create-smoodly-app 0.0.1 → 0.0.3

package/README.md

@@ -10,11 +10,17 @@ sign in. Spec: `docs/superpowers/specs/2026-09-04-create-smoodly-app-design.md`.
 
 1. Project name (also the positional argument).
 2. Where content lives: a **local Supabase stack** (`supabase init` +
-   `supabase start` inside the app; needs the Supabase CLI and Docker) or a
+   `supabase start` inside the app; needs the Supabase CLI and Docker; when
+   another project holds the default `543xx` ports the new one moves to the
+   next free block, `553xx` and so on, and says so) or a
    **hosted project** (URL, publishable key, secret key; then an offer to
-   `supabase link` + `supabase db push`).
+   `supabase link --project-ref <ref>` + `supabase db push`, the ref taken
+   from the URL so the CLI never opens its project picker).
 3. The first editor: pick an existing Auth user or create one (email +
    password). The `editors` row is written with role `owner`.
+   If `@` does not appear when you type it (macOS, `@` on Option+2 with the
+   terminal's "Option as Meta" setting on), paste the address or pass
+   `--editor-email`.
 
 Every prompt has a flag, so CI can run it: `--supabase local|hosted`, `--url`,
 `--publishable-key`, `--secret-key`, `--editor-email` (password from
@@ -38,28 +44,51 @@ The CLI has no runtime dependency on `smoodly`.
     npm test          # unit tests (template build, planner, runner, editor)
     npm run build     # template + esbuild bundle → dist/index.js
 
+## Follow-ups (logged 2026-09-05)
+
+- Text prompts drop `@` when the terminal sends Option as Meta (macOS,
+  Finnish/Nordic layouts put `@` on Option+2): the terminal emits `ESC 2` and
+  Node's readline discards meta-keys, so nothing reaches the prompt.
+  Reproduced against `@clack/prompts` 1.7.0 with a scripted stdin. Not
+  fixable from prompt options; documented under "What it asks" with the
+  paste / `--editor-email` workaround. Revisit if clack exposes a key hook.
+- Fresh installs printed a `NOTICE ... does not exist, skipping` for every
+  `drop trigger/policy if exists` in the migration (fixed 2026-09-05: the
+  migration opens with `set client_min_messages = warning`).
+
 ## Follow-ups (logged 2026-09-04)
 
+- The port probe binds `0.0.0.0` (a loopback-only bind coexists with a Docker-published port on macOS), so macOS may prompt once to allow `node` incoming connections during local mode; either answer is fine.
 - Windows: `exec` passes `shell: true` on win32 (needed for the `.cmd` shims)
   but does not quote arguments, so a project name or path containing a space
   or `&` breaks. Quote the args when the shell is on, or resolve the `.cmd`
   path and drop `shell`. Untested on Windows.
-- Hosted mode has not been run against a real hosted Supabase project with a
-  new-format `sb_secret_` key; CI and the local smoke run both use legacy JWT
-  keys. One manual run before the first customer install.
+- Hosted mode, manual run against a real hosted project with new-format keys
+  (done 2026-09-05, throwaway project, `sb_secret_` + `sb_publishable_`):
+  `db push` of the template migration printed no NOTICE, the CLI listed and
+  created the first editor through the GoTrue admin API with the secret key
+  as the sole `apikey`, the `editors` row landed with role `owner`, `next
+  build` passed, `/admin` served the shell, and a password sign-in with the
+  publishable key returned a session. Caveat: the link step ran by hand with
+  an explicit `--project-ref` (see the next-but-one item); the CLI's own
+  `supabase link` was not driven interactively.
+- Supabase CLI 2.78.1 prints `sb_secret_` keys masked (middle dots) from
+  `supabase projects api-keys`; 2.116.0 needs `--reveal`. A user who copies
+  the key from the CLI rather than the dashboard gets "Invalid API key" at
+  the editor step. Worth a hint in the "Finish by hand" text.
 - `listUsers` reads one page of 200 Auth users when offering an existing user
   to make the first editor. Fine for a fresh project, wrong for a populated one.
-- `supabase link` runs without `--project-ref`, so the CLI re-asks for the
-  project even though it is derivable from the URL already typed.
+- `supabase link` ran without `--project-ref`, so the CLI opened the
+  project picker, which preselects the account's first project; `db push`
+  follows the link, so one Enter would push Smoodly's schema into whichever
+  project sorts first (seen 2026-09-05 during the hosted run, caught before
+  the push). Fixed 2026-09-05: `projectRef` (src/env.ts) takes the ref from
+  the typed URL's first host label and the link step and every fallback
+  line pass it; a custom domain yields no ref and falls back to the picker.
 - The `--yes` flag defaults to local mode; with the Supabase CLI absent that
   stops with the install message rather than falling through to hosted.
 - Captured `exec` output is stdout only; stderr streams straight through, so
   `git init` hints and the Supabase CLI's update notice appear between the
   prompt lines.
-- CI never runs local mode, and never applies the template's migration to a
-  fresh database: the e2e uses hosted mode against a stack whose schema came
-  from the repo's own migration. Add a local-mode e2e step — the runner's stack
-  uses ports 643xx and a fresh `supabase init` defaults to 543xx, so both can
-  run at once.
 - The "Local" option is still offered in the select when the Supabase CLI is
   absent, and only bails afterwards; the spec wants the check before the prompt.

package/dist/index.js

@@ -2,7 +2,7 @@
 
 // src/index.ts
 import * as p2 from "@clack/prompts";
-import { rm, writeFile as writeFile2 } from "node:fs/promises";
+import { readFile as readFile2, rm, writeFile as writeFile2 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 
 // src/args.ts
@@ -118,6 +118,19 @@ async function hasCommand(cmd, run2, cwd) {
   }
 }
 
+// src/ports-net.ts
+import { createServer } from "node:net";
+function canListen(port, host) {
+  return new Promise((resolve2) => {
+    const server = createServer();
+    server.once("error", () => resolve2(false));
+    server.listen(port, host, () => server.close(() => resolve2(true)));
+  });
+}
+async function isPortFree(port) {
+  return await canListen(port, "127.0.0.1") && await canListen(port, "0.0.0.0");
+}
+
 // src/prompts.ts
 import * as p from "@clack/prompts";
 import { resolve } from "node:path";
@@ -231,6 +244,16 @@ function renderEnv(keys) {
     ""
   ].join("\n");
 }
+function projectRef(url) {
+  let host;
+  try {
+    host = new URL(url).hostname;
+  } catch {
+    return null;
+  }
+  const m = /^([a-z0-9]{20})\.supabase\.(co|in|red)$/.exec(host);
+  return m ? m[1] : null;
+}
 
 // src/plan.ts
 function plan(a) {
@@ -247,6 +270,32 @@ function plan(a) {
   return steps;
 }
 
+// src/ports.ts
+var DEFAULT_BASE = 54300;
+var BASES = Array.from({ length: 10 }, (_, i) => DEFAULT_BASE + i * 1e3);
+var PORT_LINE = /^([ \t]*#?[ \t]*[a-z0-9_]*port[ \t]*=[ \t]*)543(\d\d)([ \t]*(?:#.*)?)$/gm;
+var LIVE_PORT_LINE = /^[ \t]*[a-z0-9_]*port[ \t]*=[ \t]*(543\d\d)[ \t]*(?:#.*)?$/gm;
+function blockPorts(toml) {
+  return [...toml.matchAll(LIVE_PORT_LINE)].map((m) => Number(m[1]));
+}
+function shiftBlock(toml, base) {
+  return toml.replace(PORT_LINE, (_m, pre, xx, post) => `${pre}${base + Number(xx)}${post}`);
+}
+async function findFreeBlock(ports, isFree, bases = BASES) {
+  for (const base of bases) {
+    const shifted = ports.map((p3) => base + (p3 - DEFAULT_BASE));
+    let allFree = true;
+    for (const port of shifted) {
+      if (!await isFree(port)) {
+        allFree = false;
+        break;
+      }
+    }
+    if (allFree) return base;
+  }
+  throw new Error(`No free Supabase port block: tried ${bases.join(", ")}. Stop another local Supabase project and run again.`);
+}
+
 // src/supabase-cli.ts
 function parseStatusEnv(output) {
   const vars = /* @__PURE__ */ new Map();
@@ -290,17 +339,25 @@ async function run(answers2, deps) {
           await sh("git", ["add", "-A"], { capture: true });
           await sh("git", ["commit", "-m", "Smoodly site"], { capture: true });
           break;
-        case "supabaseLocal":
+        case "supabaseLocal": {
           deps.log("Starting the local Supabase stack (first run pulls Docker images)\u2026");
           await sh("supabase", ["init"], { stdin: "ignore" });
+          const configPath = join2(cwd, "supabase/config.toml");
+          const toml = await deps.fs.readFile(configPath);
+          const base = await findFreeBlock(blockPorts(toml), deps.isPortFree);
+          if (base !== DEFAULT_BASE) {
+            await deps.fs.writeFile(configPath, shiftBlock(toml, base));
+            deps.log(`Ports ${DEFAULT_BASE / 100}xx are busy (another Supabase project running?), using ${base / 100}xx.`);
+          }
           await sh("supabase", ["start"]);
           ctx.keys = parseStatusEnv((await sh("supabase", ["status", "-o", "env"], { capture: true })).stdout);
           break;
+        }
         case "supabaseInit":
           await sh("supabase", ["init"], { stdin: "ignore" });
           break;
         case "linkAndPush":
-          await sh("supabase", ["link"]);
+          await sh("supabase", linkArgs(answers2));
           await sh("supabase", ["db", "push"]);
           break;
         case "writeEnv":
@@ -340,11 +397,11 @@ ${renderEnv(keys).split("\n").filter((l) => !l.startsWith("#")).join("\n").trimE
     case "supabaseLocal":
       return [`cd ${answers2.name} && supabase init && supabase start`, "", envLines, "", editorLines].join("\n");
     case "supabaseInit": {
-      const commands = answers2.hosted?.linkAndPush ? [`cd ${answers2.name} && supabase init && supabase link && supabase db push`] : [`cd ${answers2.name} && supabase init`, "", "When you are ready: supabase link && supabase db push"];
+      const commands = answers2.hosted?.linkAndPush ? [`cd ${answers2.name} && supabase init && ${linkCommand(answers2)} && supabase db push`] : [`cd ${answers2.name} && supabase init`, "", `When you are ready: ${linkCommand(answers2)} && supabase db push`];
       return [...commands, "", envLines, "", editorLines].join("\n");
     }
     case "linkAndPush":
-      return [`cd ${answers2.name} && supabase link && supabase db push`, "", envLines, "", editorLines].join("\n");
+      return [`cd ${answers2.name} && ${linkCommand(answers2)} && supabase db push`, "", envLines, "", editorLines].join("\n");
     case "writeEnv":
       return [envLines, "", editorLines].join("\n");
     case "ensureEditor":
@@ -357,6 +414,13 @@ ${renderEnv(keys).split("\n").filter((l) => !l.startsWith("#")).join("\n").trimE
       return "";
   }
 }
+function linkArgs(answers2) {
+  const ref = answers2.hosted ? projectRef(answers2.hosted.keys.url) : null;
+  return ref ? ["link", "--project-ref", ref] : ["link"];
+}
+function linkCommand(answers2) {
+  return `supabase ${linkArgs(answers2).join(" ")}`;
+}
 
 // src/index.ts
 var TEMPLATE_DIR = fileURLToPath(new URL("../templates/next/", import.meta.url));
@@ -384,7 +448,14 @@ try {
     editorClient: supabaseEditorClient,
     askEditor: askEditorWith(flags),
     log: (line) => p2.log.step(line),
-    fs: { isEmptyOrMissing, scaffold, writeFile: (path, text2) => writeFile2(path, text2), rm: (dir) => rm(dir, { recursive: true, force: true }) }
+    isPortFree,
+    fs: {
+      isEmptyOrMissing,
+      scaffold,
+      readFile: (path) => readFile2(path, "utf8"),
+      writeFile: (path, text2) => writeFile2(path, text2),
+      rm: (dir) => rm(dir, { recursive: true, force: true })
+    }
   });
 } catch (e) {
   p2.cancel(e instanceof Error ? e.message : String(e));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-smoodly-app",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "description": "Create a Smoodly site: a fresh Next.js app with the admin mounted, a Supabase schema, an env file and a first editor.",
   "license": "MIT",
   "repository": {
@@ -9,9 +9,16 @@
     "directory": "packages/create-smoodly-app"
   },
   "type": "module",
-  "bin": { "create-smoodly-app": "./dist/index.js" },
-  "files": ["dist", "templates"],
-  "engines": { "node": ">=20" },
+  "bin": {
+    "create-smoodly-app": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "templates"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
   "scripts": {
     "build": "npm run build:template && npm run build:cli",
     "build:template": "tsx scripts/build-template.ts",

package/templates/next/package.json

@@ -13,7 +13,7 @@
     "react": "^19",
     "react-dom": "^19",
     "@supabase/supabase-js": "^2.113.0",
-    "smoodly": "0.0.1"
+    "smoodly": "0.0.3"
   },
   "devDependencies": {
     "@types/node": "^26.4.1",

package/templates/next/supabase/migrations/00000000000000_smoodly.sql

@@ -1,3 +1,5 @@
+set client_min_messages = warning;
+
 -- The space a request acts in: the key's claim in Smoodly Cloud, the
 -- default space in self-host (service role, anon key). Policies, the
 -- insert trigger and the reorder RPC all read this ONE function.