@cedarjs/pg 0.1.0-alpha.1 → 0.2.0-beta.0

package/dist/vitest-template.d.mts

@@ -0,0 +1,31 @@
+import { i as cloneWorkerDatabase, n as TemplateMigrateContext, r as TemplateMigrateFn, t as SetupTemplateModeOptions } from "./template-mode-CzyVwHsi.mjs";
+//#region src/adapters/vitest-template.d.ts
+/**
+ * Vitest globalSetup (template mode). Returns teardown that disposes TEMPLATE + clones.
+ *
+ * ```ts
+ * // vitest.cedar-global.ts
+ * import { createGlobalSetup } from "@cedarjs/pg/vitest/template";
+ * export default createGlobalSetup({ migrate: async ({ databaseUrl }) => {} });
+ *
+ * // vitest.config.ts
+ * export default defineConfig({
+ *   test: {
+ *     globalSetup: ["./vitest.cedar-global.ts"],
+ *     setupFiles: ["./vitest.cedar-worker.ts"],
+ *   },
+ * })
+ *
+ * // vitest.cedar-worker.ts — local ESM (pack emits CJS+ESM; top-level await lives here)
+ * import { cloneWorkerDatabase } from "@cedarjs/pg/vitest/template";
+ * await cloneWorkerDatabase();
+ * ```
+ *
+ * Stock `@cedarjs/pg/vitest` is one shared test DB only.
+ */
+declare function createGlobalSetup(options: SetupTemplateModeOptions): () => Promise<() => Promise<void>>;
+/** String path without a migrate hook is unsupported — use `createGlobalSetup`. */
+declare function setup(): Promise<() => Promise<void>>;
+//#endregion
+export { type SetupTemplateModeOptions, type TemplateMigrateContext, type TemplateMigrateFn, cloneWorkerDatabase, createGlobalSetup, setup as default };
+//# sourceMappingURL=vitest-template.d.mts.map

package/dist/vitest-template.mjs

@@ -0,0 +1,42 @@
+import { n as setupTemplateMode, t as cloneWorkerDatabase } from "./template-mode-BTUsdBtA.mjs";
+//#region src/adapters/vitest-template.ts
+/**
+* Vitest globalSetup (template mode). Returns teardown that disposes TEMPLATE + clones.
+*
+* ```ts
+* // vitest.cedar-global.ts
+* import { createGlobalSetup } from "@cedarjs/pg/vitest/template";
+* export default createGlobalSetup({ migrate: async ({ databaseUrl }) => {} });
+*
+* // vitest.config.ts
+* export default defineConfig({
+*   test: {
+*     globalSetup: ["./vitest.cedar-global.ts"],
+*     setupFiles: ["./vitest.cedar-worker.ts"],
+*   },
+* })
+*
+* // vitest.cedar-worker.ts — local ESM (pack emits CJS+ESM; top-level await lives here)
+* import { cloneWorkerDatabase } from "@cedarjs/pg/vitest/template";
+* await cloneWorkerDatabase();
+* ```
+*
+* Stock `@cedarjs/pg/vitest` is one shared test DB only.
+*/
+function createGlobalSetup(options) {
+	return async () => {
+		const result = await setupTemplateMode(options);
+		if (result.status !== "acquired") return async () => {};
+		return async () => {
+			await result.dispose();
+		};
+	};
+}
+/** String path without a migrate hook is unsupported — use `createGlobalSetup`. */
+async function setup() {
+	throw new Error("@cedarjs/pg/vitest/template requires createGlobalSetup({ migrate }). Point globalSetup at a local module that exports createGlobalSetup({ migrate }).");
+}
+//#endregion
+export { cloneWorkerDatabase, createGlobalSetup, setup as default };
+
+//# sourceMappingURL=vitest-template.mjs.map

package/dist/vitest-template.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"vitest-template.mjs","names":[],"sources":["../src/adapters/vitest-template.ts"],"sourcesContent":["import {\n  cloneWorkerDatabase,\n  setupTemplateMode,\n  type SetupTemplateModeOptions,\n} from \"./template-mode.ts\";\n\nexport { cloneWorkerDatabase };\nexport type {\n  SetupTemplateModeOptions,\n  TemplateMigrateFn,\n  TemplateMigrateContext,\n} from \"./template-mode.ts\";\n\n/**\n * Vitest globalSetup (template mode). Returns teardown that disposes TEMPLATE + clones.\n *\n * ```ts\n * // vitest.cedar-global.ts\n * import { createGlobalSetup } from \"@cedarjs/pg/vitest/template\";\n * export default createGlobalSetup({ migrate: async ({ databaseUrl }) => {} });\n *\n * // vitest.config.ts\n * export default defineConfig({\n *   test: {\n *     globalSetup: [\"./vitest.cedar-global.ts\"],\n *     setupFiles: [\"./vitest.cedar-worker.ts\"],\n *   },\n * })\n *\n * // vitest.cedar-worker.ts — local ESM (pack emits CJS+ESM; top-level await lives here)\n * import { cloneWorkerDatabase } from \"@cedarjs/pg/vitest/template\";\n * await cloneWorkerDatabase();\n * ```\n *\n * Stock `@cedarjs/pg/vitest` is one shared test DB only.\n */\nexport function createGlobalSetup(options: SetupTemplateModeOptions) {\n  return async () => {\n    const result = await setupTemplateMode(options);\n    if (result.status !== \"acquired\") {\n      return async () => {};\n    }\n    return async () => {\n      await result.dispose();\n    };\n  };\n}\n\n/** String path without a migrate hook is unsupported — use `createGlobalSetup`. */\nexport default async function setup(): Promise<() => Promise<void>> {\n  throw new Error(\n    \"@cedarjs/pg/vitest/template requires createGlobalSetup({ migrate }). \" +\n      \"Point globalSetup at a local module that exports createGlobalSetup({ migrate }).\",\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,SAAgB,kBAAkB,SAAmC;CACnE,OAAO,YAAY;EACjB,MAAM,SAAS,MAAM,kBAAkB,OAAO;EAC9C,IAAI,OAAO,WAAW,YACpB,OAAO,YAAY,CAAC;EAEtB,OAAO,YAAY;GACjB,MAAM,OAAO,QAAQ;EACvB;CACF;AACF;;AAGA,eAA8B,QAAsC;CAClE,MAAM,IAAI,MACR,uJAEF;AACF"}

package/dist/vitest.cjs

@@ -1,11 +1,12 @@
-Object.defineProperties(exports, {
-	__esModule: { value: true },
-	[Symbol.toStringTag]: { value: "Module" }
-});
-const require_lifecycle = require("./lifecycle-BGYtVXtx.cjs");
+const require_lifecycle = require("./lifecycle-BbrvFQvg.cjs");
 //#region src/adapters/vitest.ts
 /**
-* Vitest globalSetup: ensure test DB, return teardown that disposes it.
+* Vitest globalSetup for a single shared test DB.
+* Not a migrate-once / per-worker TEMPLATE runner — use `@cedarjs/pg/vitest/template`.
+*
+* Vitest runs globalSetup in the main process then spawns workers, so
+* `process.env` mutations (via `setEnv`) are inherited. Pair with
+* `setupFiles: ['@cedarjs/pg/test-env']` only if your pool does not inherit env.
 *
 * vitest.config.ts:
 * ```ts
@@ -17,17 +18,16 @@ const require_lifecycle = require("./lifecycle-BGYtVXtx.cjs");
 * ```
 */
 async function setup() {
-	const result = await require_lifecycle.ensureIfNeeded({
+	const result = await require_lifecycle.acquireIfNeeded({
 		mode: "test",
 		setEnv: true
 	});
-	if (result.status !== "ensured") return async () => {};
+	if (result.status !== "acquired") return async () => {};
 	return async () => {
 		await result.dispose();
 	};
 }
 //#endregion
-exports.default = setup;
-exports.setup = setup;
+module.exports = setup;
 
 //# sourceMappingURL=vitest.cjs.map

package/dist/vitest.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"vitest.cjs","names":["ensureIfNeeded"],"sources":["../src/adapters/vitest.ts"],"sourcesContent":["import { ensureIfNeeded } from \"../core/lifecycle.ts\";\n\n/**\n * Vitest globalSetup: ensure test DB, return teardown that disposes it.\n *\n * vitest.config.ts:\n * ```ts\n * export default defineConfig({\n *   test: {\n *     globalSetup: ['@cedarjs/pg/vitest'],\n *   },\n * })\n * ```\n */\nexport async function setup(): Promise<() => Promise<void>> {\n  const result = await ensureIfNeeded({\n    mode: \"test\",\n    setEnv: true,\n  });\n  if (result.status !== \"ensured\") {\n    return async () => {};\n  }\n  return async () => {\n    await result.dispose();\n  };\n}\n\nexport default setup;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAcA,eAAsB,QAAsC;CAC1D,MAAM,SAAS,MAAMA,kBAAAA,eAAe;EAClC,MAAM;EACN,QAAQ;CACV,CAAC;CACD,IAAI,OAAO,WAAW,WACpB,OAAO,YAAY,CAAC;CAEtB,OAAO,YAAY;EACjB,MAAM,OAAO,QAAQ;CACvB;AACF"}
+{"version":3,"file":"vitest.cjs","names":["acquireIfNeeded"],"sources":["../src/adapters/vitest.ts"],"sourcesContent":["import { acquireIfNeeded } from \"../core/lifecycle.ts\";\n\n/**\n * Vitest globalSetup for a single shared test DB.\n * Not a migrate-once / per-worker TEMPLATE runner — use `@cedarjs/pg/vitest/template`.\n *\n * Vitest runs globalSetup in the main process then spawns workers, so\n * `process.env` mutations (via `setEnv`) are inherited. Pair with\n * `setupFiles: ['@cedarjs/pg/test-env']` only if your pool does not inherit env.\n *\n * vitest.config.ts:\n * ```ts\n * export default defineConfig({\n *   test: {\n *     globalSetup: ['@cedarjs/pg/vitest'],\n *   },\n * })\n * ```\n */\nexport default async function setup(): Promise<() => Promise<void>> {\n  const result = await acquireIfNeeded({\n    mode: \"test\",\n    setEnv: true,\n  });\n  if (result.status !== \"acquired\") {\n    return async () => {};\n  }\n  return async () => {\n    await result.dispose();\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAmBA,eAA8B,QAAsC;CAClE,MAAM,SAAS,MAAMA,kBAAAA,gBAAgB;EACnC,MAAM;EACN,QAAQ;CACV,CAAC;CACD,IAAI,OAAO,WAAW,YACpB,OAAO,YAAY,CAAC;CAEtB,OAAO,YAAY;EACjB,MAAM,OAAO,QAAQ;CACvB;AACF"}

package/dist/vitest.d.cts

@@ -1,6 +1,11 @@
 //#region src/adapters/vitest.d.ts
 /**
- * Vitest globalSetup: ensure test DB, return teardown that disposes it.
+ * Vitest globalSetup for a single shared test DB.
+ * Not a migrate-once / per-worker TEMPLATE runner — use `@cedarjs/pg/vitest/template`.
+ *
+ * Vitest runs globalSetup in the main process then spawns workers, so
+ * `process.env` mutations (via `setEnv`) are inherited. Pair with
+ * `setupFiles: ['@cedarjs/pg/test-env']` only if your pool does not inherit env.
  *
  * vitest.config.ts:
  * ```ts
@@ -12,6 +17,5 @@
  * ```
  */
 declare function setup(): Promise<() => Promise<void>>;
-//#endregion
-export { setup as default, setup };
+export = setup;
 //# sourceMappingURL=vitest.d.cts.map

package/dist/vitest.d.mts

@@ -1,6 +1,11 @@
 //#region src/adapters/vitest.d.ts
 /**
- * Vitest globalSetup: ensure test DB, return teardown that disposes it.
+ * Vitest globalSetup for a single shared test DB.
+ * Not a migrate-once / per-worker TEMPLATE runner — use `@cedarjs/pg/vitest/template`.
+ *
+ * Vitest runs globalSetup in the main process then spawns workers, so
+ * `process.env` mutations (via `setEnv`) are inherited. Pair with
+ * `setupFiles: ['@cedarjs/pg/test-env']` only if your pool does not inherit env.
  *
  * vitest.config.ts:
  * ```ts
@@ -13,5 +18,5 @@
  */
 declare function setup(): Promise<() => Promise<void>>;
 //#endregion
-export { setup as default, setup };
+export { setup as default };
 //# sourceMappingURL=vitest.d.mts.map

package/dist/vitest.mjs

@@ -1,7 +1,12 @@
-import { r as ensureIfNeeded } from "./lifecycle-CT_8AWPv.mjs";
+import { n as acquireIfNeeded } from "./lifecycle-BvIx0xqq.mjs";
 //#region src/adapters/vitest.ts
 /**
-* Vitest globalSetup: ensure test DB, return teardown that disposes it.
+* Vitest globalSetup for a single shared test DB.
+* Not a migrate-once / per-worker TEMPLATE runner — use `@cedarjs/pg/vitest/template`.
+*
+* Vitest runs globalSetup in the main process then spawns workers, so
+* `process.env` mutations (via `setEnv`) are inherited. Pair with
+* `setupFiles: ['@cedarjs/pg/test-env']` only if your pool does not inherit env.
 *
 * vitest.config.ts:
 * ```ts
@@ -13,16 +18,16 @@ import { r as ensureIfNeeded } from "./lifecycle-CT_8AWPv.mjs";
 * ```
 */
 async function setup() {
-	const result = await ensureIfNeeded({
+	const result = await acquireIfNeeded({
 		mode: "test",
 		setEnv: true
 	});
-	if (result.status !== "ensured") return async () => {};
+	if (result.status !== "acquired") return async () => {};
 	return async () => {
 		await result.dispose();
 	};
 }
 //#endregion
-export { setup as default, setup };
+export { setup as default };
 
 //# sourceMappingURL=vitest.mjs.map

package/dist/vitest.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"vitest.mjs","names":[],"sources":["../src/adapters/vitest.ts"],"sourcesContent":["import { ensureIfNeeded } from \"../core/lifecycle.ts\";\n\n/**\n * Vitest globalSetup: ensure test DB, return teardown that disposes it.\n *\n * vitest.config.ts:\n * ```ts\n * export default defineConfig({\n *   test: {\n *     globalSetup: ['@cedarjs/pg/vitest'],\n *   },\n * })\n * ```\n */\nexport async function setup(): Promise<() => Promise<void>> {\n  const result = await ensureIfNeeded({\n    mode: \"test\",\n    setEnv: true,\n  });\n  if (result.status !== \"ensured\") {\n    return async () => {};\n  }\n  return async () => {\n    await result.dispose();\n  };\n}\n\nexport default setup;\n"],"mappings":";;;;;;;;;;;;;;AAcA,eAAsB,QAAsC;CAC1D,MAAM,SAAS,MAAM,eAAe;EAClC,MAAM;EACN,QAAQ;CACV,CAAC;CACD,IAAI,OAAO,WAAW,WACpB,OAAO,YAAY,CAAC;CAEtB,OAAO,YAAY;EACjB,MAAM,OAAO,QAAQ;CACvB;AACF"}
+{"version":3,"file":"vitest.mjs","names":[],"sources":["../src/adapters/vitest.ts"],"sourcesContent":["import { acquireIfNeeded } from \"../core/lifecycle.ts\";\n\n/**\n * Vitest globalSetup for a single shared test DB.\n * Not a migrate-once / per-worker TEMPLATE runner — use `@cedarjs/pg/vitest/template`.\n *\n * Vitest runs globalSetup in the main process then spawns workers, so\n * `process.env` mutations (via `setEnv`) are inherited. Pair with\n * `setupFiles: ['@cedarjs/pg/test-env']` only if your pool does not inherit env.\n *\n * vitest.config.ts:\n * ```ts\n * export default defineConfig({\n *   test: {\n *     globalSetup: ['@cedarjs/pg/vitest'],\n *   },\n * })\n * ```\n */\nexport default async function setup(): Promise<() => Promise<void>> {\n  const result = await acquireIfNeeded({\n    mode: \"test\",\n    setEnv: true,\n  });\n  if (result.status !== \"acquired\") {\n    return async () => {};\n  }\n  return async () => {\n    await result.dispose();\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAmBA,eAA8B,QAAsC;CAClE,MAAM,SAAS,MAAM,gBAAgB;EACnC,MAAM;EACN,QAAQ;CACV,CAAC;CACD,IAAI,OAAO,WAAW,YACpB,OAAO,YAAY,CAAC;CAEtB,OAAO,YAAY;EACjB,MAAM,OAAO,QAAQ;CACvB;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/pg",
-  "version": "0.1.0-alpha.1",
+  "version": "0.2.0-beta.0",
   "description": "Worktree-isolated local Postgres for Vite+, Nx, and CedarJS (via autopg)",
   "keywords": [
     "autopg",
@@ -29,6 +29,8 @@
   },
   "files": [
     "dist",
+    "scripts/autopg-version",
+    "scripts/ci-install-autopg.sh",
     "scripts/postinstall.js"
   ],
   "type": "module",
@@ -56,25 +58,41 @@
       "import": "./dist/vitest.mjs",
       "require": "./dist/vitest.cjs"
     },
+    "./vitest/template": {
+      "types": "./dist/vitest-template.d.mts",
+      "import": "./dist/vitest-template.mjs",
+      "require": "./dist/vitest-template.cjs"
+    },
     "./jest": {
       "types": "./dist/jest.d.mts",
       "import": "./dist/jest.mjs",
       "require": "./dist/jest.cjs"
     },
+    "./jest-teardown": {
+      "types": "./dist/jest-teardown.d.mts",
+      "import": "./dist/jest-teardown.mjs",
+      "require": "./dist/jest-teardown.cjs"
+    },
+    "./test-env": {
+      "types": "./dist/test-env.d.mts",
+      "import": "./dist/test-env.mjs",
+      "require": "./dist/test-env.cjs"
+    },
+    "./dev-env": {
+      "types": "./dist/dev-env.d.mts",
+      "import": "./dist/dev-env.mjs",
+      "require": "./dist/dev-env.cjs"
+    },
+    "./jest/template": {
+      "types": "./dist/jest-template.d.mts",
+      "import": "./dist/jest-template.mjs",
+      "require": "./dist/jest-template.cjs"
+    },
     "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public",
-    "tag": "alpha"
-  },
-  "scripts": {
-    "build": "vp pack",
-    "dev": "vp pack --watch",
-    "test": "vp test",
-    "check": "vp check",
-    "prepublishOnly": "vp pack",
-    "postinstall": "node scripts/postinstall.js",
-    "prepare": "vp config || true"
+    "tag": "beta"
   },
   "dependencies": {
     "pg": "^8.16.3"
@@ -83,8 +101,17 @@
     "@types/node": "^22.15.0",
     "@types/pg": "^8.15.4",
     "typescript": "^5.8.3",
+    "vite": "^8.2.0",
     "vite-plus": "^0.2.4"
   },
+  "peerDependencies": {
+    "vite": ">=8.0.0"
+  },
+  "peerDependenciesMeta": {
+    "vite": {
+      "optional": true
+    }
+  },
   "overrides": {
     "vite": "npm:@voidzero-dev/vite-plus-core@latest",
     "vitest": "4.1.9"
@@ -92,5 +119,11 @@
   "engines": {
     "node": ">=24"
   },
-  "packageManager": "pnpm@11.18.0"
-}
+  "scripts": {
+    "build": "vp pack",
+    "dev": "vp pack --watch",
+    "test": "vp test",
+    "check": "vp check",
+    "postinstall": "node scripts/postinstall.js"
+  }
+}

package/scripts/autopg-version

@@ -0,0 +1 @@
+v3.0.7

package/scripts/ci-install-autopg.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# Binary-only autopg install for CI (and postinstall when CEDAR_PG_INSTALL_AUTOPG=1).
+# Fetches pinned release, verifies attestation, installs binary — no pm2.
+# Version pin: scripts/autopg-version (override with AUTOPG_VERSION).
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [ -z "${AUTOPG_VERSION:-}" ]; then
+  AUTOPG_VERSION="$(tr -d '[:space:]' <"${SCRIPT_DIR}/autopg-version")"
+fi
+VERSION="${AUTOPG_VERSION}"
+REPO="${AUTOPG_REPO:-automagik-dev/autopg}"
+LEGACY_REPO="${AUTOPG_LEGACY_REPO:-namastexlabs/pgserve}"
+
+detect_libc() {
+  if [ -e /lib/ld-musl-x86_64.so.1 ] || (ldd --version 2>&1 | grep -qi musl); then
+    echo musl
+  else
+    echo glibc
+  fi
+}
+
+case "$(uname -s)-$(uname -m)" in
+  Linux-x86_64) PLATFORM="linux-x64-$(detect_libc)" ;;
+  Linux-aarch64) PLATFORM="linux-arm64" ;;
+  Darwin-arm64) PLATFORM="darwin-arm64" ;;
+  Darwin-x86_64) PLATFORM="darwin-x64" ;;
+  *)
+    echo "[ci-install-autopg] unsupported platform: $(uname -s)-$(uname -m)" >&2
+    exit 1
+    ;;
+esac
+
+if [ -x "${HOME}/.local/bin/autopg" ]; then
+  echo "[ci-install-autopg] already present: ${HOME}/.local/bin/autopg"
+  exit 0
+fi
+
+TARBALL="autopg-${VERSION#v}-${PLATFORM}.tar.gz"
+URL="https://github.com/${REPO}/releases/download/${VERSION}/${TARBALL}"
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+echo "[ci-install-autopg] fetching ${URL}"
+curl -fsSL --output "${TMP}/${TARBALL}" "${URL}"
+
+if ! command -v gh >/dev/null 2>&1; then
+  echo "[ci-install-autopg] gh CLI required for attestation verify" >&2
+  exit 1
+fi
+
+echo "[ci-install-autopg] verifying attestation"
+if ! gh attestation verify "${TMP}/${TARBALL}" --repo "${REPO}" \
+  && ! gh attestation verify "${TMP}/${TARBALL}" --repo "${LEGACY_REPO}"; then
+  echo "[ci-install-autopg] attestation verify failed" >&2
+  exit 1
+fi
+
+echo "[ci-install-autopg] extracting binary tree"
+tar -xzf "${TMP}/${TARBALL}" -C "${TMP}"
+SRC="${TMP}/autopg"
+if [ ! -x "${SRC}/autopg" ]; then
+  echo "[ci-install-autopg] unexpected tarball layout: ${SRC}/autopg missing" >&2
+  exit 1
+fi
+
+INSTALL_DIR="${HOME}/.local/share/autopg/${VERSION}"
+mkdir -p "${INSTALL_DIR}" "${HOME}/.local/bin"
+cp -a "${SRC}/." "${INSTALL_DIR}/"
+ln -sfn "${INSTALL_DIR}/autopg" "${HOME}/.local/bin/autopg"
+
+echo "[ci-install-autopg] ok — $(command -v autopg || echo "${HOME}/.local/bin/autopg")"
+"${HOME}/.local/bin/autopg" --help >/dev/null

package/scripts/postinstall.js

@@ -4,19 +4,23 @@
  * Idempotent across npm / yarn / pnpm. Never fails the parent install hard
  * when network is unavailable; prints a clear warning instead.
  *
- * Supply-chain: both the install script ref and the binary release are pinned.
- * Bump AUTOPG_VERSION (and the matching tag in INSTALL_URL) deliberately when
- * upgrading; do not track main/latest.
+ * Version pin: scripts/autopg-version (single source of truth).
+ *
+ * - Local / non-CI: pinned upstream install.sh (may start pm2).
+ * - CI + CEDAR_PG_INSTALL_AUTOPG=1: binary-only scripts/ci-install-autopg.sh
+ *   (attestation via gh; no pm2 — cedar-pg ephemeral host owns startup).
  */
 
 import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 
-/** Pinned autopg release tag. Bump intentionally for upgrades. */
-const AUTOPG_VERSION = "v3.0.7";
+const HERE = dirname(fileURLToPath(import.meta.url));
+const AUTOPG_VERSION = readFileSync(join(HERE, "autopg-version"), "utf8").trim();
 const INSTALL_URL = `https://raw.githubusercontent.com/automagik-dev/autopg/${AUTOPG_VERSION}/install.sh`;
+const CI_INSTALL = join(HERE, "ci-install-autopg.sh");
 
 function hasAutopg() {
   if (process.env.AUTOPG_BIN && existsSync(process.env.AUTOPG_BIN)) return true;
@@ -34,12 +38,34 @@ function main() {
     return;
   }
 
+  const inCi = process.env.CI === "true";
+  const forceCiInstall = process.env.CEDAR_PG_INSTALL_AUTOPG === "1";
+
   // Skip in CI unless explicitly requested; CI images often bake autopg
-  if (process.env.CI === "true" && process.env.CEDAR_PG_INSTALL_AUTOPG !== "1") {
+  // or run scripts/ci-install-autopg.sh from the workflow.
+  if (inCi && !forceCiInstall) {
     console.warn(
       "[cedarpg] autopg not found; CI detected, skip auto-install. " +
-        "Set CEDAR_PG_INSTALL_AUTOPG=1 or install autopg in the image.",
+        "Set CEDAR_PG_INSTALL_AUTOPG=1 or run scripts/ci-install-autopg.sh.",
+    );
+    return;
+  }
+
+  if (inCi && forceCiInstall) {
+    console.log(
+      `[cedarpg] autopg not found; CI binary install ${AUTOPG_VERSION} via ci-install-autopg.sh...`,
     );
+    const result = spawnSync("bash", [CI_INSTALL], {
+      stdio: "inherit",
+      env: { ...process.env, AUTOPG_VERSION },
+    });
+    if (result.status !== 0) {
+      console.warn(
+        "[cedarpg] CI binary install failed.\n" +
+          "  Run: bash scripts/ci-install-autopg.sh\n" +
+          "  (requires gh CLI + GH_TOKEN for attestation verify)",
+      );
+    }
     return;
   }
 

package/dist/constants-BY97wXjA.mjs

@@ -1,24 +0,0 @@
-//#region src/core/constants.ts
-/**
-* Product identity vs frozen crypto.
-*
-* State dirs follow the CLI name (`.cedarpg`): product-owned, not nested under
-* autopg's `~/.autopg/` (host owns that) and not a generic `.pg` (collision-prone).
-* Password salt is an opaque crypto constant; bump ROLE_PASSWORD_SCHEME to change it.
-*/
-/** User-facing CLI binary (`package.json` bin) and log prefix */
-const CLI_NAME = "cedarpg";
-/**
-* Worktree-local state dir and home-registry parent (`~/.cedarpg/registry`).
-* Frozen for lease/gc discovery after first alpha consumers appear.
-*/
-const STATE_DIRNAME = ".cedarpg";
-/**
-* Password scheme v1 salt prefix: sha256(`${PASSWORD_SALT_PREFIX}\0` + databaseName).
-* Opaque; independent of STATE_DIRNAME / CLI_NAME. Bump ROLE_PASSWORD_SCHEME to change.
-*/
-const PASSWORD_SALT_PREFIX = "cedar-pg";
-//#endregion
-export { PASSWORD_SALT_PREFIX as n, STATE_DIRNAME as r, CLI_NAME as t };
-
-//# sourceMappingURL=constants-BY97wXjA.mjs.map

package/dist/constants-BY97wXjA.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants-BY97wXjA.mjs","names":[],"sources":["../src/core/constants.ts"],"sourcesContent":["/**\n * Product identity vs frozen crypto.\n *\n * State dirs follow the CLI name (`.cedarpg`): product-owned, not nested under\n * autopg's `~/.autopg/` (host owns that) and not a generic `.pg` (collision-prone).\n * Password salt is an opaque crypto constant; bump ROLE_PASSWORD_SCHEME to change it.\n */\n\n/** User-facing CLI binary (`package.json` bin) and log prefix */\nexport const CLI_NAME = \"cedarpg\";\n\n/**\n * Worktree-local state dir and home-registry parent (`~/.cedarpg/registry`).\n * Frozen for lease/gc discovery after first alpha consumers appear.\n */\nexport const STATE_DIRNAME = \".cedarpg\";\n\n/**\n * Password scheme v1 salt prefix: sha256(`${PASSWORD_SALT_PREFIX}\\0` + databaseName).\n * Opaque; independent of STATE_DIRNAME / CLI_NAME. Bump ROLE_PASSWORD_SCHEME to change.\n */\nexport const PASSWORD_SALT_PREFIX = \"cedar-pg\";\n"],"mappings":";;;;;;;;;AASA,MAAa,WAAW;;;;;AAMxB,MAAa,gBAAgB;;;;;AAM7B,MAAa,uBAAuB"}

package/dist/constants-CNZn5Xro.cjs

@@ -1,41 +0,0 @@
-//#region src/core/constants.ts
-/**
-* Product identity vs frozen crypto.
-*
-* State dirs follow the CLI name (`.cedarpg`): product-owned, not nested under
-* autopg's `~/.autopg/` (host owns that) and not a generic `.pg` (collision-prone).
-* Password salt is an opaque crypto constant; bump ROLE_PASSWORD_SCHEME to change it.
-*/
-/** User-facing CLI binary (`package.json` bin) and log prefix */
-const CLI_NAME = "cedarpg";
-/**
-* Worktree-local state dir and home-registry parent (`~/.cedarpg/registry`).
-* Frozen for lease/gc discovery after first alpha consumers appear.
-*/
-const STATE_DIRNAME = ".cedarpg";
-/**
-* Password scheme v1 salt prefix: sha256(`${PASSWORD_SALT_PREFIX}\0` + databaseName).
-* Opaque; independent of STATE_DIRNAME / CLI_NAME. Bump ROLE_PASSWORD_SCHEME to change.
-*/
-const PASSWORD_SALT_PREFIX = "cedar-pg";
-//#endregion
-Object.defineProperty(exports, "CLI_NAME", {
-	enumerable: true,
-	get: function() {
-		return CLI_NAME;
-	}
-});
-Object.defineProperty(exports, "PASSWORD_SALT_PREFIX", {
-	enumerable: true,
-	get: function() {
-		return PASSWORD_SALT_PREFIX;
-	}
-});
-Object.defineProperty(exports, "STATE_DIRNAME", {
-	enumerable: true,
-	get: function() {
-		return STATE_DIRNAME;
-	}
-});
-
-//# sourceMappingURL=constants-CNZn5Xro.cjs.map

package/dist/constants-CNZn5Xro.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants-CNZn5Xro.cjs","names":[],"sources":["../src/core/constants.ts"],"sourcesContent":["/**\n * Product identity vs frozen crypto.\n *\n * State dirs follow the CLI name (`.cedarpg`): product-owned, not nested under\n * autopg's `~/.autopg/` (host owns that) and not a generic `.pg` (collision-prone).\n * Password salt is an opaque crypto constant; bump ROLE_PASSWORD_SCHEME to change it.\n */\n\n/** User-facing CLI binary (`package.json` bin) and log prefix */\nexport const CLI_NAME = \"cedarpg\";\n\n/**\n * Worktree-local state dir and home-registry parent (`~/.cedarpg/registry`).\n * Frozen for lease/gc discovery after first alpha consumers appear.\n */\nexport const STATE_DIRNAME = \".cedarpg\";\n\n/**\n * Password scheme v1 salt prefix: sha256(`${PASSWORD_SALT_PREFIX}\\0` + databaseName).\n * Opaque; independent of STATE_DIRNAME / CLI_NAME. Bump ROLE_PASSWORD_SCHEME to change.\n */\nexport const PASSWORD_SALT_PREFIX = \"cedar-pg\";\n"],"mappings":";;;;;;;;;AASA,MAAa,WAAW;;;;;AAMxB,MAAa,gBAAgB;;;;;AAM7B,MAAa,uBAAuB"}