@supatype/cli 0.1.6 → 0.1.7

package/dist/env-file.js

@@ -1,18 +1,132 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-/** Merge key/value updates into a project `.env` without dropping unrelated lines. */
-export function upsertEnvFile(cwd, updates, removeKeys = []) {
+/**
+ * Marks a value the CLI wrote from `versions` in `supatype.config.ts`.
+ *
+ * Provenance, so that removing a pin from config can clean up the stale image reference it left
+ * behind *without* deleting a value the operator wrote by hand. Before this, the image keys derived
+ * from config were removed unconditionally on every compose run: an operator could override
+ * `SUPATYPE_REALTIME_IMAGE` from `.env` and could not override `SUPATYPE_SERVER_IMAGE`, because the
+ * latter is derivable from a pin and the former is not. Same file, same shape, different rules.
+ */
+export const MANAGED_MARKER = "# supatype:managed — value from versions in supatype.config.ts";
+function parseLines(text) {
+    const out = [];
+    if (text === "")
+        return out;
+    let markerPending = false;
+    // A file ending in a newline yields a final empty element; keeping it would put a blank line
+    // between the existing content and anything appended.
+    const raws = text.split(/\r?\n/);
+    while (raws.length > 0 && raws[raws.length - 1] === "")
+        raws.pop();
+    for (const raw of raws) {
+        const trimmed = raw.trim();
+        if (trimmed === MANAGED_MARKER) {
+            markerPending = true;
+            out.push({ text: raw, managed: false });
+            continue;
+        }
+        const eq = raw.indexOf("=");
+        const key = eq > 0 ? raw.slice(0, eq).trim() : undefined;
+        const isAssignment = key !== undefined && /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);
+        out.push({ ...(isAssignment && { key }), text: raw, managed: isAssignment && markerPending });
+        if (!isAssignment && trimmed !== "")
+            markerPending = false;
+        else if (isAssignment)
+            markerPending = false;
+    }
+    return out;
+}
+/**
+ * Merge key/value updates into a project `.env`.
+ *
+ * Comments, blank lines and ordering are preserved: this file is edited by hand, and the previous
+ * implementation rebuilt it from the assignments alone, so every comment an operator had written
+ * disappeared the first time they ran anything that touched `.env`.
+ */
+export function upsertEnvFile(cwd, updates, options = {}) {
+    // Historically the third argument was a plain list of keys to remove unconditionally.
+    const opts = Array.isArray(options)
+        ? { remove: options }
+        : options;
+    const removeManaged = new Set(opts.removeManaged ?? []);
+    const removeAlways = new Set(opts.remove ?? []);
+    const managed = new Set(opts.managed ?? []);
     const envPath = join(cwd, ".env");
     const existing = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
-    const keys = new Set([...Object.keys(updates), ...removeKeys]);
-    const kept = existing
-        .split("\n")
-        .filter((line) => {
-        const key = line.split("=")[0]?.trim();
-        return key && line.includes("=") && !keys.has(key);
-    });
-    const merged = [...kept, ...Object.entries(updates).map(([key, value]) => `${key}=${value}`)];
-    writeFileSync(envPath, `${merged.join("\n").trimEnd()}\n`, "utf8");
+    const lines = parseLines(existing);
+    const written = new Set();
+    const kept = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const key = line.key;
+        if (key === undefined) {
+            kept.push(line);
+            continue;
+        }
+        if (removeAlways.has(key) || (removeManaged.has(key) && line.managed)) {
+            // Drop the marker that introduced it, so no orphan comment is left behind.
+            if (line.managed && kept[kept.length - 1]?.text.trim() === MANAGED_MARKER)
+                kept.pop();
+            continue;
+        }
+        if (key in updates) {
+            const wantsMarker = managed.has(key);
+            if (wantsMarker && kept[kept.length - 1]?.text.trim() !== MANAGED_MARKER) {
+                kept.push({ text: MANAGED_MARKER, managed: false });
+            }
+            if (!wantsMarker && line.managed && kept[kept.length - 1]?.text.trim() === MANAGED_MARKER) {
+                kept.pop();
+            }
+            kept.push({ key, text: `${key}=${updates[key]}`, managed: wantsMarker });
+            written.add(key);
+            continue;
+        }
+        kept.push(line);
+    }
+    const appended = [];
+    for (const [key, value] of Object.entries(updates)) {
+        if (written.has(key))
+            continue;
+        if (managed.has(key))
+            appended.push(MANAGED_MARKER);
+        appended.push(`${key}=${value}`);
+    }
+    const body = [...kept.map((l) => l.text), ...appended].join("\n");
+    writeFileSync(envPath, `${body.replace(/\n+$/, "")}\n`, "utf8");
+}
+/**
+ * Parse a project `.env` into key/value pairs.
+ *
+ * Deliberately small: `KEY=value`, `#` comments, one optional layer of surrounding quotes. No
+ * interpolation and no `export` handling, because Compose's own parser does not do those either and
+ * a `.env` that means two different things depending on who reads it is worse than a limited one.
+ */
+export function readEnvFile(cwd) {
+    const envPath = join(cwd, ".env");
+    if (!existsSync(envPath))
+        return {};
+    const out = {};
+    for (const line of readFileSync(envPath, "utf8").split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (trimmed.length === 0 || trimmed.startsWith("#"))
+            continue;
+        const eq = trimmed.indexOf("=");
+        if (eq <= 0)
+            continue;
+        const key = trimmed.slice(0, eq).trim();
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+            continue;
+        let value = trimmed.slice(eq + 1).trim();
+        if (value.length >= 2 &&
+            ((value.startsWith('"') && value.endsWith('"')) ||
+                (value.startsWith("'") && value.endsWith("'")))) {
+            value = value.slice(1, -1);
+        }
+        out[key] = value;
+    }
+    return out;
 }
 export function readEnvValue(cwd, key, fallback) {
     const envPath = join(cwd, ".env");
@@ -23,6 +137,13 @@ export function readEnvValue(cwd, key, fallback) {
     }
     return fallback;
 }
+/** Whether `.env` carries a non-empty value for `key`. Distinguishes absent from defaulted. */
+export function hasEnvValue(cwd, key) {
+    const envPath = join(cwd, ".env");
+    if (!existsSync(envPath))
+        return false;
+    return new RegExp(`^${key}=(.+)$`, "m").test(readFileSync(envPath, "utf8"));
+}
 export function readEnvInt(cwd, key) {
     const raw = readEnvValue(cwd, key, "");
     if (!raw)

package/dist/env-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-file.js","sourceRoot":"","sources":["../src/env-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,OAA+B,EAC/B,aAAgC,EAAE;IAElC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAA;IAC9D,MAAM,IAAI,GAAG,QAAQ;SAClB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;QACtC,OAAO,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IACJ,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAA;IAC7F,aAAa,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,GAAW,EAAE,QAAgB;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACjC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAA;QAC/E,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAChC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,GAAW;IACjD,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACxB,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1E,CAAC"}
+{"version":3,"file":"env-file.js","sourceRoot":"","sources":["../src/env-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,gEAAgE,CAAA;AAU9F,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAc,EAAE,CAAA;IACzB,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,GAAG,CAAA;IAC3B,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,6FAA6F;IAC7F,sDAAsD;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,IAAI,CAAC,GAAG,EAAE,CAAA;IAClE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QAC1B,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;YAC/B,aAAa,GAAG,IAAI,CAAA;YACpB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;YACvC,SAAQ;QACV,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QACxD,MAAM,YAAY,GAAG,GAAG,KAAK,SAAS,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,IAAI,aAAa,EAAE,CAAC,CAAA;QAC7F,IAAI,CAAC,YAAY,IAAI,OAAO,KAAK,EAAE;YAAE,aAAa,GAAG,KAAK,CAAA;aACrD,IAAI,YAAY;YAAE,aAAa,GAAG,KAAK,CAAA;IAC9C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,OAA+B,EAC/B,UAA6C,EAAE;IAE/C,sFAAsF;IACtF,MAAM,IAAI,GAAkB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAChD,CAAC,CAAC,EAAE,MAAM,EAAE,OAA4B,EAAE;QAC1C,CAAC,CAAE,OAAyB,CAAA;IAC9B,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAA;IACvD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;IAE3C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IAElC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,MAAM,IAAI,GAAc,EAAE,CAAA;IAE1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAA;QAEpB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACf,SAAQ;QACV,CAAC;QAED,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtE,2EAA2E;YAC3E,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,cAAc;gBAAE,IAAI,CAAC,GAAG,EAAE,CAAA;YACrF,SAAQ;QACV,CAAC;QAED,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;YACnB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACpC,IAAI,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,cAAc,EAAE,CAAC;gBACzE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;YACrD,CAAC;YACD,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,cAAc,EAAE,CAAC;gBAC1F,IAAI,CAAC,GAAG,EAAE,CAAA;YACZ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;YACxE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAChB,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACnD,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAA;IAClC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjE,aAAa,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACjC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAA;IAEnC,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC7D,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAQ;QACrB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QACvC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAQ;QACnD,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACxC,IACE,KAAK,CAAC,MAAM,IAAI,CAAC;YACjB,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC7C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EACjD,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC5B,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAClB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,GAAW,EAAE,QAAgB;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACjC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAA;QAC/E,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAChC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACjC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACtC,OAAO,IAAI,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,GAAW;IACjD,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACxB,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1E,CAAC"}

package/dist/field-masking-tier.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Which mechanism will enforce this project's per-column rules — decided offline.
+ *
+ * The engine makes the same decision at push time by asking the database whether `supatype_mask` is
+ * installed. The CLI has to answer earlier: it writes `PGRST_DB_SCHEMA` when it generates compose,
+ * before any database necessarily exists. It can, because the extension needs
+ * `shared_preload_libraries` and a compiled library on the host, so exactly one path ships it —
+ * `supatype/postgres`. Everything else gets the view tier:
+ *
+ * | Config                                       | Ships the extension | Tier      |
+ * | -------------------------------------------- | ------------------- | --------- |
+ * | `database.provider: "docker"`                | yes                 | extension |
+ * | `provider: native`                           | no                  | views     |
+ * | `database.external`                          | no                  | views     |
+ * | `provider: docker` + `database.image` override | no                | views     |
+ *
+ * Deliberately **not** "is the database external": a native `supatype dev` has no extension either,
+ * and treating it as tier 1 would point PostgREST at a schema whose tables the API roles no longer
+ * hold privileges on — every request denied.
+ *
+ * The one case this cannot call is a self-managed Postgres where the operator compiled and installed
+ * the extension themselves and points at it with `database.external`. They set `schema.api_schemas`
+ * explicitly; `supatype db check` reports the mismatch either way.
+ */
+export { nativeMaskLibraryPresent } from "./postgres-ctl.js";
+import type { SupatypeProjectConfig } from "./project-config.js";
+export type FieldMaskingTier = "none" | "extension" | "views";
+/** True when the Postgres this project runs is one that carries `supatype_mask`. */
+export declare function imageShipsMaskExtension(config: SupatypeProjectConfig): boolean;
+/**
+ * Whether any model masks a column.
+ *
+ * Read from the extracted AST rather than the config, because that is where field rules live. Shaped
+ * loosely on purpose: the CLI's AST type carries `platform.access` as an opaque record, and this only
+ * needs to know whether a `fields` map is present and non-empty.
+ */
+export declare function schemaHasFieldRules(ast: unknown): boolean;
+/** The tier this project's next push will use. */
+export declare function fieldMaskingTier(config: SupatypeProjectConfig, ast: unknown, 
+/** Set on the native path once the Postgres install is known — see [`nativeMaskLibraryPresent`]. */
+maskLibraryPresent?: boolean): FieldMaskingTier;
+/**
+ * The tier for a project on disk, loading its schema to see whether any column is masked.
+ *
+ * A schema that fails to load falls back to `"none"` — the default exposed-schema list. Deciding the
+ * tier is the wrong moment to report a syntax error, and `push`/`dev` do it properly moments later
+ * with the file and line.
+ */
+export declare function fieldMaskingTierFromProject(cwd: string, config: SupatypeProjectConfig, maskLibraryPresent?: boolean): FieldMaskingTier;
+//# sourceMappingURL=field-masking-tier.d.ts.map

package/dist/field-masking-tier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-masking-tier.d.ts","sourceRoot":"","sources":["../src/field-masking-tier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAOH,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAOhE,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,CAAA;AAY7D,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAG9E;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAUzD;AAED,kDAAkD;AAClD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,qBAAqB,EAC7B,GAAG,EAAE,OAAO;AACZ,oGAAoG;AACpG,kBAAkB,CAAC,EAAE,OAAO,GAC3B,gBAAgB,CAIlB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,qBAAqB,EAC7B,kBAAkB,CAAC,EAAE,OAAO,GAC3B,gBAAgB,CAQlB"}

package/dist/field-masking-tier.js

@@ -0,0 +1,91 @@
+/**
+ * Which mechanism will enforce this project's per-column rules — decided offline.
+ *
+ * The engine makes the same decision at push time by asking the database whether `supatype_mask` is
+ * installed. The CLI has to answer earlier: it writes `PGRST_DB_SCHEMA` when it generates compose,
+ * before any database necessarily exists. It can, because the extension needs
+ * `shared_preload_libraries` and a compiled library on the host, so exactly one path ships it —
+ * `supatype/postgres`. Everything else gets the view tier:
+ *
+ * | Config                                       | Ships the extension | Tier      |
+ * | -------------------------------------------- | ------------------- | --------- |
+ * | `database.provider: "docker"`                | yes                 | extension |
+ * | `provider: native`                           | no                  | views     |
+ * | `database.external`                          | no                  | views     |
+ * | `provider: docker` + `database.image` override | no                | views     |
+ *
+ * Deliberately **not** "is the database external": a native `supatype dev` has no extension either,
+ * and treating it as tier 1 would point PostgREST at a schema whose tables the API roles no longer
+ * hold privileges on — every request denied.
+ *
+ * The one case this cannot call is a self-managed Postgres where the operator compiled and installed
+ * the extension themselves and points at it with `database.external`. They set `schema.api_schemas`
+ * explicitly; `supatype db check` reports the mismatch either way.
+ */
+import { existsSync } from "node:fs";
+// Statically imported: these packages are ESM, where `require` does not exist. The first attempt used
+// it for a lazy import and every command that generates compose would have thrown at runtime — caught
+// by the tests that run the built binary rather than the source.
+import { loadSchemaAst } from "./config.js";
+export { nativeMaskLibraryPresent } from "./postgres-ctl.js";
+import { resolveRuntimeProvider, schemaPathFromProject, usesExternalDatabase, } from "./project-config.js";
+/** Postgres image this project would run, when it runs one at all. */
+function postgresImage(config) {
+    if (usesExternalDatabase(config))
+        return undefined;
+    if (config.database.provider !== "docker" && resolveRuntimeProvider(config) !== "docker") {
+        return undefined;
+    }
+    return config.database.image?.trim() || "supatype/postgres:latest";
+}
+/** True when the Postgres this project runs is one that carries `supatype_mask`. */
+export function imageShipsMaskExtension(config) {
+    const image = postgresImage(config);
+    return image !== undefined && /^supatype\/postgres(:|$)/.test(image);
+}
+/**
+ * Whether any model masks a column.
+ *
+ * Read from the extracted AST rather than the config, because that is where field rules live. Shaped
+ * loosely on purpose: the CLI's AST type carries `platform.access` as an opaque record, and this only
+ * needs to know whether a `fields` map is present and non-empty.
+ */
+export function schemaHasFieldRules(ast) {
+    const models = ast?.models;
+    if (!Array.isArray(models))
+        return false;
+    return models.some((model) => {
+        const access = model?.annotations?.platform?.access;
+        const fields = access?.["fields"];
+        return typeof fields === "object" && fields !== null && Object.keys(fields).length > 0;
+    });
+}
+/** The tier this project's next push will use. */
+export function fieldMaskingTier(config, ast, 
+/** Set on the native path once the Postgres install is known — see [`nativeMaskLibraryPresent`]. */
+maskLibraryPresent) {
+    if (!schemaHasFieldRules(ast))
+        return "none";
+    if (maskLibraryPresent === true)
+        return "extension";
+    return imageShipsMaskExtension(config) ? "extension" : "views";
+}
+/**
+ * The tier for a project on disk, loading its schema to see whether any column is masked.
+ *
+ * A schema that fails to load falls back to `"none"` — the default exposed-schema list. Deciding the
+ * tier is the wrong moment to report a syntax error, and `push`/`dev` do it properly moments later
+ * with the file and line.
+ */
+export function fieldMaskingTierFromProject(cwd, config, maskLibraryPresent) {
+    try {
+        const schemaPath = schemaPathFromProject(config, cwd);
+        if (!existsSync(schemaPath))
+            return "none";
+        return fieldMaskingTier(config, loadSchemaAst(schemaPath, cwd), maskLibraryPresent);
+    }
+    catch {
+        return "none";
+    }
+}
+//# sourceMappingURL=field-masking-tier.js.map

package/dist/field-masking-tier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-masking-tier.js","sourceRoot":"","sources":["../src/field-masking-tier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,sGAAsG;AACtG,sGAAsG;AACtG,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,qBAAqB,CAAA;AAK5B,sEAAsE;AACtE,SAAS,aAAa,CAAC,MAA6B;IAClD,IAAI,oBAAoB,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,sBAAsB,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzF,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,0BAA0B,CAAA;AACpE,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uBAAuB,CAAC,MAA6B;IACnE,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACnC,OAAO,KAAK,KAAK,SAAS,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,MAAM,MAAM,GAAI,GAAqC,EAAE,MAAM,CAAA;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,MAAM,MAAM,GACV,KACD,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAA;QAChC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAA;QACjC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,gBAAgB,CAC9B,MAA6B,EAC7B,GAAY;AACZ,oGAAoG;AACpG,kBAA4B;IAE5B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAA;IAC5C,IAAI,kBAAkB,KAAK,IAAI;QAAE,OAAO,WAAW,CAAA;IACnD,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAA;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,GAAW,EACX,MAA6B,EAC7B,kBAA4B;IAE5B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACrD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,MAAM,CAAA;QAC1C,OAAO,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,kBAAkB,CAAC,CAAA;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAA;IACf,CAAC;AACH,CAAC"}

package/dist/functions-deno-types.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Scaffold Deno IDE types for edge functions so tsserver / Cursor stop
+ * reporting "Cannot find name 'Deno'" under the project root tsconfig.
+ *
+ * We ship a curated ambient declaration (not `@types/deno` at the app root):
+ * installing `@types/deno` as a project dependency auto-includes it in the
+ * whole app when root `tsconfig` omits `"types"`, which pollutes React/Next.
+ */
+/** Ambient Deno types written into `functions/deno.d.ts`. */
+export declare function functionsDenoAmbientSource(): string;
+/** `functions/tsconfig.json` — owns function files so the app config can exclude them. */
+export declare function functionsTsConfigSource(): string;
+export type FunctionsDenoTypesResult = {
+    wroteDenoDts: boolean;
+    wroteTsconfig: boolean;
+    rootExclude: "updated" | "already" | "missing" | "manual";
+    hints: string[];
+};
+/**
+ * Ensure `functions/deno.d.ts` + `functions/tsconfig.json` exist, and try to
+ * exclude `functions` from the project-root `tsconfig.json`.
+ */
+export declare function ensureFunctionsDenoTypes(projectRoot: string, functionsDir: string): FunctionsDenoTypesResult;
+//# sourceMappingURL=functions-deno-types.d.ts.map

package/dist/functions-deno-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"functions-deno-types.d.ts","sourceRoot":"","sources":["../src/functions-deno-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH,6DAA6D;AAC7D,wBAAgB,0BAA0B,IAAI,MAAM,CAsDnD;AAED,0FAA0F;AAC1F,wBAAgB,uBAAuB,IAAI,MAAM,CAiBhD;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,YAAY,EAAE,OAAO,CAAA;IACrB,aAAa,EAAE,OAAO,CAAA;IACtB,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAA;IACzD,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB,CAAA;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,wBAAwB,CAiC1B"}

package/dist/functions-deno-types.js

@@ -0,0 +1,155 @@
+/**
+ * Scaffold Deno IDE types for edge functions so tsserver / Cursor stop
+ * reporting "Cannot find name 'Deno'" under the project root tsconfig.
+ *
+ * We ship a curated ambient declaration (not `@types/deno` at the app root):
+ * installing `@types/deno` as a project dependency auto-includes it in the
+ * whole app when root `tsconfig` omits `"types"`, which pollutes React/Next.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync, } from "node:fs";
+import { join, relative } from "node:path";
+import ts from "typescript";
+const MARKER = "Supatype edge functions (IDE / tsserver)";
+/** Ambient Deno types written into `functions/deno.d.ts`. */
+export function functionsDenoAmbientSource() {
+    return `/**
+ * ${MARKER}.
+ * Runtime is Deno; this file covers APIs edge functions commonly use.
+ * Do not add \`@types/deno\` to the app package.json — it leaks into the
+ * whole project when root tsconfig has no \`"types"\` field.
+ *
+ * Optional: for the full Deno API, install the Deno VS Code/Cursor extension
+ * and open \`functions/\` as a Deno-enabled workspace folder.
+ */
+/* eslint-disable @typescript-eslint/no-unused-vars */
+
+interface DenoEnv {
+  /** Returns the value of the environment variable, or \`undefined\` if unset. */
+  get(key: string): string | undefined
+  set(key: string, value: string): void
+  delete(key: string): void
+  has(key: string): boolean
+  toObject(): { [key: string]: string }
+}
+
+declare namespace Deno {
+  const env: DenoEnv
+
+  namespace errors {
+    class NotFound extends Error {}
+    class PermissionDenied extends Error {}
+  }
+
+  interface DirEntry {
+    name: string
+    isFile: boolean
+    isDirectory: boolean
+    isSymlink: boolean
+  }
+
+  interface FileInfo {
+    isFile: boolean
+    isDirectory: boolean
+    isSymlink: boolean
+    size: number
+    mtime: Date | null
+  }
+
+  function readDir(path: string): AsyncIterable<DirEntry>
+  function readTextFile(path: string): Promise<string>
+  function stat(path: string): Promise<FileInfo>
+
+  function serve(
+    options: { port: number; hostname?: string; onListen?: (params: { hostname: string; port: number }) => void },
+    handler: (req: Request) => Response | Promise<Response>,
+  ): void
+}
+`;
+}
+/** `functions/tsconfig.json` — owns function files so the app config can exclude them. */
+export function functionsTsConfigSource() {
+    return `{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "strict": true,
+    "noEmit": true,
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "isolatedModules": true,
+    "skipLibCheck": true,
+    "allowImportingTsExtensions": true,
+    "types": []
+  },
+  "include": ["./**/*.ts", "./deno.d.ts"]
+}
+`;
+}
+/**
+ * Ensure `functions/deno.d.ts` + `functions/tsconfig.json` exist, and try to
+ * exclude `functions` from the project-root `tsconfig.json`.
+ */
+export function ensureFunctionsDenoTypes(projectRoot, functionsDir) {
+    mkdirSync(functionsDir, { recursive: true });
+    const denoDtsPath = join(functionsDir, "deno.d.ts");
+    const tsconfigPath = join(functionsDir, "tsconfig.json");
+    let wroteDenoDts = false;
+    if (!existsSync(denoDtsPath)) {
+        writeFileSync(denoDtsPath, functionsDenoAmbientSource(), "utf8");
+        wroteDenoDts = true;
+    }
+    let wroteTsconfig = false;
+    if (!existsSync(tsconfigPath)) {
+        writeFileSync(tsconfigPath, functionsTsConfigSource(), "utf8");
+        wroteTsconfig = true;
+    }
+    const rootExclude = ensureRootTsconfigExcludesFunctions(projectRoot);
+    const hints = [];
+    const fnRel = toPosix(relative(projectRoot, functionsDir)) || "functions";
+    if (rootExclude === "manual") {
+        hints.push(`Add "functions" to the root tsconfig.json "exclude" array so the app checker skips ${fnRel}/.`);
+    }
+    else if (rootExclude === "missing") {
+        hints.push(`If you add a root tsconfig.json, exclude "${fnRel}" (or "functions") so app typecheck stays separate.`);
+    }
+    return { wroteDenoDts, wroteTsconfig, rootExclude, hints };
+}
+function ensureRootTsconfigExcludesFunctions(projectRoot) {
+    const path = join(projectRoot, "tsconfig.json");
+    if (!existsSync(path))
+        return "missing";
+    const raw = readFileSync(path, "utf8");
+    const parsed = ts.parseConfigFileTextToJson(path, raw);
+    if (parsed.error || parsed.config === undefined || typeof parsed.config !== "object") {
+        return "manual";
+    }
+    const cfg = parsed.config;
+    const exclude = Array.isArray(cfg.exclude) ? cfg.exclude.map(String) : [];
+    if (exclude.some(isFunctionsExcludeEntry))
+        return "already";
+    try {
+        const asJson = JSON.parse(raw);
+        asJson.exclude = [...(Array.isArray(asJson.exclude) ? asJson.exclude : []), "functions"];
+        writeFileSync(path, `${JSON.stringify(asJson, null, 2)}\n`, "utf8");
+        return "updated";
+    }
+    catch {
+        // JSONC / trailing commas — try a conservative string splice into an existing exclude array.
+        if (/"exclude"\s*:\s*\[/.test(raw)) {
+            const next = raw.replace(/("exclude"\s*:\s*\[)/, `$1\n    "functions",`);
+            if (next !== raw) {
+                writeFileSync(path, next, "utf8");
+                return "updated";
+            }
+        }
+        return "manual";
+    }
+}
+function isFunctionsExcludeEntry(entry) {
+    const n = entry.replace(/\\/g, "/").replace(/^\.\//, "");
+    return n === "functions" || n === "functions/**" || n.startsWith("functions/");
+}
+function toPosix(path) {
+    return path.replace(/\\/g, "/");
+}
+//# sourceMappingURL=functions-deno-types.js.map

package/dist/functions-deno-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"functions-deno-types.js","sourceRoot":"","sources":["../src/functions-deno-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EAAE,MAAM,YAAY,CAAA;AAE3B,MAAM,MAAM,GAAG,0CAA0C,CAAA;AAEzD,6DAA6D;AAC7D,MAAM,UAAU,0BAA0B;IACxC,OAAO;KACJ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmDV,CAAA;AACD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,uBAAuB;IACrC,OAAO;;;;;;;;;;;;;;;CAeR,CAAA;AACD,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,YAAoB;IAEpB,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE5C,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;IAExD,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,aAAa,CAAC,WAAW,EAAE,0BAA0B,EAAE,EAAE,MAAM,CAAC,CAAA;QAChE,YAAY,GAAG,IAAI,CAAA;IACrB,CAAC;IAED,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,aAAa,CAAC,YAAY,EAAE,uBAAuB,EAAE,EAAE,MAAM,CAAC,CAAA;QAC9D,aAAa,GAAG,IAAI,CAAA;IACtB,CAAC;IAED,MAAM,WAAW,GAAG,mCAAmC,CAAC,WAAW,CAAC,CAAA;IACpE,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,IAAI,WAAW,CAAA;IAEzE,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CACR,sFAAsF,KAAK,IAAI,CAChG,CAAA;IACH,CAAC;SAAM,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CACR,6CAA6C,KAAK,qDAAqD,CACxG,CAAA;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;AAC5D,CAAC;AAED,SAAS,mCAAmC,CAC1C,WAAmB;IAEnB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAA;IAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAEvC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACtD,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,MAA+B,CAAA;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,IAAI,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC;QAAE,OAAO,SAAS,CAAA;IAE3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAA;QACxD,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAA;QACxF,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACnE,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,6FAA6F;QAC7F,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,CAAA;YACxE,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;gBACjC,OAAO,SAAS,CAAA;YAClB,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACxD,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;AAChF,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AACjC,CAAC"}

package/dist/hook-upload.d.ts

@@ -0,0 +1,30 @@
+import { type ManifestHookEntry } from "./model-hooks.js";
+/** The generated adapter, flattened. `_`-prefixed, so the worker never routes to it. */
+export declare const ADAPTER_KEY = "_supatype-hooks.ts";
+export interface HookUpload {
+    /** Handler name → its source, flattened and import-rewritten. */
+    handlers: Array<{
+        name: string;
+        source: string;
+    }>;
+    /** table → event → config, exactly as the manifest would carry it. */
+    map: Record<string, Record<string, ManifestHookEntry>>;
+}
+/**
+ * Read the hooks a schema actually names, ready to upload.
+ *
+ * **Named-only**, not every directory under `hooks/`: an unnamed handler would sit on the worker
+ * holding the service-role key with nothing able to call it. Uploading it buys nothing and widens what
+ * runs with that credential.
+ *
+ * Throws with a message meant for a terminal when a handler cannot be flattened faithfully — the
+ * alternative is a deploy that succeeds and a hook that fails to import, which reads to the caller as
+ * the table's writes being broken for no visible reason.
+ */
+export declare function readHookUpload(cwd: string, hooksDir: string, ast: unknown): HookUpload | null;
+/** The generated adapter as a handler-shaped entry, so it travels with them. */
+export declare function adapterEntry(module: string): {
+    name: string;
+    source: string;
+};
+//# sourceMappingURL=hook-upload.d.ts.map

package/dist/hook-upload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-upload.d.ts","sourceRoot":"","sources":["../src/hook-upload.ts"],"names":[],"mappings":"AAWA,OAAO,EAAgC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEvF,wFAAwF;AACxF,eAAO,MAAM,WAAW,uBAAuB,CAAA;AAK/C,MAAM,WAAW,UAAU;IACzB,iEAAiE;IACjE,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjD,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAA;CACvD;AA0BD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAwC7F;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAE7E"}

package/dist/hook-upload.js

@@ -0,0 +1,86 @@
+/**
+ * Package a project's hooks for a managed stack.
+ *
+ * Self-hosted stacks need none of this: the worker mounts the project directory, so `hooks/` is already
+ * where it looks. A managed project has no directory — its worker reads a ConfigMap, whose keys may only
+ * contain alphanumerics, `-`, `_` and `.`. So the tree is flattened here, where it can be checked and
+ * explained, rather than in the deploy route where a dropped file would be silent.
+ */
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+import { declaredHooks, manifestHooks } from "./model-hooks.js";
+/** The generated adapter, flattened. `_`-prefixed, so the worker never routes to it. */
+export const ADAPTER_KEY = "_supatype-hooks.ts";
+/** What the handlers import locally, and what has to be rewritten to reach the flattened name. */
+const ADAPTER_IMPORT = "../_supatype/hooks.ts";
+/**
+ * Rewrite the one import a hook handler is generated to make.
+ *
+ * `../_supatype/hooks.ts` is a path that cannot survive flattening, and it is the specifier our own
+ * scaffold writes — so it is rewritten rather than refused. Any *other* relative import is refused
+ * below: it would resolve to nothing on the worker, and a hook that fails to import is a hooked table
+ * whose writes all start failing.
+ */
+function rewriteAdapterImport(source) {
+    return source.split(ADAPTER_IMPORT).join(`./${ADAPTER_KEY}`);
+}
+/** Relative specifiers a flattened layout cannot honour, so the caller can refuse with a real reason. */
+function unsupportedImports(source) {
+    const found = new Set();
+    // Matches `from "…"` and `import("…")`, which is every form that resolves against the file's own path.
+    for (const match of source.matchAll(/(?:from|import)\s*\(?\s*["'](\.[^"']*)["']/g)) {
+        const specifier = match[1];
+        if (specifier === ADAPTER_IMPORT || specifier === `./${ADAPTER_KEY}`)
+            continue;
+        found.add(specifier);
+    }
+    return [...found].sort();
+}
+/**
+ * Read the hooks a schema actually names, ready to upload.
+ *
+ * **Named-only**, not every directory under `hooks/`: an unnamed handler would sit on the worker
+ * holding the service-role key with nothing able to call it. Uploading it buys nothing and widens what
+ * runs with that credential.
+ *
+ * Throws with a message meant for a terminal when a handler cannot be flattened faithfully — the
+ * alternative is a deploy that succeeds and a hook that fails to import, which reads to the caller as
+ * the table's writes being broken for no visible reason.
+ */
+export function readHookUpload(cwd, hooksDir, ast) {
+    const declared = declaredHooks(ast);
+    if (declared.length === 0)
+        return null;
+    const names = [...new Set(declared.map((hook) => hook.function))].sort();
+    const where = relative(cwd, hooksDir) || hooksDir;
+    const handlers = [];
+    for (const name of names) {
+        const dir = join(hooksDir, name);
+        const entry = join(dir, "index.ts");
+        if (!existsSync(entry)) {
+            throw new Error(`Hook "${name}" has no ${where}/${name}/index.ts`);
+        }
+        const extra = readdirSync(dir)
+            .filter((file) => file !== "index.ts")
+            .filter((file) => statSync(join(dir, file)).isFile() || !file.startsWith("."));
+        if (extra.length > 0) {
+            throw new Error(`Hook "${name}" has more than one file (${extra.join(", ")}).\n` +
+                `A managed stack serves each hook as a single module today, so the others would not be ` +
+                `uploaded and the hook would fail to import.\nMove what it needs into index.ts, or run this ` +
+                `hook on a self-hosted stack, which mounts the directory as it is.`);
+        }
+        const source = readFileSync(entry, "utf8");
+        const unsupported = unsupportedImports(source);
+        if (unsupported.length > 0) {
+            throw new Error(`Hook "${name}" imports ${unsupported.join(", ")}, which a managed stack cannot resolve.\n` +
+                `Only the generated ${ADAPTER_IMPORT} survives upload; bare specifiers and URLs are fine.`);
+        }
+        handlers.push({ name, source: rewriteAdapterImport(source) });
+    }
+    return { handlers, map: manifestHooks(ast) };
+}
+/** The generated adapter as a handler-shaped entry, so it travels with them. */
+export function adapterEntry(module) {
+    return { name: ADAPTER_KEY.replace(/\.ts$/, ""), source: module };
+}
+//# sourceMappingURL=hook-upload.js.map