@supatype/cli 0.1.0-alpha.10

package/src/cli.ts

@@ -0,0 +1,63 @@
+import { Command } from "commander"
+import { registerInit } from "./commands/init.js"
+import { registerDev } from "./commands/dev.js"
+import { registerCache } from "./commands/cache.js"
+import { registerUpdate } from "./commands/update.js"
+import { registerPg } from "./commands/pg.js"
+import { registerPush } from "./commands/push.js"
+import { registerDiff } from "./commands/diff.js"
+import { registerPull } from "./commands/pull.js"
+import { registerGenerate } from "./commands/generate.js"
+import { registerMigrate } from "./commands/migrate.js"
+import { registerSeed } from "./commands/seed.js"
+import { registerKeys } from "./commands/keys.js"
+import { registerApp } from "./commands/app.js"
+import { registerSelfHost } from "./commands/self-host.js"
+import { registerCloud } from "./commands/cloud.js"
+import { registerEngine } from "./commands/engine.js"
+import { registerDb } from "./commands/db.js"
+import { registerDeploy } from "./commands/deploy.js"
+import { registerStatus } from "./commands/status.js"
+import { registerLogs } from "./commands/logs.js"
+import { registerAdmin } from "./commands/admin.js"
+import { registerFunctions } from "./commands/functions.js"
+import { registerPlugins } from "./commands/plugins.js"
+import { registerTypes } from "./commands/types.js"
+import { registerMigrateFromV1 } from "./commands/migrate-from-v1.js"
+import { registerSelfUpdate } from "./commands/self-update.js"
+
+export function run(): void {
+  const program = new Command()
+    .name("supatype")
+    .description("Supatype — schema-first Postgres API")
+    .version("0.1.0")
+
+  registerInit(program)
+  registerDev(program)
+  registerCache(program)
+  registerSelfUpdate(program)
+  registerUpdate(program)
+  registerPg(program)
+  registerPush(program)
+  registerDiff(program)
+  registerPull(program)
+  registerGenerate(program)
+  registerMigrate(program)
+  registerSeed(program)
+  registerKeys(program)
+  registerApp(program)
+  registerSelfHost(program)
+  registerCloud(program)
+  registerEngine(program)
+  registerDb(program)
+  registerDeploy(program)
+  registerStatus(program)
+  registerLogs(program)
+  registerAdmin(program)
+  registerFunctions(program)
+  registerPlugins(program)
+  registerTypes(program)
+  registerMigrateFromV1(program)
+
+  program.parse()
+}

package/src/commands/admin.ts

@@ -0,0 +1,372 @@
+// ─── Admin panel CLI commands (Gap Appendices task 48) ──────────────────────
+//
+// `npx supatype admin create-user` — create an admin user in the project's
+// {ref}_auth.users table. Used for initial setup and ongoing admin management.
+
+import type { Command } from "commander"
+import { createInterface } from "node:readline"
+import { randomBytes, scrypt } from "node:crypto"
+import { promisify } from "node:util"
+import { loadConfig } from "../config.js"
+import { connectionString } from "../project-config.js"
+import { signJwt } from "../jwt.js"
+
+const scryptAsync = promisify(scrypt)
+
+export function registerAdmin(program: Command): void {
+  const adminCmd = program
+    .command("admin")
+    .description("Manage admin panel users and configuration")
+
+  adminCmd
+    .command("create-user")
+    .description("Create an admin user for the admin panel")
+    .option("--email <email>", "Admin user email address")
+    .option("--password <password>", "Admin user password (prompted if not provided)")
+    .option("--role <role>", "Admin role to assign", "admin")
+    .option("--connection <url>", "Database connection URL (overrides config)")
+    .action(
+      async (opts: {
+        email?: string
+        password?: string
+        role: string
+        connection?: string
+      }) => {
+        const cwd = process.cwd()
+        const config = loadConfig(cwd)
+        const connection = opts.connection ?? connectionString(config)
+
+        const email = opts.email ?? (await prompt("Admin email: "))
+        if (!email || !email.includes("@")) {
+          console.error("A valid email address is required.")
+          process.exit(1)
+        }
+
+        const password =
+          opts.password ?? (await prompt("Admin password (min 8 chars): "))
+        if (!password || password.length < 8) {
+          console.error("Password must be at least 8 characters.")
+          process.exit(1)
+        }
+
+        const role = opts.role
+
+        console.log(`\nCreating admin user: ${email} (role: ${role})...`)
+
+        // We use pg directly to insert into the auth.users table
+        const pg = await importPg()
+        const pool = new pg.Pool({ connectionString: connection, max: 2 })
+
+        try {
+          // Ensure the auth schema and users table exist
+          await pool.query(`
+            CREATE SCHEMA IF NOT EXISTS auth;
+
+            CREATE TABLE IF NOT EXISTS auth.users (
+              id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+              instance_id   UUID,
+              aud           TEXT DEFAULT 'authenticated',
+              role          TEXT DEFAULT 'authenticated',
+              email         TEXT UNIQUE,
+              encrypted_password TEXT,
+              email_confirmed_at TIMESTAMPTZ DEFAULT now(),
+              raw_app_meta_data  JSONB DEFAULT '{}',
+              raw_user_meta_data JSONB DEFAULT '{}',
+              created_at    TIMESTAMPTZ DEFAULT now(),
+              updated_at    TIMESTAMPTZ DEFAULT now(),
+              confirmation_token TEXT DEFAULT '',
+              recovery_token TEXT DEFAULT '',
+              email_change_token_new TEXT DEFAULT '',
+              email_change  TEXT DEFAULT ''
+            );
+          `)
+
+          // Check if user already exists
+          const existing = await pool.query(
+            `SELECT id FROM auth.users WHERE email = $1`,
+            [email.toLowerCase()],
+          )
+
+          if (existing.rows.length > 0) {
+            console.error(
+              `\nUser with email "${email}" already exists.`,
+            )
+            console.log(
+              `To update their role, use: supatype admin set-role --email ${email} --role ${role}`,
+            )
+            process.exit(1)
+          }
+
+          // Hash the password (bcrypt-style for GoTrue compatibility)
+          const passwordHash = await hashPassword(password)
+
+          // Insert the admin user with the admin role in app_metadata
+          const appMetadata = JSON.stringify({ role, provider: "email", providers: ["email"] })
+          const userMetadata = JSON.stringify({})
+
+          const result = await pool.query(
+            `INSERT INTO auth.users (
+              email, encrypted_password, role, aud,
+              raw_app_meta_data, raw_user_meta_data,
+              email_confirmed_at, created_at, updated_at
+            ) VALUES (
+              $1, $2, 'authenticated', 'authenticated',
+              $3::jsonb, $4::jsonb,
+              now(), now(), now()
+            ) RETURNING id, email`,
+            [email.toLowerCase(), passwordHash, appMetadata, userMetadata],
+          )
+
+          const user = result.rows[0] as { id: string; email: string }
+
+          console.log(`\nAdmin user created successfully.`)
+          console.log(`  ID:    ${user.id}`)
+          console.log(`  Email: ${user.email}`)
+          console.log(`  Role:  ${role}`)
+          console.log(
+            `\nThis user can now log in to the admin panel at /admin\n`,
+          )
+        } catch (err) {
+          const message =
+            err instanceof Error ? err.message : "Unknown error"
+          console.error(`\nFailed to create admin user: ${message}`)
+          process.exit(1)
+        } finally {
+          await pool.end()
+        }
+      },
+    )
+
+  adminCmd
+    .command("set-role")
+    .description("Change an existing user's admin role")
+    .requiredOption("--email <email>", "User email address")
+    .requiredOption("--role <role>", "New role to assign")
+    .option("--connection <url>", "Database connection URL (overrides config)")
+    .action(
+      async (opts: { email: string; role: string; connection?: string }) => {
+        const cwd = process.cwd()
+        const config = loadConfig(cwd)
+        const connection = opts.connection ?? connectionString(config)
+
+        const pg = await importPg()
+        const pool = new pg.Pool({ connectionString: connection, max: 2 })
+
+        try {
+          const result = await pool.query(
+            `UPDATE auth.users
+             SET raw_app_meta_data = raw_app_meta_data || $1::jsonb,
+                 updated_at = now()
+             WHERE email = $2
+             RETURNING id, email, raw_app_meta_data`,
+            [JSON.stringify({ role: opts.role }), opts.email.toLowerCase()],
+          )
+
+          if (result.rows.length === 0) {
+            console.error(`\nNo user found with email "${opts.email}".`)
+            process.exit(1)
+          }
+
+          const user = result.rows[0] as {
+            id: string
+            email: string
+            raw_app_meta_data: Record<string, unknown>
+          }
+
+          console.log(`\nRole updated successfully.`)
+          console.log(`  ID:    ${user.id}`)
+          console.log(`  Email: ${user.email}`)
+          console.log(`  Role:  ${opts.role}\n`)
+        } catch (err) {
+          const message =
+            err instanceof Error ? err.message : "Unknown error"
+          console.error(`\nFailed to update role: ${message}`)
+          process.exit(1)
+        } finally {
+          await pool.end()
+        }
+      },
+    )
+
+  adminCmd
+    .command("list-users")
+    .description("List users with admin roles")
+    .option("--connection <url>", "Database connection URL (overrides config)")
+    .action(async (opts: { connection?: string }) => {
+      const cwd = process.cwd()
+      const config = loadConfig(cwd)
+      const connection = opts.connection ?? connectionString(config)
+
+      const pg = await importPg()
+      const pool = new pg.Pool({ connectionString: connection, max: 2 })
+
+      try {
+        const result = await pool.query(
+          `SELECT id, email, raw_app_meta_data->>'role' as role, created_at
+           FROM auth.users
+           WHERE raw_app_meta_data->>'role' IS NOT NULL
+             AND raw_app_meta_data->>'role' != 'authenticated'
+           ORDER BY created_at ASC`,
+        )
+
+        if (result.rows.length === 0) {
+          console.log("\nNo admin users found.")
+          console.log(
+            "Create one with: supatype admin create-user --email admin@example.com --role admin\n",
+          )
+          return
+        }
+
+        console.log(
+          "\n  ID                                     Email                          Role         Created",
+        )
+        console.log("  " + "-".repeat(100))
+        for (const row of result.rows) {
+          const r = row as {
+            id: string
+            email: string
+            role: string
+            created_at: string
+          }
+          const date = new Date(r.created_at).toISOString().slice(0, 10)
+          console.log(
+            `  ${r.id}  ${r.email.padEnd(30)} ${r.role.padEnd(12)} ${date}`,
+          )
+        }
+        console.log()
+      } catch (err) {
+        const message =
+          err instanceof Error ? err.message : "Unknown error"
+        console.error(`\nFailed to list admin users: ${message}`)
+        process.exit(1)
+      } finally {
+        await pool.end()
+      }
+    })
+}
+
+// ─── First admin user prompt (task 48) ──────────────────────────────────────
+// Called by `supatype push` on initial setup if no admin users exist.
+
+export async function promptFirstAdminUser(
+  connection: string,
+): Promise<void> {
+  const pg = await importPg()
+  const pool = new pg.Pool({ connectionString: connection, max: 2 })
+
+  try {
+    // Check if auth.users table exists
+    const tableExists = await pool.query(
+      `SELECT EXISTS (
+        SELECT FROM information_schema.tables
+        WHERE table_schema = 'auth' AND table_name = 'users'
+      ) as exists`,
+    )
+    if (!tableExists.rows[0]?.exists) return
+
+    // Check if any admin users exist
+    const adminCount = await pool.query(
+      `SELECT COUNT(*) as count FROM auth.users
+       WHERE raw_app_meta_data->>'role' IS NOT NULL
+         AND raw_app_meta_data->>'role' != 'authenticated'`,
+    )
+
+    const count = parseInt(
+      (adminCount.rows[0] as { count: string }).count,
+      10,
+    )
+    if (count > 0) return
+
+    // No admin users — prompt to create one
+    console.log("\n  No admin users found for the admin panel.")
+    const createAdmin = await confirm(
+      "  Create an admin user now? [y/N] ",
+    )
+    if (!createAdmin) {
+      console.log(
+        "  Skipped. You can create one later with: supatype admin create-user\n",
+      )
+      return
+    }
+
+    const email = await prompt("  Admin email: ")
+    if (!email || !email.includes("@")) {
+      console.log("  Invalid email. Skipping admin user creation.\n")
+      return
+    }
+
+    const password = await prompt(
+      "  Admin password (min 8 chars): ",
+    )
+    if (!password || password.length < 8) {
+      console.log(
+        "  Password too short. Skipping admin user creation.\n",
+      )
+      return
+    }
+
+    const passwordHash = await hashPassword(password)
+    const appMetadata = JSON.stringify({
+      role: "admin",
+      provider: "email",
+      providers: ["email"],
+    })
+
+    await pool.query(
+      `INSERT INTO auth.users (
+        email, encrypted_password, role, aud,
+        raw_app_meta_data, raw_user_meta_data,
+        email_confirmed_at, created_at, updated_at
+      ) VALUES (
+        $1, $2, 'authenticated', 'authenticated',
+        $3::jsonb, '{}'::jsonb,
+        now(), now(), now()
+      )`,
+      [email.toLowerCase(), passwordHash, appMetadata],
+    )
+
+    console.log(`\n  Admin user "${email}" created (role: admin).`)
+    console.log(`  Log in at /admin after starting the dev server.\n`)
+  } catch {
+    // Non-fatal — if auth schema doesn't exist yet, skip silently
+  } finally {
+    await pool.end()
+  }
+}
+
+// ─── Helpers ────────────────────────────────────────────────────────────────────
+
+async function importPg(): Promise<typeof import("pg")> {
+  try {
+    return await import("pg")
+  } catch {
+    console.error(
+      "pg package is required for admin commands. Install it with: pnpm add pg",
+    )
+    process.exit(1)
+  }
+}
+
+async function hashPassword(password: string): Promise<string> {
+  const salt = randomBytes(16).toString("hex")
+  const derived = (await scryptAsync(password, salt, 64)) as Buffer
+  return `${salt}:${derived.toString("hex")}`
+}
+
+function prompt(question: string): Promise<string> {
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  })
+  return new Promise((resolve) => {
+    rl.question(question, (answer) => {
+      rl.close()
+      resolve(answer.trim())
+    })
+  })
+}
+
+async function confirm(question: string): Promise<boolean> {
+  const answer = await prompt(question)
+  return answer.toLowerCase() === "y"
+}

package/src/commands/app.ts

@@ -0,0 +1,97 @@
+import type { Command } from "commander"
+import { existsSync, mkdirSync } from "node:fs"
+import { resolve } from "node:path"
+import { localKongBaseUrl } from "../local-gateway.js"
+import { updateAppConfigInProject } from "../app-config.js"
+
+export function registerApp(program: Command): void {
+  const appCmd = program
+    .command("app")
+    .description("Manage application routing intent in supatype.config.ts")
+
+  appCmd
+    .command("add [dir]")
+    .description("Configure app routing: --static for a built site, or proxy to a dev server")
+    .option("--static", "Serve a static directory at / (default: ./public, or [dir] argument)")
+    .option("--port <port>", "Port your app listens on (proxy mode)", "3000")
+    .option("--upstream <url>", "Explicit upstream URL (proxy mode; defaults to localhost:<port>)")
+    .option("--dockerfile <path>", "(deprecated) ignored — use supatype.config.ts")
+    .action(
+      (
+        dir: string | undefined,
+        opts: {
+          static?: boolean
+          port: string
+          upstream?: string
+          dockerfile?: string
+        },
+      ) => {
+        if (opts.static) {
+          addStaticApp(process.cwd(), resolveStaticDir(dir))
+          return
+        }
+        if (opts.dockerfile) {
+          console.warn("[supatype] --dockerfile is deprecated and ignored.")
+        }
+        addProxyApp(process.cwd(), opts.port, opts.upstream)
+      },
+    )
+
+  appCmd
+    .command("remove")
+    .description("Set app.mode=none in supatype.config.ts")
+    .action(() => {
+      removeApp(process.cwd())
+    })
+}
+
+// ─── Implementation ───────────────────────────────────────────────────────────
+
+function resolveStaticDir(dir?: string): string {
+  const trimmed = dir?.trim()
+  return trimmed && trimmed.length > 0 ? trimmed : "./public"
+}
+
+function addStaticApp(cwd: string, staticDir: string): void {
+  const abs = resolve(cwd, staticDir)
+  if (!existsSync(abs)) {
+    mkdirSync(abs, { recursive: true })
+    console.log(`  created  ${staticDir}/`)
+  }
+  try {
+    const configPath = updateAppConfigInProject(cwd, { mode: "static", staticDir })
+    console.log(`  updated  ${configPath}`)
+    console.log(`\nStatic app directory: ${staticDir}`)
+    console.log(`Build your frontend into ${staticDir}/, then:`)
+    console.log(`  supatype self-host compose render`)
+    console.log(`  supatype self-host compose up -d`)
+    console.log(`\nYour app will be served at ${localKongBaseUrl()}/\n`)
+  } catch (err) {
+    console.error((err as Error).message)
+    process.exit(1)
+  }
+}
+
+function addProxyApp(cwd: string, port: string, upstream?: string): void {
+  const upstreamUrl = upstream?.trim() || `http://localhost:${port}`
+  try {
+    const configPath = updateAppConfigInProject(cwd, { mode: "proxy", upstream: upstreamUrl })
+    console.log(`  updated  ${configPath}`)
+    console.log(`\nApp upstream set to ${upstreamUrl}. The app will be available at ${localKongBaseUrl()}/\n`)
+    console.log("Run: supatype self-host compose render")
+  } catch (err) {
+    console.error((err as Error).message)
+    process.exit(1)
+  }
+}
+
+function removeApp(cwd: string): void {
+  try {
+    const configPath = updateAppConfigInProject(cwd, { mode: "none" })
+    console.log(`  updated  ${configPath}`)
+    console.log("\nApp routing disabled (app.mode=none).\n")
+  } catch (err) {
+    console.error((err as Error).message)
+    process.exit(1)
+  }
+}

package/src/commands/cache.ts

@@ -0,0 +1,117 @@
+/**
+ * supatype cache — list and clean cached component binaries.
+ */
+
+import type { Command } from "commander"
+import { existsSync, readdirSync, rmSync, statSync } from "node:fs"
+import { join } from "node:path"
+import { cacheRoot, type Component } from "../binary-cache.js"
+
+const COMPONENTS: Component[] = ["engine", "server", "postgres", "deno"]
+
+export function registerCache(program: Command): void {
+  const cache = program
+    .command("cache")
+    .description("Manage cached component binaries")
+
+  cache
+    .command("list")
+    .description("List cached component binaries and their sizes")
+    .action(() => {
+      const root = cacheRoot()
+      if (!existsSync(root)) {
+        console.log("Cache is empty.")
+        return
+      }
+
+      let totalBytes = 0
+      let found = false
+
+      for (const component of COMPONENTS) {
+        const compDir = join(root, component)
+        if (!existsSync(compDir)) continue
+
+        const versions = readdirSync(compDir).filter(
+          (v) => statSync(join(compDir, v)).isDirectory(),
+        )
+        for (const version of versions) {
+          const vDir = join(compDir, version)
+          const size = dirSize(vDir)
+          totalBytes += size
+          found = true
+          console.log(`  ${component}@${version}  ${formatBytes(size)}`)
+        }
+      }
+
+      if (!found) {
+        console.log("Cache is empty.")
+        return
+      }
+
+      console.log(`\nTotal: ${formatBytes(totalBytes)}`)
+      console.log(`Cache root: ${root}`)
+    })
+
+  cache
+    .command("clean [component] [version]")
+    .description(
+      "Remove cached binaries. Optionally specify a component and/or version.\n" +
+        "Examples:\n" +
+        "  supatype cache clean           # remove everything\n" +
+        "  supatype cache clean engine    # remove all engine versions\n" +
+        "  supatype cache clean engine 0.4.2",
+    )
+    .action((component?: string, version?: string) => {
+      const root = cacheRoot()
+      if (!existsSync(root)) {
+        console.log("Cache is already empty.")
+        return
+      }
+
+      const targets = component ? [component as Component] : COMPONENTS
+
+      for (const comp of targets) {
+        const compDir = join(root, comp)
+        if (!existsSync(compDir)) continue
+
+        if (version) {
+          const vDir = join(compDir, version)
+          if (!existsSync(vDir)) {
+            console.log(`  ${comp}@${version} not cached.`)
+            continue
+          }
+          rmSync(vDir, { recursive: true, force: true })
+          console.log(`  removed  ${comp}@${version}`)
+        } else {
+          rmSync(compDir, { recursive: true, force: true })
+          console.log(`  removed  ${comp} (all versions)`)
+        }
+      }
+
+      console.log("Done.")
+    })
+}
+
+function dirSize(dir: string): number {
+  let total = 0
+  try {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const full = join(dir, entry.name)
+      if (entry.isDirectory()) {
+        total += dirSize(full)
+      } else {
+        total += statSync(full).size
+      }
+    }
+  } catch {
+    // Skip unreadable entries.
+  }
+  return total
+}
+
+function formatBytes(bytes: number): string {
+  if (bytes < 1024) return `${bytes} B`
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`
+  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`
+}