supabase-worker-previews 0.0.0 → 0.1.0

package/dist/commands/branches.js

@@ -0,0 +1,273 @@
+import { previewWildcard } from "../preview-name.js";
+import { projectUrl } from "../supabase.js";
+import { IDENTITY_PATH, OVERRIDE_SECRET } from "../runtime.js";
+const MIGRATION_COUNT_SQL = "select count(*)::int as n from supabase_migrations.schema_migrations";
+const BRANCH_FAILED = ["MIGRATIONS_FAILED", "FUNCTIONS_FAILED"];
+async function subdomainOf(deps) {
+    return deps.config.workersSubdomain ?? deps.cloudflare.workersSubdomain();
+}
+/** The non-default Supabase branch tied to a git branch, made by the GitHub integration or by `up`. */
+export async function branchFor(gitBranch, deps) {
+    const branches = await deps.supabase.listBranches(deps.config.supabaseProjectRef);
+    return branches.find((b) => b.git_branch === gitBranch && !b.is_default);
+}
+/** The Preview a git branch deploys to: named after the branch, or `pr-<number>` when configured. */
+export function previewKey(gitBranch, config, pr) {
+    if (config.previewName === "branch")
+        return gitBranch;
+    if (pr === undefined)
+        throw new Error(`previewName is "pr", so pass the PR number (--pr <n>)`);
+    return `pr-${pr}`;
+}
+/** A branch `swp` may delete: never production, the shared database, the trunk's or a persistent one. */
+export function isDisposable(branch, config) {
+    return (!branch.is_default &&
+        !branch.persistent &&
+        branch.project_ref !== config.supabaseProjectRef &&
+        branch.name !== config.sharedBranch &&
+        branch.git_branch !== config.trunk);
+}
+/** Never repoint, write to or delete the production project through a branch record. */
+export function assertIsolated(branch, parent) {
+    if (branch.is_default || branch.project_ref === parent) {
+        throw new Error(`Supabase branch "${branch.name}" is the production project ${parent} itself; refusing to touch it`);
+    }
+}
+export async function supabaseValues(ref, deps) {
+    const keys = await deps.supabase.keys(ref, deps.config.apiKeys);
+    return {
+        SUPABASE_URL: projectUrl(ref),
+        SUPABASE_PUBLISHABLE_KEY: keys.publishable,
+        SUPABASE_SERVICE_ROLE_KEY: keys.secret,
+        SUPABASE_PROJECT_REF: ref,
+    };
+}
+/**
+ * The shared Preview database: a persistent branch that tracks the trunk, so
+ * the GitHub integration migrates it on every trunk push. Its public values
+ * belong in wrangler `previews.vars`; only its secret key goes in the Preview
+ * base config.
+ */
+export async function shared(deps) {
+    const { config, runner, supabase } = deps;
+    const parent = config.supabaseProjectRef;
+    runner.log(`Shared Preview database "${config.sharedBranch}" on ${parent}, tracking ${config.trunk}`);
+    const branches = await supabase.listBranches(parent);
+    if (runner.dryRun) {
+        runner.log(`  ${branches.some((b) => b.name === config.sharedBranch) ? "update" : "create"} the persistent branch`);
+        return `<${config.sharedBranch}>`;
+    }
+    if (!branches.some((b) => b.is_default))
+        throw new Error(`Branching is not enabled on ${parent}. Connect the repo in the Supabase dashboard ` +
+            "(project settings, Integrations, GitHub, automatic branching on), then run swp shared again.");
+    let branch = branches.find((b) => b.name === config.sharedBranch);
+    if (!branch) {
+        branch = await supabase.createBranch(parent, {
+            name: config.sharedBranch,
+            gitBranch: config.trunk,
+            persistent: true,
+        });
+    }
+    else if (branch.git_branch !== config.trunk || !branch.persistent) {
+        await supabase.updateBranch(branch.project_ref, { gitBranch: config.trunk, persistent: true });
+    }
+    assertIsolated(branch, parent);
+    const ref = branch.project_ref;
+    await waitForMigrations(ref, deps);
+    const subdomain = await subdomainOf(deps);
+    await supabase.allowRedirects(ref, `https://${config.worker}.${subdomain}.workers.dev`, [
+        previewWildcard(config.worker, subdomain),
+    ]);
+    const values = await supabaseValues(ref, deps);
+    deps.cloudflare.putBaseSecrets({ SUPABASE_SERVICE_ROLE_KEY: values.SUPABASE_SERVICE_ROLE_KEY });
+    runner.log(`Done: ${ref}. Put these in the wrangler config under previews.vars:`);
+    runner.log(JSON.stringify({
+        SUPABASE_URL: values.SUPABASE_URL,
+        SUPABASE_PUBLISHABLE_KEY: values.SUPABASE_PUBLISHABLE_KEY,
+        SUPABASE_PROJECT_REF: ref,
+    }, null, 2));
+    return ref;
+}
+/**
+ * Gives a git branch's Preview its own database. The GitHub integration makes
+ * one for any PR that changes supabase/; for other branches this asks for one,
+ * which Supabase still migrates and seeds from that git branch.
+ */
+export async function up(gitBranch, deps, pr) {
+    const { config, runner, supabase } = deps;
+    runner.log(`Isolated database for ${gitBranch}`);
+    if (runner.dryRun) {
+        runner.log(`  find or create the Supabase branch for ${gitBranch}, wait for its migrations`);
+        runner.log(`  set ${OVERRIDE_SECRET} on the Preview of ${gitBranch}`);
+        return `<${gitBranch}>`;
+    }
+    const branch = (await branchFor(gitBranch, deps)) ??
+        (await supabase.createBranch(config.supabaseProjectRef, { name: gitBranch, gitBranch }));
+    assertIsolated(branch, config.supabaseProjectRef);
+    const ref = branch.project_ref;
+    await waitForMigrations(ref, deps);
+    const preview = await waitForPreview(previewKey(gitBranch, config, pr), deps);
+    const url = previewUrlOf(preview);
+    await supabase.allowRedirects(ref, url, [`${url}/**`]);
+    deps.cloudflare.putPreviewSecrets(preview.name, {
+        [OVERRIDE_SECRET]: JSON.stringify(await supabaseValues(ref, deps)),
+    });
+    runner.log(`Done: ${url} now runs on ${ref}`);
+    return ref;
+}
+/**
+ * Puts a Preview back on the shared database once its PR no longer needs its
+ * own: drops the override, then deletes the branch `up` made for it. The
+ * integration only makes branches for PRs that change supabase/, which never
+ * get here.
+ */
+export async function release(gitBranch, deps, pr) {
+    const { config, runner } = deps;
+    const found = await deps.cloudflare.findPreview(previewKey(gitBranch, config, pr));
+    // Workers Builds creates the record before the first deploy, and wrangler cannot list secrets until one exists.
+    const preview = found?.deployed_on ? found : undefined;
+    if (preview && runner.dryRun)
+        runner.log(`  remove ${OVERRIDE_SECRET} from Preview ${preview.name} if set`);
+    else if (preview && deps.cloudflare.listPreviewSecrets(preview.name).includes(OVERRIDE_SECRET)) {
+        deps.cloudflare.deletePreviewSecret(preview.name, OVERRIDE_SECRET);
+        runner.log(`  removed ${OVERRIDE_SECRET} from Preview ${preview.name}; it serves ${config.sharedBranch} again`);
+    }
+    const branch = await branchFor(gitBranch, deps);
+    if (!branch || !isDisposable(branch, config))
+        return;
+    if (runner.dryRun) {
+        runner.log(`  DELETE Supabase branch ${branch.name} (${branch.project_ref})`);
+        return;
+    }
+    assertIsolated(branch, config.supabaseProjectRef);
+    await deps.supabase.deleteBranch(branch.project_ref);
+    runner.log(`  Supabase branch ${branch.name} deleted; ${gitBranch} no longer needs its own database`);
+}
+/** Which database a deployed Preview serves, from the identity route or, failing that, its HTML. */
+export async function servedRef(baseUrl, deps) {
+    const identity = await deps.fetchImpl(`${baseUrl}${IDENTITY_PATH}`).catch(() => null);
+    if (identity?.ok && (identity.headers.get("content-type") ?? "").includes("json")) {
+        const body = (await identity.json());
+        if (body.projectRef)
+            return { ref: body.projectRef, seen: body.projectRef };
+    }
+    const page = await deps.fetchImpl(`${baseUrl}${deps.config.checkPath}`).catch(() => null);
+    if (!page?.ok)
+        return { seen: `HTTP ${page?.status ?? "error"}` };
+    const refs = new Set([...(await page.text()).matchAll(/https:\/\/([a-z0-9]{20})\.supabase\.co/g)].map((m) => m[1]));
+    if (refs.size > 1)
+        return { seen: `several databases in the page: ${[...refs].join(", ")}` };
+    const [ref] = refs;
+    return ref ? { ref, seen: ref } : { seen: "no Supabase URL in the page" };
+}
+/**
+ * Fails unless the Preview serves the database it should: its own branch
+ * when isolated, else the shared one. Production fails at once; anything
+ * else is retried while Workers Builds and `up` finish.
+ */
+export async function check(gitBranch, isolated, deps, pr) {
+    const { config, runner, supabase } = deps;
+    const parent = config.supabaseProjectRef;
+    const want = isolated ? `the branch for ${gitBranch}` : config.sharedBranch;
+    if (runner.dryRun) {
+        runner.log(`  the Preview of ${gitBranch} must serve ${want}`);
+        return;
+    }
+    const expected = isolated
+        ? await branchFor(gitBranch, deps)
+        : (await supabase.listBranches(parent)).find((b) => b.name === config.sharedBranch);
+    if (!expected)
+        throw new Error(`No Supabase branch for ${want} on ${parent}`);
+    assertIsolated(expected, parent);
+    let seen = "nothing yet";
+    for (let attempt = 1; attempt <= 45; attempt += 1) {
+        const preview = await deps.cloudflare.findPreview(previewKey(gitBranch, config, pr));
+        if (!preview)
+            seen = "no Preview yet";
+        else if (!preview.deployed_on)
+            seen = `Preview ${preview.slug} exists but was never deployed`;
+        else {
+            const result = await servedRef(previewUrlOf(preview), deps);
+            if (result.ref === parent)
+                throw new Error(`Preview ${preview.slug} serves the production database ${parent}; refusing to pass`);
+            if (result.ref === expected.project_ref) {
+                runner.log(`  Preview ${preview.slug} runs on ${expected.name} (${result.ref})`);
+                return;
+            }
+            seen = result.seen;
+        }
+        await deps.sleep(20_000);
+    }
+    throw new Error(`The Preview of ${gitBranch} never served ${want} (${expected.project_ref}); last saw ${seen}`);
+}
+/** Removes the Preview and, if the integration has not already, its own database. */
+export async function down(gitBranch, deps, pr) {
+    const { config, runner } = deps;
+    runner.log(`Removing the Preview of ${gitBranch} and any database of its own`);
+    const branch = await branchFor(gitBranch, deps);
+    if (!branch || branch.persistent) {
+        runner.log(`  no Supabase branch of its own`);
+    }
+    else if (runner.dryRun) {
+        runner.log(`  DELETE Supabase branch ${branch.name} (${branch.project_ref})`);
+    }
+    else {
+        assertIsolated(branch, config.supabaseProjectRef);
+        await deps.supabase.deleteBranch(branch.project_ref);
+        runner.log(`  Supabase branch ${branch.name} deleted`);
+    }
+    const preview = await deps.cloudflare.findPreview(previewKey(gitBranch, config, pr));
+    if (!preview)
+        runner.log(`  no Preview to delete`);
+    else if (runner.dryRun)
+        runner.log(`  delete Preview ${preview.name}`);
+    else
+        deps.cloudflare.deletePreview(preview.name);
+}
+/** On a PR's first push, Workers Builds may still be creating the Preview. */
+async function waitForPreview(name, deps) {
+    for (let attempt = 1; attempt <= 30; attempt += 1) {
+        const preview = await deps.cloudflare.findPreview(name);
+        if (preview?.deployed_on)
+            return preview;
+        deps.runner.log(`  waiting for the Preview ${name} to be deployed (${attempt})`);
+        await deps.sleep(20_000);
+    }
+    throw new Error(`No deployed Preview ${name} appeared; is a Preview being deployed for it?`);
+}
+function previewUrlOf(preview) {
+    const url = preview.urls[0];
+    if (!url)
+        throw new Error(`Preview ${preview.slug} has no URL`);
+    return url.replace(/\/+$/, "");
+}
+/**
+ * Ready when the branch holds every migration in this checkout. Branch status
+ * runs ahead of the migrations, so the status alone is not enough.
+ */
+export async function waitForMigrations(ref, deps) {
+    const want = deps.migrationCount();
+    const now = deps.now ?? Date.now;
+    const started = now();
+    let last = "not created yet";
+    while (now() - started < 15 * 60_000) {
+        const detail = await deps.supabase.getBranch(ref).catch((err) => {
+            if (/\b404\b/.test(err.message))
+                return null;
+            throw err;
+        });
+        if (detail) {
+            const branch = (await deps.supabase.listBranches(deps.config.supabaseProjectRef)).find((b) => b.project_ref === ref);
+            const status = branch?.status ?? detail.status;
+            if (BRANCH_FAILED.includes(status))
+                throw new Error(`Supabase branch ${ref} ended ${status}`);
+            const rows = await deps.supabase.query(ref, MIGRATION_COUNT_SQL).catch(() => []);
+            const have = rows[0]?.n ?? 0;
+            if (have >= want)
+                return;
+            last = `${have} of ${want} migrations, ${status}`;
+        }
+        await deps.sleep(10_000);
+    }
+    throw new Error(`Supabase branch ${ref} not ready after 15 minutes: ${last}`);
+}

package/dist/commands/doctor.d.ts

@@ -0,0 +1,24 @@
+import { type Config } from "../config.js";
+import { type Style } from "../style.js";
+import type { SupabaseApi } from "../supabase.js";
+/** `fix` says what to do next, for a warning or an error. */
+export type Finding = {
+    level: "ok" | "warn" | "error";
+    message: string;
+    fix?: string;
+};
+export declare function hasDefaultPrivileges(sql: string): boolean;
+export declare function checkLocal(config: Config, cwd?: string): Finding[];
+export declare function checkRemote(config: Config, supabase: SupabaseApi, cwd?: string): Promise<Finding[]>;
+export declare function compareVersions(version: string, min: number[]): number;
+export type Section = {
+    title: string;
+    findings: Finding[];
+    skipped?: string;
+};
+/** Local checks always; online checks when there is a token and a usable config. */
+export declare function doctor(overrides: Partial<Config>, supabase: SupabaseApi | undefined, cwd?: string): Promise<Section[]>;
+export declare function formatReport(sections: Section[], s?: Style): {
+    text: string;
+    pass: boolean;
+};

package/dist/commands/doctor.js

@@ -0,0 +1,289 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { CONFIG_DEFAULTS, defined, loadConfig, migrationFiles, migrationsDir, readWranglerConfig, } from "../config.js";
+import { TOKENS_URL } from "../http.js";
+import { projectRefOf } from "../runtime.js";
+import { makeStyle } from "../style.js";
+const MIN_WRANGLER = [4, 135, 0];
+/** Binding keys a Preview does not inherit from the top-level config. */
+const BINDING_KEYS = [
+    "kv_namespaces",
+    "d1_databases",
+    "r2_buckets",
+    "durable_objects",
+    "queues",
+    "services",
+    "ratelimits",
+    "vectorize",
+    "hyperdrive",
+    "ai",
+    "browser",
+    "images",
+    "analytics_engine_datasets",
+    "send_email",
+    "workflows",
+    "dispatch_namespaces",
+    "mtls_certificates",
+    "secrets_store_secrets",
+    "version_metadata",
+];
+const SECRET_NAMES = ["SUPABASE_SERVICE_ROLE_KEY", "SUPABASE_OVERRIDE"];
+export function hasDefaultPrivileges(sql) {
+    const s = sql.toLowerCase().replace(/\s+/g, " ");
+    return /alter default privileges/.test(s) && /grant all on tables to [^;]*\b(anon|authenticated)\b/.test(s);
+}
+export function checkLocal(config, cwd = process.cwd()) {
+    const out = [];
+    const ok = (message) => out.push({ level: "ok", message });
+    const warn = (message, fix) => out.push({ level: "warn", message, fix });
+    const error = (message, fix) => out.push({ level: "error", message, fix });
+    const shared = "Run `swp shared` and paste the values it prints into previews.vars.";
+    const version = installedWranglerVersion(cwd);
+    if (!version)
+        warn("wrangler is not installed in this project", "npm install --save-dev wrangler@latest (4.135.0 or later)");
+    else if (compareVersions(version, MIN_WRANGLER) < 0)
+        error(`wrangler ${version} predates Worker Previews`, "npm install --save-dev wrangler@latest (4.135.0 or later)");
+    else
+        ok(`wrangler ${version}`);
+    const wrangler = readWranglerConfig(cwd);
+    if (!wrangler)
+        error("no wrangler.jsonc, wrangler.json or wrangler.toml here", "Run swp doctor in the Worker's directory.");
+    else {
+        const previews = wrangler.json.previews;
+        if (!previews)
+            error(`${wrangler.file} has no "previews" block, so Previews get no Supabase settings`, 'Add "previews": { "vars": {} }, redeclaring every binding the Worker uses, then run `swp shared` for the vars.');
+        else {
+            const vars = (previews.vars ?? {});
+            const url = typeof vars.SUPABASE_URL === "string" ? vars.SUPABASE_URL : undefined;
+            if (!url || !vars.SUPABASE_PUBLISHABLE_KEY)
+                error("previews.vars needs SUPABASE_URL and SUPABASE_PUBLISHABLE_KEY", shared);
+            else if (projectRefOf(url) === config.supabaseProjectRef)
+                error(`previews.vars points at the production project ${config.supabaseProjectRef}`, shared);
+            else
+                ok(`previews.vars uses ${projectRefOf(url) ?? url}`);
+            for (const name of SECRET_NAMES)
+                if (name in vars)
+                    error(`previews.vars holds ${name}; secrets belong in the Preview base config`, `Remove ${name} from previews.vars (swp stores it as a secret), and rotate the key if it was committed.`);
+            for (const key of BINDING_KEYS) {
+                if (!(key in wrangler.json) || key in previews)
+                    continue;
+                warn(`"${key}" is bound at the top level but not in "previews"; Previews do not inherit bindings`, `Redeclare "${key}" under "previews", pointing at Preview-safe resources.`);
+            }
+            const topVars = Object.keys(wrangler.json.vars ?? {}).filter((k) => !(k in vars));
+            if (topVars.length)
+                warn(`vars missing from previews.vars: ${topVars.join(", ")}`, "Copy them into previews.vars; Previews do not inherit vars.");
+        }
+        const assets = wrangler.json.assets;
+        const html = assets?.directory ? htmlFiles(join(cwd, assets.directory)) : [];
+        if (html.length && !assets?.run_worker_first)
+            warn(`${assets.directory} has ${html.join(", ")}; Cloudflare serves matching assets without running the Worker, ` +
+                "so those pages get no Supabase config and the browser falls back to build-time values", 'Set "run_worker_first": true under "assets" (or list the HTML routes).');
+    }
+    const migrations = migrationFiles(config, cwd);
+    if (!migrations.length)
+        warn(`no migrations in ${migrationsDir(config)}`, 'Commit your migrations there, or set "supabaseDir" in swp.config.json.');
+    else {
+        const first = readFileSync(join(cwd, migrationsDir(config), migrations[0]), "utf8");
+        if (hasDefaultPrivileges(first))
+            ok(`${migrations[0]} grants the API roles default privileges`);
+        else
+            error(`the first migration (${migrations[0]}) does not grant default privileges; branch databases will 403`, "Run `swp init` to add the grants migration before it.");
+    }
+    const toml = join(cwd, config.supabaseDir, "config.toml");
+    if (existsSync(toml)) {
+        const text = readFileSync(toml, "utf8");
+        if (!/additional_redirect_urls[^\]]*workers\.dev/s.test(text))
+            warn(`${config.supabaseDir}/config.toml additional_redirect_urls has no workers.dev entry; the integration resets branch auth URLs from it on every push`, `Add "https://*-${config.worker || "<worker>"}.<subdomain>.workers.dev/**" to [auth] additional_redirect_urls.`);
+    }
+    return out;
+}
+export async function checkRemote(config, supabase, cwd = process.cwd()) {
+    const out = [];
+    const parent = config.supabaseProjectRef;
+    try {
+        await supabase.getProject(parent);
+    }
+    catch (err) {
+        const status = err.status;
+        return [
+            {
+                level: "error",
+                message: `cannot read project ${parent}: ${err.message}`,
+                ...(status === 404 && {
+                    fix: `Check "supabaseProjectRef" in swp.config.json, and that SUPABASE_ACCESS_TOKEN can reach that project.`,
+                }),
+            },
+        ];
+    }
+    let branches;
+    try {
+        branches = await supabase.listBranches(parent);
+    }
+    catch (err) {
+        return [
+            {
+                level: "error",
+                message: `cannot list the branches of ${parent}: ${err.message}`,
+                fix: `The token needs Development Branches: Read-write (${TOKENS_URL}).`,
+            },
+        ];
+    }
+    if (!branches.some((b) => b.is_default))
+        out.push({
+            level: "error",
+            message: `branching is not enabled on ${parent}`,
+            fix: "Supabase dashboard, Project Settings, Integrations, GitHub: connect the repo with automatic branching on.",
+        });
+    const shared = branches.find((b) => b.name === config.sharedBranch);
+    const finding = await githubFinding(branches.filter((b) => !b.is_default && b.project_ref !== parent), shared, supabase);
+    if (finding)
+        out.push(finding);
+    if (!shared) {
+        out.push({
+            level: "error",
+            message: `no "${config.sharedBranch}" branch, the shared Preview database`,
+            fix: "Run `swp shared` to create it.",
+        });
+        return out;
+    }
+    if (shared.project_ref === parent || shared.is_default)
+        out.push({
+            level: "error",
+            message: `"${config.sharedBranch}" is the production project itself`,
+            fix: 'Set "sharedBranch" in swp.config.json to another name, then run `swp shared`.',
+        });
+    if (!shared.persistent)
+        out.push({
+            level: "warn",
+            message: `"${config.sharedBranch}" is not persistent`,
+            fix: "Run `swp shared` to make it persistent.",
+        });
+    if (shared.git_branch !== config.trunk)
+        out.push({
+            level: "error",
+            message: `"${config.sharedBranch}" tracks ${shared.git_branch ?? "no git branch"}, not ${config.trunk}`,
+            fix: `Run \`swp shared\` to point it at ${config.trunk}.`,
+        });
+    const vars = readWranglerConfig(cwd)?.json.previews
+        ?.vars;
+    const varsRef = projectRefOf(vars?.SUPABASE_URL);
+    if (varsRef && varsRef !== shared.project_ref)
+        out.push({
+            level: "error",
+            message: `previews.vars uses ${varsRef}, but "${config.sharedBranch}" is ${shared.project_ref}`,
+            fix: "Run `swp shared` and paste the values it prints into previews.vars.",
+        });
+    else if (varsRef)
+        out.push({
+            level: "ok",
+            message: `"${config.sharedBranch}" (${shared.project_ref}) tracks ${config.trunk}`,
+        });
+    return out;
+}
+/**
+ * The Management API does not say whether a project is connected to GitHub.
+ * Runs the integration made carry the repo in `git_config`, so look for one.
+ */
+async function githubFinding(branches, shared, supabase) {
+    const ordered = [...(shared ? [shared] : []), ...branches.filter((b) => b !== shared)].slice(0, 5);
+    if (!ordered.length)
+        return null;
+    let runs = 0;
+    for (const branch of ordered) {
+        const list = await supabase.actionRuns(branch.project_ref).catch(() => null);
+        if (!list)
+            continue;
+        runs += list.length;
+        const git = list.find((r) => r.git_config?.repo)?.git_config;
+        if (git)
+            return {
+                level: "ok",
+                message: `Supabase builds "${branch.name}" from GitHub ${git.owner}/${git.repo}, so branches run the repo's migrations`,
+            };
+    }
+    const names = ordered.map((b) => `"${b.name}"`).join(", ");
+    return {
+        level: "warn",
+        message: `cannot confirm the Supabase GitHub integration: ${runs ? `none of the ${runs} runs` : "no runs"} on ${names} came from GitHub. ` +
+            "Branching without Git copies the schema without privileges, so signed-in reads 403",
+        fix: "Connect the repo under Integrations, GitHub; if it is connected, push to the trunk and run doctor again.",
+    };
+}
+function htmlFiles(dir) {
+    return existsSync(dir) ? readdirSync(dir).filter((f) => f.endsWith(".html")) : [];
+}
+function installedWranglerVersion(cwd) {
+    const path = join(cwd, "node_modules", "wrangler", "package.json");
+    return existsSync(path) ? JSON.parse(readFileSync(path, "utf8")).version : null;
+}
+export function compareVersions(version, min) {
+    const parts = version.split(/[.-]/).map((p) => Number.parseInt(p, 10));
+    for (let i = 0; i < min.length; i++) {
+        const diff = (parts[i] ?? 0) - min[i];
+        if (diff)
+            return diff;
+    }
+    return 0;
+}
+/** Local checks always; online checks when there is a token and a usable config. */
+export async function doctor(overrides, supabase, cwd = process.cwd()) {
+    const local = { title: "Local files", findings: [] };
+    const online = { title: "Supabase (online)", findings: [] };
+    let config;
+    try {
+        config = loadConfig(overrides, cwd);
+    }
+    catch (err) {
+        local.findings.push({ level: "error", message: err.message });
+    }
+    try {
+        local.findings.push(...checkLocal(config ?? { ...CONFIG_DEFAULTS, worker: "", supabaseProjectRef: "", ...defined(overrides) }, cwd));
+    }
+    catch (err) {
+        local.findings.push({ level: "error", message: err.message });
+    }
+    if (!config)
+        online.skipped = "skipped until the config above is fixed";
+    else if (!supabase)
+        online.skipped =
+            "skipped: SUPABASE_ACCESS_TOKEN is not set. Add it to .env.swp to also check branching, " +
+                `the shared database and the GitHub integration (${TOKENS_URL}).`;
+    else {
+        online.title = `Supabase (online, project ${config.supabaseProjectRef})`;
+        try {
+            online.findings.push(...(await checkRemote(config, supabase, cwd)));
+        }
+        catch (err) {
+            online.findings.push({ level: "error", message: err.message });
+        }
+    }
+    return [local, online];
+}
+const MARKS = { ok: "✓", warn: "!", error: "✗" };
+export function formatReport(sections, s = makeStyle(false)) {
+    const color = { ok: s.green, warn: s.yellow, error: s.red };
+    const lines = [];
+    for (const section of sections) {
+        if (lines.length)
+            lines.push("");
+        lines.push(s.bold(section.title));
+        for (const f of section.findings) {
+            lines.push(`  ${color[f.level](MARKS[f.level])} ${f.message}`);
+            if (f.fix && f.level !== "ok")
+                lines.push(`    ${s.dim(`→ ${f.fix}`)}`);
+        }
+        if (section.skipped)
+            lines.push(`  ${s.dim(`- ${section.skipped}`)}`);
+    }
+    const all = sections.flatMap((section) => section.findings);
+    const errors = all.filter((f) => f.level === "error").length;
+    const warnings = all.filter((f) => f.level === "warn").length;
+    const plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+    const skipped = sections.some((section) => section.skipped) ? " (online checks skipped)" : "";
+    lines.push("", errors
+        ? s.red(`${plural(errors, "error")}, ${plural(warnings, "warning")}${skipped}. Fix the errors and run swp doctor again.`)
+        : warnings
+            ? s.yellow(`No errors, ${plural(warnings, "warning")}${skipped}.`)
+            : s.green(`All checks passed${skipped}.`));
+    return { text: lines.join("\n"), pass: errors === 0 };
+}

package/dist/commands/init.d.ts

@@ -0,0 +1,11 @@
+export type InitOptions = {
+    supabaseProjectRef?: string;
+    trunk?: string;
+    /** Write the workflow that uses the published GitHub Action. */
+    action?: boolean;
+    dryRun?: boolean;
+    log?: (line: string) => void;
+};
+/** `20260914000000_x.sql` minus one second, so a new migration sorts first. */
+export declare function timestampBefore(file: string): string;
+export declare function init(options?: InitOptions, cwd?: string): void;