@supatype/cli 0.1.0-alpha.6 → 0.1.0-alpha.7

package/src/release-pins.ts

@@ -0,0 +1,31 @@
+/**
+ * Release pins read from files under packages/cli/releases/.
+ * CI (deno-releases workflow) uses the same paths — bump only releases/deno/VERSION.
+ */
+
+import { readFileSync } from "node:fs"
+import { dirname, join } from "node:path"
+import { fileURLToPath } from "node:url"
+
+const CLI_PACKAGE_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..")
+
+function readPinFile(...segments: string[]): string {
+  const path = join(CLI_PACKAGE_ROOT, "releases", ...segments)
+  let raw: string
+  try {
+    raw = readFileSync(path, "utf8")
+  } catch {
+    throw new Error(
+      `Missing release pin file: ${path}\n` +
+        "Expected packages/cli/releases/… — reinstall @supatype/cli or build from the monorepo.",
+    )
+  }
+  const version = raw.trim()
+  if (!/^\d+\.\d+\.\d+/.test(version)) {
+    throw new Error(`Invalid pin in ${path}: expected semver like 2.2.0, got ${JSON.stringify(raw)}`)
+  }
+  return version
+}
+
+/** Pinned Deno runtime for edge functions (also published to CDN under /deno/v{version}/). */
+export const DENO_RELEASE_PIN = readPinFile("deno", "VERSION")

package/src/release-public-key.ts

@@ -0,0 +1,12 @@
+/**
+ * Minisign public key for CDN release verification.
+ * Populated at publish via scripts/embed-release-pubkey.mjs (MINISIGN_PUBLIC_KEY secret),
+ * or overridden at runtime with SUPATYPE_RELEASE_PUBLIC_KEY.
+ */
+export const EMBEDDED_RELEASE_PUBLIC_KEY = "untrusted comment: minisign public key DE133E99689AE71D\nRWQd55pomT4T3t+5FLZZ6+h0DoHrtiuU9RBUHHm9BcFHeGRvW7BXxBCr"
+
+export function releasePublicKey(): string {
+  const fromEnv = process.env["SUPATYPE_RELEASE_PUBLIC_KEY"]?.trim()
+  if (fromEnv) return fromEnv
+  return EMBEDDED_RELEASE_PUBLIC_KEY.trim()
+}

package/src/runtime-routes.ts

@@ -0,0 +1,216 @@
+export interface RuntimeRoute {
+  name: string
+  serviceName: string
+  serviceUrl: string
+  paths: string[]
+  stripPath?: boolean
+  protocols?: string[]
+  engineProtected?: boolean
+}
+
+export interface RuntimeRouteOptions {
+  appUpstream?: string
+  staticAppServiceUrl?: string
+  /** Compose self-host: supatype-server container (functions proxy). */
+  functionsServiceUrl?: string
+  /**
+   * Self-host Compose: Kong forwards API traffic to supatype-server (unified gateway),
+   * which proxies to internal services — same model as `supatype dev`.
+   */
+  unifiedGateway?: boolean
+}
+
+const SERVER_GATEWAY = "http://server:9999"
+
+/**
+ * Kong routes when self-host uses supatype-server as the single API gateway.
+ */
+function runtimeRouteSpecUnified(): RuntimeRoute[] {
+  return [
+    {
+      name: "rest-v1",
+      serviceName: "supatype-server-rest",
+      serviceUrl: SERVER_GATEWAY,
+      paths: ["/rest/v1/"],
+      stripPath: false,
+    },
+    {
+      name: "auth-v1",
+      serviceName: "supatype-server-auth",
+      serviceUrl: SERVER_GATEWAY,
+      paths: ["/auth/v1/"],
+      stripPath: false,
+    },
+    {
+      name: "admin-v1",
+      serviceName: "supatype-server-admin",
+      serviceUrl: SERVER_GATEWAY,
+      paths: ["/admin/v1/"],
+      stripPath: false,
+    },
+    {
+      name: "storage-v1",
+      serviceName: "supatype-server-storage",
+      serviceUrl: SERVER_GATEWAY,
+      paths: ["/storage/v1/"],
+      stripPath: false,
+    },
+    {
+      name: "realtime-v1",
+      serviceName: "supatype-server-realtime",
+      serviceUrl: SERVER_GATEWAY,
+      paths: ["/realtime/v1/"],
+      stripPath: false,
+      protocols: ["http", "https", "ws", "wss"],
+    },
+    {
+      name: "functions-v1",
+      serviceName: "supatype-server-functions",
+      serviceUrl: SERVER_GATEWAY,
+      paths: ["/functions/v1/"],
+      stripPath: false,
+    },
+    {
+      name: "graphql-v1",
+      serviceName: "supatype-server-graphql",
+      serviceUrl: SERVER_GATEWAY,
+      paths: ["/graphql/v1/"],
+      stripPath: false,
+    },
+    {
+      name: "studio-config-route",
+      serviceName: "supatype-server-studio-config",
+      serviceUrl: SERVER_GATEWAY,
+      paths: ["/studio-config"],
+      stripPath: false,
+    },
+    {
+      name: "sql-route",
+      serviceName: "supatype-server-sql",
+      serviceUrl: SERVER_GATEWAY,
+      paths: ["/sql"],
+      stripPath: false,
+    },
+    {
+      name: "studio",
+      serviceName: "studio",
+      serviceUrl: "http://studio:3002",
+      paths: ["/studio/"],
+      stripPath: true,
+    },
+    {
+      name: "app-root",
+      serviceName: "supatype-server-app",
+      serviceUrl: SERVER_GATEWAY,
+      paths: ["/"],
+      stripPath: false,
+    },
+  ]
+}
+
+/**
+ * Legacy split-stack routes (PostgREST/storage/realtime directly from Kong).
+ * Kept for tests or explicit opt-out only — self-host uses unifiedGateway.
+ */
+function runtimeRouteSpecSplit(opts: RuntimeRouteOptions): RuntimeRoute[] {
+  const routes: RuntimeRoute[] = [
+    {
+      name: "rest-v1",
+      serviceName: "rest-v1",
+      serviceUrl: "http://postgrest:3000",
+      paths: ["/rest/v1/"],
+      stripPath: true,
+    },
+    {
+      name: "auth-v1",
+      serviceName: "auth-v1",
+      serviceUrl: "http://server:9999",
+      paths: ["/auth/v1/"],
+      stripPath: true,
+    },
+    {
+      name: "admin-v1",
+      serviceName: "admin-v1",
+      serviceUrl: "http://server:9999",
+      paths: ["/admin/v1/"],
+      stripPath: false,
+    },
+    {
+      name: "storage-v1",
+      serviceName: "storage-v1",
+      serviceUrl: "http://storage:5000",
+      paths: ["/storage/v1/"],
+      stripPath: true,
+    },
+    {
+      name: "realtime-v1",
+      serviceName: "realtime-v1",
+      serviceUrl: "http://realtime:4000",
+      paths: ["/realtime/v1/"],
+      stripPath: true,
+      protocols: ["http", "https", "ws", "wss"],
+    },
+    {
+      name: "functions-v1",
+      serviceName: "functions-v1",
+      serviceUrl: opts.functionsServiceUrl?.trim() || "http://server:9999",
+      paths: ["/functions/v1/"],
+      stripPath: false,
+    },
+    {
+      name: "studio",
+      serviceName: "studio",
+      serviceUrl: "http://studio:3002",
+      paths: ["/studio/"],
+      stripPath: true,
+    },
+    {
+      name: "studio-config-route",
+      serviceName: "engine-studio-config",
+      serviceUrl: "http://engine:7500",
+      paths: ["/studio-config"],
+      engineProtected: true,
+    },
+    {
+      name: "sql-route",
+      serviceName: "engine-sql",
+      serviceUrl: "http://engine:7500",
+      paths: ["/sql"],
+      engineProtected: true,
+    },
+  ]
+
+  const staticServiceUrl = opts.staticAppServiceUrl?.trim()
+  if (staticServiceUrl && staticServiceUrl.length > 0) {
+    routes.push({
+      name: "app-root",
+      serviceName: "app-root",
+      serviceUrl: staticServiceUrl,
+      paths: ["/"],
+      stripPath: false,
+    })
+    return routes
+  }
+
+  if (opts.appUpstream && opts.appUpstream.trim().length > 0) {
+    routes.push({
+      name: "app-root",
+      serviceName: "app-root",
+      serviceUrl: opts.appUpstream.trim(),
+      paths: ["/"],
+      stripPath: false,
+    })
+  }
+
+  return routes
+}
+
+/**
+ * Shared route contract used by local/self-host renderers.
+ */
+export function runtimeRouteSpec(opts: RuntimeRouteOptions = {}): RuntimeRoute[] {
+  if (opts.unifiedGateway) {
+    return runtimeRouteSpecUnified()
+  }
+  return runtimeRouteSpecSplit(opts)
+}

package/src/scripts/postinstall.ts

@@ -1,40 +1,51 @@
 /**
- * Postinstall script — downloads the correct engine binary for the current
- * platform and caches it at ~/.supatype/engine/{version}/supatype-engine[.exe].
+ * Postinstall script — downloads component binaries on first install.
  *
- * Pattern: same as Prisma, esbuild, SWC, Turbo.
+ * Components: supatype-engine, supatype-server, supatype-pg (Postgres), deno.
+ * Binaries are cached in ~/.supatype/cache/{component}/{version}/.
  *
- * The binary is verified via:
- * 1. Minisign signature on checksums.sha256 (proves checksum file is authentic)
- * 2. SHA256 checksum of binary (proves binary matches signed checksum)
+ * Failures are non-fatal: an installation message is printed and the user
+ * can run `supatype update` manually to retry.
  */
 
-import { ENGINE_VERSION } from "../engine-version.js"
-import { detectPlatform } from "../engine/platform.js"
-import { hasCachedBinary } from "../engine/cache.js"
-import { resolveEngine } from "../engine/resolve.js"
+import { download, currentPlatform, fetchAllLatestVersions, type Component } from "../binary-cache.js"
 
-async function main(): Promise<void> {
-  const platform = detectPlatform()
+async function main() {
+  const platform = currentPlatform()
 
-  // Skip if already cached at the right version
-  if (hasCachedBinary(ENGINE_VERSION, platform)) {
-    console.log(`[supatype] Engine v${ENGINE_VERSION} already cached.`)
+  let versions: Record<Component, string>
+  try {
+    console.log("[supatype] Fetching latest component versions...")
+    versions = await fetchAllLatestVersions()
+  } catch (err) {
+    console.error(`[supatype] Failed to fetch latest versions: ${(err as Error).message}`)
+    console.error("[supatype] Run 'supatype update' to download component binaries.")
     return
   }
 
-  console.log(
-    `[supatype] Downloading engine v${ENGINE_VERSION} for ${platform.os}-${platform.arch}...`,
-  )
+  console.log(`[supatype] Downloading component binaries for ${platform.os}/${platform.arch}...`)
 
-  const result = await resolveEngine(ENGINE_VERSION)
-  console.log(`[supatype] Engine installed at ${result.binaryPath}`)
+  const components = Object.entries(versions) as [Component, string][]
+
+  let anyFailed = false
+  for (const [component, version] of components) {
+    try {
+      await download(component, version, platform)
+    } catch (err) {
+      console.error(`[supatype] Failed to download ${component} v${version}: ${(err as Error).message}`)
+      anyFailed = true
+    }
+  }
+
+  if (anyFailed) {
+    console.error("[supatype] Some downloads failed. Run 'supatype update' to retry.")
+  } else {
+    console.log("[supatype] All component binaries downloaded successfully.")
+  }
 }
 
 main().catch((err) => {
-  console.error("[supatype] Engine download failed:", err.message)
-  console.error(
-    "[supatype] You can still use the CLI — the engine will be downloaded on first use.",
-  )
-  // Don't exit(1) — let npm install succeed even if binary download fails.
+  // Non-fatal — postinstall failures should not break npm install.
+  console.error("[supatype] Postinstall failed:", err)
+  process.exit(0)
 })

package/src/self-host-compose.ts

@@ -0,0 +1,257 @@
+import { existsSync, mkdirSync, writeFileSync } from "node:fs"
+import { dirname, join, relative, resolve } from "node:path"
+import { spawnSync } from "node:child_process"
+import type { SupatypeProjectConfig } from "./project-config.js"
+import { buildKongDeclarative } from "./kong-config.js"
+
+export interface SelfHostComposePaths {
+  dir: string
+  composePath: string
+  kongPath: string
+  nginxPath: string
+}
+
+export function selfHostComposePaths(cwd: string): SelfHostComposePaths {
+  const dir = resolve(cwd, ".supatype", "self-host")
+  return {
+    dir,
+    composePath: join(dir, "docker-compose.yml"),
+    kongPath: join(dir, "kong.yml"),
+    nginxPath: join(dir, "nginx.conf"),
+  }
+}
+
+export function appUpstreamForCompose(config: SupatypeProjectConfig): string | undefined {
+  if (config.app.mode !== "proxy") return undefined
+  const upstream = config.app.upstream?.trim()
+  return upstream && upstream.length > 0 ? upstream : undefined
+}
+
+export function staticDirForCompose(config: SupatypeProjectConfig): string | undefined {
+  if (config.app.mode !== "static") return undefined
+  const dir = config.app.static_dir?.trim()
+  return dir && dir.length > 0 ? dir : "./public"
+}
+
+function projectMountPath(cwd: string): string {
+  const composeDir = resolve(cwd, ".supatype", "self-host")
+  let rel = relative(composeDir, resolve(cwd)).replace(/\\/g, "/")
+  if (!rel.startsWith(".") && !rel.startsWith("/")) {
+    rel = `./${rel}`
+  }
+  return rel || "../.."
+}
+
+function serverAppEnvForCompose(config: SupatypeProjectConfig): string {
+  const mode = config.app.mode ?? "none"
+  const lines = [`      SUPATYPE_APP_MODE: ${mode}`]
+  if (mode === "static") {
+    const dir = staticDirForCompose(config) ?? "./public"
+    lines.push(`      SUPATYPE_APP_STATIC_DIR: /project/${dir.replace(/^\.\//, "")}`)
+  } else if (mode === "proxy" && config.app.upstream?.trim()) {
+    lines.push(`      SUPATYPE_APP_UPSTREAM: ${config.app.upstream.trim()}`)
+  }
+  return lines.join("\n")
+}
+
+export function renderSelfHostCompose(config: SupatypeProjectConfig, cwd: string = process.cwd()): string {
+  const projectMount = projectMountPath(cwd)
+  const appEnv = serverAppEnvForCompose(config)
+
+  return `# Generated by supatype self-host compose
+# Kong → supatype-server (unified gateway) → internal PostgREST / storage / etc.
+services:
+  db:
+    image: \${SUPATYPE_POSTGRES_IMAGE:-supatype/postgres:17-latest}
+    environment:
+      POSTGRES_USER: \${POSTGRES_USER:-supatype_admin}
+      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:-postgres}
+      POSTGRES_DB: \${POSTGRES_DB:-supatype}
+    ports:
+      - "5432:5432"
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U \${POSTGRES_USER:-supatype_admin}"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  postgrest:
+    image: postgrest/postgrest:v12.2.8
+    expose:
+      - "3000"
+    environment:
+      PGRST_DB_URI: postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}
+      PGRST_DB_SCHEMA: "public, supatype"
+      PGRST_DB_ANON_ROLE: anon
+      PGRST_JWT_SECRET: \${JWT_SECRET:-super-secret-jwt-token-change-in-production}
+      PGRST_DB_EXTRA_SEARCH_PATH: public,extensions
+      PGRST_DB_POOL: 3
+    depends_on:
+      db:
+        condition: service_healthy
+
+  storage:
+    image: \${SUPATYPE_STORAGE_IMAGE:-supatype/storage:latest}
+    expose:
+      - "5000"
+    environment:
+      PORT: 5000
+      DATABASE_URL: "postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}"
+      JWT_SECRET: \${JWT_SECRET:-super-secret-jwt-token-change-in-production}
+      S3_ENDPOINT: http://minio:9000
+      S3_REGION: us-east-1
+      S3_ACCESS_KEY: supatype
+      S3_SECRET_KEY: supatype-secret
+      S3_FORCE_PATH_STYLE: "true"
+    depends_on:
+      db:
+        condition: service_healthy
+
+  functions-worker:
+    image: \${SUPATYPE_FUNCTIONS_WORKER_IMAGE:-supatype/functions-worker:latest}
+    expose:
+      - "8001"
+    volumes:
+      - ${projectMount}:/project:ro
+    environment:
+      SUPATYPE_FUNCTIONS_ROOT: /project/functions
+      SUPATYPE_DENO_FUNCTIONS_DIR: /project/functions
+      PORT: "8001"
+      SUPATYPE_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
+      SUPATYPE_ANON_KEY: \${ANON_KEY:-}
+      SUPATYPE_SERVICE_ROLE_KEY: \${SERVICE_ROLE_KEY:-}
+    depends_on:
+      db:
+        condition: service_healthy
+
+  server:
+    image: \${SUPATYPE_SERVER_IMAGE:-\${SUPATYPE_AUTH_IMAGE:-supatype/server:latest}}
+    ports:
+      - "9999:9999"
+    volumes:
+      - ${projectMount}:/project:ro
+    working_dir: /project
+    environment:
+      SUPATYPE_MODE: standalone
+      SUPATYPE_MANIFEST_PATH: /project/.supatype/manifest.json
+      SUPATYPE_ADMIN_CONFIG_PATH: /project/.supatype/admin-config.json
+      SUPATYPE_API_CONFIG_PATH: /project/.supatype/api-config.json
+      SUPATYPE_POSTGREST_URL: http://postgrest:3000
+      SUPATYPE_GRAPHQL_URL: http://postgrest:3000
+      SUPATYPE_STORAGE_URL: http://storage:5000
+      SUPATYPE_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
+      SUPATYPE_ANON_KEY: \${ANON_KEY:-}
+      SUPATYPE_SERVICE_ROLE_KEY: \${SERVICE_ROLE_KEY:-}
+      SUPATYPE_SQL_DATABASE_URL: "postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}"
+      SUPATYPE_DENO_FUNCTIONS_DIR: /project/functions
+      SUPATYPE_FUNCTIONS_WORKER_URL: http://functions-worker:8001
+${appEnv}
+      GOTRUE_API_HOST: 0.0.0.0
+      GOTRUE_API_PORT: 9999
+      API_EXTERNAL_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
+      GOTRUE_API_EXTERNAL_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
+      GOTRUE_DB_DRIVER: postgres
+      GOTRUE_DB_DATABASE_URL: "postgres://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}?search_path=auth"
+      GOTRUE_SITE_URL: \${SITE_URL:-http://localhost:3000}
+      GOTRUE_JWT_SECRET: \${JWT_SECRET:-super-secret-jwt-token-change-in-production}
+      GOTRUE_JWT_EXP: 3600
+      GOTRUE_JWT_AUD: authenticated
+      GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
+      GOTRUE_JWT_ADMIN_ROLES: service_role,supatype_admin
+      GOTRUE_MAILER_AUTOCONFIRM: \${GOTRUE_MAILER_AUTOCONFIRM:-true}
+      GOTRUE_DISABLE_SIGNUP: \${DISABLE_SIGNUP:-false}
+    depends_on:
+      db:
+        condition: service_healthy
+      postgrest:
+        condition: service_started
+      storage:
+        condition: service_started
+      functions-worker:
+        condition: service_started
+
+  minio:
+    image: minio/minio:RELEASE.2024-11-07T00-52-20Z
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: supatype
+      MINIO_ROOT_PASSWORD: supatype-secret
+    ports:
+      - "9000:9000"
+      - "9001:9001"
+    volumes:
+      - minio-data:/data
+
+  studio:
+    image: \${SUPATYPE_STUDIO_IMAGE:-supatype/studio:latest}
+    expose:
+      - "3002"
+
+  kong:
+    image: kong:3.6
+    environment:
+      KONG_DATABASE: "off"
+      KONG_DECLARATIVE_CONFIG: /etc/kong/kong.yml
+      KONG_PROXY_ACCESS_LOG: /dev/stdout
+      KONG_ADMIN_ACCESS_LOG: /dev/stdout
+      KONG_PROXY_ERROR_LOG: /dev/stderr
+      KONG_ADMIN_ERROR_LOG: /dev/stderr
+    volumes:
+      - ./kong.yml:/etc/kong/kong.yml:ro
+    ports:
+      - "18473:8000"
+    depends_on:
+      - server
+      - studio
+
+volumes:
+  db-data:
+  minio-data:
+`
+}
+
+function ensureComposeManifest(cwd: string): void {
+  const manifestPath = join(cwd, ".supatype", "manifest.json")
+  if (existsSync(manifestPath)) return
+  mkdirSync(dirname(manifestPath), { recursive: true })
+  const manifest = {
+    schema: "public",
+    postgrest_url: "http://postgrest:3000",
+    storage_url: "http://storage:5000",
+    realtime_enabled: true,
+    functions_enabled: false,
+  }
+  writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8")
+}
+
+export function writeSelfHostCompose(cwd: string, config: SupatypeProjectConfig): SelfHostComposePaths {
+  const paths = selfHostComposePaths(cwd)
+  mkdirSync(paths.dir, { recursive: true })
+  ensureComposeManifest(cwd)
+  writeFileSync(paths.composePath, renderSelfHostCompose(config, cwd), "utf8")
+  writeFileSync(
+    paths.kongPath,
+    buildKongDeclarative({
+      unifiedGateway: true,
+    }),
+    "utf8",
+  )
+  return paths
+}
+
+export function runDockerCompose(composePath: string, args: string[], projectRoot: string = process.cwd()): number {
+  const envFile = resolve(projectRoot, ".env")
+  const composeArgs = ["compose", "-f", composePath]
+  if (existsSync(envFile)) {
+    composeArgs.push("--env-file", envFile)
+  }
+  composeArgs.push(...args)
+  const result = spawnSync(
+    "docker",
+    composeArgs,
+    { stdio: "inherit", cwd: dirname(composePath) },
+  )
+  return result.status ?? 1
+}

package/src/storage-provision.ts

@@ -0,0 +1,58 @@
+/**
+ * Provision storage buckets declared in a schema AST via the storage server API.
+ *
+ * The storage server is the authority on bucket existence — going through the API
+ * ensures it creates any backing resources (directories, S3 buckets, etc.).
+ * Buckets already registered return 409 Conflict, which is treated as success.
+ */
+
+export interface BucketSpec {
+  id: string
+  public: boolean
+  allowed_mime_types?: string[] | null
+  file_size_limit?: number | null
+  access_mode?: "public" | "private" | "custom"
+  s3_bucket_policy?: string | null
+}
+
+/**
+ * Ensure all declared buckets exist in the storage server.
+ *
+ * @param storageApiUrl  Base URL of the storage API, e.g. "http://localhost:54321/storage/v1"
+ * @param serviceRoleKey  A service_role JWT for the storage server
+ * @param buckets  Buckets to provision (from the resolved AST)
+ */
+export async function provisionBuckets(
+  storageApiUrl: string,
+  serviceRoleKey: string,
+  buckets: BucketSpec[],
+): Promise<void> {
+  const base = storageApiUrl.replace(/\/$/, "")
+  const headers = {
+    "Authorization": `Bearer ${serviceRoleKey}`,
+    "Content-Type": "application/json",
+  }
+
+  for (const bucket of buckets) {
+    const body = JSON.stringify({
+      id: bucket.id,
+      name: bucket.id,
+      public: bucket.public,
+      ...(bucket.allowed_mime_types != null && { allowed_mime_types: bucket.allowed_mime_types }),
+      ...(bucket.file_size_limit != null && { file_size_limit: bucket.file_size_limit }),
+      ...(bucket.access_mode != null && { access_mode: bucket.access_mode }),
+      ...(bucket.s3_bucket_policy != null &&
+        bucket.s3_bucket_policy !== "" && { s3_bucket_policy: bucket.s3_bucket_policy }),
+    })
+
+    const res = await fetch(`${base}/bucket`, { method: "POST", headers, body })
+      .catch(() => null)
+
+    if (res === null) continue // server not reachable — skip silently
+    if (res.status === 409) continue // already exists — fine
+    if (!res.ok) {
+      const msg = await res.text().catch(() => res.statusText)
+      console.warn(`[storage] Failed to provision bucket "${bucket.id}": ${msg}`)
+    }
+  }
+}