posix.basename(file.path) !== "better-supabase.config.ts") {
+			out.push(file);
+			continue;
+		}
+		const edit = writeDesign(file.path, file.contents, design);
+		if (!edit.ok) return `The design can't be written to ${file.path}: ${edit.reason}`;
+		out.push({
+			...file,
+			contents: edit.text
+		});
+	}
+	return out;
+}
+async function runInit(config, args, prompts, now = () => /* @__PURE__ */ new Date()) {
+	const flags = conventionFlags(args);
+	const chosen = await chosenPreset(args, flags, prompts);
+	if (chosen !== null && "code" in chosen) return chosen;
+	let conventions = chosen?.resolved.preset;
+	conventions ??= prompts && !hasConventionFlags(flags) ? await promptConventions(prompts) : defaultConventions(flags);
+	if (conventions === void 0) return CANCELLED;
+	const casing = conventions.casing;
+	const keys = conventionConfig(conventions);
+	const workflow = args.workflow ?? "pg-delta";
+	if (!isSqlWorkflow(workflow)) throw new CliError("usage", "--workflow must be \"pg-delta\", \"migra\" or \"migrations\"");
+	const target = await initTarget(config.root, args.package ?? createUrlParam(args.preset, "package"), prompts);
+	if ("code" in target) return target;
+	const root = resolve(config.root, target.dir);
+	const inPackage = target.dir !== ".";
+	const workspaceProject = await detectProject(config.root);
+	const project = inPackage ? {
+		...await detectProject(root),
+		packageManager: workspaceProject.packageManager
+	} : workspaceProject;
+	const lite = args.lite === true;
+	const installTarget = inPackage ? {
+		dir: target.dir,
+		name: project.name
+	} : void 0;
+	const requested = parseIntegrations(list(args.integration));
+	if (typeof requested === "string") throw new CliError("usage", requested);
+	const fromPreset = parseIntegrations(chosen === null ? [] : [...chosen.resolved.preset.integrations, ...integrationsForFramework(chosen.resolved.preset.framework)]);
+	if (typeof fromPreset === "string") throw new CliError("usage", fromPreset);
+	const detected = resolveIntegrations([
+		...suggestedIntegrations(project.frameworks),
+		...requested,
+		...fromPreset
+	]);
+	const picked = args.integration === void 0 && prompts && chosen === null ? await chooseIntegrations(prompts, detected) : detected;
+	if (picked === void 0) return CANCELLED;
+	const integrations = resolveIntegrations(picked);
+	const hasConfig = findConfig(root) !== void 0;
+	let generated = posix.normalize(posix.join(project.srcDir, "lib/supabase/generated.ts"));
+	if (hasConfig) generated = inPackage ? (await loadConfig(root)).output : config.output;
+	const templateContext = templateContextFor(project, generated);
+	const migrationSince = await latestMigrationVersion(root) ?? await latestMigrationVersion(config.root);
+	const since = migrationSince === void 0 ? {} : { migrationSince };
+	const files = withDesign([
+		...baseFiles(templateContext, casing, needsLib(integrations), integrations, workflow, chosen?.value, chosen === null ? {
+			...keys.sql === void 0 ? {} : { sql: keys.sql },
+			...keys.blocks === void 0 ? {} : { blocks: keys.blocks },
+			provider: conventions.access === "provider",
+			...since
+		} : {
+			provider: conventions.access === "provider",
+			...since
+		}),
+		...integrationFiles(integrations, templateContext),
+		...chosen === null ? [] : [{
+			path: blocksWiringPath(templateContext),
+			contents: presetBlocksSource(chosen.resolved, blockConfigImport(templateContext))
+		}]
+	], chosen?.design);
+	if (typeof files === "string") return {
+		code: 1,
+		error: files
+	};
+	const force = await overwrite(root, files, args, prompts, config.root);
+	if (force === void 0) return CANCELLED;
+	const where = inPackage ? ` in ${target.dir}` : "";
+	const applied = await applyPlan(templatePlan(root, files, "better-supabase init", config.root), {
+		...args,
+		force
+	});
+	if (applied.mode === "check" && applied.drift) return planResult(templatePlan(root, files, "better-supabase init", config.root), applied);
+	const lines = [
+		project.frameworks.length > 0 ? `Found ${project.frameworks.join(", ")}${where}.` : `No framework found${where}.`,
+		"",
+		...changeLines(applied),
+		...workflow === "pg-delta" ? await enablePgDelta(root, args["dry-run"] === true, config.root) : []
+	];
+	if (createUrlParam(args.preset, "authz") !== void 0) lines.push("", AUTHZ_NOTE);
+	if (chosen !== null) {
+		const presetConfig = resolveConfig({
+			preset: chosen.value,
+			casing,
+			output: generated,
+			...designKeys(chosen.resolved, chosen.design),
+			...workflow === "pg-delta" ? {} : { sql: { workflow } }
+		}, root);
+		const synced = await syncModules(presetConfig, { "dry-run": args["dry-run"] === true }, plain, now);
+		lines.push("", synced.output ?? synced.error ?? "");
+		const glue = presetGlue(chosen.resolved);
+		if (glue.length > 0) lines.push("", `Glue for ${chosen.resolved.preset.framework}: ${glueCommand(glue)}`);
+	}
+	const packages = packagesFor(project, integrations);
+	const cwdFlag = inPackage ? ` --cwd ${target.dir}` : "";
+	const install = (names, dev) => installCommand(project.packageManager, names, dev, installTarget);
+	const next = [
+		...packages.length > 0 ? [{
+			command: install(packages, false),
+			when: "installs the packages"
+		}] : [],
+		...devPackages(project, lite).map((names) => ({
+			command: install(names, true),
+			when: "installs the dev tools"
+		})),
+		...project.hasSupabase || workspaceProject.hasSupabase ? [] : [{
+			command: lite ? "npx lite init" : "supabase init",
+			when: "creates the supabase folder"
+		}],
+		...lite ? [{
+			command: "npx lite dev",
+			when: "starts the local stack"
+		}] : [{
+			command: "supabase start",
+			when: "starts the local stack"
+		}, {
+			command: `better-supabase env${cwdFlag}`,
+			when: "writes the stack's keys to .env"
+		}],
+		{
+			command: `better-supabase gen${cwdFlag}`,
+			when: "generates the typed client"
+		},
+		{
+			command: "better-supabase skills install",
+			when: "installs the agent skills"
+		}
+	];
+	const hints = [...lite ? ["Before npx lite dev, set jwt_secret = \"env(SUPABASE_JWT_SECRET)\" under [auth] in supabase/config.toml, and add SUPABASE_URL=http://127.0.0.1:54321 and a SUPABASE_JWT_SECRET of 32 or more characters to .env", "Pass backend: 'lite' to createServer (or createNext, createHono, createEdge, createOrpc): https://bettersupabase.com/docs/platform/lite"] : [], ...integrations.flatMap((name) => TEMPLATES[name].next ?? [])];
+	if (hints.length > 0) lines.push("", ...hints.map((hint) => `- ${hint}`));
+	return {
+		code: 0,
+		output: lines.join("\n"),
+		data: {
+			frameworks: project.frameworks,
+			...inPackage ? { package: target.dir } : {},
+			integrations,
+			...chosen === null ? {} : { preset: chosen.value },
+			files: applied.changes,
+			hints
+		},
+		next
+	};
+}
+const initCommand = defineCliCommand({
+	meta: commandMeta("init"),
+	args: {
+		...CONVENTION_ARGS,
+		...INIT_ARGS,
+		...PLAN_ARGS
+	},
+	lists: ["integration"],
+	completions: {
+		...CONVENTION_COMPLETIONS,
+		preset: () => PRESET_NAMES
+	},
+	run: (args, { config, io }) => runInit(config, args, io.prompts)
+});
+/** The `blocks` and `appTables` keys a design adds to the preset's config. */
+function designKeys(resolved, design) {
+	if (design === void 0) return {};
+	const { blocks, appTables } = designConfig(resolved, design);
+	return {
+		blocks,
+		...appTables === void 0 ? {} : { appTables }
+	};
+}
+//#endregion
+export { initCommand };

package/dist/cli/introspect-B-gXAIqs.js

@@ -0,0 +1,51 @@
+import { p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
+import { n as CliError } from "./errors-Caiz_0so.js";
+import { c as serializeGenerator, s as restrictSchemas } from "./typegen--TfvOPLh.js";
+import { a as serializeSnapshot, t as loadSnapshot } from "./snapshot-Dvcx0BSl.js";
+import { n as applyPlan, o as insideRoot, s as planResult, t as PLAN_ARGS } from "./files-DDvAwTko.js";
+import { n as SOURCE_ARGS, r as sourceArgs } from "./source-args-BNhagtpw.js";
+//#region src/cli/commands/introspect.ts
+const ARGS = {
+	out: {
+		type: "string",
+		description: "Defaults to source.snapshot, supabase/snapshot.json, or supabase/generator-metadata.json",
+		valueHint: "file"
+	},
+	kind: {
+		type: "string",
+		description: "snapshot (the default) or generator-metadata (postgrest-typegen's input)",
+		valueHint: "snapshot|generator-metadata"
+	},
+	check: PLAN_ARGS.check,
+	"dry-run": PLAN_ARGS["dry-run"],
+	...SOURCE_ARGS
+};
+const introspectCommand = defineCliCommand({
+	meta: commandMeta("introspect"),
+	args: ARGS,
+	run: async (args, { config, env, io, log, paint, signal }) => {
+		const format = args.kind ?? "snapshot";
+		if (format !== "snapshot" && format !== "generator-metadata") throw new CliError("usage", "--kind must be \"snapshot\" or \"generator-metadata\"");
+		const source = await sourceArgs(args, io);
+		const snapshot = await log.progress("Reading the schema", () => loadSnapshot(config, env, {
+			...source,
+			live: true,
+			...signal ? { signal } : {}
+		}));
+		const out = args.out ?? (format === "snapshot" ? config.source.snapshot ?? "supabase/snapshot.json" : "supabase/generator-metadata.json");
+		const contents = format === "snapshot" ? serializeSnapshot(snapshot) : `${await serializeGenerator(restrictSchemas(snapshot.generator, config.schemas))}\n`;
+		const tables = snapshot.extras.tables.length;
+		const plan = {
+			root: config.root,
+			regenerate: "better-supabase introspect",
+			files: [{
+				path: insideRoot(config.root, out, "--out"),
+				contents,
+				note: `${tables} tables`
+			}]
+		};
+		return planResult(plan, await applyPlan(plan, args, paint), { data: { tables } });
+	}
+});
+//#endregion
+export { introspectCommand };

package/dist/cli/io-BiPX-_J1.js

@@ -0,0 +1,37 @@
+import { n as CliError } from "./errors-Caiz_0so.js";
+import { existsSync } from "node:fs";
+import { dirname, relative, resolve, sep } from "node:path";
+import { readFile } from "node:fs/promises";
+//#region src/cli/core/io.ts
+/**
+* All of stdin for `flag`. Fails at once when stdin is a terminal or
+* missing, instead of waiting for input nobody pipes in.
+*/
+async function readStdin(io, flag) {
+	if (!io.stdin || io.stdinIsTty === true) throw new CliError("missing_value", `${flag} reads from stdin, and nothing is piped in. Pipe the value: printf %s "$VALUE" | better-supabase <command> ${flag}`, { flag });
+	return io.stdin();
+}
+/** `text` with `\r\n` line endings turned into `\n`. */
+const withLf = (text) => text.replaceAll("\r\n", "\n");
+/**
+* Whether a file on disk holds `expected`, ignoring line endings: a checkout
+* with `core.autocrlf` turns every `\n` into `\r\n`.
+*/
+function sameText(current, expected) {
+	return current !== void 0 && withLf(current) === withLf(expected);
+}
+/** The file's text, or `undefined` when it does not exist. */
+async function readIfExists(path) {
+	return existsSync(path) ? readFile(path, "utf-8") : void 0;
+}
+/** Relative ESM import specifier from one file to another, keeping `.ts`. */
+function importPath(fromFile, toFile) {
+	let path = relative(dirname(fromFile), toFile).split(sep).join("/");
+	if (!path.startsWith(".")) path = `./${path}`;
+	return path;
+}
+function display(root, path) {
+	return relative(root, resolve(root, path)).split(sep).join("/") || ".";
+}
+//#endregion
+export { sameText as a, readStdin as i, importPath as n, readIfExists as r, display as t };

package/dist/cli/jsonc-C8M0EhHB.js

@@ -0,0 +1 @@
+export { t as parseJSONC } from "./jsonc-D5Fu67jw.js";

package/dist/cli/keys-hwtdwdkT.js

@@ -0,0 +1,106 @@
+import { p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
+import { t as display } from "./io-BiPX-_J1.js";
+import { m as supabaseDir } from "./supabase-toml-DjLgBYEo.js";
+import { n as applyPlan, r as changeLines } from "./files-DDvAwTko.js";
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { readFile } from "node:fs/promises";
+//#region src/cli/commands/keys.ts
+const ARGS = {
+	out: {
+		type: "string",
+		description: "Defaults to keys.output, then supabase/signing_keys.json",
+		valueHint: "file"
+	},
+	rotate: {
+		type: "boolean",
+		description: "Put a new key first (it signs) and keep the old ones (they still verify)"
+	},
+	force: {
+		type: "boolean",
+		description: "Replace the file"
+	},
+	"dry-run": {
+		type: "boolean",
+		description: "Print what would change and write nothing"
+	}
+};
+async function createSigningKey() {
+	const pair = await crypto.subtle.generateKey({
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, true, ["sign", "verify"]);
+	const jwk = await crypto.subtle.exportKey("jwk", pair.privateKey);
+	return {
+		kty: "EC",
+		kid: crypto.randomUUID(),
+		use: "sig",
+		key_ops: ["sign", "verify"],
+		alg: "ES256",
+		ext: true,
+		crv: jwk.crv,
+		x: jwk.x,
+		y: jwk.y,
+		d: jwk.d
+	};
+}
+async function runKeys(config, args) {
+	const dir = supabaseDir(config.root);
+	const out = args.out ?? config.keys.output ?? `${dir}/signing_keys.json`;
+	const path = resolve(config.root, out);
+	const rotate = args.rotate === true;
+	const exists = existsSync(path);
+	if (exists && !rotate && args.force !== true) return {
+		code: 1,
+		error: `${display(config.root, out)} exists. Use --rotate to add a key or --force to replace it.`
+	};
+	const previous = exists && rotate ? JSON.parse(await readFile(path, "utf-8")) : [];
+	if (!Array.isArray(previous)) return {
+		code: 1,
+		errorCode: "invalid_input",
+		error: `${display(config.root, out)} is not a JSON array of keys.`
+	};
+	const key = await createSigningKey();
+	const applied = await applyPlan({
+		root: args.out === void 0 && config.keys.output === void 0 ? resolve(config.root, dir, "..") : config.root,
+		base: config.root,
+		regenerate: "better-supabase keys --rotate",
+		files: [{
+			path,
+			contents: `${JSON.stringify([key, ...previous], null, 2)}\n`,
+			mode: 384,
+			secret: true,
+			note: `key ${key.kid}${previous.length > 0 ? `, ${previous.length} older key${previous.length === 1 ? "" : "s"} kept for verification` : ""}`
+		}]
+	}, { "dry-run": args["dry-run"] });
+	const lines = changeLines(applied);
+	const toml = resolve(config.root, dir, "config.toml");
+	const configured = existsSync(toml) && /^\s*signing_keys_path\s*=/m.test(await readFile(toml, "utf-8"));
+	if (!configured) {
+		const relativeToSupabase = out.startsWith(`${dir}/`) ? `./${out.slice(dir.length + 1)}` : out;
+		lines.push("", `Add it to ${dir}/config.toml and restart the stack:`, "  [auth]", `  signing_keys_path = "${relativeToSupabase}"`);
+	}
+	const gitignored = [resolve(config.root, ".gitignore"), resolve(config.root, dir, ".gitignore")];
+	let ignored = false;
+	for (const file of gitignored) if (existsSync(file) && (await readFile(file, "utf-8")).includes("signing_keys")) ignored = true;
+	if (!ignored) lines.push("", `Warning: add ${out} to .gitignore; it holds a private key.`);
+	return {
+		code: 0,
+		output: lines.join("\n"),
+		data: {
+			file: display(config.root, out),
+			files: applied.changes,
+			kid: key.kid,
+			kept: previous.length,
+			configured,
+			gitignored: ignored
+		}
+	};
+}
+const keysCommand = defineCliCommand({
+	meta: commandMeta("keys"),
+	args: ARGS,
+	run: (args, { config }) => runKeys(config, args)
+});
+//#endregion
+export { keysCommand };