@supatype/cli 0.1.7 → 0.1.9

package/tests/field-masking-tier.test.ts

@@ -20,7 +20,7 @@ import { apiSchemaList, validateProjectConfig, type SupatypeProjectConfig } from
  *
  * The rule is deliberately **not** "is the database external". A native `supatype dev` has no
  * extension either, and calling that tier 1 would point PostgREST at a schema whose tables the API
- * roles no longer hold privileges on — every request denied.
+ * roles no longer hold privileges on, every request denied.
  */
 const project = (database: unknown, rest: Record<string, unknown> = {}): SupatypeProjectConfig =>
   validateProjectConfig(

package/tests/homebrew-formula.test.ts

@@ -1,4 +1,5 @@
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { createHash } from "node:crypto"
 import { join } from "node:path"
 import { tmpdir } from "node:os"
 import { spawnSync } from "node:child_process"
@@ -7,19 +8,36 @@ import { afterEach, beforeEach, describe, expect, it } from "vitest"
 let counter = 0
 let tmpDir: string
 
-const PLATFORMS = [
-  "supatype-cli-darwin-arm64",
-  "supatype-cli-darwin-amd64",
-  "supatype-cli-linux-arm64",
-  "supatype-cli-linux-amd64",
+// The published artefacts: one archive per platform, plus the musl variants Homebrew does not
+// use, since Homebrew on Linux is glibc.
+const ARCHIVES = [
+  "supatype-cli-darwin-arm64.tar.gz",
+  "supatype-cli-darwin-amd64.tar.gz",
+  "supatype-cli-linux-arm64.tar.gz",
+  "supatype-cli-linux-amd64.tar.gz",
+  "supatype-cli-linux-amd64-musl.tar.gz",
+  "supatype-cli-windows-amd64.zip",
 ]
 
+const script = () => join(import.meta.dirname, "../scripts/generate-homebrew-formula.mjs")
+
+/** Write stub archives and the checksums manifest that build-release-artifacts.sh produces. */
+function writeArtifacts(names: string[]): Record<string, string> {
+  const hashes: Record<string, string> = {}
+  const lines: string[] = []
+  for (const name of names) {
+    const body = `stub-${name}\n`
+    writeFileSync(join(tmpDir, name), body, "utf8")
+    hashes[name] = createHash("sha256").update(body).digest("hex")
+    lines.push(`${hashes[name]}  ${name}`)
+  }
+  writeFileSync(join(tmpDir, "checksums.sha256"), lines.join("\n") + "\n", "utf8")
+  return hashes
+}
+
 beforeEach(() => {
   tmpDir = join(tmpdir(), `homebrew-formula-${Date.now()}-${++counter}`)
   mkdirSync(tmpDir, { recursive: true })
-  for (const name of PLATFORMS) {
-    writeFileSync(join(tmpDir, name), `stub-${name}\n`, "utf8")
-  }
 })
 
 afterEach(() => {
@@ -27,32 +45,56 @@ afterEach(() => {
 })
 
 describe("generate-homebrew-formula.mjs", () => {
-  it("writes a Formula with versioned CDN URLs and sha256 blocks", () => {
+  it("points at the published archives, with the hashes from the manifest", () => {
+    const hashes = writeArtifacts(ARCHIVES)
     const outPath = join(tmpDir, "supatype.rb")
-    const script = join(import.meta.dirname, "../scripts/generate-homebrew-formula.mjs")
-    const result = spawnSync(
-      process.execPath,
-      [script, "9.9.9", tmpDir],
-      {
-        encoding: "utf8",
-        env: { ...process.env, HOMEBREW_FORMULA_OUT: outPath },
-      },
-    )
+    const result = spawnSync(process.execPath, [script(), "9.9.9", tmpDir], {
+      encoding: "utf8",
+      env: { ...process.env, HOMEBREW_FORMULA_OUT: outPath },
+    })
 
     expect(result.status, result.stderr).toBe(0)
     const formula = readFileSync(outPath, "utf8")
+
     expect(formula).toContain('version "9.9.9"')
-    expect(formula).toContain("https://releases.supatype.com/cli/v9.9.9/supatype-cli-darwin-arm64")
-    expect(formula).toMatch(/sha256 "[a-f0-9]{64}"/)
+    expect(formula).toContain('license "Apache-2.0"')
+    expect(formula).toContain(
+      "https://releases.supatype.com/cli/v9.9.9/supatype-cli-darwin-arm64.tar.gz",
+    )
+    // The hash has to be the manifest's, not one the generator computed for itself: the manifest
+    // is the signed record of what was published.
+    expect(formula).toContain(`sha256 "${hashes["supatype-cli-darwin-arm64.tar.gz"]}"`)
+    // Every archive holds one executable called `supatype`, so there is no per-platform rename.
+    expect(formula).toContain('bin.install "supatype"')
     expect(formula).toContain('system bin/"supatype", "_postinstall"')
-    expect(formula).toContain('bin.install "supatype-cli-#{arch}" => "supatype"')
   })
 
-  it("fails when an artifact is missing", () => {
-    rmSync(join(tmpDir, "supatype-cli-linux-amd64"))
-    const script = join(import.meta.dirname, "../scripts/generate-homebrew-formula.mjs")
-    const result = spawnSync(process.execPath, [script, "1.0.0", tmpDir], { encoding: "utf8" })
+  it("does not reference the musl or windows artefacts", () => {
+    writeArtifacts(ARCHIVES)
+    const outPath = join(tmpDir, "supatype.rb")
+    const result = spawnSync(process.execPath, [script(), "9.9.9", tmpDir], {
+      encoding: "utf8",
+      env: { ...process.env, HOMEBREW_FORMULA_OUT: outPath },
+    })
+
+    expect(result.status, result.stderr).toBe(0)
+    const formula = readFileSync(outPath, "utf8")
+    expect(formula).not.toContain("musl")
+    expect(formula).not.toContain("windows")
+  })
+
+  it("fails when the manifest is missing, rather than hashing the files itself", () => {
+    writeArtifacts(ARCHIVES)
+    rmSync(join(tmpDir, "checksums.sha256"))
+    const result = spawnSync(process.execPath, [script(), "1.0.0", tmpDir], { encoding: "utf8" })
+    expect(result.status).not.toBe(0)
+    expect(result.stderr).toContain("checksums.sha256")
+  })
+
+  it("fails when the manifest omits a platform it needs", () => {
+    writeArtifacts(ARCHIVES.filter((n) => n !== "supatype-cli-linux-amd64.tar.gz"))
+    const result = spawnSync(process.execPath, [script(), "1.0.0", tmpDir], { encoding: "utf8" })
     expect(result.status).not.toBe(0)
-    expect(result.stderr).toContain("Missing artifact")
+    expect(result.stderr).toContain("No checksum for supatype-cli-linux-amd64.tar.gz")
   })
 })

package/tests/hook-upload.test.ts

@@ -86,7 +86,7 @@ describe("readHookUpload", () => {
   })
 
   it("refuses a hook with a second file rather than dropping it", () => {
-    // Silent truncation would deploy successfully and fail at import — which reads to the caller as
+    // Silent truncation would deploy successfully and fail at import, which reads to the caller as
     // that table's writes being broken for no visible reason.
     const { cwd, hooks } = project()
     writeHook(hooks, "moderate-post", HANDLER, { "helpers.ts": "export const x = 1\n" })

package/tests/hooks-generator.test.ts

@@ -71,7 +71,7 @@ export type Post = Model<{ id: UUID }, { tableName: "posts" }>
 describe("the generated module compiles", () => {
   /**
    * The generator emits TypeScript, so the only test that really proves it works is a compiler.
-   * A missing brace or a type that does not resolve would otherwise reach a user's editor — and this
+   * A missing brace or a type that does not resolve would otherwise reach a user's editor, and this
    * file is imported by their hook, so a broken emit breaks their function rather than our build.
    */
   it("typechecks under strict mode, together with a handler that uses it", () => {

package/tests/init.test.ts

@@ -329,7 +329,7 @@ describe("scaffold()", () => {
     expect(config).toContain('provider: "local"')
     expect(config).toContain("Production storage: external S3")
     const env = readFileSync(join(tmpRoot, ".env"), "utf8")
-    expect(env).toContain("local development — MinIO")
-    expect(env).toContain("production — external bucket")
+    expect(env).toContain("local development, MinIO")
+    expect(env).toContain("production, external bucket")
   })
 })

package/tests/keys.test.ts

@@ -1,5 +1,5 @@
 /**
- * Tests for `supatype keys` — JWT generation command.
+ * Tests for `supatype keys`, JWT generation command.
  * Uses subprocess tests (requires built dist/) for the CLI integration,
  * plus direct module tests for the signing logic.
  */
@@ -20,10 +20,16 @@ function runCli(
 ): { stdout: string; stderr: string; exitCode: number } {
   const result = spawnSync(process.execPath, [CLI_BIN, ...args], {
     encoding: "utf8",
-    timeout: 10_000,
+    timeout: 60_000,
     cwd: opts.cwd,
     env: { ...process.env, ...opts.env },
   })
+  if (result.signal) {
+    throw new Error(
+      `CLI subprocess killed by ${result.signal} after the spawn timeout. `
+        + `Args: ${args.join(" ")}. This is usually machine contention, not a CLI fault.`,
+    )
+  }
   return {
     stdout: String(result.stdout ?? ""),
     stderr: String(result.stderr ?? ""),

package/tests/local-secrets.test.ts

@@ -14,7 +14,7 @@ import {
 import { upsertEnvFile } from "../src/env-file.js"
 
 // The bug these exist to prevent: `supatype dev` used to pin POSTGRES_PASSWORD and JWT_SECRET
-// to published constants in `.env` on every run — the same `.env` a self-host deployment reads.
+// to published constants in `.env` on every run, the same `.env` a self-host deployment reads.
 // A generated secret survived until the developer's next `dev`, then reverted silently, and the
 // deployment went out with a secret anyone can look up.
 
@@ -32,7 +32,7 @@ describe("resolving local secrets", () => {
     expect(devAuthenticatorPassword(dir)).toBe("auth-mine")
   })
 
-  // A project with no `.env` still has to start, so the constants remain — as fallbacks only.
+  // A project with no `.env` still has to start, so the constants remain, as fallbacks only.
   it("falls back when the project has none", () => {
     const dir = project()
     expect(devJwtSecret(dir)).toBe(FALLBACK_JWT_SECRET)
@@ -43,7 +43,7 @@ describe("resolving local secrets", () => {
 
 describe("the dev env write does not clobber secrets", () => {
   // This is the regression. `upsertEnvFile` replaces any key handed to it, so the guarantee has
-  // to be that the dev path never hands it these — asserted here at the level that matters:
+  // to be that the dev path never hands it these, asserted here at the level that matters:
   // write what dev writes, then check the secrets are byte-identical.
   it("leaves generated secrets untouched across repeated writes", () => {
     const dir = project(

package/tests/model-hooks.test.ts

@@ -33,7 +33,7 @@ function addFunction(dir: string, name: string): void {
   writeFileSync(join(dir, "functions", name, "index.ts"), "export default () => new Response()", "utf8")
 }
 
-describe("model hooks — declaration", () => {
+describe("model hooks: declaration", () => {
   it("extracts both the shorthand and the options form", () => {
     const { ast } = project(`
 import type { Model, UUID } from "@supatype/types"
@@ -84,7 +84,7 @@ export type Post = Model<{ id: UUID }, {
   })
 })
 
-describe("model hooks — push-time validation", () => {
+describe("model hooks: push-time validation", () => {
   const schema = `
 import type { Model, UUID } from "@supatype/types"
 
@@ -142,7 +142,7 @@ export type Post = Model<{ id: UUID }, { tableName: "posts" }>
   })
 })
 
-describe("model hooks — manifest map", () => {
+describe("model hooks: manifest map", () => {
   const schema = `
 import type { Model, UUID } from "@supatype/types"
 
@@ -193,7 +193,7 @@ export type Post = Model<{ id: UUID }, {
 
   it("never creates a manifest from scratch", () => {
     // `functions_enabled` is a plain bool on the server's side, so a manifest carrying only hooks
-    // would read as functions *disabled* — the defect fixed one commit earlier, by another door.
+    // would read as functions *disabled*, the defect fixed one commit earlier, by another door.
     const { dir, ast } = project(schema)
     expect(syncManifestHooks(dir, ast)).toBe(false)
     expect(existsSync(join(dir, ".supatype", "manifest.json"))).toBe(false)
@@ -220,7 +220,7 @@ export type Post = Model<{ id: UUID }, { tableName: "posts" }>
   })
 })
 
-describe("model hooks — generated module on disk", () => {
+describe("model hooks: generated module on disk", () => {
   it("removes a stale module when the last hook is deleted", () => {
     // Otherwise a typed module sits there claiming tables are hooked, and a handler importing it
     // keeps compiling while never running.
@@ -250,7 +250,7 @@ export type Post = Model<{ id: UUID }, { tableName: "posts"; hooks: { beforeChan
   })
 })
 
-describe("model hooks — doctor report", () => {
+describe("model hooks: doctor report", () => {
   const schema = `
 import type { Model, UUID } from "@supatype/types"
 

package/tests/runtime-contract.test.ts

@@ -130,7 +130,7 @@ describe("runtime contract", () => {
 
   // PostgREST must connect as `authenticator`, never as POSTGRES_USER. POSTGRES_USER is
   // `supatype_admin`, a superuser, and a superuser session may SET ROLE to any role in the
-  // cluster — so a request whose JWT named one got it. Verified against a live stack: a
+  // cluster: so a request whose JWT named one got it. Verified against a live stack: a
   // token with `role: "supatype_admin"` returned every row of an RLS-protected table.
   it("self-host compose connects PostgREST as authenticator, not the superuser", () => {
     const compose = renderSelfHostCompose(baseConfig)
@@ -149,7 +149,7 @@ describe("runtime contract", () => {
   })
 
   // `supatype dev --provider docker` renders *this* file, so a `${VAR:?}` with no default
-  // takes local dev down before anything starts — `docker compose` refuses to interpolate and
+  // takes local dev down before anything starts, `docker compose` refuses to interpolate and
   // exits 1. Adding one therefore means wiring it into `upsertDevComposeEnv` as well. This
   // list is the reminder; if it fails, do that rather than just updating the list.
   it("requires only variables the dev path also sets", () => {

package/tests/service-role-check.test.ts

@@ -66,7 +66,7 @@ describe("checkServiceRoleRoutes", () => {
   })
 
   it("warns rather than fails on a hook entry", () => {
-    // It was the documented form once, and the worker grants hooks whatever the list says — so it is
+    // It was the documented form once, and the worker grants hooks whatever the list says, so it is
     // harmless, and worth saying because a reader would assume the line is what grants.
     const problems = checkServiceRoleRoutes(config(["hooks/moderate-post"]), projectWith([]))
     expect(problems.errors).toEqual([])
@@ -89,7 +89,7 @@ describe("serviceRoleProblemLines", () => {
 
   it("lists what could have been named instead", () => {
     const lines = serviceRoleProblemLines({
-      errors: ['  "x" — no functions/x/index.ts'],
+      errors: ['  "x": no functions/x/index.ts'],
       missing: ["x"],
       warnings: [],
       available: ["audit", "send-email"],
@@ -99,7 +99,7 @@ describe("serviceRoleProblemLines", () => {
 
   it("says so when there are no functions at all", () => {
     const lines = serviceRoleProblemLines({
-      errors: ['  "x" — nope'],
+      errors: ['  "x": nope'],
       missing: ["x"],
       warnings: [],
       available: [],

package/tests/storage-provision.test.ts

@@ -80,7 +80,7 @@ describe("provisionBuckets", () => {
 
     await provisionBuckets("http://localhost:54321/storage/v1", "key", [{ id: "photos", public: false }])
 
-    expect(warn).toHaveBeenCalledWith('[storage] Storage API unreachable — skipped bucket "photos"')
+    expect(warn).toHaveBeenCalledWith('[storage] Storage API unreachable, skipped bucket "photos"')
   })
 })
 

package/tests/type-extractor.test.ts

@@ -1255,8 +1255,8 @@ export type Invoice = Model<{
 
   it("extracts Code and Currency as JSONB carrying their declared shape", () => {
     // Both were exported from `@supatype/types` and rejected by the extractor, so a schema using
-    // either failed the push with "unknown type". Each carries two values — a language with its
-    // source, an amount with its currency — so JSONB is the column that does not drop one.
+    // either failed the push with "unknown type". Each carries two values, a language with its
+    // source, an amount with its currency, so JSONB is the column that does not drop one.
     const dir = mkdtempSync(join(tmpdir(), "supatype-code-currency-"))
     dirs.push(dir)
     const schemaPath = join(dir, "schema.ts")