@supatype/cli 0.1.0-alpha.8 → 0.1.0

package/dist/app/proxy-dev-app.js

@@ -1,10 +1,12 @@
 /**
  * Spawn the frontend dev server during `supatype dev` when app.mode is proxy.
  */
+import { execSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { detectPackageManager } from "./framework.js";
-import { ProcessManager } from "../process-manager.js";
+import { appendDevTaskLog } from "../dev-session.js";
+import { ProcessManager, readPid } from "../process-manager.js";
 import { projectRootFromConfig } from "../project-config.js";
 const DEFAULT_PROXY_DEV_SCRIPT = "start";
 /** package.json script name to run (only when app.mode is proxy). */
@@ -14,6 +16,102 @@ export function resolveProxyDevScript(config) {
     const script = config.app.start?.trim();
     return script && script.length > 0 ? script : DEFAULT_PROXY_DEV_SCRIPT;
 }
+/** Port from app.upstream (e.g. http://localhost:5285 → 5285). */
+export function portFromUpstream(config) {
+    const raw = config.app?.upstream?.trim();
+    if (!raw)
+        return null;
+    try {
+        const port = new URL(raw).port;
+        if (!port)
+            return null;
+        const n = Number(port);
+        return Number.isFinite(n) && n > 0 ? n : null;
+    }
+    catch {
+        return null;
+    }
+}
+function killPidTree(pid) {
+    if (!Number.isFinite(pid) || pid <= 0)
+        return;
+    try {
+        if (process.platform === "win32") {
+            execSync(`taskkill /pid ${pid} /T /F`, { stdio: "ignore" });
+        }
+        else {
+            execSync(`kill -9 ${pid}`, { stdio: "ignore" });
+        }
+    }
+    catch {
+        /* already gone */
+    }
+}
+function killPortListeners(port) {
+    if (process.platform === "win32") {
+        try {
+            const out = execSync(`netstat -ano | findstr :${port}`, { encoding: "utf8" });
+            const pids = new Set();
+            for (const line of out.split("\n")) {
+                const match = line.match(/LISTENING\s+(\d+)/);
+                if (match?.[1])
+                    pids.add(match[1]);
+            }
+            for (const pid of pids) {
+                try {
+                    execSync(`taskkill /pid ${pid} /T /F`, { stdio: "ignore" });
+                }
+                catch {
+                    /* already gone */
+                }
+            }
+        }
+        catch {
+            /* nothing listening */
+        }
+        return;
+    }
+    try {
+        const out = execSync(`lsof -ti :${port}`, { encoding: "utf8" });
+        for (const pid of out.trim().split(/\s+/)) {
+            try {
+                execSync(`kill -9 ${pid}`, { stdio: "ignore" });
+            }
+            catch {
+                /* already gone */
+            }
+        }
+    }
+    catch {
+        /* nothing listening */
+    }
+}
+/** Free the upstream port and any stale app PID before spawning Vite. */
+export function freeProxyDevPort(pidDir, port) {
+    const stalePid = readPid(pidDir, "app");
+    if (stalePid)
+        killPidTree(stalePid);
+    killPortListeners(port);
+}
+/**
+ * When a package.json script only runs Vite, spawn node + vite.js directly.
+ * Avoids Windows shell shims (pnpm → bash → vite) that orphan the real server
+ * and break PID-based cleanup / auto-restart.
+ */
+export function resolveViteDirectSpawn(appDir, script, scripts) {
+    const body = scripts?.[script]?.trim() ?? "";
+    if (!body)
+        return null;
+    const runsVite = body === "vite" ||
+        /^vite\s/.test(body) ||
+        body.includes("vite/bin/vite");
+    if (!runsVite)
+        return null;
+    const viteJs = join(appDir, "node_modules", "vite", "bin", "vite.js");
+    if (!existsSync(viteJs))
+        return null;
+    return { bin: process.execPath, args: [viteJs], shell: false };
+}
 /**
  * Start the configured package.json script for proxy dev.
  * Returns null when not in proxy mode or when the script is missing.
@@ -34,18 +132,24 @@ export function startProxyDevApp(cwd, config, pidDir) {
             `  Add "scripts.${script}" or set app.start in supatype.config.ts`);
         return null;
     }
+    const upstreamPort = portFromUpstream(config);
+    const directVite = resolveViteDirectSpawn(appDir, script, pkg.scripts);
     const pm = detectPackageManager(appDir);
-    const bin = pm;
-    const args = pm === "yarn" ? [script] : ["run", script];
-    // pnpm/npm/yarn are .cmd shims on Windows — spawn via shell so PATH resolution works.
-    const useShell = process.platform === "win32";
-    console.log(`[supatype] Proxy mode: running ${bin} ${args.join(" ")} (${appDir})`);
+    const bin = directVite?.bin ?? pm;
+    const args = directVite?.args ?? (pm === "yarn" ? [script] : ["run", script]);
+    const useShell = directVite ? false : process.platform === "win32";
+    appendDevTaskLog("app", "app", directVite
+        ? `Proxy mode: running node vite.js (${appDir})`
+        : `Proxy mode: running ${bin} ${args.join(" ")} (${appDir})`);
+    if (upstreamPort)
+        freeProxyDevPort(pidDir, upstreamPort);
     const manager = new ProcessManager(bin, args, {
         label: "app",
         pidDir,
         cwd: appDir,
         colour: "\x1b[33m",
         shell: useShell,
+        ...(upstreamPort ? { beforeRestart: () => freeProxyDevPort(pidDir, upstreamPort) } : {}),
     });
     manager.start();
     return manager;

package/dist/app/proxy-dev-app.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-dev-app.js","sourceRoot":"","sources":["../../src/app/proxy-dev-app.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,qBAAqB,EAA8B,MAAM,sBAAsB,CAAA;AAExF,MAAM,wBAAwB,GAAG,OAAO,CAAA;AAExC,qEAAqE;AACrE,MAAM,UAAU,qBAAqB,CAAC,MAA6B;IACjE,IAAI,MAAM,CAAC,GAAG,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAA;IACvC,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAA;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,MAA6B,EAC7B,MAAc;IAEd,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAExB,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IAC5C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,oDAAoD,MAAM,oBAAoB,CAAC,CAAA;QAC5F,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAEnD,CAAA;IACD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CACV,mDAAmD,MAAM,aAAa;YACpE,kBAAkB,MAAM,0CAA0C,CACrE,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IACvC,MAAM,GAAG,GAAG,EAAE,CAAA;IACd,MAAM,IAAI,GAAG,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACvD,sFAAsF;IACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;IAE7C,OAAO,CAAC,GAAG,CAAC,kCAAkC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,GAAG,CAAC,CAAA;IAElF,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE;QAC5C,KAAK,EAAE,KAAK;QACZ,MAAM;QACN,GAAG,EAAE,MAAM;QACX,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;IACF,OAAO,CAAC,KAAK,EAAE,CAAA;IACf,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"proxy-dev-app.js","sourceRoot":"","sources":["../../src/app/proxy-dev-app.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAE,qBAAqB,EAA8B,MAAM,sBAAsB,CAAA;AAExF,MAAM,wBAAwB,GAAG,OAAO,CAAA;AAExC,qEAAqE;AACrE,MAAM,UAAU,qBAAqB,CAAC,MAA6B;IACjE,IAAI,MAAM,CAAC,GAAG,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAA;IACvC,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAA;AACxE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,MAA6B;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAA;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAM;IAC7C,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,QAAQ,CAAC,iBAAiB,GAAG,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC7D,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,WAAW,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,2BAA2B,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YAC7E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;gBAC7C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YACpC,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,QAAQ,CAAC,iBAAiB,GAAG,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;gBAC7D,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;QACD,OAAM;IACR,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QAC/D,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,QAAQ,CAAC,WAAW,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAAY;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACvC,IAAI,QAAQ;QAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IACnC,iBAAiB,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,MAAc,EACd,OAA2C;IAE3C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAEtB,MAAM,QAAQ,GACZ,IAAI,KAAK,MAAM;QACf,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;IAEhC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAE1B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IACrE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAEpC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,MAA6B,EAC7B,MAAc;IAEd,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAExB,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IAC5C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,oDAAoD,MAAM,oBAAoB,CAAC,CAAA;QAC5F,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAEnD,CAAA;IACD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CACV,mDAAmD,MAAM,aAAa;YACpE,kBAAkB,MAAM,0CAA0C,CACrE,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IACtE,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IACvC,MAAM,GAAG,GAAG,UAAU,EAAE,GAAG,IAAI,EAAE,CAAA;IACjC,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;IAC7E,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;IAElE,gBAAgB,CACd,KAAK,EACL,KAAK,EACL,UAAU;QACR,CAAC,CAAC,qCAAqC,MAAM,GAAG;QAChD,CAAC,CAAC,uBAAuB,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,GAAG,CAC/D,CAAA;IAED,IAAI,YAAY;QAAE,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAExD,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE;QAC5C,KAAK,EAAE,KAAK;QACZ,MAAM;QACN,GAAG,EAAE,MAAM;QACX,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,QAAQ;QACf,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC,CAAA;IACF,OAAO,CAAC,KAAK,EAAE,CAAA;IACf,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/app-config.d.ts

@@ -4,4 +4,14 @@ export interface UpdateAppConfigInput {
     upstream?: string;
 }
 export declare function updateAppConfigInProject(cwd: string, input: UpdateAppConfigInput): string;
+export interface UpdateServerConfigInput {
+    domain: string;
+    tlsEmail: string;
+    provider?: "kong" | "none";
+}
+/**
+ * Set `server.mode = "standalone"` plus `domain` and `tls` in supatype.config.ts,
+ * enabling self-host HTTPS. Preserves other `server` keys (port, etc).
+ */
+export declare function updateServerConfigInProject(cwd: string, input: UpdateServerConfigInput): string;
 //# sourceMappingURL=app-config.d.ts.map

package/dist/app-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../src/app-config.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAQzF"}
+{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../src/app-config.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAQzF;AAuCD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAC3B;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAQ/F"}

package/dist/app-config.js

@@ -46,6 +46,78 @@ function updateAppConfigAst(configPath, input) {
     }
     return sourceFile.getFullText();
 }
+/**
+ * Set `server.mode = "standalone"` plus `domain` and `tls` in supatype.config.ts,
+ * enabling self-host HTTPS. Preserves other `server` keys (port, etc).
+ */
+export function updateServerConfigInProject(cwd, input) {
+    const configPath = resolve(cwd, "supatype.config.ts");
+    if (!existsSync(configPath)) {
+        throw new Error("supatype.config.ts not found. Run: supatype init");
+    }
+    const next = updateServerConfigAst(configPath, input);
+    writeFileSync(configPath, next, "utf8");
+    return configPath;
+}
+function updateServerConfigAst(configPath, input) {
+    const project = new Project({
+        useInMemoryFileSystem: false,
+        skipAddingFilesFromTsConfig: true,
+        manipulationSettings: {
+            quoteKind: QuoteKind.Double,
+        },
+    });
+    const srcText = readFileSync(configPath, "utf8");
+    const sourceFile = project.createSourceFile(configPath, srcText, { overwrite: true });
+    const rootObject = getRootConfigObject(sourceFile);
+    const serverProperty = rootObject.getProperty("server");
+    if (serverProperty === undefined) {
+        rootObject.addPropertyAssignment({
+            name: "server",
+            initializer: renderServerInitializer(input),
+        });
+    }
+    else if (Node.isPropertyAssignment(serverProperty)) {
+        const init = serverProperty.getInitializer();
+        if (init && Node.isObjectLiteralExpression(init)) {
+            patchServerObject(init, input);
+        }
+        else {
+            serverProperty.setInitializer(renderServerInitializer(input));
+        }
+    }
+    else {
+        serverProperty.remove();
+        rootObject.addPropertyAssignment({
+            name: "server",
+            initializer: renderServerInitializer(input),
+        });
+    }
+    return sourceFile.getFullText();
+}
+function renderServerInitializer(input) {
+    const provider = input.provider ?? "kong";
+    return `{
+    mode: "standalone",
+    domain: "${input.domain}",
+    tls: { email: "${input.tlsEmail}", provider: "${provider}" },
+  }`;
+}
+function patchServerObject(serverObj, input) {
+    upsertStringProperty(serverObj, "mode", "standalone");
+    upsertStringProperty(serverObj, "domain", input.domain);
+    const provider = input.provider ?? "kong";
+    const tlsInitializer = `{ email: "${input.tlsEmail}", provider: "${provider}" }`;
+    const existing = serverObj.getProperty("tls");
+    if (existing && Node.isPropertyAssignment(existing)) {
+        existing.setInitializer(tlsInitializer);
+    }
+    else {
+        if (existing)
+            existing.remove();
+        serverObj.addPropertyAssignment({ name: "tls", initializer: tlsInitializer });
+    }
+}
 function getRootConfigObject(sourceFile) {
     const exportAssignment = sourceFile.getFirstDescendantByKind(SyntaxKind.ExportAssignment);
     if (!exportAssignment) {

package/dist/app-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.js","sourceRoot":"","sources":["../src/app-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAiD,MAAM,UAAU,CAAA;AAQ9G,MAAM,UAAU,wBAAwB,CAAC,GAAW,EAAE,KAA2B;IAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAA;IACrD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAClD,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IACvC,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB,EAAE,KAA2B;IACzE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,qBAAqB,EAAE,KAAK;QAC5B,2BAA2B,EAAE,IAAI;QACjC,oBAAoB,EAAE;YACpB,SAAS,EAAE,SAAS,CAAC,MAAM;SAC5B;KACF,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrF,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAElD,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IAEjD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,UAAU,CAAC,qBAAqB,CAAC;YAC/B,IAAI,EAAE,KAAK;YACX,WAAW,EAAE,oBAAoB,CAAC,KAAK,CAAC;SACzC,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,EAAE,CAAA;QACzC,IAAI,IAAI,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,MAAM,EAAE,CAAA;QACpB,UAAU,CAAC,qBAAqB,CAAC;YAC/B,IAAI,EAAE,KAAK;YACX,WAAW,EAAE,oBAAoB,CAAC,KAAK,CAAC;SACzC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,UAAU,CAAC,WAAW,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAsB;IACjD,MAAM,gBAAgB,GAAG,UAAU,CAAC,wBAAwB,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAA;IACzF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAA;IAC7C,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;QACtC,IAAI,QAAQ,IAAI,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,OAAO,QAAQ,CAAA;QACjB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA2B;IACvD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO;;mBAEQ,KAAK,CAAC,QAAQ,IAAI,uBAAuB;MACtD,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO;;qBAEU,KAAK,CAAC,SAAS,IAAI,QAAQ;MAC1C,CAAA;IACJ,CAAC;IACD,OAAO;;IAEL,CAAA;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B,EAAE,KAA2B;IAClF,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IAEhD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,IAAI,uBAAuB,CAAC,CAAA;QACnF,uBAAuB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QAC7C,OAAM;IACR,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAA;QACvE,uBAAuB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;QAC3C,OAAM;IACR,CAAC;IAED,uBAAuB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAC3C,uBAAuB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;AAC/C,CAAC;AAED,SAAS,oBAAoB,CAAC,GAA4B,EAAE,GAAW,EAAE,KAAa;IACpF,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,QAAQ,IAAI,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,QAAQ,CAAC,cAAc,CAAC,IAAI,KAAK,GAAG,CAAC,CAAA;QACrC,OAAM;IACR,CAAC;IACD,IAAI,QAAQ;QAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC/B,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,KAAK,GAAG,EAAE,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,uBAAuB,CAAC,GAA4B,EAAE,GAAW;IACxE,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,IAAI;QAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AACzB,CAAC"}
+{"version":3,"file":"app-config.js","sourceRoot":"","sources":["../src/app-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAiD,MAAM,UAAU,CAAA;AAQ9G,MAAM,UAAU,wBAAwB,CAAC,GAAW,EAAE,KAA2B;IAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAA;IACrD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAClD,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IACvC,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB,EAAE,KAA2B;IACzE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,qBAAqB,EAAE,KAAK;QAC5B,2BAA2B,EAAE,IAAI;QACjC,oBAAoB,EAAE;YACpB,SAAS,EAAE,SAAS,CAAC,MAAM;SAC5B;KACF,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrF,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAElD,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IAEjD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,UAAU,CAAC,qBAAqB,CAAC;YAC/B,IAAI,EAAE,KAAK;YACX,WAAW,EAAE,oBAAoB,CAAC,KAAK,CAAC;SACzC,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,EAAE,CAAA;QACzC,IAAI,IAAI,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,MAAM,EAAE,CAAA;QACpB,UAAU,CAAC,qBAAqB,CAAC;YAC/B,IAAI,EAAE,KAAK;YACX,WAAW,EAAE,oBAAoB,CAAC,KAAK,CAAC;SACzC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,UAAU,CAAC,WAAW,EAAE,CAAA;AACjC,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAW,EAAE,KAA8B;IACrF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAA;IACrD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IACrD,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IACvC,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB,EAAE,KAA8B;IAC/E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,qBAAqB,EAAE,KAAK;QAC5B,2BAA2B,EAAE,IAAI;QACjC,oBAAoB,EAAE;YACpB,SAAS,EAAE,SAAS,CAAC,MAAM;SAC5B;KACF,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrF,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAElD,MAAM,cAAc,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;IAEvD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,UAAU,CAAC,qBAAqB,CAAC;YAC/B,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,uBAAuB,CAAC,KAAK,CAAC;SAC5C,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,cAAc,CAAC,cAAc,EAAE,CAAA;QAC5C,IAAI,IAAI,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAChC,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,cAAc,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,cAAc,CAAC,MAAM,EAAE,CAAA;QACvB,UAAU,CAAC,qBAAqB,CAAC;YAC/B,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,uBAAuB,CAAC,KAAK,CAAC;SAC5C,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,UAAU,CAAC,WAAW,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,uBAAuB,CAAC,KAA8B;IAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAA;IACzC,OAAO;;eAEM,KAAK,CAAC,MAAM;qBACN,KAAK,CAAC,QAAQ,iBAAiB,QAAQ;IACxD,CAAA;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAkC,EAAE,KAA8B;IAC3F,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;IACrD,oBAAoB,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAA;IACzC,MAAM,cAAc,GAAG,aAAa,KAAK,CAAC,QAAQ,iBAAiB,QAAQ,KAAK,CAAA;IAChF,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IAC7C,IAAI,QAAQ,IAAI,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,QAAQ,CAAC,cAAc,CAAC,cAAc,CAAC,CAAA;IACzC,CAAC;SAAM,CAAC;QACN,IAAI,QAAQ;YAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;QAC/B,SAAS,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAA;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAsB;IACjD,MAAM,gBAAgB,GAAG,UAAU,CAAC,wBAAwB,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAA;IACzF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAA;IAC7C,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;QACtC,IAAI,QAAQ,IAAI,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,OAAO,QAAQ,CAAA;QACjB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA2B;IACvD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO;;mBAEQ,KAAK,CAAC,QAAQ,IAAI,uBAAuB;MACtD,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO;;qBAEU,KAAK,CAAC,SAAS,IAAI,QAAQ;MAC1C,CAAA;IACJ,CAAC;IACD,OAAO;;IAEL,CAAA;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B,EAAE,KAA2B;IAClF,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IAEhD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,IAAI,uBAAuB,CAAC,CAAA;QACnF,uBAAuB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QAC7C,OAAM;IACR,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAA;QACvE,uBAAuB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;QAC3C,OAAM;IACR,CAAC;IAED,uBAAuB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAC3C,uBAAuB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;AAC/C,CAAC;AAED,SAAS,oBAAoB,CAAC,GAA4B,EAAE,GAAW,EAAE,KAAa;IACpF,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,QAAQ,IAAI,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,QAAQ,CAAC,cAAc,CAAC,IAAI,KAAK,GAAG,CAAC,CAAA;QACrC,OAAM;IACR,CAAC;IACD,IAAI,QAAQ;QAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC/B,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,KAAK,GAAG,EAAE,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,uBAAuB,CAAC,GAA4B,EAAE,GAAW;IACxE,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,IAAI;QAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AACzB,CAAC"}

package/dist/assets/supatype-logo-wordmark.ascii.txt

@@ -0,0 +1,6 @@
+                           __                 
+   _______  ______  ____ _/ /___  ______  ___ 
+  / ___/ / / / __ \/ __ `/ __/ / / / __ \/ _ \
+ (__  ) /_/ / /_/ / /_/ / /_/ /_/ / /_/ /  __/
+/____/\__,_/ .___/\__,_/\__/\__, / .___/\___/ 
+          /_/              /____/_/           

package/dist/binary-cache.d.ts

@@ -7,10 +7,13 @@
  *
  * Security model:
  *   1. Download checksums.sha256 + checksums.sha256.minisig from CDN.
- *   2. Verify Ed25519 minisign signature on the checksum file using the
- *      embedded public key (SUPATYPE_RELEASE_PUBLIC_KEY).
+ *   2. Verify the Ed25519 minisign signature on the checksum file using the
+ *      release public key (embedded at publish, overridable via
+ *      SUPATYPE_RELEASE_PUBLIC_KEY).
  *   3. Verify SHA256 of the downloaded binary against the signed checksum.
- *   Both checks are mandatory when SUPATYPE_RELEASE_PUBLIC_KEY is set.
+ *   Verification is mandatory and fails closed: if no public key is configured,
+ *   the download errors out rather than silently degrading to SHA256-only.
+ *   The only escape hatch is the explicit SUPATYPE_ALLOW_UNVERIFIED_DOWNLOADS=1.
  */
 import type { SupatypeProjectConfig } from "./project-config.js";
 /**
@@ -27,12 +30,12 @@ export declare function hasMeaningfulOverrides(config: SupatypeProjectConfig): b
 export declare function describeActiveOverrides(config: SupatypeProjectConfig): string[];
 /**
  * True when this working tree is associated with a remote Supatype Cloud project:
- * `project.ref`, `.supatype/cloud.json` (schema deploy link), or `.supatype/linked.json` (functions link).
+ * `project.ref` or `.supatype/link.json` (cloud kind).
  */
 export declare function isLinkedToCloudProject(cwd: string, config: SupatypeProjectConfig): boolean;
 export type { Component, ComponentVersions } from "./components.js";
 export { BINARY_COMPONENTS } from "./components.js";
-import { type Component } from "./components.js";
+import { type Component, type ComponentVersions } from "./components.js";
 export interface PlatformId {
     os: "linux" | "darwin" | "windows";
     arch: "amd64" | "arm64";
@@ -66,12 +69,21 @@ export declare function resolveBinary(component: Component, config: SupatypeProj
 /** Download if missing or invalid; return cached path for the given platform. */
 export declare function ensureCachedBinary(component: Component, version: string, platform: PlatformId): Promise<string>;
 export declare function download(component: Component, version: string, platform: PlatformId): Promise<string>;
+/**
+ * Verify a minisign signature. Supports both Ed25519 legacy mode ("Ed", over the
+ * raw file) and prehashed mode ("ED", over BLAKE2b-512(file)). Throws if invalid.
+ */
+export declare function verifyMinisign(fileBytes: Buffer, sigFileContent: string, pubKeyStr: string): void;
 /** Confirm a downloaded/cached artifact matches the expected CDN format (tests, CI). */
 export declare function validateArtifactFormat(component: Component, filePath: string, platform: PlatformId): void;
 /**
  * On Windows, Git Bash represents paths as /c/Users/... — convert to C:\Users\...
  */
 export declare function normalisePlatformPath(p: string): string;
+export declare function pinnedVersion(component: Component, config: SupatypeProjectConfig): string | undefined;
+/** Pinned version from config, or latest from CDN when unset. */
+export declare function resolveVersionFor(component: Component, config: SupatypeProjectConfig): Promise<string>;
+/** @deprecated Prefer {@link pinnedVersion} or {@link resolveVersionFor}. */
 export declare function versionFor(component: Component, config: SupatypeProjectConfig): string;
 /**
  * Fetch the latest available version for a component.
@@ -89,6 +101,6 @@ export declare function fetchAllLatestVersions(): Promise<Record<Component, stri
  * Verify all cached binaries for the current platform (used by integration CI).
  * Throws if any cached component is missing or fails format checks.
  */
-export declare function verifyCachedBinaries(versions: SupatypeProjectConfig["versions"]): void;
-export declare function downloadAll(versions: SupatypeProjectConfig["versions"], graceful?: boolean): Promise<void>;
+export declare function verifyCachedBinaries(versions: Partial<ComponentVersions> | undefined): void;
+export declare function downloadAll(versions: Partial<ComponentVersions> | undefined, graceful?: boolean): Promise<void>;
 //# sourceMappingURL=binary-cache.d.ts.map

package/dist/binary-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binary-cache.d.ts","sourceRoot":"","sources":["../src/binary-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAmBH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAGhE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,UAAU,CAAA;AAExC,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAGxE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAGxE;AAED,yFAAyF;AACzF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAO7E;AAED,kEAAkE;AAClE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAgB/E;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAqB1F;AAMD,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEnE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAA;IAClC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAA;CACxB;AAQD,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1D;AA6BD,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,MAAM,CAEpG;AAgBD,wBAAgB,eAAe,IAAI,UAAU,CAY5C;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA+DjB;AAMD;;;;;;;GAOG;AACH,iFAAiF;AACjF,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,UAAU,GACnB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,QAAQ,CAC5B,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,UAAU,GACnB,OAAO,CAAC,MAAM,CAAC,CAwDjB;AAmMD,wFAAwF;AACxF,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,UAAU,GACnB,IAAI,CAEN;AAsJD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAYvD;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAMtF;AAMD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAW9E;AAED,gEAAgE;AAChE,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAKjF;AAMD;;;;GAIG;AACH;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,UAAU,CAAC,GAAG,IAAI,CAetF;AAED,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,qBAAqB,CAAC,UAAU,CAAC,EAC3C,QAAQ,UAAQ,GACf,OAAO,CAAC,IAAI,CAAC,CAmBf"}
+{"version":3,"file":"binary-cache.d.ts","sourceRoot":"","sources":["../src/binary-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAoBH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAIhE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,UAAU,CAAA;AAExC,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAGxE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAGxE;AAED,yFAAyF;AACzF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAO7E;AAED,kEAAkE;AAClE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAgB/E;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAyB1F;AAMD,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAqB,KAAK,SAAS,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAE3F,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAA;IAClC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAA;CACxB;AAQD,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1D;AAkBD,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,MAAM,CAEpG;AAgBD,wBAAgB,eAAe,IAAI,UAAU,CAY5C;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA+DjB;AAMD;;;;;;;GAOG;AACH,iFAAiF;AACjF,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,UAAU,GACnB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,QAAQ,CAC5B,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,UAAU,GACnB,OAAO,CAAC,MAAM,CAAC,CAgEjB;AAsED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAyDjG;AAqFD,wFAAwF;AACxF,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,UAAU,GACnB,IAAI,CAEN;AAsJD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAYvD;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,GAAG,MAAM,GAAG,SAAS,CAKrG;AAED,iEAAiE;AACjE,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAQtF;AAMD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAW9E;AAED,gEAAgE;AAChE,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAKjF;AAMD;;;;GAIG;AACH;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,GAAG,IAAI,CAkB3F;AAED,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,EAChD,QAAQ,UAAQ,GACf,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/binary-cache.js

@@ -7,16 +7,20 @@
  *
  * Security model:
  *   1. Download checksums.sha256 + checksums.sha256.minisig from CDN.
- *   2. Verify Ed25519 minisign signature on the checksum file using the
- *      embedded public key (SUPATYPE_RELEASE_PUBLIC_KEY).
+ *   2. Verify the Ed25519 minisign signature on the checksum file using the
+ *      release public key (embedded at publish, overridable via
+ *      SUPATYPE_RELEASE_PUBLIC_KEY).
  *   3. Verify SHA256 of the downloaded binary against the signed checksum.
- *   Both checks are mandatory when SUPATYPE_RELEASE_PUBLIC_KEY is set.
+ *   Verification is mandatory and fails closed: if no public key is configured,
+ *   the download errors out rather than silently degrading to SHA256-only.
+ *   The only escape hatch is the explicit SUPATYPE_ALLOW_UNVERIFIED_DOWNLOADS=1.
  */
 import { createHash, createPublicKey, verify as cryptoVerify } from "node:crypto";
-import { closeSync, copyFileSync, createWriteStream, existsSync, mkdirSync, openSync, readFileSync, readSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { closeSync, copyFileSync, createWriteStream, existsSync, mkdirSync, openSync, readFileSync, readSync, rmdirSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { chmod } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, join, resolve, isAbsolute } from "node:path";
+import { loadProjectLink, migrateLegacyLinkFiles } from "./link.js";
 import { releasePublicKey } from "./release-public-key.js";
 /**
  * Set `versions.{engine|server|postgres|deno}: VERSION_PIN_LOCAL` to mean “use `overrides.*` only”
@@ -64,12 +68,16 @@ export function describeActiveOverrides(config) {
 }
 /**
  * True when this working tree is associated with a remote Supatype Cloud project:
- * `project.ref`, `.supatype/cloud.json` (schema deploy link), or `.supatype/linked.json` (functions link).
+ * `project.ref` or `.supatype/link.json` (cloud kind).
  */
 export function isLinkedToCloudProject(cwd, config) {
     const ref = config.project.ref;
     if (typeof ref === "string" && ref.trim() !== "")
         return true;
+    migrateLegacyLinkFiles(cwd);
+    const link = loadProjectLink(cwd);
+    if (link?.kind === "cloud" && link.projectRef.trim() !== "")
+        return true;
     const linkedPath = join(cwd, ".supatype", "linked.json");
     if (existsSync(linkedPath)) {
         try {
@@ -100,16 +108,6 @@ const CDN_BASE = "https://releases.supatype.com";
 export function postgresArchiveTag(version) {
     return version.split(".")[0];
 }
-/**
- * Supatype release signing public key (minisign format).
- * Generated with: minisign -G
- * Rotate by: generating a new pair, updating this constant, and updating
- * the MINISIGN_PRIVATE_KEY GitHub Actions secret.
- *
- * ⚠ PLACEHOLDER — replace with actual public key before first release.
- * When empty, minisign verification is skipped with a warning (SHA256 only).
- */
-const SUPATYPE_RELEASE_PUBLIC_KEY = "";
 // CDN path templates per component.
 const CDN_PATHS = {
     engine: (v, p) => `/engine/v${v}/supatype-engine-${p.os}-${p.arch}${p.os === "windows" ? ".exe" : ""}`,
@@ -183,7 +181,7 @@ export async function resolveBinary(component, config) {
             "Remove overrides from supatype.config.ts / supatype.local.config.ts, or remove the cloud link files / clear project.ref.");
     }
     const overridePath = config.overrides?.[component === "postgres" ? "postgres_dir" : component];
-    const version = versionFor(component, config);
+    const version = await resolveVersionFor(component, config);
     if (version === VERSION_PIN_LOCAL && !overridePath) {
         const key = component === "postgres" ? "postgres_dir" : component;
         throw new Error(`[versions] versions.${component} is "${VERSION_PIN_LOCAL}" but overrides.${key} is not set. ` +
@@ -261,11 +259,11 @@ export async function download(component, version, platform) {
     const checksumsUrl = `${CDN_BASE}${checksumsDirPath(component, version)}`;
     const minisigUrl = `${checksumsUrl}.minisig`;
     console.log(`[supatype] Downloading ${component} v${version} (${platform.os}/${platform.arch})...`);
-    // ── Fetch checksums + optional minisig ────────────────────────────────────
-    const expectedChecksum = await withRetry(() => fetchChecksums(checksumsUrl, minisigUrl, name));
-    // ── Stream-download binary with progress ─────────────────────────────────
     const tmpPath = destPath + ".tmp";
     try {
+        // ── Fetch checksums + optional minisig (retried on transient failures) ───
+        const expectedChecksum = await withRetry(() => fetchChecksums(checksumsUrl, minisigUrl, name));
+        // ── Stream-download binary with progress (retried on transient failures) ─
         await withRetry(() => streamToFileWithProgress(binaryUrl, tmpPath));
         // ── Verify SHA256 ────────────────────────────────────────────────────────
         await verifyChecksum(tmpPath, expectedChecksum, component);
@@ -275,10 +273,24 @@ export async function download(component, version, platform) {
             await chmod(destPath, 0o755);
         }
     }
+    catch (err) {
+        // Never leave a partial binary or an empty version directory behind: a stale
+        // empty dir makes the next resolve look fine while silently lacking a binary.
+        try {
+            if (existsSync(destPath))
+                unlinkSync(destPath);
+        }
+        catch { /* ignore */ }
+        try {
+            rmdirSync(dir);
+        }
+        catch { /* dir not empty or already removed */ }
+        throw new Error(`Failed to download ${component} v${version} from ${CDN_BASE}: ${err.message}`);
+    }
     finally {
         if (existsSync(tmpPath)) {
             try {
-                require("node:fs").unlinkSync(tmpPath);
+                unlinkSync(tmpPath);
             }
             catch { /* ignore */ }
         }
@@ -296,20 +308,28 @@ async function fetchChecksums(checksumsUrl, minisigUrl, binaryFilename) {
     }
     const checksumsText = await csResp.text();
     const pubKey = releasePublicKey();
-    if (pubKey) {
-        // Minisign signature is required when a public key is embedded.
-        const sigResp = await fetch(minisigUrl);
-        if (!sigResp.ok) {
-            throw new Error(`Failed to fetch checksum signature from ${minisigUrl}: HTTP ${sigResp.status}\n` +
-                "Cannot verify release integrity. Aborting download.");
+    if (!pubKey) {
+        // Fail closed: a missing public key means we cannot verify authenticity, only
+        // integrity (SHA256). Published builds always embed the key, so this only
+        // happens in source/contributor builds — never silently downgrade.
+        if (process.env["SUPATYPE_ALLOW_UNVERIFIED_DOWNLOADS"] === "1") {
+            console.warn("[supatype] \u26a0  SUPATYPE_ALLOW_UNVERIFIED_DOWNLOADS=1 — no minisign public " +
+                "key configured; verifying SHA256 only (authenticity NOT checked).");
+            return extractChecksum(checksumsText, binaryFilename);
         }
-        const sigText = await sigResp.text();
-        verifyMinisign(Buffer.from(checksumsText, "utf8"), sigText, pubKey);
-    }
-    else {
-        console.warn("[supatype] \u26a0  Minisign public key not configured — " +
-            "skipping signature verification (SHA256 only).");
-    }
+        throw new Error("No minisign public key configured — cannot verify release authenticity.\n" +
+            "Published @supatype/cli builds embed the key automatically; if you are building " +
+            "from source, set SUPATYPE_RELEASE_PUBLIC_KEY to the release public key, or set " +
+            "SUPATYPE_ALLOW_UNVERIFIED_DOWNLOADS=1 to download with SHA256-only verification (unsafe).");
+    }
+    // Minisign signature is mandatory when a public key is configured.
+    const sigResp = await fetch(minisigUrl);
+    if (!sigResp.ok) {
+        throw new Error(`Failed to fetch checksum signature from ${minisigUrl}: HTTP ${sigResp.status}\n` +
+            "Cannot verify release integrity. Aborting download.");
+    }
+    const sigText = await sigResp.text();
+    verifyMinisign(Buffer.from(checksumsText, "utf8"), sigText, pubKey);
     return extractChecksum(checksumsText, binaryFilename);
 }
 // ---------------------------------------------------------------------------
@@ -330,10 +350,10 @@ async function fetchChecksums(checksumsUrl, minisigUrl, binaryFilename) {
  */
 const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
 /**
- * Verify a minisign signature (Ed25519 legacy mode, algorithm bytes "Ed").
- * Throws if verification fails.
+ * Verify a minisign signature. Supports both Ed25519 legacy mode ("Ed", over the
+ * raw file) and prehashed mode ("ED", over BLAKE2b-512(file)). Throws if invalid.
  */
-function verifyMinisign(fileBytes, sigFileContent, pubKeyStr) {
+export function verifyMinisign(fileBytes, sigFileContent, pubKeyStr) {
     // Parse public key: [2 algo][8 keyId][32 ed25519 key]
     const pkLines = pubKeyStr.trim().split("\n");
     const pkBytes = Buffer.from(pkLines[pkLines.length - 1].trim(), "base64");
@@ -355,19 +375,27 @@ function verifyMinisign(fileBytes, sigFileContent, pubKeyStr) {
     const algo = sigBytes.subarray(0, 2);
     const sigKeyId = sigBytes.subarray(2, 10);
     const signature = sigBytes.subarray(10, 74);
-    // Only Ed25519 legacy mode ("Ed" = 0x45, 0x64) is supported.
-    // Hashed mode ("ED") requires BLAKE2b prehashing — not implemented.
-    if (algo[0] !== 0x45 || algo[1] !== 0x64) {
-        throw new Error("Unsupported minisign algorithm — only Ed25519 legacy mode supported.\n" +
+    // Both Ed25519 modes are supported:
+    //   "Ed" (0x45, 0x64) — legacy: signature is over the raw file bytes.
+    //   "ED" (0x45, 0x44) — prehashed: signature is over BLAKE2b-512(file).
+    // Modern minisign (and our release pipeline) default to prehashed mode.
+    if (algo[0] !== 0x45 || (algo[1] !== 0x64 && algo[1] !== 0x44)) {
+        throw new Error("Unsupported minisign algorithm — expected Ed25519 ('Ed' legacy or 'ED' prehashed).\n" +
             `Got: 0x${algo[0]?.toString(16)}${algo[1]?.toString(16)}`);
     }
+    const prehashed = algo[1] === 0x44;
     if (!sigKeyId.equals(pkKeyId)) {
         throw new Error("Minisign key ID mismatch — signature was produced with a different key.\n" +
             "This could indicate a compromised release. Do not proceed.");
     }
     const spkiDer = Buffer.concat([ED25519_SPKI_PREFIX, pkEd25519]);
     const keyObject = createPublicKey({ key: spkiDer, format: "der", type: "spki" });
-    const valid = cryptoVerify(null, fileBytes, keyObject, signature);
+    // Pure Ed25519 (PureEdDSA) verifies over the message directly; for prehashed
+    // minisign the "message" is the BLAKE2b-512 digest of the file.
+    const signedData = prehashed
+        ? createHash("blake2b512").update(fileBytes).digest()
+        : fileBytes;
+    const valid = cryptoVerify(null, signedData, keyObject, signature);
     if (!valid) {
         throw new Error("Minisign signature verification FAILED — the checksum file may have been tampered with.\n" +
             "This could indicate a supply chain attack. Aborting download.");
@@ -587,10 +615,25 @@ export function normalisePlatformPath(p) {
     }
     return result;
 }
+export function pinnedVersion(component, config) {
+    const version = config.versions?.[component];
+    if (typeof version !== "string")
+        return undefined;
+    const trimmed = version.trim();
+    return trimmed === "" ? undefined : trimmed;
+}
+/** Pinned version from config, or latest from CDN when unset. */
+export async function resolveVersionFor(component, config) {
+    const pinned = pinnedVersion(component, config);
+    if (pinned)
+        return pinned;
+    return fetchLatestVersion(component);
+}
+/** @deprecated Prefer {@link pinnedVersion} or {@link resolveVersionFor}. */
 export function versionFor(component, config) {
-    const version = config.versions[component];
-    if (typeof version !== "string" || version.trim() === "") {
-        throw new Error(`[supatype] versions.${component} must be set in supatype.config.ts`);
+    const version = pinnedVersion(component, config);
+    if (!version) {
+        throw new Error(`[supatype] versions.${component} is not pinned in supatype.config.ts (omit versions to use latest)`);
     }
     return version;
 }
@@ -631,6 +674,9 @@ export async function fetchAllLatestVersions() {
  * Throws if any cached component is missing or fails format checks.
  */
 export function verifyCachedBinaries(versions) {
+    if (!versions) {
+        throw new Error("[supatype] verifyCachedBinaries requires pinned versions");
+    }
     const platform = currentPlatform();
     for (const component of BINARY_COMPONENTS) {
         const version = versions[component];
@@ -647,9 +693,9 @@ export function verifyCachedBinaries(versions) {
 export async function downloadAll(versions, graceful = false) {
     const platform = currentPlatform();
     const components = [...BINARY_COMPONENTS];
-    const fakeConfig = { versions };
+    const latest = await fetchAllLatestVersions();
     for (const component of components) {
-        const version = versionFor(component, fakeConfig);
+        const version = versions?.[component] ?? latest[component];
         if (version === VERSION_PIN_LOCAL)
             continue;
         try {