create-kontrolia-auth 2.2.1 → 2.3.0

package/README.md

@@ -16,6 +16,12 @@ Eso hace, en orden:
 2. **Descarga** el repositorio en `./mi-app` e instala dependencias.
 3. **Base de datos** — dos caminos independientes:
    - _Ya tengo Supabase_ (Cloud o self-hosted): pegas URL + keys, sin Docker.
+     Si es un proyecto Supabase Cloud, además ofrece **configurar
+     automáticamente** los dos ajustes que solo viven en su Dashboard —
+     exponer el schema `kontrolia_auth` en la API y activar el Custom Access
+     Token Hook — vía la Management API de Supabase (pide un Personal Access
+     Token de tu cuenta, distinto a las keys del proyecto; no se guarda). Si
+     lo saltas, muestra las instrucciones manuales exactas.
    - _Crear uno nuevo self-hosted_: genera `docker/.env`, **levanta los
      contenedores por ti** (`docker compose up -d`) y aplica las migraciones
      en cuanto Postgres está listo.

package/dist/index.js

@@ -5,6 +5,7 @@ import { askApplicationStep } from "./steps/application.js";
 import { askDatabaseStep } from "./steps/database.js";
 import { askDeploymentStep } from "./steps/deployment.js";
 import { bringUpAndMigrate } from "./utils/docker.js";
+import { readEnvFile } from "./utils/files.js";
 import { runPreflight } from "./utils/preflight.js";
 import { textOrExit } from "./utils/prompts.js";
 import { ensureRepo, isInsideRepo } from "./utils/scaffold.js";
@@ -93,8 +94,10 @@ async function runUpdateCommand() {
  * offer) without repeating the database/application questions. For anyone
  * who already has everything running and just wants to (re)connect a
  * deploy target — e.g. adding admin-panel after auth-server was already
- * deployed. Doesn't persist Supabase credentials anywhere between runs, so
- * it still has to ask for them once here.
+ * deployed. A previous install/deploy already wrote these same Supabase
+ * values into apps/auth-server/.env.local, so this reuses them instead of
+ * asking again every time — only falls back to asking when that file is
+ * missing or incomplete (e.g. first run, or the file got deleted).
  */
 async function runDeployCommand() {
     console.clear();
@@ -105,9 +108,40 @@ async function runDeployCommand() {
         process.exitCode = 1;
         return;
     }
-    const supabaseUrl = await textOrExit("URL de tu proyecto Supabase", "https://tu-proyecto.supabase.co");
-    const anonKey = await textOrExit("Anon/public key");
-    const serviceRoleKey = await textOrExit("Service role key (server-only, nunca la expongas al navegador)");
+    const existingEnv = await readEnvFile(`${process.cwd()}/apps/auth-server/.env.local`);
+    const found = existingEnv?.SUPABASE_URL && existingEnv?.NEXT_PUBLIC_SUPABASE_ANON_KEY && existingEnv?.SUPABASE_SERVICE_ROLE_KEY
+        ? {
+            supabaseUrl: existingEnv.SUPABASE_URL,
+            anonKey: existingEnv.NEXT_PUBLIC_SUPABASE_ANON_KEY,
+            serviceRoleKey: existingEnv.SUPABASE_SERVICE_ROLE_KEY,
+        }
+        : null;
+    let supabaseUrl;
+    let anonKey;
+    let serviceRoleKey;
+    if (found) {
+        const reuse = await p.confirm({
+            message: `Ya tengo las credenciales de Supabase que usaste antes (${found.supabaseUrl}) — ¿las uso, o quieres capturar otras?`,
+            initialValue: true,
+        });
+        if (p.isCancel(reuse)) {
+            p.cancel("Cancelado.");
+            process.exit(0);
+        }
+        if (reuse) {
+            ({ supabaseUrl, anonKey, serviceRoleKey } = found);
+        }
+        else {
+            supabaseUrl = await textOrExit("URL de tu proyecto Supabase", "https://tu-proyecto.supabase.co");
+            anonKey = await textOrExit("Anon/public key");
+            serviceRoleKey = await textOrExit("Service role key (server-only, nunca la expongas al navegador)");
+        }
+    }
+    else {
+        supabaseUrl = await textOrExit("URL de tu proyecto Supabase", "https://tu-proyecto.supabase.co");
+        anonKey = await textOrExit("Anon/public key");
+        serviceRoleKey = await textOrExit("Service role key (server-only, nunca la expongas al navegador)");
+    }
     const db = { mode: "existing", databaseUrl: "", supabaseUrl, anonKey, serviceRoleKey };
     await askDeploymentStep(process.cwd(), db);
     p.outro("Listo.");

package/dist/steps/database.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/steps/database.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,GAAG,iBAAiB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAmE/E"}
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/steps/database.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,GAAG,iBAAiB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAmDD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAiF/E"}

package/dist/steps/database.js

@@ -3,6 +3,49 @@ import { generateJwtSecret } from "../utils/secrets.js";
 import { generateSupabaseKeys } from "../utils/supabase-keys.js";
 import { writeEnvFile } from "../utils/files.js";
 import { textOrExit } from "../utils/prompts.js";
+import { addExposedSchema, enableCustomAccessTokenHook, extractProjectRef } from "../utils/supabase-management-api.js";
+/**
+ * Offers to configure the two Supabase Cloud dashboard-only settings
+ * (exposed schemas + Custom Access Token Hook) via the Management API
+ * instead of leaving them as manual steps — mirrors the Vercel deploy
+ * automation: a separate, more powerful "Personal Access Token" (account
+ * level, not the project's anon/service keys), captured with masked input
+ * and never persisted. Only offered for Supabase Cloud URLs (self-hosted
+ * projects and custom domains have no Management API to call). Returns
+ * which parts actually succeeded so the caller can fall back to a manual
+ * note for whichever one didn't.
+ */
+async function tryAutoConfigureSupabaseCloud(supabaseUrl) {
+    const projectRef = extractProjectRef(supabaseUrl);
+    if (!projectRef)
+        return { schemaDone: false, hookDone: false };
+    const auto = await p.confirm({
+        message: "¿Quieres que configure automáticamente el schema expuesto y el Custom Access Token Hook en tu proyecto Supabase? " +
+            "Necesito un Personal Access Token de tu cuenta Supabase (distinto a las keys del proyecto que ya diste).",
+        initialValue: true,
+    });
+    if (p.isCancel(auto) || !auto)
+        return { schemaDone: false, hookDone: false };
+    p.note("1. Entra a supabase.com/dashboard/account/tokens\n" +
+        '2. Dale click a "Generate new token"\n' +
+        "3. Ponle un nombre, confirma y cópialo (solo se ve una vez)\n" +
+        "4. Pégalo aquí abajo", "Cómo conseguir el Personal Access Token de Supabase");
+    const managementToken = await p.password({
+        message: "Personal Access Token de Supabase (no se guarda, solo se usa ahora)",
+        validate: (value) => (value.trim() ? undefined : "Requerido"),
+    });
+    if (p.isCancel(managementToken))
+        return { schemaDone: false, hookDone: false };
+    const schemaSpinner = p.spinner();
+    schemaSpinner.start("Exponiendo el schema kontrolia_auth en la API de datos");
+    const schemaResult = await addExposedSchema(managementToken, projectRef, "kontrolia_auth");
+    schemaSpinner.stop(schemaResult.ok ? "Schema kontrolia_auth expuesto" : `Falló: ${schemaResult.error}`);
+    const hookSpinner = p.spinner();
+    hookSpinner.start("Activando el Custom Access Token Hook");
+    const hookResult = await enableCustomAccessTokenHook(managementToken, projectRef);
+    hookSpinner.stop(hookResult.ok ? "Hook activado" : `Falló: ${hookResult.error}`);
+    return { schemaDone: schemaResult.ok, hookDone: hookResult.ok };
+}
 /**
  * Question A from the architecture plan: where does Postgres + GoTrue come
  * from? Two fully independent paths — neither assumes Docker.
@@ -32,7 +75,19 @@ export async function askDatabaseStep(repoRoot) {
         const anonKey = await textOrExit("Anon/public key");
         const serviceRoleKey = await textOrExit("Service role key (server-only, nunca la expongas al navegador)");
         const databaseUrl = await textOrExit("Connection string de Postgres", "postgres://postgres:...@db.tu-proyecto.supabase.co:5432/postgres");
-        p.note("Si tu proyecto es Supabase Cloud, activa el Custom Access Token Hook manualmente en Dashboard → Authentication → Hooks → selecciona kontrolia_auth.custom_access_token_hook. No se puede automatizar por API.", "Paso manual pendiente");
+        const { schemaDone, hookDone } = await tryAutoConfigureSupabaseCloud(supabaseUrl);
+        if (!schemaDone || !hookDone) {
+            const pending = [];
+            if (!hookDone)
+                pending.push("Authentication → Hooks → activa kontrolia_auth.custom_access_token_hook.");
+            if (!schemaDone) {
+                pending.push("Project Settings → Data API → en \"Exposed schemas\" agrega kontrolia_auth (queda como: public, graphql_public, kontrolia_auth). " +
+                    "Sin esto, crear una organización u otras operaciones fallan con \"Invalid schema: kontrolia_auth\".");
+            }
+            p.note("Si tu proyecto es Supabase Cloud (o self-hosted fuera de nuestro docker-compose), estos ajustes solo se pueden hacer " +
+                "desde el Dashboard — la API de Supabase no los expone del todo:\n\n" +
+                pending.map((line, i) => `${i + 1}. ${line}`).join("\n"), pending.length > 1 ? "Pasos manuales pendientes" : "Paso manual pendiente");
+        }
         return { mode, databaseUrl, supabaseUrl, anonKey, serviceRoleKey };
     }
     const jwtSecret = generateJwtSecret();

package/dist/steps/deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/steps/deployment.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AA8JpD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAwI3F"}
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/steps/deployment.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AA8JpD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAoJ3F"}

package/dist/steps/deployment.js

@@ -1,5 +1,5 @@
 import * as p from "@clack/prompts";
-import { updateEnvValue, writeEnvFile } from "../utils/files.js";
+import { readEnvFile, updateEnvValue, writeEnvFile } from "../utils/files.js";
 import { registerOAuthClient } from "../utils/oauth-client.js";
 import { createVercelProject, detectCurrentBranch, detectGitHubRepo, triggerVercelDeployment } from "../utils/vercel-api.js";
 const NEXT_STEPS = {
@@ -128,6 +128,14 @@ async function tryAutoCreateVercelProjects(repoRoot, authServerEnv, adminPanelEn
  * ever generates env files, it never touches the database connection.
  */
 export async function askDeploymentStep(repoRoot, db) {
+    // A previous install/deploy already wrote these into .env.local — reuse
+    // them as editable defaults instead of making the user retype the same
+    // URLs every time they run `deploy` again.
+    const prevAuthServerEnv = await readEnvFile(`${repoRoot}/apps/auth-server/.env.local`);
+    const prevAdminPanelEnv = await readEnvFile(`${repoRoot}/apps/admin-panel/.env.local`);
+    const prevAuthServerUrl = prevAdminPanelEnv?.NEXT_PUBLIC_AUTH_SERVER_URL;
+    const prevAdminPanelUrl = prevAuthServerEnv?.NEXT_PUBLIC_ADMIN_PANEL_URL;
+    const prevCookieDomain = prevAuthServerEnv?.NEXT_PUBLIC_COOKIE_DOMAIN ?? prevAdminPanelEnv?.NEXT_PUBLIC_COOKIE_DOMAIN;
     const target = await p.select({
         message: "¿Dónde vas a desplegar auth-server / admin-panel?",
         options: [
@@ -147,6 +155,7 @@ export async function askDeploymentStep(repoRoot, db) {
         message: "¿En qué URL va a vivir auth-server? (admin-panel la usa para enviar ahí a quien no tenga sesión)",
         placeholder: "http://localhost:3000",
         defaultValue: "http://localhost:3000",
+        initialValue: prevAuthServerUrl,
     });
     if (p.isCancel(authServerUrl)) {
         p.cancel("Instalación cancelada.");
@@ -156,6 +165,7 @@ export async function askDeploymentStep(repoRoot, db) {
         message: "¿Y en qué URL va a vivir admin-panel? (auth-server la usa para regresar ahí después de iniciar sesión, en vez de mandarte a su propia pantalla de inicio)",
         placeholder: "http://localhost:3001",
         defaultValue: "http://localhost:3001",
+        initialValue: prevAdminPanelUrl,
     });
     if (p.isCancel(adminPanelUrl)) {
         p.cancel("Instalación cancelada.");
@@ -166,6 +176,7 @@ export async function askDeploymentStep(repoRoot, db) {
             "Si es así, escribe el dominio compartido empezando con un punto (ej. .tuempresa.com). Si comparten el mismo host, o no lo sabes todavía, déjalo vacío.",
         placeholder: "",
         defaultValue: "",
+        initialValue: prevCookieDomain,
     });
     if (p.isCancel(cookieDomain)) {
         p.cancel("Instalación cancelada.");

package/dist/utils/files.d.ts

@@ -9,4 +9,6 @@ export declare function writeEnvFile(path: string, values: EnvValues): Promise<v
  */
 export declare function updateEnvValue(path: string, key: string, value: string): Promise<void>;
 export declare function fileExists(path: string): boolean;
+/** Parses a simple `KEY=value` .env file (no quoting/escaping) — null if it doesn't exist. */
+export declare function readEnvFile(path: string): Promise<EnvValues | null>;
 //# sourceMappingURL=files.d.ts.map

package/dist/utils/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/utils/files.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACvB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjF;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5F;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/utils/files.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACvB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjF;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5F;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED,8FAA8F;AAC9F,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAYzE"}

package/dist/utils/files.js

@@ -23,3 +23,18 @@ export async function updateEnvValue(path, key, value) {
 export function fileExists(path) {
     return existsSync(path);
 }
+/** Parses a simple `KEY=value` .env file (no quoting/escaping) — null if it doesn't exist. */
+export async function readEnvFile(path) {
+    if (!existsSync(path))
+        return null;
+    const contents = await readFile(path, "utf8");
+    const values = {};
+    for (const line of contents.split("\n")) {
+        const match = line.match(/^([A-Z0-9_]+)=(.*)$/);
+        if (match) {
+            const [, key, value] = match;
+            values[key] = value.trim();
+        }
+    }
+    return values;
+}

package/dist/utils/supabase-management-api.d.ts

@@ -0,0 +1,28 @@
+export interface ManagementApiResult {
+    ok: boolean;
+    /** Only present when ok is false. */
+    error?: string;
+}
+/**
+ * Extracts the project ref (subdomain) from a Supabase Cloud URL, e.g.
+ * "https://abcxyz.supabase.co" -> "abcxyz". Returns null for anything else
+ * (self-hosted, a custom domain) — those aren't reachable through Supabase's
+ * account-level Management API, which only knows about Cloud projects.
+ */
+export declare function extractProjectRef(supabaseUrl: string): string | null;
+/**
+ * Adds a schema to the project's exposed-schemas list (PostgREST's
+ * `db_schema`) if it isn't there already — idempotent, and preserves
+ * whatever schemas were already exposed instead of overwriting them, since
+ * `db_schema` is a single string representing the *entire* list, not a
+ * per-schema toggle.
+ */
+export declare function addExposedSchema(token: string, projectRef: string, schema: string): Promise<ManagementApiResult>;
+/**
+ * Enables the Custom Access Token Hook against
+ * kontrolia_auth.custom_access_token_hook — the function that injects
+ * organization_id/roles/permissions into the JWT. Cloud projects' database
+ * is always named "postgres", so the pg-functions:// URI is fixed.
+ */
+export declare function enableCustomAccessTokenHook(token: string, projectRef: string): Promise<ManagementApiResult>;
+//# sourceMappingURL=supabase-management-api.d.ts.map

package/dist/utils/supabase-management-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-management-api.d.ts","sourceRoot":"","sources":["../../src/utils/supabase-management-api.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGpE;AASD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+BtH;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgBjH"}

package/dist/utils/supabase-management-api.js

@@ -0,0 +1,84 @@
+const CUSTOM_ACCESS_TOKEN_HOOK_URI = "pg-functions://postgres/kontrolia_auth/custom_access_token_hook";
+/**
+ * Extracts the project ref (subdomain) from a Supabase Cloud URL, e.g.
+ * "https://abcxyz.supabase.co" -> "abcxyz". Returns null for anything else
+ * (self-hosted, a custom domain) — those aren't reachable through Supabase's
+ * account-level Management API, which only knows about Cloud projects.
+ */
+export function extractProjectRef(supabaseUrl) {
+    const match = supabaseUrl.match(/^https:\/\/([a-z0-9-]+)\.supabase\.co\/?$/);
+    return match ? match[1] : null;
+}
+async function managementApiFetch(path, token, init) {
+    return fetch(`https://api.supabase.com/v1${path}`, {
+        ...init,
+        headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", ...init?.headers },
+    });
+}
+/**
+ * Adds a schema to the project's exposed-schemas list (PostgREST's
+ * `db_schema`) if it isn't there already — idempotent, and preserves
+ * whatever schemas were already exposed instead of overwriting them, since
+ * `db_schema` is a single string representing the *entire* list, not a
+ * per-schema toggle.
+ */
+export async function addExposedSchema(token, projectRef, schema) {
+    let getRes;
+    try {
+        getRes = await managementApiFetch(`/projects/${projectRef}/postgrest`, token);
+    }
+    catch (error) {
+        return { ok: false, error: error.message };
+    }
+    if (!getRes.ok) {
+        const body = (await getRes.json().catch(() => null));
+        return { ok: false, error: body?.message ?? `HTTP ${getRes.status} leyendo la config actual` };
+    }
+    const current = (await getRes.json());
+    const schemas = (current.db_schema ?? "public")
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+    if (schemas.includes(schema))
+        return { ok: true };
+    schemas.push(schema);
+    let patchRes;
+    try {
+        patchRes = await managementApiFetch(`/projects/${projectRef}/postgrest`, token, {
+            method: "PATCH",
+            body: JSON.stringify({ db_schema: schemas.join(",") }),
+        });
+    }
+    catch (error) {
+        return { ok: false, error: error.message };
+    }
+    if (patchRes.ok)
+        return { ok: true };
+    const body = (await patchRes.json().catch(() => null));
+    return { ok: false, error: body?.message ?? `HTTP ${patchRes.status}` };
+}
+/**
+ * Enables the Custom Access Token Hook against
+ * kontrolia_auth.custom_access_token_hook — the function that injects
+ * organization_id/roles/permissions into the JWT. Cloud projects' database
+ * is always named "postgres", so the pg-functions:// URI is fixed.
+ */
+export async function enableCustomAccessTokenHook(token, projectRef) {
+    let res;
+    try {
+        res = await managementApiFetch(`/projects/${projectRef}/config/auth`, token, {
+            method: "PATCH",
+            body: JSON.stringify({
+                hook_custom_access_token_enabled: true,
+                hook_custom_access_token_uri: CUSTOM_ACCESS_TOKEN_HOOK_URI,
+            }),
+        });
+    }
+    catch (error) {
+        return { ok: false, error: error.message };
+    }
+    if (res.ok)
+        return { ok: true };
+    const body = (await res.json().catch(() => null));
+    return { ok: false, error: body?.message ?? `HTTP ${res.status}` };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kontrolia-auth",
-  "version": "2.2.1",
+  "version": "2.3.0",
   "license": "MIT",
   "description": "Turnkey installer for KontrolIA Auth. `npx create-kontrolia-auth mi-app` checks requirements, downloads the repo, installs deps, and runs a wizard: (1) connect to an existing Supabase project or create a new self-hosted one via Docker; (2) where to deploy auth-server/admin-panel (Docker, Vercel, Railway, Render, Coolify). Also exposes `update`, `migrate` and `doctor` subcommands.",
   "keywords": [