@supatype/cli 0.1.6 → 0.1.7

package/src/commands/cloud.ts

@@ -1,6 +1,7 @@
 import type { Command } from "commander"
 import { readFileSync, writeFileSync, existsSync } from "node:fs"
 import { resolve } from "node:path"
+import { loadCloudCredentials, persistCloudSession } from "../cloud-credentials.js"
 import { loadProjectLink, migrateLegacyLinkFiles } from "../link.js"
 import { targetFetch } from "../target-client.js"
 import { registerEnvs, registerLinkOptions, runLinkAction } from "./link-helpers.js"
@@ -28,7 +29,7 @@ export function loadCloudConfig(cwd: string): CloudConfig | null {
   }
   return {
     apiUrl: link.cloudApiUrl ?? "https://api.supatype.com",
-    token: link.token ?? "",
+    token: link.token ?? loadCloudCredentials()?.accessToken ?? "",
     projectSlug: link.projectRef,
     ...(link.orgId !== undefined ? { orgId: link.orgId } : {}),
   }
@@ -44,19 +45,39 @@ function saveCloudConfig(cwd: string, config: CloudConfig): void {
 }
 
 async function cloudFetch<T>(config: CloudConfig, method: string, path: string, body?: unknown): Promise<T> {
+  const cwd = process.cwd()
+  const creds = loadCloudCredentials()
+  const refreshToken = creds?.refreshToken ?? loadProjectLink(cwd)?.refreshToken
   return targetFetch<T>(config.apiUrl, "/api/v1", {
     method,
     path,
-    body,
+    ...(body !== undefined ? { body } : {}),
     token: config.token,
-    orgId: config.orgId,
+    ...(config.orgId !== undefined ? { orgId: config.orgId } : {}),
+    ...(refreshToken
+      ? {
+          authRefresh: {
+            cloudApiUrl: config.apiUrl,
+            refreshToken,
+            onRefreshed: ({ accessToken, refreshToken: nextRefresh }) => {
+              persistCloudSession(cwd, {
+                apiUrl: config.apiUrl,
+                accessToken,
+                ...(nextRefresh !== undefined ? { refreshToken: nextRefresh } : {}),
+              })
+              config.token = accessToken
+            },
+          },
+        }
+      : {}),
   })
 }
 
 export function isCloudLinked(cwd: string): boolean {
   migrateLegacyLinkFiles(cwd)
   const link = loadProjectLink(cwd)
-  return Boolean(link?.kind === "cloud" && link.projectRef && link.token)
+  if (!(link?.kind === "cloud" && link.projectRef)) return false
+  return Boolean(link.token || loadCloudCredentials()?.accessToken)
 }
 
 export async function pushSchemaToLinkedProject(
@@ -260,15 +281,18 @@ function getCloudConfigOrExit(): CloudConfig {
   const cwd = process.cwd()
   let config = loadCloudConfig(cwd)
   if (!config) {
+    const creds = loadCloudCredentials()
     const token =
       process.env["SUPATYPE_ACCESS_TOKEN"] ??
-      process.env["SUPATYPE_TOKEN"]
-    const apiUrl = process.env["SUPATYPE_API_URL"] ?? "https://api.supatype.com"
+      process.env["SUPATYPE_TOKEN"] ??
+      creds?.accessToken
+    const apiUrl =
+      process.env["SUPATYPE_API_URL"] ?? creds?.apiUrl ?? "https://api.supatype.com"
     if (!token) {
-      error("Not connected to Supatype Cloud. Run: supatype link, or set SUPATYPE_ACCESS_TOKEN.")
+      error("Not connected to Supatype Cloud. Run: supatype login (then supatype link), or set SUPATYPE_ACCESS_TOKEN.")
       process.exit(1)
     }
-    config = { apiUrl, token }
+    config = { apiUrl: apiUrl.replace(/\/$/, ""), token }
   }
   return config
 }

package/src/commands/db.ts

@@ -2,6 +2,7 @@
  * Database connection commands:
  *   supatype db connection-string  — show the connection string for the linked project
  *   supatype db reset-password     — reset the database password
+ *   supatype db check              — does this database meet what Supatype needs of it?
  */
 
 import type { Command } from "commander"
@@ -10,7 +11,16 @@ import { connectionString } from "../project-config.js"
 import { loadProjectLink } from "../link.js"
 import { resolveTarget } from "../resolve-target.js"
 import { targetFetch } from "../target-client.js"
-import { error, info, plain } from "../ui/messages.js"
+import { error, info, plain, warn } from "../ui/messages.js"
+import {
+  applyRemedies,
+  needsOperatorPassword,
+  operatorRemedies,
+  runPreflight,
+  transactionalRemedies,
+  type CheckResult,
+  type Severity,
+} from "../db-preflight.js"
 
 export function registerDb(program: Command): void {
   const db = program
@@ -110,4 +120,155 @@ export function registerDb(program: Command): void {
         process.exitCode = 1
       }
     })
+
+  db
+    .command("check")
+    .description("Check whether a database meets Supatype's requirements (for external Postgres)")
+    .option("--connection <url>", "Postgres URL to check (else config `connection`, else DATABASE_URL)")
+    .option("--schema <name>", "Schema Supatype will manage (else config `schema.pg_schema`)")
+    .option("--emit", "Print the remediation SQL instead of applying it")
+    .option("--fix", "Apply the remediation in a single transaction")
+    .option(
+      "--authenticator-password <password>",
+      "Password for the `authenticator` role when it has to be created",
+    )
+    .action(async (opts: {
+      connection?: string
+      schema?: string
+      emit?: boolean
+      fix?: boolean
+      authenticatorPassword?: string
+    }) => {
+      if (opts.emit && opts.fix) {
+        error("Pass either --emit or --fix, not both: one prints the SQL, the other runs it.")
+        process.exitCode = 1
+        return
+      }
+
+      const cwd = process.cwd()
+      let url = opts.connection?.trim()
+      let schema = opts.schema?.trim()
+      if (!url || !schema) {
+        try {
+          const config = loadConfig(cwd)
+          url = url ?? connectionString(config)
+          schema = schema ?? config.schema?.pg_schema ?? "public"
+        } catch {
+          // Runnable outside a project, which is the point — an operator should be able to check a
+          // database before committing to any config at all.
+          url = url ?? process.env["DATABASE_URL"]
+          schema = schema ?? "public"
+        }
+      }
+      if (!url) {
+        error("No connection. Pass --connection, set DATABASE_URL, or set `connection` in supatype.config.ts.")
+        process.exitCode = 1
+        return
+      }
+
+      const pgMod = await import("pg")
+      const client = new pgMod.default.Client({ connectionString: url })
+      try {
+        await client.connect()
+      } catch (err) {
+        error(`Could not connect: ${(err as Error).message}`)
+        process.exitCode = 1
+        return
+      }
+
+      try {
+        const report = await runPreflight(client, {
+          schema: schema!,
+          ...(opts.authenticatorPassword !== undefined && {
+            authenticatorPassword: opts.authenticatorPassword,
+          }),
+        })
+
+        const fixable = transactionalRemedies(report)
+        const manual = operatorRemedies(report)
+
+        if (opts.emit) {
+          // Machine-consumable: SQL on stdout, commentary on stderr, so it can be piped to psql.
+          if (fixable.length === 0) {
+            warn("Nothing to emit — no SQL-fixable findings.")
+          } else {
+            plain("BEGIN;")
+            for (const r of fixable) plain(`\n-- ${r.title}\n${r.remedy}`)
+            plain("\nCOMMIT;")
+          }
+          if (manual.length > 0) {
+            warn(`\n${manual.length} finding(s) need operator action and are not included above:`)
+            for (const r of manual) warn(`  ${r.title} — ${r.detail}`)
+          }
+          return
+        }
+
+        printReport(report.results)
+
+        if (opts.fix) {
+          if (fixable.length === 0) {
+            info("Nothing to fix.")
+          } else if (needsOperatorPassword(fixable)) {
+            // The credential is the operator's by decision. Creating the role with a placeholder
+            // password would be worse than refusing, and harder to notice.
+            error(
+              "`authenticator` has to be created and no password was given. Nothing was changed.\n" +
+                "  Re-run with --authenticator-password <password>, or use --emit and apply the SQL yourself.\n" +
+                "  Use the same value for AUTHENTICATOR_PASSWORD in your .env.",
+            )
+            process.exitCode = 1
+            return
+          } else {
+            info(`\nApplying ${fixable.length} remediation(s) in one transaction...`)
+            try {
+              await applyRemedies(client, fixable)
+              info("Applied. Re-run `supatype db check` to confirm.")
+            } catch (err) {
+              error(`Rolled back — the database is unchanged: ${(err as Error).message}`)
+              process.exitCode = 1
+              return
+            }
+          }
+          if (manual.length > 0) {
+            warn(`\n${manual.length} finding(s) cannot be fixed in a transaction:`)
+            for (const r of manual) {
+              warn(`  ${r.title} — needs a server setting change and likely a restart`)
+            }
+          }
+          return
+        }
+
+        if (report.worst === "fail") {
+          plain("")
+          error("This database is not ready. Re-run with --emit to see the SQL, or --fix to apply it.")
+          process.exitCode = 1
+        } else if (fixable.length > 0) {
+          plain("")
+          info("Re-run with --emit to see suggested SQL, or --fix to apply it.")
+        }
+      } catch (err) {
+        // An unexpected failure must not read as a clean bill of health.
+        error(`Preflight could not complete: ${(err as Error).message}`)
+        process.exitCode = 1
+      } finally {
+        await client.end().catch(() => undefined)
+      }
+    })
+}
+
+const SEVERITY_LABEL: Record<Severity, string> = {
+  pass: "ok  ",
+  warn: "note",
+  degrade: "off ",
+  fail: "FAIL",
+}
+
+function printReport(results: readonly CheckResult[]): void {
+  for (const r of results) {
+    const line = `[${SEVERITY_LABEL[r.severity]}] ${r.title} — ${r.detail}`
+    if (r.severity === "fail") error(line)
+    else if (r.severity === "degrade" || r.severity === "warn") warn(line)
+    else plain(line)
+    if (r.impact) plain(`         ${r.impact}`)
+  }
 }

package/src/commands/dev.ts

@@ -18,13 +18,21 @@ import { isAbsolute, join, relative, resolve } from "node:path"
 import { loadConfig } from "../config.js"
 import type { ExtractedSchemaAstV2 } from "../schema-ast-v2.js"
 import {
+  apiSchemaList,
   functionsPathCandidatesFromProject,
   resolveRuntimeProvider,
   schemaPathFromProject,
   type SupatypeProjectConfig,
 } from "../project-config.js"
 import { discoverTsFunctionsInDir, writeDevFunctionsRouter } from "../functions-router-gen.js"
+import { fieldMaskingTierFromProject } from "../field-masking-tier.js"
 import { signJwt } from "../jwt.js"
+import {
+  devAuthenticatorPassword,
+  devJwtSecret,
+  devPostgresPassword,
+  secretFingerprint,
+} from "../local-secrets.js"
 import {
   normalisePlatformPath,
   cachePath,
@@ -50,6 +58,7 @@ import { writeAppViteEnv } from "../app-vite-env.js"
 import { ensureValkeySidecar, stopValkeySidecar } from "../valkey-sidecar.js"
 import {
   initdb,
+  nativeMaskLibraryPresent,
   start as pgStart,
   stop as pgStop,
   waitReady as pgWaitReady,
@@ -172,9 +181,15 @@ export function registerDev(program: Command): void {
 
       // ── 5–7. Start Postgres ───────────────────────────────────────────────
       let dbURL: string
+      /** What PostgREST connects as — deliberately not `dbURL`, which is a superuser. */
+      let postgrestDbURL: string
       let stopPostgres: () => void | Promise<void>
       const pgPort = NATIVE_PG_PORT
-      const pgPassword = "postgres"
+      const pgPassword = devPostgresPassword(cwd)
+      // Distinct from pgPassword even locally, so the split the other paths enforce is the
+      // one developers see. Read from .env when present so it matches a stack the user has
+      // already provisioned.
+      const authenticatorPassword = devAuthenticatorPassword(cwd)
       // pgBinDir is set on the native path and used to add DLL search path for
       // PostgREST on Windows (PostgREST links against libpq + SSL from MinGW).
       let pgBinDir: string | null = null
@@ -192,7 +207,8 @@ export function registerDev(program: Command): void {
         pgStart(pgOpts)
         await pgWaitReady(pgOpts, 15_000)
         console.log("[supatype] Postgres is ready.")
-        dbURL = `postgres://postgres:postgres@127.0.0.1:${pgPort}/${projectName}?sslmode=disable`
+        dbURL = `postgres://postgres:${pgPassword}@127.0.0.1:${pgPort}/${projectName}?sslmode=disable`
+        postgrestDbURL = `postgres://authenticator:${authenticatorPassword}@127.0.0.1:${pgPort}/${projectName}?sslmode=disable`
         stopPostgres = () => pgStop(pgOpts)
 
         // Create project database if it doesn't exist (native only).
@@ -219,8 +235,25 @@ export function registerDev(program: Command): void {
         //   anon          – unauthenticated requests (RLS enforced)
         //   authenticated – signed-in user requests  (RLS enforced)
         //   service_role  – developer/admin bypass   (BYPASSRLS)
+        //   authenticator – the role PostgREST *connects* as, and nothing else
+        //
+        // `authenticator` is NOINHERIT and holds no privileges of its own: it can only
+        // SET ROLE to the three above. That containment is the point. Connecting as
+        // `postgres` — a superuser — meant a request whose JWT named *any* role in the
+        // cluster got it, because a superuser may SET ROLE to anything. Verified: as
+        // postgres, `SET ROLE supatype_replication_admin` succeeds; as authenticator the
+        // same statement is refused. Mirrors the image, which has had this role all along.
+        // Created here rather than during the push, because the engine chooses how to enforce field
+        // rules from the extensions present *when it diffs*. Creating it later would leave the tier
+        // decided against a database that no longer looks like that.
+        //
+        // Conditional on the library being bundled: an archive downloaded before it was would fail
+        // the CREATE, and there is nothing the developer could do about it from here.
+        const maskSql = nativeMaskLibraryPresent(pgBinDir)
+          ? "CREATE EXTENSION IF NOT EXISTS supatype_mask;\n"
+          : ""
         const rolesSql = `
-CREATE SCHEMA IF NOT EXISTS auth;
+${maskSql}CREATE SCHEMA IF NOT EXISTS auth;
 DO $$ BEGIN
   IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'anon')
     THEN CREATE ROLE anon NOLOGIN; END IF;
@@ -228,8 +261,11 @@ DO $$ BEGIN
     THEN CREATE ROLE authenticated NOLOGIN; END IF;
   IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'service_role')
     THEN CREATE ROLE service_role NOLOGIN BYPASSRLS; END IF;
+  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'authenticator')
+    THEN CREATE ROLE authenticator LOGIN NOINHERIT PASSWORD '${authenticatorPassword}'; END IF;
 END $$;
 GRANT anon, authenticated, service_role TO postgres;
+GRANT anon, authenticated, service_role TO authenticator;
 GRANT USAGE ON SCHEMA public TO anon, authenticated, service_role;
 -- Table-level privileges (RLS restricts rows; roles still need table access)
 GRANT SELECT ON ALL TABLES IN SCHEMA public TO anon;
@@ -246,7 +282,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
           { stdio: "pipe", encoding: "utf8", env: pgEnv })
       }
 
-      const LOCAL_JWT_SECRET = "super-secret-jwt-token-with-at-least-32-characters-long"
+      const LOCAL_JWT_SECRET = devJwtSecret(cwd)
       const authDbURL = dbURL.includes("?")
         ? `${dbURL}&search_path=auth`
         : `${dbURL}?search_path=auth`
@@ -340,7 +376,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
             JWT_SECRET: LOCAL_JWT_SECRET,
             PORT: REALTIME_PORT,
             SLOT_NAME: "supatype_realtime",
-            PUBLICATION_NAME: "supatype_realtime_pub",
+            PUBLICATION_NAME: "supatype_realtime",
           },
         })
         realtimeProc.start()
@@ -472,8 +508,21 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
         }
 
         const postgrestEnv: Record<string, string> = {
-          PGRST_DB_URI: dbURL,
-          PGRST_DB_SCHEMA: "public, supatype, graphql_public",
+          PGRST_DB_URI: postgrestDbURL,
+          // Derived from schema.pg_schema (or schema.api_schemas) — a hardcoded "public" here meant
+          // a non-default pg_schema pushed correctly and then answered PGRST106 on every request.
+          // Native dev has no masking extension either, so a schema with field rules is served from
+          // `api` here too — the case an "is the database external" rule would have got wrong.
+          PGRST_DB_SCHEMA: apiSchemaList(
+            config,
+            // The installed archive decides: one downloaded before the masking library was bundled
+            // has no extension, so its field rules are enforced by views instead.
+            fieldMaskingTierFromProject(cwd, config, nativeMaskLibraryPresent(pgBinDir)),
+          ),
+          // Parity with self-host, which has always set this. Unqualified names in column defaults
+          // (`uuid_generate_v4()`) resolve here, and with a non-public pg_schema the request schema
+          // alone does not reach them.
+          PGRST_DB_EXTRA_SEARCH_PATH: "public,extensions",
           PGRST_DB_ANON_ROLE: "anon",
           PGRST_SERVER_PORT: postgrestPort,
           PGRST_SERVER_HOST: "127.0.0.1",
@@ -547,7 +596,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
         links,
         anonKey,
         serviceRoleKey,
-        hints: [`Postgres ${dbURL}`, `JWT secret: ${LOCAL_JWT_SECRET}`],
+        hints: [`Postgres ${dbURL}`, `JWT secret: #${secretFingerprint(LOCAL_JWT_SECRET)} (in .env)`],
       })
 
       // ── Shutdown handler ──────────────────────────────────────────────────

package/src/commands/doctor.ts

@@ -1,10 +1,12 @@
 import type { Command } from "commander"
 import { loadConfig, loadSchemaAst } from "../config.js"
 import { info, plain } from "../ui/messages.js"
-import { schemaPathFromProject } from "../project-config.js"
+import { hooksPathFromProject, schemaPathFromProject, serviceRoleRoutes } from "../project-config.js"
 import { resolveTarget, targetSchemaDoctor, schemaPgSchema } from "../resolve-target.js"
 import { loadProjectLink } from "../link.js"
 import { resolveHostEngineDatabaseUrl } from "../dev-compose.js"
+import { hooksReport, type HooksReport } from "../model-hooks.js"
+import { checkServiceRoleRoutes, type ServiceRoleProblems } from "../service-role-check.js"
 
 interface DoctorItem {
   kind: string
@@ -20,12 +22,15 @@ interface DoctorReport {
   unmanagedDrift: DoctorItem[]
 }
 
-function printSection(title: string, items: DoctorItem[]): void {
+/** Exported for tests: the label form is easy to get subtly wrong per item kind. */
+export function printSection(title: string, items: DoctorItem[]): void {
   if (items.length === 0) return
   plain(`\n${title} (${items.length}):\n`)
   for (const item of items) {
     const fields = item.fields.length > 0 ? ` (${item.fields.join(", ")})` : ""
-    plain(`  • ${item.table}.${item.name}${fields}`)
+    // A table's `name` *is* its table, so the usual `table.name` form renders "widget.widget".
+    const label = item.table === item.name ? item.name : `${item.table}.${item.name}`
+    plain(`  • ${label}${fields}`)
     plain(`    ${item.message}`)
   }
 }
@@ -82,6 +87,9 @@ export function registerDoctor(program: Command): void {
         })) as DoctorReport
       }
 
+      printHooks(hooksReport(cwd, hooksPathFromProject(config, cwd), ast))
+      printServiceRoleGrants(checkServiceRoleRoutes(config, cwd), serviceRoleRoutes(config))
+
       printSection("Missing (in AST, not in DB)", report.missing ?? [])
       printSection("Stale managed (stamped, not in AST)", report.staleManaged ?? [])
       printSection("Unmanaged drift (manual decision)", report.unmanagedDrift ?? [])
@@ -101,3 +109,61 @@ export function registerDoctor(program: Command): void {
       }
     })
 }
+
+/**
+ * Whether declared hooks can actually run.
+ *
+ * Worth its own section because every failure here is silent: a hook whose function is missing, or a
+ * stack with functions switched off, produces no error anywhere — the write just succeeds
+ * unvalidated. Drift you cannot see is the thing doctor exists for.
+ */
+export function printHooks(report: HooksReport): void {
+  if (report.declared.length === 0) return
+
+  plain(`\nHooks (${report.declared.length}):\n`)
+  for (const hook of report.declared) {
+    const broken = report.missing.some(
+      (m) => m.model === hook.model && m.event === hook.event,
+    )
+    plain(`  ${broken ? "✗" : "•"} ${hook.model}.${hook.event} → ${hook.function}`)
+  }
+
+  if (report.missing.length > 0) {
+    plain("\n  Those marked ✗ name a function that does not exist, so they never fire.")
+    plain("  Create it with: supatype hooks new <name>")
+  }
+  if (report.functionsDisabled) {
+    plain("\n  functions_enabled is false in .supatype/manifest.json — every hook is inert.")
+    plain("  Regenerate the stack config with: supatype self-host compose")
+  }
+  if (report.mapMissing) {
+    plain("\n  .supatype/manifest.json carries no hook map, so the server has nothing to call.")
+    plain("  Run: supatype push")
+  }
+}
+
+/**
+ * Report which functions may see the service-role key, and which grants do nothing.
+ *
+ * Worth printing even when everything resolves: this is the list of functions that can read and write
+ * past every access rule in the schema, and "which ones are those again?" should be answerable without
+ * opening the config.
+ */
+export function printServiceRoleGrants(
+  problems: ServiceRoleProblems,
+  declared: readonly string[],
+): void {
+  if (declared.length === 0) return
+
+  plain(`\nService-role grants (${declared.length}):\n`)
+  const broken = new Set(problems.missing)
+  for (const name of declared) {
+    plain(`  ${broken.has(name) ? "✗" : "•"} ${name}`)
+  }
+
+  if (broken.size > 0) {
+    plain("\n  Those marked ✗ match no function, so they grant nothing — the function reads no key.")
+  }
+  for (const warning of problems.warnings) plain(warning)
+  plain("\n  These functions bypass every access rule in the schema. Anything not listed cannot.")
+}

package/src/commands/functions.ts

@@ -16,6 +16,7 @@ import { ensureBinary } from "../ensure-binary.js"
 import {
   functionsPathCandidatesFromProject,
   preferredFunctionsPathFromProject,
+  serviceRoleRoutes,
 } from "../project-config.js"
 import {
   discoverTsFunctionsInDir,
@@ -24,6 +25,7 @@ import {
 import { loadProjectLink } from "../link.js"
 import { resolveTarget } from "../resolve-target.js"
 import { targetFetch } from "../target-client.js"
+import { ensureFunctionsDenoTypes } from "../functions-deno-types.js"
 import { error, info, plain } from "../ui/messages.js"
 import { nextSteps } from "../ui/next-steps.js"
 
@@ -140,18 +142,19 @@ function scaffoldFunction(cwd: string, name: string): void {
 // Docs: https://supatype.com/docs/edge-functions
 
 export default async function handler(req: Request): Promise<Response> {
-  const { method, url } = req
+  const { method } = req
+  const url = Deno.env.get("SUPATYPE_URL")
 
   // Example: read request body for POST requests
   if (method === "POST") {
     const body = await req.json()
-    return new Response(JSON.stringify({ message: "Hello from ${name}!", received: body }), {
+    return new Response(JSON.stringify({ message: "Hello from ${name}!", received: body, url }), {
       status: 200,
       headers: { "Content-Type": "application/json" },
     })
   }
 
-  return new Response(JSON.stringify({ message: "Hello from ${name}!" }), {
+  return new Response(JSON.stringify({ message: "Hello from ${name}!", url }), {
     status: 200,
     headers: { "Content-Type": "application/json" },
   })
@@ -181,13 +184,27 @@ export default async function handler(req: Request): Promise<Response> {
     )
   }
 
+  const denoTypes = ensureFunctionsDenoTypes(cwd, functionsDir)
+
   const functionsDirLabel = relativeFunctionsDir(cwd, functionsDir)
   info(`Created function: ${functionsDirLabel}/${name}/index.ts`)
-  nextSteps("Next steps:", [
+  if (denoTypes.wroteDenoDts) {
+    info(`Added Deno IDE types: ${functionsDirLabel}/deno.d.ts`)
+  }
+  if (denoTypes.wroteTsconfig) {
+    info(`Added functions tsconfig: ${functionsDirLabel}/tsconfig.json`)
+  }
+  if (denoTypes.rootExclude === "updated") {
+    info('Updated root tsconfig.json to exclude "functions"')
+  }
+
+  const steps = [
     "Local dev:    npx supatype functions serve",
     `Invoke:       npx supatype functions invoke ${name}`,
     "Deploy:       npx supatype functions deploy",
-  ])
+    ...denoTypes.hints,
+  ]
+  nextSteps("Next steps:", steps)
 }
 
 // ─── Discover functions ──────────────────────────────────────────────────────
@@ -422,6 +439,9 @@ async function deployViaTarget(
               source,
               entrypoint: `${fn.name}/index.ts`,
             }],
+            // Sent every deploy, and replaced wholesale by the platform: the config file is the whole
+            // truth, so a name removed from it must stop being entitled to the service-role key.
+            serviceRole: serviceRoleRoutesFor(cwd),
           },
           token: target.token!,
           orgId: target.orgId,
@@ -479,6 +499,9 @@ async function deployCloud(cwd: string, fns: DiscoveredFunction[], env?: string)
             source,
             entrypoint: `${fn.name}/index.ts`,
           }],
+          // Same grants as the target path: both reach the same endpoint, and a project deployed one
+          // way must not end up with a different credential surface than the other.
+          serviceRole: serviceRoleRoutesFor(cwd),
         }),
         signal: AbortSignal.timeout(60_000),
       })
@@ -500,6 +523,20 @@ async function deployCloud(cwd: string, fns: DiscoveredFunction[], env?: string)
   info(`Invoke: https://${linked.ref}.supatype.dev/functions/v1/<name>`)
 }
 
+/**
+ * The project's `functions.serviceRole` list, or undefined when the config cannot be read.
+ *
+ * Undefined rather than `[]`: the platform replaces the stored list wholesale when the field is present,
+ * so sending an empty array because a config failed to load would revoke every grant the project has.
+ */
+export function serviceRoleRoutesFor(cwd: string): string[] | undefined {
+  try {
+    return serviceRoleRoutes(loadConfig(cwd))
+  } catch {
+    return undefined
+  }
+}
+
 function readFunctionSource(fn: DiscoveredFunction): string {
   const stat = statSync(fn.absPath)
   if (stat.isFile()) {

package/src/commands/generate.ts

@@ -2,9 +2,10 @@ import type { Command } from "commander"
 import { mkdirSync, writeFileSync } from "node:fs"
 import { resolve, dirname } from "node:path"
 import { loadConfig, loadSchemaAst } from "../config.js"
-import { schemaPathFromProject } from "../project-config.js"
+import { hooksPathFromProject, schemaPathFromProject } from "../project-config.js"
 import { ensureEngine, engineRequest } from "../engine-client.js"
 import { generateClientAugmentation } from "../augmentation-generator.js"
+import { writeHooksModule } from "../model-hooks.js"
 import { error, info } from "../ui/messages.js"
 
 export function registerGenerate(program: Command): void {
@@ -41,5 +42,8 @@ export function registerGenerate(program: Command): void {
       mkdirSync(dirname(augmentationOutPath), { recursive: true })
       writeFileSync(augmentationOutPath, augmentationCode, "utf8")
       info(`Client augmentation written to ${outputClientPath}`)
+
+      const hooksPath = writeHooksModule(cwd, hooksPathFromProject(config, cwd), ast)
+      if (hooksPath !== null) info(`Hook handler types written to ${hooksPath}`)
     })
 }