@supatype/cli 0.1.0-alpha.9 → 0.1.1

package/src/self-host-compose.ts

@@ -1,10 +1,135 @@
-import { existsSync, mkdirSync, writeFileSync } from "node:fs"
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"
 import { dirname, join, relative, resolve } from "node:path"
 import { spawnSync } from "node:child_process"
-import { preferredFunctionsPathFromProject, type SupatypeProjectConfig } from "./project-config.js"
-import { hasEngineOverride, hasStudioOverride } from "./binary-cache.js"
+import { requireDockerDaemon, type DockerBrandOptions } from "./docker-runtime.js"
+import { fatalError } from "./ui/fatal.js"
+import { preferredFunctionsPathFromProject, selfHostTlsEnabled, type SupatypeProjectConfig } from "./project-config.js"
+import { hasEngineOverride, hasStudioOverride, pinnedVersion, fetchLatestVersion, VERSION_PIN_LOCAL } from "./binary-cache.js"
 import { buildKongDeclarative } from "./kong-config.js"
 
+/** Env keys written when `versions` pins exist in supatype.config.ts. */
+export const COMPOSE_PINNED_IMAGE_ENV_KEYS = [
+  "SUPATYPE_ENGINE_IMAGE",
+  "SUPATYPE_SERVER_IMAGE",
+  "SUPATYPE_POSTGRES_IMAGE",
+] as const
+
+/** Compose image env vars that may be overridden manually in `.env`. */
+export const COMPOSE_IMAGE_ENV_KEYS = [
+  ...COMPOSE_PINNED_IMAGE_ENV_KEYS,
+  "SUPATYPE_CONTROL_PLANE_IMAGE",
+  "SUPATYPE_AUTH_IMAGE",
+  "SUPATYPE_STUDIO_IMAGE",
+  "SUPATYPE_STORAGE_IMAGE",
+  "SUPATYPE_FUNCTIONS_WORKER_IMAGE",
+] as const
+
+type DockerPinComponent = "engine" | "server" | "postgres"
+
+/** Map a config version pin to a Docker Hub image reference. */
+export function dockerImageRef(
+  component: DockerPinComponent,
+  version: string,
+  config?: SupatypeProjectConfig,
+): string {
+  const trimmed = version.trim()
+  switch (component) {
+    case "engine":
+      return `supatype/schema-engine:${trimmed.startsWith("v") ? trimmed : `v${trimmed}`}`
+    case "server":
+      return `supatype/server:${trimmed.startsWith("v") ? trimmed : `v${trimmed}`}`
+    case "postgres": {
+      const override = config?.database?.image?.trim()
+      if (override) return override
+      if (trimmed.includes("-latest")) return `supatype/postgres:${trimmed}`
+      const major = trimmed.split(".")[0]
+      return `supatype/postgres:${major}-latest`
+    }
+  }
+}
+
+/**
+ * When the user pins `versions` in config, sync matching SUPATYPE_*_IMAGE vars for Compose.
+ * Unpinned components are omitted so compose falls back to :latest defaults.
+ */
+export function composeDockerImageEnv(config: SupatypeProjectConfig): Record<string, string> {
+  const env: Record<string, string> = {}
+  const versions = config.versions
+  if (!versions) return env
+
+  if (versions.engine && versions.engine !== VERSION_PIN_LOCAL) {
+    env.SUPATYPE_ENGINE_IMAGE = dockerImageRef("engine", versions.engine)
+  }
+  if (versions.server && versions.server !== VERSION_PIN_LOCAL) {
+    env.SUPATYPE_SERVER_IMAGE = dockerImageRef("server", versions.server)
+  }
+  if (versions.postgres && versions.postgres !== VERSION_PIN_LOCAL) {
+    env.SUPATYPE_POSTGRES_IMAGE = dockerImageRef("postgres", versions.postgres, config)
+  }
+  return env
+}
+
+/** True when a Docker image tag is a semver/latest ref we expect `docker pull` to resolve. */
+export function isRegistryPullableImageRef(ref: string): boolean {
+  const trimmed = ref.trim()
+  if (!trimmed) return true
+  const tag = trimmed.includes(":") ? trimmed.slice(trimmed.lastIndexOf(":") + 1) : "latest"
+  if (tag === "latest") return true
+  if (/^v?\d+\.\d+/.test(tag)) return true
+  if (/^\d+-latest$/.test(tag)) return true
+  return false
+}
+
+export function hasLocalVersionPins(config: SupatypeProjectConfig): boolean {
+  const versions = config.versions
+  if (!versions) return false
+  return (
+    versions.engine === VERSION_PIN_LOCAL ||
+    versions.server === VERSION_PIN_LOCAL ||
+    versions.postgres === VERSION_PIN_LOCAL ||
+    versions.deno === VERSION_PIN_LOCAL
+  )
+}
+
+function readComposeImageEnvValues(cwd: string): string[] {
+  const envPath = resolve(cwd, ".env")
+  if (!existsSync(envPath)) return []
+  const text = readFileSync(envPath, "utf8")
+  const values: string[] = []
+  for (const key of COMPOSE_IMAGE_ENV_KEYS) {
+    const match = text.match(new RegExp(`^${key}=(.+)$`, "m"))
+    if (match?.[1]) values.push(match[1].trim())
+  }
+  return values
+}
+
+/**
+ * Use `docker compose pull --ignore-pull-failures` only when the project may
+ * reference local-only images (config `versions: local` or custom `.env` tags).
+ */
+export function composePullNeedsIgnoreFailures(
+  config: SupatypeProjectConfig,
+  cwd: string = process.cwd(),
+): boolean {
+  if (hasLocalVersionPins(config)) return true
+  return readComposeImageEnvValues(cwd).some((ref) => !isRegistryPullableImageRef(ref))
+}
+
+/**
+ * Schema-engine image for a one-off `docker compose run` when pushing schema.
+ * Uses config pin when set; otherwise CDN engine semver (Docker Hub `:latest` can lag).
+ * Does not touch `.env` — server/postgres still use compose `:latest` defaults.
+ */
+export async function schemaEngineImageForPush(
+  config: SupatypeProjectConfig,
+): Promise<string | undefined> {
+  const pinned = pinnedVersion("engine", config)
+  if (pinned === VERSION_PIN_LOCAL) return undefined
+  if (pinned) return dockerImageRef("engine", pinned)
+  const version = await fetchLatestVersion("engine")
+  return dockerImageRef("engine", version)
+}
+
 export interface SelfHostComposePaths {
   dir: string
   composePath: string
@@ -59,21 +184,9 @@ function kongMountPath(_cwd: string): string {
 /** Host Vite dev server as seen from Kong inside Docker Compose. */
 export const COMPOSE_STUDIO_HOST_URL = "http://host.docker.internal:3002"
 
-/** Local monorepo Studio image for `supatype dev` (dogfooding). */
-function studioServiceBlock(cwd: string, devLocal: boolean): string {
-  if (!devLocal) {
-    return `    image: \${SUPATYPE_STUDIO_IMAGE:-supatype/studio:latest}`
-  }
-  const monorepoRoot = resolve(cwd, "..", "supatype")
-  const studioDockerfile = join(monorepoRoot, "packages", "studio", "Dockerfile")
-  if (!existsSync(studioDockerfile) || !existsSync(join(monorepoRoot, "pnpm-workspace.yaml"))) {
-    return `    image: \${SUPATYPE_STUDIO_IMAGE:-supatype/studio:latest}`
-  }
-  const context = relativeFromProjectRoot(cwd, monorepoRoot)
-  return `    build:
-      context: ${context}
-      dockerfile: packages/studio/Dockerfile
-    image: supatype/studio:dev-local`
+/** Studio container — always Docker Hub unless SUPATYPE_STUDIO_IMAGE is set in .env. */
+function studioServiceBlock(): string {
+  return `    image: \${SUPATYPE_STUDIO_IMAGE:-supatype/studio:latest}`
 }
 
 /** Host dev app (Astro/Vite on the machine) as seen from inside compose services. */
@@ -101,6 +214,11 @@ function serverAppEnvForCompose(config: SupatypeProjectConfig, devLocal: boolean
   } else if (mode === "proxy" && config.app.upstream?.trim()) {
     lines.push(`      SUPATYPE_APP_UPSTREAM: ${proxyUpstreamForCompose(config.app.upstream, devLocal)}`)
   }
+  if (config.app.vite_dev_url?.trim()) {
+    lines.push(
+      `      SUPATYPE_VITE_DEV_URL: ${proxyUpstreamForCompose(config.app.vite_dev_url, devLocal)}`,
+    )
+  }
   return lines.join("\n")
 }
 
@@ -117,23 +235,32 @@ export function renderSelfHostCompose(
   const projectMount = projectMountPath(cwd)
   const kongMount = kongMountPath(cwd)
   const devLocal = options?.devLocal === true
+  const tlsEnabled = selfHostTlsEnabled(config, devLocal)
+  const domain = config.server.domain?.trim() ?? ""
+  // When TLS is on, default external URLs to https://<domain> so auth links/redirects use HTTPS.
+  const externalUrlFallback = tlsEnabled ? `https://${domain}` : "http://localhost:18473"
+  const siteUrlFallback = tlsEnabled ? `https://${domain}` : "http://localhost:3000"
   const studioHostDev = devLocal && hasStudioOverride(config)
   const appEnv = serverAppEnvForCompose(config, devLocal)
-  const studioService = studioServiceBlock(cwd, devLocal)
+  const staticDir = staticDirForCompose(config) ?? "./dist"
+  const composeProject = composeProjectName(config.project.name)
+  const studioService = studioServiceBlock()
   const studioBlock = studioHostDev
     ? ""
     : `
   studio:
 ${studioService}
     environment:
-      SUPATYPE_CLOUD_JSON: '{"url":"\${API_EXTERNAL_URL:-http://localhost:18473}","anonKey":"\${ANON_KEY:-}"}'
+      SUPATYPE_CLOUD_JSON: '{"url":"\${API_EXTERNAL_URL:-${externalUrlFallback}}","anonKey":"\${ANON_KEY:-}"}'
     expose:
       - "3002"
 `
   const kongDependsOn = studioHostDev
-    ? `      - server`
+    ? `      - server
+      - control-plane`
     : `      - server
-      - studio`
+      - studio
+      - control-plane`
   const publishDbToHost = !devLocal || hasEngineOverride(config)
   const dbPorts = publishDbToHost
     ? devLocal
@@ -155,6 +282,44 @@ ${studioService}
       - "9000:9000"
       - "9001:9001"
 `
+  const kongTlsEnv = tlsEnabled
+    ? `      KONG_PROXY_LISTEN: "0.0.0.0:8000, 0.0.0.0:8443 ssl"
+      KONG_LUA_SSL_TRUSTED_CERTIFICATE: system
+      KONG_LUA_SSL_VERIFY_DEPTH: "2"
+`
+    : ""
+  const kongPorts = tlsEnabled
+    ? `      - "80:8000"
+      - "443:8443"`
+    : `      - "\${SUPATYPE_KONG_PORT:-18473}:8000"`
+  const kongTlsDependsOn = tlsEnabled ? "\n      - valkey" : ""
+  const valkeyBlock = tlsEnabled
+    ? `
+  valkey:
+    image: \${SUPATYPE_VALKEY_IMAGE:-valkey/valkey:8-alpine}
+    command: ["valkey-server", "--appendonly", "yes"]
+    expose:
+      - "6379"
+    volumes:
+      - valkey-data:/data
+`
+    : ""
+  const tlsHintComment = tlsEnabled
+    ? ""
+    : `  # HTTPS is off. To enable automatic TLS (Let's Encrypt) for production, set in supatype.config.ts:
+  #   server: { mode: "standalone", domain: "your.domain", tls: { email: "you@example.com" } }
+  # then re-run \`supatype self-host compose up -d\`. Kong publishes :80/:443 and provisions certs automatically.
+`
+  const volumesBlock = tlsEnabled
+    ? `volumes:
+  db-data:
+  minio-data:
+  valkey-data:
+`
+    : `volumes:
+  db-data:
+  minio-data:
+`
 
   return `# Generated by supatype self-host compose
 # Kong → supatype-server (unified gateway) → internal PostgREST / storage / etc.
@@ -179,7 +344,7 @@ ${dbPorts}    volumes:
       - "3000"
     environment:
       PGRST_DB_URI: postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}
-      PGRST_DB_SCHEMA: "public, supatype, graphql_public"
+      PGRST_DB_SCHEMA: "public, supatype, graphql_public, auth"
       PGRST_DB_ANON_ROLE: anon
       PGRST_JWT_SECRET: \${JWT_SECRET:-super-secret-jwt-token-change-in-production}
       PGRST_DB_EXTRA_SEARCH_PATH: public,extensions
@@ -215,12 +380,33 @@ ${dbPorts}    volumes:
       SUPATYPE_FUNCTIONS_ROOT: /project/functions
       SUPATYPE_DENO_FUNCTIONS_DIR: /project/functions
       PORT: "8001"
-      SUPATYPE_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
+      SUPATYPE_URL: \${API_EXTERNAL_URL:-${externalUrlFallback}}
       SUPATYPE_ANON_KEY: \${ANON_KEY:-}
       SUPATYPE_SERVICE_ROLE_KEY: \${SERVICE_ROLE_KEY:-}
       STRIPE_SECRET_KEY: \${STRIPE_SECRET_KEY:-}
       STRIPE_WEBHOOK_SECRET: \${STRIPE_WEBHOOK_SECRET:-}
-      SITE_URL: \${SITE_URL:-\${API_EXTERNAL_URL:-http://localhost:18473}}
+      SITE_URL: \${SITE_URL:-\${API_EXTERNAL_URL:-${externalUrlFallback}}}
+    depends_on:
+      db:
+        condition: service_healthy
+
+  control-plane:
+    image: \${SUPATYPE_CONTROL_PLANE_IMAGE:-supatype/control-plane:latest}
+    expose:
+      - "8080"
+    volumes:
+      - ${projectMount}:/project
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      PORT: "8080"
+      SUPATYPE_PROJECT_REF: ${JSON.stringify(config.project.name)}
+      SUPATYPE_PROJECT_ROOT: /project
+      DATABASE_URL: "postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}"
+      SUPATYPE_FUNCTIONS_ROOT: /project/functions
+      SUPATYPE_STATIC_ROOT: /project/${staticDir.replace(/^\.\//, "")}
+      SUPATYPE_DEPLOYMENTS_DIR: /project/.supatype/deployments
+      COMPOSE_PROJECT_NAME: ${composeProject}
+      SUPATYPE_ENGINE_BIN: supatype-engine
     depends_on:
       db:
         condition: service_healthy
@@ -232,26 +418,27 @@ ${serverPorts}    volumes:
     working_dir: /project
     environment:
       SUPATYPE_MODE: ${devLocal ? "dev" : "standalone"}
-      SUPATYPE_MANIFEST_PATH: /project/.supatype/manifest.json
-      SUPATYPE_ADMIN_CONFIG_PATH: /project/.supatype/admin-config.json
-      SUPATYPE_API_CONFIG_PATH: /project/.supatype/api-config.json
+      SUPATYPE_MANIFEST_PATH: .supatype/manifest.json
+      SUPATYPE_ADMIN_CONFIG_PATH: .supatype/admin-config.json
+      SUPATYPE_API_CONFIG_PATH: .supatype/api-config.json
       SUPATYPE_POSTGREST_URL: http://postgrest:3000
       SUPATYPE_GRAPHQL_URL: http://postgrest:3000
       SUPATYPE_STORAGE_URL: http://storage:5000
-      SUPATYPE_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
+      SUPATYPE_URL: \${API_EXTERNAL_URL:-${externalUrlFallback}}
       SUPATYPE_ANON_KEY: \${ANON_KEY:-}
       SUPATYPE_SERVICE_ROLE_KEY: \${SERVICE_ROLE_KEY:-}
       SUPATYPE_SQL_DATABASE_URL: "postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}"
       SUPATYPE_DENO_FUNCTIONS_DIR: /project/functions
       SUPATYPE_FUNCTIONS_WORKER_URL: http://functions-worker:8001
+      SUPATYPE_CONTROL_PLANE_URL: http://control-plane:8080
 ${appEnv}
       GOTRUE_API_HOST: 0.0.0.0
       GOTRUE_API_PORT: 9999
-      API_EXTERNAL_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
-      GOTRUE_API_EXTERNAL_URL: \${API_EXTERNAL_URL:-http://localhost:18473}
+      API_EXTERNAL_URL: \${API_EXTERNAL_URL:-${externalUrlFallback}}
+      GOTRUE_API_EXTERNAL_URL: \${API_EXTERNAL_URL:-${externalUrlFallback}}
       GOTRUE_DB_DRIVER: postgres
       GOTRUE_DB_DATABASE_URL: "postgres://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}?search_path=auth"
-      GOTRUE_SITE_URL: \${SITE_URL:-http://localhost:3000}
+      GOTRUE_SITE_URL: \${SITE_URL:-${siteUrlFallback}}
       GOTRUE_JWT_SECRET: \${JWT_SECRET:-super-secret-jwt-token-change-in-production}
       GOTRUE_JWT_EXP: 3600
       GOTRUE_JWT_AUD: authenticated
@@ -269,6 +456,8 @@ ${devLocal ? "      STUDIO_OPEN_DEV: \"1\"\n" : ""}
         condition: service_started
       functions-worker:
         condition: service_started
+      control-plane:
+        condition: service_started
 
   minio:
     image: minio/minio:RELEASE.2024-11-07T00-52-20Z
@@ -289,8 +478,7 @@ ${minioPorts}    volumes:
     depends_on:
       db:
         condition: service_healthy
-${studioBlock}
-  kong:
+${studioBlock}${valkeyBlock}${tlsHintComment}  kong:
     image: kong:3.6
     environment:
       KONG_DATABASE: "off"
@@ -299,17 +487,14 @@ ${studioBlock}
       KONG_ADMIN_ACCESS_LOG: /dev/stdout
       KONG_PROXY_ERROR_LOG: /dev/stderr
       KONG_ADMIN_ERROR_LOG: /dev/stderr
-    volumes:
+${kongTlsEnv}    volumes:
       - ${kongMount}:/etc/kong/kong.yml:ro
     ports:
-      - "\${SUPATYPE_KONG_PORT:-18473}:8000"
+${kongPorts}
     depends_on:
-${kongDependsOn}
+${kongDependsOn}${kongTlsDependsOn}
 
-volumes:
-  db-data:
-  minio-data:
-`
+${volumesBlock}`
 }
 
 function ensureComposeManifest(cwd: string): void {
@@ -341,6 +526,9 @@ export function writeSelfHostCompose(
   ensureComposeManifest(cwd)
   writeFileSync(paths.composePath, renderSelfHostCompose(config, cwd, options), "utf8")
   const studioHostDev = options?.devLocal === true && hasStudioOverride(config)
+  const tlsEnabled = selfHostTlsEnabled(config, options?.devLocal === true)
+  const domain = config.server.domain?.trim()
+  const acmeEmail = config.server.tls?.email?.trim()
   writeFileSync(
     paths.kongPath,
     buildKongDeclarative({
@@ -349,20 +537,48 @@ export function writeSelfHostCompose(
         studioServiceUrl: COMPOSE_STUDIO_HOST_URL,
         studioStripPath: false,
       }),
+      ...(tlsEnabled && domain && acmeEmail
+        ? { acme: { email: acmeEmail, domain, redisHost: "valkey" } }
+        : {}),
     }),
     "utf8",
   )
   return paths
 }
 
+export interface RunDockerComposeOptions {
+  /** Suppress docker compose progress UI (container status lines). */
+  quiet?: boolean
+  /** Logo + Clack intro when Docker preflight fails (TTY). */
+  brand?: DockerBrandOptions
+}
+
+/** Exit with a friendly compose failure message. */
+export function exitComposeFailed(
+  status: number,
+  context: string,
+  brand?: DockerBrandOptions,
+): never {
+  fatalError(
+    `docker compose failed (exit ${status}).`,
+    [context, "Check logs: supatype self-host compose logs"],
+    { ...(brand !== undefined && { brand }), exitCode: status === 0 ? 1 : status },
+  )
+}
+
 export function runDockerCompose(
   composePath: string,
   args: string[],
   projectRoot: string = process.cwd(),
   composeProject?: string,
+  options?: RunDockerComposeOptions,
 ): number {
+  requireDockerDaemon(options?.brand !== undefined ? { brand: options.brand } : undefined)
   const envFile = resolve(projectRoot, ".env")
   const composeArgs = ["compose"]
+  if (options?.quiet) {
+    composeArgs.push("--progress", "quiet")
+  }
   // Per-project name isolates containers/volumes/network so multiple Supatype
   // projects on one machine never share a database (default would be the
   // ".supatype/self-host" dir name, identical for every project).
@@ -374,11 +590,11 @@ export function runDockerCompose(
     composeArgs.push("--env-file", envFile)
   }
   composeArgs.push(...args)
-  const result = spawnSync(
-    "docker",
-    composeArgs,
-    { stdio: "inherit", cwd: projectRoot },
-  )
+  const env: NodeJS.ProcessEnv = options?.quiet
+    ? { ...process.env, COMPOSE_PROGRESS: "quiet" }
+    : process.env
+  const stdio = options?.quiet ? "pipe" : "inherit"
+  const result = spawnSync("docker", composeArgs, { stdio, cwd: projectRoot, env })
   return result.status ?? 1
 }
 

package/src/storage-provision.ts

@@ -6,6 +6,10 @@
  * Buckets already registered return 409 Conflict, which is treated as success.
  */
 
+import type { ExtractedSchemaAstV2 } from "./schema-ast-v2.js"
+
+export type { ExtractedStorageBucketAst as SchemaStorageBucketAst } from "./schema-ast-v2.js"
+
 export interface BucketSpec {
   id: string
   public: boolean
@@ -15,6 +19,29 @@ export interface BucketSpec {
   s3_bucket_policy?: string | null
 }
 
+export function bucketSpecsFromAst(ast: Pick<ExtractedSchemaAstV2, "storageBuckets">): BucketSpec[] {
+  return (ast.storageBuckets ?? []).map((b) => ({
+    id: b.id,
+    public: b.public,
+    ...(b.accessMode !== undefined && { access_mode: b.accessMode }),
+    ...(b.allowedMimeTypes != null && { allowed_mime_types: b.allowedMimeTypes }),
+    ...(b.fileSizeLimit != null && { file_size_limit: b.fileSizeLimit }),
+    ...(b.s3BucketPolicy != null &&
+      b.s3BucketPolicy !== "" && { s3_bucket_policy: b.s3BucketPolicy }),
+  }))
+}
+
+export async function provisionBucketsFromAst(
+  ast: Pick<ExtractedSchemaAstV2, "storageBuckets">,
+  storageApiUrl: string,
+  serviceRoleKey: string,
+): Promise<void> {
+  const buckets = bucketSpecsFromAst(ast)
+  if (buckets.length === 0) return
+  console.log("[supatype] Provisioning storage buckets...")
+  await provisionBuckets(storageApiUrl, serviceRoleKey, buckets)
+}
+
 /**
  * Ensure all declared buckets exist in the storage server.
  *
@@ -48,11 +75,16 @@ export async function provisionBuckets(
     const res = await fetch(`${base}/bucket`, { method: "POST", headers, body })
       .catch(() => null)
 
-    if (res === null) continue // server not reachable — skip silently
+    if (res === null) {
+      console.warn(`[storage] Storage API unreachable — skipped bucket "${bucket.id}"`)
+      continue
+    }
     if (res.status === 409) continue // already exists — fine
     if (!res.ok) {
       const msg = await res.text().catch(() => res.statusText)
       console.warn(`[storage] Failed to provision bucket "${bucket.id}": ${msg}`)
+      continue
     }
+    console.log(`[supatype] Storage bucket "${bucket.id}" ready.`)
   }
 }

package/src/supatype-eval-1781522769253.mts

@@ -0,0 +1 @@
+process.stdout.write("hello from tsx")

package/src/systemd.ts

@@ -62,7 +62,7 @@ function postgresUnit(
 ): string {
   const dataDir = config.database.data_dir ?? join(stateDir, "data")
   const logDir = join(stateDir, "logs")
-  const pgBinDir = `%h/.supatype/cache/postgres/${config.versions.postgres}/bin`
+  const pgBinDir = `%h/.supatype/cache/postgres/${config.versions?.postgres ?? "latest"}/bin`
 
   return `[Unit]
 Description=Supatype Postgres (${config.project.name})
@@ -100,7 +100,7 @@ function serverUnit(
   envFile: string,
 ): string {
   const port = config.server.port ?? 54321
-  const serverBin = `%h/.supatype/cache/server/${config.versions.server}/supatype-server`
+  const serverBin = `%h/.supatype/cache/server/${config.versions?.server ?? "latest"}/supatype-server`
   const logDir = join(stateDir, "logs")
 
   const extraArgs: string[] = [`--mode ${config.server.mode}`]

package/src/target-client.ts

@@ -0,0 +1,40 @@
+export interface TargetFetchOptions {
+  method: string
+  path: string
+  body?: unknown
+  token: string
+  orgId?: string | undefined
+  environment?: string | undefined
+}
+
+export async function targetFetch<T>(
+  baseUrl: string,
+  apiPrefix: "/api/v1" | "/platform/v1",
+  opts: TargetFetchOptions,
+): Promise<T> {
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+    Authorization: `Bearer ${opts.token}`,
+  }
+  if (opts.orgId) headers["X-Org-Id"] = opts.orgId
+  if (opts.environment) headers["X-Supatype-Environment"] = opts.environment
+
+  const url = `${baseUrl.replace(/\/$/, "")}${apiPrefix}${opts.path}`
+  const res = await fetch(url, {
+    method: opts.method,
+    headers,
+    ...(opts.body !== undefined ? { body: JSON.stringify(opts.body) } : {}),
+  })
+
+  const json = (await res.json().catch(() => ({}))) as {
+    data?: T
+    error?: string
+    message?: string
+  }
+
+  if (!res.ok) {
+    throw new Error(json.message ?? json.error ?? `API error: ${res.status} ${url}`)
+  }
+
+  return (json.data !== undefined ? json.data : json) as T
+}