supabase-worker-previews 0.0.0 → 0.1.1

package/dist/commands/init.js

@@ -0,0 +1,132 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { CONFIG_FILE, migrationFiles, migrationsDir, PLACEHOLDER_REF, readWranglerConfig, WRANGLER_FILES, } from "../config.js";
+import { QUICKSTART_URL, TOKENS_URL } from "../http.js";
+import { hasDefaultPrivileges } from "./doctor.js";
+const TEMPLATES = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "templates");
+const WORKFLOW = ".github/workflows/supabase-previews.yml";
+/** `20260914000000_x.sql` minus one second, so a new migration sorts first. */
+export function timestampBefore(file) {
+    const m = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})/.exec(file);
+    if (!m)
+        throw new Error(`${file} does not start with a YYYYMMDDHHMMSS timestamp`);
+    const [, y, mo, d, h, mi, s] = m.map(Number);
+    return stamp(new Date(Date.UTC(y, mo - 1, d, h, mi, s) - 1000));
+}
+function stamp(date) {
+    return date.toISOString().replace(/[-:T]/g, "").slice(0, 14);
+}
+function defaultTrunk(cwd) {
+    try {
+        return execFileSync("git", ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], {
+            cwd,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        })
+            .trim()
+            .replace(/^origin\//, "");
+    }
+    catch {
+        return "main";
+    }
+}
+function hasProjectRef(json) {
+    try {
+        const ref = JSON.parse(json).supabaseProjectRef;
+        return typeof ref === "string" && !!ref && ref !== PLACEHOLDER_REF;
+    }
+    catch {
+        return true;
+    }
+}
+function linkedProjectRef(cwd) {
+    const path = join(cwd, "supabase", ".temp", "project-ref");
+    return existsSync(path) ? readFileSync(path, "utf8").trim() : undefined;
+}
+export function init(options = {}, cwd = process.cwd()) {
+    const log = options.log ?? console.log;
+    const wrangler = readWranglerConfig(cwd);
+    if (!wrangler)
+        throw new Error(`No ${WRANGLER_FILES.join(", ")} in this directory. Run swp init in the Worker's directory.`);
+    if (!wrangler.name)
+        throw new Error(`${wrangler.file} has no "name". Add the Worker's name, then run swp init again.`);
+    const write = (path, content) => {
+        if (options.dryRun)
+            return;
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, content);
+    };
+    if (options.dryRun)
+        log("Dry run: nothing is written.\n");
+    const configPath = join(cwd, CONFIG_FILE);
+    let needsRef;
+    if (existsSync(configPath)) {
+        needsRef = !hasProjectRef(readFileSync(configPath, "utf8"));
+        log(`- ${CONFIG_FILE} exists, left alone`);
+    }
+    else {
+        const linked = linkedProjectRef(cwd);
+        const ref = options.supabaseProjectRef ?? linked;
+        needsRef = !ref;
+        const config = {
+            supabaseProjectRef: ref ?? PLACEHOLDER_REF,
+            trunk: options.trunk ?? defaultTrunk(cwd),
+        };
+        write(configPath, JSON.stringify(config, null, 2) + "\n");
+        const note = !ref
+            ? "  (fill in supabaseProjectRef)"
+            : ref === linked && !options.supabaseProjectRef
+                ? "  (project ref from supabase link)"
+                : "";
+        log(`+ ${CONFIG_FILE}${note}`);
+    }
+    const config = { supabaseDir: "supabase" };
+    const migrations = migrationFiles(config, cwd);
+    const first = migrations[0];
+    if (first && hasDefaultPrivileges(readFileSync(join(cwd, migrationsDir(config), first), "utf8"))) {
+        log(`- ${first} already grants default privileges`);
+    }
+    else {
+        const name = `${first ? timestampBefore(first) : stamp(new Date())}_api_default_privileges.sql`;
+        write(join(cwd, migrationsDir(config), name), readFileSync(join(TEMPLATES, "default-privileges.sql")));
+        log(`+ ${migrationsDir(config)}/${name}`);
+        if (first)
+            log("  It is dated before your existing migrations. Production has not run it: apply it with\n" +
+                `  \`supabase db push --include-all\`, or run the SQL once and \`supabase migration repair --status applied ${name.slice(0, 14)}\`.`);
+    }
+    const workflowPath = join(cwd, WORKFLOW);
+    if (existsSync(workflowPath))
+        log(`- ${WORKFLOW} exists, left alone`);
+    else {
+        write(workflowPath, readFileSync(join(TEMPLATES, options.action ? "supabase-previews-action.yml" : "supabase-previews.yml")));
+        log(`+ ${WORKFLOW}`);
+        log(options.action
+            ? "  It uses the published action, mattruby/supabase-worker-previews@v0."
+            : "  It runs `npx supabase-worker-previews pr`; `npx supabase-worker-previews init --action` writes one that uses the published action instead.");
+    }
+    const steps = [
+        ...(needsRef
+            ? [`Set "supabaseProjectRef" in ${CONFIG_FILE}: the <ref> in https://<ref>.supabase.co.`]
+            : []),
+        "Supabase dashboard, Project Settings, Integrations, GitHub: connect the repo, with\n" +
+            'automatic branching on and "Deploy to production" off.',
+        `In supabase/config.toml, add "https://*-${wrangler.name}.<subdomain>.workers.dev/**" to\n` +
+            "[auth] additional_redirect_urls.",
+        ...(wrangler.json.previews
+            ? []
+            : [`Add a "previews" block to ${wrangler.file}, redeclaring every binding the Worker uses.`]),
+        "Put SUPABASE_ACCESS_TOKEN, CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID in .env.swp\n" +
+            `(git-ignore it; scopes: ${TOKENS_URL}),\n` +
+            "then run `npx supabase-worker-previews shared` and paste the previews.vars it prints.",
+        "Wrap the Worker's default export:\n" +
+            '  import { withSupabasePreviews } from "supabase-worker-previews";\n' +
+            "  export default withSupabasePreviews(app);",
+        "Workers Builds: turn on non-production branch builds, deploy command `npx wrangler preview`.",
+        "GitHub repo, Settings, Secrets and variables, Actions: add the same three tokens.",
+        "Run `npx supabase-worker-previews doctor` until it passes, then commit and open a PR.",
+    ];
+    log(`\nNext, by hand (the full guide: ${QUICKSTART_URL}):`);
+    steps.forEach((step, i) => log(`  ${i + 1}. ${step.replace(/\n/g, "\n     ")}`));
+}

package/dist/commands/pr.d.ts

@@ -0,0 +1,37 @@
+import type { Config } from "../config.js";
+import { type FeedbackDeps } from "../feedback.js";
+export type PullRequestEvent = {
+    action: string;
+    number: number;
+    pull_request: {
+        head: {
+            ref: string;
+            sha: string;
+            repo?: {
+                full_name: string;
+            } | null;
+        };
+        labels: {
+            name: string;
+        }[];
+    };
+    repository: {
+        full_name: string;
+    };
+};
+export declare function readEvent(path?: string | undefined): PullRequestEvent;
+export declare const PR_ENV: string[];
+export type Skip = {
+    level: "notice" | "warning" | "error";
+    message: string;
+};
+/**
+ * A fork PR, or a bot PR without secrets (Dependabot gets none), is skipped with an annotation.
+ * Anyone else's PR without secrets fails, so a misconfigured repo never shows a green check.
+ */
+export declare function skipReason(event: PullRequestEvent, env?: Record<string, string | undefined>): Skip | null;
+export declare function annotation(skip: Skip): string;
+export declare function changedFiles(event: PullRequestEvent, token: string, fetchImpl: typeof fetch): Promise<string[]>;
+export declare function needsIsolatedDb(event: PullRequestEvent, files: string[], config: Config): boolean;
+/** One entry point for a pull_request workflow: clean up on close, otherwise point and prove. */
+export declare function pr(event: PullRequestEvent, deps: FeedbackDeps): Promise<void>;

package/dist/commands/pr.js

@@ -0,0 +1,78 @@
+import { readFileSync } from "node:fs";
+import { Feedback } from "../feedback.js";
+import { apiErrorMessage } from "../http.js";
+import { check, down, release, up } from "./branches.js";
+export function readEvent(path = process.env.GITHUB_EVENT_PATH) {
+    if (!path)
+        throw new Error("GITHUB_EVENT_PATH is not set: `swp pr` runs inside a pull_request workflow. To try one branch here, use `swp up` or `swp check`.");
+    const event = JSON.parse(readFileSync(path, "utf8"));
+    if (!event.pull_request)
+        throw new Error("`swp pr` needs a pull_request event");
+    return event;
+}
+export const PR_ENV = [
+    "SUPABASE_ACCESS_TOKEN",
+    "CLOUDFLARE_API_TOKEN",
+    "CLOUDFLARE_ACCOUNT_ID",
+    "GITHUB_TOKEN",
+];
+/**
+ * A fork PR, or a bot PR without secrets (Dependabot gets none), is skipped with an annotation.
+ * Anyone else's PR without secrets fails, so a misconfigured repo never shows a green check.
+ */
+export function skipReason(event, env = process.env) {
+    const head = event.pull_request.head.repo;
+    if (head !== undefined && head?.full_name !== event.repository.full_name)
+        return {
+            level: "notice",
+            message: `swp pr skipped PR #${event.number}: it comes from ${head ? `the fork ${head.full_name}` : "a deleted fork"}, and GitHub Actions gives fork PRs no secrets`,
+        };
+    const missing = PR_ENV.filter((name) => !env[name]);
+    if (missing.length) {
+        const bot = env.GITHUB_ACTOR?.endsWith("[bot]") ?? false;
+        return {
+            level: bot ? "warning" : "error",
+            message: `swp pr ${bot ? "skipped" : "cannot check"} PR #${event.number}: ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} empty; add ${missing.length === 1 ? "it" : "them"} to the repository's Actions secrets`,
+        };
+    }
+    return null;
+}
+export function annotation(skip) {
+    return `::${skip.level}::${skip.message.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A")}`;
+}
+export async function changedFiles(event, token, fetchImpl) {
+    const files = [];
+    for (let page = 1;; page += 1) {
+        const res = await fetchImpl(`https://api.github.com/repos/${event.repository.full_name}/pulls/${event.number}/files?per_page=100&page=${page}`, { headers: { authorization: `Bearer ${token}`, accept: "application/vnd.github+json" } });
+        if (!res.ok)
+            throw new Error(apiErrorMessage("GitHub API GET PR files", res.status, await res.text(), "GITHUB_TOKEN"));
+        const batch = (await res.json());
+        for (const f of batch)
+            files.push(f.filename, ...(f.previous_filename ? [f.previous_filename] : []));
+        if (batch.length < 100)
+            return files;
+    }
+}
+export function needsIsolatedDb(event, files, config) {
+    if (event.pull_request.labels.some((l) => l.name === config.isolatedLabel))
+        return true;
+    const dir = config.supabaseDir.replace(/\/+$/, "") + "/";
+    return files.some((f) => f.startsWith(dir));
+}
+/** One entry point for a pull_request workflow: clean up on close, otherwise point and prove. */
+export async function pr(event, deps) {
+    const branch = event.pull_request.head.ref;
+    const feedback = new Feedback(event, deps);
+    const files = await changedFiles(event, deps.githubToken, deps.fetchImpl);
+    const isolated = needsIsolatedDb(event, files, deps.config);
+    if (event.action === "closed")
+        return feedback.close(() => down(branch, deps, event.number), isolated);
+    deps.runner.log(`PR #${event.number} (${branch}): ${isolated ? "its own database" : `the shared "${deps.config.sharedBranch}" database`}`);
+    await feedback.run(isolated, async () => {
+        if (isolated)
+            await up(branch, deps, event.number);
+        else
+            await release(branch, deps, event.number);
+        await check(branch, isolated, deps, event.number);
+    });
+}

package/dist/commands/prune.d.ts

@@ -0,0 +1,32 @@
+import type { PreviewRecord } from "../cloudflare.js";
+import type { Config } from "../config.js";
+import type { Branch } from "../supabase.js";
+import { type Deps } from "./branches.js";
+export type OpenPr = {
+    number: number;
+    head: string;
+};
+export type PrunePlan = {
+    branches: Branch[];
+    previews: PreviewRecord[];
+};
+/** What the repo says: its git branches, its open PRs, and the heads that only have closed PRs. */
+export type RepoFacts = {
+    branches: string[];
+    open: OpenPr[];
+    closedHeads: string[];
+};
+export declare function openPullRequests(repo: string, token: string, fetchImpl: typeof fetch): Promise<OpenPr[]>;
+export declare function repoBranches(repo: string, token: string, fetchImpl: typeof fetch): Promise<string[]>;
+/**
+ * Leftovers. A disposable Supabase branch whose git branch is gone, or has a
+ * closed PR and no open one. A Preview whose git branch is gone, or with
+ * previewName "pr", a pr-<n> whose PR is not open. Never the trunk's Preview.
+ */
+export declare function planPrune(branches: Branch[], previews: PreviewRecord[], facts: RepoFacts, config: Config): PrunePlan;
+/** Prints the leftovers; deletes them only with `yes`. */
+export declare function prune(deps: Deps & {
+    githubToken: string;
+    repo: string;
+    yes: boolean;
+}): Promise<PrunePlan>;

package/dist/commands/prune.js

@@ -0,0 +1,110 @@
+import { apiErrorMessage } from "../http.js";
+import { previewName } from "../preview-name.js";
+import { assertIsolated, isDisposable } from "./branches.js";
+async function github(path, token, fetchImpl) {
+    const res = await fetchImpl(`https://api.github.com/repos/${path}`, {
+        headers: { authorization: `Bearer ${token}`, accept: "application/vnd.github+json" },
+    });
+    if (!res.ok)
+        throw new Error(apiErrorMessage(`GitHub API GET ${path}`, res.status, await res.text(), "GITHUB_TOKEN"));
+    return (await res.json());
+}
+async function allPages(path, token, fetchImpl) {
+    const all = [];
+    for (let page = 1;; page += 1) {
+        const sep = path.includes("?") ? "&" : "?";
+        const batch = await github(`${path}${sep}per_page=100&page=${page}`, token, fetchImpl);
+        all.push(...batch);
+        if (batch.length < 100)
+            return all;
+    }
+}
+export async function openPullRequests(repo, token, fetchImpl) {
+    const prs = await allPages(`${repo}/pulls?state=open`, token, fetchImpl);
+    return prs.map((p) => ({ number: p.number, head: p.head.ref }));
+}
+export async function repoBranches(repo, token, fetchImpl) {
+    return (await allPages(`${repo}/branches`, token, fetchImpl)).map((b) => b.name);
+}
+async function hasClosedPr(repo, ref, token, fetchImpl) {
+    const owner = repo.split("/")[0];
+    const head = encodeURIComponent(`${owner}:${ref}`);
+    return ((await github(`${repo}/pulls?state=closed&head=${head}&per_page=1`, token, fetchImpl)).length >
+        0);
+}
+function slugOf(branch) {
+    try {
+        return previewName(branch);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Leftovers. A disposable Supabase branch whose git branch is gone, or has a
+ * closed PR and no open one. A Preview whose git branch is gone, or with
+ * previewName "pr", a pr-<n> whose PR is not open. Never the trunk's Preview.
+ */
+export function planPrune(branches, previews, facts, config) {
+    const existing = new Set(facts.branches);
+    const existingSlugs = new Set(facts.branches.map(slugOf).filter((s) => s !== undefined));
+    const openHeads = new Set(facts.open.map((p) => p.head));
+    const closedHeads = new Set(facts.closedHeads);
+    const numbers = new Set(facts.open.map((p) => p.number));
+    const isTrunk = (p) => p.name === config.trunk || p.slug === slugOf(config.trunk);
+    return {
+        branches: branches.filter((b) => isDisposable(b, config) &&
+            !!b.git_branch &&
+            !openHeads.has(b.git_branch) &&
+            (!existing.has(b.git_branch) || closedHeads.has(b.git_branch))),
+        previews: previews.filter((p) => {
+            if (isTrunk(p))
+                return false;
+            if (config.previewName === "pr") {
+                const n = /^pr-(\d+)$/.exec(p.name)?.[1];
+                return n !== undefined && !numbers.has(Number(n));
+            }
+            return !existing.has(p.name) && !existingSlugs.has(p.slug);
+        }),
+    };
+}
+/** Prints the leftovers; deletes them only with `yes`. */
+export async function prune(deps) {
+    const { config, runner } = deps;
+    const { repo, githubToken: token, fetchImpl } = deps;
+    const open = await openPullRequests(repo, token, fetchImpl);
+    const existing = await repoBranches(repo, token, fetchImpl);
+    const supabaseBranches = await deps.supabase.listBranches(config.supabaseProjectRef);
+    const openHeads = new Set(open.map((p) => p.head));
+    const closedHeads = [];
+    for (const gitBranch of new Set(supabaseBranches.filter((b) => isDisposable(b, config)).map((b) => b.git_branch))) {
+        if (!gitBranch || openHeads.has(gitBranch) || !existing.includes(gitBranch))
+            continue;
+        if (await hasClosedPr(repo, gitBranch, token, fetchImpl))
+            closedHeads.push(gitBranch);
+    }
+    const plan = planPrune(supabaseBranches, await deps.cloudflare.listPreviews(), { branches: existing, open, closedHeads }, config);
+    runner.log(`${repo} has ${existing.length} branches and ${open.length} open PRs`);
+    for (const b of plan.branches)
+        runner.log(`  Supabase branch ${b.name} (${b.project_ref}), git branch ${b.git_branch}`);
+    for (const p of plan.previews)
+        runner.log(`  Preview ${p.name}`);
+    if (!plan.branches.length && !plan.previews.length) {
+        runner.log("Nothing to prune");
+        return plan;
+    }
+    if (!deps.yes || runner.dryRun) {
+        runner.log("Run again with --yes to delete these");
+        return plan;
+    }
+    for (const b of plan.branches) {
+        assertIsolated(b, config.supabaseProjectRef);
+        await deps.supabase.deleteBranch(b.project_ref);
+        runner.log(`  deleted Supabase branch ${b.name}`);
+    }
+    for (const p of plan.previews) {
+        deps.cloudflare.deletePreview(p.name);
+        runner.log(`  deleted Preview ${p.name}`);
+    }
+    return plan;
+}

package/dist/config.d.ts

@@ -0,0 +1,50 @@
+export declare const CONFIG_FILE = "swp.config.json";
+export declare const WRANGLER_FILES: string[];
+/** What `swp init` writes when it cannot find the project ref. */
+export declare const PLACEHOLDER_REF = "<production project ref>";
+export type Config = {
+    /** Worker name; defaults to `name` in the wrangler config. */
+    worker: string;
+    /** The parent (production) Supabase project. Previews must never serve it. */
+    supabaseProjectRef: string;
+    /** Git branch the shared Preview database tracks. */
+    trunk: string;
+    /** Name of the persistent Supabase branch every Preview shares by default. */
+    sharedBranch: string;
+    /** The account's workers.dev subdomain; looked up through the API when absent. */
+    workersSubdomain?: string;
+    supabaseDir: string;
+    /** PR label that asks for an isolated database without a schema change. */
+    isolatedLabel: string;
+    /** Path `check` fetches when the Worker does not serve the identity route. */
+    checkPath: string;
+    /** How Previews are named: after the raw git branch (Workers Builds), or `pr-<number>`. */
+    previewName: "branch" | "pr";
+    /** Which Supabase API keys to hand a Preview when a project has both kinds. */
+    apiKeys: "legacy" | "new";
+    /** `swp pr` keeps one status comment on the PR. Default true. */
+    prComment?: boolean;
+    /** `swp pr` records a GitHub deployment for the PR head. Default true. */
+    githubDeployments?: boolean;
+    /** GitHub environment of those deployments, shared by every PR; `{branch}` makes one per branch. Default "Preview". */
+    deploymentEnvironment?: string;
+};
+export type WranglerConfig = {
+    file: string;
+    json: Record<string, unknown>;
+    name?: string;
+};
+export declare const CONFIG_DEFAULTS: {
+    trunk: string;
+    sharedBranch: string;
+    supabaseDir: string;
+    isolatedLabel: string;
+    checkPath: string;
+    previewName: "branch";
+    apiKeys: "legacy";
+};
+export declare function readWranglerConfig(cwd?: string): WranglerConfig | null;
+export declare function loadConfig(overrides?: Partial<Config>, cwd?: string): Config;
+export declare function migrationsDir(config: Pick<Config, "supabaseDir">): string;
+export declare function migrationFiles(config: Pick<Config, "supabaseDir">, cwd?: string): string[];
+export declare function defined<T extends object>(o: T): Partial<T>;

package/dist/config.js

@@ -0,0 +1,105 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse as parseToml } from "smol-toml";
+import { parseJsonc } from "./jsonc.js";
+import { didYouMean } from "./suggest.js";
+export const CONFIG_FILE = "swp.config.json";
+export const WRANGLER_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
+/** What `swp init` writes when it cannot find the project ref. */
+export const PLACEHOLDER_REF = "<production project ref>";
+export const CONFIG_DEFAULTS = {
+    trunk: "main",
+    sharedBranch: "preview",
+    supabaseDir: "supabase",
+    isolatedLabel: "isolated-db",
+    checkPath: "/",
+    previewName: "branch",
+    apiKeys: "legacy",
+};
+const CHOICES = { previewName: ["branch", "pr"], apiKeys: ["legacy", "new"] };
+const KEYS = [
+    "$schema",
+    "worker",
+    "supabaseProjectRef",
+    "trunk",
+    "sharedBranch",
+    "workersSubdomain",
+    "supabaseDir",
+    "isolatedLabel",
+    "checkPath",
+    "previewName",
+    "apiKeys",
+    "prComment",
+    "githubDeployments",
+    "deploymentEnvironment",
+];
+export function readWranglerConfig(cwd = process.cwd()) {
+    const file = WRANGLER_FILES.find((f) => existsSync(join(cwd, f)));
+    if (!file)
+        return null;
+    const text = readFileSync(join(cwd, file), "utf8");
+    let json;
+    try {
+        json = (file.endsWith(".toml") ? parseToml(text) : parseJsonc(text));
+    }
+    catch (err) {
+        throw new Error(`Cannot parse ${file}: ${err.message}`, { cause: err });
+    }
+    return { file, json, name: typeof json.name === "string" ? json.name : undefined };
+}
+export function loadConfig(overrides = {}, cwd = process.cwd()) {
+    const path = join(cwd, CONFIG_FILE);
+    const exists = existsSync(path);
+    const file = exists ? readConfigFile(path) : {};
+    const wrangler = readWranglerConfig(cwd);
+    const merged = { ...CONFIG_DEFAULTS, worker: wrangler?.name, ...file, ...defined(overrides) };
+    if (!merged.supabaseProjectRef)
+        throw new Error(exists
+            ? `Set "supabaseProjectRef" (the production project) in ${CONFIG_FILE}`
+            : `No ${CONFIG_FILE} in this directory. Run \`swp init\` first, or pass --project-ref <ref>.`);
+    if (merged.supabaseProjectRef === PLACEHOLDER_REF)
+        throw new Error(`"supabaseProjectRef" in ${CONFIG_FILE} is still ${PLACEHOLDER_REF}. ` +
+            "Set it to the production project's ref, the <ref> in https://<ref>.supabase.co.");
+    if (!merged.worker)
+        throw new Error(wrangler
+            ? `${wrangler.file} has no "name"; add the Worker's name there or "worker" in ${CONFIG_FILE}`
+            : `No ${WRANGLER_FILES.join(", ")} in this directory. Run swp in the Worker's directory, or set "worker" in ${CONFIG_FILE}.`);
+    for (const [key, allowed] of Object.entries(CHOICES)) {
+        const value = merged[key];
+        if (!allowed.includes(value))
+            throw new Error(`"${key}" in ${CONFIG_FILE} must be ${allowed.map((a) => `"${a}"`).join(" or ")}`);
+    }
+    return merged;
+}
+function readConfigFile(path) {
+    let json;
+    try {
+        json = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (err) {
+        throw new Error(`Cannot parse ${CONFIG_FILE}: ${err.message}`, { cause: err });
+    }
+    if (!json || typeof json !== "object" || Array.isArray(json))
+        throw new Error(`${CONFIG_FILE} must hold a JSON object`);
+    for (const key of Object.keys(json)) {
+        if (KEYS.includes(key))
+            continue;
+        const guess = didYouMean(key, KEYS);
+        throw new Error(`Unknown key "${key}" in ${CONFIG_FILE}.${guess ? ` Did you mean "${guess}"?` : ""} See the README for the keys.`);
+    }
+    return json;
+}
+export function migrationsDir(config) {
+    return join(config.supabaseDir, "migrations");
+}
+export function migrationFiles(config, cwd = process.cwd()) {
+    const dir = join(cwd, migrationsDir(config));
+    return existsSync(dir)
+        ? readdirSync(dir)
+            .filter((f) => f.endsWith(".sql"))
+            .sort()
+        : [];
+}
+export function defined(o) {
+    return Object.fromEntries(Object.entries(o).filter(([, v]) => v !== undefined));
+}

package/dist/feedback.d.ts

@@ -0,0 +1,64 @@
+import { type Deps } from "./commands/branches.js";
+import type { PullRequestEvent } from "./commands/pr.js";
+import { GitHubApi } from "./github.js";
+export declare const COMMENT_MARKER = "<!-- supabase-worker-previews -->";
+export type Database = {
+    kind: "shared" | "own";
+    name: string;
+    ref?: string;
+};
+export type CommentState = {
+    phase: "checking" | "passed" | "failed" | "removed" | "cleanup-failed";
+    worker: string;
+    sha: string;
+    commitUrl: string;
+    dashboardUrl: string;
+    updated: Date;
+    previewUrl?: string;
+    database?: Database;
+    error?: string;
+    runUrl?: string;
+};
+export declare function renderComment(s: CommentState): string;
+/** `::warning::` lines end at a newline, so GitHub's escapes keep a multi-line message whole. */
+export declare function warning(message: string): string;
+export type FeedbackDeps = Deps & {
+    githubToken: string;
+    github?: GitHubApi;
+    env?: Record<string, string | undefined>;
+    clock?: () => Date;
+};
+/**
+ * The PR comment and GitHub deployment for one `swp pr` run. Any GitHub API
+ * failure becomes a warning; only the wrapped database work decides the job.
+ */
+export declare class Feedback {
+    private event;
+    private deps;
+    private github;
+    private commentOn;
+    private deploymentsOn;
+    private commentId?;
+    private branch;
+    private sha;
+    private environment;
+    private server;
+    private runUrl?;
+    constructor(event: PullRequestEvent, deps: FeedbackDeps);
+    /** Reports on `work` (up and check) from start to finish, and rethrows its error. */
+    run(isolated: boolean, work: () => Promise<void>): Promise<void>;
+    /** Reports on `work` (down) when the PR closes. */
+    /** `isolated`: the PR had its own database, which Supabase's integration may already have deleted. */
+    close(work: () => Promise<void>, isolated?: boolean): Promise<void>;
+    private database;
+    private previewUrl;
+    private comment;
+    private startDeployment;
+    private deploymentStatus;
+    /**
+     * Transient deployments are never marked inactive automatically, so this PR's
+     * older ones are retired here. Other PRs share the environment.
+     */
+    private deactivateDeployments;
+    private safe;
+}