supabase-worker-previews 0.0.0 → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matt Ruby
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1 +1,143 @@
-Placeholder. See https://github.com/mattruby/supabase-worker-previews
+# supabase-worker-previews
+
+[![npm](https://img.shields.io/npm/v/supabase-worker-previews)](https://www.npmjs.com/package/supabase-worker-previews)
+[![CI](https://img.shields.io/github/actions/workflow/status/mattruby/supabase-worker-previews/ci.yml?branch=main&label=CI)](https://github.com/mattruby/supabase-worker-previews/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/github/license/mattruby/supabase-worker-previews)](LICENSE)
+
+**Vercel-style PR Previews for a Cloudflare Worker on Supabase, each on the right database, with a check that proves it.**
+
+Every branch gets a [Worker Preview](https://developers.cloudflare.com/workers/previews/) on a shared Preview database. Every PR that changes `supabase/` gets its own database, migrated and seeded from the PR. One build serves all of them, and no Preview ever serves production.
+
+## What you get
+
+On every pull request, one comment that stays up to date:
+
+> **Supabase Worker Preview** for `my-app`
+>
+> | Status                 | Preview            | Database                                       | Commit         | Updated (UTC)    |
+> | :--------------------- | :----------------- | :--------------------------------------------- | :------------- | :--------------- |
+> | **Passed** ([logs](#)) | [Visit Preview](#) | Shared [`preview`](#) (`abcdefghijklmnopqrst`) | [`1a2b3c4`](#) | 2026-10-01 03:10 |
+
+Plus:
+
+- a **View deployment** button on the PR, pointing at the Preview;
+- a **Preview database** check that fails if the Preview serves the wrong database, and fails at once if it serves production;
+- cleanup when the PR closes: the Preview and its own database are deleted, and the comment says so.
+
+**You need this if** your app runs on Cloudflare Workers, deploys with [Workers Builds](https://developers.cloudflare.com/workers/ci-cd/builds/), keeps its data in Supabase, and you want every PR to have a working preview that cannot touch production data. If you are on Vercel, Supabase's own integration already does this; see [Compared with Vercel](docs/vs-vercel.md).
+
+## How it works
+
+```mermaid
+flowchart LR
+  push["git push"] --> builds["Workers Builds"]
+  builds -- trunk --> prod["Production Worker"]
+  builds -- any other branch --> preview["Worker Preview<br/>npx wrangler preview"]
+  prod --> proddb[("Supabase project<br/>(production)")]
+  preview -- "previews.vars" --> shareddb[("Shared Preview database<br/>persistent branch 'preview'")]
+  pr["PR changes supabase/<br/>or has label isolated-db"] --> integ["Supabase GitHub integration"]
+  integ --> prdb[("The PR's own database")]
+  pr --> action["GitHub Actions: swp pr"]
+  action -- "SUPABASE_OVERRIDE secret" --> preview
+  preview -. "PRs with their own database" .-> prdb
+  action -- "swp check reads<br/>/.well-known/supabase-preview" --> preview
+```
+
+`swp` adds no infrastructure. Cloudflare builds the Previews and Supabase makes and migrates the databases. `swp` connects the two:
+
+1. **Every Preview starts on the shared Preview database**, a persistent Supabase branch that tracks your trunk. Its public URL and key live in your wrangler config's `previews.vars`.
+2. **A PR that changes the schema gets its own database.** The Supabase GitHub integration creates it; `swp pr` points the PR's Preview at it with one secret, `SUPABASE_OVERRIDE`.
+3. **The Worker reads its Supabase settings per request.** `withSupabasePreviews()` applies the override and injects the public config into each HTML page, so no build-time `VITE_SUPABASE_URL` pins a database into the bundle.
+4. **`swp check` asks the Preview which database it serves** and fails the PR unless it is the right one.
+
+New to Worker Previews or Supabase branching? [Concepts](docs/concepts.md) explains both in five minutes.
+
+## Quickstart
+
+You need a Worker deployed by Workers Builds from a GitHub repo, wrangler 4.135.0 or later, Node 22 or later, and a Supabase project on a plan with branching.
+
+```bash
+npm install --save-dev supabase-worker-previews
+npx supabase-worker-previews init --project-ref <production project ref>
+```
+
+`init` writes `swp.config.json`, a grants migration and the PR workflow, and prints the rest. Then:
+
+1. Connect the Supabase GitHub integration (automatic branching on, deploy to production off).
+2. Add a `previews` block to your wrangler config.
+3. `npx supabase-worker-previews shared` creates the shared Preview database and prints its `previews.vars`.
+4. Wrap the Worker:
+
+   ```ts
+   import { withSupabasePreviews } from "supabase-worker-previews";
+   import app from "./app";
+
+   export default withSupabasePreviews(app);
+   ```
+
+   and create the browser client from `readPublicConfig()`.
+
+5. Turn on Preview builds in Workers Builds, add three Actions secrets, run `npx supabase-worker-previews doctor`, and open a PR.
+
+The **[full quickstart](docs/quickstart.md)** walks through every step with the dashboard settings and the output to expect. For a complete working project, see [`examples/hono-notes`](examples/hono-notes).
+
+## Commands
+
+| Group          | Command      | Does                                                                                 |
+| -------------- | ------------ | ------------------------------------------------------------------------------------ |
+| **Set up**     | `swp init`   | Scaffold `swp.config.json`, the grants migration and the workflow (never overwrites) |
+|                | `swp doctor` | Check the whole setup, offline and (with a token) against Supabase                   |
+|                | `swp shared` | Create or repair the shared Preview database; prints its `previews.vars`             |
+| **Per branch** | `swp up`     | Give a branch's Preview its own database                                             |
+|                | `swp check`  | Fail unless the Preview serves the right database                                    |
+|                | `swp down`   | Delete a branch's Preview and its own database                                       |
+| **In CI**      | `swp pr`     | All of the above for a `pull_request` workflow, plus the PR comment and deployment   |
+|                | `swp prune`  | List leftovers of deleted branches and closed PRs; delete them with `--yes`          |
+
+`swp` is the short name once the package is installed; the full name `supabase-worker-previews` runs the same CLI. With `npx`, always use the full name: `npx swp` on a machine without this package installed downloads [an unrelated npm package named `swp`](https://www.npmjs.com/package/swp) that deletes dependency and build folders.
+
+`swp <command> --help` shows one command's flags and examples, and `swp --version` prints the version. Flags, environment variables, every `swp.config.json` field and the GitHub Action inputs are in the [configuration reference](docs/configuration.md).
+
+## Safety
+
+- `swp` never writes to, repoints or deletes the production project, and never deletes a persistent branch.
+- `swp check` fails the first time a Preview serves production, with no retry.
+- `swp doctor` fails if `previews.vars` names production or holds a secret.
+- `swp prune` only lists until you pass `--yes`, and every command that changes something takes `--dry-run`.
+
+[Security](docs/security.md) covers what `swp` can touch and what each token can reach.
+
+## Docs
+
+| Page                                       | For                                                                |
+| ------------------------------------------ | ------------------------------------------------------------------ |
+| [Concepts](docs/concepts.md)               | Worker Previews, Supabase branches, and how `swp` joins them       |
+| [Quickstart](docs/quickstart.md)           | From an existing Worker to the first working PR Preview            |
+| [Frameworks](docs/README.md#frameworks)    | TanStack Start, Hono, React Router v7, Astro                       |
+| [Troubleshooting](docs/troubleshooting.md) | Symptoms, causes and fixes                                         |
+| [How it works](docs/how-it-works.md)       | Every moving part and why it is built that way                     |
+| [Configuration](docs/configuration.md)     | Commands, flags, `swp.config.json`, the GitHub Action, the runtime |
+| [Tokens](docs/tokens.md)                   | Least-privilege Cloudflare, Supabase and GitHub credentials        |
+| [Security](docs/security.md)               | What `swp` can touch, what is public, what is secret               |
+| [Compared with Vercel](docs/vs-vercel.md)  | When Vercel and its Supabase integration are the better fit        |
+
+The full index is [docs/README.md](docs/README.md).
+
+## Claude Code plugin
+
+The repo is also a Claude Code plugin. Its skill carries the [measured platform behaviour](skills/supabase-worker-previews/references/gotchas.md) behind every design choice, so Claude can set up and debug Previews with it:
+
+```text
+/plugin marketplace add mattruby/supabase-worker-previews
+/plugin install supabase-worker-previews
+```
+
+## Status
+
+**Beta.** Cloudflare [launched Worker Previews on 2026-09-22](https://developers.cloudflare.com/changelog/post/2026-09-22-worker-previews/) as an open beta, and this package is 0.x. Expect both the platform and the CLI to change. Bug reports and platform findings are welcome; see [CONTRIBUTING.md](CONTRIBUTING.md).
+
+Not affiliated with Supabase or Cloudflare.
+
+## License
+
+[MIT](LICENSE)

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,152 @@
+#!/usr/bin/env node
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { CloudflareApi } from "./cloudflare.js";
+import { loadConfig, migrationFiles } from "./config.js";
+import { check, down, shared, up } from "./commands/branches.js";
+import { doctor, formatReport } from "./commands/doctor.js";
+import { init } from "./commands/init.js";
+import { prune } from "./commands/prune.js";
+import { annotation, pr, readEvent, skipReason } from "./commands/pr.js";
+import { makeRunner, sleep } from "./run.js";
+import { err as errStyle, out } from "./style.js";
+import { SupabaseApi } from "./supabase.js";
+import { formatError, missingEnvMessage, resolveInvocation, version } from "./usage.js";
+function git(args) {
+    try {
+        return execFileSync("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+function currentBranch(flag) {
+    if (typeof flag === "string")
+        return flag;
+    if (process.env.WORKERS_CI_BRANCH)
+        return process.env.WORKERS_CI_BRANCH;
+    if (process.env.GITHUB_HEAD_REF)
+        return process.env.GITHUB_HEAD_REF;
+    const branch = git(["rev-parse", "--abbrev-ref", "HEAD"]);
+    if (!branch)
+        throw new Error("Cannot tell the git branch here (not a git checkout?). Pass --branch <name>.");
+    if (branch === "HEAD")
+        throw new Error("HEAD is detached, so there is no branch to use. Pass --branch <name>.");
+    return branch;
+}
+/** `owner/name` from a github.com origin remote, over https or ssh. */
+function originRepo() {
+    const url = git(["remote", "get-url", "origin"]);
+    return url?.match(/github\.com[:/]([^/]+\/[^/]+?)(?:\.git)?\/?$/)?.[1];
+}
+function env(name) {
+    return process.env[name] || `<${name}>`;
+}
+function str(v) {
+    return typeof v === "string" ? v : undefined;
+}
+function prNumber(flag) {
+    if (flag === undefined)
+        return undefined;
+    const n = Number(flag);
+    if (!Number.isInteger(n) || n <= 0)
+        throw new Error(`--pr takes a pull request number, not "${String(flag)}"`);
+    return n;
+}
+async function main(argv) {
+    const invocation = resolveInvocation(argv, out);
+    if (invocation.kind === "help") {
+        console.log(invocation.text);
+        return invocation.code;
+    }
+    if (invocation.kind === "version") {
+        console.log(version());
+        return 0;
+    }
+    if (invocation.kind === "error") {
+        console.error(`${errStyle.red("swp:")} ${invocation.message}`);
+        return 2;
+    }
+    const { command, flags } = invocation;
+    const dryRun = flags["dry-run"] === true;
+    const envFile = str(flags.dotenv) ?? (existsSync(".env.swp") ? ".env.swp" : undefined);
+    if (envFile) {
+        if (!existsSync(envFile))
+            throw new Error(`--dotenv ${envFile}: no such file`);
+        process.loadEnvFile(envFile);
+    }
+    if (command === "init") {
+        init({
+            supabaseProjectRef: str(flags["project-ref"]),
+            trunk: str(flags.trunk),
+            action: flags.action === true,
+            dryRun,
+            log: (line) => console.log(line.startsWith("+ ") ? out.green(line) : line.startsWith("- ") ? out.dim(line) : line),
+        });
+        return 0;
+    }
+    const overrides = {
+        worker: str(flags.worker),
+        supabaseProjectRef: str(flags["project-ref"]),
+        trunk: str(flags.trunk),
+        prComment: flags["no-comment"] ? false : undefined,
+        githubDeployments: flags["no-deployments"] ? false : undefined,
+    };
+    if (command === "doctor") {
+        const token = process.env.SUPABASE_ACCESS_TOKEN;
+        const report = formatReport(await doctor(overrides, token ? new SupabaseApi(token) : undefined), out);
+        console.log(report.text);
+        return report.pass ? 0 : 1;
+    }
+    const config = loadConfig(overrides);
+    const prNum = prNumber(flags.pr);
+    const event = command === "pr" ? readEvent() : undefined;
+    const skip = event && skipReason(event);
+    if (skip) {
+        console.log(annotation(skip));
+        return skip.level === "error" ? 1 : 0;
+    }
+    const repo = command === "prune" ? (str(flags.repo) ?? process.env.GITHUB_REPOSITORY ?? originRepo()) : undefined;
+    if (command === "prune" && !repo)
+        throw new Error("Cannot tell the GitHub repo: pass --repo <owner/name>, or set GITHUB_REPOSITORY.");
+    const missing = missingEnvMessage(command, dryRun);
+    if (missing)
+        throw new Error(missing);
+    const runner = makeRunner(dryRun, (line) => console.log(line.startsWith("  $ ") ? out.dim(line) : line));
+    if (dryRun)
+        runner.log(out.dim("Dry run: reads only, changes nothing."));
+    const deps = {
+        config,
+        runner,
+        supabase: new SupabaseApi(env("SUPABASE_ACCESS_TOKEN")),
+        cloudflare: new CloudflareApi(runner, { apiToken: env("CLOUDFLARE_API_TOKEN"), accountId: env("CLOUDFLARE_ACCOUNT_ID") }, config.worker),
+        migrationCount: () => migrationFiles(config).length,
+        sleep,
+        fetchImpl: fetch,
+    };
+    switch (command) {
+        case "shared":
+            await shared(deps);
+            break;
+        case "up":
+            await up(currentBranch(flags.branch), deps, prNum);
+            break;
+        case "check":
+            await check(currentBranch(flags.branch), flags.isolated === true, deps, prNum);
+            break;
+        case "down":
+            await down(currentBranch(flags.branch), deps, prNum);
+            break;
+        case "pr":
+            await pr(event, { ...deps, githubToken: env("GITHUB_TOKEN") });
+            break;
+        case "prune":
+            await prune({ ...deps, githubToken: env("GITHUB_TOKEN"), repo: repo, yes: flags.yes === true });
+            break;
+    }
+    return 0;
+}
+main(process.argv.slice(2)).then((code) => process.exit(code), (err) => {
+    console.error(`${errStyle.red("swp:")} ${formatError(err)}`);
+    process.exit(1);
+});

package/dist/cloudflare.d.ts

@@ -0,0 +1,37 @@
+import type { Runner } from "./run.js";
+export type CloudflareAuth = {
+    apiToken: string;
+    accountId: string;
+};
+export type PreviewRecord = {
+    id: string;
+    name: string;
+    slug: string;
+    urls: string[];
+    deployed_on: string | null;
+};
+/** Workers Builds names a Preview after the raw git branch; Cloudflare derives the slug and hostname. */
+export declare function matchPreview(previews: PreviewRecord[], gitBranch: string): PreviewRecord | undefined;
+/** Preview operations go through wrangler; only the subdomain lookup is a direct API call. */
+export declare class CloudflareApi {
+    private runner;
+    private auth;
+    private worker;
+    private fetchImpl;
+    private subdomain?;
+    constructor(runner: Runner, auth: CloudflareAuth, worker: string, fetchImpl?: typeof fetch);
+    private get env();
+    private wrangler;
+    private api;
+    workersSubdomain(): Promise<string>;
+    listPreviews(): Promise<PreviewRecord[]>;
+    findPreview(gitBranch: string): Promise<PreviewRecord | undefined>;
+    /** Writing to a Preview creates a new deployment of it. */
+    putPreviewSecrets(preview: string, secrets: Record<string, string>): void;
+    listPreviewSecrets(preview: string): string[];
+    /** Creates a new deployment of the Preview, like any secret write. */
+    deletePreviewSecret(preview: string, key: string): void;
+    /** Merges: keys absent from `secrets` stay. Only Previews created afterwards copy it. */
+    putBaseSecrets(secrets: Record<string, string>): void;
+    deletePreview(preview: string): void;
+}

package/dist/cloudflare.js

@@ -0,0 +1,95 @@
+import { apiErrorMessage } from "./http.js";
+import { previewName } from "./preview-name.js";
+/** Workers Builds names a Preview after the raw git branch; Cloudflare derives the slug and hostname. */
+export function matchPreview(previews, gitBranch) {
+    return (previews.find((p) => p.name === gitBranch) ?? previews.find((p) => p.slug === previewName(gitBranch)));
+}
+/** Preview operations go through wrangler; only the subdomain lookup is a direct API call. */
+export class CloudflareApi {
+    runner;
+    auth;
+    worker;
+    fetchImpl;
+    subdomain;
+    constructor(runner, auth, worker, fetchImpl = fetch) {
+        this.runner = runner;
+        this.auth = auth;
+        this.worker = worker;
+        this.fetchImpl = fetchImpl;
+    }
+    get env() {
+        return { CLOUDFLARE_API_TOKEN: this.auth.apiToken, CLOUDFLARE_ACCOUNT_ID: this.auth.accountId };
+    }
+    wrangler(args, opts = {}) {
+        return this.runner.exec("npx", ["wrangler", ...args, "--worker-name", this.worker], {
+            env: this.env,
+            ...opts,
+        });
+    }
+    async api(path) {
+        const res = await this.fetchImpl(`https://api.cloudflare.com/client/v4/accounts/${this.auth.accountId}${path}`, {
+            headers: { authorization: `Bearer ${this.auth.apiToken}` },
+        });
+        const text = await res.text();
+        const json = parseJson(text);
+        if (!res.ok || json?.result === undefined)
+            throw new Error(apiErrorMessage(`Cloudflare API GET ${path}`, res.status, text, "CLOUDFLARE_API_TOKEN"));
+        return json.result;
+    }
+    async workersSubdomain() {
+        this.subdomain ??= (await this.api("/workers/subdomain")).subdomain;
+        return this.subdomain;
+    }
+    async listPreviews() {
+        const all = [];
+        for (let page = 1;; page += 1) {
+            const batch = await this.api(`/workers/workers/${this.worker}/previews?per_page=100&page=${page}`);
+            all.push(...batch);
+            if (batch.length < 100)
+                return all;
+        }
+    }
+    async findPreview(gitBranch) {
+        return matchPreview(await this.listPreviews(), gitBranch);
+    }
+    /** Writing to a Preview creates a new deployment of it. */
+    putPreviewSecrets(preview, secrets) {
+        if (this.runner.dryRun) {
+            this.runner.log(`  $ npx wrangler preview secret bulk --name ${preview}  (${Object.keys(secrets).join(", ")})`);
+            return;
+        }
+        this.wrangler(["preview", "secret", "bulk", "--name", preview], { input: JSON.stringify(secrets) });
+    }
+    listPreviewSecrets(preview) {
+        const out = this.wrangler(["preview", "secret", "list", "--name", preview, "--json"], {
+            captureStderr: true,
+        });
+        const start = out.search(/^\[/m);
+        return start === -1 ? [] : JSON.parse(out.slice(start)).map((s) => s.name);
+    }
+    /** Creates a new deployment of the Preview, like any secret write. */
+    deletePreviewSecret(preview, key) {
+        this.wrangler(["preview", "secret", "delete", key, "--name", preview, "--skip-confirmation"], {
+            captureStderr: true,
+        });
+    }
+    /** Merges: keys absent from `secrets` stay. Only Previews created afterwards copy it. */
+    putBaseSecrets(secrets) {
+        if (this.runner.dryRun) {
+            this.runner.log(`  $ npx wrangler preview base-config secret bulk  (${Object.keys(secrets).join(", ")})`);
+            return;
+        }
+        this.wrangler(["preview", "base-config", "secret", "bulk"], { input: JSON.stringify(secrets) });
+    }
+    deletePreview(preview) {
+        this.wrangler(["preview", "delete", "--name", preview, "--skip-confirmation"], { captureStderr: true });
+    }
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}

package/dist/commands/branches.d.ts

@@ -0,0 +1,62 @@
+import type { CloudflareApi } from "../cloudflare.js";
+import type { Config } from "../config.js";
+import type { Runner } from "../run.js";
+import { type Branch, type SupabaseApi } from "../supabase.js";
+import { type SupabaseValues } from "../runtime.js";
+export type Deps = {
+    config: Config;
+    runner: Runner;
+    supabase: SupabaseApi;
+    cloudflare: CloudflareApi;
+    migrationCount: () => number;
+    sleep: (ms: number) => Promise<void>;
+    fetchImpl: typeof fetch;
+    now?: () => number;
+};
+/** The non-default Supabase branch tied to a git branch, made by the GitHub integration or by `up`. */
+export declare function branchFor(gitBranch: string, deps: Deps): Promise<Branch | undefined>;
+/** The Preview a git branch deploys to: named after the branch, or `pr-<number>` when configured. */
+export declare function previewKey(gitBranch: string, config: Config, pr?: number): string;
+/** A branch `swp` may delete: never production, the shared database, the trunk's or a persistent one. */
+export declare function isDisposable(branch: Branch, config: Config): boolean;
+/** Never repoint, write to or delete the production project through a branch record. */
+export declare function assertIsolated(branch: Branch, parent: string): void;
+export declare function supabaseValues(ref: string, deps: Deps): Promise<SupabaseValues>;
+/**
+ * The shared Preview database: a persistent branch that tracks the trunk, so
+ * the GitHub integration migrates it on every trunk push. Its public values
+ * belong in wrangler `previews.vars`; only its secret key goes in the Preview
+ * base config.
+ */
+export declare function shared(deps: Deps): Promise<string>;
+/**
+ * Gives a git branch's Preview its own database. The GitHub integration makes
+ * one for any PR that changes supabase/; for other branches this asks for one,
+ * which Supabase still migrates and seeds from that git branch.
+ */
+export declare function up(gitBranch: string, deps: Deps, pr?: number): Promise<string>;
+/**
+ * Puts a Preview back on the shared database once its PR no longer needs its
+ * own: drops the override, then deletes the branch `up` made for it. The
+ * integration only makes branches for PRs that change supabase/, which never
+ * get here.
+ */
+export declare function release(gitBranch: string, deps: Deps, pr?: number): Promise<void>;
+/** Which database a deployed Preview serves, from the identity route or, failing that, its HTML. */
+export declare function servedRef(baseUrl: string, deps: Deps): Promise<{
+    ref?: string;
+    seen: string;
+}>;
+/**
+ * Fails unless the Preview serves the database it should: its own branch
+ * when isolated, else the shared one. Production fails at once; anything
+ * else is retried while Workers Builds and `up` finish.
+ */
+export declare function check(gitBranch: string, isolated: boolean, deps: Deps, pr?: number): Promise<void>;
+/** Removes the Preview and, if the integration has not already, its own database. */
+export declare function down(gitBranch: string, deps: Deps, pr?: number): Promise<void>;
+/**
+ * Ready when the branch holds every migration in this checkout. Branch status
+ * runs ahead of the migrations, so the status alone is not enough.
+ */
+export declare function waitForMigrations(ref: string, deps: Deps): Promise<void>;