@supatype/cli 0.1.5 → 0.1.7

package/src/binary-cache.ts

@@ -196,6 +196,26 @@ function binaryName(component: Component, version: string, platform: PlatformId)
   }
 }
 
+/**
+ * Names a published archive may carry, most-canonical first.
+ *
+ * `supatype-postgres` published the Intel macOS archive as `darwin-x86_64` while every other platform
+ * used `amd64` — the spelling the CLI derives from `process.arch === "x64"`. Releases already on the CDN
+ * carry the old name, so both are accepted and the *signed* checksums manifest decides which exists.
+ * Nothing is guessed: the URL and the hash always come from the same manifest entry.
+ */
+export function archiveNameCandidates(
+  component: Component,
+  version: string,
+  platform: PlatformId,
+): string[] {
+  const canonical = binaryName(component, version, platform)
+  if (component === "postgres" && platform.os === "darwin" && platform.arch === "amd64") {
+    return [canonical, canonical.replace("darwin-amd64", "darwin-x86_64")]
+  }
+  return [canonical]
+}
+
 // ---------------------------------------------------------------------------
 // Platform detection
 // ---------------------------------------------------------------------------
@@ -390,7 +410,6 @@ export async function download(
     return destPath
   }
 
-  const binaryUrl = `${CDN_BASE}${CDN_PATHS[component](version, platform)}`
   const checksumsUrl = `${CDN_BASE}${checksumsDirPath(component, version)}`
   const minisigUrl = `${checksumsUrl}.minisig`
 
@@ -399,15 +418,20 @@ export async function download(
   const tmpPath = destPath + ".tmp"
   try {
     // ── Fetch checksums + optional minisig (retried on transient failures) ───
-    const expectedChecksum = await withRetry(() =>
-      fetchChecksums(checksumsUrl, minisigUrl, name),
+    const match = await withRetry(() =>
+      fetchChecksums(checksumsUrl, minisigUrl, archiveNameCandidates(component, version, platform)),
     )
 
+    // The directory from the path template, the filename from the manifest: a release published under
+    // a legacy name is fetched under that name rather than one the CLI assumed.
+    const cdnDir = CDN_PATHS[component](version, platform).replace(/\/[^/]+$/, "")
+    const binaryUrl = `${CDN_BASE}${cdnDir}/${match.filename}`
+
     // ── Stream-download binary with progress (retried on transient failures) ─
     await withRetry(() => streamToFileWithProgress(binaryUrl, tmpPath))
 
     // ── Verify SHA256 ────────────────────────────────────────────────────────
-    await verifyChecksum(tmpPath, expectedChecksum, component)
+    await verifyChecksum(tmpPath, match.checksum, component)
 
     writeFileSync(destPath, readFileSync(tmpPath))
 
@@ -440,8 +464,8 @@ export async function download(
 async function fetchChecksums(
   checksumsUrl: string,
   minisigUrl: string,
-  binaryFilename: string,
-): Promise<string> {
+  binaryFilenames: string | string[],
+): Promise<ChecksumMatch> {
   const csResp = await fetch(checksumsUrl)
   if (!csResp.ok) {
     throw new Error(`Failed to fetch checksums from ${checksumsUrl}: HTTP ${csResp.status}`)
@@ -458,7 +482,7 @@ async function fetchChecksums(
         "[supatype] \u26a0  SUPATYPE_ALLOW_UNVERIFIED_DOWNLOADS=1 — no minisign public " +
           "key configured; verifying SHA256 only (authenticity NOT checked).",
       )
-      return extractChecksum(checksumsText, binaryFilename)
+      return extractChecksum(checksumsText, binaryFilenames)
     }
     throw new Error(
       "No minisign public key configured — cannot verify release authenticity.\n" +
@@ -479,7 +503,7 @@ async function fetchChecksums(
   const sigText = await sigResp.text()
   verifyMinisign(Buffer.from(checksumsText, "utf8"), sigText, pubKey)
 
-  return extractChecksum(checksumsText, binaryFilename)
+  return extractChecksum(checksumsText, binaryFilenames)
 }
 
 // ---------------------------------------------------------------------------
@@ -568,20 +592,28 @@ export function verifyMinisign(fileBytes: Buffer, sigFileContent: string, pubKey
  * Extract the SHA256 hash for `filename` from a checksums.sha256 file.
  * Format: `<hash>  <filename>` (sha256sum output, two spaces).
  */
-function extractChecksum(checksumsText: string, filename: string): string {
-  const target = basename(filename)
-  for (const line of checksumsText.split("\n")) {
-    const parts = line.trim().split(/\s+/)
-    if (parts.length >= 2 && parts[1] === target) {
-      return parts[0]!
+function extractChecksum(checksumsText: string, filenames: string | string[]): ChecksumMatch {
+  const targets = (Array.isArray(filenames) ? filenames : [filenames]).map((f) => basename(f))
+  for (const target of targets) {
+    for (const line of checksumsText.split("\n")) {
+      const parts = line.trim().split(/\s+/)
+      if (parts.length >= 2 && parts[1] === target) {
+        return { filename: target, checksum: parts[0]! }
+      }
     }
   }
   throw new Error(
-    `Checksum not found for "${target}" in checksums.sha256.\n` +
+    `Checksum not found for ${targets.map((t) => `"${t}"`).join(" or ")} in checksums.sha256.\n` +
       "The checksums file may be from a different release.",
   )
 }
 
+/** Which published name matched, and its hash — both from the same signed manifest entry. */
+export interface ChecksumMatch {
+  filename: string
+  checksum: string
+}
+
 // ---------------------------------------------------------------------------
 // Streaming download with progress bar
 // ---------------------------------------------------------------------------

package/src/cache-clean.ts

@@ -0,0 +1,81 @@
+/**
+ * Helpers for `supatype cache list` / `cache clean` (shared sizing + formatting).
+ */
+
+import { readdirSync, statSync } from "node:fs"
+import { join } from "node:path"
+import { BINARY_COMPONENTS, type Component } from "./components.js"
+import { cacheRoot } from "./binary-cache.js"
+import { isVersionPinned, loadPinnedVersionsForProjects, resolveCacheProjectDirs } from "./cache-pins.js"
+
+export function dirSize(dir: string): number {
+  let total = 0
+  try {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const full = join(dir, entry.name)
+      if (entry.isDirectory()) {
+        total += dirSize(full)
+      } else {
+        total += statSync(full).size
+      }
+    }
+  } catch {
+    // skip unreadable
+  }
+  return total
+}
+
+export function formatBytes(bytes: number): string {
+  if (bytes < 1024) return `${bytes} B`
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`
+  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`
+}
+
+export function listCacheEntries(projectDirs: string[]): Array<{
+  component: Component
+  version: string
+  bytes: number
+  pinned: boolean
+}> {
+  const root = cacheRoot()
+  const { protectedVersions } = loadPinnedVersionsForProjects(projectDirs)
+  const entries: Array<{ component: Component; version: string; bytes: number; pinned: boolean }> = []
+
+  for (const component of BINARY_COMPONENTS) {
+    const compDir = join(root, component)
+    if (!statExists(compDir)) continue
+
+    for (const version of readdirSync(compDir)) {
+      const vDir = join(compDir, version)
+      if (!statIsDir(vDir)) continue
+      entries.push({
+        component,
+        version,
+        bytes: dirSize(vDir),
+        pinned: protectedVersions.get(component)?.has(version) ?? false,
+      })
+    }
+  }
+
+  return entries
+}
+
+function statExists(path: string): boolean {
+  try {
+    statSync(path)
+    return true
+  } catch {
+    return false
+  }
+}
+
+function statIsDir(path: string): boolean {
+  try {
+    return statSync(path).isDirectory()
+  } catch {
+    return false
+  }
+}
+
+export { BINARY_COMPONENTS, resolveCacheProjectDirs }

package/src/cache-pins.ts

@@ -0,0 +1,243 @@
+/**
+ * Pin-aware cache eviction — collect `versions.*` pins across local projects (C13).
+ */
+
+import { existsSync, readdirSync, rmSync, statSync } from "node:fs"
+import { join, resolve } from "node:path"
+import { BINARY_COMPONENTS, type Component } from "./components.js"
+import { cachePath, cacheRoot, pinnedVersion, VERSION_PIN_LOCAL } from "./binary-cache.js"
+import { loadConfig } from "./config.js"
+import type { SupatypeProjectConfig } from "./project-config.js"
+
+const CONFIG_FILENAMES = ["supatype.config.ts", "supatype.config.js", "supatype.config.mjs"] as const
+
+export interface PinSource {
+  component: Component
+  version: string
+  projectDir: string
+  projectName: string
+}
+
+export interface CleanCacheEntry {
+  component: Component
+  version: string
+  bytes: number
+}
+
+export interface CleanCacheResult {
+  removed: CleanCacheEntry[]
+  skipped: Array<CleanCacheEntry & { reason: string }>
+  warned: string[]
+}
+
+/** Union pinned semver versions from one or more loaded configs. */
+export function pinnedVersionsFromConfigs(
+  entries: Array<{ projectDir: string; config: SupatypeProjectConfig }>,
+): { protectedVersions: Map<Component, Set<string>>; sources: PinSource[] } {
+  const protectedVersions = new Map<Component, Set<string>>()
+  const sources: PinSource[] = []
+
+  for (const { projectDir, config } of entries) {
+    const projectName = config.project?.name?.trim() || projectDir
+    for (const component of BINARY_COMPONENTS) {
+      const version = pinnedVersion(component, config)
+      if (!version || version === VERSION_PIN_LOCAL) continue
+      let set = protectedVersions.get(component)
+      if (!set) {
+        set = new Set<string>()
+        protectedVersions.set(component, set)
+      }
+      set.add(version)
+      sources.push({ component, version, projectDir, projectName })
+    }
+  }
+
+  return { protectedVersions, sources }
+}
+
+function hasSupatypeConfig(dir: string): boolean {
+  return CONFIG_FILENAMES.some((name) => existsSync(join(dir, name)))
+}
+
+/** Walk `root` up to `maxDepth` looking for directories that contain a Supatype config file. */
+export function findSupatypeProjectDirs(root: string, maxDepth = 4): string[] {
+  const absRoot = resolve(root)
+  if (!existsSync(absRoot)) return []
+
+  const found: string[] = []
+  const queue: Array<{ dir: string; depth: number }> = [{ dir: absRoot, depth: 0 }]
+
+  while (queue.length > 0) {
+    const item = queue.shift()
+    if (!item) break
+    const { dir, depth } = item
+
+    if (hasSupatypeConfig(dir)) {
+      found.push(dir)
+      continue
+    }
+
+    if (depth >= maxDepth) continue
+
+    let entries
+    try {
+      entries = readdirSync(dir, { withFileTypes: true })
+    } catch {
+      continue
+    }
+
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue
+      if (entry.name === "node_modules" || entry.name === ".git" || entry.name === ".supatype") continue
+      queue.push({ dir: join(dir, entry.name), depth: depth + 1 })
+    }
+  }
+
+  return found
+}
+
+/** Resolve project directories whose `versions` pins should protect cache entries. */
+export function resolveCacheProjectDirs(cwd: string, extraProjects: string[]): string[] {
+  const dirs = new Set<string>()
+
+  for (const raw of extraProjects) {
+    const abs = resolve(raw)
+    if (hasSupatypeConfig(abs)) dirs.add(abs)
+  }
+
+  if (hasSupatypeConfig(cwd)) dirs.add(resolve(cwd))
+
+  const envRoots = process.env.SUPATYPE_CACHE_PROJECT_ROOTS?.trim()
+  if (envRoots) {
+    for (const segment of envRoots.split(",")) {
+      const root = segment.trim()
+      if (!root) continue
+      for (const dir of findSupatypeProjectDirs(root)) {
+        dirs.add(dir)
+      }
+    }
+  }
+
+  return [...dirs]
+}
+
+export function loadPinnedVersionsForProjects(
+  projectDirs: string[],
+): { protectedVersions: Map<Component, Set<string>>; sources: PinSource[]; loadWarnings: string[] } {
+  const configs: Array<{ projectDir: string; config: SupatypeProjectConfig }> = []
+  const loadWarnings: string[] = []
+
+  for (const projectDir of projectDirs) {
+    try {
+      configs.push({ projectDir, config: loadConfig(projectDir) })
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err)
+      loadWarnings.push(`${projectDir}: ${message}`)
+    }
+  }
+
+  const { protectedVersions, sources } = pinnedVersionsFromConfigs(configs)
+  return { protectedVersions, sources, loadWarnings }
+}
+
+export function listCachedVersions(component: Component): string[] {
+  const compDir = join(cacheRoot(), component)
+  if (!existsSync(compDir)) return []
+  return readdirSync(compDir).filter((name) => {
+    try {
+      return statSync(join(compDir, name)).isDirectory()
+    } catch {
+      return false
+    }
+  })
+}
+
+function pinReason(
+  component: Component,
+  version: string,
+  sources: PinSource[],
+): string | undefined {
+  const matches = sources.filter((s) => s.component === component && s.version === version)
+  if (matches.length === 0) return undefined
+  const names = [...new Set(matches.map((m) => m.projectName))]
+  return `pinned by ${names.join(", ")}`
+}
+
+function dirSize(dir: string): number {
+  let total = 0
+  try {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const full = join(dir, entry.name)
+      if (entry.isDirectory()) {
+        total += dirSize(full)
+      } else {
+        total += statSync(full).size
+      }
+    }
+  } catch {
+    // skip unreadable
+  }
+  return total
+}
+
+export interface CleanCachedBinariesOptions {
+  components: Component[]
+  version?: string
+  force?: boolean
+  dryRun?: boolean
+  projectDirs: string[]
+}
+
+export function cleanCachedBinaries(options: CleanCachedBinariesOptions): CleanCacheResult {
+  const { protectedVersions, sources, loadWarnings } = loadPinnedVersionsForProjects(options.projectDirs)
+  const result: CleanCacheResult = { removed: [], skipped: [], warned: [...loadWarnings] }
+
+  const force = options.force === true
+  const dryRun = options.dryRun === true
+  const explicitVersion = options.version?.trim()
+
+  for (const component of options.components) {
+    const versions = explicitVersion ? [explicitVersion] : listCachedVersions(component)
+
+    for (const version of versions) {
+      const vDir = cachePath(component, version)
+      if (!existsSync(vDir)) {
+        if (explicitVersion) continue
+        continue
+      }
+
+      const bytes = dirSize(vDir)
+      const entry: CleanCacheEntry = { component, version, bytes }
+      const pinned = protectedVersions.get(component)?.has(version) ?? false
+
+      if (!force && !explicitVersion && pinned) {
+        const reason = pinReason(component, version, sources) ?? "pinned"
+        result.skipped.push({ ...entry, reason })
+        continue
+      }
+
+      if (!force && explicitVersion && pinned) {
+        const reason = pinReason(component, version, sources) ?? "pinned"
+        result.warned.push(
+          `${component}@${version} is ${reason} — removing anyway (explicit version)`,
+        )
+      }
+
+      if (!dryRun) {
+        rmSync(vDir, { recursive: true, force: true })
+      }
+      result.removed.push(entry)
+    }
+  }
+
+  return result
+}
+
+export function isVersionPinned(
+  component: Component,
+  version: string,
+  projectDirs: string[],
+): boolean {
+  const { protectedVersions } = loadPinnedVersionsForProjects(projectDirs)
+  return protectedVersions.get(component)?.has(version) ?? false
+}

package/src/cli-install-method.ts

@@ -0,0 +1,67 @@
+/**
+ * Detect how the supatype CLI was installed (npm, Homebrew, standalone CDN).
+ */
+
+export type CliInstallMethod = "npm" | "homebrew" | "standalone"
+
+function normalizePath(path: string): string {
+  return path.replace(/\\/g, "/")
+}
+
+/** The running binary sits in an npm or workspace layout. */
+function hasNpmInstallPath(): boolean {
+  const main = normalizePath(process.argv[1] ?? "")
+  return (
+    main.includes("node_modules") ||
+    main.includes("/dist/cli") ||
+    main.includes("/bin/supatype.js")
+  )
+}
+
+/** Launched through an npm/pnpm/yarn script, whatever the binary's own layout. */
+function ranUnderPackageManager(): boolean {
+  return Boolean(process.env["npm_execpath"]) || Boolean(process.env["npm_lifecycle_event"])
+}
+
+/** npm global, project dependency, or monorepo workspace build. */
+export function looksLikeNpmOrWorkspaceCLI(): boolean {
+  return hasNpmInstallPath() || ranUnderPackageManager()
+}
+
+/** Homebrew / Linuxbrew Cellar layout. */
+export function looksLikeHomebrewCLI(): boolean {
+  const main = normalizePath(process.argv[1] ?? "")
+  if (!main) return false
+
+  if (/(?:^|\/)Cellar\/supatype\//.test(main)) return true
+
+  const cellar = process.env["HOMEBREW_CELLAR"]
+  if (cellar && normalizePath(main).startsWith(normalizePath(cellar) + "/") && main.includes("/supatype/")) {
+    return true
+  }
+
+  return false
+}
+
+/**
+ * Which installer owns the running binary — this decides what `self-update`
+ * tells the user to run, so it has to describe the binary on disk.
+ *
+ * Path shape wins over `npm_*` in the environment: those are set whenever the
+ * CLI is invoked from a package script, which says nothing about how the binary
+ * got there. Trusting them meant a Homebrew or curl install called from an npm
+ * script was told to update itself with npm.
+ */
+export function detectCliInstallMethod(): CliInstallMethod {
+  if (hasNpmInstallPath()) return "npm"
+  if (looksLikeHomebrewCLI()) return "homebrew"
+  if (isStandalonePath()) return "standalone"
+  if (ranUnderPackageManager()) return "npm"
+  return "standalone"
+}
+
+/** The `curl | sh` installer's default target. */
+function isStandalonePath(): boolean {
+  const main = normalizePath(process.argv[1] ?? "")
+  return main.includes("/.supatype/bin/")
+}

package/src/cli.ts

@@ -18,6 +18,7 @@ import { registerApp } from "./commands/app.js"
 import { registerAdd } from "./commands/add.js"
 import { registerSelfHost } from "./commands/self-host.js"
 import { registerCloud } from "./commands/cloud.js"
+import { registerLogin } from "./commands/login.js"
 import { registerEngine } from "./commands/engine.js"
 import { registerDb } from "./commands/db.js"
 import { registerDeploy } from "./commands/deploy.js"
@@ -25,10 +26,12 @@ import { registerStatus } from "./commands/status.js"
 import { registerLogs } from "./commands/logs.js"
 import { registerAdmin } from "./commands/admin.js"
 import { registerFunctions } from "./commands/functions.js"
+import { registerHooks } from "./commands/hooks.js"
 import { registerPlugins } from "./commands/plugins.js"
 import { registerTypes } from "./commands/types.js"
 import { registerMigrateFromV1 } from "./commands/migrate-from-v1.js"
 import { registerSelfUpdate } from "./commands/self-update.js"
+import { registerInternalCommands } from "./commands/internal.js"
 import { cliPackageVersion } from "./cli-package-version.js"
 import { reportCliFatal } from "./ui/fatal.js"
 import { wrapProgramActionsWithChrome } from "./ui/runtime/command-chrome.js"
@@ -43,6 +46,7 @@ export async function run(): Promise<void> {
   registerDev(program)
   registerCache(program)
   registerSelfUpdate(program)
+  registerInternalCommands(program)
   registerUpdate(program)
   registerPg(program)
   registerPush(program)
@@ -58,6 +62,7 @@ export async function run(): Promise<void> {
   registerApp(program)
   registerAdd(program)
   registerSelfHost(program)
+  registerLogin(program)
   registerCloud(program)
   registerEngine(program)
   registerDb(program)
@@ -66,6 +71,7 @@ export async function run(): Promise<void> {
   registerLogs(program)
   registerAdmin(program)
   registerFunctions(program)
+  registerHooks(program)
   registerPlugins(program)
   registerTypes(program)
   registerMigrateFromV1(program)