supabase-worker-previews 0.0.0 → 0.1.1

package/dist/runtime.js

@@ -0,0 +1,121 @@
+/**
+ * Worker-side half: one build serves any Supabase database. The Worker reads
+ * its Supabase values at request time (from wrangler vars, or a Preview's
+ * SUPABASE_OVERRIDE secret) and hands the public ones to the browser, so a
+ * Preview never needs its own build.
+ */
+export const OVERRIDE_SECRET = "SUPABASE_OVERRIDE";
+export const DEFAULT_GLOBAL = "__SUPABASE_PUBLIC__";
+export const IDENTITY_PATH = "/.well-known/supabase-preview";
+export const SUPABASE_VARS = [
+    "SUPABASE_URL",
+    "SUPABASE_PUBLISHABLE_KEY",
+    "SUPABASE_SERVICE_ROLE_KEY",
+    "SUPABASE_PROJECT_REF",
+];
+/**
+ * The override replaces all four values. It is one secret, not four, because a
+ * Worker var and secret must never share a name.
+ */
+export function parseOverride(raw) {
+    if (typeof raw !== "string" || !raw)
+        return null;
+    const values = JSON.parse(raw);
+    for (const name of SUPABASE_VARS) {
+        if (typeof values[name] !== "string" || !values[name])
+            throw new Error(`${OVERRIDE_SECRET} is missing ${name}`);
+    }
+    return values;
+}
+/**
+ * `env` with any SUPABASE_OVERRIDE applied. Also patches `process.env` when
+ * nodejs_compat provides it, for code that reads Supabase settings from there.
+ */
+export function resolveEnv(env) {
+    const override = parseOverride(env[OVERRIDE_SECRET]);
+    if (!override)
+        return env;
+    const proc = globalThis.process;
+    if (proc?.env)
+        Object.assign(proc.env, override);
+    return new Proxy(env, {
+        get: (target, key, receiver) => typeof key === "string" && key in override
+            ? override[key]
+            : Reflect.get(target, key, receiver),
+    });
+}
+export function publicConfigFromEnv(env) {
+    const { SUPABASE_URL: supabaseUrl, SUPABASE_PUBLISHABLE_KEY: supabaseKey } = env;
+    return typeof supabaseUrl === "string" && typeof supabaseKey === "string" && supabaseUrl && supabaseKey
+        ? { supabaseUrl, supabaseKey }
+        : null;
+}
+export function publicConfigScript(config, globalName = DEFAULT_GLOBAL) {
+    const json = JSON.stringify(config).replace(/</g, "\\u003c");
+    return `<script>window.${globalName}=${json}</script>`;
+}
+/** Browser side: the values the Worker injected, or null under a dev server that did not. */
+export function readPublicConfig(globalName = DEFAULT_GLOBAL, scope = globalThis) {
+    const value = scope[globalName];
+    return value?.supabaseUrl && value.supabaseKey
+        ? { supabaseUrl: value.supabaseUrl, supabaseKey: value.supabaseKey }
+        : null;
+}
+/** `https://<ref>.supabase.co` gives `<ref>`; a custom API domain gives null. */
+export function projectRefOf(url) {
+    return url?.match(/^https:\/\/([a-z0-9]+)\.supabase\.co\/?$/)?.[1] ?? null;
+}
+export async function injectIntoHtml(response, html) {
+    if (!(response.headers.get("content-type") ?? "").includes("text/html"))
+        return response;
+    const Rewriter = globalThis.HTMLRewriter;
+    if (Rewriter) {
+        return new Rewriter()
+            .on("head", { element: (el) => el.prepend(html, { html: true }) })
+            .transform(response);
+    }
+    const body = (await response.text()).replace(/<head(\s[^>]*)?>/i, (head) => head + html);
+    const headers = new Headers(response.headers);
+    headers.delete("content-length");
+    return new Response(body, { status: response.status, statusText: response.statusText, headers });
+}
+export function identityResponse(env) {
+    const url = env.SUPABASE_URL;
+    const ref = env.SUPABASE_PROJECT_REF ?? projectRefOf(url);
+    return Response.json({ projectRef: ref ?? null, supabaseUrl: url ?? null }, { headers: { "cache-control": "no-store" } });
+}
+/**
+ * Frameworks that call the entry without `env` (TanStack Start on nitro calls
+ * `fetch(request)`) still expose vars and secrets on process.env under nodejs_compat.
+ */
+function envOrProcessEnv(env) {
+    if (env && typeof env === "object")
+        return env;
+    return (globalThis.process?.env ?? {});
+}
+/**
+ * Wraps a Worker's default export. Every handler sees the override applied;
+ * `fetch` also injects the public config and answers the identity route that
+ * `swp check` reads.
+ */
+export function withSupabasePreviews(handler, options = {}) {
+    const { globalName = DEFAULT_GLOBAL, inject = true, identity = true } = options;
+    const wrapped = { ...handler };
+    for (const [name, fn] of Object.entries(handler)) {
+        if (typeof fn !== "function" || name === "fetch")
+            continue;
+        wrapped[name] = (event, env, ctx) => fn.call(handler, event, resolveEnv(envOrProcessEnv(env)), ctx);
+    }
+    if (handler.fetch) {
+        const fetchFn = handler.fetch;
+        wrapped.fetch = async (request, rawEnv, ctx) => {
+            const env = resolveEnv(envOrProcessEnv(rawEnv));
+            if (identity && new URL(request.url).pathname === IDENTITY_PATH)
+                return identityResponse(env);
+            const response = await fetchFn.call(handler, request, env, ctx);
+            const config = inject ? publicConfigFromEnv(env) : null;
+            return config ? injectIntoHtml(response, publicConfigScript(config, globalName)) : response;
+        };
+    }
+    return wrapped;
+}

package/dist/style.d.ts

@@ -0,0 +1,8 @@
+export type Style = Record<"bold" | "dim" | "red" | "yellow" | "green" | "cyan", (text: string) => string>;
+/** Color only on a terminal, and never when NO_COLOR is set (https://no-color.org). */
+export declare function colorEnabled(stream?: {
+    isTTY?: boolean;
+}, env?: Record<string, string | undefined>): boolean;
+export declare function makeStyle(enabled: boolean): Style;
+export declare const out: Style;
+export declare const err: Style;

package/dist/style.js

@@ -0,0 +1,21 @@
+const CODES = {
+    bold: [1, 22],
+    dim: [2, 22],
+    red: [31, 39],
+    yellow: [33, 39],
+    green: [32, 39],
+    cyan: [36, 39],
+};
+/** Color only on a terminal, and never when NO_COLOR is set (https://no-color.org). */
+export function colorEnabled(stream = process.stdout, env = process.env) {
+    return !!stream.isTTY && !env.NO_COLOR && env.TERM !== "dumb";
+}
+export function makeStyle(enabled) {
+    const entries = Object.entries(CODES).map(([name, [open, close]]) => [
+        name,
+        (text) => (enabled ? `\x1b[${open}m${text}\x1b[${close}m` : text),
+    ]);
+    return Object.fromEntries(entries);
+}
+export const out = makeStyle(colorEnabled(process.stdout));
+export const err = makeStyle(colorEnabled(process.stderr));

package/dist/suggest.d.ts

@@ -0,0 +1,2 @@
+/** The candidate closest to `input` by edit distance, if it is close enough to be a typo. */
+export declare function didYouMean(input: string, candidates: string[]): string | undefined;

package/dist/suggest.js

@@ -0,0 +1,22 @@
+/** The candidate closest to `input` by edit distance, if it is close enough to be a typo. */
+export function didYouMean(input, candidates) {
+    let best;
+    let bestDistance = Infinity;
+    for (const c of candidates) {
+        const [a, b] = [input.toLowerCase(), c.toLowerCase()];
+        const d = b.startsWith(a) && a.length >= 2 ? 0 : distance(a, b);
+        if (d < bestDistance)
+            [best, bestDistance] = [c, d];
+    }
+    return bestDistance <= Math.max(1, Math.floor((best?.length ?? 0) / 3)) ? best : undefined;
+}
+function distance(a, b) {
+    let prev = Array.from({ length: b.length + 1 }, (_, j) => j);
+    for (let i = 1; i <= a.length; i++) {
+        const row = [i];
+        for (let j = 1; j <= b.length; j++)
+            row[j] = Math.min(prev[j] + 1, row[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+        prev = row;
+    }
+    return prev[b.length];
+}

package/dist/supabase.d.ts

@@ -0,0 +1,78 @@
+export type Branch = {
+    id: string;
+    name: string;
+    project_ref: string;
+    parent_project_ref?: string;
+    is_default?: boolean;
+    git_branch?: string | null;
+    persistent?: boolean;
+    status: string;
+};
+export type BranchDetail = {
+    ref: string;
+    status: string;
+};
+export type ProjectKeys = {
+    publishable: string;
+    secret: string;
+};
+export type KeyKind = "legacy" | "new";
+export type ApiKey = {
+    name: string;
+    type?: "legacy" | "publishable" | "secret" | null;
+    api_key?: string | null;
+};
+export type ActionRun = {
+    id: string;
+    git_config?: {
+        owner?: string;
+        repo?: string;
+        ref?: string;
+    } | null;
+    created_at: string;
+};
+export declare class SupabaseApiError extends Error {
+    readonly method: string;
+    readonly path: string;
+    readonly status: number;
+    readonly body: string;
+    constructor(method: string, path: string, status: number, body: string);
+}
+export declare class SupabaseApi {
+    private token;
+    private fetchImpl;
+    constructor(token: string, fetchImpl?: typeof fetch);
+    private call;
+    getProject(ref: string): Promise<{
+        id: string;
+        name: string;
+        status: string;
+    }>;
+    listBranches(ref: string): Promise<Branch[]>;
+    createBranch(ref: string, args: {
+        name: string;
+        gitBranch?: string;
+        persistent?: boolean;
+    }): Promise<Branch>;
+    /** 404s for a few seconds after the branch is created. */
+    getBranch(branchRef: string): Promise<BranchDetail>;
+    updateBranch(branchRef: string, args: {
+        gitBranch?: string;
+        persistent?: boolean;
+    }): Promise<Branch>;
+    deleteBranch(branchRef: string): Promise<unknown>;
+    query<T>(ref: string, sql: string): Promise<T[]>;
+    /** The preferred kind of key pair when the project has it (and legacy keys are enabled), else the other. */
+    keys(ref: string, prefer?: KeyKind): Promise<ProjectKeys>;
+    private legacyKeysEnabled;
+    /** Newest first. Runs the GitHub integration made carry `git_config`. */
+    actionRuns(branchRef: string): Promise<ActionRun[]>;
+    getAuthConfig(ref: string): Promise<{
+        site_url?: string;
+        uri_allow_list?: string;
+    }>;
+    /** Sets the site URL and adds redirect URLs, keeping the ones already allowed. */
+    allowRedirects(ref: string, siteUrl: string, redirects: string[]): Promise<void>;
+}
+export declare function explainCreateBranchError(ref: string, name: string, err: SupabaseApiError): string;
+export declare function projectUrl(ref: string): string;

package/dist/supabase.js

@@ -0,0 +1,168 @@
+import { apiErrorMessage } from "./http.js";
+const API = "https://api.supabase.com/v1";
+export class SupabaseApiError extends Error {
+    method;
+    path;
+    status;
+    body;
+    constructor(method, path, status, body) {
+        super(apiErrorMessage(`Supabase API ${method} ${path}`, status, body, "SUPABASE_ACCESS_TOKEN"));
+        this.method = method;
+        this.path = path;
+        this.status = status;
+        this.body = body;
+    }
+}
+export class SupabaseApi {
+    token;
+    fetchImpl;
+    constructor(token, fetchImpl = fetch) {
+        this.token = token;
+        this.fetchImpl = fetchImpl;
+    }
+    async call(method, path, body) {
+        const res = await this.fetchImpl(`${API}${path}`, {
+            method,
+            headers: { authorization: `Bearer ${this.token}`, "content-type": "application/json" },
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        if (!res.ok)
+            throw new SupabaseApiError(method, path, res.status, await res.text());
+        const text = await res.text();
+        return (text ? JSON.parse(text) : undefined);
+    }
+    getProject(ref) {
+        return this.call("GET", `/projects/${ref}`);
+    }
+    async listBranches(ref) {
+        return (await this.call("GET", `/projects/${ref}/branches`)) ?? [];
+    }
+    async createBranch(ref, args) {
+        try {
+            return await this.call("POST", `/projects/${ref}/branches`, {
+                branch_name: args.name,
+                ...(args.gitBranch ? { git_branch: args.gitBranch } : {}),
+                persistent: args.persistent ?? false,
+            });
+        }
+        catch (err) {
+            throw err instanceof SupabaseApiError ? new Error(explainCreateBranchError(ref, args.name, err)) : err;
+        }
+    }
+    /** 404s for a few seconds after the branch is created. */
+    getBranch(branchRef) {
+        return this.call("GET", `/branches/${branchRef}`);
+    }
+    updateBranch(branchRef, args) {
+        return this.call("PATCH", `/branches/${branchRef}`, {
+            ...(args.gitBranch ? { git_branch: args.gitBranch } : {}),
+            ...(args.persistent !== undefined ? { persistent: args.persistent } : {}),
+        });
+    }
+    deleteBranch(branchRef) {
+        return this.call("DELETE", `/branches/${branchRef}`);
+    }
+    query(ref, sql) {
+        return this.call("POST", `/projects/${ref}/database/query`, { query: sql });
+    }
+    /** The preferred kind of key pair when the project has it (and legacy keys are enabled), else the other. */
+    async keys(ref, prefer = "legacy") {
+        const keys = await this.call("GET", `/projects/${ref}/api-keys?reveal=true`);
+        const pairs = { legacy: legacyPair(keys), new: newPair(keys) };
+        if (pairs.legacy && !(await this.legacyKeysEnabled(ref)))
+            pairs.legacy = null;
+        const pair = pairs[prefer] ?? pairs[prefer === "legacy" ? "new" : "legacy"];
+        if (!pair) {
+            const masked = keys.some((k) => k.api_key && !revealed(k.api_key));
+            throw new Error(masked
+                ? `Project ${ref}: the access token cannot reveal secret API keys; use a token with the project's secrets permission`
+                : `Project ${ref} has no publishable and secret API key pair`);
+        }
+        return pair;
+    }
+    async legacyKeysEnabled(ref) {
+        const status = await this.call("GET", `/projects/${ref}/api-keys/legacy`).catch(() => null);
+        return status?.enabled !== false;
+    }
+    /** Newest first. Runs the GitHub integration made carry `git_config`. */
+    async actionRuns(branchRef) {
+        return (await this.call("GET", `/projects/${branchRef}/actions`)) ?? [];
+    }
+    getAuthConfig(ref) {
+        return this.call("GET", `/projects/${ref}/config/auth`);
+    }
+    /** Sets the site URL and adds redirect URLs, keeping the ones already allowed. */
+    async allowRedirects(ref, siteUrl, redirects) {
+        const current = (await this.getAuthConfig(ref)).uri_allow_list ?? "";
+        const list = [
+            ...new Set([
+                ...current
+                    .split(",")
+                    .map((s) => s.trim())
+                    .filter(Boolean),
+                ...redirects,
+            ]),
+        ];
+        await this.call("PATCH", `/projects/${ref}/config/auth`, {
+            site_url: siteUrl,
+            uri_allow_list: list.join(","),
+        });
+    }
+}
+/** Without `reveal`, or without permission to reveal, secret keys come back with `·` in place of characters. */
+function revealed(key) {
+    return !key.includes("·");
+}
+function legacyPair(keys) {
+    const find = (name) => keys.find((k) => k.name === name && (k.type ?? "legacy") === "legacy" && k.api_key && revealed(k.api_key))
+        ?.api_key;
+    const publishable = find("anon");
+    const secret = find("service_role");
+    return publishable && secret ? { publishable, secret } : null;
+}
+function newPair(keys) {
+    const find = (type) => {
+        const usable = keys.filter((k) => k.type === type && k.api_key && revealed(k.api_key));
+        return (usable.find((k) => k.name === "default") ?? usable[0])?.api_key;
+    };
+    const publishable = find("publishable");
+    const secret = find("secret");
+    return publishable && secret ? { publishable, secret } : null;
+}
+/** The plan-gate envelope: `{"error":{"code":"entitlement_required","feature":"branching_limit","upgrade_url":...}}`. */
+function planGate(body) {
+    try {
+        const error = JSON.parse(body)
+            .error;
+        return error?.code === "entitlement_required" ? error : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function explainCreateBranchError(ref, name, err) {
+    const gate = planGate(err.body);
+    const upgrade = gate?.upgrade_url ? ` (${gate.upgrade_url})` : "";
+    let advice;
+    if (gate?.feature === "branching_persistent")
+        advice = `The organization's plan does not allow persistent branches${upgrade}.`;
+    else if (gate?.feature === "branching_limit" ||
+        /branch(es|ing)?[ _]limit|(maximum|max|too many)[\w ]* branches/i.test(err.body))
+        advice = `Project ${ref} has reached its branch limit. Delete branches you no longer need (\`swp prune\` lists leftovers) or raise the limit${upgrade}.`;
+    else if (gate)
+        advice = `The organization's plan does not include ${gate.feature ?? "this feature"}${upgrade}.`;
+    else if (err.status === 401)
+        advice = "The Supabase access token is invalid or expired.";
+    else if (err.status === 403)
+        advice = `The Supabase access token cannot create branches on ${ref}; use an organization-scoped token with access to it.`;
+    else if (err.status === 409 || /already exists/i.test(err.body))
+        advice = `A Supabase branch named "${name}" already exists on ${ref}.`;
+    else if (err.status === 429)
+        advice = "The Supabase API is rate limiting this token; run again in a minute.";
+    return advice
+        ? `Cannot create Supabase branch "${name}": ${advice} Supabase said: ${err.status} ${err.body}`
+        : err.message;
+}
+export function projectUrl(ref) {
+    return `https://${ref}.supabase.co`;
+}

package/dist/usage.d.ts

@@ -0,0 +1,46 @@
+import { type Style } from "./style.js";
+type Flag = {
+    name: string;
+    value?: string;
+    help: string;
+};
+export type CommandName = "init" | "doctor" | "shared" | "up" | "check" | "down" | "pr" | "prune";
+type Command = {
+    name: CommandName;
+    group: "Set up" | "Per branch" | "In CI";
+    args: string;
+    summary: string;
+    details: string;
+    flags: Flag[];
+    env: string[];
+    /** The variables `--dry-run` still needs, because the dry run reads live state. */
+    dryRunEnv: string[];
+    examples: string[];
+};
+export declare const COMMANDS: Command[];
+export declare const BOOLEAN_FLAGS: ReadonlySet<string>;
+export declare function command(name: string): Command | undefined;
+export declare function version(): string;
+export declare function mainHelp(s?: Style): string;
+export declare function commandHelp(c: Command, s?: Style): string;
+export type Invocation = {
+    kind: "help";
+    text: string;
+    code: 0 | 2;
+} | {
+    kind: "version";
+} | {
+    kind: "error";
+    message: string;
+} | {
+    kind: "run";
+    command: CommandName;
+    flags: Record<string, string | true>;
+};
+/** What the arguments ask for, or a usage error that says how to fix them. */
+export declare function resolveInvocation(argv: string[], s?: Style): Invocation;
+/** Names every variable the command needs and lacks, with where to get each; undefined when none is missing. */
+export declare function missingEnvMessage(name: CommandName, dryRun: boolean, env?: Record<string, string | undefined>): string | undefined;
+/** One line for the user: the message, and for a network failure the host and the system error. */
+export declare function formatError(err: unknown, debug?: boolean): string;
+export {};