@supatype/cli 0.1.6 → 0.1.9

package/src/cache-pins.ts

@@ -0,0 +1,243 @@
+/**
+ * Pin-aware cache eviction: collect `versions.*` pins across local projects (C13).
+ */
+
+import { existsSync, readdirSync, rmSync, statSync } from "node:fs"
+import { join, resolve } from "node:path"
+import { BINARY_COMPONENTS, type Component } from "./components.js"
+import { cachePath, cacheRoot, pinnedVersion, VERSION_PIN_LOCAL } from "./binary-cache.js"
+import { loadConfig } from "./config.js"
+import type { SupatypeProjectConfig } from "./project-config.js"
+
+const CONFIG_FILENAMES = ["supatype.config.ts", "supatype.config.js", "supatype.config.mjs"] as const
+
+export interface PinSource {
+  component: Component
+  version: string
+  projectDir: string
+  projectName: string
+}
+
+export interface CleanCacheEntry {
+  component: Component
+  version: string
+  bytes: number
+}
+
+export interface CleanCacheResult {
+  removed: CleanCacheEntry[]
+  skipped: Array<CleanCacheEntry & { reason: string }>
+  warned: string[]
+}
+
+/** Union pinned semver versions from one or more loaded configs. */
+export function pinnedVersionsFromConfigs(
+  entries: Array<{ projectDir: string; config: SupatypeProjectConfig }>,
+): { protectedVersions: Map<Component, Set<string>>; sources: PinSource[] } {
+  const protectedVersions = new Map<Component, Set<string>>()
+  const sources: PinSource[] = []
+
+  for (const { projectDir, config } of entries) {
+    const projectName = config.project?.name?.trim() || projectDir
+    for (const component of BINARY_COMPONENTS) {
+      const version = pinnedVersion(component, config)
+      if (!version || version === VERSION_PIN_LOCAL) continue
+      let set = protectedVersions.get(component)
+      if (!set) {
+        set = new Set<string>()
+        protectedVersions.set(component, set)
+      }
+      set.add(version)
+      sources.push({ component, version, projectDir, projectName })
+    }
+  }
+
+  return { protectedVersions, sources }
+}
+
+function hasSupatypeConfig(dir: string): boolean {
+  return CONFIG_FILENAMES.some((name) => existsSync(join(dir, name)))
+}
+
+/** Walk `root` up to `maxDepth` looking for directories that contain a Supatype config file. */
+export function findSupatypeProjectDirs(root: string, maxDepth = 4): string[] {
+  const absRoot = resolve(root)
+  if (!existsSync(absRoot)) return []
+
+  const found: string[] = []
+  const queue: Array<{ dir: string; depth: number }> = [{ dir: absRoot, depth: 0 }]
+
+  while (queue.length > 0) {
+    const item = queue.shift()
+    if (!item) break
+    const { dir, depth } = item
+
+    if (hasSupatypeConfig(dir)) {
+      found.push(dir)
+      continue
+    }
+
+    if (depth >= maxDepth) continue
+
+    let entries
+    try {
+      entries = readdirSync(dir, { withFileTypes: true })
+    } catch {
+      continue
+    }
+
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue
+      if (entry.name === "node_modules" || entry.name === ".git" || entry.name === ".supatype") continue
+      queue.push({ dir: join(dir, entry.name), depth: depth + 1 })
+    }
+  }
+
+  return found
+}
+
+/** Resolve project directories whose `versions` pins should protect cache entries. */
+export function resolveCacheProjectDirs(cwd: string, extraProjects: string[]): string[] {
+  const dirs = new Set<string>()
+
+  for (const raw of extraProjects) {
+    const abs = resolve(raw)
+    if (hasSupatypeConfig(abs)) dirs.add(abs)
+  }
+
+  if (hasSupatypeConfig(cwd)) dirs.add(resolve(cwd))
+
+  const envRoots = process.env.SUPATYPE_CACHE_PROJECT_ROOTS?.trim()
+  if (envRoots) {
+    for (const segment of envRoots.split(",")) {
+      const root = segment.trim()
+      if (!root) continue
+      for (const dir of findSupatypeProjectDirs(root)) {
+        dirs.add(dir)
+      }
+    }
+  }
+
+  return [...dirs]
+}
+
+export function loadPinnedVersionsForProjects(
+  projectDirs: string[],
+): { protectedVersions: Map<Component, Set<string>>; sources: PinSource[]; loadWarnings: string[] } {
+  const configs: Array<{ projectDir: string; config: SupatypeProjectConfig }> = []
+  const loadWarnings: string[] = []
+
+  for (const projectDir of projectDirs) {
+    try {
+      configs.push({ projectDir, config: loadConfig(projectDir) })
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err)
+      loadWarnings.push(`${projectDir}: ${message}`)
+    }
+  }
+
+  const { protectedVersions, sources } = pinnedVersionsFromConfigs(configs)
+  return { protectedVersions, sources, loadWarnings }
+}
+
+export function listCachedVersions(component: Component): string[] {
+  const compDir = join(cacheRoot(), component)
+  if (!existsSync(compDir)) return []
+  return readdirSync(compDir).filter((name) => {
+    try {
+      return statSync(join(compDir, name)).isDirectory()
+    } catch {
+      return false
+    }
+  })
+}
+
+function pinReason(
+  component: Component,
+  version: string,
+  sources: PinSource[],
+): string | undefined {
+  const matches = sources.filter((s) => s.component === component && s.version === version)
+  if (matches.length === 0) return undefined
+  const names = [...new Set(matches.map((m) => m.projectName))]
+  return `pinned by ${names.join(", ")}`
+}
+
+function dirSize(dir: string): number {
+  let total = 0
+  try {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const full = join(dir, entry.name)
+      if (entry.isDirectory()) {
+        total += dirSize(full)
+      } else {
+        total += statSync(full).size
+      }
+    }
+  } catch {
+    // skip unreadable
+  }
+  return total
+}
+
+export interface CleanCachedBinariesOptions {
+  components: Component[]
+  version?: string
+  force?: boolean
+  dryRun?: boolean
+  projectDirs: string[]
+}
+
+export function cleanCachedBinaries(options: CleanCachedBinariesOptions): CleanCacheResult {
+  const { protectedVersions, sources, loadWarnings } = loadPinnedVersionsForProjects(options.projectDirs)
+  const result: CleanCacheResult = { removed: [], skipped: [], warned: [...loadWarnings] }
+
+  const force = options.force === true
+  const dryRun = options.dryRun === true
+  const explicitVersion = options.version?.trim()
+
+  for (const component of options.components) {
+    const versions = explicitVersion ? [explicitVersion] : listCachedVersions(component)
+
+    for (const version of versions) {
+      const vDir = cachePath(component, version)
+      if (!existsSync(vDir)) {
+        if (explicitVersion) continue
+        continue
+      }
+
+      const bytes = dirSize(vDir)
+      const entry: CleanCacheEntry = { component, version, bytes }
+      const pinned = protectedVersions.get(component)?.has(version) ?? false
+
+      if (!force && !explicitVersion && pinned) {
+        const reason = pinReason(component, version, sources) ?? "pinned"
+        result.skipped.push({ ...entry, reason })
+        continue
+      }
+
+      if (!force && explicitVersion && pinned) {
+        const reason = pinReason(component, version, sources) ?? "pinned"
+        result.warned.push(
+          `${component}@${version} is ${reason}: removing anyway (explicit version)`,
+        )
+      }
+
+      if (!dryRun) {
+        rmSync(vDir, { recursive: true, force: true })
+      }
+      result.removed.push(entry)
+    }
+  }
+
+  return result
+}
+
+export function isVersionPinned(
+  component: Component,
+  version: string,
+  projectDirs: string[],
+): boolean {
+  const { protectedVersions } = loadPinnedVersionsForProjects(projectDirs)
+  return protectedVersions.get(component)?.has(version) ?? false
+}

package/src/cli-artifacts.ts

@@ -0,0 +1,65 @@
+/**
+ * Names and locations of the published standalone CLI artefacts.
+ *
+ * One place, because this layout had drifted into five: the release workflow, install.sh,
+ * this module's caller, the Homebrew generator and a now-deleted second installer all
+ * described it independently, and `supatype self-update` was asking for bare executables the
+ * publisher had stopped writing. `scripts/install.sh` cannot import this (it runs before any
+ * CLI exists on the machine), so the shell keeps its own copy; what holds the two together is
+ * the round-trip test in tests/integration/scripts/cli-artifact-roundtrip.sh, not this file.
+ */
+
+import { existsSync, readdirSync } from "node:fs"
+import { currentPlatform, type PlatformId } from "./binary-cache.js"
+
+/**
+ * Which C library the running system provides. Only meaningful on Linux: Bun links
+ * libstdc++ and libgcc dynamically, so a glibc build cannot start on Alpine, and installing a
+ * glibc binary over a working musl one is how a self-update would brick an Alpine install.
+ */
+export type LibcId = "glibc" | "musl"
+
+/** Detects musl by its dynamic loader, the same signal scripts/install.sh uses. */
+export function currentLibc(platform: PlatformId = currentPlatform()): LibcId {
+  if (platform.os !== "linux") return "glibc"
+  if (!existsSync("/lib")) return "glibc"
+  try {
+    const musl = readdirSync("/lib").some((f) => f.startsWith("ld-musl-") && f.endsWith(".so.1"))
+    return musl ? "musl" : "glibc"
+  } catch {
+    return "glibc"
+  }
+}
+
+/**
+ * The archive published for a platform. Windows gets a zip because that is what Windows
+ * users can open without extra tools; everything else is a tarball. Both hold a single
+ * executable called `supatype` (`supatype.exe` on Windows), whatever the archive is named.
+ */
+export function cliArchiveName(
+  platform: PlatformId = currentPlatform(),
+  libc: LibcId = currentLibc(platform),
+): string {
+  const suffix = platform.os === "linux" && libc === "musl" ? "-musl" : ""
+  const ext = platform.os === "windows" ? "zip" : "tar.gz"
+  return `supatype-cli-${platform.os}-${platform.arch}${suffix}.${ext}`
+}
+
+/** The executable inside the archive. */
+export function cliExecutableName(platform: PlatformId = currentPlatform()): string {
+  return platform.os === "windows" ? "supatype.exe" : "supatype"
+}
+
+/** CDN path of a version's archive, relative to the CDN root. */
+export function cliArchivePath(
+  version: string,
+  platform: PlatformId = currentPlatform(),
+  libc: LibcId = currentLibc(platform),
+): string {
+  return `/cli/v${version}/${cliArchiveName(platform, libc)}`
+}
+
+/** CDN path of the checksums file covering every archive in a version. */
+export function cliChecksumsPath(version: string): string {
+  return `/cli/v${version}/checksums.sha256`
+}

package/src/cli-install-method.ts

@@ -0,0 +1,87 @@
+/**
+ * Detect how the supatype CLI was installed (npm, Homebrew, standalone CDN).
+ */
+
+export type CliInstallMethod = "npm" | "homebrew" | "standalone"
+
+function normalizePath(path: string): string {
+  return path.replace(/\\/g, "/")
+}
+
+/**
+ * Inside a Bun-compiled binary, argv[1] is a path in the embedded filesystem, not on disk:
+ * `/$bunfs/root/supatype` on Linux and macOS, `B:/~BUN/root/supatype.exe` on Windows. No
+ * filesystem call can touch either, which is why self-update failed with
+ * `ENOENT: copyfile '/$bunfs/root/supatype'` and could never have replaced itself.
+ */
+const EMBEDDED_FS_PATH = /(^|\/)(\$bunfs|~BUN)\//i
+
+/**
+ * The executable on disk.
+ *
+ * process.execPath is the compiled binary when running one, and the Node binary otherwise, so
+ * it is only correct to prefer it when argv[1] is an embedded path. Under Node the script path
+ * is what identifies the install.
+ */
+export function runningBinaryPath(): string {
+  const main = normalizePath(process.argv[1] ?? "")
+  return EMBEDDED_FS_PATH.test(main) ? process.execPath : (process.argv[1] ?? "")
+}
+
+/** The running binary sits in an npm or workspace layout. */
+function hasNpmInstallPath(): boolean {
+  const main = normalizePath(runningBinaryPath())
+  return (
+    main.includes("node_modules") ||
+    main.includes("/dist/cli") ||
+    main.includes("/bin/supatype.js")
+  )
+}
+
+/** Launched through an npm/pnpm/yarn script, whatever the binary's own layout. */
+function ranUnderPackageManager(): boolean {
+  return Boolean(process.env["npm_execpath"]) || Boolean(process.env["npm_lifecycle_event"])
+}
+
+/** npm global, project dependency, or monorepo workspace build. */
+export function looksLikeNpmOrWorkspaceCLI(): boolean {
+  return hasNpmInstallPath() || ranUnderPackageManager()
+}
+
+/** Homebrew / Linuxbrew Cellar layout. */
+export function looksLikeHomebrewCLI(): boolean {
+  const main = normalizePath(runningBinaryPath())
+  if (!main) return false
+
+  if (/(?:^|\/)Cellar\/supatype\//.test(main)) return true
+
+  const cellar = process.env["HOMEBREW_CELLAR"]
+  if (cellar && normalizePath(main).startsWith(normalizePath(cellar) + "/") && main.includes("/supatype/")) {
+    return true
+  }
+
+  return false
+}
+
+/**
+ * Which installer owns the running binary. This decides what `self-update`
+ * tells the user to run, so it has to describe the binary on disk.
+ *
+ * Path shape wins over `npm_*` in the environment: those are set whenever the
+ * CLI is invoked from a package script, which says nothing about how the binary
+ * got there. Trusting them meant a Homebrew or curl install called from an npm
+ * script was told to update itself with npm.
+ */
+export function detectCliInstallMethod(): CliInstallMethod {
+  if (hasNpmInstallPath()) return "npm"
+  if (looksLikeHomebrewCLI()) return "homebrew"
+  if (isStandalonePath()) return "standalone"
+  if (ranUnderPackageManager()) return "npm"
+  return "standalone"
+}
+
+/** The `curl | sh` installer's default target. */
+function isStandalonePath(): boolean {
+  const main = normalizePath(runningBinaryPath())
+  return main.includes("/.supatype/bin/")
+}

package/src/cli-package-version.ts

@@ -1,11 +1,15 @@
 import { readFileSync } from "node:fs"
 import { dirname, join } from "node:path"
 import { fileURLToPath } from "node:url"
+import { EMBEDDED_CLI_VERSION } from "./cli-version-embedded.js"
 
 const CLI_PACKAGE_JSON = join(dirname(fileURLToPath(import.meta.url)), "..", "package.json")
 
-/** Installed @supatype/cli version from package.json (used by --version and init scaffolding). */
+/** Installed @supatype/cli version (used by --version and init scaffolding). */
 export function cliPackageVersion(): string {
+  // Set in published builds; the package.json read below only works when one is on disk,
+  // which is true for the npm package and false inside the standalone binary.
+  if (EMBEDDED_CLI_VERSION !== "") return EMBEDDED_CLI_VERSION
   try {
     const pkg = JSON.parse(readFileSync(CLI_PACKAGE_JSON, "utf8")) as { version?: string }
     return pkg.version ?? "0.0.0"

package/src/cli-standalone.ts

@@ -1,23 +1,45 @@
 /**
- * Standalone CLI binary CDN download (self-update + curl|sh installers).
+ * Standalone CLI archive download, used by `supatype self-update`.
+ *
+ * The artefact is a per-platform archive holding one executable, not a bare executable, and it
+ * is verified against the release's checksums.sha256 before anything is replaced. Previously
+ * this path checked only that the download was over 64 bytes and did not begin like HTML or
+ * JSON, which made the CLI stricter about a postgres archive than about overwriting itself.
  */
 
-import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs"
-import { homedir } from "node:os"
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { createHash } from "node:crypto"
+import { homedir, tmpdir } from "node:os"
 import { join } from "node:path"
-import { currentPlatform, type PlatformId } from "./binary-cache.js"
+import { spawnSync } from "node:child_process"
+import { currentPlatform, fetchChecksums, type PlatformId } from "./binary-cache.js"
+import {
+  cliArchiveName,
+  cliArchivePath,
+  cliChecksumsPath,
+  cliExecutableName,
+  currentLibc,
+  type LibcId,
+} from "./cli-artifacts.js"
 
-const CDN_BASE = "https://releases.supatype.com"
-
-export function cliCdnPath(version: string, platform: PlatformId): string {
-  const win = platform.os === "windows"
-  return `/cli/v${version}/supatype-cli-${platform.os}-${platform.arch}${win ? ".exe" : ""}`
-}
+/**
+ * Overridable for the same reason scripts/install.sh takes SUPATYPE_CDN: with the host fixed,
+ * nothing can exercise this path except a real release, which is how it came to request bare
+ * executables the publisher had stopped writing. SUPATYPE_CDN_BASE is the CDN root, where
+ * install.sh's SUPATYPE_CDN is the root plus /cli.
+ *
+ * binary-cache.ts hardcodes the same host for component downloads and could use the same
+ * treatment, which is left alone here as it is not part of this change.
+ */
+const CDN_BASE = process.env["SUPATYPE_CDN_BASE"]?.replace(/\/$/, "")
+  || "https://releases.supatype.com"
 
-export function cliCachePath(version: string, platform: PlatformId = currentPlatform()): string {
-  const win = platform.os === "windows"
-  const name = `supatype-cli-${platform.os}-${platform.arch}${win ? ".exe" : ""}`
-  return join(homedir(), ".supatype", "cache", "cli", version, name)
+/** Where a downloaded release is unpacked, so a repeated update does not refetch it. */
+export function cliCachePath(
+  version: string,
+  platform: PlatformId = currentPlatform(),
+): string {
+  return join(homedir(), ".supatype", "cache", "cli", version, cliExecutableName(platform))
 }
 
 export async function fetchStandaloneCliLatestVersion(): Promise<string> {
@@ -32,31 +54,91 @@ export async function fetchStandaloneCliLatestVersion(): Promise<string> {
   return data.version.trim()
 }
 
-/** Download the standalone CLI binary for the current platform. */
-export async function downloadStandaloneCli(version?: string): Promise<string> {
-  const platform = currentPlatform()
-  const resolved = version ?? await fetchStandaloneCliLatestVersion()
-  const dest = cliCachePath(resolved, platform)
-  if (existsSync(dest)) return dest
-
-  const url = `${CDN_BASE}${cliCdnPath(resolved, platform)}`
+async function fetchBytes(url: string, what: string): Promise<Buffer> {
   const resp = await fetch(url)
   if (!resp.ok) {
-    throw new Error(`Failed to download CLI from ${url}: HTTP ${resp.status}`)
+    throw new Error(`Failed to download ${what} from ${url}: HTTP ${resp.status}`)
   }
-  const buf = Buffer.from(await resp.arrayBuffer())
-  if (buf.length < 64) {
-    throw new Error("Downloaded CLI artifact is too small")
+  return Buffer.from(await resp.arrayBuffer())
+}
+
+/**
+ * Unpack the single executable from an archive.
+ *
+ * PowerShell on Windows, because Git Bash's tar is usually first on PATH there and chokes on
+ * drive-letter paths. The same split exists in commands/dev.ts for component archives.
+ */
+function unpackExecutable(archivePath: string, destDir: string, platform: PlatformId): string {
+  mkdirSync(destDir, { recursive: true })
+  const result = platform.os === "windows"
+    ? spawnSync(
+        "powershell.exe",
+        [
+          "-NoProfile",
+          "-Command",
+          `Expand-Archive -Path '${archivePath}' -DestinationPath '${destDir}' -Force`,
+        ],
+        { stdio: "pipe" },
+      )
+    : spawnSync("tar", ["-xzf", archivePath, "-C", destDir], { stdio: "pipe" })
+
+  if (result.status !== 0) {
+    throw new Error(
+      `Failed to unpack ${archivePath}: ${result.stderr?.toString().trim() || "unknown error"}`,
+    )
   }
-  const head = buf.subarray(0, 5).toString("utf8").toLowerCase()
-  if (head.startsWith("<!doc") || head.startsWith("{")) {
-    throw new Error("Downloaded CLI artifact looks like an error page, not a binary")
+
+  const exe = join(destDir, cliExecutableName(platform))
+  if (!existsSync(exe)) {
+    throw new Error(
+      `${cliArchiveName(platform)} did not contain ${cliExecutableName(platform)}.`,
+    )
+  }
+  return exe
+}
+
+/**
+ * Download and verify the standalone CLI for this machine, returning the path to the
+ * executable. Nothing is written to the cache until the checksum matches.
+ */
+export async function downloadStandaloneCli(
+  version?: string,
+  platform: PlatformId = currentPlatform(),
+  libc: LibcId = currentLibc(platform),
+): Promise<string> {
+  const resolved = version ?? await fetchStandaloneCliLatestVersion()
+  const dest = cliCachePath(resolved, platform)
+  if (existsSync(dest)) return dest
+
+  const name = cliArchiveName(platform, libc)
+  const archive = await fetchBytes(`${CDN_BASE}${cliArchivePath(resolved, platform, libc)}`, name)
+
+  // The manifest is verified before it is trusted, and only then is the archive compared
+  // against it. A checksum alone would prove the download was intact, not that it came from
+  // us, and the signature is what makes replacing our own executable no weaker than fetching
+  // a postgres archive. fetchChecksums treats the .minisig as mandatory and fails closed
+  // without a public key, which is the same rule component downloads follow.
+  const checksumsUrl = `${CDN_BASE}${cliChecksumsPath(resolved)}`
+  const expected = await fetchChecksums(checksumsUrl, `${checksumsUrl}.minisig`, name)
+  const actual = createHash("sha256").update(archive).digest("hex")
+  if (actual !== expected.checksum) {
+    throw new Error(
+      `Checksum mismatch for ${name}.\n  expected: ${expected.checksum}\n  actual:   ${actual}`,
+    )
   }
 
-  mkdirSync(join(dest, ".."), { recursive: true })
-  writeFileSync(dest, buf)
-  if (platform.os !== "windows") {
-    chmodSync(dest, 0o755)
+  const staging = join(tmpdir(), `supatype-cli-${resolved}-${process.pid}`)
+  try {
+    mkdirSync(staging, { recursive: true })
+    const archivePath = join(staging, name)
+    writeFileSync(archivePath, archive)
+    const unpacked = unpackExecutable(archivePath, staging, platform)
+
+    mkdirSync(join(dest, ".."), { recursive: true })
+    writeFileSync(dest, readFileSync(unpacked))
+    if (platform.os !== "windows") chmodSync(dest, 0o755)
+    return dest
+  } finally {
+    rmSync(staging, { recursive: true, force: true })
   }
-  return dest
 }

package/src/cli-version-embedded.ts

@@ -0,0 +1,12 @@
+/**
+ * CLI version, baked in at publish by scripts/set-version.mjs.
+ *
+ * The standalone binary cannot read its own package.json: pkg carries only files it can
+ * find by static analysis, and that path is assembled at runtime, so `--version` inside a
+ * published binary would answer 0.0.0 without this. Empty in a source checkout, where
+ * cliPackageVersion() falls back to reading package.json.
+ */
+// Annotated `string`, not left to inference: once a release stamps a value here, the
+// inferred literal type makes the `!== ""` test in cliPackageVersion() a compile error
+// (TS2367, no overlap), so the build would only fail during a release.
+export const EMBEDDED_CLI_VERSION: string = "0.1.9"

package/src/cli.ts

@@ -18,6 +18,7 @@ import { registerApp } from "./commands/app.js"
 import { registerAdd } from "./commands/add.js"
 import { registerSelfHost } from "./commands/self-host.js"
 import { registerCloud } from "./commands/cloud.js"
+import { registerLogin } from "./commands/login.js"
 import { registerEngine } from "./commands/engine.js"
 import { registerDb } from "./commands/db.js"
 import { registerDeploy } from "./commands/deploy.js"
@@ -25,10 +26,12 @@ import { registerStatus } from "./commands/status.js"
 import { registerLogs } from "./commands/logs.js"
 import { registerAdmin } from "./commands/admin.js"
 import { registerFunctions } from "./commands/functions.js"
+import { registerHooks } from "./commands/hooks.js"
 import { registerPlugins } from "./commands/plugins.js"
 import { registerTypes } from "./commands/types.js"
 import { registerMigrateFromV1 } from "./commands/migrate-from-v1.js"
 import { registerSelfUpdate } from "./commands/self-update.js"
+import { registerInternalCommands } from "./commands/internal.js"
 import { cliPackageVersion } from "./cli-package-version.js"
 import { reportCliFatal } from "./ui/fatal.js"
 import { wrapProgramActionsWithChrome } from "./ui/runtime/command-chrome.js"
@@ -36,13 +39,14 @@ import { wrapProgramActionsWithChrome } from "./ui/runtime/command-chrome.js"
 export async function run(): Promise<void> {
   const program = new Command()
     .name("supatype")
-    .description("Supatype — type-first platform for PostgreSQL")
+    .description("Supatype: type-first platform for PostgreSQL")
     .version(cliPackageVersion())
 
   registerInit(program)
   registerDev(program)
   registerCache(program)
   registerSelfUpdate(program)
+  registerInternalCommands(program)
   registerUpdate(program)
   registerPg(program)
   registerPush(program)
@@ -58,6 +62,7 @@ export async function run(): Promise<void> {
   registerApp(program)
   registerAdd(program)
   registerSelfHost(program)
+  registerLogin(program)
   registerCloud(program)
   registerEngine(program)
   registerDb(program)
@@ -66,6 +71,7 @@ export async function run(): Promise<void> {
   registerLogs(program)
   registerAdmin(program)
   registerFunctions(program)
+  registerHooks(program)
   registerPlugins(program)
   registerTypes(program)
   registerMigrateFromV1(program)