@supatype/cli 0.1.0-alpha.6 → 0.1.0-alpha.7

package/dist/release-pins.js

@@ -0,0 +1,27 @@
+/**
+ * Release pins read from files under packages/cli/releases/.
+ * CI (deno-releases workflow) uses the same paths — bump only releases/deno/VERSION.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const CLI_PACKAGE_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+function readPinFile(...segments) {
+    const path = join(CLI_PACKAGE_ROOT, "releases", ...segments);
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch {
+        throw new Error(`Missing release pin file: ${path}\n` +
+            "Expected packages/cli/releases/… — reinstall @supatype/cli or build from the monorepo.");
+    }
+    const version = raw.trim();
+    if (!/^\d+\.\d+\.\d+/.test(version)) {
+        throw new Error(`Invalid pin in ${path}: expected semver like 2.2.0, got ${JSON.stringify(raw)}`);
+    }
+    return version;
+}
+/** Pinned Deno runtime for edge functions (also published to CDN under /deno/v{version}/). */
+export const DENO_RELEASE_PIN = readPinFile("deno", "VERSION");
+//# sourceMappingURL=release-pins.js.map

package/dist/release-pins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-pins.js","sourceRoot":"","sources":["../src/release-pins.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;AAE5E,SAAS,WAAW,CAAC,GAAG,QAAkB;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,CAAA;IAC5D,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,IAAI;YACnC,wFAAwF,CAC3F,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,qCAAqC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACnG,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA"}

package/dist/release-public-key.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Minisign public key for CDN release verification.
+ * Populated at publish via scripts/embed-release-pubkey.mjs (MINISIGN_PUBLIC_KEY secret),
+ * or overridden at runtime with SUPATYPE_RELEASE_PUBLIC_KEY.
+ */
+export declare const EMBEDDED_RELEASE_PUBLIC_KEY = "untrusted comment: minisign public key DE133E99689AE71D\nRWQd55pomT4T3t+5FLZZ6+h0DoHrtiuU9RBUHHm9BcFHeGRvW7BXxBCr";
+export declare function releasePublicKey(): string;
+//# sourceMappingURL=release-public-key.d.ts.map

package/dist/release-public-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-public-key.d.ts","sourceRoot":"","sources":["../src/release-public-key.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,sHAAsH,CAAA;AAE9J,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC"}

package/dist/release-public-key.js

@@ -0,0 +1,13 @@
+/**
+ * Minisign public key for CDN release verification.
+ * Populated at publish via scripts/embed-release-pubkey.mjs (MINISIGN_PUBLIC_KEY secret),
+ * or overridden at runtime with SUPATYPE_RELEASE_PUBLIC_KEY.
+ */
+export const EMBEDDED_RELEASE_PUBLIC_KEY = "untrusted comment: minisign public key DE133E99689AE71D\nRWQd55pomT4T3t+5FLZZ6+h0DoHrtiuU9RBUHHm9BcFHeGRvW7BXxBCr";
+export function releasePublicKey() {
+    const fromEnv = process.env["SUPATYPE_RELEASE_PUBLIC_KEY"]?.trim();
+    if (fromEnv)
+        return fromEnv;
+    return EMBEDDED_RELEASE_PUBLIC_KEY.trim();
+}
+//# sourceMappingURL=release-public-key.js.map

package/dist/release-public-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-public-key.js","sourceRoot":"","sources":["../src/release-public-key.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,mHAAmH,CAAA;AAE9J,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,IAAI,EAAE,CAAA;IAClE,IAAI,OAAO;QAAE,OAAO,OAAO,CAAA;IAC3B,OAAO,2BAA2B,CAAC,IAAI,EAAE,CAAA;AAC3C,CAAC"}

package/dist/runtime-routes.d.ts

@@ -0,0 +1,25 @@
+export interface RuntimeRoute {
+    name: string;
+    serviceName: string;
+    serviceUrl: string;
+    paths: string[];
+    stripPath?: boolean;
+    protocols?: string[];
+    engineProtected?: boolean;
+}
+export interface RuntimeRouteOptions {
+    appUpstream?: string;
+    staticAppServiceUrl?: string;
+    /** Compose self-host: supatype-server container (functions proxy). */
+    functionsServiceUrl?: string;
+    /**
+     * Self-host Compose: Kong forwards API traffic to supatype-server (unified gateway),
+     * which proxies to internal services — same model as `supatype dev`.
+     */
+    unifiedGateway?: boolean;
+}
+/**
+ * Shared route contract used by local/self-host renderers.
+ */
+export declare function runtimeRouteSpec(opts?: RuntimeRouteOptions): RuntimeRoute[];
+//# sourceMappingURL=runtime-routes.d.ts.map

package/dist/runtime-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-routes.d.ts","sourceRoot":"","sources":["../src/runtime-routes.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AA2LD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,mBAAwB,GAAG,YAAY,EAAE,CAK/E"}

package/dist/runtime-routes.js

@@ -0,0 +1,189 @@
+const SERVER_GATEWAY = "http://server:9999";
+/**
+ * Kong routes when self-host uses supatype-server as the single API gateway.
+ */
+function runtimeRouteSpecUnified() {
+    return [
+        {
+            name: "rest-v1",
+            serviceName: "supatype-server-rest",
+            serviceUrl: SERVER_GATEWAY,
+            paths: ["/rest/v1/"],
+            stripPath: false,
+        },
+        {
+            name: "auth-v1",
+            serviceName: "supatype-server-auth",
+            serviceUrl: SERVER_GATEWAY,
+            paths: ["/auth/v1/"],
+            stripPath: false,
+        },
+        {
+            name: "admin-v1",
+            serviceName: "supatype-server-admin",
+            serviceUrl: SERVER_GATEWAY,
+            paths: ["/admin/v1/"],
+            stripPath: false,
+        },
+        {
+            name: "storage-v1",
+            serviceName: "supatype-server-storage",
+            serviceUrl: SERVER_GATEWAY,
+            paths: ["/storage/v1/"],
+            stripPath: false,
+        },
+        {
+            name: "realtime-v1",
+            serviceName: "supatype-server-realtime",
+            serviceUrl: SERVER_GATEWAY,
+            paths: ["/realtime/v1/"],
+            stripPath: false,
+            protocols: ["http", "https", "ws", "wss"],
+        },
+        {
+            name: "functions-v1",
+            serviceName: "supatype-server-functions",
+            serviceUrl: SERVER_GATEWAY,
+            paths: ["/functions/v1/"],
+            stripPath: false,
+        },
+        {
+            name: "graphql-v1",
+            serviceName: "supatype-server-graphql",
+            serviceUrl: SERVER_GATEWAY,
+            paths: ["/graphql/v1/"],
+            stripPath: false,
+        },
+        {
+            name: "studio-config-route",
+            serviceName: "supatype-server-studio-config",
+            serviceUrl: SERVER_GATEWAY,
+            paths: ["/studio-config"],
+            stripPath: false,
+        },
+        {
+            name: "sql-route",
+            serviceName: "supatype-server-sql",
+            serviceUrl: SERVER_GATEWAY,
+            paths: ["/sql"],
+            stripPath: false,
+        },
+        {
+            name: "studio",
+            serviceName: "studio",
+            serviceUrl: "http://studio:3002",
+            paths: ["/studio/"],
+            stripPath: true,
+        },
+        {
+            name: "app-root",
+            serviceName: "supatype-server-app",
+            serviceUrl: SERVER_GATEWAY,
+            paths: ["/"],
+            stripPath: false,
+        },
+    ];
+}
+/**
+ * Legacy split-stack routes (PostgREST/storage/realtime directly from Kong).
+ * Kept for tests or explicit opt-out only — self-host uses unifiedGateway.
+ */
+function runtimeRouteSpecSplit(opts) {
+    const routes = [
+        {
+            name: "rest-v1",
+            serviceName: "rest-v1",
+            serviceUrl: "http://postgrest:3000",
+            paths: ["/rest/v1/"],
+            stripPath: true,
+        },
+        {
+            name: "auth-v1",
+            serviceName: "auth-v1",
+            serviceUrl: "http://server:9999",
+            paths: ["/auth/v1/"],
+            stripPath: true,
+        },
+        {
+            name: "admin-v1",
+            serviceName: "admin-v1",
+            serviceUrl: "http://server:9999",
+            paths: ["/admin/v1/"],
+            stripPath: false,
+        },
+        {
+            name: "storage-v1",
+            serviceName: "storage-v1",
+            serviceUrl: "http://storage:5000",
+            paths: ["/storage/v1/"],
+            stripPath: true,
+        },
+        {
+            name: "realtime-v1",
+            serviceName: "realtime-v1",
+            serviceUrl: "http://realtime:4000",
+            paths: ["/realtime/v1/"],
+            stripPath: true,
+            protocols: ["http", "https", "ws", "wss"],
+        },
+        {
+            name: "functions-v1",
+            serviceName: "functions-v1",
+            serviceUrl: opts.functionsServiceUrl?.trim() || "http://server:9999",
+            paths: ["/functions/v1/"],
+            stripPath: false,
+        },
+        {
+            name: "studio",
+            serviceName: "studio",
+            serviceUrl: "http://studio:3002",
+            paths: ["/studio/"],
+            stripPath: true,
+        },
+        {
+            name: "studio-config-route",
+            serviceName: "engine-studio-config",
+            serviceUrl: "http://engine:7500",
+            paths: ["/studio-config"],
+            engineProtected: true,
+        },
+        {
+            name: "sql-route",
+            serviceName: "engine-sql",
+            serviceUrl: "http://engine:7500",
+            paths: ["/sql"],
+            engineProtected: true,
+        },
+    ];
+    const staticServiceUrl = opts.staticAppServiceUrl?.trim();
+    if (staticServiceUrl && staticServiceUrl.length > 0) {
+        routes.push({
+            name: "app-root",
+            serviceName: "app-root",
+            serviceUrl: staticServiceUrl,
+            paths: ["/"],
+            stripPath: false,
+        });
+        return routes;
+    }
+    if (opts.appUpstream && opts.appUpstream.trim().length > 0) {
+        routes.push({
+            name: "app-root",
+            serviceName: "app-root",
+            serviceUrl: opts.appUpstream.trim(),
+            paths: ["/"],
+            stripPath: false,
+        });
+    }
+    return routes;
+}
+/**
+ * Shared route contract used by local/self-host renderers.
+ */
+export function runtimeRouteSpec(opts = {}) {
+    if (opts.unifiedGateway) {
+        return runtimeRouteSpecUnified();
+    }
+    return runtimeRouteSpecSplit(opts);
+}
+//# sourceMappingURL=runtime-routes.js.map

package/dist/runtime-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-routes.js","sourceRoot":"","sources":["../src/runtime-routes.ts"],"names":[],"mappings":"AAsBA,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAE3C;;GAEG;AACH,SAAS,uBAAuB;IAC9B,OAAO;QACL;YACE,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,sBAAsB;YACnC,UAAU,EAAE,cAAc;YAC1B,KAAK,EAAE,CAAC,WAAW,CAAC;YACpB,SAAS,EAAE,KAAK;SACjB;QACD;YACE,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,sBAAsB;YACnC,UAAU,EAAE,cAAc;YAC1B,KAAK,EAAE,CAAC,WAAW,CAAC;YACpB,SAAS,EAAE,KAAK;SACjB;QACD;YACE,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,uBAAuB;YACpC,UAAU,EAAE,cAAc;YAC1B,KAAK,EAAE,CAAC,YAAY,CAAC;YACrB,SAAS,EAAE,KAAK;SACjB;QACD;YACE,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,yBAAyB;YACtC,UAAU,EAAE,cAAc;YAC1B,KAAK,EAAE,CAAC,cAAc,CAAC;YACvB,SAAS,EAAE,KAAK;SACjB;QACD;YACE,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,0BAA0B;YACvC,UAAU,EAAE,cAAc;YAC1B,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC;SAC1C;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,2BAA2B;YACxC,UAAU,EAAE,cAAc;YAC1B,KAAK,EAAE,CAAC,gBAAgB,CAAC;YACzB,SAAS,EAAE,KAAK;SACjB;QACD;YACE,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,yBAAyB;YACtC,UAAU,EAAE,cAAc;YAC1B,KAAK,EAAE,CAAC,cAAc,CAAC;YACvB,SAAS,EAAE,KAAK;SACjB;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,+BAA+B;YAC5C,UAAU,EAAE,cAAc;YAC1B,KAAK,EAAE,CAAC,gBAAgB,CAAC;YACzB,SAAS,EAAE,KAAK;SACjB;QACD;YACE,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,qBAAqB;YAClC,UAAU,EAAE,cAAc;YAC1B,KAAK,EAAE,CAAC,MAAM,CAAC;YACf,SAAS,EAAE,KAAK;SACjB;QACD;YACE,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,oBAAoB;YAChC,KAAK,EAAE,CAAC,UAAU,CAAC;YACnB,SAAS,EAAE,IAAI;SAChB;QACD;YACE,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,qBAAqB;YAClC,UAAU,EAAE,cAAc;YAC1B,KAAK,EAAE,CAAC,GAAG,CAAC;YACZ,SAAS,EAAE,KAAK;SACjB;KACF,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,IAAyB;IACtD,MAAM,MAAM,GAAmB;QAC7B;YACE,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,SAAS;YACtB,UAAU,EAAE,uBAAuB;YACnC,KAAK,EAAE,CAAC,WAAW,CAAC;YACpB,SAAS,EAAE,IAAI;SAChB;QACD;YACE,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,SAAS;YACtB,UAAU,EAAE,oBAAoB;YAChC,KAAK,EAAE,CAAC,WAAW,CAAC;YACpB,SAAS,EAAE,IAAI;SAChB;QACD;YACE,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,UAAU;YACvB,UAAU,EAAE,oBAAoB;YAChC,KAAK,EAAE,CAAC,YAAY,CAAC;YACrB,SAAS,EAAE,KAAK;SACjB;QACD;YACE,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,YAAY;YACzB,UAAU,EAAE,qBAAqB;YACjC,KAAK,EAAE,CAAC,cAAc,CAAC;YACvB,SAAS,EAAE,IAAI;SAChB;QACD;YACE,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,sBAAsB;YAClC,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC;SAC1C;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,cAAc;YAC3B,UAAU,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,oBAAoB;YACpE,KAAK,EAAE,CAAC,gBAAgB,CAAC;YACzB,SAAS,EAAE,KAAK;SACjB;QACD;YACE,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,oBAAoB;YAChC,KAAK,EAAE,CAAC,UAAU,CAAC;YACnB,SAAS,EAAE,IAAI;SAChB;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,sBAAsB;YACnC,UAAU,EAAE,oBAAoB;YAChC,KAAK,EAAE,CAAC,gBAAgB,CAAC;YACzB,eAAe,EAAE,IAAI;SACtB;QACD;YACE,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,YAAY;YACzB,UAAU,EAAE,oBAAoB;YAChC,KAAK,EAAE,CAAC,MAAM,CAAC;YACf,eAAe,EAAE,IAAI;SACtB;KACF,CAAA;IAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAA;IACzD,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,UAAU;YACvB,UAAU,EAAE,gBAAgB;YAC5B,KAAK,EAAE,CAAC,GAAG,CAAC;YACZ,SAAS,EAAE,KAAK;SACjB,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,UAAU;YACvB,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;YACnC,KAAK,EAAE,CAAC,GAAG,CAAC;YACZ,SAAS,EAAE,KAAK;SACjB,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA4B,EAAE;IAC7D,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,OAAO,uBAAuB,EAAE,CAAA;IAClC,CAAC;IACD,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAA;AACpC,CAAC"}

package/dist/scripts/postinstall.d.ts

@@ -1,12 +1,11 @@
 /**
- * Postinstall script — downloads the correct engine binary for the current
- * platform and caches it at ~/.supatype/engine/{version}/supatype-engine[.exe].
+ * Postinstall script — downloads component binaries on first install.
  *
- * Pattern: same as Prisma, esbuild, SWC, Turbo.
+ * Components: supatype-engine, supatype-server, supatype-pg (Postgres), deno.
+ * Binaries are cached in ~/.supatype/cache/{component}/{version}/.
  *
- * The binary is verified via:
- * 1. Minisign signature on checksums.sha256 (proves checksum file is authentic)
- * 2. SHA256 checksum of binary (proves binary matches signed checksum)
+ * Failures are non-fatal: an installation message is printed and the user
+ * can run `supatype update` manually to retry.
  */
 export {};
 //# sourceMappingURL=postinstall.d.ts.map

package/dist/scripts/postinstall.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postinstall.d.ts","sourceRoot":"","sources":["../../src/scripts/postinstall.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}
+{"version":3,"file":"postinstall.d.ts","sourceRoot":"","sources":["../../src/scripts/postinstall.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/scripts/postinstall.js

@@ -1,31 +1,47 @@
 /**
- * Postinstall script — downloads the correct engine binary for the current
- * platform and caches it at ~/.supatype/engine/{version}/supatype-engine[.exe].
+ * Postinstall script — downloads component binaries on first install.
  *
- * Pattern: same as Prisma, esbuild, SWC, Turbo.
+ * Components: supatype-engine, supatype-server, supatype-pg (Postgres), deno.
+ * Binaries are cached in ~/.supatype/cache/{component}/{version}/.
  *
- * The binary is verified via:
- * 1. Minisign signature on checksums.sha256 (proves checksum file is authentic)
- * 2. SHA256 checksum of binary (proves binary matches signed checksum)
+ * Failures are non-fatal: an installation message is printed and the user
+ * can run `supatype update` manually to retry.
  */
-import { ENGINE_VERSION } from "../engine-version.js";
-import { detectPlatform } from "../engine/platform.js";
-import { hasCachedBinary } from "../engine/cache.js";
-import { resolveEngine } from "../engine/resolve.js";
+import { download, currentPlatform, fetchAllLatestVersions } from "../binary-cache.js";
 async function main() {
-    const platform = detectPlatform();
-    // Skip if already cached at the right version
-    if (hasCachedBinary(ENGINE_VERSION, platform)) {
-        console.log(`[supatype] Engine v${ENGINE_VERSION} already cached.`);
+    const platform = currentPlatform();
+    let versions;
+    try {
+        console.log("[supatype] Fetching latest component versions...");
+        versions = await fetchAllLatestVersions();
+    }
+    catch (err) {
+        console.error(`[supatype] Failed to fetch latest versions: ${err.message}`);
+        console.error("[supatype] Run 'supatype update' to download component binaries.");
         return;
     }
-    console.log(`[supatype] Downloading engine v${ENGINE_VERSION} for ${platform.os}-${platform.arch}...`);
-    const result = await resolveEngine(ENGINE_VERSION);
-    console.log(`[supatype] Engine installed at ${result.binaryPath}`);
+    console.log(`[supatype] Downloading component binaries for ${platform.os}/${platform.arch}...`);
+    const components = Object.entries(versions);
+    let anyFailed = false;
+    for (const [component, version] of components) {
+        try {
+            await download(component, version, platform);
+        }
+        catch (err) {
+            console.error(`[supatype] Failed to download ${component} v${version}: ${err.message}`);
+            anyFailed = true;
+        }
+    }
+    if (anyFailed) {
+        console.error("[supatype] Some downloads failed. Run 'supatype update' to retry.");
+    }
+    else {
+        console.log("[supatype] All component binaries downloaded successfully.");
+    }
 }
 main().catch((err) => {
-    console.error("[supatype] Engine download failed:", err.message);
-    console.error("[supatype] You can still use the CLI — the engine will be downloaded on first use.");
-    // Don't exit(1) — let npm install succeed even if binary download fails.
+    // Non-fatal — postinstall failures should not break npm install.
+    console.error("[supatype] Postinstall failed:", err);
+    process.exit(0);
 });
 //# sourceMappingURL=postinstall.js.map

package/dist/scripts/postinstall.js.map

@@ -1 +1 @@
-{"version":3,"file":"postinstall.js","sourceRoot":"","sources":["../../src/scripts/postinstall.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD,KAAK,UAAU,IAAI;IACjB,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAA;IAEjC,8CAA8C;IAC9C,IAAI,eAAe,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,sBAAsB,cAAc,kBAAkB,CAAC,CAAA;QACnE,OAAM;IACR,CAAC;IAED,OAAO,CAAC,GAAG,CACT,kCAAkC,cAAc,QAAQ,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,CAC1F,CAAA;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,cAAc,CAAC,CAAA;IAClD,OAAO,CAAC,GAAG,CAAC,kCAAkC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAA;AACpE,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAChE,OAAO,CAAC,KAAK,CACX,oFAAoF,CACrF,CAAA;IACD,yEAAyE;AAC3E,CAAC,CAAC,CAAA"}
+{"version":3,"file":"postinstall.js","sourceRoot":"","sources":["../../src/scripts/postinstall.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,sBAAsB,EAAkB,MAAM,oBAAoB,CAAA;AAEtG,KAAK,UAAU,IAAI;IACjB,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;IAElC,IAAI,QAAmC,CAAA;IACvC,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAA;QAC/D,QAAQ,GAAG,MAAM,sBAAsB,EAAE,CAAA;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,+CAAgD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QACtF,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAA;QACjF,OAAM;IACR,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,iDAAiD,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAA;IAE/F,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAA0B,CAAA;IAEpE,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,UAAU,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,iCAAiC,SAAS,KAAK,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;YAClG,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC;IACH,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAA;IACpF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,iEAAiE;IACjE,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAA;IACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/self-host-compose.d.ts

@@ -0,0 +1,14 @@
+import type { SupatypeProjectConfig } from "./project-config.js";
+export interface SelfHostComposePaths {
+    dir: string;
+    composePath: string;
+    kongPath: string;
+    nginxPath: string;
+}
+export declare function selfHostComposePaths(cwd: string): SelfHostComposePaths;
+export declare function appUpstreamForCompose(config: SupatypeProjectConfig): string | undefined;
+export declare function staticDirForCompose(config: SupatypeProjectConfig): string | undefined;
+export declare function renderSelfHostCompose(config: SupatypeProjectConfig, cwd?: string): string;
+export declare function writeSelfHostCompose(cwd: string, config: SupatypeProjectConfig): SelfHostComposePaths;
+export declare function runDockerCompose(composePath: string, args: string[], projectRoot?: string): number;
+//# sourceMappingURL=self-host-compose.d.ts.map

package/dist/self-host-compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-host-compose.d.ts","sourceRoot":"","sources":["../src/self-host-compose.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAGhE,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAQtE;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,GAAG,SAAS,CAIvF;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,GAAG,SAAS,CAIrF;AAuBD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,GAAE,MAAsB,GAAG,MAAM,CA4JxG;AAgBD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,GAAG,oBAAoB,CAarG;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,GAAE,MAAsB,GAAG,MAAM,CAajH"}

package/dist/self-host-compose.js

@@ -0,0 +1,236 @@
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+import { buildKongDeclarative } from "./kong-config.js";
+export function selfHostComposePaths(cwd) {
+    const dir = resolve(cwd, ".supatype", "self-host");
+    return {
+        dir,
+        composePath: join(dir, "docker-compose.yml"),
+        kongPath: join(dir, "kong.yml"),
+        nginxPath: join(dir, "nginx.conf"),
+    };
+}
+export function appUpstreamForCompose(config) {
+    if (config.app.mode !== "proxy")
+        return undefined;
+    const upstream = config.app.upstream?.trim();
+    return upstream && upstream.length > 0 ? upstream : undefined;
+}
+export function staticDirForCompose(config) {
+    if (config.app.mode !== "static")
+        return undefined;
+    const dir = config.app.static_dir?.trim();
+    return dir && dir.length > 0 ? dir : "./public";
+}
+function projectMountPath(cwd) {
+    const composeDir = resolve(cwd, ".supatype", "self-host");
+    let rel = relative(composeDir, resolve(cwd)).replace(/\\/g, "/");
+    if (!rel.startsWith(".") && !rel.startsWith("/")) {
+        rel = `./${rel}`;
+    }
+    return rel || "../..";
+}
+function serverAppEnvForCompose(config) {
+    const mode = config.app.mode ?? "none";
+    const lines = [`      SUPATYPE_APP_MODE: ${mode}`];
+    if (mode === "static") {
+        const dir = staticDirForCompose(config) ?? "./public";
+        lines.push(`      SUPATYPE_APP_STATIC_DIR: /project/${dir.replace(/^\.\//, "")}`);
+    }
+    else if (mode === "proxy" && config.app.upstream?.trim()) {
+        lines.push(`      SUPATYPE_APP_UPSTREAM: ${config.app.upstream.trim()}`);
+    }
+    return lines.join("\n");
+}
+export function renderSelfHostCompose(config, cwd = process.cwd()) {
+    const projectMount = projectMountPath(cwd);
+    const appEnv = serverAppEnvForCompose(config);
+    return `# Generated by supatype self-host compose
+# Kong → supatype-server (unified gateway) → internal PostgREST / storage / etc.
+services:
+  db:
+    image: \${SUPATYPE_POSTGRES_IMAGE:-supatype/postgres:17-latest}
+    environment:
+      POSTGRES_USER: \${POSTGRES_USER:-supatype_admin}
+      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:-postgres}
+      POSTGRES_DB: \${POSTGRES_DB:-supatype}
+    ports:
+      - "5432:5432"
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U \${POSTGRES_USER:-supatype_admin}"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  postgrest:
+    image: postgrest/postgrest:v12.2.8
+    expose:
+      - "3000"
+    environment:
+      PGRST_DB_URI: postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}
+      PGRST_DB_SCHEMA: "public, supatype"
+      PGRST_DB_ANON_ROLE: anon
+      PGRST_JWT_SECRET: \${JWT_SECRET:-super-secret-jwt-token-change-in-production}
+      PGRST_DB_EXTRA_SEARCH_PATH: public,extensions
+      PGRST_DB_POOL: 3
+    depends_on:
+      db:
+        condition: service_healthy
+
+  storage:
+    image: \${SUPATYPE_STORAGE_IMAGE:-supatype/storage:latest}
+    expose:
+      - "5000"
+    environment:
+      PORT: 5000
+      DATABASE_URL: "postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}"
+      JWT_SECRET: \${JWT_SECRET:-super-secret-jwt-token-change-in-production}
+      S3_ENDPOINT: http://minio:9000
+      S3_REGION: us-east-1
+      S3_ACCESS_KEY: supatype
+      S3_SECRET_KEY: supatype-secret
+      S3_FORCE_PATH_STYLE: "true"
+    depends_on:
+      db:
+        condition: service_healthy
+
+  functions-worker:
+    image: \${SUPATYPE_FUNCTIONS_WORKER_IMAGE:-supatype/functions-worker:latest}
+    expose:
+      - "8001"
+    volumes:
+      - ${projectMount}:/project:ro
+    environment:
+      SUPATYPE_FUNCTIONS_ROOT: /project/functions
+      SUPATYPE_DENO_FUNCTIONS_DIR: /project/functions
+      PORT: "8001"
+      SUPATYPE_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
+      SUPATYPE_ANON_KEY: \${ANON_KEY:-}
+      SUPATYPE_SERVICE_ROLE_KEY: \${SERVICE_ROLE_KEY:-}
+    depends_on:
+      db:
+        condition: service_healthy
+
+  server:
+    image: \${SUPATYPE_SERVER_IMAGE:-\${SUPATYPE_AUTH_IMAGE:-supatype/server:latest}}
+    ports:
+      - "9999:9999"
+    volumes:
+      - ${projectMount}:/project:ro
+    working_dir: /project
+    environment:
+      SUPATYPE_MODE: standalone
+      SUPATYPE_MANIFEST_PATH: /project/.supatype/manifest.json
+      SUPATYPE_ADMIN_CONFIG_PATH: /project/.supatype/admin-config.json
+      SUPATYPE_API_CONFIG_PATH: /project/.supatype/api-config.json
+      SUPATYPE_POSTGREST_URL: http://postgrest:3000
+      SUPATYPE_GRAPHQL_URL: http://postgrest:3000
+      SUPATYPE_STORAGE_URL: http://storage:5000
+      SUPATYPE_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
+      SUPATYPE_ANON_KEY: \${ANON_KEY:-}
+      SUPATYPE_SERVICE_ROLE_KEY: \${SERVICE_ROLE_KEY:-}
+      SUPATYPE_SQL_DATABASE_URL: "postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}"
+      SUPATYPE_DENO_FUNCTIONS_DIR: /project/functions
+      SUPATYPE_FUNCTIONS_WORKER_URL: http://functions-worker:8001
+${appEnv}
+      GOTRUE_API_HOST: 0.0.0.0
+      GOTRUE_API_PORT: 9999
+      API_EXTERNAL_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
+      GOTRUE_API_EXTERNAL_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
+      GOTRUE_DB_DRIVER: postgres
+      GOTRUE_DB_DATABASE_URL: "postgres://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}?search_path=auth"
+      GOTRUE_SITE_URL: \${SITE_URL:-http://localhost:3000}
+      GOTRUE_JWT_SECRET: \${JWT_SECRET:-super-secret-jwt-token-change-in-production}
+      GOTRUE_JWT_EXP: 3600
+      GOTRUE_JWT_AUD: authenticated
+      GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
+      GOTRUE_JWT_ADMIN_ROLES: service_role,supatype_admin
+      GOTRUE_MAILER_AUTOCONFIRM: \${GOTRUE_MAILER_AUTOCONFIRM:-true}
+      GOTRUE_DISABLE_SIGNUP: \${DISABLE_SIGNUP:-false}
+    depends_on:
+      db:
+        condition: service_healthy
+      postgrest:
+        condition: service_started
+      storage:
+        condition: service_started
+      functions-worker:
+        condition: service_started
+
+  minio:
+    image: minio/minio:RELEASE.2024-11-07T00-52-20Z
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: supatype
+      MINIO_ROOT_PASSWORD: supatype-secret
+    ports:
+      - "9000:9000"
+      - "9001:9001"
+    volumes:
+      - minio-data:/data
+
+  studio:
+    image: \${SUPATYPE_STUDIO_IMAGE:-supatype/studio:latest}
+    expose:
+      - "3002"
+
+  kong:
+    image: kong:3.6
+    environment:
+      KONG_DATABASE: "off"
+      KONG_DECLARATIVE_CONFIG: /etc/kong/kong.yml
+      KONG_PROXY_ACCESS_LOG: /dev/stdout
+      KONG_ADMIN_ACCESS_LOG: /dev/stdout
+      KONG_PROXY_ERROR_LOG: /dev/stderr
+      KONG_ADMIN_ERROR_LOG: /dev/stderr
+    volumes:
+      - ./kong.yml:/etc/kong/kong.yml:ro
+    ports:
+      - "18473:8000"
+    depends_on:
+      - server
+      - studio
+
+volumes:
+  db-data:
+  minio-data:
+`;
+}
+function ensureComposeManifest(cwd) {
+    const manifestPath = join(cwd, ".supatype", "manifest.json");
+    if (existsSync(manifestPath))
+        return;
+    mkdirSync(dirname(manifestPath), { recursive: true });
+    const manifest = {
+        schema: "public",
+        postgrest_url: "http://postgrest:3000",
+        storage_url: "http://storage:5000",
+        realtime_enabled: true,
+        functions_enabled: false,
+    };
+    writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+}
+export function writeSelfHostCompose(cwd, config) {
+    const paths = selfHostComposePaths(cwd);
+    mkdirSync(paths.dir, { recursive: true });
+    ensureComposeManifest(cwd);
+    writeFileSync(paths.composePath, renderSelfHostCompose(config, cwd), "utf8");
+    writeFileSync(paths.kongPath, buildKongDeclarative({
+        unifiedGateway: true,
+    }), "utf8");
+    return paths;
+}
+export function runDockerCompose(composePath, args, projectRoot = process.cwd()) {
+    const envFile = resolve(projectRoot, ".env");
+    const composeArgs = ["compose", "-f", composePath];
+    if (existsSync(envFile)) {
+        composeArgs.push("--env-file", envFile);
+    }
+    composeArgs.push(...args);
+    const result = spawnSync("docker", composeArgs, { stdio: "inherit", cwd: dirname(composePath) });
+    return result.status ?? 1;
+}
+//# sourceMappingURL=self-host-compose.js.map