@supatype/cli 0.1.6 → 0.1.9

package/src/augmentation-generator.ts

@@ -1,4 +1,4 @@
-interface AstModel {
+export interface AstModel {
   name?: string
   tableName?: string
   fields: Record<string, Record<string, unknown>>
@@ -11,7 +11,14 @@ interface AstShape {
   models?: AstModel[]
 }
 
-function resolveTableName(model: AstModel): string {
+/**
+ * Shared with the hooks generator on purpose.
+ *
+ * A hook's `row` must be the same shape the client sees for that table, and two copies of this logic
+ * would drift: the client would gain a column type the hook handler did not, which is the failure
+ * mode this codebase has already paid for once.
+ */
+export function resolveTableName(model: AstModel): string {
   const fromAnnotations = model.annotations?.db?.tableName
   if (typeof fromAnnotations === "string" && fromAnnotations.length > 0) return fromAnnotations
   if (typeof model.tableName === "string" && model.tableName.length > 0) return model.tableName
@@ -36,7 +43,7 @@ export function generateClientAugmentation(ast: unknown): string {
     .sort((a, b) => a.tableName.localeCompare(b.tableName))
 
   const lines: string[] = []
-  lines.push("// Generated by supatype CLI — do not edit manually.")
+  lines.push("// Generated by supatype CLI, do not edit manually.")
   lines.push("")
   lines.push("declare module \"@supatype/client\" {")
   lines.push("  interface SupatypeModels {")
@@ -58,7 +65,7 @@ export function generateClientAugmentation(ast: unknown): string {
   return lines.join("\n")
 }
 
-function generateRowType(fields: Record<string, Record<string, unknown>>): string {
+export function generateRowType(fields: Record<string, Record<string, unknown>>): string {
   const entries = Object.entries(fields).sort(([a], [b]) => a.localeCompare(b))
   if (entries.length === 0) return "Record<string, unknown>"
   const body = entries
@@ -71,7 +78,7 @@ function insertColumnOptionalOnInsert(meta: Record<string, unknown>): boolean {
   return meta["default"] !== undefined || fieldServerGenerated(meta)
 }
 
-function generateInsertType(fields: Record<string, Record<string, unknown>>): string {
+export function generateInsertType(fields: Record<string, Record<string, unknown>>): string {
   const entries = Object.entries(fields).sort(([a], [b]) => a.localeCompare(b))
   if (entries.length === 0) return "Record<string, unknown>"
   const body = entries
@@ -83,7 +90,7 @@ function generateInsertType(fields: Record<string, Record<string, unknown>>): st
   return `{\n${body}\n}`
 }
 
-function generateUpdateType(fields: Record<string, Record<string, unknown>>): string {
+export function generateUpdateType(fields: Record<string, Record<string, unknown>>): string {
   const entries = Object.entries(fields).sort(([a], [b]) => a.localeCompare(b))
   if (entries.length === 0) return "Record<string, unknown>"
   const body = entries
@@ -96,6 +103,12 @@ function toTsType(meta: Record<string, unknown>): string {
   const kind = typeof meta["kind"] === "string" ? meta["kind"] : "json"
   const required = meta["required"] === true
   const base = (() => {
+    // A field that knows its own shape says so. Without this, everything stored as JSONB collapses
+    // to `Record<string, unknown>` in the generated row, so `Currency` would arrive as an opaque
+    // object rather than `{ amount: string; code: "USD" }`, and the schema's precision would be
+    // lost exactly where a caller reads it.
+    const declared = meta["tsType"]
+    if (typeof declared === "string" && declared.length > 0) return declared
     switch (kind) {
       case "uuid":
       case "slug":

package/src/binary-cache.ts

@@ -1,5 +1,5 @@
 /**
- * Binary cache — manages supatype component binaries.
+ * Binary cache: manages supatype component binaries.
  *
  * Components: engine, server, postgres, deno, realtime.
  * Cache root: ~/.supatype/cache/{component}/{version}/
@@ -71,7 +71,7 @@ export function hasMeaningfulOverrides(config: SupatypeProjectConfig): boolean {
   return false
 }
 
-/** Lines for a startup banner — non-empty override paths only. */
+/** Lines for a startup banner, non-empty override paths only. */
 export function describeActiveOverrides(config: SupatypeProjectConfig): string[] {
   const o = config.overrides
   if (!o) return []
@@ -196,6 +196,26 @@ function binaryName(component: Component, version: string, platform: PlatformId)
   }
 }
 
+/**
+ * Names a published archive may carry, most-canonical first.
+ *
+ * `supatype-postgres` published the Intel macOS archive as `darwin-x86_64` while every other platform
+ * used `amd64`, the spelling the CLI derives from `process.arch === "x64"`. Releases already on the CDN
+ * carry the old name, so both are accepted and the *signed* checksums manifest decides which exists.
+ * Nothing is guessed: the URL and the hash always come from the same manifest entry.
+ */
+export function archiveNameCandidates(
+  component: Component,
+  version: string,
+  platform: PlatformId,
+): string[] {
+  const canonical = binaryName(component, version, platform)
+  if (component === "postgres" && platform.os === "darwin" && platform.arch === "amd64") {
+    return [canonical, canonical.replace("darwin-amd64", "darwin-x86_64")]
+  }
+  return [canonical]
+}
+
 // ---------------------------------------------------------------------------
 // Platform detection
 // ---------------------------------------------------------------------------
@@ -222,9 +242,9 @@ export function currentPlatform(): PlatformId {
  * Resolve the binary path for a component.
  *
  * Resolution order:
- * 1. config.overrides?.[component] — local build path (must exist)
+ * 1. config.overrides?.[component]: local build path (must exist)
  * 2. Cached binary at ~/.supatype/cache/{component}/{version}/
- * 3. Throws — caller should call download() first.
+ * 3. Throws, so the caller should call download() first.
  *
  * Hard error if any meaningful `overrides` entry is set while the project is linked to cloud
  * (`project.ref`, `.supatype/cloud.json`, or `.supatype/linked.json`).
@@ -332,7 +352,7 @@ async function acquireDownloadSlot(
 
     if (isDownloadInProgress(component, version)) {
       console.log(
-        `[supatype] ${component} v${version} is downloading in another process — waiting...`,
+        `[supatype] ${component} v${version} is downloading in another process, waiting...`,
       )
       const outcome = await waitForComponentDownload(component, version, isReady, (c) => {
         console.log(`[supatype] Still waiting for ${c} download...`)
@@ -344,7 +364,7 @@ async function acquireDownloadSlot(
         )
       }
       console.warn(
-        `[supatype] ${component} v${version} download did not finish in the other process — retrying.`,
+        `[supatype] ${component} v${version} download did not finish in the other process, retrying.`,
       )
       continue
     }
@@ -364,7 +384,7 @@ export async function download(
 ): Promise<string> {
   if (version === VERSION_PIN_LOCAL) {
     throw new Error(
-      `cannot download CDN binary when version is "${VERSION_PIN_LOCAL}" — set overrides.${component === "postgres" ? "postgres_dir" : component} or pin a semver`,
+      `cannot download CDN binary when version is "${VERSION_PIN_LOCAL}": set overrides.${component === "postgres" ? "postgres_dir" : component} or pin a semver`,
     )
   }
 
@@ -380,7 +400,7 @@ export async function download(
       return destPath
     }
     console.warn(
-      `[supatype] ${component} v${version} cache invalid — re-downloading (${destPath}).`,
+      `[supatype] ${component} v${version} cache invalid, re-downloading (${destPath}).`,
     )
     unlinkSync(destPath)
   }
@@ -390,7 +410,6 @@ export async function download(
     return destPath
   }
 
-  const binaryUrl = `${CDN_BASE}${CDN_PATHS[component](version, platform)}`
   const checksumsUrl = `${CDN_BASE}${checksumsDirPath(component, version)}`
   const minisigUrl = `${checksumsUrl}.minisig`
 
@@ -399,15 +418,20 @@ export async function download(
   const tmpPath = destPath + ".tmp"
   try {
     // ── Fetch checksums + optional minisig (retried on transient failures) ───
-    const expectedChecksum = await withRetry(() =>
-      fetchChecksums(checksumsUrl, minisigUrl, name),
+    const match = await withRetry(() =>
+      fetchChecksums(checksumsUrl, minisigUrl, archiveNameCandidates(component, version, platform)),
     )
 
+    // The directory from the path template, the filename from the manifest: a release published under
+    // a legacy name is fetched under that name rather than one the CLI assumed.
+    const cdnDir = CDN_PATHS[component](version, platform).replace(/\/[^/]+$/, "")
+    const binaryUrl = `${CDN_BASE}${cdnDir}/${match.filename}`
+
     // ── Stream-download binary with progress (retried on transient failures) ─
     await withRetry(() => streamToFileWithProgress(binaryUrl, tmpPath))
 
     // ── Verify SHA256 ────────────────────────────────────────────────────────
-    await verifyChecksum(tmpPath, expectedChecksum, component)
+    await verifyChecksum(tmpPath, match.checksum, component)
 
     writeFileSync(destPath, readFileSync(tmpPath))
 
@@ -437,11 +461,19 @@ export async function download(
  * Fetch checksums.sha256, optionally verify its minisign signature, and
  * return the expected SHA256 for `binaryFilename`.
  */
-async function fetchChecksums(
+/**
+ * Fetch a checksums manifest and verify its minisign signature, returning the entry for one of
+ * `binaryFilenames`.
+ *
+ * Exported so the standalone CLI download path enforces the same rule as component downloads.
+ * It previously verified nothing at all, which made the CLI stricter about a postgres archive
+ * than about overwriting its own executable.
+ */
+export async function fetchChecksums(
   checksumsUrl: string,
   minisigUrl: string,
-  binaryFilename: string,
-): Promise<string> {
+  binaryFilenames: string | string[],
+): Promise<ChecksumMatch> {
   const csResp = await fetch(checksumsUrl)
   if (!csResp.ok) {
     throw new Error(`Failed to fetch checksums from ${checksumsUrl}: HTTP ${csResp.status}`)
@@ -452,16 +484,16 @@ async function fetchChecksums(
   if (!pubKey) {
     // Fail closed: a missing public key means we cannot verify authenticity, only
     // integrity (SHA256). Published builds always embed the key, so this only
-    // happens in source/contributor builds — never silently downgrade.
+    // happens in source/contributor builds. Never silently downgrade.
     if (process.env["SUPATYPE_ALLOW_UNVERIFIED_DOWNLOADS"] === "1") {
       console.warn(
-        "[supatype] \u26a0  SUPATYPE_ALLOW_UNVERIFIED_DOWNLOADS=1 — no minisign public " +
+        "[supatype] \u26a0  SUPATYPE_ALLOW_UNVERIFIED_DOWNLOADS=1: no minisign public " +
           "key configured; verifying SHA256 only (authenticity NOT checked).",
       )
-      return extractChecksum(checksumsText, binaryFilename)
+      return extractChecksum(checksumsText, binaryFilenames)
     }
     throw new Error(
-      "No minisign public key configured — cannot verify release authenticity.\n" +
+      "No minisign public key configured, so cannot verify release authenticity.\n" +
         "Published @supatype/cli builds embed the key automatically; if you are building " +
         "from source, set SUPATYPE_RELEASE_PUBLIC_KEY to the release public key, or set " +
         "SUPATYPE_ALLOW_UNVERIFIED_DOWNLOADS=1 to download with SHA256-only verification (unsafe).",
@@ -479,7 +511,7 @@ async function fetchChecksums(
   const sigText = await sigResp.text()
   verifyMinisign(Buffer.from(checksumsText, "utf8"), sigText, pubKey)
 
-  return extractChecksum(checksumsText, binaryFilename)
+  return extractChecksum(checksumsText, binaryFilenames)
 }
 
 // ---------------------------------------------------------------------------
@@ -487,7 +519,7 @@ async function fetchChecksums(
 // ---------------------------------------------------------------------------
 
 /**
- * Ed25519 SPKI DER prefix — wraps a raw 32-byte public key into the
+ * Ed25519 SPKI DER prefix, wraps a raw 32-byte public key into the
  * SubjectPublicKeyInfo structure that Node.js crypto.createPublicKey expects.
  *
  * Breakdown:
@@ -515,7 +547,7 @@ export function verifyMinisign(fileBytes: Buffer, sigFileContent: string, pubKey
 
   // Parse signature file:
   //   line 0: untrusted comment
-  //   line 1: base64 sig bytes — [2 algo][8 keyId][64 Ed25519 sig]
+  //   line 1: base64 sig bytes: [2 algo][8 keyId][64 Ed25519 sig]
   //   line 2: trusted comment
   //   line 3: base64 global sig (over sig bytes + trusted comment)
   const sigLines = sigFileContent.trim().split("\n")
@@ -528,12 +560,12 @@ export function verifyMinisign(fileBytes: Buffer, sigFileContent: string, pubKey
   const signature = sigBytes.subarray(10, 74)
 
   // Both Ed25519 modes are supported:
-  //   "Ed" (0x45, 0x64) — legacy: signature is over the raw file bytes.
-  //   "ED" (0x45, 0x44) — prehashed: signature is over BLAKE2b-512(file).
+  //   "Ed" (0x45, 0x64) legacy: signature is over the raw file bytes.
+  //   "ED" (0x45, 0x44) prehashed: signature is over BLAKE2b-512(file).
   // Modern minisign (and our release pipeline) default to prehashed mode.
   if (algo[0] !== 0x45 || (algo[1] !== 0x64 && algo[1] !== 0x44)) {
     throw new Error(
-      "Unsupported minisign algorithm — expected Ed25519 ('Ed' legacy or 'ED' prehashed).\n" +
+      "Unsupported minisign algorithm, expected Ed25519 ('Ed' legacy or 'ED' prehashed).\n" +
         `Got: 0x${algo[0]?.toString(16)}${algo[1]?.toString(16)}`,
     )
   }
@@ -541,7 +573,7 @@ export function verifyMinisign(fileBytes: Buffer, sigFileContent: string, pubKey
 
   if (!sigKeyId.equals(pkKeyId)) {
     throw new Error(
-      "Minisign key ID mismatch — signature was produced with a different key.\n" +
+      "Minisign key ID mismatch: the signature was produced with a different key.\n" +
         "This could indicate a compromised release. Do not proceed.",
     )
   }
@@ -558,7 +590,7 @@ export function verifyMinisign(fileBytes: Buffer, sigFileContent: string, pubKey
   const valid = cryptoVerify(null, signedData, keyObject, signature)
   if (!valid) {
     throw new Error(
-      "Minisign signature verification FAILED — the checksum file may have been tampered with.\n" +
+      "Minisign signature verification FAILED: the checksum file may have been tampered with.\n" +
         "This could indicate a supply chain attack. Aborting download.",
     )
   }
@@ -566,22 +598,37 @@ export function verifyMinisign(fileBytes: Buffer, sigFileContent: string, pubKey
 
 /**
  * Extract the SHA256 hash for `filename` from a checksums.sha256 file.
- * Format: `<hash>  <filename>` (sha256sum output, two spaces).
+ * Format: `<hash>  <filename>` (sha256sum output, two spaces), or `<hash> *<filename>` when
+ * the publisher used binary mode.
+ *
+ * Exported so the standalone CLI download path parses the manifest the same way rather than
+ * carrying a second implementation.
  */
-function extractChecksum(checksumsText: string, filename: string): string {
-  const target = basename(filename)
-  for (const line of checksumsText.split("\n")) {
-    const parts = line.trim().split(/\s+/)
-    if (parts.length >= 2 && parts[1] === target) {
-      return parts[0]!
+export function extractChecksum(
+  checksumsText: string,
+  filenames: string | string[],
+): ChecksumMatch {
+  const targets = (Array.isArray(filenames) ? filenames : [filenames]).map((f) => basename(f))
+  for (const target of targets) {
+    for (const line of checksumsText.split("\n")) {
+      const parts = line.trim().split(/\s+/)
+      if (parts.length >= 2 && parts[1]?.replace(/^\*/, "") === target) {
+        return { filename: target, checksum: parts[0]! }
+      }
     }
   }
   throw new Error(
-    `Checksum not found for "${target}" in checksums.sha256.\n` +
+    `Checksum not found for ${targets.map((t) => `"${t}"`).join(" or ")} in checksums.sha256.\n` +
       "The checksums file may be from a different release.",
   )
 }
 
+/** Which published name matched, and its hash, both from the same signed manifest entry. */
+export interface ChecksumMatch {
+  filename: string
+  checksum: string
+}
+
 // ---------------------------------------------------------------------------
 // Streaming download with progress bar
 // ---------------------------------------------------------------------------
@@ -658,9 +705,9 @@ export function validateArtifactFormat(
 
 /**
  * Per-component CDN artifact shapes:
- *   engine, server, deno, realtime — native executable (ELF / Mach-O / PE)
- *   postgres (unix)      — .tar.gz (gzip)
- *   postgres (windows)   — .zip
+ *   engine, server, deno, realtime: native executable (ELF / Mach-O / PE)
+ *   postgres (unix)      .tar.gz (gzip)
+ *   postgres (windows)   .zip
  */
 function assertArtifactFormat(
   component: Component,
@@ -687,7 +734,7 @@ function assertGzipArchive(filePath: string): void {
     if (magic[0] !== 0x1f || magic[1] !== 0x8b) {
       throw new Error(
         "Downloaded postgres file is not a gzip archive (bad magic bytes). " +
-          "The CDN object may be corrupt or cached HTML — delete ~/.supatype/cache and retry.",
+          "The CDN object may be corrupt or cached HTML, so delete ~/.supatype/cache and retry.",
       )
     }
   } finally {
@@ -704,7 +751,7 @@ function assertZipArchive(filePath: string): void {
     if (magic[0] !== 0x50 || magic[1] !== 0x4b) {
       throw new Error(
         "Downloaded postgres file is not a zip archive (bad magic bytes). " +
-          "The CDN object may be corrupt or cached HTML — delete ~/.supatype/cache and retry.",
+          "The CDN object may be corrupt or cached HTML, so delete ~/.supatype/cache and retry.",
       )
     }
   } finally {
@@ -727,14 +774,14 @@ function assertNativeExecutable(
     if (goCArchive) {
       throw new Error(
         `Downloaded ${component} file is a Go static archive (c-archive), not an executable. ` +
-          "The CDN object may be from a bad release build — delete ~/.supatype/cache and retry.",
+          "The CDN object may be from a bad release build, so delete ~/.supatype/cache and retry.",
       )
     }
     if (platform.os === "windows") {
       if (magic[0] !== 0x4d || magic[1] !== 0x5a) {
         throw new Error(
           `Downloaded ${component} file is not a Windows PE executable (bad magic bytes). ` +
-            "The CDN object may be corrupt or cached HTML — delete ~/.supatype/cache and retry.",
+            "The CDN object may be corrupt or cached HTML, so delete ~/.supatype/cache and retry.",
         )
       }
       return
@@ -745,7 +792,7 @@ function assertNativeExecutable(
       if (!elf) {
         throw new Error(
           `Downloaded ${component} file is not an ELF executable (bad magic bytes). ` +
-            "The CDN object may be corrupt or cached HTML — delete ~/.supatype/cache and retry.",
+            "The CDN object may be corrupt or cached HTML, so delete ~/.supatype/cache and retry.",
         )
       }
       return
@@ -759,7 +806,7 @@ function assertNativeExecutable(
     if (!macho) {
       throw new Error(
         `Downloaded ${component} file is not a Mach-O executable (bad magic bytes). ` +
-          "The CDN object may be corrupt or cached HTML — delete ~/.supatype/cache and retry.",
+          "The CDN object may be corrupt or cached HTML, so delete ~/.supatype/cache and retry.",
       )
     }
   } finally {
@@ -805,7 +852,7 @@ async function withRetry<T>(fn: () => Promise<T>, attempts = 3): Promise<T> {
 // ---------------------------------------------------------------------------
 
 /**
- * On Windows, Git Bash represents paths as /c/Users/... — convert to C:\Users\...
+ * On Windows, Git Bash represents paths as /c/Users/..., convert to C:\Users\...
  */
 export function normalisePlatformPath(p: string): string {
   let result = p
@@ -899,7 +946,7 @@ export async function fetchAllLatestVersions(): Promise<Partial<Record<Component
  */
 /**
  * Verify cached binaries for the current platform (used by integration CI).
- * Only checks components present in `versions` — unpublished CDN components
+ * Only checks components present in `versions`; unpublished CDN components
  * (no latest.json yet) are skipped with a log so CI can land before first release.
  * Throws if a pinned component is missing from cache or fails format checks.
  */
@@ -912,7 +959,7 @@ export function verifyCachedBinaries(versions: Partial<ComponentVersions> | unde
     const version = versions[component]
     if (typeof version !== "string" || version.trim() === "") {
       console.log(
-        `[supatype] skipping verify for ${component} (no version — CDN latest.json not published yet)`,
+        `[supatype] skipping verify for ${component} (no version, CDN latest.json not published yet)`,
       )
       continue
     }

package/src/cache-clean.ts

@@ -0,0 +1,81 @@
+/**
+ * Helpers for `supatype cache list` / `cache clean` (shared sizing + formatting).
+ */
+
+import { readdirSync, statSync } from "node:fs"
+import { join } from "node:path"
+import { BINARY_COMPONENTS, type Component } from "./components.js"
+import { cacheRoot } from "./binary-cache.js"
+import { isVersionPinned, loadPinnedVersionsForProjects, resolveCacheProjectDirs } from "./cache-pins.js"
+
+export function dirSize(dir: string): number {
+  let total = 0
+  try {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const full = join(dir, entry.name)
+      if (entry.isDirectory()) {
+        total += dirSize(full)
+      } else {
+        total += statSync(full).size
+      }
+    }
+  } catch {
+    // skip unreadable
+  }
+  return total
+}
+
+export function formatBytes(bytes: number): string {
+  if (bytes < 1024) return `${bytes} B`
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`
+  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`
+}
+
+export function listCacheEntries(projectDirs: string[]): Array<{
+  component: Component
+  version: string
+  bytes: number
+  pinned: boolean
+}> {
+  const root = cacheRoot()
+  const { protectedVersions } = loadPinnedVersionsForProjects(projectDirs)
+  const entries: Array<{ component: Component; version: string; bytes: number; pinned: boolean }> = []
+
+  for (const component of BINARY_COMPONENTS) {
+    const compDir = join(root, component)
+    if (!statExists(compDir)) continue
+
+    for (const version of readdirSync(compDir)) {
+      const vDir = join(compDir, version)
+      if (!statIsDir(vDir)) continue
+      entries.push({
+        component,
+        version,
+        bytes: dirSize(vDir),
+        pinned: protectedVersions.get(component)?.has(version) ?? false,
+      })
+    }
+  }
+
+  return entries
+}
+
+function statExists(path: string): boolean {
+  try {
+    statSync(path)
+    return true
+  } catch {
+    return false
+  }
+}
+
+function statIsDir(path: string): boolean {
+  try {
+    return statSync(path).isDirectory()
+  } catch {
+    return false
+  }
+}
+
+export { BINARY_COMPONENTS, resolveCacheProjectDirs }