test(cli): cover embedded suppression, v3Alternative pointer, and null-clientPath re-run

Close the three test gaps auxesis flagged on #705 — all callee-side or
negative-case coverage the diff's new behaviour landed without:

- eql/migration.ts: assert the six `if (!embedded)` suppression sites and
  the `?? false` default at the callee (banners emitted by default;
  suppressed + SQL still written when embedded; abort outro suppressed but
  CliExit still propagates).
- db/install.ts: assert the `v3Alternative` pointer via its distinctive
  `stash eql migration --drizzle` substring (the pre-diff `/--drizzle/`
  match was unguarded), plus the lopsided-negative that it stays absent for
  --latest / --migration / --migrations-dir.
- init/steps/install-eql.ts: cover the null-clientPath re-run path (config
  already on disk) and assert a plain Drizzle project passes
  supabase: undefined.

Tests-only; no production change.

Author: tobyhede

packages/cli/src/__tests__/supabase-migration.test.ts

@@ -338,6 +338,36 @@ describe('validateInstallFlags', () => {
       }),
     ).toBeNull()
   })
+
+  it('points --drizzle at the v3 migration command instead of only at --eql-version 2', () => {
+    // Steering users to `--eql-version 2` is how new projects ended up on the
+    // legacy generation (#691). Both the default-branch wording and the explicit
+    // `--eql-version 3` wording must carry the pointer. Assert the distinctive
+    // substring, not a bare `/--drizzle/` — that already appears in the base
+    // message body and would pass even if the pointer were dropped.
+    expect(validateInstallFlags({ drizzle: true })).toMatch(
+      /stash eql migration --drizzle/,
+    )
+    expect(validateInstallFlags({ eqlVersion: '3', drizzle: true })).toMatch(
+      /stash eql migration --drizzle/,
+    )
+  })
+
+  it('does NOT offer the Drizzle alternative for the other v2-only flags', () => {
+    // There is no `stash eql migration` route for these — suggesting one would
+    // send the user to a command that cannot help them. Guards the pointer being
+    // gated on `v2OnlyFlag === '--drizzle'`.
+    for (const opts of [
+      { latest: true },
+      { supabase: true, migration: true },
+      { supabase: true, migrationsDir: 'db/migrations' },
+    ]) {
+      expect(validateInstallFlags(opts)).not.toMatch(/stash eql migration/)
+      expect(validateInstallFlags({ ...opts, eqlVersion: '3' })).not.toMatch(
+        /stash eql migration/,
+      )
+    }
+  })
 })
 
 describe('routeInstallPathForEqlVersion', () => {

packages/cli/src/commands/eql/__tests__/migration.test.ts

@@ -11,6 +11,7 @@ import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { CliExit } from '../../../cli/exit.js'
 import { messages } from '../../../messages.js'
+import { printNextSteps } from '../../db/install.js'
 import { buildEqlV3MigrationSql, eqlMigrationCommand } from '../migration.js'
 
 // clack is chrome — silence it and spy on the error/note channels the command
@@ -242,4 +243,63 @@ describe('eqlMigrationCommand — Drizzle', () => {
     expect(existsSync(scaffolded)).toBe(false)
     expect(clack.log.error).toHaveBeenCalledWith('EACCES: permission denied')
   })
+
+  // The `embedded` flag is asserted at the caller (install-eql.test.ts) as
+  // *passed*; these pin what it *does* at the callee. All six suppression sites
+  // hang off `options.embedded ?? false`, and none were exercised — flipping the
+  // default or dropping an `if (!embedded)` guard would pass CI silently.
+  it('emits the standalone banners by default (embedded unset)', async () => {
+    const out = join(tmp, 'drizzle')
+    mkdirSync(out, { recursive: true })
+    spawnMock.mockImplementation(() => {
+      fsWrite.real(join(out, '0000_install-eql.sql'), '')
+      return { status: 0, stdout: '', stderr: '' }
+    })
+
+    await eqlMigrationCommand({ drizzle: true, out })
+
+    expect(clack.intro).toHaveBeenCalled()
+    expect(clack.outro).toHaveBeenCalledWith('Done!')
+    expect(printNextSteps).toHaveBeenCalled()
+  })
+
+  it('suppresses intro/outro/next-steps when embedded, but still writes the SQL', async () => {
+    // `stash init` renders its own summary + agent handoff; a second "what next"
+    // block from here would compete with it. The migration itself is unchanged.
+    const out = join(tmp, 'drizzle')
+    mkdirSync(out, { recursive: true })
+    spawnMock.mockImplementation(() => {
+      fsWrite.real(join(out, '0000_install-eql.sql'), '')
+      return { status: 0, stdout: '', stderr: '' }
+    })
+
+    await eqlMigrationCommand({ drizzle: true, out, embedded: true })
+
+    expect(clack.intro).not.toHaveBeenCalled()
+    expect(clack.outro).not.toHaveBeenCalled()
+    expect(printNextSteps).not.toHaveBeenCalled()
+    // Presentational suppression only — the migration note itself still renders,
+    // and the SQL is written to the located file.
+    expect(clack.note).toHaveBeenCalledWith(expect.any(String), 'Next Steps')
+    expect(readFileSync(join(out, '0000_install-eql.sql'), 'utf-8')).toContain(
+      'EQL v3 schema creation',
+    )
+  })
+
+  it('suppresses the abort outro when embedded but still exits 1', async () => {
+    // `install-eql`'s catch depends on the CliExit propagating; embedded must
+    // silence the outro banner without swallowing the failure.
+    spawnMock.mockReturnValue({ status: 1, stdout: '', stderr: 'boom' })
+
+    await expect(
+      eqlMigrationCommand({
+        drizzle: true,
+        out: join(tmp, 'drizzle'),
+        embedded: true,
+      }),
+    ).rejects.toBeInstanceOf(CliExit)
+
+    expect(clack.outro).not.toHaveBeenCalled()
+    expect(clack.log.error).toHaveBeenCalledWith('boom')
+  })
 })

packages/cli/src/commands/init/steps/__tests__/install-eql.test.ts

@@ -160,6 +160,36 @@ describe('installEqlStep', () => {
       )
     })
 
+    it('passes supabase: undefined for a plain (non-Supabase) Drizzle project', async () => {
+      // Symmetric negative to the --supabase forward: a plain Drizzle project
+      // must NOT leak supabase: true, or the migration would append role grants
+      // no one asked for. `toMatchObject` above ignores the key, so it can't
+      // catch a leak — this asserts it explicitly.
+      await installEqlStep.run(drizzleState, drizzleProvider)
+
+      expect(
+        vi.mocked(eqlMigrationCommand).mock.calls[0][0].supabase,
+      ).toBeUndefined()
+    })
+
+    it('still generates the migration when stash.config.ts already exists', async () => {
+      // offerStashConfig returns null when the config is already on disk — the
+      // re-run case (config-scaffold.ts: `if (existsSync(configPath)) return
+      // null`), i.e. every re-run of `stash init` on a Drizzle project. Nothing
+      // to scaffold, but the migration must still be written and the state must
+      // still say "pending". If the `if (clientPath)` guard were dropped,
+      // ensureEncryptionClient(null, …) would throw outside the try/catch and
+      // abort init after the user has already authenticated.
+      vi.mocked(offerStashConfig).mockResolvedValueOnce(null)
+
+      const result = await installEqlStep.run(drizzleState, drizzleProvider)
+
+      expect(ensureEncryptionClient).not.toHaveBeenCalled()
+      expect(eqlMigrationCommand).toHaveBeenCalledTimes(1)
+      expect(result.eqlMigrationPending).toBe(true)
+      expect(result.eqlInstalled).toBe(false)
+    })
+
     it('degrades to "not installed" (never crashes init) when drizzle-kit is missing', async () => {
       // eqlMigrationCommand throws CliExit when drizzle-kit isn't installed or
       // configured. init must absorb that and report honestly — a thrown