@supatype/cli 0.1.0-alpha.9 → 0.1.1

package/src/engine-client.ts

@@ -13,21 +13,25 @@ import { mkdirSync, writeFileSync, unlinkSync, existsSync, readdirSync } from "n
 import { tmpdir, homedir } from "node:os"
 import { join } from "node:path"
 import { loadConfig } from "./config.js"
-import { resolveBinary, currentPlatform, cachePath } from "./binary-cache.js"
+import { currentPlatform, cachePath } from "./binary-cache.js"
+import { ensureBinary } from "./ensure-binary.js"
 
 // ---------------------------------------------------------------------------
 // Types (kept for backward compatibility with existing callers)
 // ---------------------------------------------------------------------------
 
 export interface Operation {
-  kind: "create_table" | "alter_table" | "drop_table" | "create_index" | "drop_index" |
-        "create_policy" | "drop_policy" | "add_column" | "drop_column" | "alter_column" |
-        "recreate_column"
   type?: string
+  kind?: string
   description?: string
   risk?: "safe" | "warn" | "danger" | "cautious" | "destructive"
   warning?: string
   sql?: string
+  table?: string
+  column?: string
+  constraint?: string
+  index_name?: string
+  index?: { fields?: string[]; name?: string; unique?: boolean }
 }
 
 export interface DiffResult {
@@ -83,10 +87,16 @@ async function getEngineBin(): Promise<string> {
 
   try {
     const config = loadConfig(cwd)
-    _engineBin = await resolveBinary("engine", config)
+    // Download-on-miss (with retry) so a fresh machine or a failed postinstall
+    // self-heals on first use instead of silently skipping type/admin refresh.
+    _engineBin = await ensureBinary("engine", config)
     return _engineBin
-  } catch {
-    // No valid project config — fall through to default cache path.
+  } catch (err) {
+    // A real download/verification failure must surface, not fall back to a
+    // possibly-stale cached binary from a different version.
+    const message = err instanceof Error ? err.message : String(err)
+    if (message.includes("Failed to download")) throw err
+    // Otherwise (no valid project config) fall through to default cache scan.
   }
 
   // No config found — scan the cache for any available engine binary.
@@ -146,24 +156,40 @@ export async function engineRequest<T = unknown>(
 ): Promise<T> {
   const bin = await getEngineBin()
 
-  // Write request to a temp file.
-  // For CLI-mode endpoints the engine reads the input file as a raw SchemaAst,
-  // so we extract the `ast` field when present, otherwise write the full body.
   const tmpDir = join(tmpdir(), "supatype-engine")
   mkdirSync(tmpDir, { recursive: true })
+  const cleanup: string[] = []
   const reqFile = join(tmpDir, `req-${Date.now()}.json`)
   const inputPayload = body["ast"] !== undefined ? body["ast"] : body
   writeFileSync(reqFile, JSON.stringify(inputPayload))
+  cleanup.push(reqFile)
+
+  let gzPath: string | undefined
+  let manifestPath: string | undefined
+  if (typeof body["schema_sources_gz_base64"] === "string") {
+    gzPath = join(tmpDir, `sources-${Date.now()}.gz`)
+    writeFileSync(gzPath, Buffer.from(body["schema_sources_gz_base64"], "base64"))
+    cleanup.push(gzPath)
+  }
+  if (body["schema_sources_manifest"] !== undefined) {
+    manifestPath = join(tmpDir, `manifest-${Date.now()}.json`)
+    writeFileSync(manifestPath, JSON.stringify(body["schema_sources_manifest"]))
+    cleanup.push(manifestPath)
+  }
 
-  const args = endpointToArgs(endpoint, body, reqFile)
+  const args = endpointToArgs(endpoint, body, reqFile, {
+    ...(gzPath !== undefined ? { gzPath } : {}),
+    ...(manifestPath !== undefined ? { manifestPath } : {}),
+  })
 
   const result = spawnSync(bin, args, {
     encoding: "utf8",
     cwd: process.cwd(),
   })
 
-  // Clean up temp file.
-  try { unlinkSync(reqFile) } catch { /* ignore */ }
+  for (const f of cleanup) {
+    try { unlinkSync(f) } catch { /* ignore */ }
+  }
 
   if (result.status !== 0) {
     const stderr = result.stderr?.trim() || "(no output)"
@@ -195,6 +221,7 @@ function endpointToArgs(
   endpoint: string,
   body: Record<string, unknown>,
   reqFile: string,
+  sources?: { gzPath?: string; manifestPath?: string },
 ): string[] {
   const dbUrl = (body["database_url"] as string | undefined) ?? ""
   const schema = (body["schema"] as string | undefined) ?? "public"
@@ -206,8 +233,26 @@ function endpointToArgs(
     case "/diff":
       return ["diff", "--input", reqFile, "--database-url", dbUrl, "--schema", schema]
 
-    case "/push":
-      return ["push", "--input", reqFile, "--database-url", dbUrl, "--schema", schema, ...force, ...nonInteractive]
+    case "/push": {
+      const sourceArgs: string[] = []
+      if (sources?.gzPath) sourceArgs.push("--schema-sources-gz", sources.gzPath)
+      if (sources?.manifestPath) sourceArgs.push("--schema-sources-manifest", sources.manifestPath)
+      return [
+        "push",
+        "--input",
+        reqFile,
+        "--database-url",
+        dbUrl,
+        "--schema",
+        schema,
+        ...force,
+        ...nonInteractive,
+        ...sourceArgs,
+      ]
+    }
+
+    case "/rollback":
+      return ["rollback", "--database-url", dbUrl, "--schema", schema]
 
     case "/parse":
       return ["parse", "--input", reqFile]
@@ -220,6 +265,18 @@ function endpointToArgs(
     case "/introspect":
       return ["introspect", "--database-url", dbUrl, "--schema", schema]
 
+    case "/doctor": {
+      const strict = body["strict"] ? ["--strict"] : []
+      const noCache = body["no_cache"] ? ["--no-cache"] : []
+      return ["doctor", "--input", reqFile, "--database-url", dbUrl, "--schema", schema, ...strict, ...noCache]
+    }
+
+    case "/adopt": {
+      const yes = body["yes"] ? ["--yes"] : []
+      const noCache = body["no_cache"] ? ["--no-cache"] : []
+      return ["adopt", "--input", reqFile, "--database-url", dbUrl, "--schema", schema, ...yes, ...noCache]
+    }
+
     case "/validate":
       return ["validate", "--input", reqFile]
 
@@ -227,9 +284,16 @@ function endpointToArgs(
       return ["admin", "--input", reqFile]
 
     default:
-      if (endpoint.startsWith("/migrations")) {
+      if (endpoint === "/migrations" || endpoint.startsWith("/migrations")) {
         const action = (body["action"] as string | undefined) ?? "list"
-        return ["migrations", action, "--database-url", dbUrl]
+        if (action === "rollback") {
+          return ["rollback", "--database-url", dbUrl, "--schema", schema]
+        }
+        const name = body["name"] as string | undefined
+        if (name) {
+          return ["migrations", "--database-url", dbUrl, "--name", name]
+        }
+        return ["migrations", "--database-url", dbUrl]
       }
       return [endpoint.replace(/^\//, ""), "--input", reqFile]
   }

package/src/engine-push-output.ts

@@ -0,0 +1,75 @@
+/**
+ * Parse and format schema-engine push output (compose subprocess or HTTP).
+ */
+
+export interface EnginePushResult {
+  status?: string
+  operations?: number
+  admin_refreshed?: boolean
+  message?: string
+}
+
+/** Extract the engine JSON object from mixed docker compose stdout/stderr. */
+export function parseEngineJsonOutput<T>(output: string): T | null {
+  const trimmed = output.trim()
+  if (!trimmed) return null
+
+  for (const line of trimmed.split(/\r?\n/)) {
+    const candidate = line.trim()
+    if (!candidate.startsWith("{") || !candidate.endsWith("}")) continue
+    try {
+      return JSON.parse(candidate) as T
+    } catch {
+      /* try next line */
+    }
+  }
+
+  if (trimmed.startsWith("{")) {
+    try {
+      return JSON.parse(trimmed) as T
+    } catch {
+      return null
+    }
+  }
+
+  return null
+}
+
+export function parseEnginePushOutput(output: string): EnginePushResult | null {
+  return parseEngineJsonOutput<EnginePushResult>(output)
+}
+
+/** Human-readable one-liner for successful push (matches `supatype push` tone). */
+export function formatEnginePushMessage(result: EnginePushResult): string {
+  if (result.status === "up_to_date") {
+    if (result.admin_refreshed) {
+      return "Schema up to date — Studio metadata synced."
+    }
+    return "Schema up to date."
+  }
+
+  const ops = result.operations
+  if (typeof ops === "number" && ops > 0) {
+    return `Applied ${ops} operation(s).`
+  }
+
+  return result.message?.trim() || "Schema applied."
+}
+
+const COMPOSE_PROGRESS_LINE =
+  /^Container\s+.+\s+(Running|Waiting|Healthy|Created|Starting|Started|Exited|Stopped)\s*$/i
+
+/** Drop docker compose progress noise; keep engine JSON and real errors. */
+export function filterComposeNoise(output: string): string {
+  return output
+    .split(/\r?\n/)
+    .map((line) => line.trimEnd())
+    .filter((line) => {
+      const t = line.trim()
+      if (!t) return false
+      if (COMPOSE_PROGRESS_LINE.test(t)) return false
+      return true
+    })
+    .join("\n")
+    .trim()
+}

package/src/ensure-binary.ts

@@ -6,7 +6,7 @@ import {
   resolveBinary,
   download,
   currentPlatform,
-  versionFor,
+  resolveVersionFor,
   type Component,
 } from "./binary-cache.js"
 import type { SupatypeProjectConfig } from "./project-config.js"
@@ -24,5 +24,5 @@ export async function ensureBinary(
     }
   }
 
-  return download(component, versionFor(component, config), currentPlatform())
+  return download(component, await resolveVersionFor(component, config), currentPlatform())
 }

package/src/env-file.ts

@@ -0,0 +1,37 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+
+/** Merge key/value updates into a project `.env` without dropping unrelated lines. */
+export function upsertEnvFile(
+  cwd: string,
+  updates: Record<string, string>,
+  removeKeys: readonly string[] = [],
+): void {
+  const envPath = join(cwd, ".env")
+  const existing = existsSync(envPath) ? readFileSync(envPath, "utf8") : ""
+  const keys = new Set([...Object.keys(updates), ...removeKeys])
+  const kept = existing
+    .split("\n")
+    .filter((line) => {
+      const key = line.split("=")[0]?.trim()
+      return key && line.includes("=") && !keys.has(key)
+    })
+  const merged = [...kept, ...Object.entries(updates).map(([key, value]) => `${key}=${value}`)]
+  writeFileSync(envPath, `${merged.join("\n").trimEnd()}\n`, "utf8")
+}
+
+export function readEnvValue(cwd: string, key: string, fallback: string): string {
+  const envPath = join(cwd, ".env")
+  if (existsSync(envPath)) {
+    const m = readFileSync(envPath, "utf8").match(new RegExp(`^${key}=(.+)$`, "m"))
+    if (m?.[1]) return m[1].trim()
+  }
+  return fallback
+}
+
+export function readEnvInt(cwd: string, key: string): number | null {
+  const raw = readEnvValue(cwd, key, "")
+  if (!raw) return null
+  const port = Number(raw)
+  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : null
+}

package/src/gitignore.ts

@@ -0,0 +1,48 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs"
+import { resolve } from "node:path"
+
+export const SUPATYPE_GITIGNORE_MARKER = "# Supatype — local runtime (contains secrets in link.json)"
+export const SUPATYPE_GITIGNORE_BLOCK = `${SUPATYPE_GITIGNORE_MARKER}
+.env
+.supatype/
+supatype.local.config.ts
+supatype.local.config.js
+supatype.local.config.mjs
+`
+
+export function isSupatypeGitignored(cwd: string): boolean {
+  const gitignorePath = resolve(cwd, ".gitignore")
+  if (!existsSync(gitignorePath)) return false
+  const content = readFileSync(gitignorePath, "utf8")
+  return /\.supatype\/?(\/|\s|$)/m.test(content) || content.includes(".supatype/")
+}
+
+export function ensureSupatypeGitignore(cwd: string, opts?: { silent?: boolean }): boolean {
+  const gitignorePath = resolve(cwd, ".gitignore")
+  if (isSupatypeGitignored(cwd)) return true
+
+  if (existsSync(gitignorePath)) {
+    const content = readFileSync(gitignorePath, "utf8")
+    const next = content.endsWith("\n") ? content : `${content}\n`
+    writeFileSync(gitignorePath, `${next}\n${SUPATYPE_GITIGNORE_BLOCK}`, "utf8")
+  } else {
+    writeFileSync(
+      gitignorePath,
+      `.env\nnode_modules/\ndist/\n${SUPATYPE_GITIGNORE_BLOCK}`,
+      "utf8",
+    )
+  }
+
+  if (!opts?.silent) {
+    console.warn("Added .supatype/ to .gitignore (link.json contains secrets — never commit).")
+  }
+  return true
+}
+
+export function warnIfLinkNotGitignored(cwd: string): void {
+  if (isSupatypeGitignored(cwd)) return
+  console.warn(
+    "\n⚠  Warning: .supatype/ is not in .gitignore — link.json contains tokens and must not be committed.",
+  )
+  console.warn("   Run with link --fix-gitignore to append the Supatype block.\n")
+}

package/src/kong-config.ts

@@ -18,6 +18,11 @@ export interface KongDeclarativeOptions {
   studioServiceUrl?: string | undefined
   /** See {@link RuntimeRouteOptions.studioStripPath}. */
   studioStripPath?: boolean | undefined
+  /**
+   * When set, append a global Kong `acme` plugin (Let's Encrypt) with Redis/Valkey
+   * storage so the self-host gateway provisions and renews TLS automatically.
+   */
+  acme?: { email: string; domain: string; redisHost: string } | undefined
 }
 
 /** Escape a string for use inside YAML double quotes. */
@@ -85,9 +90,27 @@ ${route.paths.map((path) => `          - ${path}`).join("\n")}
 ${protocols}${routePlugins}${graphqlPlugins}`
   }).join("\n")
 
+  const acme = opts.acme
+  const pluginsBlock = acme
+    ? `
+plugins:
+  - name: acme
+    config:
+      account_email: ${yamlQuotedString(acme.email)}
+      tos_accepted: true
+      domains:
+        - ${yamlQuotedString(acme.domain)}
+      storage: redis
+      storage_config:
+        redis:
+          host: ${yamlQuotedString(acme.redisHost)}
+          port: 6379
+`
+    : ""
+
   return `_format_version: "3.0"
 ${consumersBlock}
 services:
 ${servicesBlock}
-`
+${pluginsBlock}`
 }

package/src/link.ts

@@ -0,0 +1,243 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"
+import { resolve } from "node:path"
+import { warn } from "./ui/messages.js"
+
+export const LINK_VERSION = 1 as const
+export const LINK_FILE = ".supatype/link.json"
+export const LEGACY_CLOUD_FILE = ".supatype/cloud.json"
+export const LEGACY_LINKED_FILE = ".supatype/linked.json"
+
+export type ProjectLinkKind = "cloud" | "self-host" | "local"
+
+export interface EnvironmentTarget {
+  name: string
+  apiUrl: string
+  token?: string
+  linkedAt: string
+}
+
+export interface ProjectLink {
+  version: typeof LINK_VERSION
+  kind: ProjectLinkKind
+  projectRef: string
+  defaultEnvironment: string
+  token?: string
+  orgId?: string | undefined
+  cloudApiUrl?: string
+  linkedAt: string
+  environments: Record<string, EnvironmentTarget>
+}
+
+export interface LocalEnvironment {
+  target: "local"
+  apiUrl: string
+  databaseUrl: string
+  projectRef: string
+  kongPort: number
+  provider: "docker" | "native"
+}
+
+export interface BranchContext {
+  mode: "branch"
+  branchId: string
+  apiUrl: string
+  token?: string | undefined
+}
+
+interface LegacyCloudFile {
+  apiUrl?: string
+  token?: string
+  projectSlug?: string
+  orgId?: string
+}
+
+interface LegacyLinkedFile {
+  ref?: string
+  orgId?: string
+}
+
+export function writeLocalEnvironment(cwd: string, env: LocalEnvironment): void {
+  const dir = resolve(cwd, ".supatype")
+  mkdirSync(dir, { recursive: true })
+  writeFileSync(resolve(dir, "environment.json"), `${JSON.stringify(env, null, 2)}\n`, "utf8")
+}
+
+export function loadLocalEnvironment(cwd: string): LocalEnvironment | null {
+  const path = resolve(cwd, ".supatype/environment.json")
+  if (!existsSync(path)) return null
+  return JSON.parse(readFileSync(path, "utf8")) as LocalEnvironment
+}
+
+export function linkPath(cwd: string): string {
+  return resolve(cwd, LINK_FILE)
+}
+
+export function loadProjectLink(cwd: string): ProjectLink | null {
+  migrateLegacyLinkFiles(cwd)
+  const path = linkPath(cwd)
+  if (!existsSync(path)) return null
+  return JSON.parse(readFileSync(path, "utf8")) as ProjectLink
+}
+
+export function saveProjectLink(cwd: string, link: ProjectLink): void {
+  const dir = resolve(cwd, ".supatype")
+  mkdirSync(dir, { recursive: true })
+  writeFileSync(linkPath(cwd), `${JSON.stringify(link, null, 2)}\n`, "utf8")
+}
+
+export function isProjectLinked(cwd: string): boolean {
+  const link = loadProjectLink(cwd)
+  return Boolean(link?.projectRef && Object.keys(link.environments).length > 0)
+}
+
+export function resolveEnvironmentName(link: ProjectLink, envFlag?: string): string {
+  if (envFlag?.trim()) return envFlag.trim()
+  return link.defaultEnvironment || "production"
+}
+
+export function getEnvironmentTarget(link: ProjectLink, envName: string): EnvironmentTarget | null {
+  return link.environments[envName] ?? null
+}
+
+export function resolveEnvironmentToken(link: ProjectLink, env: EnvironmentTarget): string | undefined {
+  return env.token ?? link.token
+}
+
+let migrationWarned = false
+
+/** Merge legacy cloud.json + linked.json into link.json once. */
+export function migrateLegacyLinkFiles(cwd: string): void {
+  const target = linkPath(cwd)
+  if (existsSync(target)) return
+
+  const cloudPath = resolve(cwd, LEGACY_CLOUD_FILE)
+  const linkedPath = resolve(cwd, LEGACY_LINKED_FILE)
+  const hasCloud = existsSync(cloudPath)
+  const hasLinked = existsSync(linkedPath)
+  if (!hasCloud && !hasLinked) return
+
+  let cloud: LegacyCloudFile | null = null
+  let linked: LegacyLinkedFile | null = null
+
+  if (hasCloud) {
+    cloud = JSON.parse(readFileSync(cloudPath, "utf8")) as LegacyCloudFile
+  }
+  if (hasLinked) {
+    linked = JSON.parse(readFileSync(linkedPath, "utf8")) as LegacyLinkedFile
+  }
+
+  const projectRef = cloud?.projectSlug ?? linked?.ref
+  if (!projectRef || !cloud?.token) {
+    return
+  }
+
+  const now = new Date().toISOString()
+  const link: ProjectLink = {
+    version: LINK_VERSION,
+    kind: "cloud",
+    projectRef,
+    defaultEnvironment: "production",
+    token: cloud.token,
+    cloudApiUrl: cloud.apiUrl ?? "https://api.supatype.com",
+    linkedAt: now,
+    environments: {
+      production: {
+        name: "production",
+        apiUrl: cloud.apiUrl ?? "https://api.supatype.com",
+        linkedAt: now,
+      },
+    },
+    ...(cloud.orgId !== undefined
+      ? { orgId: cloud.orgId }
+      : linked?.orgId !== undefined
+        ? { orgId: linked.orgId }
+        : {}),
+  }
+
+  saveProjectLink(cwd, link)
+
+  if (!migrationWarned) {
+    migrationWarned = true
+    warn(
+      "Migrated .supatype/cloud.json → .supatype/link.json (legacy files kept; remove manually when ready).",
+    )
+  }
+}
+
+export function createSelfHostLink(params: {
+  projectRef: string
+  apiUrl: string
+  token: string
+  envName?: string
+  existing?: ProjectLink | null
+}): ProjectLink {
+  const envName = params.envName ?? "production"
+  const now = new Date().toISOString()
+  const env: EnvironmentTarget = {
+    name: envName,
+    apiUrl: params.apiUrl.replace(/\/$/, ""),
+    token: params.token,
+    linkedAt: now,
+  }
+
+  if (params.existing) {
+    return {
+      ...params.existing,
+      kind: params.existing.kind === "cloud" ? "self-host" : params.existing.kind,
+      projectRef: params.projectRef,
+      defaultEnvironment: params.existing.defaultEnvironment || envName,
+      linkedAt: now,
+      environments: {
+        ...params.existing.environments,
+        [envName]: env,
+      },
+    }
+  }
+
+  return {
+    version: LINK_VERSION,
+    kind: "self-host",
+    projectRef: params.projectRef,
+    defaultEnvironment: envName,
+    token: params.token,
+    linkedAt: now,
+    environments: { [envName]: env },
+  }
+}
+
+export function createCloudLink(params: {
+  projectRef: string
+  cloudApiUrl: string
+  token: string
+  orgId?: string | undefined
+  environments?: Array<{ name: string; apiUrl: string }>
+  existing?: ProjectLink | null
+}): ProjectLink {
+  const now = new Date().toISOString()
+  const envMap: Record<string, EnvironmentTarget> = {}
+  const envs = params.environments?.length
+    ? params.environments
+    : [{ name: "production", apiUrl: params.cloudApiUrl }]
+
+  for (const e of envs) {
+    envMap[e.name] = {
+      name: e.name,
+      apiUrl: e.apiUrl.replace(/\/$/, ""),
+      linkedAt: now,
+    }
+  }
+
+  return {
+    version: LINK_VERSION,
+    kind: "cloud",
+    projectRef: params.projectRef,
+    defaultEnvironment: "production",
+    token: params.token,
+    cloudApiUrl: params.cloudApiUrl.replace(/\/$/, ""),
+    linkedAt: now,
+    environments: params.existing
+      ? { ...params.existing.environments, ...envMap }
+      : envMap,
+    ...(params.orgId !== undefined ? { orgId: params.orgId } : {}),
+  }
+}