@supatype/cli 0.1.0-alpha.6 → 0.1.0-alpha.7

package/src/engine-client.ts

@@ -0,0 +1,231 @@
+/**
+ * engine-client.ts — subprocess-based engine invocation.
+ *
+ * Replaces the former HTTP-based engine client (Docker container API).
+ * All callers use the same interface; only the transport changed.
+ *
+ * The engine binary reads a request JSON file passed via --request-file and
+ * writes a response JSON to stdout.
+ */
+
+import { spawnSync } from "node:child_process"
+import { mkdirSync, writeFileSync, unlinkSync, existsSync, readdirSync } from "node:fs"
+import { tmpdir, homedir } from "node:os"
+import { join } from "node:path"
+import { loadConfig } from "./config.js"
+import { resolveBinary, currentPlatform, cachePath } from "./binary-cache.js"
+
+// ---------------------------------------------------------------------------
+// Types (kept for backward compatibility with existing callers)
+// ---------------------------------------------------------------------------
+
+export interface Operation {
+  kind: "create_table" | "alter_table" | "drop_table" | "create_index" | "drop_index" |
+        "create_policy" | "drop_policy" | "add_column" | "drop_column" | "alter_column"
+  description: string
+  risk?: "safe" | "warn" | "danger"
+  sql?: string
+}
+
+export interface DiffResult {
+  operations: Operation[]
+  warnings?: string[]
+  summary?: string
+}
+
+export interface IntrospectResult {
+  models: Array<{
+    name: string
+    table: string
+    columns: Array<{
+      name: string
+      type: string
+      nullable: boolean
+      default?: string
+      primaryKey?: boolean
+      unique?: boolean
+      references?: { table: string; column: string }
+    }>
+  }>
+}
+
+export interface EngineResult<T = unknown> {
+  ok: boolean
+  data: T
+  message?: string
+  error?: string
+}
+
+export class EngineError extends Error {
+  constructor(
+    message: string,
+    public readonly endpoint: string,
+    public readonly exitCode: number | null,
+  ) {
+    super(message)
+    this.name = "EngineError"
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Engine binary resolution
+// ---------------------------------------------------------------------------
+
+let _engineBin: string | null = null
+
+async function getEngineBin(): Promise<string> {
+  if (_engineBin) return _engineBin
+
+  const cwd = process.cwd()
+
+  try {
+    const config = loadConfig(cwd)
+    _engineBin = await resolveBinary("engine", config)
+    return _engineBin
+  } catch {
+    // No valid project config — fall through to default cache path.
+  }
+
+  // No config found — scan the cache for any available engine binary.
+  const platform = currentPlatform()
+  const engineCacheDir = join(homedir(), ".supatype", "cache", "engine")
+  try {
+    const cachedVersions = readdirSync(engineCacheDir).sort()
+    for (const version of cachedVersions.reverse()) {
+      const bin = join(cachePath("engine", version), `supatype-engine-${platform.os}-${platform.arch}`)
+      if (existsSync(bin)) {
+        _engineBin = bin
+        return _engineBin
+      }
+    }
+  } catch { /* cache dir doesn't exist */ }
+
+  throw new Error(
+    "Engine binary not found. Run: supatype update",
+  )
+}
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/** Verify the engine binary is accessible. Throws if not found. */
+export async function ensureEngine(): Promise<void> {
+  await getEngineBin()
+}
+
+/** Check if the engine can be invoked. Returns true/false. */
+export async function engineHealth(): Promise<boolean> {
+  try {
+    const bin = await getEngineBin()
+    const result = spawnSync(bin, ["--version"], { encoding: "utf8" })
+    return result.status === 0
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Invoke the engine and return a typed result.
+ *
+ * The endpoint maps to a subcommand:
+ *   /diff        → engine diff
+ *   /push        → engine push
+ *   /generate    → engine generate
+ *   /migrations  → engine migrations
+ *   /introspect  → engine introspect
+ *   /validate    → engine validate
+ *   /admin       → engine admin (admin-config JSON on stdout)
+ */
+export async function engineRequest<T = unknown>(
+  endpoint: string,
+  body: Record<string, unknown>,
+): Promise<T> {
+  const bin = await getEngineBin()
+
+  // Write request to a temp file.
+  // For CLI-mode endpoints the engine reads the input file as a raw SchemaAst,
+  // so we extract the `ast` field when present, otherwise write the full body.
+  const tmpDir = join(tmpdir(), "supatype-engine")
+  mkdirSync(tmpDir, { recursive: true })
+  const reqFile = join(tmpDir, `req-${Date.now()}.json`)
+  const inputPayload = body["ast"] !== undefined ? body["ast"] : body
+  writeFileSync(reqFile, JSON.stringify(inputPayload))
+
+  const args = endpointToArgs(endpoint, body, reqFile)
+
+  const result = spawnSync(bin, args, {
+    encoding: "utf8",
+    cwd: process.cwd(),
+  })
+
+  // Clean up temp file.
+  try { unlinkSync(reqFile) } catch { /* ignore */ }
+
+  if (result.status !== 0) {
+    const stderr = result.stderr?.trim() || "(no output)"
+    throw new EngineError(
+      `Engine ${endpoint} failed (exit ${result.status}): ${stderr}`,
+      endpoint,
+      result.status,
+    )
+  }
+
+  if (!result.stdout?.trim()) {
+    // Some subcommands print nothing on success.
+    return {} as T
+  }
+
+  try {
+    return JSON.parse(result.stdout) as T
+  } catch {
+    // Non-JSON stdout — return as message.
+    return { message: result.stdout.trim() } as T
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Endpoint → CLI args mapping
+// ---------------------------------------------------------------------------
+
+function endpointToArgs(
+  endpoint: string,
+  body: Record<string, unknown>,
+  reqFile: string,
+): string[] {
+  const dbUrl = (body["database_url"] as string | undefined) ?? ""
+  const schema = (body["schema"] as string | undefined) ?? "public"
+  const force = body["force"] ? ["--force"] : []
+
+  switch (endpoint) {
+    case "/diff":
+      return ["diff", "--input", reqFile, "--database-url", dbUrl, "--schema", schema]
+
+    case "/push":
+      return ["push", "--input", reqFile, "--database-url", dbUrl, "--schema", schema, ...force]
+
+    case "/parse":
+      return ["parse", "--input", reqFile]
+
+    case "/generate": {
+      const lang = (body["lang"] as string | undefined) ?? "typescript"
+      return ["generate", "--input", reqFile, "--lang", lang]
+    }
+
+    case "/introspect":
+      return ["introspect", "--database-url", dbUrl, "--schema", schema]
+
+    case "/validate":
+      return ["validate", "--input", reqFile]
+
+    case "/admin":
+      return ["admin", "--input", reqFile]
+
+    default:
+      if (endpoint.startsWith("/migrations")) {
+        const action = (body["action"] as string | undefined) ?? "list"
+        return ["migrations", action, "--database-url", dbUrl]
+      }
+      return [endpoint.replace(/^\//, ""), "--input", reqFile]
+  }
+}

package/src/ensure-binary.ts

@@ -0,0 +1,28 @@
+/**
+ * Resolve component binaries, downloading from the CDN when not cached.
+ */
+
+import {
+  resolveBinary,
+  download,
+  currentPlatform,
+  versionFor,
+  type Component,
+} from "./binary-cache.js"
+import type { SupatypeProjectConfig } from "./project-config.js"
+
+export async function ensureBinary(
+  component: Component,
+  config: SupatypeProjectConfig,
+): Promise<string> {
+  try {
+    return await resolveBinary(component, config)
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
+    if (!message.includes("not found in cache")) {
+      throw err
+    }
+  }
+
+  return download(component, versionFor(component, config), currentPlatform())
+}

package/src/functions-router-gen.ts

@@ -0,0 +1,224 @@
+/**
+ * Generates a Deno router entrypoint so `deno run` (optionally `deno run --watch` in dev)
+ * can serve multiple handlers (same routing contract as `supatype functions serve`).
+ */
+import {
+  basename,
+  join,
+  relative,
+  dirname,
+  resolve as pathResolve,
+} from "node:path"
+import { existsSync, readdirSync, statSync, mkdirSync, writeFileSync } from "node:fs"
+
+export interface DiscoveredFunctionRoute {
+  name: string
+  entrypoint: string
+}
+
+/** Discover *.ts handlers and `{name}/index.ts` dirs; skips `_shared`, dotfiles. */
+export function discoverTsFunctionsInDir(functionsDir: string): DiscoveredFunctionRoute[] {
+  if (!existsSync(functionsDir)) return []
+
+  const entries = readdirSync(functionsDir)
+  const out: DiscoveredFunctionRoute[] = []
+
+  for (const entry of entries) {
+    if (entry.startsWith("_") || entry.startsWith(".")) continue
+
+    const fullPath = join(functionsDir, entry)
+    const st = statSync(fullPath)
+
+    if (st.isDirectory()) {
+      const indexTs = join(fullPath, "index.ts")
+      if (existsSync(indexTs)) out.push({ name: entry, entrypoint: indexTs })
+    } else if (entry.endsWith(".ts") && !entry.endsWith(".d.ts")) {
+      const name = basename(entry, ".ts")
+      out.push({ name, entrypoint: fullPath })
+    }
+  }
+
+  return out.sort((a, b) => a.name.localeCompare(b.name))
+}
+
+function importSpecFromRouter(routerFilePath: string, entrypoint: string): string {
+  const rel = relative(dirname(routerFilePath), entrypoint).replace(/\\/g, "/")
+  if (!rel.startsWith(".")) return `./${rel}`
+  return rel
+}
+
+/** Router source rooted at routerFilePath (defines import paths). */
+export function generateFunctionsRouterSource(
+  routerFilePath: string,
+  fns: DiscoveredFunctionRoute[],
+): string {
+  const imports = fns.map(
+    (fn, i) =>
+      `import handler_${i} from "${importSpecFromRouter(routerFilePath, fn.entrypoint)}"`,
+  )
+  const routes = fns.map((fn, i) => `  "${fn.name}": handler_${i},`)
+
+  return `// Auto-generated — do not edit (regenerated by supatype dev / functions serve)
+${imports.join("\n")}
+
+const handlers: Record<string, (req: Request) => Response | Promise<Response>> = {
+${routes.join("\n")}
+}
+
+const port = parseInt(Deno.env.get("PORT") ?? "8001", 10)
+const functionsDir = Deno.env.get("SUPATYPE_DENO_FUNCTIONS_DIR") ?? ""
+const normalizedFunctionsDir = functionsDir.endsWith("/") ? functionsDir.slice(0, -1) : functionsDir
+const sharedEnvPath = Deno.env.get("SUPATYPE_SHARED_ENV_FILE")
+  ?? (normalizedFunctionsDir ? normalizedFunctionsDir + "/.env.local" : "")
+
+let envLock: Promise<void> = Promise.resolve()
+
+async function withEnvLock<T>(run: () => Promise<T>): Promise<T> {
+  const prev = envLock
+  let release: () => void = () => {}
+  envLock = new Promise<void>(resolve => { release = resolve })
+  await prev
+  try {
+    return await run()
+  } finally {
+    release()
+  }
+}
+
+async function readEnvFile(path: string): Promise<Record<string, string>> {
+  if (!path) return {}
+  try {
+    const text = await Deno.readTextFile(path)
+    const out: Record<string, string> = {}
+    for (const line of text.split("\\n")) {
+      const trimmed = line.trim()
+      if (!trimmed || trimmed.startsWith("#")) continue
+      const eq = trimmed.indexOf("=")
+      if (eq <= 0) continue
+      out[trimmed.slice(0, eq)] = trimmed.slice(eq + 1)
+    }
+    return out
+  } catch {
+    return {}
+  }
+}
+
+async function scopedEnvForFunction(fnName: string): Promise<Record<string, string>> {
+  const shared = await readEnvFile(sharedEnvPath)
+  if (!normalizedFunctionsDir) return shared
+  const fnPath = normalizedFunctionsDir + "/.env." + fnName + ".local"
+  const fnVars = await readEnvFile(fnPath)
+  return { ...shared, ...fnVars }
+}
+
+async function runWithScopedEnv<T>(fnName: string, run: () => Promise<T>): Promise<T> {
+  return withEnvLock(async () => {
+    const scoped = await scopedEnvForFunction(fnName)
+    const prev = new Map<string, string | undefined>()
+    for (const [k, v] of Object.entries(scoped)) {
+      prev.set(k, Deno.env.get(k))
+      Deno.env.set(k, v)
+    }
+    try {
+      return await run()
+    } finally {
+      for (const k of Object.keys(scoped)) {
+        const old = prev.get(k)
+        if (old === undefined) Deno.env.delete(k)
+        else Deno.env.set(k, old)
+      }
+    }
+  })
+}
+
+Deno.serve({ port }, async (req: Request): Promise<Response> => {
+  const url = new URL(req.url)
+  const pathParts = url.pathname
+    .replace(/^\\/functions\\/v1\\/?/, "")
+    .split("/")
+    .filter(Boolean)
+  const fnName = pathParts[0] ?? ""
+
+  if (!fnName || !handlers[fnName]) {
+    return new Response(JSON.stringify({
+      error: "not_found",
+      message: fnName ? \`Function "\${fnName}" not found\` : "No function specified",
+      available: Object.keys(handlers),
+    }), { status: 404, headers: { "Content-Type": "application/json" } })
+  }
+
+  try {
+    const start = performance.now()
+    const response = await runWithScopedEnv(fnName, async () => {
+      const prev = new Map<string, string | undefined>()
+      const setScoped = (key: string, value: string | undefined) => {
+        if (value === undefined || value.length === 0) return
+        prev.set(key, Deno.env.get(key))
+        Deno.env.set(key, value)
+      }
+
+      // Supatype runtime defaults available to every invocation.
+      const supatypeUrl = Deno.env.get("SUPATYPE_URL")
+      const supatypeAnon = Deno.env.get("SUPATYPE_ANON_KEY")
+      const supatypeServiceRole = Deno.env.get("SUPATYPE_SERVICE_ROLE_KEY")
+      const supatypeDbUrl = Deno.env.get("SUPATYPE_DB_URL") ?? Deno.env.get("DATABASE_URL")
+      const supatypeJwks = Deno.env.get("SUPATYPE_JWKS")
+
+      setScoped("SUPATYPE_URL", supatypeUrl)
+      setScoped("SUPATYPE_ANON_KEY", supatypeAnon)
+      setScoped("SUPATYPE_SERVICE_ROLE_KEY", supatypeServiceRole)
+      setScoped("SUPATYPE_DB_URL", supatypeDbUrl)
+      setScoped("SUPATYPE_JWKS", supatypeJwks)
+      if (!Deno.env.get("SUPATYPE_PUBLISHABLE_KEYS") && supatypeAnon) {
+        setScoped("SUPATYPE_PUBLISHABLE_KEYS", JSON.stringify({ anon: supatypeAnon }))
+      }
+      if (!Deno.env.get("SUPATYPE_SECRET_KEYS") && supatypeServiceRole) {
+        setScoped("SUPATYPE_SECRET_KEYS", JSON.stringify({ service_role: supatypeServiceRole }))
+      }
+
+      setScoped("SUPATYPE_REGION", Deno.env.get("SUPATYPE_REGION") ?? "local")
+      setScoped("SUPATYPE_EXECUTION_ID", crypto.randomUUID())
+      setScoped("DENO_DEPLOYMENT_ID", Deno.env.get("DENO_DEPLOYMENT_ID") ?? "local-dev")
+
+      try {
+        return await handlers[fnName]!(req)
+      } finally {
+        for (const [key, old] of prev.entries()) {
+          if (old === undefined) Deno.env.delete(key)
+          else Deno.env.set(key, old)
+        }
+      }
+    })
+    const duration = (performance.now() - start).toFixed(1)
+    console.log(\`\${req.method} /functions/v1/\${fnName} → \${response.status} (\${duration}ms)\`)
+    return response
+  } catch (err) {
+    console.error(\`Error in function "\${fnName}":\`, err)
+    return new Response(JSON.stringify({
+      error: "function_error",
+      message: err instanceof Error ? err.message : "Unknown error",
+    }), { status: 500, headers: { "Content-Type": "application/json" } })
+  }
+})
+`
+}
+
+/**
+ * Writes `.supatype/functions-router.ts` under project cwd. Returns absolute path or null if no handlers.
+ * Pass `routes` when callers already scanned the dir to avoid duplicate I/O.
+ */
+export function writeDevFunctionsRouter(
+  cwd: string,
+  functionsDir: string,
+  routes?: DiscoveredFunctionRoute[],
+): string | null {
+  const fns = routes ?? discoverTsFunctionsInDir(functionsDir)
+  if (fns.length === 0) return null
+
+  const supatypeDir = pathResolve(cwd, ".supatype")
+  mkdirSync(supatypeDir, { recursive: true })
+  const routerPath = join(supatypeDir, "functions-router.ts")
+  const src = generateFunctionsRouterSource(routerPath, fns)
+  writeFileSync(routerPath, src, "utf8")
+  return routerPath
+}

package/src/index.ts

@@ -4,16 +4,8 @@
  * For CLI usage: use the `supatype` binary.
  */
 
-export { invokeEngine, getEnginePath, ensureEngine, getEnginePathAsync } from "./engine.js"
-export {
-  ENGINE_VERSION,
-  ENGINE_REPO,
-  ENGINE_DOWNLOAD_BASE,
-  CDN_BASE_URL,
-  ENGINE_RELEASES_REPO,
-  GITHUB_RELEASES_FALLBACK_URL,
-} from "./engine-version.js"
+export { ensureEngine, engineRequest, engineHealth, EngineError } from "./engine-client.js"
+export type { EngineResult, DiffResult, Operation, IntrospectResult } from "./engine-client.js"
 export { defineConfig, loadConfig, loadSchemaAst } from "./config.js"
-export type { SupatypeConfig } from "./config.js"
-export { detectPlatform } from "./engine/platform.js"
-export type { PlatformInfo } from "./engine/platform.js"
+export type { SupatypeConfig, SupatypeProjectConfig } from "./config.js"
+export { schemaPathFromProject, localDSN, connectionString, serverBaseUrl } from "./project-config.js"

package/src/kong-config.ts

@@ -0,0 +1,78 @@
+/**
+ * Kong declarative config for local dev and self-hosted production.
+ * When `engineGatewayKey` is set, `/studio-config` and `/sql` require `apikey` (key-auth).
+ */
+
+export interface KongDeclarativeOptions {
+  /**
+   * When non-empty, Kong `key-auth` is enabled on engine routes; clients must send
+   * header `apikey: <key>` (same convention as PostgREST). Omit for open local dev.
+   */
+  engineGatewayKey?: string | undefined
+  appUpstream?: string | undefined
+  staticAppServiceUrl?: string | undefined
+  functionsServiceUrl?: string | undefined
+  /** Self-host: route API paths through supatype-server (see runtime-routes). */
+  unifiedGateway?: boolean | undefined
+}
+
+/** Escape a string for use inside YAML double quotes. */
+function yamlQuotedString(s: string): string {
+  return JSON.stringify(s)
+}
+
+import { runtimeRouteSpec } from "./runtime-routes.js"
+
+/**
+ * Build full `kong.yml` content. Single source of truth for CLI `dev` and `self-host setup`.
+ */
+export function buildKongDeclarative(opts: KongDeclarativeOptions = {}): string {
+  const gatewayKey = opts.engineGatewayKey?.trim()
+  const secured = Boolean(gatewayKey)
+  const routes = runtimeRouteSpec({
+    ...(opts.unifiedGateway === true && { unifiedGateway: true }),
+    ...(opts.unifiedGateway !== true && opts.appUpstream !== undefined && { appUpstream: opts.appUpstream }),
+    ...(opts.unifiedGateway !== true &&
+      opts.staticAppServiceUrl !== undefined && { staticAppServiceUrl: opts.staticAppServiceUrl }),
+    ...(opts.functionsServiceUrl !== undefined && { functionsServiceUrl: opts.functionsServiceUrl }),
+  })
+
+  const consumersBlock = secured
+    ? `
+consumers:
+  - username: studio-engine-gateway
+    keyauth_credentials:
+      - key: ${yamlQuotedString(gatewayKey!)}
+`
+    : ""
+
+  const servicesBlock = routes.map((route) => {
+    const routePlugins = route.engineProtected && secured
+      ? `        plugins:
+          - name: key-auth
+            config:
+              key_names:
+                - apikey
+              hide_credentials: true
+`
+      : ""
+    const protocols = route.protocols && route.protocols.length > 0
+      ? `        protocols:\n${route.protocols.map((p) => `          - ${p}`).join("\n")}\n`
+      : ""
+    const stripPath = route.stripPath ?? false
+    return `  - name: ${route.serviceName}
+    url: ${route.serviceUrl}
+    routes:
+      - name: ${route.name}
+        strip_path: ${stripPath}
+        paths:
+${route.paths.map((path) => `          - ${path}`).join("\n")}
+${protocols}${routePlugins}`
+  }).join("\n")
+
+  return `_format_version: "3.0"
+${consumersBlock}
+services:
+${servicesBlock}
+`
+}

package/src/local-gateway.ts

@@ -0,0 +1,9 @@
+/**
+ * Host port published for Kong in local Docker Compose. Kong still listens on
+ * 8000 inside the container; this avoids clashing with other tools on :8000.
+ */
+export const LOCAL_KONG_HOST_PORT = 18473
+
+export function localKongBaseUrl(): string {
+  return `http://localhost:${LOCAL_KONG_HOST_PORT}`
+}

package/src/local-storage.ts

@@ -0,0 +1,14 @@
+import { join } from "node:path"
+
+/**
+ * Returns env vars that configure supatype-server to use local-disk storage.
+ * Spread into the server process env when config.storage?.provider !== "s3".
+ *
+ * @param stateDir  Per-project state directory (e.g. ~/.supatype/projects/{name}/)
+ */
+export function localStorageEnv(stateDir: string): Record<string, string> {
+  return {
+    STORAGE_PROVIDER: "local",
+    STORAGE_PATH: join(stateDir, "storage"),
+  }
+}

package/src/pgbouncer-userlist.ts

@@ -0,0 +1,15 @@
+import { createHash } from "node:crypto"
+
+/** PgBouncer md5 auth: "md5" + md5(password + username) — same as supatype-cloud / self-host. */
+export function pgbouncerMd5Hash(password: string, username: string): string {
+  return "md5" + createHash("md5").update(password + username).digest("hex")
+}
+
+/** Two roles used by local compose: superuser pools (GoTrue, engine) and PostgREST. */
+export function pgbouncerUserlistContent(pgPassword: string): string {
+  return `# PgBouncer md5 userlist — matches supatype-cloud transaction pool (auth_type = md5).
+# Regenerated by supatype dev --local / init from POSTGRES_PASSWORD.
+"supatype_admin" "${pgbouncerMd5Hash(pgPassword, "supatype_admin")}"
+"authenticator" "${pgbouncerMd5Hash(pgPassword, "authenticator")}"
+`
+}