@cedarjs/pg 0.1.0-alpha.0 → 0.2.0-alpha.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cedarjs/pg",
-  "version": "0.1.0-alpha.0",
-  "description": "Worktree-isolated local Postgres for Vite+/Nx/CedarJS — powered by autopg (embedded PostgreSQL with true concurrent connections)",
+  "version": "0.2.0-alpha.0",
+  "description": "Worktree-isolated local Postgres for Vite+, Nx, and CedarJS (via autopg)",
   "keywords": [
     "autopg",
     "cedar",
@@ -29,6 +29,8 @@
   },
   "files": [
     "dist",
+    "scripts/autopg-version",
+    "scripts/ci-install-autopg.sh",
     "scripts/postinstall.js"
   ],
   "type": "module",
@@ -56,26 +58,42 @@
       "import": "./dist/vitest.mjs",
       "require": "./dist/vitest.cjs"
     },
+    "./vitest/template": {
+      "types": "./dist/vitest-template.d.mts",
+      "import": "./dist/vitest-template.mjs",
+      "require": "./dist/vitest-template.cjs"
+    },
     "./jest": {
       "types": "./dist/jest.d.mts",
       "import": "./dist/jest.mjs",
       "require": "./dist/jest.cjs"
     },
+    "./jest-teardown": {
+      "types": "./dist/jest-teardown.d.mts",
+      "import": "./dist/jest-teardown.mjs",
+      "require": "./dist/jest-teardown.cjs"
+    },
+    "./test-env": {
+      "types": "./dist/test-env.d.mts",
+      "import": "./dist/test-env.mjs",
+      "require": "./dist/test-env.cjs"
+    },
+    "./dev-env": {
+      "types": "./dist/dev-env.d.mts",
+      "import": "./dist/dev-env.mjs",
+      "require": "./dist/dev-env.cjs"
+    },
+    "./jest/template": {
+      "types": "./dist/jest-template.d.mts",
+      "import": "./dist/jest-template.mjs",
+      "require": "./dist/jest-template.cjs"
+    },
     "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public",
     "tag": "alpha"
   },
-  "scripts": {
-    "build": "vp pack",
-    "dev": "vp pack --watch",
-    "test": "vp test",
-    "check": "vp check",
-    "prepublishOnly": "vp pack",
-    "postinstall": "node scripts/postinstall.js",
-    "prepare": "vp config || true"
-  },
   "dependencies": {
     "pg": "^8.16.3"
   },
@@ -92,5 +110,11 @@
   "engines": {
     "node": ">=24"
   },
-  "packageManager": "pnpm@11.18.0"
-}
+  "scripts": {
+    "build": "vp pack",
+    "dev": "vp pack --watch",
+    "test": "vp test",
+    "check": "vp check",
+    "postinstall": "node scripts/postinstall.js"
+  }
+}

package/scripts/autopg-version

@@ -0,0 +1 @@
+v3.0.7

package/scripts/ci-install-autopg.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# Binary-only autopg install for CI (and postinstall when CEDAR_PG_INSTALL_AUTOPG=1).
+# Fetches pinned release, verifies attestation, installs binary — no pm2.
+# Version pin: scripts/autopg-version (override with AUTOPG_VERSION).
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [ -z "${AUTOPG_VERSION:-}" ]; then
+  AUTOPG_VERSION="$(tr -d '[:space:]' <"${SCRIPT_DIR}/autopg-version")"
+fi
+VERSION="${AUTOPG_VERSION}"
+REPO="${AUTOPG_REPO:-automagik-dev/autopg}"
+LEGACY_REPO="${AUTOPG_LEGACY_REPO:-namastexlabs/pgserve}"
+
+detect_libc() {
+  if [ -e /lib/ld-musl-x86_64.so.1 ] || (ldd --version 2>&1 | grep -qi musl); then
+    echo musl
+  else
+    echo glibc
+  fi
+}
+
+case "$(uname -s)-$(uname -m)" in
+  Linux-x86_64) PLATFORM="linux-x64-$(detect_libc)" ;;
+  Linux-aarch64) PLATFORM="linux-arm64" ;;
+  Darwin-arm64) PLATFORM="darwin-arm64" ;;
+  Darwin-x86_64) PLATFORM="darwin-x64" ;;
+  *)
+    echo "[ci-install-autopg] unsupported platform: $(uname -s)-$(uname -m)" >&2
+    exit 1
+    ;;
+esac
+
+if [ -x "${HOME}/.local/bin/autopg" ]; then
+  echo "[ci-install-autopg] already present: ${HOME}/.local/bin/autopg"
+  exit 0
+fi
+
+TARBALL="autopg-${VERSION#v}-${PLATFORM}.tar.gz"
+URL="https://github.com/${REPO}/releases/download/${VERSION}/${TARBALL}"
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+echo "[ci-install-autopg] fetching ${URL}"
+curl -fsSL --output "${TMP}/${TARBALL}" "${URL}"
+
+if ! command -v gh >/dev/null 2>&1; then
+  echo "[ci-install-autopg] gh CLI required for attestation verify" >&2
+  exit 1
+fi
+
+echo "[ci-install-autopg] verifying attestation"
+if ! gh attestation verify "${TMP}/${TARBALL}" --repo "${REPO}" \
+  && ! gh attestation verify "${TMP}/${TARBALL}" --repo "${LEGACY_REPO}"; then
+  echo "[ci-install-autopg] attestation verify failed" >&2
+  exit 1
+fi
+
+echo "[ci-install-autopg] extracting binary tree"
+tar -xzf "${TMP}/${TARBALL}" -C "${TMP}"
+SRC="${TMP}/autopg"
+if [ ! -x "${SRC}/autopg" ]; then
+  echo "[ci-install-autopg] unexpected tarball layout: ${SRC}/autopg missing" >&2
+  exit 1
+fi
+
+INSTALL_DIR="${HOME}/.local/share/autopg/${VERSION}"
+mkdir -p "${INSTALL_DIR}" "${HOME}/.local/bin"
+cp -a "${SRC}/." "${INSTALL_DIR}/"
+ln -sfn "${INSTALL_DIR}/autopg" "${HOME}/.local/bin/autopg"
+
+echo "[ci-install-autopg] ok — $(command -v autopg || echo "${HOME}/.local/bin/autopg")"
+"${HOME}/.local/bin/autopg" --help >/dev/null

package/scripts/postinstall.js

@@ -2,21 +2,25 @@
 /**
  * Ensure the autopg host binary is available after @cedarjs/pg install.
  * Idempotent across npm / yarn / pnpm. Never fails the parent install hard
- * when network is unavailable — prints a clear warning instead.
+ * when network is unavailable; prints a clear warning instead.
  *
- * Supply-chain: both the install script ref and the binary release are pinned.
- * Bump AUTOPG_VERSION (and the matching tag in INSTALL_URL) deliberately when
- * upgrading — do not track main/latest.
+ * Version pin: scripts/autopg-version (single source of truth).
+ *
+ * - Local / non-CI: pinned upstream install.sh (may start pm2).
+ * - CI + CEDAR_PG_INSTALL_AUTOPG=1: binary-only scripts/ci-install-autopg.sh
+ *   (attestation via gh; no pm2 — cedar-pg ephemeral host owns startup).
  */
 
 import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 
-/** Pinned autopg release tag. Bump intentionally for upgrades. */
-const AUTOPG_VERSION = "v3.0.7";
+const HERE = dirname(fileURLToPath(import.meta.url));
+const AUTOPG_VERSION = readFileSync(join(HERE, "autopg-version"), "utf8").trim();
 const INSTALL_URL = `https://raw.githubusercontent.com/automagik-dev/autopg/${AUTOPG_VERSION}/install.sh`;
+const CI_INSTALL = join(HERE, "ci-install-autopg.sh");
 
 function hasAutopg() {
   if (process.env.AUTOPG_BIN && existsSync(process.env.AUTOPG_BIN)) return true;
@@ -34,16 +38,38 @@ function main() {
     return;
   }
 
-  // Skip in CI unless explicitly requested — CI images often bake autopg
-  if (process.env.CI === "true" && process.env.CEDAR_PG_INSTALL_AUTOPG !== "1") {
+  const inCi = process.env.CI === "true";
+  const forceCiInstall = process.env.CEDAR_PG_INSTALL_AUTOPG === "1";
+
+  // Skip in CI unless explicitly requested; CI images often bake autopg
+  // or run scripts/ci-install-autopg.sh from the workflow.
+  if (inCi && !forceCiInstall) {
     console.warn(
-      "[cedarpg] autopg not found; CI detected — skip auto-install. " +
-        "Set CEDAR_PG_INSTALL_AUTOPG=1 or install autopg in the image.",
+      "[cedarpg] autopg not found; CI detected, skip auto-install. " +
+        "Set CEDAR_PG_INSTALL_AUTOPG=1 or run scripts/ci-install-autopg.sh.",
+    );
+    return;
+  }
+
+  if (inCi && forceCiInstall) {
+    console.log(
+      `[cedarpg] autopg not found; CI binary install ${AUTOPG_VERSION} via ci-install-autopg.sh...`,
     );
+    const result = spawnSync("bash", [CI_INSTALL], {
+      stdio: "inherit",
+      env: { ...process.env, AUTOPG_VERSION },
+    });
+    if (result.status !== 0) {
+      console.warn(
+        "[cedarpg] CI binary install failed.\n" +
+          "  Run: bash scripts/ci-install-autopg.sh\n" +
+          "  (requires gh CLI + GH_TOKEN for attestation verify)",
+      );
+    }
     return;
   }
 
-  console.log(`[cedarpg] autopg not found — installing ${AUTOPG_VERSION} via pinned install.sh…`);
+  console.log(`[cedarpg] autopg not found; installing ${AUTOPG_VERSION} via pinned install.sh...`);
   const result = spawnSync("bash", ["-c", `curl -fsSL ${INSTALL_URL} | bash`], {
     stdio: "inherit",
     env: { ...process.env, AUTOPG_VERSION },

package/dist/constants-B7sCf4fg.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants-B7sCf4fg.cjs","names":[],"sources":["../src/core/constants.ts"],"sourcesContent":["/**\n * Product identity vs frozen crypto.\n *\n * State dirs follow the CLI name (`.cedarpg`) — product-owned, not nested under\n * autopg's `~/.autopg/` (host owns that) and not a generic `.pg` (collision-prone).\n * Password salt is an opaque crypto constant; bump ROLE_PASSWORD_SCHEME to change it.\n */\n\n/** User-facing CLI binary (`package.json` bin) and log prefix */\nexport const CLI_NAME = \"cedarpg\";\n\n/**\n * Worktree-local state dir and home-registry parent (`~/.cedarpg/registry`).\n * Frozen for lease/gc discovery after first alpha consumers appear.\n */\nexport const STATE_DIRNAME = \".cedarpg\";\n\n/**\n * Password scheme v1 salt prefix: sha256(`${PASSWORD_SALT_PREFIX}\\0` + databaseName).\n * Opaque — independent of STATE_DIRNAME / CLI_NAME. Bump ROLE_PASSWORD_SCHEME to change.\n */\nexport const PASSWORD_SALT_PREFIX = \"cedar-pg\";\n"],"mappings":";;;;;;;;;AASA,MAAa,WAAW;;;;;AAMxB,MAAa,gBAAgB;;;;;AAM7B,MAAa,uBAAuB"}

package/dist/constants-YnHDwShD.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants-YnHDwShD.mjs","names":[],"sources":["../src/core/constants.ts"],"sourcesContent":["/**\n * Product identity vs frozen crypto.\n *\n * State dirs follow the CLI name (`.cedarpg`) — product-owned, not nested under\n * autopg's `~/.autopg/` (host owns that) and not a generic `.pg` (collision-prone).\n * Password salt is an opaque crypto constant; bump ROLE_PASSWORD_SCHEME to change it.\n */\n\n/** User-facing CLI binary (`package.json` bin) and log prefix */\nexport const CLI_NAME = \"cedarpg\";\n\n/**\n * Worktree-local state dir and home-registry parent (`~/.cedarpg/registry`).\n * Frozen for lease/gc discovery after first alpha consumers appear.\n */\nexport const STATE_DIRNAME = \".cedarpg\";\n\n/**\n * Password scheme v1 salt prefix: sha256(`${PASSWORD_SALT_PREFIX}\\0` + databaseName).\n * Opaque — independent of STATE_DIRNAME / CLI_NAME. Bump ROLE_PASSWORD_SCHEME to change.\n */\nexport const PASSWORD_SALT_PREFIX = \"cedar-pg\";\n"],"mappings":";;;;;;;;;AASA,MAAa,WAAW;;;;;AAMxB,MAAa,gBAAgB;;;;;AAM7B,MAAa,uBAAuB"}