@supatype/cli 0.1.0-alpha.7 → 0.1.0-alpha.9

package/src/commands/dev.ts

@@ -1,9 +1,9 @@
 /**
  * supatype dev — start local Postgres, apply schema, run supatype-server.
  *
- * Supports two database providers (set in supatype.config.ts):
- *   provider = "native" — manages a native Postgres binary from the supatype cache (default when omitted)
- *   provider = "docker" — runs supatype/postgres via Docker (includes all extensions)
+ * Runtime provider (top-level `provider` or legacy `database.provider`):
+ *   native — host Postgres + host server + host engine (default)
+ *   docker — full self-host Compose stack (Kong :18473); see dev-compose.ts
  *
  * Edge functions (when a functions/ dir exists): Deno is resolved from the CDN cache
  * (auto-download on miss). Self-host/cloud Docker stacks use supatype-server in-container;
@@ -18,6 +18,7 @@ import { isAbsolute, join, relative, resolve } from "node:path"
 import { loadConfig } from "../config.js"
 import {
   functionsPathCandidatesFromProject,
+  resolveRuntimeProvider,
   schemaPathFromProject,
   type SupatypeProjectConfig,
 } from "../project-config.js"
@@ -32,7 +33,9 @@ import {
   postgresArchiveTag,
 } from "../binary-cache.js"
 import { ensureBinary } from "../ensure-binary.js"
+import { startProxyDevApp } from "../app/proxy-dev-app.js"
 import { ProcessManager } from "../process-manager.js"
+import { startStudioViteDevServer } from "../studio-dev-server.js"
 import { localStorageEnv } from "../local-storage.js"
 import {
   initdb,
@@ -42,15 +45,6 @@ import {
   isPortInUse,
   pgSpawnEnv,
 } from "../postgres-ctl.js"
-import {
-  dockerPgStart,
-  dockerPgStop,
-  dockerPgWaitReady,
-  dockerDbUrl,
-} from "../docker-postgres.js"
-
-const DEFAULT_DOCKER_IMAGE = "supatype/postgres:17-latest"
-
 /** Map `email.smtp` from supatype.config.ts into GOTRUE_SMTP_* for the embedded GoTrue process. */
 function gotrueSMTPFromEmailConfig(email: SupatypeProjectConfig["email"] | undefined): Record<string, string> {
   const s = email?.smtp
@@ -90,7 +84,13 @@ export function registerDev(program: Command): void {
       const projectName = config.project.name
       const serverPort = opts.port ?? String(config.server.port ?? 54321)
       const postgrestPort = String(config.server.postgrestPort ?? 3001)
-      const provider = config.database.provider ?? "native"
+      const provider = resolveRuntimeProvider(config)
+
+      if (provider === "docker") {
+        const { runDevCompose } = await import("../dev-compose.js")
+        await runDevCompose(cwd, config, { watch: opts.watch !== false })
+        return
+      }
 
       // ── 2. Resolve engine + server binaries ──────────────────────────────
       console.log(`[supatype] Resolving component binaries for "${projectName}"...`)
@@ -136,22 +136,12 @@ export function registerDev(program: Command): void {
       // ── 5–7. Start Postgres ───────────────────────────────────────────────
       let dbURL: string
       let stopPostgres: () => void | Promise<void>
+      const pgPassword = "postgres"
       // pgBinDir is set on the native path and used to add DLL search path for
       // PostgREST on Windows (PostgREST links against libpq + SSL from MinGW).
       let pgBinDir: string | null = null
 
-      if (provider === "docker") {
-        console.log(
-          "[supatype] database.provider \"docker\" — Postgres runs in Docker; engine and supatype-server stay native.",
-        )
-        const image = config.database.image ?? DEFAULT_DOCKER_IMAGE
-        console.log(`[supatype] Starting Postgres via Docker (${image})...`)
-        dockerPgStart({ image, projectName, port: pgPort })
-        await dockerPgWaitReady(projectName, 90_000)
-        console.log("[supatype] Postgres is ready.")
-        dbURL = dockerDbUrl(projectName, pgPort)
-        stopPostgres = () => dockerPgStop(projectName)
-      } else {
+      {
         // native — resolve pg bin dir and manage with pg_ctl
         pgBinDir = await resolvePgBinDir(config)
         const dataDir = config.database.data_dir ?? join(stateRoot, "data")
@@ -167,7 +157,7 @@ export function registerDev(program: Command): void {
         dbURL = `postgres://postgres:postgres@127.0.0.1:${pgPort}/${projectName}?sslmode=disable`
         stopPostgres = () => pgStop(pgOpts)
 
-        // Create project database if it doesn't exist.
+        // Create project database if it doesn't exist (native only).
         const psqlBin    = join(pgBinDir, process.platform === "win32" ? "psql.exe"    : "psql")
         const createdbBin = join(pgBinDir, process.platform === "win32" ? "createdb.exe" : "createdb")
         const pgConnArgs = ["-h", "127.0.0.1", "-p", String(pgPort), "-U", "postgres"]
@@ -225,7 +215,8 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
 
       // ── 8. GoTrue migrations (auth.users before engine studio SQL) ─────────
       console.log("[supatype] Running GoTrue migrations...")
-      runGotrueMigrations(serverBin, authDbURL, LOCAL_JWT_SECRET)
+      const migrateEnv = gotrueMigrateEnv(serverPort, dbURL, LOCAL_JWT_SECRET)
+      runGotrueMigrations(serverBin, migrateEnv)
 
       // ── 9. Engine: apply schema ───────────────────────────────────────────
       const schemaPath = schemaPathFromProject(config, cwd)
@@ -236,9 +227,9 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
 
       const localStoragePath = config.storage?.provider !== "s3" ? join(stateRoot, "storage") : undefined
       // Native Postgres builds don't include PostGIS — skip geo fields rather than failing.
-      const skipFieldKinds: ReadonlySet<string> = provider === "native" ? new Set(["geo", "vector"]) : new Set()
+      const skipFieldKinds: ReadonlySet<string> = new Set(["geo", "vector"])
 
-      await runSchemaPush(cwd, engineBin, schemaPath, dbURL, manifestPath, adminConfigPath, localStoragePath, skipFieldKinds).catch(
+      await runSchemaPush(cwd, engineBin, schemaPath, dbURL, manifestPath, adminConfigPath, localStoragePath, skipFieldKinds, config).catch(
         (e: unknown) => console.error("[supatype] Initial schema push failed:", (e as Error).message),
       )
 
@@ -325,8 +316,11 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
           ? { SUPATYPE_VITE_DEV_URL: config.app.vite_dev_url.trim() }
           : {}),
         // GoTrue required fields (sensible local-dev defaults)
+        GOTRUE_DB_DATABASE_URL: authDbURL,
         DATABASE_URL: authDbURL,
         SUPATYPE_SQL_DATABASE_URL: dbURL,
+        PGSSLMODE: "disable",
+        GOTRUE_DB_NAMESPACE: "auth",
         GOTRUE_DB_DRIVER: "postgres",
         GOTRUE_JWT_SECRET: LOCAL_JWT_SECRET,
         GOTRUE_JWT_EXP: "3600",
@@ -400,7 +394,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
 
         const postgrestEnv: Record<string, string> = {
           PGRST_DB_URI: dbURL,
-          PGRST_DB_SCHEMA: "public, supatype",
+          PGRST_DB_SCHEMA: "public, supatype, graphql_public",
           PGRST_DB_ANON_ROLE: "anon",
           PGRST_SERVER_PORT: postgrestPort,
           PGRST_SERVER_HOST: "127.0.0.1",
@@ -445,39 +439,19 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
 
       const studioOverride = config.overrides?.studio
       if (studioOverride) {
-        const studioDir = resolve(cwd, studioOverride)
-        // Run vite's JS entry directly via node — avoids .cmd/.sh wrapper spawn issues on Windows.
-        const viteJs = join(studioDir, "node_modules", "vite", "bin", "vite.js")
-        if (existsSync(viteJs)) {
-          studioProc = new ProcessManager(
-            process.execPath,
-            [viteJs, "--port", String(studioPort), "--strictPort"],
-            {
-              label: "studio",
-              pidDir,
-              cwd: studioDir,
-              colour: "\x1b[35m",
-              env: {
-                // Point the studio at the Vite dev server (same origin as the
-                // browser) so all API requests are same-origin — CORS never fires.
-                // Vite's dev proxy (configured via SUPATYPE_PROXY_TARGET) then
-                // forwards those requests server-side to the actual backend.
-                VITE_SUPATYPE_URL: `http://localhost:${studioPort}`,
-                SUPATYPE_PROXY_TARGET: `http://localhost:${serverPort}`,
-                // Studio is a developer tool — use service_role key to bypass
-                // RLS so all tables and rows are visible regardless of policies.
-                VITE_SUPATYPE_ANON_KEY: serviceRoleKey,
-                VITE_SUPATYPE_SERVICE_ROLE_KEY: serviceRoleKey,
-                VITE_BASE_PATH: "/",
-              },
-            },
-          )
-          studioProc.start()
-        } else {
-          console.warn(`[supatype] ⚠  Studio override set but vite not found at ${viteJs}. Run: pnpm install`)
-        }
+        studioProc = startStudioViteDevServer({
+          cwd,
+          studioOverride,
+          pidDir,
+          serviceRoleKey,
+          proxyTarget: `http://localhost:${serverPort}`,
+          viteSupatypeUrl: `http://localhost:${studioPort}`,
+        })
+        studioProc?.start()
       }
 
+      const appProc = startProxyDevApp(cwd, config, pidDir)
+
       // ── Print status ──────────────────────────────────────────────────────
       console.log(`
 [supatype] Services running:
@@ -505,6 +479,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
           serverProc.stop(),
           postgrestProc?.stop(),
           studioProc?.stop(),
+          appProc?.stop(),
         ])
         await stopPostgres()
         process.exit(0)
@@ -527,7 +502,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
           debounceTimer = setTimeout(() => {
             debounceTimer = null
             console.log(`\n[supatype] Change detected in ${filename}, checking schema...`)
-            runSchemaPush(cwd, engineBin, schemaPath, dbURL, manifestPath, adminConfigPath, localStoragePath, skipFieldKinds).catch((e: unknown) =>
+            runSchemaPush(cwd, engineBin, schemaPath, dbURL, manifestPath, adminConfigPath, localStoragePath, skipFieldKinds, config).catch((e: unknown) =>
               console.error("[supatype] Schema push failed:", (e as Error).message),
             )
           }, 300)
@@ -557,6 +532,7 @@ async function runSchemaPush(
   adminConfigPath?: string,
   storagePath?: string,
   skipFieldKinds?: ReadonlySet<string>,
+  config?: import("../project-config.js").SupatypeProjectConfig,
 ): Promise<void> {
   // Build AST JSON from schema file.
   const { loadSchemaAst } = await import("../config.js")
@@ -590,7 +566,7 @@ async function runSchemaPush(
   console.log("[supatype] Applying schema...")
   const pushResult = spawnSync(
     engineBin,
-    ["push", "-i", astPath, "--database-url", dbURL, "--force"],
+    ["push", "-i", astPath, "--database-url", dbURL, "--force", "--non-interactive"],
     { cwd, stdio: "inherit", encoding: "utf8" },
   )
   if (pushResult.status !== 0) {
@@ -640,7 +616,15 @@ async function runSchemaPush(
       { cwd, stdio: "pipe", encoding: "utf8" },
     )
     if (adminResult.status === 0 && adminResult.stdout) {
-      writeFileSync(adminConfigPath, adminResult.stdout)
+      const { withAdminRoles } = await import("../studio-admin-roles.js")
+      let admin: unknown
+      try {
+        admin = JSON.parse(adminResult.stdout) as unknown
+      } catch {
+        admin = adminResult.stdout
+      }
+      const merged = config ? withAdminRoles(admin, config) : admin
+      writeFileSync(adminConfigPath, `${JSON.stringify(merged, null, 2)}\n`)
     }
   }
 
@@ -960,20 +944,39 @@ function adaptUnsupportedKinds(
 // .env loader
 // ---------------------------------------------------------------------------
 
+/** Minimal GoTrue env for `migrate` (matches required fields in serverEnv below). */
+function gotrueMigrateEnv(
+  serverPort: string,
+  sqlDbURL: string,
+  jwtSecret: string,
+): Record<string, string> {
+  const base = `http://localhost:${serverPort}`
+  return {
+    // envconfig: gotrue + DB.DATABASE_URL → GOTRUE_DB_DATABASE_URL
+    GOTRUE_DB_DATABASE_URL: sqlDbURL,
+    DATABASE_URL: sqlDbURL,
+    GOTRUE_DB_DRIVER: "postgres",
+    GOTRUE_DB_NAMESPACE: "auth",
+    PGSSLMODE: "disable",
+    GOTRUE_JWT_SECRET: jwtSecret,
+    API_EXTERNAL_URL: `${base}/auth/v1`,
+    GOTRUE_API_HOST: "localhost",
+    GOTRUE_SITE_URL: base,
+    GOTRUE_MAILER_AUTOCONFIRM: "true",
+  }
+}
+
 /** Apply GoTrue DDL (auth.users, etc.) before engine push references auth schema. */
 function runGotrueMigrations(
   serverBin: string,
-  authDbURL: string,
-  jwtSecret: string,
+  migrateEnv: Record<string, string>,
 ): void {
   const result = spawnSync(serverBin, ["migrate"], {
     stdio: "pipe",
     encoding: "utf8",
     env: {
       ...process.env,
-      DATABASE_URL: authDbURL,
-      GOTRUE_DB_DRIVER: "postgres",
-      GOTRUE_JWT_SECRET: jwtSecret,
+      ...migrateEnv,
     },
   })
   if (result.status !== 0) {

package/src/commands/diff.ts

@@ -2,6 +2,7 @@ import type { Command } from "commander"
 import { loadConfig, loadSchemaAst } from "../config.js"
 import { connectionString, schemaPathFromProject } from "../project-config.js"
 import { ensureEngine, engineRequest, type DiffResult } from "../engine-client.js"
+import { printDiffWarnings } from "../diff-output.js"
 
 export function registerDiff(program: Command): void {
   program
@@ -25,6 +26,7 @@ export function registerDiff(program: Command): void {
       })
 
       const ops = diff.operations ?? []
+      printDiffWarnings(diff)
 
       if (ops.length === 0) {
         console.log("No changes.")
@@ -34,9 +36,17 @@ export function registerDiff(program: Command): void {
       const symbol: Record<NonNullable<DiffResult["operations"][number]["risk"]>, string> = {
         safe: "+",
         warn: "~",
+        cautious: "~",
         danger: "!",
+        destructive: "!",
+      }
+      const legend: typeof symbol = {
+        safe: "safe",
+        warn: "caution",
+        cautious: "caution",
+        danger: "DANGER",
+        destructive: "DANGER",
       }
-      const legend: typeof symbol = { safe: "safe", warn: "caution", danger: "DANGER" }
 
       console.log(`\n${ops.length} change(s):\n`)
       for (const op of ops) {

package/src/commands/init.ts

@@ -134,9 +134,10 @@ function tsConfigTemplate(projectName: string, mode: "dev" | "standalone", versi
 
 export default defineConfig({
   project: { name: "${projectName}" },
+  provider: "native",
+  // provider: "docker"  // full self-host Compose stack (Kong :18473)
   database: {
     provider: "native",
-    // provider: "docker", image: "supatype/postgres:17-latest"  // full extensions stack via Docker
   },
   server: {
     mode: "${mode}",
@@ -145,7 +146,7 @@ ${domainField}  },
   app: {
     mode: "none",
     // mode: "static", static_dir: "./public",  // supatype app add --static ./public
-    // mode: "proxy", upstream: "http://localhost:3000",
+    // mode: "proxy", upstream: "http://localhost:3000", start: "dev",
     // vite_dev_url: "http://127.0.0.1:5173",  // dev HMR at /_vite (when using a separate Vite server)
   },
   versions: {
@@ -163,7 +164,7 @@ ${domainField}  },
 }
 
 function schemaTemplate(): string {
-  return `import type { Model, Public, Owner, Role, SupatypeAuthUserId, Unique, Email } from "@supatype/types"
+  return `import type { Model, Public, Owner, Role, SupatypeAuthUserId, Unique, Email, UUID } from "@supatype/types"
 
 export type User = Model<{
   id: SupatypeAuthUserId
@@ -179,6 +180,18 @@ export type User = Model<{
     delete: Role<"admin">
   }
 }>
+
+/** Example singleton global — editable in Studio under Settings. */
+export type SiteSettings = Model<{
+  id: UUID
+  site_name: string
+}, {
+  singleton: true
+  access: {
+    read: Public
+    update: Role<"admin">
+  }
+}>
 `
 }
 

package/src/commands/push.ts

@@ -3,11 +3,15 @@ import { mkdirSync, writeFileSync } from "node:fs"
 import { createInterface } from "node:readline"
 import { join } from "node:path"
 import { loadConfig, loadSchemaAst } from "../config.js"
-import { connectionString, schemaPathFromProject, serverBaseUrl } from "../project-config.js"
+import { connectionString, resolveRuntimeProvider, schemaPathFromProject, serverBaseUrl } from "../project-config.js"
+import { isCloudLinked, pushSchemaToLinkedProject } from "./cloud.js"
 import { ensureEngine, engineRequest, type DiffResult, type Operation } from "../engine-client.js"
+import { printDiffWarnings } from "../diff-output.js"
 import { signJwt } from "../jwt.js"
 import { provisionBuckets } from "../storage-provision.js"
 import { promptFirstAdminUser } from "./admin.js"
+import { withAdminRoles } from "../studio-admin-roles.js"
+import type { SupatypeProjectConfig } from "../project-config.js"
 
 const DEV_JWT_SECRET = "super-secret-jwt-token-with-at-least-32-characters-long"
 
@@ -21,7 +25,27 @@ export function registerPush(program: Command): void {
     .option("--connection <url>", "Database connection URL (overrides config)")
     .action(async (opts: { yes?: boolean; connection?: string }) => {
       const cwd = process.cwd()
+
+      if (isCloudLinked(cwd)) {
+        if (opts.connection) {
+          console.error("--connection is not allowed when linked to a cloud project (credentials stay server-side).")
+          process.exit(1)
+        }
+        await pushSchemaToLinkedProject(cwd, { force: opts.yes ?? true })
+        return
+      }
+
       const config = loadConfig(cwd)
+
+      // Docker provider: the compose Postgres isn't published to the host, so
+      // apply the schema through the in-compose schema-engine (unless the user
+      // gave an explicit --connection to a reachable database).
+      if (!opts.connection && resolveRuntimeProvider(config) === "docker") {
+        const { pushSchemaDocker } = await import("../dev-compose.js")
+        await pushSchemaDocker(cwd, config)
+        return
+      }
+
       const connection = opts.connection ?? connectionString(config)
 
       await ensureEngine()
@@ -37,18 +61,21 @@ export function registerPush(program: Command): void {
       })
 
       const ops = diff.operations ?? []
+      printDiffWarnings(diff)
 
       if (ops.length === 0) {
         console.log(
-          "Schema matches the database (no DDL). Refreshing admin metadata and local Studio config...",
+          "Schema matches the database (no DDL). Syncing Studio metadata...",
         )
       } else {
         printDiff(ops)
 
-        const destructive = ops.filter((o) => o.risk === "danger")
-        if (destructive.length > 0 && !opts.yes) {
+        const risky = ops.filter(
+          (o) => o.risk === "cautious" || o.risk === "destructive" || o.risk === "warn" || o.risk === "danger",
+        )
+        if (risky.length > 0 && !opts.yes) {
           const confirmed = await confirm(
-            `\n${destructive.length} destructive operation(s) above. Proceed? [y/N] `,
+            `\n${risky.length} risky operation(s) above (type changes or data loss). Proceed? [y/N] `,
           )
           if (!confirmed) {
             console.log("Aborted.")
@@ -71,14 +98,14 @@ export function registerPush(program: Command): void {
       if (pushResult.status === "up_to_date") {
         console.log(
           pushResult.admin_refreshed
-            ? "Admin config updated on the latest migration record (no SQL applied)."
+            ? "Database schema unchanged — Studio metadata synced."
             : "Schema is up to date.",
         )
       } else {
         console.log(pushResult.message ?? "Migration applied.")
       }
 
-      await writeLocalAdminConfig(ast)
+      await writeLocalAdminConfig(ast, config)
 
       // After a DDL migration, check if this is the first push and offer to create an
       // admin user if none exist (Gap Appendices task 48).
@@ -130,20 +157,29 @@ export function registerPush(program: Command): void {
         console.log(genResult.message ?? "Types generated.")
       }
 
-      console.log("\nDone.")
+      const studioBase = baseUrl?.replace(/\/$/, "") ?? ""
+      if (studioBase) {
+        console.log(`\nStudio: ${studioBase}/studio/ — sign in with the admin user you created.`)
+      } else {
+        console.log("\nDone.")
+      }
     })
 }
 
 function printDiff(ops: Operation[]): void {
-  const symbol: Record<NonNullable<Operation["risk"]>, string> = {
+  const symbol: Record<string, string> = {
     safe: "+",
     warn: "~",
+    cautious: "~",
     danger: "!",
+    destructive: "!",
   }
   console.log(`\n${ops.length} change(s) planned:\n`)
   for (const op of ops) {
-    const s = op.risk ? symbol[op.risk] : "?"
-    console.log(`  [${s}] ${formatOperation(op)}`)
+    const riskKey = op.risk ?? "safe"
+    const s = symbol[riskKey] ?? "?"
+    const label = op.warning ?? op.description ?? formatOperation(op)
+    console.log(`  [${s}] ${label}`)
   }
 }
 
@@ -179,10 +215,10 @@ async function confirm(prompt: string): Promise<boolean> {
 }
 
 /** Write `.supatype/admin-config.json` for local Studio (same layout as `supatype dev`). */
-async function writeLocalAdminConfig(ast: unknown): Promise<void> {
+async function writeLocalAdminConfig(ast: unknown, config: SupatypeProjectConfig): Promise<void> {
   const cwd = process.cwd()
   const dir = join(cwd, ".supatype")
   mkdirSync(dir, { recursive: true })
-  const admin = await engineRequest<unknown>("/admin", { ast })
+  const admin = withAdminRoles(await engineRequest<unknown>("/admin", { ast }), config)
   writeFileSync(join(dir, "admin-config.json"), `${JSON.stringify(admin, null, 2)}\n`)
 }

package/src/commands/update.ts

@@ -7,6 +7,8 @@ import type { Command } from "commander"
 import { existsSync, readFileSync, writeFileSync } from "node:fs"
 import { basename, resolve } from "node:path"
 import { loadConfig } from "../config.js"
+import { resolveRuntimeProvider } from "../project-config.js"
+import { runDockerCompose, writeSelfHostCompose } from "../self-host-compose.js"
 import { download, currentPlatform, fetchAllLatestVersions, type Component } from "../binary-cache.js"
 
 const CONFIG_CANDIDATES = ["supatype.config.ts", "supatype.config.js", "supatype.config.mjs"]
@@ -29,6 +31,21 @@ export function registerUpdate(program: Command): void {
     .action(async (opts: { check: boolean }) => {
       const cwd = process.cwd()
       const config = loadConfig(cwd)
+      const provider = resolveRuntimeProvider(config)
+
+      if (provider === "docker") {
+        if (opts.check) {
+          console.log("Docker provider: run without --check to pull compose images (supatype self-host compose pull).")
+          return
+        }
+        const paths = writeSelfHostCompose(cwd, config, { devLocal: true })
+        console.log("Pulling self-host compose images...")
+        const status = runDockerCompose(paths.composePath, ["pull"], cwd)
+        if (status !== 0) process.exit(status)
+        console.log("Compose images updated.")
+        return
+      }
+
       const platform = currentPlatform()
 
       const components: Component[] = ["engine", "server", "postgres", "deno"]