@supatype/cli 0.1.6 → 0.1.9

package/src/commands/push.ts

@@ -1,8 +1,17 @@
 import type { Command } from "commander"
-import { mkdirSync, writeFileSync } from "node:fs"
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"
 import { join } from "node:path"
 import { loadConfig, loadSchemaAst } from "../config.js"
-import { resolveRuntimeProvider, schemaPathFromProject, serverBaseUrl } from "../project-config.js"
+import { syncManifestHooks, validateModelHooks, writeHooksModule } from "../model-hooks.js"
+import { adapterEntry, readHookUpload } from "../hook-upload.js"
+import { checkServiceRoleRoutes, serviceRoleProblemLines } from "../service-role-check.js"
+import { fatalError } from "../ui/fatal.js"
+import {
+  hooksPathFromProject,
+  resolveRuntimeProvider,
+  schemaPathFromProject,
+  serverBaseUrl,
+} from "../project-config.js"
 import { ensureEngine, engineRequest, type DiffResult } from "../engine-client.js"
 import { printDiffOperations, printDiffWarnings } from "../diff-output.js"
 import { signJwt } from "../jwt.js"
@@ -20,6 +29,7 @@ import {
   type DeployTarget,
 } from "../resolve-target.js"
 import { loadProjectLink } from "../link.js"
+import { targetFetch } from "../target-client.js"
 import {
   buildSchemaSourcesPayload,
   cacheSchemaSourcesLocally,
@@ -54,6 +64,8 @@ export function registerPush(program: Command): void {
       const config = loadConfig(cwd)
       const pgSchema = schemaPgSchema(cwd)
       const ast = loadSchemaAst(schemaPathFromProject(config, cwd), cwd)
+      assertModelHooksResolve(cwd, config, ast)
+      assertServiceRoleGrantsResolve(cwd, config)
 
       const linked = loadProjectLink(cwd)
       const useDirect = opts.direct || opts.local || Boolean(opts.connection)
@@ -143,6 +155,10 @@ async function pushViaTarget(
     }
   }
 
+  if (target.mode === "cloud" || target.mode === "self-host") {
+    await deployHooksToTarget(cwd, config, target, ast)
+  }
+
   if (target.mode === "direct" || target.mode === "local") {
     await writeLocalAdminConfig(ast, config)
     if (target.databaseUrl) {
@@ -150,17 +166,86 @@ async function pushViaTarget(
     }
     await generateTypesLocal(ast, config)
     await provisionLocalStorage(ast, config)
-  } else {
-    info(`Pushed to ${target.mode} (${target.environment}).`)
+
+    // Local Studio only: a cloud/self-host push must not advertise the local
+    // gateway URL from config, which may not even be running.
+    const baseUrl = (serverBaseUrl(config) ?? "").replace(/\/$/, "")
+    if (baseUrl) {
+      plain(`\nStudio: ${baseUrl}/studio/`)
+    }
+    return
   }
 
-  const baseUrl = (serverBaseUrl(config) ?? "").replace(/\/$/, "")
-  if (baseUrl) {
-    plain(`\nStudio: ${baseUrl}/studio/`)
+  info(`Pushed to ${target.mode} (${target.environment}).`)
+  const envUrl = target.link?.environments?.[target.environment]?.apiUrl?.replace(/\/$/, "")
+  if (envUrl) {
+    plain(`\nProject API: ${envUrl}`)
   }
 }
 
+/**
+ * Upload the hooks this schema names to a managed stack.
+ *
+ * On `push` rather than `functions deploy`, because the hook *map* comes from the schema: the two have
+ * to move together, and a map naming a handler that was never uploaded turns every write to that table
+ * into a 503.
+ *
+ * The handler types are written locally as well. A project pushing to cloud still edits its hooks on
+ * this machine, and `hooks/_supatype/hooks.ts` is what makes them typed, it is generated, never
+ * committed, so a fresh clone that has only ever pushed to cloud would otherwise have no types at all.
+ */
+async function deployHooksToTarget(
+  cwd: string,
+  config: SupatypeProjectConfig,
+  target: DeployTarget,
+  ast: unknown,
+): Promise<void> {
+  const hooksDir = hooksPathFromProject(config, cwd)
+  const hooksPath = writeHooksModule(cwd, hooksDir, ast)
+  if (hooksPath !== null) info(`Hook handler types written to ${hooksPath}`)
+
+  let upload: ReturnType<typeof readHookUpload>
+  try {
+    upload = readHookUpload(cwd, hooksDir, ast)
+  } catch (err) {
+    // Refused rather than partially uploaded: the schema is already applied, so the honest thing is to
+    // say the hooks did not deploy and why, leaving the previous ones in place.
+    fatalError(err instanceof Error ? err.message : String(err))
+    return
+  }
+  if (upload === null) return
+
+  const adapter = readGeneratedAdapter(hooksDir)
+  const handlers = adapter === null ? upload.handlers : [...upload.handlers, adapter]
+
+  await withSpinner(`Deploying ${upload.handlers.length} hook(s)`, () =>
+    targetFetch(target.apiBaseUrl, target.apiPrefix, {
+      method: "POST",
+      path: `/projects/${target.projectRef}/hooks/deploy`,
+      body: { handlers, map: upload.map },
+      token: target.token!,
+      orgId: target.orgId,
+      environment: target.mode === "cloud" ? target.environment : undefined,
+    }),
+  ).then(() => info(`Deployed ${upload.handlers.length} hook(s)`))
+}
+
+/** The generated adapter, flattened to the name handlers were rewritten to import. */
+function readGeneratedAdapter(hooksDir: string): { name: string; source: string } | null {
+  const file = join(hooksDir, "_supatype", "hooks.ts")
+  if (!existsSync(file)) return null
+  return adapterEntry(readFileSync(file, "utf8"))
+}
+
 async function generateTypesLocal(ast: unknown, config: SupatypeProjectConfig): Promise<void> {
+  // Independent of `output`: a project with hooks needs its handler types whether or not it asked
+  // for client types, and the module is written next to the functions that import it.
+  const cwd = process.cwd()
+  const hooksPath = writeHooksModule(cwd, hooksPathFromProject(config, cwd), ast)
+  if (hooksPath !== null) info(`Hook handler types written to ${hooksPath}`)
+  // The server watches this file, so a changed hook takes effect without a restart.
+  if (syncManifestHooks(cwd, ast)) info("Hook map written to .supatype/manifest.json")
+
   if (!config.output?.types && !config.output?.client) return
   await withSpinner("Generating types", async () => {
     await ensureEngine()
@@ -195,3 +280,35 @@ async function writeLocalAdminConfig(ast: unknown, config: SupatypeProjectConfig
   restoreSystemRelationTargets(admin, ast)
   writeFileSync(join(dir, "admin-config.json"), `${JSON.stringify(admin, null, 2)}\n`)
 }
+
+/**
+ * Stop the push when a declared hook names a function that is not there.
+ *
+ * A hook is only enforcement if it runs. A typo'd name would extract cleanly, reach the manifest, and
+ * then never fire: so the write it was meant to validate would succeed and look fine. Cheaper to
+ * fail here, naming the directory searched.
+ */
+/**
+ * Refuse a push whose `functions.serviceRole` names a function that does not exist.
+ *
+ * The grant fails closed, which is the safe direction and the invisible one: the function reads no key
+ * at runtime, in a deploy that reported success. A warning is printed for an entry that is merely
+ * redundant, since a reader would reasonably assume the line is what does the granting.
+ */
+function assertServiceRoleGrantsResolve(cwd: string, config: SupatypeProjectConfig): void {
+  const problems = checkServiceRoleRoutes(config, cwd)
+  for (const warning of problems.warnings) plain(warning)
+  const lines = serviceRoleProblemLines(problems)
+  if (lines.length === 0) return
+  fatalError("functions.serviceRole names a function that does not exist.", lines, {
+    brand: { intro: "Push" },
+  })
+}
+
+function assertModelHooksResolve(cwd: string, config: SupatypeProjectConfig, ast: unknown): void {
+  const problems = validateModelHooks(ast, hooksPathFromProject(config, cwd), cwd)
+  if (problems.length === 0) return
+  fatalError("A model declares a hook whose function does not exist.", problems, {
+    brand: { intro: "Push" },
+  })
+}

package/src/commands/self-host.ts

@@ -1,5 +1,5 @@
 /**
- * self-host commands — manage self-hosted deployments.
+ * self-host commands: manage self-hosted deployments.
  *
  * Compose-based commands are the default path.
  * Native/systemd commands remain available for bare-metal deployments.

package/src/commands/self-update.ts

@@ -1,33 +1,27 @@
 /**
- * supatype self-update — Phase 10.6C8.
+ * supatype self-update
  *
  * npm-installed CLI: instruct to use `npm update -g`.
- * Standalone curl|sh installs: replace binary from releases.supatype.com/cli/.
+ * Homebrew: instruct to use `brew upgrade supatype`.
+ * Standalone curl|sh installs: replace the binary from releases.supatype.com/cli/.
  */
 
 import type { Command } from "commander"
 import { copyFileSync, renameSync } from "node:fs"
-import { sep } from "node:path"
+import { cliPackageVersion } from "../cli-package-version.js"
+import { detectCliInstallMethod, runningBinaryPath } from "../cli-install-method.js"
 import { downloadStandaloneCli, fetchStandaloneCliLatestVersion } from "../cli-standalone.js"
 import { error, info, plain } from "../ui/messages.js"
 
-function looksLikeNpmOrWorkspaceCLI(): boolean {
-  const main = process.argv[1] ?? ""
-  return (
-    main.includes("node_modules") ||
-    main.includes(`${sep}dist${sep}cli`) ||
-    main.includes(`${sep}bin${sep}supatype.js`) ||
-    Boolean(process.env["npm_execpath"]) ||
-    Boolean(process.env["npm_lifecycle_event"])
-  )
-}
-
 export function registerSelfUpdate(program: Command): void {
   program
     .command("self-update")
     .description("Update the supatype CLI (npm or standalone CDN binary)")
-    .action(async () => {
-      if (looksLikeNpmOrWorkspaceCLI()) {
+    .option("--force", "Reinstall even if the latest version is already installed")
+    .action(async (opts: { force?: boolean }) => {
+      const method = detectCliInstallMethod()
+
+      if (method === "npm") {
         plain(
           "This CLI was installed via npm (or runs from the package workspace).\n" +
             "Update with:\n\n  npm update -g @supatype/cli\n\n" +
@@ -36,7 +30,18 @@ export function registerSelfUpdate(program: Command): void {
         return
       }
 
-      const currentPath = process.argv[1]
+      if (method === "homebrew") {
+        plain(
+          "This CLI was installed via Homebrew.\n" +
+            "Update with:\n\n  brew update && brew upgrade supatype\n\n" +
+            "To bump component binaries pinned in supatype.config.ts, use:\n\n  supatype update\n",
+        )
+        return
+      }
+
+      // The binary on disk, not argv[1]: in a compiled binary argv[1] points into the embedded
+      // filesystem, so backing it up failed with ENOENT and no update could ever complete.
+      const currentPath = runningBinaryPath()
       if (!currentPath) {
         error("Could not determine current CLI path.")
         process.exit(1)
@@ -44,21 +49,38 @@ export function registerSelfUpdate(program: Command): void {
 
       try {
         const latest = await fetchStandaloneCliLatestVersion()
-        info(`Downloading supatype CLI v${latest}...`)
+        const current = cliPackageVersion()
+
+        // Without this the command re-downloaded on every run: it compared nothing, so a
+        // machine already on the latest version fetched and rewrote the same binary.
+        if (latest === current && !opts.force) {
+          info(`Already on v${current}, the latest release.`)
+          plain("Reinstall anyway with `supatype self-update --force`.")
+          return
+        }
+
+        info(
+          latest === current
+            ? `Reinstalling v${latest}...`
+            : `Downloading supatype CLI v${latest} (current: v${current})...`,
+        )
         const downloaded = await downloadStandaloneCli(latest)
+
         const backup = `${currentPath}.bak`
         copyFileSync(currentPath, backup)
         try {
           renameSync(downloaded, currentPath)
-        } catch (err) {
+        } catch {
           copyFileSync(downloaded, currentPath)
         }
+
         info(`Updated to v${latest}.`)
         plain("Run `supatype --version` to verify.")
       } catch (err) {
         error(
           `Standalone CLI self-update failed: ${(err as Error).message}\n\n` +
             "Install or upgrade via npm:\n  npm install -g @supatype/cli\n\n" +
+            "Or Homebrew:\n  brew upgrade supatype\n\n" +
             "Component binaries (engine, server, postgres, deno, realtime):\n  supatype update\n",
         )
         process.exit(1)

package/src/commands/status.ts

@@ -1,5 +1,5 @@
 /**
- * supatype status — show linked target or local dev stack state.
+ * supatype status: show linked target or local dev stack state.
  */
 import type { Command } from "commander"
 import { spawnSync } from "node:child_process"

package/src/commands/update.ts

@@ -1,5 +1,5 @@
 /**
- * supatype update — bump component versions in supatype.config.ts
+ * supatype update: bump component versions in supatype.config.ts
  * and download the new binaries.
  */
 

package/src/config.ts

@@ -3,6 +3,7 @@ import { resolve } from "node:path"
 import { tmpdir } from "node:os"
 import { join } from "node:path"
 import { evalTsSnippet } from "./tsx-runner.js"
+import { readEnvFile } from "./env-file.js"
 import {
   mergeProjectConfig,
   validateProjectConfig,
@@ -71,7 +72,7 @@ export interface AppConfig {
   headers?: Record<string, string>
 }
 
-/** Identity helper — provides type inference for config files. */
+/** Identity helper: provides type inference for config files. */
 export function defineConfig(config: SupatypeProjectConfig): SupatypeProjectConfig {
   return config
 }
@@ -135,7 +136,25 @@ export function loadConfig(cwd: string = process.cwd()): SupatypeProjectConfig {
   if (localRaw === null) return base
 
   const localNorm = normalizeProjectJson(localRaw) as Partial<SupatypeProjectConfig>
-  return mergeProjectConfig(base, localNorm)
+  // Re-validated after merging: the local override can reintroduce a combination the base file was
+  // rejected for: `database.provider` beside an inherited `database.external`, say, and merging
+  // has no opinion about that.
+  return validateProjectConfig(
+    mergeProjectConfig(base, localNorm),
+    "supatype.local.config.ts (merged with supatype.config.ts)",
+  )
+}
+
+/**
+ * Environment for the child process that imports the config module.
+ *
+ * `supatype.config.ts` is TypeScript, so the natural way to keep a database password out of version
+ * control is `process.env.DATABASE_URL`: which only works if the project's `.env` is visible to the
+ * process doing the import. A real environment variable still wins over the file, matching how every
+ * other dotenv reader behaves and how Compose itself resolves the same names.
+ */
+function configLoadEnv(cwd: string): NodeJS.ProcessEnv {
+  return { ...readEnvFile(cwd), ...process.env }
 }
 
 function loadFirstTsConfig(
@@ -152,7 +171,7 @@ const mod = await import(${JSON.stringify(urlPath)})
 const config = mod.default ?? mod
 process.stdout.write(JSON.stringify(config))
 `
-    const result = evalTsSnippet(snippet, { cwd })
+    const result = evalTsSnippet(snippet, { cwd, env: configLoadEnv(cwd) })
     if (result.exitCode === 0) {
       return JSON.parse(result.stdout) as Record<string, unknown>
     }
@@ -203,7 +222,7 @@ const mod = await import(${JSON.stringify(urlPath)})
 const config = mod.default ?? mod
 process.stdout.write(JSON.stringify(config))
 `
-    const result = evalTsSnippet(snippet, { cwd })
+    const result = evalTsSnippet(snippet, { cwd, env: configLoadEnv(cwd) })
     if (result.exitCode !== 0) return null
     return JSON.parse(result.stdout) as Record<string, unknown>
   } finally {