[thedogwiththedataonit]

11-01 status (current). Head 1baeb78 (11-01 (c): restacked on #61 52f18fc, plus Greptile fixes on e65b7d6). Spec: openapi/public-api-v1.yaml is the brew-v2 #2169 head 6e4accea4c byte for byte (sha256 b86fb228250266ea57637a3d5c1e722e05e289a9d59b0c9b349bcc1243178bd3), the same file at the final #2169 head aedf27704d (later commits: a main merge and docs only; no spec change), vendored by #54: main's spec (brew-v2 373e900a9a, unchanged on main since) plus the DX delta; types regenerated. The 6e4accea4c delta over 02a3946b18 is description text only (the AppEmailPutRequest.publish field, PUT /v1/app-emails/{triggerKey}, POST /v1/app-emails/kit and PUT /v1/integrations/{provider}/connection): an app email unpublished in Brew turns back on when it is published in Brew or when its setup is repeated with the same starter or source plus publish: true; publish: true alone rebuilds a starter-kit key from its starter and is 400 INVALID_REQUEST on any other key. Version 0.23.0 (not released). Local checks on this head: tsc, lint, test 101 files / 1567 tests, docs:commands:check, generate:skills:check, sync:launchers:check; SDK from the local typescript-sdk#74 build (build, bin, signal and regression smokes and smoke:launchers last run on 854f4f8). 854f4f8 fixes Greptile's earlier P1 (a brew.json save that fails puts the earlier hook secret back in .env.local) and P2 (provider setup reads every app email page until the keys it needs are found). Greptile's P2 on e65b7d6 is fixed in c72830b (the --app-url brand lookup reads every page until a match or the list's end, a repeated cursor ending it, so a matching brand past the first 1,000 is found instead of re-created into BRAND_DOMAIN_CONFLICT). Its follow-ups are fixed in ba40e0d and 1baeb78: .env.local's app key holds the domain, kit and provider setup unless it is on this run's server and bound to the brand the run sets up, whether --app-url switches brands or the run's key already has the app's brand (a staging copy with the same brand ids no longer passes). Each fix has a test that failed first. Greptile on 1baeb78: 5/5, no open threads. Older notes below that name 6f8ef50544, 5084a5202f, b884e78157 or 02a3946b18 as the spec, or other version numbers, are history.

11-01 Greptile fixes: 94159d9: a printed Supabase re-run (rerun-supabase-connect, configure-supabase-hook) keeps the project --supabase-project picked, so it never detects and changes another project's hook. 956fbcb: with an organization key, a failed brand list is no longer read as a website mismatch on the key's brand; the brand step fails (exit 1) and the domain, kit and provider steps wait. This CLI needs SDK 13.7.0 (^13.7.0); generated app code still asks for ^13.6.0.

Merge/publish order (nothing here is merged, published or tagged):

1. brew-v2 #2169 merged and deployed, and the live spec (https://brew.new/openapi/public-api-v1.yaml) matches the vendored file.
2. typescript-sdk publishes in order: init + the brew.new / create-brew launchers (C4, 0.21.0) #55 as 13.5.0, Release CLI 0.17.0 with registry SDK 13 #64 as 13.6.0, Spec drift: live API differs from the vendored spec #74 as 13.7.0 (each retargets to main once the one below merges).
3. brew-cli bumps the SDK: bun add @brew.new/sdk@^13.6.0 for 0.20.0 to 0.22.0 (send by key, app-emails, trigger keys (C2, 0.20.0) #54, init + the brew.new / create-brew launchers (C4, 0.21.0) #55, migrate resend (C5, 0.22.0): move a Resend account and codebase to Brew #61; Project foundations + mcp install (C1) #44 and Login through the browser (session flow) (C3) #53 ship inside 0.20.0) and ^13.7.0 for 0.23.0 (feat(init): Supabase/Clerk provider switch, integrations connect, brand from --app-url, doctor --project (C6, 0.23.0) #63), each regenerating bun.lock from the registry, then a frozen install and the full checks.
4. brew-cli publishes 0.20.0, 0.21.0, 0.22.0 and 0.23.0, in that order.

Renumbered 10-31: main published 0.19.0 (--input refuses unknown keys, SDK ^13.3.0) and SDK main published 13.4.0 (email lang), so this chain moves up one again: #54 0.20.0, #55 0.21.0, #61 0.22.0, #63 0.23.0. The SDK DX releases stay send-by-key 13.5.0, adapters/appEmails 13.6.0 (SDK_RANGE ^13.6.0), integrations.connect 13.7.0. Rebased on main 1f12ba4; the vendored spec was then the brew-v2 #2169 @ 6f8ef50544 DX delta merged structurally into main's spec (brew-v2 373e900a9a). This PR is 0.23.0; older numbers below are pre-rebase.

Update 2026-10-25: restacked on #61. Conflicts: CHANGELOG.md, generated docs. The hosted auth hook SDK gate is 13.7.0 (after 13.6.0); generated app code asks for ^13.6.0; doctor --project tests use ^13.3.0 as the too-old range. Checks against a local SDK build of typescript-sdk#74 merged with SDK main: tsc, lint, test 1135, generated types fresh, docs:commands:check, generate:skills:check, sync:launchers:check, build, bin smoke, launcher pack smoke, signal smoke ✓.

Renumbered 10-25: main published 0.18.0 (--lang/--clear-lang, contact imports, SDK ^13.3.0), and SDK main published 13.1.0, 13.2.0 and 13.3.0 without the DX features (13.4.0 is reserved for its pending email lang release). So this chain moves up one: #54 0.19.0, #55 0.20.0, #61 0.21.0, #63 0.22.0, and the DX SDK releases are send-by-key 13.5.0, adapters/appEmails 13.6.0 (SDK_RANGE ^13.6.0, so installs can no longer resolve to the published 13.3.0), integrations.connect 13.7.0. This PR is 0.22.0; older numbers below are pre-rebase.

Spec sync 2026-10-21: restacked on #61; the #2068/#2146 spec commit folded into #54's vendored brew-v2 #2169 @ 6f8ef50544 spec, and integrations connect|connection empty the parity pending list. Adapted to #2169's idempotent PUT /v1/integrations/{provider}/connection (README, skill, CHANGELOG: a re-run keeps connectionId and webhookUrl, replaces the secret in place, finishes failed auth emails); init --domain with DKIM_SELECTOR_IN_USE offers neither the DNS records step nor Connect automatically. RELEASING: brew-v2 #2169 deployed. Checks: tsc, lint, test 1102, generated types fresh, docs/skills/launchers freshness, build, launcher + signal smokes ✓.

Renumbered 10-21: main published 0.17.0 (canvas commands, SDK ^13.0.0), so this chain moved up one: #54 0.18.0, #55 0.19.0, #61 0.20.0, #63 0.21.0. This PR is 0.21.0; older numbers below are pre-rebase.

Stacked on #61 (head d3eef9f; restacked 11-01); needs brew-v2 #2169 deployed and SDK 13.7.0, after #61's gate.

Chain: #44 → #53 → #54 → #55 (init) → #61 (migrate resend) → this PR (C6, 0.23.0). Base: claude/migrate-resend.

Summary

The CLI pieces init was still missing (plan C4 "provider config", brand from --app-url, the domain link, doctor --project, integrations connect).

• integrations connect <supabase_auth|clerk> binds the SDK's integrations.connect (typescript-sdk#74, 13.7.0, not released). Destructive class. The signing secret comes from --signing-secret-env <VAR> or --signing-secret-stdin, never from argv. It is never echoed, including when it is pasted where the variable name goes. Prints {connectionId, webhookUrl, status, authEmails}. integrations connection <provider> binds integrations.getConnection.

• init --configure-supabase (needs SUPABASE_ACCESS_TOKEN locally; the token goes to api.supabase.com only):

  1. saves the current Send Email hook settings to brew.json#providerConfig before changing anything (a previous hook secret goes to .env.local, never brew.json);
  2. connects Brew with a freshly generated v1,whsec_ secret;
  3. PATCHes /v1/projects/{ref}/config/auth with hook_send_email_enabled, hook_send_email_uri and hook_send_email_secrets.

  --dry-run --json shows the exact PATCH with the secret replaced. A re-run makes no change.

• init --configure-clerk (needs CLERK_SECRET_KEY in the shell or .env.local) runs only once integrations connection clerk is active. It then turns off delivery through POST /templates/email/{slug}/toggle_delivery for exactly the CLERK_EMAIL_SLUG_ROUTES slugs whose key has a published app email. Before the connection is active it refuses and makes no Clerk call. A bare --yes never touches Clerk or Supabase.

• init --rollback-provider restores what either flag changed, using what brew.json saved.

• Without those flags, init prints the manual dashboard steps. The self-hosted Edge Function and its local config.toml patch become the optional alternative.

• --app-url: with an organization key, init reuses the brand whose website matches, or creates one through POST /v1/brands (idempotent) and waits for it to be ready. A 403 (ORG_SCOPE_REQUIRED) gets a clear next step. A key bound to one brand is never moved; a mismatch is only reported.

• --domain: also returns the domain's page in Brew (domain.connectUrl). The report says plainly that Connect automatically (Entri) runs in the app, because v1 has no API for it, and that the sandbox applies until the domain verifies.

• doctor --project [--json] checks:

  • managed file hashes;
  • BREW_API_KEY is present, git-ignored, and never under NEXT_PUBLIC_, VITE_, PUBLIC_ or EXPO_PUBLIC_;
  • the SDK is declared and installed at a version that satisfies SDK_RANGE (^13.6.0);
  • the key's brand, and every brew.json key exists and is published (GET /v1/app-emails);
  • the domain status and the hook connection status.

  Exit codes: 0, 1 if any check fails, 2 if there is no brew.json.

• Spec: the final brew-v2 #2169 head 6e4accea4c whole, from send by key, app-emails, trigger keys (C2, 0.20.0) #54 (sha256 b86fb228250266ea57637a3d5c1e722e05e289a9d59b0c9b349bcc1243178bd3). History (superseded 10-21 by brew-v2 #2169 @ 6f8ef50544): migrate resend (C5, 0.22.0): move a Resend account and codebase to Brew #61's spec (brew-v2 #2145 b2912ad9f7: #2066 0fed90fbf3 merged with #2064 9f97aea3f8, plus #2145's source modes) plus exactly the deltas from #2068 (12a02af5e3 over 0fed90fbf3) and #2146 (c3da555e60 over 12a02af5e3). Re-checked on the restack: byte-identical to a three-way merge of #2145's and #2146's files over #2066's. Types are regenerated.

• The init report stays schema v1 with additive fields: providers[], a provider step, brand.domain / matchesAppUrl / created, and domain.connectUrl.

• vendorFetch now also redacts secrets carried in the request body. The init test helpers move to tests/helpers/init-api.ts, which keeps the test files from growing past 1,000 lines.

External APIs (verified against the official references; cited in code comments):

• Supabase Management API: GET|PATCH https://api.supabase.com/v1/projects/{ref}/config/auth (https://supabase.com/docs/reference/api/v1-update-auth-service-config, https://supabase.com/docs/reference/api/v1-get-auth-service-config, spec https://api.supabase.com/api/v1-json). The secret format follows https://supabase.com/docs/guides/auth/auth-hooks/send-email-hook.
• Clerk Backend API: GET /v1/templates/email/{slug} and POST /v1/templates/email/{slug}/toggle_delivery with {delivered_by_clerk} (https://clerk.com/docs/reference/backend-api, spec https://github.com/clerk/openapi-specs/blob/main/bapi/2026-08-20.yml). Clerk's spec marks both endpoints deprecated (in favour of the dashboard), but they are still served. On a 402 or 423 the CLI points the person to the dashboard.

SDK and publish gate

This uses the SDK methods, not raw HTTP. Local validation ran against the typescript-sdk#74 build (b4508d8, on #64 3c3827f). package.json keeps main's published SDK range, so CI typecheck and parity stay red until SDK 13.7.0 is on npm. RELEASING.md has a gate for this: publish SDK 13.7.0, run bun add @brew.new/sdk@^13.7.0, then a frozen install and the full checks. brew-v2 #2169 must also be deployed first, and the live openapi.yaml compared with the bundled one. The restack kept both RELEASING.md sections (#61's API gate, then this one). Generated app code still asks for ^13.6.0.

Test plan

• bun run tsc, bun run lint
• bun run test: 100 files, 1495 tests (head 956fbcb, 11-01). New suites: integrations-connect, init-providers, init-app-url, doctor-project, lib/init/providers. Both parity sentinels pass.
• docs:commands:check, generate:skills:check, sync:launchers:check, generate:types freshness
• Secret canaries: the Supabase token, the Clerk secret key, the generated and previous hook secrets and the signing secrets never appear in stdout, stderr or brew.json, and no Brew request carries a provider token.
• Dry-run output (exact requests, nothing written). Rollback for Supabase (with and without a previous secret) and for Clerk. Refusal under a bare --yes. Clerk refusal while the connection is pending. 403 from POST /v1/brands. 404 for a provider that is not connected. Supabase vendor errors are redacted.
• Live: a Supabase test project and a Clerk test instance against brew-v2 #2169 (after deploy)
• CI is green once SDK 13.7.0 is published

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Confidence Score: 5/5

The reviewed changes appear safe to merge under the documented SDK and deployment gates.

Summary

Adds hosted Supabase and Clerk connections, provider setup and rollback, brand selection from --app-url, and doctor --project.

• The CLI connects Supabase and Clerk auth emails to Brew.
• Init matches app URLs to brands and sets up auth-provider email routing.
• The doctor command checks a project against its Brew setup.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Resolve brand from app URL] --> B{Saved app key differs from run key?}
  B -->|No| E[Continue when brand is ready]
  B -->|Yes| C{Server and brand match?}
  C -->|Yes| E
  C -->|No| D[Ask user to replace app key]
  D --> F[Hold domain, kit, patches and provider setup]

Loading

_{Reviews (45) · Last reviewed commit: "fix(init): check the app key's server an..." · Reviewed by Greptile}