@supatype/cli 0.1.0-alpha.6 → 0.1.0-alpha.8

package/src/self-host-compose.ts

@@ -0,0 +1,389 @@
+import { existsSync, mkdirSync, writeFileSync } from "node:fs"
+import { dirname, join, relative, resolve } from "node:path"
+import { spawnSync } from "node:child_process"
+import { preferredFunctionsPathFromProject, type SupatypeProjectConfig } from "./project-config.js"
+import { hasEngineOverride, hasStudioOverride } from "./binary-cache.js"
+import { buildKongDeclarative } from "./kong-config.js"
+
+export interface SelfHostComposePaths {
+  dir: string
+  composePath: string
+  kongPath: string
+  nginxPath: string
+}
+
+export function selfHostComposePaths(cwd: string): SelfHostComposePaths {
+  const dir = resolve(cwd, ".supatype", "self-host")
+  return {
+    dir,
+    composePath: join(dir, "docker-compose.yml"),
+    kongPath: join(dir, "kong.yml"),
+    nginxPath: join(dir, "nginx.conf"),
+  }
+}
+
+export function appUpstreamForCompose(config: SupatypeProjectConfig): string | undefined {
+  if (config.app.mode !== "proxy") return undefined
+  const upstream = config.app.upstream?.trim()
+  return upstream && upstream.length > 0 ? upstream : undefined
+}
+
+export function staticDirForCompose(config: SupatypeProjectConfig): string | undefined {
+  if (config.app.mode !== "static") return undefined
+  const dir = config.app.static_dir?.trim()
+  return dir && dir.length > 0 ? dir : "./public"
+}
+
+/**
+ * Bind-mount source for `/project` in generated compose files.
+ * Paths are resolved from `--project-directory` (always the project root in `runDockerCompose`),
+ * not from the compose file directory — use `.` not `../..`.
+ */
+function projectMountPath(_cwd: string): string {
+  return "."
+}
+
+/** Paths in generated compose are resolved from `--project-directory` (project root). */
+function relativeFromProjectRoot(cwd: string, target: string): string {
+  let rel = relative(resolve(cwd), resolve(target)).replace(/\\/g, "/")
+  if (!rel.startsWith(".") && !rel.startsWith("/")) {
+    rel = `./${rel}`
+  }
+  return rel
+}
+
+function kongMountPath(_cwd: string): string {
+  return ".supatype/self-host/kong.yml"
+}
+
+/** Host Vite dev server as seen from Kong inside Docker Compose. */
+export const COMPOSE_STUDIO_HOST_URL = "http://host.docker.internal:3002"
+
+/** Local monorepo Studio image for `supatype dev` (dogfooding). */
+function studioServiceBlock(cwd: string, devLocal: boolean): string {
+  if (!devLocal) {
+    return `    image: \${SUPATYPE_STUDIO_IMAGE:-supatype/studio:latest}`
+  }
+  const monorepoRoot = resolve(cwd, "..", "supatype")
+  const studioDockerfile = join(monorepoRoot, "packages", "studio", "Dockerfile")
+  if (!existsSync(studioDockerfile) || !existsSync(join(monorepoRoot, "pnpm-workspace.yaml"))) {
+    return `    image: \${SUPATYPE_STUDIO_IMAGE:-supatype/studio:latest}`
+  }
+  const context = relativeFromProjectRoot(cwd, monorepoRoot)
+  return `    build:
+      context: ${context}
+      dockerfile: packages/studio/Dockerfile
+    image: supatype/studio:dev-local`
+}
+
+/** Host dev app (Astro/Vite on the machine) as seen from inside compose services. */
+function proxyUpstreamForCompose(upstream: string, devLocal: boolean): string {
+  const trimmed = upstream.trim()
+  if (!devLocal) return trimmed
+  try {
+    const url = new URL(trimmed)
+    if (url.hostname === "localhost" || url.hostname === "127.0.0.1") {
+      url.hostname = "host.docker.internal"
+      return url.toString()
+    }
+  } catch {
+    // keep literal upstream when not a URL
+  }
+  return trimmed
+}
+
+function serverAppEnvForCompose(config: SupatypeProjectConfig, devLocal: boolean): string {
+  const mode = config.app.mode ?? "none"
+  const lines = [`      SUPATYPE_APP_MODE: ${mode}`]
+  if (mode === "static") {
+    const dir = staticDirForCompose(config) ?? "./public"
+    lines.push(`      SUPATYPE_APP_STATIC_DIR: /project/${dir.replace(/^\.\//, "")}`)
+  } else if (mode === "proxy" && config.app.upstream?.trim()) {
+    lines.push(`      SUPATYPE_APP_UPSTREAM: ${proxyUpstreamForCompose(config.app.upstream, devLocal)}`)
+  }
+  return lines.join("\n")
+}
+
+export interface SelfHostComposeOptions {
+  /** `supatype dev` with provider docker: internal-only db/server; Kong on host :18473. */
+  devLocal?: boolean
+}
+
+export function renderSelfHostCompose(
+  config: SupatypeProjectConfig,
+  cwd: string = process.cwd(),
+  options?: SelfHostComposeOptions,
+): string {
+  const projectMount = projectMountPath(cwd)
+  const kongMount = kongMountPath(cwd)
+  const devLocal = options?.devLocal === true
+  const studioHostDev = devLocal && hasStudioOverride(config)
+  const appEnv = serverAppEnvForCompose(config, devLocal)
+  const studioService = studioServiceBlock(cwd, devLocal)
+  const studioBlock = studioHostDev
+    ? ""
+    : `
+  studio:
+${studioService}
+    environment:
+      SUPATYPE_CLOUD_JSON: '{"url":"\${API_EXTERNAL_URL:-http://localhost:18473}","anonKey":"\${ANON_KEY:-}"}'
+    expose:
+      - "3002"
+`
+  const kongDependsOn = studioHostDev
+    ? `      - server`
+    : `      - server
+      - studio`
+  const publishDbToHost = !devLocal || hasEngineOverride(config)
+  const dbPorts = publishDbToHost
+    ? devLocal
+      ? `    ports:
+      - "127.0.0.1:\${SUPATYPE_DEV_DB_PORT:-54329}:5432"
+`
+      : `    ports:
+      - "5432:5432"
+`
+    : ""
+  const serverPorts = devLocal
+    ? ""
+    : `    ports:
+      - "9999:9999"
+`
+  const minioPorts = devLocal
+    ? ""
+    : `    ports:
+      - "9000:9000"
+      - "9001:9001"
+`
+
+  return `# Generated by supatype self-host compose
+# Kong → supatype-server (unified gateway) → internal PostgREST / storage / etc.
+services:
+  db:
+    image: \${SUPATYPE_POSTGRES_IMAGE:-supatype/postgres:latest}
+    environment:
+      POSTGRES_USER: \${POSTGRES_USER:-supatype_admin}
+      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:-postgres}
+      POSTGRES_DB: \${POSTGRES_DB:-supatype}
+${dbPorts}    volumes:
+      - db-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U \${POSTGRES_USER:-supatype_admin}"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  postgrest:
+    image: postgrest/postgrest:v12.2.8
+    expose:
+      - "3000"
+    environment:
+      PGRST_DB_URI: postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}
+      PGRST_DB_SCHEMA: "public, supatype, graphql_public"
+      PGRST_DB_ANON_ROLE: anon
+      PGRST_JWT_SECRET: \${JWT_SECRET:-super-secret-jwt-token-change-in-production}
+      PGRST_DB_EXTRA_SEARCH_PATH: public,extensions
+      PGRST_DB_POOL: 3
+    depends_on:
+      db:
+        condition: service_healthy
+
+  storage:
+    image: \${SUPATYPE_STORAGE_IMAGE:-supatype/storage:latest}
+    expose:
+      - "5000"
+    environment:
+      PORT: 5000
+      DATABASE_URL: "postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}"
+      JWT_SECRET: \${JWT_SECRET:-super-secret-jwt-token-change-in-production}
+      S3_ENDPOINT: http://minio:9000
+      S3_REGION: us-east-1
+      S3_ACCESS_KEY: supatype
+      S3_SECRET_KEY: supatype-secret
+      S3_FORCE_PATH_STYLE: "true"
+    depends_on:
+      db:
+        condition: service_healthy
+
+  functions-worker:
+    image: \${SUPATYPE_FUNCTIONS_WORKER_IMAGE:-supatype/functions-worker:latest}
+    expose:
+      - "8001"
+    volumes:
+      - ${projectMount}:/project:ro
+    environment:
+      SUPATYPE_FUNCTIONS_ROOT: /project/functions
+      SUPATYPE_DENO_FUNCTIONS_DIR: /project/functions
+      PORT: "8001"
+      SUPATYPE_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
+      SUPATYPE_ANON_KEY: \${ANON_KEY:-}
+      SUPATYPE_SERVICE_ROLE_KEY: \${SERVICE_ROLE_KEY:-}
+      STRIPE_SECRET_KEY: \${STRIPE_SECRET_KEY:-}
+      STRIPE_WEBHOOK_SECRET: \${STRIPE_WEBHOOK_SECRET:-}
+      SITE_URL: \${SITE_URL:-\${API_EXTERNAL_URL:-http://localhost:18473}}
+    depends_on:
+      db:
+        condition: service_healthy
+
+  server:
+    image: \${SUPATYPE_SERVER_IMAGE:-\${SUPATYPE_AUTH_IMAGE:-supatype/server:latest}}
+${serverPorts}    volumes:
+      - ${projectMount}:/project:ro
+    working_dir: /project
+    environment:
+      SUPATYPE_MODE: ${devLocal ? "dev" : "standalone"}
+      SUPATYPE_MANIFEST_PATH: /project/.supatype/manifest.json
+      SUPATYPE_ADMIN_CONFIG_PATH: /project/.supatype/admin-config.json
+      SUPATYPE_API_CONFIG_PATH: /project/.supatype/api-config.json
+      SUPATYPE_POSTGREST_URL: http://postgrest:3000
+      SUPATYPE_GRAPHQL_URL: http://postgrest:3000
+      SUPATYPE_STORAGE_URL: http://storage:5000
+      SUPATYPE_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
+      SUPATYPE_ANON_KEY: \${ANON_KEY:-}
+      SUPATYPE_SERVICE_ROLE_KEY: \${SERVICE_ROLE_KEY:-}
+      SUPATYPE_SQL_DATABASE_URL: "postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}"
+      SUPATYPE_DENO_FUNCTIONS_DIR: /project/functions
+      SUPATYPE_FUNCTIONS_WORKER_URL: http://functions-worker:8001
+${appEnv}
+      GOTRUE_API_HOST: 0.0.0.0
+      GOTRUE_API_PORT: 9999
+      API_EXTERNAL_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
+      GOTRUE_API_EXTERNAL_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
+      GOTRUE_DB_DRIVER: postgres
+      GOTRUE_DB_DATABASE_URL: "postgres://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}?search_path=auth"
+      GOTRUE_SITE_URL: \${SITE_URL:-http://localhost:3000}
+      GOTRUE_JWT_SECRET: \${JWT_SECRET:-super-secret-jwt-token-change-in-production}
+      GOTRUE_JWT_EXP: 3600
+      GOTRUE_JWT_AUD: authenticated
+      GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
+      GOTRUE_JWT_ADMIN_ROLES: service_role,supatype_admin
+      GOTRUE_MAILER_AUTOCONFIRM: \${GOTRUE_MAILER_AUTOCONFIRM:-true}
+      GOTRUE_DISABLE_SIGNUP: \${DISABLE_SIGNUP:-false}
+${devLocal ? "      STUDIO_OPEN_DEV: \"1\"\n" : ""}
+    depends_on:
+      db:
+        condition: service_healthy
+      postgrest:
+        condition: service_started
+      storage:
+        condition: service_started
+      functions-worker:
+        condition: service_started
+
+  minio:
+    image: minio/minio:RELEASE.2024-11-07T00-52-20Z
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: supatype
+      MINIO_ROOT_PASSWORD: supatype-secret
+${minioPorts}    volumes:
+      - minio-data:/data
+
+  schema-engine:
+    image: \${SUPATYPE_ENGINE_IMAGE:-supatype/schema-engine:latest}
+    profiles: ["tools"]
+    entrypoint: ["supatype-engine"]
+    volumes:
+      - ${projectMount}:/project
+    working_dir: /project
+    depends_on:
+      db:
+        condition: service_healthy
+${studioBlock}
+  kong:
+    image: kong:3.6
+    environment:
+      KONG_DATABASE: "off"
+      KONG_DECLARATIVE_CONFIG: /etc/kong/kong.yml
+      KONG_PROXY_ACCESS_LOG: /dev/stdout
+      KONG_ADMIN_ACCESS_LOG: /dev/stdout
+      KONG_PROXY_ERROR_LOG: /dev/stderr
+      KONG_ADMIN_ERROR_LOG: /dev/stderr
+    volumes:
+      - ${kongMount}:/etc/kong/kong.yml:ro
+    ports:
+      - "\${SUPATYPE_KONG_PORT:-18473}:8000"
+    depends_on:
+${kongDependsOn}
+
+volumes:
+  db-data:
+  minio-data:
+`
+}
+
+function ensureComposeManifest(cwd: string): void {
+  const manifestPath = join(cwd, ".supatype", "manifest.json")
+  if (existsSync(manifestPath)) return
+  mkdirSync(dirname(manifestPath), { recursive: true })
+  const manifest = {
+    schema: "public",
+    postgrest_url: "http://postgrest:3000",
+    storage_url: "http://storage:5000",
+    realtime_enabled: true,
+    functions_enabled: false,
+  }
+  writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8")
+}
+
+function ensureProjectFunctionsDir(cwd: string, config: SupatypeProjectConfig): void {
+  mkdirSync(preferredFunctionsPathFromProject(config, cwd), { recursive: true })
+}
+
+export function writeSelfHostCompose(
+  cwd: string,
+  config: SupatypeProjectConfig,
+  options?: SelfHostComposeOptions,
+): SelfHostComposePaths {
+  const paths = selfHostComposePaths(cwd)
+  mkdirSync(paths.dir, { recursive: true })
+  ensureProjectFunctionsDir(cwd, config)
+  ensureComposeManifest(cwd)
+  writeFileSync(paths.composePath, renderSelfHostCompose(config, cwd, options), "utf8")
+  const studioHostDev = options?.devLocal === true && hasStudioOverride(config)
+  writeFileSync(
+    paths.kongPath,
+    buildKongDeclarative({
+      unifiedGateway: true,
+      ...(studioHostDev && {
+        studioServiceUrl: COMPOSE_STUDIO_HOST_URL,
+        studioStripPath: false,
+      }),
+    }),
+    "utf8",
+  )
+  return paths
+}
+
+export function runDockerCompose(
+  composePath: string,
+  args: string[],
+  projectRoot: string = process.cwd(),
+  composeProject?: string,
+): number {
+  const envFile = resolve(projectRoot, ".env")
+  const composeArgs = ["compose"]
+  // Per-project name isolates containers/volumes/network so multiple Supatype
+  // projects on one machine never share a database (default would be the
+  // ".supatype/self-host" dir name, identical for every project).
+  if (composeProject) composeArgs.push("-p", composeProject)
+  // Resolve ${VAR} in compose.yml from the project root .env (not .supatype/self-host/).
+  composeArgs.push("--project-directory", projectRoot)
+  composeArgs.push("-f", composePath)
+  if (existsSync(envFile)) {
+    composeArgs.push("--env-file", envFile)
+  }
+  composeArgs.push(...args)
+  const result = spawnSync(
+    "docker",
+    composeArgs,
+    { stdio: "inherit", cwd: projectRoot },
+  )
+  return result.status ?? 1
+}
+
+/** Compose project name for a Supatype project — isolates docker state per project. */
+export function composeProjectName(projectName: string): string {
+  const slug = projectName.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "")
+  return `supatype-${slug || "project"}`
+}

package/src/storage-provision.ts

@@ -0,0 +1,58 @@
+/**
+ * Provision storage buckets declared in a schema AST via the storage server API.
+ *
+ * The storage server is the authority on bucket existence — going through the API
+ * ensures it creates any backing resources (directories, S3 buckets, etc.).
+ * Buckets already registered return 409 Conflict, which is treated as success.
+ */
+
+export interface BucketSpec {
+  id: string
+  public: boolean
+  allowed_mime_types?: string[] | null
+  file_size_limit?: number | null
+  access_mode?: "public" | "private" | "custom"
+  s3_bucket_policy?: string | null
+}
+
+/**
+ * Ensure all declared buckets exist in the storage server.
+ *
+ * @param storageApiUrl  Base URL of the storage API, e.g. "http://localhost:54321/storage/v1"
+ * @param serviceRoleKey  A service_role JWT for the storage server
+ * @param buckets  Buckets to provision (from the resolved AST)
+ */
+export async function provisionBuckets(
+  storageApiUrl: string,
+  serviceRoleKey: string,
+  buckets: BucketSpec[],
+): Promise<void> {
+  const base = storageApiUrl.replace(/\/$/, "")
+  const headers = {
+    "Authorization": `Bearer ${serviceRoleKey}`,
+    "Content-Type": "application/json",
+  }
+
+  for (const bucket of buckets) {
+    const body = JSON.stringify({
+      id: bucket.id,
+      name: bucket.id,
+      public: bucket.public,
+      ...(bucket.allowed_mime_types != null && { allowed_mime_types: bucket.allowed_mime_types }),
+      ...(bucket.file_size_limit != null && { file_size_limit: bucket.file_size_limit }),
+      ...(bucket.access_mode != null && { access_mode: bucket.access_mode }),
+      ...(bucket.s3_bucket_policy != null &&
+        bucket.s3_bucket_policy !== "" && { s3_bucket_policy: bucket.s3_bucket_policy }),
+    })
+
+    const res = await fetch(`${base}/bucket`, { method: "POST", headers, body })
+      .catch(() => null)
+
+    if (res === null) continue // server not reachable — skip silently
+    if (res.status === 409) continue // already exists — fine
+    if (!res.ok) {
+      const msg = await res.text().catch(() => res.statusText)
+      console.warn(`[storage] Failed to provision bucket "${bucket.id}": ${msg}`)
+    }
+  }
+}

package/src/studio-admin-roles.ts

@@ -0,0 +1,16 @@
+import type { SupatypeProjectConfig } from "./project-config.js"
+
+export const DEFAULT_STUDIO_ADMIN_ROLES = ["admin", "supatype_admin"] as const
+
+/** Studio admin roles from `supatype.config.ts` `admin.roles` or defaults. */
+export function studioAdminRoles(cfg: SupatypeProjectConfig): string[] {
+  const roles = cfg.admin?.roles
+  if (roles !== undefined && roles.length > 0) return roles
+  return [...DEFAULT_STUDIO_ADMIN_ROLES]
+}
+
+/** Merge `adminRoles` into engine admin-config JSON for Studio and supatype-server. */
+export function withAdminRoles(admin: unknown, cfg: SupatypeProjectConfig): Record<string, unknown> {
+  const base = typeof admin === "object" && admin !== null ? (admin as Record<string, unknown>) : {}
+  return { ...base, adminRoles: studioAdminRoles(cfg) }
+}

package/src/studio-dev-server.ts

@@ -0,0 +1,53 @@
+import { existsSync } from "node:fs"
+import { join, resolve } from "node:path"
+import { ProcessManager } from "./process-manager.js"
+
+const STUDIO_PORT = 3002
+
+export interface StudioDevServerOptions {
+  cwd: string
+  studioOverride: string
+  pidDir: string
+  serviceRoleKey: string
+  /**
+   * Where Vite proxies API requests (Kong gateway port for compose dev, or
+   * supatype-server port for native `supatype dev`).
+   */
+  proxyTarget: string
+  /**
+   * Public Supatype URL the browser uses. Compose dev: Kong on the host.
+   * Native dev: Vite dev server (same origin as Studio).
+   */
+  viteSupatypeUrl: string
+  /** Vite `base` — `/studio/` when behind Kong at `/studio/`; `/` for native dev on :3002. */
+  basePath?: string
+}
+
+/** Start @supatype/studio Vite dev server when `overrides.studio` is set. */
+export function startStudioViteDevServer(opts: StudioDevServerOptions): ProcessManager | null {
+  const studioDir = resolve(opts.cwd, opts.studioOverride)
+  const viteJs = join(studioDir, "node_modules", "vite", "bin", "vite.js")
+  if (!existsSync(viteJs)) {
+    console.warn(`[supatype] ⚠  Studio override set but vite not found at ${viteJs}. Run: pnpm install`)
+    return null
+  }
+
+  const basePath = opts.basePath ?? "/"
+  return new ProcessManager(
+    process.execPath,
+    [viteJs, "--port", String(STUDIO_PORT), "--strictPort", "--host"],
+    {
+      label: "studio",
+      pidDir: opts.pidDir,
+      cwd: studioDir,
+      colour: "\x1b[35m",
+      env: {
+        VITE_SUPATYPE_URL: opts.viteSupatypeUrl,
+        SUPATYPE_PROXY_TARGET: opts.proxyTarget,
+        VITE_SUPATYPE_ANON_KEY: opts.serviceRoleKey,
+        VITE_SUPATYPE_SERVICE_ROLE_KEY: opts.serviceRoleKey,
+        VITE_BASE_PATH: basePath,
+      },
+    },
+  )
+}

package/src/systemd.ts

@@ -0,0 +1,137 @@
+/**
+ * systemd.ts — generate systemd unit files for self-hosted deployments.
+ *
+ * Usage:
+ *   generateUnits(config, outputDir)
+ *   → writes supatype-postgres.service + supatype-server.service to outputDir
+ */
+
+import { writeFileSync, mkdirSync } from "node:fs"
+import { join, resolve } from "node:path"
+import { homedir } from "node:os"
+import type { SupatypeProjectConfig } from "./project-config.js"
+
+export interface SystemdOptions {
+  /** Directory where unit files are written. Defaults to .supatype/systemd/. */
+  outputDir?: string
+  /** User to run services as. Defaults to current user. */
+  user?: string
+  /** EnvironmentFile path injected into the units. Defaults to project .env. */
+  envFile?: string
+}
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/**
+ * Generate supatype-postgres.service and supatype-server.service.
+ *
+ * Returns the paths of the written files.
+ */
+export function generateUnits(
+  config: SupatypeProjectConfig,
+  projectDir: string,
+  opts: SystemdOptions = {},
+): { postgres: string; server: string } {
+  const outputDir = opts.outputDir ?? resolve(projectDir, ".supatype", "systemd")
+  mkdirSync(outputDir, { recursive: true })
+
+  const user = opts.user ?? process.env["USER"] ?? "supatype"
+  const envFile = opts.envFile ?? resolve(projectDir, ".env")
+  const stateDir = join(homedir(), ".supatype", "projects", config.project.name)
+
+  const postgresPath = join(outputDir, "supatype-postgres.service")
+  const serverPath = join(outputDir, "supatype-server.service")
+
+  writeFileSync(postgresPath, postgresUnit(config, stateDir, user, envFile), "utf8")
+  writeFileSync(serverPath, serverUnit(config, stateDir, user, envFile), "utf8")
+
+  return { postgres: postgresPath, server: serverPath }
+}
+
+// ---------------------------------------------------------------------------
+// Unit templates
+// ---------------------------------------------------------------------------
+
+function postgresUnit(
+  config: SupatypeProjectConfig,
+  stateDir: string,
+  user: string,
+  envFile: string,
+): string {
+  const dataDir = config.database.data_dir ?? join(stateDir, "data")
+  const logDir = join(stateDir, "logs")
+  const pgBinDir = `%h/.supatype/cache/postgres/${config.versions.postgres}/bin`
+
+  return `[Unit]
+Description=Supatype Postgres (${config.project.name})
+After=network.target
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+Type=forking
+User=${user}
+EnvironmentFile=-${envFile}
+ExecStartPre=/bin/mkdir -p ${logDir}
+ExecStart=${pgBinDir}/pg_ctl start \\
+  -D ${dataDir} \\
+  -l ${logDir}/postgres.log \\
+  -w \\
+  -t 60
+ExecStop=${pgBinDir}/pg_ctl stop -D ${dataDir} -m fast
+ExecReload=${pgBinDir}/pg_ctl reload -D ${dataDir}
+PIDFile=${stateDir}/pid/postgres.pid
+Restart=on-failure
+RestartSec=5s
+TimeoutStartSec=90
+TimeoutStopSec=30
+
+[Install]
+WantedBy=multi-user.target
+`
+}
+
+function serverUnit(
+  config: SupatypeProjectConfig,
+  stateDir: string,
+  user: string,
+  envFile: string,
+): string {
+  const port = config.server.port ?? 54321
+  const serverBin = `%h/.supatype/cache/server/${config.versions.server}/supatype-server`
+  const logDir = join(stateDir, "logs")
+
+  const extraArgs: string[] = [`--mode ${config.server.mode}`]
+  if (config.server.domain) extraArgs.push(`--domain ${config.server.domain}`)
+
+  return `[Unit]
+Description=Supatype Server (${config.project.name})
+After=network.target supatype-postgres.service
+Requires=supatype-postgres.service
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+Type=simple
+User=${user}
+EnvironmentFile=-${envFile}
+ExecStartPre=/bin/mkdir -p ${logDir}
+ExecStart=${serverBin} \\
+  --port ${port} \\
+  ${extraArgs.join(" \\\n  ")}
+PIDFile=${stateDir}/pid/server.pid
+StandardOutput=append:${logDir}/server.log
+StandardError=append:${logDir}/server.log
+Restart=on-failure
+RestartSec=5s
+TimeoutStartSec=30
+TimeoutStopSec=15
+KillMode=mixed
+KillSignal=SIGTERM
+
+[Install]
+WantedBy=multi-user.target
+`
+}

package/src/tsx-runner.ts

@@ -7,11 +7,16 @@ import { spawnSync, type SpawnSyncOptions } from "node:child_process"
 import { existsSync, readFileSync } from "node:fs"
 import { resolve, dirname } from "node:path"
 import { createRequire } from "node:module"
+import { fileURLToPath } from "node:url"
 import { writeFileSync, unlinkSync } from "node:fs"
 import { tmpdir } from "node:os"
 
 const _require = createRequire(import.meta.url)
 
+// The CLI's own source directory — workspace packages are
+// resolvable from here. Eval snippets are written here so ESM resolution finds them.
+const CLI_SRC_DIR = dirname(fileURLToPath(import.meta.url))
+
 /**
  * Resolve the absolute path to the tsx CLI entry point.
  * tsx is a direct dependency so this will always succeed after `npm install`.
@@ -34,6 +39,7 @@ function findTsxBin(): string {
 
 const TSX_BIN = findTsxBin()
 
+
 export interface RunResult {
   stdout: string
   stderr: string
@@ -65,7 +71,11 @@ export function evalTsSnippet(
   snippet: string,
   opts: SpawnSyncOptions = {},
 ): RunResult {
-  const tmpFile = resolve(tmpdir(), `supatype-eval-${Date.now()}.mts`)
+  // Always write the temp file into the CLI's source directory so that ESM
+  // resolution can find workspace packages from there.
+  // The subprocess CWD is kept as opts.cwd (the user's project dir) so that
+  // any relative paths in the snippet resolve correctly.
+  const tmpFile = resolve(CLI_SRC_DIR, `supatype-eval-${Date.now()}.mts`)
   writeFileSync(tmpFile, snippet, "utf8")
   try {
     return runTsFile(tmpFile, opts)