create-smoodly-app 0.0.2 → 0.0.3

package/README.md

@@ -14,9 +14,13 @@ sign in. Spec: `docs/superpowers/specs/2026-09-04-create-smoodly-app-design.md`.
    another project holds the default `543xx` ports the new one moves to the
    next free block, `553xx` and so on, and says so) or a
    **hosted project** (URL, publishable key, secret key; then an offer to
-   `supabase link` + `supabase db push`).
+   `supabase link --project-ref <ref>` + `supabase db push`, the ref taken
+   from the URL so the CLI never opens its project picker).
 3. The first editor: pick an existing Auth user or create one (email +
    password). The `editors` row is written with role `owner`.
+   If `@` does not appear when you type it (macOS, `@` on Option+2 with the
+   terminal's "Option as Meta" setting on), paste the address or pass
+   `--editor-email`.
 
 Every prompt has a flag, so CI can run it: `--supabase local|hosted`, `--url`,
 `--publishable-key`, `--secret-key`, `--editor-email` (password from
@@ -40,6 +44,18 @@ The CLI has no runtime dependency on `smoodly`.
     npm test          # unit tests (template build, planner, runner, editor)
     npm run build     # template + esbuild bundle → dist/index.js
 
+## Follow-ups (logged 2026-09-05)
+
+- Text prompts drop `@` when the terminal sends Option as Meta (macOS,
+  Finnish/Nordic layouts put `@` on Option+2): the terminal emits `ESC 2` and
+  Node's readline discards meta-keys, so nothing reaches the prompt.
+  Reproduced against `@clack/prompts` 1.7.0 with a scripted stdin. Not
+  fixable from prompt options; documented under "What it asks" with the
+  paste / `--editor-email` workaround. Revisit if clack exposes a key hook.
+- Fresh installs printed a `NOTICE ... does not exist, skipping` for every
+  `drop trigger/policy if exists` in the migration (fixed 2026-09-05: the
+  migration opens with `set client_min_messages = warning`).
+
 ## Follow-ups (logged 2026-09-04)
 
 - The port probe binds `0.0.0.0` (a loopback-only bind coexists with a Docker-published port on macOS), so macOS may prompt once to allow `node` incoming connections during local mode; either answer is fine.
@@ -47,22 +63,32 @@ The CLI has no runtime dependency on `smoodly`.
   but does not quote arguments, so a project name or path containing a space
   or `&` breaks. Quote the args when the shell is on, or resolve the `.cmd`
   path and drop `shell`. Untested on Windows.
-- Hosted mode has not been run against a real hosted Supabase project with a
-  new-format `sb_secret_` key; CI and the local smoke run both use legacy JWT
-  keys. One manual run before the first customer install.
+- Hosted mode, manual run against a real hosted project with new-format keys
+  (done 2026-09-05, throwaway project, `sb_secret_` + `sb_publishable_`):
+  `db push` of the template migration printed no NOTICE, the CLI listed and
+  created the first editor through the GoTrue admin API with the secret key
+  as the sole `apikey`, the `editors` row landed with role `owner`, `next
+  build` passed, `/admin` served the shell, and a password sign-in with the
+  publishable key returned a session. Caveat: the link step ran by hand with
+  an explicit `--project-ref` (see the next-but-one item); the CLI's own
+  `supabase link` was not driven interactively.
+- Supabase CLI 2.78.1 prints `sb_secret_` keys masked (middle dots) from
+  `supabase projects api-keys`; 2.116.0 needs `--reveal`. A user who copies
+  the key from the CLI rather than the dashboard gets "Invalid API key" at
+  the editor step. Worth a hint in the "Finish by hand" text.
 - `listUsers` reads one page of 200 Auth users when offering an existing user
   to make the first editor. Fine for a fresh project, wrong for a populated one.
-- `supabase link` runs without `--project-ref`, so the CLI re-asks for the
-  project even though it is derivable from the URL already typed.
+- `supabase link` ran without `--project-ref`, so the CLI opened the
+  project picker, which preselects the account's first project; `db push`
+  follows the link, so one Enter would push Smoodly's schema into whichever
+  project sorts first (seen 2026-09-05 during the hosted run, caught before
+  the push). Fixed 2026-09-05: `projectRef` (src/env.ts) takes the ref from
+  the typed URL's first host label and the link step and every fallback
+  line pass it; a custom domain yields no ref and falls back to the picker.
 - The `--yes` flag defaults to local mode; with the Supabase CLI absent that
   stops with the install message rather than falling through to hosted.
 - Captured `exec` output is stdout only; stderr streams straight through, so
   `git init` hints and the Supabase CLI's update notice appear between the
   prompt lines.
-- CI never runs local mode, and never applies the template's migration to a
-  fresh database: the e2e uses hosted mode against a stack whose schema came
-  from the repo's own migration. Add a local-mode e2e step — the runner's stack
-  uses ports 643xx and a fresh `supabase init` defaults to 543xx, so both can
-  run at once.
 - The "Local" option is still offered in the select when the Supabase CLI is
   absent, and only bails afterwards; the spec wants the check before the prompt.

package/dist/index.js

@@ -244,6 +244,16 @@ function renderEnv(keys) {
     ""
   ].join("\n");
 }
+function projectRef(url) {
+  let host;
+  try {
+    host = new URL(url).hostname;
+  } catch {
+    return null;
+  }
+  const m = /^([a-z0-9]{20})\.supabase\.(co|in|red)$/.exec(host);
+  return m ? m[1] : null;
+}
 
 // src/plan.ts
 function plan(a) {
@@ -347,7 +357,7 @@ async function run(answers2, deps) {
           await sh("supabase", ["init"], { stdin: "ignore" });
           break;
         case "linkAndPush":
-          await sh("supabase", ["link"]);
+          await sh("supabase", linkArgs(answers2));
           await sh("supabase", ["db", "push"]);
           break;
         case "writeEnv":
@@ -387,11 +397,11 @@ ${renderEnv(keys).split("\n").filter((l) => !l.startsWith("#")).join("\n").trimE
     case "supabaseLocal":
       return [`cd ${answers2.name} && supabase init && supabase start`, "", envLines, "", editorLines].join("\n");
     case "supabaseInit": {
-      const commands = answers2.hosted?.linkAndPush ? [`cd ${answers2.name} && supabase init && supabase link && supabase db push`] : [`cd ${answers2.name} && supabase init`, "", "When you are ready: supabase link && supabase db push"];
+      const commands = answers2.hosted?.linkAndPush ? [`cd ${answers2.name} && supabase init && ${linkCommand(answers2)} && supabase db push`] : [`cd ${answers2.name} && supabase init`, "", `When you are ready: ${linkCommand(answers2)} && supabase db push`];
       return [...commands, "", envLines, "", editorLines].join("\n");
     }
     case "linkAndPush":
-      return [`cd ${answers2.name} && supabase link && supabase db push`, "", envLines, "", editorLines].join("\n");
+      return [`cd ${answers2.name} && ${linkCommand(answers2)} && supabase db push`, "", envLines, "", editorLines].join("\n");
     case "writeEnv":
       return [envLines, "", editorLines].join("\n");
     case "ensureEditor":
@@ -404,6 +414,13 @@ ${renderEnv(keys).split("\n").filter((l) => !l.startsWith("#")).join("\n").trimE
       return "";
   }
 }
+function linkArgs(answers2) {
+  const ref = answers2.hosted ? projectRef(answers2.hosted.keys.url) : null;
+  return ref ? ["link", "--project-ref", ref] : ["link"];
+}
+function linkCommand(answers2) {
+  return `supabase ${linkArgs(answers2).join(" ")}`;
+}
 
 // src/index.ts
 var TEMPLATE_DIR = fileURLToPath(new URL("../templates/next/", import.meta.url));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-smoodly-app",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "description": "Create a Smoodly site: a fresh Next.js app with the admin mounted, a Supabase schema, an env file and a first editor.",
   "license": "MIT",
   "repository": {

package/templates/next/package.json

@@ -13,7 +13,7 @@
     "react": "^19",
     "react-dom": "^19",
     "@supabase/supabase-js": "^2.113.0",
-    "smoodly": "0.0.2"
+    "smoodly": "0.0.3"
   },
   "devDependencies": {
     "@types/node": "^26.4.1",

package/templates/next/supabase/migrations/00000000000000_smoodly.sql

@@ -1,3 +1,5 @@
+set client_min_messages = warning;
+
 -- The space a request acts in: the key's claim in Smoodly Cloud, the
 -- default space in self-host (service role, anon key). Policies, the
 -- insert trigger and the reorder RPC all read this ONE function.