@supatype/cli 0.1.6 → 0.1.9

package/src/service-role-check.ts

@@ -0,0 +1,111 @@
+/**
+ * Check that every name in `functions.serviceRole` is a function that exists.
+ *
+ * The grant fails **closed**: a typo, or a function that has since been renamed, means that function
+ * quietly does not receive the service-role key. Nothing breaks loudly, the handler simply reads
+ * `undefined` and whatever it does with the key stops working, at runtime, in a deploy that reported
+ * success. So the name is checked where it is declared, against the directory it must match.
+ *
+ * `serviceRoleRoutes()` claimed this was already true. It was not: nothing read the list except the two
+ * places that turn it into an env var.
+ */
+import { existsSync, readdirSync, statSync } from "node:fs"
+import { join, relative } from "node:path"
+
+import {
+  functionsPathCandidatesFromProject,
+  serviceRoleRoutes,
+  type SupatypeProjectConfig,
+} from "./project-config.js"
+
+export interface ServiceRoleProblems {
+  /** Names with no matching function. Each line is ready to print. */
+  errors: string[]
+  /** The same names, unformatted, for callers that need to mark them rather than print them. */
+  missing: string[]
+  /** Entries that are harmless but say nothing, e.g. a hook. */
+  warnings: string[]
+  /** Function names available to be granted, for the "did you mean" line. */
+  available: string[]
+}
+
+/** Function directory names, matching how the worker discovers routes. */
+function availableFunctions(dirs: readonly string[]): string[] {
+  const names = new Set<string>()
+  for (const dir of dirs) {
+    if (!existsSync(dir)) continue
+    for (const entry of readdirSync(dir)) {
+      if (entry.startsWith("_") || entry.startsWith(".")) continue
+      const full = join(dir, entry)
+      if (statSync(full).isDirectory()) {
+        if (existsSync(join(full, "index.ts"))) names.add(entry)
+      } else if (entry.endsWith(".ts") && !entry.endsWith(".d.ts")) {
+        names.add(entry.replace(/\.ts$/, ""))
+      }
+    }
+  }
+  return [...names].sort()
+}
+
+/**
+ * Resolve the declared grants against what is on disk.
+ *
+ * Returns the problems rather than throwing, so `push` can refuse while `doctor` reports alongside
+ * everything else it found.
+ */
+export function checkServiceRoleRoutes(
+  cfg: SupatypeProjectConfig,
+  cwd: string,
+): ServiceRoleProblems {
+  const declared = serviceRoleRoutes(cfg)
+  if (declared.length === 0) return { errors: [], missing: [], warnings: [], available: [] }
+
+  const dirs = functionsPathCandidatesFromProject(cfg, cwd)
+  const available = availableFunctions(dirs)
+  const known = new Set(available)
+  // Forward slashes and the candidates listed separately: joining them into one path produced
+  // "no functions or supatype\functions/send-email/index.ts", which reads as neither a path nor a list.
+  const searched = dirs.map((dir) => (relative(cwd, dir) || dir).replace(/\\/g, "/"))
+  const primary = searched[0] ?? "functions"
+
+  const errors: string[] = []
+  const missing: string[] = []
+  const warnings: string[] = []
+
+  for (const name of declared) {
+    if (name.startsWith("hooks/")) {
+      // Not an error: it was the documented form once, and the worker grants hooks whatever this says.
+      // Still worth saying, because a reader would reasonably assume the line is what does the granting.
+      warnings.push(
+        `  "${name}" is not needed, a hook receives the service-role key because only the API server ` +
+          `can reach it`,
+      )
+      continue
+    }
+    if (!known.has(name)) {
+      const where =
+        searched.length > 1 ? ` (searched ${searched.join(", ")})` : ""
+      errors.push(`  "${name}": no ${primary}/${name}/index.ts${where}`)
+      missing.push(name)
+    }
+  }
+
+  return { errors, missing, warnings, available }
+}
+
+/** The full message for a refusal, including what *is* available to name. */
+export function serviceRoleProblemLines(problems: ServiceRoleProblems): string[] {
+  if (problems.errors.length === 0) return []
+  const lines = [...problems.errors, ""]
+  lines.push(
+    problems.available.length > 0
+      ? `Functions found: ${problems.available.join(", ")}`
+      : "No functions found. Create one with: supatype functions new <name>",
+  )
+  lines.push("")
+  lines.push(
+    "A name that matches nothing grants nothing, and says so nowhere: the function reads no key at " +
+      "runtime, in a deploy that reported success.",
+  )
+  return lines
+}

package/src/storage-provision.ts

@@ -1,7 +1,7 @@
 /**
  * Provision storage buckets declared in a schema AST via the storage server API.
  *
- * The storage server is the authority on bucket existence — going through the API
+ * The storage server is the authority on bucket existence, going through the API
  * ensures it creates any backing resources (directories, S3 buckets, etc.).
  * Buckets already registered return 409 Conflict, which is treated as success.
  */
@@ -76,10 +76,10 @@ export async function provisionBuckets(
       .catch(() => null)
 
     if (res === null) {
-      console.warn(`[storage] Storage API unreachable — skipped bucket "${bucket.id}"`)
+      console.warn(`[storage] Storage API unreachable, skipped bucket "${bucket.id}"`)
       continue
     }
-    if (res.status === 409) continue // already exists — fine
+    if (res.status === 409) continue // already exists, fine
     if (!res.ok) {
       const msg = await res.text().catch(() => res.statusText)
       console.warn(`[storage] Failed to provision bucket "${bucket.id}": ${msg}`)

package/src/studio-dev-server.ts

@@ -20,7 +20,7 @@ export interface StudioDevServerOptions {
    * so fetches hit the Vite proxy (SUPATYPE_PROXY_TARGET) and avoid CORS.
    */
   viteSupatypeUrl: string
-  /** Vite `base` — `/studio/` when behind Kong at `/studio/`; `/` for native dev on :3002. */
+  /** Vite `base`: `/studio/` when behind Kong at `/studio/`; `/` for native dev on :3002. */
   basePath?: string
 }
 

package/src/systemd.ts

@@ -1,5 +1,5 @@
 /**
- * systemd.ts — generate systemd unit files for self-hosted deployments.
+ * systemd.ts: generate systemd unit files for self-hosted deployments.
  *
  * Usage:
  *   generateUnits(config, outputDir)

package/src/target-client.ts

@@ -5,6 +5,61 @@ export interface TargetFetchOptions {
   token: string
   orgId?: string | undefined
   environment?: string | undefined
+  /**
+   * Cloud-only: renew short-lived access JWT via control-plane `/auth/refresh`.
+   * Self-host SERVICE_ROLE_KEY links omit this.
+   */
+  authRefresh?: {
+    cloudApiUrl: string
+    refreshToken: string
+    onRefreshed: (tokens: { accessToken: string; refreshToken?: string }) => void
+  }
+}
+
+export class TargetApiError extends Error {
+  readonly status: number
+  readonly code?: string
+
+  constructor(message: string, status: number, code?: string) {
+    super(message)
+    this.name = "TargetApiError"
+    this.status = status
+    if (code !== undefined) this.code = code
+  }
+}
+
+function isAuthExpiry(status: number, code?: string, message?: string): boolean {
+  if (status !== 401) return false
+  if (code === "TOKEN_EXPIRED" || code === "NO_SESSION" || code === "INVALID_TOKEN") return true
+  const m = (message ?? "").toLowerCase()
+  return m.includes("token expired") || m.includes("authentication required")
+}
+
+async function refreshAccessToken(
+  authRefresh: NonNullable<TargetFetchOptions["authRefresh"]>,
+): Promise<string> {
+  const base = authRefresh.cloudApiUrl.replace(/\/$/, "")
+  const res = await fetch(`${base}/auth/refresh`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ refresh_token: authRefresh.refreshToken }),
+  })
+  const json = (await res.json().catch(() => ({}))) as {
+    access_token?: string
+    refresh_token?: string
+    message?: string
+    error?: string
+  }
+  if (!res.ok || !json.access_token) {
+    throw new Error(
+      `${json.message ?? json.error ?? "Token refresh failed"}. Run: supatype login`,
+    )
+  }
+  authRefresh.onRefreshed({
+    accessToken: json.access_token,
+    ...(json.refresh_token !== undefined ? { refreshToken: json.refresh_token } : {}),
+  })
+  return json.access_token
 }
 
 export async function targetFetch<T>(
@@ -12,29 +67,61 @@ export async function targetFetch<T>(
   apiPrefix: "/api/v1" | "/platform/v1",
   opts: TargetFetchOptions,
 ): Promise<T> {
-  const headers: Record<string, string> = {
-    "Content-Type": "application/json",
-    Authorization: `Bearer ${opts.token}`,
+  const url = `${baseUrl.replace(/\/$/, "")}${apiPrefix}${opts.path}`
+
+  const doFetch = async (token: string): Promise<{
+    ok: boolean
+    status: number
+    json: { data?: T; error?: string; message?: string; code?: string }
+  }> => {
+    const headers: Record<string, string> = {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`,
+    }
+    if (opts.orgId) headers["X-Org-Id"] = opts.orgId
+    if (opts.environment) headers["X-Supatype-Environment"] = opts.environment
+
+    const res = await fetch(url, {
+      method: opts.method,
+      headers,
+      ...(opts.body !== undefined ? { body: JSON.stringify(opts.body) } : {}),
+    })
+
+    const json = (await res.json().catch(() => ({}))) as {
+      data?: T
+      error?: string
+      message?: string
+      code?: string
+    }
+    return { ok: res.ok, status: res.status, json }
   }
-  if (opts.orgId) headers["X-Org-Id"] = opts.orgId
-  if (opts.environment) headers["X-Supatype-Environment"] = opts.environment
 
-  const url = `${baseUrl.replace(/\/$/, "")}${apiPrefix}${opts.path}`
-  const res = await fetch(url, {
-    method: opts.method,
-    headers,
-    ...(opts.body !== undefined ? { body: JSON.stringify(opts.body) } : {}),
-  })
+  let token = opts.token
+  let result = await doFetch(token)
 
-  const json = (await res.json().catch(() => ({}))) as {
-    data?: T
-    error?: string
-    message?: string
+  if (
+    !result.ok &&
+    opts.authRefresh &&
+    isAuthExpiry(result.status, result.json.code, result.json.message ?? result.json.error)
+  ) {
+    token = await refreshAccessToken(opts.authRefresh)
+    result = await doFetch(token)
   }
 
-  if (!res.ok) {
-    throw new Error(json.message ?? json.error ?? `API error: ${res.status} ${url}`)
+  if (!result.ok) {
+    const message = result.json.message ?? result.json.error ?? `API error: ${result.status} ${url}`
+    if (
+      isAuthExpiry(result.status, result.json.code, message) &&
+      !opts.authRefresh
+    ) {
+      throw new TargetApiError(
+        `${message}. Session expired, run: supatype login`,
+        result.status,
+        result.json.code,
+      )
+    }
+    throw new TargetApiError(message, result.status, result.json.code)
   }
 
-  return (json.data !== undefined ? json.data : json) as T
+  return (result.json.data !== undefined ? result.json.data : result.json) as T
 }

package/src/tsx-runner.ts

@@ -13,7 +13,7 @@ import { tmpdir } from "node:os"
 
 const _require = createRequire(import.meta.url)
 
-// The CLI's own source directory — workspace packages are
+// The CLI's own source directory, workspace packages are
 // resolvable from here. Eval snippets are written here so ESM resolution finds them.
 const CLI_SRC_DIR = dirname(fileURLToPath(import.meta.url))