create-bw-app 0.18.6 → 0.20.0

package/src/env.mjs

@@ -0,0 +1,43 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { pathExists } from "./generator.mjs";
+
+function parseValue(rawValue) {
+  const trimmed = rawValue.trim();
+  if (
+    (trimmed.startsWith('"') && trimmed.endsWith('"'))
+    || (trimmed.startsWith("'") && trimmed.endsWith("'"))
+  ) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed.replace(/\s+#.*$/, "").trim();
+}
+
+export function parseDotEnv(content) {
+  const values = {};
+  for (const line of content.split(/\r?\n/)) {
+    const match = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/);
+    if (!match) continue;
+    values[match[1]] = parseValue(match[2]);
+  }
+  return values;
+}
+
+export async function loadAppEnvironment(targetDir, runtimeEnv = process.env) {
+  const envPath = path.join(targetDir, ".env.local");
+  const fileValues = await pathExists(envPath)
+    ? parseDotEnv(await fs.readFile(envPath, "utf8"))
+    : {};
+  const runtimeValues = Object.fromEntries(
+    Object.entries(runtimeEnv || {}).filter(([, value]) => typeof value === "string"),
+  );
+  return { ...fileValues, ...runtimeValues };
+}
+
+export function readFirstEnvironmentValue(environment, names) {
+  for (const name of names) {
+    const value = environment[name]?.trim();
+    if (value) return value;
+  }
+  return null;
+}

package/src/generator.mjs

@@ -17,6 +17,12 @@ import {
   TEMPLATE_OPTIONS,
 } from "./constants.mjs";
 import { createInitialAppManifest, writeAppManifest } from "./app-manifest.mjs";
+import {
+  createVercelConfig,
+  nearestVercelRegion,
+  normalizeSupabaseRegion,
+  regionSetupNote,
+} from "./regions.mjs";
 
 export const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 export const TEMPLATE_ROOT = path.join(PACKAGE_ROOT, "template");
@@ -416,13 +422,14 @@ export function createPlatformModulesConfigFile(selectedModules) {
   ].join("\n");
 }
 
-function createEnvFileContent() {
+function createEnvFileContent(supabaseRegion) {
   return [
     "NEXT_PUBLIC_APP_URL=http://localhost:3000",
     "PUBLIC_APP_URL=http://localhost:3000",
     "NEXT_PUBLIC_SUPABASE_URL=",
     "NEXT_PUBLIC_SUPABASE_PUBLISHABLE_DEFAULT_KEY=",
     "SUPABASE_SECRET_DEFAULT_KEY=",
+    `SUPABASE_PROJECT_REGION=${normalizeSupabaseRegion(supabaseRegion) || ""}`,
     "RESEND_API_KEY=",
     "RESEND_WEBHOOK_SECRET=",
     "RESEND_FROM_TRANSACTIONAL=",
@@ -512,6 +519,7 @@ function createPlatformReadme({
   workspaceMode,
   packageManager,
   dbInstallPlan,
+  supabaseRegion,
 }) {
   const moduleLines = SELECTABLE_MODULES.map((moduleDefinition) => {
     const enabled = selectedModules.includes(moduleDefinition.key);
@@ -524,12 +532,16 @@ function createPlatformReadme({
     ? [
         "1. Review `.env.local` and fill in real service credentials.",
         "2. Run `pnpm install` from the BrightWeb workspace root.",
-        `3. Run \`pnpm --filter ${slug} dev\`.`,
+        "3. Link the Supabase project and run `supabase db push` from this app.",
+        "4. Run `bw admin create --email you@example.com` to create the first administrator.",
+        `5. Run \`pnpm --filter ${slug} dev\`.`,
       ]
     : [
         "1. Review `.env.local` and fill in real service credentials.",
         `2. Run \`${packageManager} install\`.`,
-        `3. Run \`${packageManager} dev\`.`,
+        "3. Link the Supabase project and run `supabase db push`.",
+        "4. Run `bw admin create --email you@example.com` to create the first administrator.",
+        `5. Run \`${packageManager} dev\`.`,
       ];
 
   return [
@@ -563,6 +575,16 @@ function createPlatformReadme({
           "",
         ]
       : []),
+    "## First administrator",
+    "",
+    "Run `bw admin create --email you@example.com` after the generated migrations and `.env.local` values are in place.",
+    "The command refuses projects that already contain an admin unless `--force` is explicit, refuses to promote an existing Auth user, never accepts a password, and sends the new user through the Core Auth `/reset-password` flow.",
+    "",
+    "## Function region",
+    "",
+    regionSetupNote(supabaseRegion),
+    "Keep `SUPABASE_PROJECT_REGION` current if the Supabase project is replaced, then run `bw doctor --deployment-url https://your-app.example` to compare it with the deployed Vercel Function region.",
+    "",
     "## Package mounts",
     "",
     ...getPlatformStarterRoutes(selectedModules).map((route) => `- \`${route}\``),
@@ -817,7 +839,7 @@ export function createPackageJson({
     version: "0.0.0",
     scripts: {
       dev: "next dev",
-      build: "next build",
+      build: "next build --webpack",
       start: "next start",
       lint: "tsc --noEmit",
     },
@@ -875,6 +897,7 @@ export async function createPlatformGlobalsCss(selectedModules) {
   const sourcePackages = [
     "@brightweblabs/ui",
     "@brightweblabs/app-shell",
+    "@brightweblabs/core-auth",
     ...SELECTABLE_MODULES
       .filter((moduleDefinition) => selectedModules.includes(moduleDefinition.key))
       .map((moduleDefinition) => moduleDefinition.packageName),
@@ -996,6 +1019,211 @@ export function createShellConfig(selectedModules) {
   ].join("\n");
 }
 
+export function createModuleToolbarControlsConfig(selectedModules) {
+  const imports = [];
+  const branches = [];
+
+  if (selectedModules.includes("admin")) {
+    imports.push('import { AdminToolbarControls } from "@brightweblabs/module-admin/ui";');
+    branches.push('  if (pathname === "/admin/users") return <AdminToolbarControls />;');
+  }
+  if (selectedModules.includes("crm")) {
+    imports.push('import { CrmToolbarControls } from "@brightweblabs/module-crm/ui";');
+    branches.push('  if (pathname === "/crm") return <CrmToolbarControls />;');
+  }
+  if (selectedModules.includes("projects")) {
+    imports.push('import { ProjectsToolbarControls } from "@brightweblabs/module-projects/ui";');
+    branches.push('  if (pathname === projectsBaseHref) return <ProjectsToolbarControls />;');
+  }
+
+  return [
+    '"use client";',
+    "",
+    "// MANAGED BY BRIGHTWEB — regenerated when modules are added, removed, or updated.",
+    ...imports,
+    imports.length > 0 ? "" : null,
+    "export function getModuleToolbarControls(pathname: string, projectsBaseHref: string) {",
+    ...branches,
+    "  return null;",
+    "}",
+    "",
+  ].filter((line) => line !== null).join("\n");
+}
+
+function createOrganizationRoute(methods, enabled) {
+  const lines = ['export const dynamic = "force-dynamic";', ""];
+  for (const { method, handler, context = false } of methods) {
+    if (enabled) {
+      lines.push(
+        `export async function ${method}(request: Request${context ? ', context: { params: Promise<{ id: string }> }' : ""}) {`,
+        `  const { ${handler} } = await import("@brightweblabs/module-orgs");`,
+        `  return ${handler}(request${context ? ", context" : ""});`,
+        "}",
+        "",
+      );
+    } else {
+      lines.push(
+        `export async function ${method}(_request: Request${context ? ', _context: { params: Promise<{ id: string }> }' : ""}) {`,
+        '  return new Response(null, { status: 404 });',
+        "}",
+        "",
+      );
+    }
+  }
+  return lines.join("\n");
+}
+
+export function createOptionalModuleRouteFiles(selectedModules) {
+  const adminEnabled = selectedModules.includes("admin");
+  const crmEnabled = selectedModules.includes("crm");
+  const orgsEnabled = selectedModules.includes("orgs")
+    || crmEnabled
+    || selectedModules.includes("marketing")
+    || selectedModules.includes("projects");
+  const dependencyImports = [
+    'import { requireServerUserAccess } from "@brightweblabs/core-auth/server";',
+    'import type { InvitationHttpDependencies } from "@brightweblabs/core-auth/routes";',
+    'import { requireServiceRoleClient } from "@brightweblabs/infra/server";',
+  ];
+
+  if (adminEnabled) {
+    dependencyImports.push(
+      'import { getAdminUserInvitationDetails, registerUserFromAdminInvitation } from "@brightweblabs/module-admin";',
+    );
+  }
+  if (orgsEnabled) {
+    dependencyImports.push(
+      'import { acceptOrganizationInvitation, getOrganizationInvitationDetails, registerUserFromOrganizationInvitation } from "@brightweblabs/module-orgs";',
+    );
+  }
+  if (crmEnabled) {
+    dependencyImports.push(
+      'import { ensureCrmContactForProfile } from "@brightweblabs/module-crm";',
+    );
+  }
+
+  const invitationDependencies = adminEnabled && orgsEnabled && crmEnabled
+    ? [
+      'import { requireServerUserAccess } from "@brightweblabs/core-auth/server";',
+      'import { requireServiceRoleClient } from "@brightweblabs/infra/server";',
+      "import {",
+      "  getAdminUserInvitationDetails,",
+      "  registerUserFromAdminInvitation,",
+      '} from "@brightweblabs/module-admin";',
+      'import { ensureCrmContactForProfile } from "@brightweblabs/module-crm";',
+      "import {",
+      "  acceptOrganizationInvitation,",
+      "  getOrganizationInvitationDetails,",
+      "  registerUserFromOrganizationInvitation,",
+      '} from "@brightweblabs/module-orgs";',
+      "",
+      "export const invitationHttpDependencies = {",
+      "  getServiceClient: requireServiceRoleClient,",
+      "  getAccess: requireServerUserAccess,",
+      "  getOrganizationInvitation: getOrganizationInvitationDetails,",
+      "  getAdminInvitation: getAdminUserInvitationDetails,",
+      "  registerOrganizationInvitation: (client: never, input: {",
+      "    invitationId: string;",
+      "    firstName: string;",
+      "    lastName: string;",
+      "    password: string;",
+      "  }) => registerUserFromOrganizationInvitation(client, {",
+      "    ...input,",
+      "    ensureCrmContactForProfile,",
+      "  }),",
+      "  registerAdminInvitation: registerUserFromAdminInvitation,",
+      "  acceptOrganizationInvitation: (client: never, input: {",
+      "    invitationId: string;",
+      "    profileId: string;",
+      "    userEmail: string;",
+      "  }) => acceptOrganizationInvitation(client, {",
+      "    ...input,",
+      "    ensureCrmContactForProfile,",
+      "  }),",
+      "};",
+      "",
+    ].join("\n")
+    : [
+    ...dependencyImports,
+    "",
+    ...(!adminEnabled ? [
+      "const getAdminUserInvitationDetails = async (_client: never, _invitationId: string) => null;",
+      'const registerUserFromAdminInvitation = async (_client: never, _input: unknown): Promise<never> => { throw new Error("INVITATION_NOT_FOUND"); };',
+    ] : []),
+    ...(!orgsEnabled ? [
+      "const getOrganizationInvitationDetails = async (_client: never, _invitationId: string) => null;",
+      'const registerUserFromOrganizationInvitation = async (_client: never, _input: unknown): Promise<never> => { throw new Error("INVITATION_NOT_FOUND"); };',
+      'const acceptOrganizationInvitation = async (_client: never, _input: unknown): Promise<never> => { throw new Error("Convite não encontrado."); };',
+    ] : []),
+    ...(!crmEnabled ? [
+      "const ensureCrmContactForProfile = async () => ({ success: true as const });",
+    ] : []),
+    (!adminEnabled || !orgsEnabled || !crmEnabled) ? "" : null,
+    "export const invitationHttpDependencies = {",
+    "  getServiceClient: requireServiceRoleClient,",
+    "  getAccess: requireServerUserAccess,",
+    "  getOrganizationInvitation: getOrganizationInvitationDetails,",
+    "  getAdminInvitation: getAdminUserInvitationDetails,",
+    "  registerOrganizationInvitation: (client: never, input: {",
+    "    invitationId: string;",
+    "    firstName: string;",
+    "    lastName: string;",
+    "    password: string;",
+    "  }) => registerUserFromOrganizationInvitation(client, {",
+    "    ...input,",
+    "    ensureCrmContactForProfile,",
+    "  }),",
+    "  registerAdminInvitation: registerUserFromAdminInvitation,",
+    "  acceptOrganizationInvitation: (client: never, input: {",
+    "    invitationId: string;",
+    "    profileId: string;",
+    "    userEmail: string;",
+    "  }) => acceptOrganizationInvitation(client, {",
+    "    ...input,",
+    "    ensureCrmContactForProfile,",
+    "  }),",
+    "} satisfies InvitationHttpDependencies;",
+    "",
+    ].filter((line) => line !== null).join("\n");
+
+  return {
+    "app/api/invitations/_dependencies.ts": invitationDependencies,
+    "app/api/organizations/route.ts": createOrganizationRoute([
+      { method: "POST", handler: "handleOrganizationsPostRequest" },
+    ], orgsEnabled),
+    "app/api/organizations/[id]/route.ts": createOrganizationRoute([
+      { method: "PATCH", handler: "handleOrganizationPatchRequest", context: true },
+    ], orgsEnabled),
+    "app/api/organizations/[id]/invitations/route.ts": createOrganizationRoute([
+      { method: "GET", handler: "handleOrganizationInvitationsGetRequest", context: true },
+      { method: "POST", handler: "handleOrganizationInvitationsPostRequest", context: true },
+    ], orgsEnabled),
+    "app/api/organizations/[id]/invitations/[invitationId]/route.ts": orgsEnabled
+      ? [
+        'export const dynamic = "force-dynamic";',
+        "",
+        "export async function DELETE(",
+        "  request: Request,",
+        "  context: { params: Promise<{ id: string; invitationId: string }> },",
+        ") {",
+        '  const { handleOrganizationInvitationDeleteRequest } = await import("@brightweblabs/module-orgs");',
+        "  return handleOrganizationInvitationDeleteRequest(request, context);",
+        "}",
+        "",
+      ].join("\n")
+      : [
+        'export const dynamic = "force-dynamic";',
+        "",
+        'type RouteContext = { params: Promise<{ id: string; invitationId: string }> };',
+        "",
+        "export async function DELETE(_request: Request, _context: RouteContext) {",
+        "  return new Response(null, { status: 404 });",
+        "}",
+        "",
+      ].join("\n"),
+  };
+}
+
 function createSiteConfigFile(slug) {
   const siteName = titleizeSlug(slug);
 
@@ -1080,6 +1308,10 @@ async function writeClientStack(baseRoot, slug, dbInstallPlan, options = {}) {
         historyMode: "greenfield-modular",
         futureMode: "forward-only-modular",
         enabledModules,
+        infrastructure: {
+          supabaseRegion: normalizeSupabaseRegion(options.supabaseRegion),
+          vercelRegion: nearestVercelRegion(options.supabaseRegion),
+        },
         clientMigrationPath: `supabase/clients/${slug}/migrations`,
         notes: [
           generatedInWorkspaceMode
@@ -1126,7 +1358,13 @@ async function writeSupabaseCliMigrations({ targetDir, dbInstallPlan }) {
   }
 }
 
-async function writeBundledSupabaseBaseline({ targetDir, slug, dbInstallPlan, registry }) {
+async function writeBundledSupabaseBaseline({
+  targetDir,
+  slug,
+  dbInstallPlan,
+  registry,
+  supabaseRegion,
+}) {
   const shippedModuleKeys = dbInstallPlan.resolvedOrder;
   if (shippedModuleKeys.length === 0) {
     return;
@@ -1155,7 +1393,7 @@ async function writeBundledSupabaseBaseline({ targetDir, slug, dbInstallPlan, re
     );
   }
 
-  await writeClientStack(targetDir, slug, dbInstallPlan);
+  await writeClientStack(targetDir, slug, dbInstallPlan, { supabaseRegion });
   await writeSupabaseCliMigrations({ targetDir, dbInstallPlan });
 }
 
@@ -1188,6 +1426,7 @@ function renderPlanSummary({
   install,
   template,
   dbInstallPlan,
+  supabaseRegion,
 }) {
   const installLocation = workspaceMode ? "workspace root" : "project directory";
   const templateLabel = TEMPLATE_OPTIONS.find((templateOption) => templateOption.key === template)?.label || template;
@@ -1209,6 +1448,12 @@ function renderPlanSummary({
           ...dbInstallPlan.notes.map((note) => `- ${note}`),
         ]
       : []),
+    ...(template === "platform"
+      ? [
+          `Supabase region: ${normalizeSupabaseRegion(supabaseRegion) || "unknown"}`,
+          `Vercel Functions region: ${nearestVercelRegion(supabaseRegion) || "placeholder (not pinned)"}`,
+        ]
+      : []),
     `Install dependencies: ${install ? `yes (${packageManager} in ${installLocation})` : "no"}`,
   ].join("\n");
 }
@@ -1243,6 +1488,7 @@ async function collectAnswers(argvOptions, runtimeOptions) {
   }
 
   let selectedModules = [];
+  let supabaseRegion = null;
 
   if (template === "platform") {
     const askedModules = [];
@@ -1264,6 +1510,15 @@ async function collectAnswers(argvOptions, runtimeOptions) {
       : argvOptions.yes
         ? []
         : askedModules;
+
+    supabaseRegion = normalizeSupabaseRegion(
+      argvOptions.supabaseRegion
+        || (argvOptions.yes
+          ? null
+          : await promptInput({
+              message: "What Supabase region is the project in? (for example eu-west-3; leave blank if unknown)",
+            })),
+    );
   }
 
   const install =
@@ -1280,6 +1535,7 @@ async function collectAnswers(argvOptions, runtimeOptions) {
     slug: resolvedSlug,
     template,
     selectedModules,
+    supabaseRegion,
     install,
   };
 }
@@ -1311,6 +1567,10 @@ async function scaffoldPlatformProject({
   await ensureDirectory(path.dirname(targetDir));
   await copyDirectory(baseTemplateDir, targetDir);
 
+  if (!workspaceMode && packageManager === "pnpm") {
+    await fs.writeFile(path.join(targetDir, "pnpm-workspace.yaml"), "allowBuilds:\n  sharp: true\n");
+  }
+
   for (const moduleDefinition of SELECTABLE_MODULES) {
     if (!selectedModules.includes(moduleDefinition.key)) continue;
     const moduleTemplateDir = path.join(TEMPLATE_ROOT, "modules", moduleDefinition.templateFolder);
@@ -1340,7 +1600,14 @@ async function scaffoldPlatformProject({
     createPlatformBrandConfigFile({ slug: answers.slug, brandValues }),
   );
   await fs.writeFile(path.join(targetDir, "config", "modules.ts"), createPlatformModulesConfigFile(selectedModules));
+  await fs.writeFile(
+    path.join(targetDir, "config", "module-toolbar-controls.tsx"),
+    createModuleToolbarControlsConfig(selectedModules),
+  );
   await fs.writeFile(path.join(targetDir, "config", "shell.ts"), createShellConfig(selectedModules));
+  for (const [relativePath, content] of Object.entries(createOptionalModuleRouteFiles(selectedModules))) {
+    await fs.writeFile(path.join(targetDir, relativePath), content);
+  }
   await fs.writeFile(
     path.join(targetDir, "docs", "ai", "app-context.json"),
     createAppContextFile({
@@ -1351,9 +1618,10 @@ async function scaffoldPlatformProject({
     }),
   );
 
-  const envFileContent = createEnvFileContent();
+  const vercelConfig = createVercelConfig(answers.supabaseRegion);
 
-  await fs.writeFile(path.join(targetDir, ".env.local"), envFileContent);
+  await fs.writeFile(path.join(targetDir, ".env.local"), createEnvFileContent(answers.supabaseRegion));
+  await fs.writeFile(path.join(targetDir, "vercel.json"), `${JSON.stringify(vercelConfig.config, null, 2)}\n`);
   await fs.writeFile(path.join(targetDir, ".gitignore"), createGitignore());
   await fs.writeFile(
     path.join(targetDir, "README.md"),
@@ -1363,11 +1631,15 @@ async function scaffoldPlatformProject({
       workspaceMode,
       packageManager,
       dbInstallPlan,
+      supabaseRegion: answers.supabaseRegion,
     }),
   );
 
   if (workspaceMode) {
-    await writeClientStack(workspaceRoot, answers.slug, dbInstallPlan, { workspaceMode: true });
+    await writeClientStack(workspaceRoot, answers.slug, dbInstallPlan, {
+      workspaceMode: true,
+      supabaseRegion: answers.supabaseRegion,
+    });
     await writeSupabaseCliMigrations({ targetDir, dbInstallPlan });
   } else {
     await writeBundledSupabaseBaseline({
@@ -1375,6 +1647,7 @@ async function scaffoldPlatformProject({
       slug: answers.slug,
       dbInstallPlan,
       registry: dbRegistry,
+      supabaseRegion: answers.supabaseRegion,
     });
   }
 
@@ -1387,6 +1660,10 @@ async function scaffoldPlatformProject({
     versionMap,
     dbInstallPlan,
     cliVersion: cliPackage?.version || "0.0.0",
+    infrastructure: {
+      supabaseRegion: vercelConfig.supabaseRegion,
+      vercelRegion: vercelConfig.vercelRegion,
+    },
   }));
 }
 
@@ -1404,6 +1681,9 @@ async function scaffoldSiteProject({
 
   await ensureDirectory(path.dirname(targetDir));
   await copyDirectory(baseTemplateDir, targetDir);
+  if (!workspaceMode && packageManager === "pnpm") {
+    await fs.writeFile(path.join(targetDir, "pnpm-workspace.yaml"), "allowBuilds:\n  sharp: true\n");
+  }
   await ensureDirectory(path.join(targetDir, "config"));
   await ensureDirectory(path.join(targetDir, "docs", "ai"));
 
@@ -1515,6 +1795,7 @@ export async function createBrightwebClientApp(argvOptions, runtimeOptions = {})
       install: answers.install,
       template: answers.template,
       dbInstallPlan,
+      supabaseRegion: answers.supabaseRegion,
     })}\n\n`);
     return {
       answers,
@@ -1535,6 +1816,7 @@ export async function createBrightwebClientApp(argvOptions, runtimeOptions = {})
     install: answers.install,
     template: answers.template,
     dbInstallPlan,
+    supabaseRegion: answers.supabaseRegion,
   })}\n\n`);
 
   if (answers.template === "site") {

package/src/migrations.mjs

@@ -1,5 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import { resolveSafeRelativePath } from "./safe-path.mjs";
 import { TEMPLATE_ROOT, pathExists } from "./generator.mjs";
 
 export async function findAppMigrationsDirectory(targetDir) {
@@ -16,7 +17,9 @@ export async function findAppMigrationsDirectory(targetDir) {
 export async function getModuleMigrations(moduleKey, catalogEntry = {}) {
   const candidates = [];
   const configuredPath = catalogEntry.manifest?.database?.migrations;
-  if (catalogEntry.packageRoot && configuredPath) candidates.push(path.resolve(catalogEntry.packageRoot, configuredPath));
+  if (catalogEntry.packageRoot && configuredPath) {
+    candidates.push(resolveSafeRelativePath(catalogEntry.packageRoot, configuredPath, `${catalogEntry.key || "Module"} migration manifest path`));
+  }
   if (catalogEntry.packageRoot) candidates.push(path.join(catalogEntry.packageRoot, "migrations"));
   candidates.push(path.join(TEMPLATE_ROOT, "supabase", "modules", moduleKey, "migrations"));
   for (const directory of candidates) {

package/src/regions.mjs

@@ -0,0 +1,60 @@
+// Supabase: https://supabase.com/docs/guides/platform/regions
+// Vercel: https://vercel.com/docs/regions
+// Verified 2026-07-29. Keep this list explicit; unknown regions must remain unpinned.
+export const SUPABASE_TO_VERCEL_REGION = Object.freeze({
+  americas: "iad1",
+  emea: "fra1",
+  apac: "sin1",
+  "us-west-1": "sfo1",
+  "us-west-2": "pdx1",
+  "us-east-1": "iad1",
+  "us-east-2": "cle1",
+  "ca-central-1": "yul1",
+  "eu-west-1": "dub1",
+  "eu-west-2": "lhr1",
+  "eu-west-3": "cdg1",
+  "eu-central-1": "fra1",
+  "eu-central-2": "fra1",
+  "eu-north-1": "arn1",
+  "ap-south-1": "bom1",
+  "ap-southeast-1": "sin1",
+  "ap-northeast-1": "hnd1",
+  "ap-northeast-2": "icn1",
+  "ap-southeast-2": "syd1",
+  "sa-east-1": "gru1",
+});
+
+export function normalizeSupabaseRegion(value) {
+  const normalized = typeof value === "string" ? value.trim().toLowerCase() : "";
+  return normalized || null;
+}
+
+export function nearestVercelRegion(supabaseRegion) {
+  const normalized = normalizeSupabaseRegion(supabaseRegion);
+  return normalized ? SUPABASE_TO_VERCEL_REGION[normalized] ?? null : null;
+}
+
+export function createVercelConfig(supabaseRegion) {
+  const vercelRegion = nearestVercelRegion(supabaseRegion);
+  return {
+    config: vercelRegion
+      ? {
+          $schema: "https://openapi.vercel.sh/vercel.json",
+          regions: [vercelRegion],
+        }
+      : {
+          $schema: "https://openapi.vercel.sh/vercel.json",
+        },
+    supabaseRegion: normalizeSupabaseRegion(supabaseRegion),
+    vercelRegion,
+  };
+}
+
+export function regionSetupNote(supabaseRegion) {
+  const normalized = normalizeSupabaseRegion(supabaseRegion);
+  const vercelRegion = nearestVercelRegion(normalized);
+  if (vercelRegion) {
+    return `Supabase region \`${normalized}\` maps to Vercel Functions region \`${vercelRegion}\` in \`vercel.json\`.`;
+  }
+  return "<!-- vercel.json region placeholder: once the Supabase region is known, set SUPABASE_PROJECT_REGION and add the nearest verified Vercel region as `\"regions\": [\"<region>\"]`. -->";
+}

package/src/remove.mjs

@@ -12,7 +12,9 @@ import {
 import {
   createAppContextFile,
   createDbInstallPlan,
+  createModuleToolbarControlsConfig,
   createNextConfig,
+  createOptionalModuleRouteFiles,
   createPlatformGlobalsCss,
   createPlatformModulesConfigFile,
   createShellConfig,
@@ -20,6 +22,7 @@ import {
   pathExists,
   readJsonIfPresent,
 } from "./generator.mjs";
+import { resolveSafeRelativePath } from "./safe-path.mjs";
 
 const HELP = `Usage: bw remove <moduleKey> [options]\n\nOptions:\n  --target-dir <path>       App directory (defaults to cwd)\n  --workspace-root <path>   BrightWeb workspace root\n  --dry-run                 Print the removal plan without writing\n  --yes                     Apply the removal plan\n  --help                    Show this help`;
 
@@ -61,16 +64,18 @@ export async function removeBrightwebModule(moduleKey, argvOptions = {}, runtime
   const managedWrites = {
     "next.config.ts": createNextConfig({ template: "platform", selectedModules: remainingModules }),
     "app/globals.css": await createPlatformGlobalsCss(remainingModules),
+    "config/module-toolbar-controls.tsx": createModuleToolbarControlsConfig(remainingModules),
     "config/modules.ts": createPlatformModulesConfigFile(remainingModules),
     "config/shell.ts": createShellConfig(remainingModules),
     "docs/ai/app-context.json": createAppContextFile({ slug: appManifest.app.slug, template: "platform", selectedModules: remainingModules.filter((key) => key !== "orgs"), dbInstallPlan }),
+    ...createOptionalModuleRouteFiles(remainingModules),
   };
 
   const cleanFiles = [];
   const driftedFiles = [];
   for (const [relativePath, record] of Object.entries(appManifest.scaffoldFiles || {})) {
     if (record.module !== moduleKey) continue;
-    const filePath = path.join(targetDir, relativePath);
+    const filePath = resolveSafeRelativePath(targetDir, relativePath, "Manifest scaffold file path");
     if (!(await pathExists(filePath))) continue;
     if ((record.intent || "managed") === "managed" && await hashFile(filePath) === record.hash) cleanFiles.push(relativePath);
     else driftedFiles.push(relativePath);
@@ -86,14 +91,25 @@ export async function removeBrightwebModule(moduleKey, argvOptions = {}, runtime
   if (!apply) return { dryRun: true, moduleKey, cleanFiles, driftedFiles, notice };
 
   await fs.writeFile(packagePath, `${JSON.stringify(nextPackageJson, null, 2)}\n`, "utf8");
-  for (const relativePath of cleanFiles) await fs.rm(path.join(targetDir, relativePath));
+  for (const relativePath of cleanFiles) await fs.rm(resolveSafeRelativePath(targetDir, relativePath, "Manifest scaffold file path"));
   for (const [relativePath, content] of Object.entries(managedWrites)) {
     const targetPath = path.join(targetDir, relativePath);
     await fs.mkdir(path.dirname(targetPath), { recursive: true });
     await fs.writeFile(targetPath, content, "utf8");
   }
   delete appManifest.modules[moduleKey];
+  if (appManifest.modules.orgs) {
+    appManifest.modules.orgs.exposed = remainingModules.some((key) => ["crm", "marketing", "projects"].includes(key));
+  }
   for (const [relativePath, record] of Object.entries(appManifest.scaffoldFiles || {})) if (record.module === moduleKey) delete appManifest.scaffoldFiles[relativePath];
+  for (const relativePath of Object.keys(managedWrites)) {
+    const record = appManifest.scaffoldFiles[relativePath];
+    if (!record) continue;
+    const targetPath = resolveSafeRelativePath(targetDir, relativePath, "Manifest scaffold file path");
+    if (!(await pathExists(targetPath))) continue;
+    record.hash = await hashFile(targetPath);
+    record.status = "current";
+  }
   await writeAppManifest(targetDir, appManifest);
   output.write(`Removed ${moduleKey} package wiring and ${cleanFiles.length} clean scaffold file${cleanFiles.length === 1 ? "" : "s"}. Install dependencies next.\n`);
   return { dryRun: false, moduleKey, cleanFiles, driftedFiles, notice };