create-smoodly-app 0.0.2 → 0.0.4

package/README.md

@@ -14,9 +14,16 @@ sign in. Spec: `docs/superpowers/specs/2026-09-04-create-smoodly-app-design.md`.
    another project holds the default `543xx` ports the new one moves to the
    next free block, `553xx` and so on, and says so) or a
    **hosted project** (URL, publishable key, secret key; then an offer to
-   `supabase link` + `supabase db push`).
+   `supabase link --project-ref <ref>` + `supabase db push`, the ref taken
+   from the URL so the CLI never opens its project picker). The URL may be
+   pasted without `https://`; anything that is not an http(s) URL is refused
+   before any step runs. A custom domain has no ref, so the link is not
+   offered and the two commands are printed instead.
 3. The first editor: pick an existing Auth user or create one (email +
    password). The `editors` row is written with role `owner`.
+   If `@` does not appear when you type it (macOS, `@` on Option+2 with the
+   terminal's "Option as Meta" setting on), paste the address or pass
+   `--editor-email`.
 
 Every prompt has a flag, so CI can run it: `--supabase local|hosted`, `--url`,
 `--publishable-key`, `--secret-key`, `--editor-email` (password from
@@ -40,6 +47,18 @@ The CLI has no runtime dependency on `smoodly`.
     npm test          # unit tests (template build, planner, runner, editor)
     npm run build     # template + esbuild bundle → dist/index.js
 
+## Follow-ups (logged 2026-09-05)
+
+- Text prompts drop `@` when the terminal sends Option as Meta (macOS,
+  Finnish/Nordic layouts put `@` on Option+2): the terminal emits `ESC 2` and
+  Node's readline discards meta-keys, so nothing reaches the prompt.
+  Reproduced against `@clack/prompts` 1.7.0 with a scripted stdin. Not
+  fixable from prompt options; documented under "What it asks" with the
+  paste / `--editor-email` workaround. Revisit if clack exposes a key hook.
+- Fresh installs printed a `NOTICE ... does not exist, skipping` for every
+  `drop trigger/policy if exists` in the migration (fixed 2026-09-05: the
+  migration opens with `set client_min_messages = warning`).
+
 ## Follow-ups (logged 2026-09-04)
 
 - The port probe binds `0.0.0.0` (a loopback-only bind coexists with a Docker-published port on macOS), so macOS may prompt once to allow `node` incoming connections during local mode; either answer is fine.
@@ -47,22 +66,38 @@ The CLI has no runtime dependency on `smoodly`.
   but does not quote arguments, so a project name or path containing a space
   or `&` breaks. Quote the args when the shell is on, or resolve the `.cmd`
   path and drop `shell`. Untested on Windows.
-- Hosted mode has not been run against a real hosted Supabase project with a
-  new-format `sb_secret_` key; CI and the local smoke run both use legacy JWT
-  keys. One manual run before the first customer install.
+- Hosted mode, manual run against a real hosted project with new-format keys
+  (done 2026-09-05, throwaway project, `sb_secret_` + `sb_publishable_`):
+  `db push` of the template migration printed no NOTICE, the CLI listed and
+  created the first editor through the GoTrue admin API with the secret key
+  as the sole `apikey`, the `editors` row landed with role `owner`, `next
+  build` passed, `/admin` served the shell, and a password sign-in with the
+  publishable key returned a session. Caveat: the link step ran by hand with
+  an explicit `--project-ref` (see the next-but-one item); the CLI's own
+  `supabase link` was not driven interactively.
+- Supabase CLI 2.78.1 prints `sb_secret_` keys masked (middle dots) from
+  `supabase projects api-keys`; 2.116.0 needs `--reveal`. A user who copies
+  the key from the CLI rather than the dashboard gets "Invalid API key" at
+  the editor step. Worth a hint in the "Finish by hand" text.
 - `listUsers` reads one page of 200 Auth users when offering an existing user
   to make the first editor. Fine for a fresh project, wrong for a populated one.
-- `supabase link` runs without `--project-ref`, so the CLI re-asks for the
-  project even though it is derivable from the URL already typed.
+- `supabase link` ran without `--project-ref`, so the CLI opened the
+  project picker, which preselects the account's first project; `db push`
+  follows the link, so one Enter would push Smoodly's schema into whichever
+  project sorts first (seen 2026-09-05 during the hosted run, caught before
+  the push). Fixed 2026-09-05: `projectRef` (src/env.ts) takes the ref from
+  the typed URL's first host label and the link step and every fallback
+  line pass it. Seen again 2026-09-05 from the published 0.0.3: a URL typed
+  without `https://` gave no ref (the picker opened) and then failed
+  `ensureEditor` with supabase-js's "Invalid supabaseUrl". Fixed the same
+  day: `normalizeProjectUrl` (src/env.ts) adds the scheme and refuses
+  non-URLs at the prompt and for `--url`; a URL with no ref (custom domain)
+  never offers the link, and `run` throws rather than run a bare
+  `supabase link`.
 - The `--yes` flag defaults to local mode; with the Supabase CLI absent that
   stops with the install message rather than falling through to hosted.
 - Captured `exec` output is stdout only; stderr streams straight through, so
   `git init` hints and the Supabase CLI's update notice appear between the
   prompt lines.
-- CI never runs local mode, and never applies the template's migration to a
-  fresh database: the e2e uses hosted mode against a stack whose schema came
-  from the repo's own migration. Add a local-mode e2e step — the runner's stack
-  uses ports 643xx and a fresh `supabase init` defaults to 543xx, so both can
-  run at once.
 - The "Local" option is still offered in the select when the Supabase CLI is
   absent, and only bails afterwards; the spec wants the check before the prompt.

package/dist/index.js

@@ -135,6 +135,41 @@ async function isPortFree(port) {
 import * as p from "@clack/prompts";
 import { resolve } from "node:path";
 
+// src/env.ts
+function renderEnv(keys) {
+  return [
+    "# Smoodly, self-host: the content project's values. SMOODLY_AUTH_URL and",
+    "# SMOODLY_AUTH_KEY default to these two \u2014 leave them unset.",
+    `SMOODLY_URL=${keys.url}`,
+    `SMOODLY_SECRET_KEY=${keys.secretKey}`,
+    `SMOODLY_PUBLISHABLE_KEY=${keys.publishableKey}`,
+    ""
+  ].join("\n");
+}
+function normalizeProjectUrl(input) {
+  const raw = input.trim();
+  if (!raw) return null;
+  const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(raw) ? raw : `https://${raw}`;
+  try {
+    const url = new URL(withScheme);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+    if (!url.hostname) return null;
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+function projectRef(url) {
+  let host;
+  try {
+    host = new URL(url).hostname;
+  } catch {
+    return null;
+  }
+  const m = /^([a-z0-9]{20})\.supabase\.(co|in|red)$/.exec(host);
+  return m ? m[1] : null;
+}
+
 // src/scaffold.ts
 import { cp, readdir, readFile, rename, writeFile } from "node:fs/promises";
 import { join } from "node:path";
@@ -197,10 +232,23 @@ async function resolveAnswers(flags2, ctx) {
     if (!ctx.hasSupabaseCli) bail("Local mode needs the Supabase CLI: https://supabase.com/docs/guides/cli (brew install supabase/tap/supabase)");
     return { name, dir, supabase, hasSupabaseCli: true, smoodlyDep: flags2.smoodlyDep };
   }
-  const url = flags2.url ?? await answer(p.text({ message: "Supabase project URL", placeholder: "https://abcd.supabase.co" }));
+  const badUrl = "Supabase project URL must be an http(s) URL, like https://abcd.supabase.co";
+  const typedUrl = flags2.url ?? await answer(
+    p.text({
+      message: "Supabase project URL",
+      placeholder: "https://abcd.supabase.co",
+      validate: (v) => normalizeProjectUrl(v ?? "") ? void 0 : badUrl
+    })
+  );
+  const url = normalizeProjectUrl(typedUrl);
+  if (!url) throw new Error(`${badUrl} (got "${typedUrl}")`);
   const publishableKey = flags2.publishableKey ?? await answer(p.text({ message: "Publishable (anon) key" }));
   const secretKey = flags2.secretKey ?? await answer(p.password({ message: "Secret (service role) key" }));
-  const linkAndPush = !ctx.hasSupabaseCli ? false : flags2.skipLink ? false : flags2.yes ? true : await answer(p.confirm({ message: "Link this app to the project and push the migration now? (supabase link, supabase db push)" }));
+  const ref = projectRef(url);
+  if (ctx.hasSupabaseCli && !flags2.skipLink && !ref) {
+    p.log.warn(`No project ref in ${url}; skipping supabase link. Run \`supabase link --project-ref <project-ref>\` and \`supabase db push\` yourself.`);
+  }
+  const linkAndPush = !ctx.hasSupabaseCli ? false : flags2.skipLink || !ref ? false : flags2.yes ? true : await answer(p.confirm({ message: `Link this app to the project and push the migration now? (supabase link --project-ref ${ref}, supabase db push)` }));
   return { name, dir, supabase, hasSupabaseCli: ctx.hasSupabaseCli, hosted: { keys: { url, publishableKey, secretKey }, linkAndPush }, smoodlyDep: flags2.smoodlyDep };
 }
 function askEditorWith(flags2, env = process.env) {
@@ -233,18 +281,6 @@ function askEditorWith(flags2, env = process.env) {
 // src/run.ts
 import { join as join2 } from "node:path";
 
-// src/env.ts
-function renderEnv(keys) {
-  return [
-    "# Smoodly, self-host: the content project's values. SMOODLY_AUTH_URL and",
-    "# SMOODLY_AUTH_KEY default to these two \u2014 leave them unset.",
-    `SMOODLY_URL=${keys.url}`,
-    `SMOODLY_SECRET_KEY=${keys.secretKey}`,
-    `SMOODLY_PUBLISHABLE_KEY=${keys.publishableKey}`,
-    ""
-  ].join("\n");
-}
-
 // src/plan.ts
 function plan(a) {
   if (a.supabase === "local" && !a.hasSupabaseCli) {
@@ -347,7 +383,7 @@ async function run(answers2, deps) {
           await sh("supabase", ["init"], { stdin: "ignore" });
           break;
         case "linkAndPush":
-          await sh("supabase", ["link"]);
+          await sh("supabase", linkArgs(answers2));
           await sh("supabase", ["db", "push"]);
           break;
         case "writeEnv":
@@ -387,11 +423,11 @@ ${renderEnv(keys).split("\n").filter((l) => !l.startsWith("#")).join("\n").trimE
     case "supabaseLocal":
       return [`cd ${answers2.name} && supabase init && supabase start`, "", envLines, "", editorLines].join("\n");
     case "supabaseInit": {
-      const commands = answers2.hosted?.linkAndPush ? [`cd ${answers2.name} && supabase init && supabase link && supabase db push`] : [`cd ${answers2.name} && supabase init`, "", "When you are ready: supabase link && supabase db push"];
+      const commands = answers2.hosted?.linkAndPush ? [`cd ${answers2.name} && supabase init && ${linkCommand(answers2)} && supabase db push`] : [`cd ${answers2.name} && supabase init`, "", `When you are ready: ${linkCommand(answers2)} && supabase db push`];
       return [...commands, "", envLines, "", editorLines].join("\n");
     }
     case "linkAndPush":
-      return [`cd ${answers2.name} && supabase link && supabase db push`, "", envLines, "", editorLines].join("\n");
+      return [`cd ${answers2.name} && ${linkCommand(answers2)} && supabase db push`, "", envLines, "", editorLines].join("\n");
     case "writeEnv":
       return [envLines, "", editorLines].join("\n");
     case "ensureEditor":
@@ -404,6 +440,16 @@ ${renderEnv(keys).split("\n").filter((l) => !l.startsWith("#")).join("\n").trimE
       return "";
   }
 }
+function linkArgs(answers2) {
+  const url = answers2.hosted?.keys.url ?? "";
+  const ref = projectRef(url);
+  if (!ref) throw new Error(`no project ref in ${url}; run \`supabase link --project-ref <project-ref>\` yourself`);
+  return ["link", "--project-ref", ref];
+}
+function linkCommand(answers2) {
+  const ref = answers2.hosted ? projectRef(answers2.hosted.keys.url) : null;
+  return `supabase link --project-ref ${ref ?? "<project-ref>"}`;
+}
 
 // src/index.ts
 var TEMPLATE_DIR = fileURLToPath(new URL("../templates/next/", import.meta.url));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-smoodly-app",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "description": "Create a Smoodly site: a fresh Next.js app with the admin mounted, a Supabase schema, an env file and a first editor.",
   "license": "MIT",
   "repository": {

package/templates/next/package.json

@@ -13,7 +13,7 @@
     "react": "^19",
     "react-dom": "^19",
     "@supabase/supabase-js": "^2.113.0",
-    "smoodly": "0.0.2"
+    "smoodly": "0.0.4"
   },
   "devDependencies": {
     "@types/node": "^26.4.1",

package/templates/next/supabase/migrations/00000000000000_smoodly.sql

@@ -1,3 +1,5 @@
+set client_min_messages = warning;
+
 -- The space a request acts in: the key's claim in Smoodly Cloud, the
 -- default space in self-host (service role, anon key). Policies, the
 -- insert trigger and the reorder RPC all read this ONE function.