@ticket-gate/supabase-next 0.0.0-stage → 0.1.0-rc.1

package/mutations/sql-object.mjs

@@ -0,0 +1,214 @@
+// The `object` form of a registry `sql` entry (the schema-snapshot form).
+//
+// A function guard is `object` + `find` + `replace`: the entry names the
+// function, and the run edits `pg_get_functiondef(<object>)` instead of
+// carrying a whole `create or replace function` copy that goes stale when the
+// function changes. This module checks an entry against the committed schema
+// snapshot (supabase/schema/) and expands it into the SQL `applySql` runs.
+//
+// Library only; no CLI. `check-mutations.mjs` calls `checkSqlEntry` and
+// `checkProtects` per entry, `mutate-check.mjs` calls `checkSqlEntry` and
+// `expandSql`. The object grammar (`parseObject`) and the JS matcher
+// (`locate`) are mutate-check's; the Postgres ARE builder here is
+// `sqlFindPattern`.
+import { locate } from '#engine/mutations/locate.mjs';
+import { parseObject, snapshotPath } from './sql-kind.mjs';
+
+export const WHOLE_BODY =
+  /\bcreate\s+(?:or\s+replace\s+)?(?:function|procedure)\b|\bpg_get_functiondef\b/i;
+
+// One statement of a grant / revoke / default-privileges / cron apply (or the
+// PostgREST schema-reload notify that follows a grant), after
+// an optional `do $x$ begin` or `execute '` wrapper is peeled off.
+const PRIVILEGE_STATEMENT =
+  /^(?:(?:grant|revoke|alter\s+default\s+privileges|select\s+cron\.(?:schedule|unschedule))\b|perform\s+pg_notify\(\s*'pgrst'\s*,)/i;
+
+function peel(statement) {
+  return statement
+    .replace(/^\s*do\s+\$[A-Za-z0-9_]*\$/i, '')
+    .replace(/^\s*begin\b/i, '')
+    .replace(/^\s*execute\s+'/i, '')
+    .replace(/'\s*$/, '')
+    .replace(/^\s*end\s+\$[A-Za-z0-9_]*\$\s*$/i, '')
+    .trim();
+}
+
+/** True when every statement of an apply is a grant, revoke, default-privileges or cron call. */
+export const PRIVILEGE_ONLY = {
+  test(apply) {
+    const parts = String(apply)
+      .split(';')
+      .map(peel)
+      .filter((s) => s !== '');
+    return parts.length > 0 && parts.every((s) => PRIVILEGE_STATEMENT.test(s));
+  },
+};
+
+const WS_RUN = /\s+/g;
+
+/** A Postgres ARE for `find`: every whitespace run matches `[[:space:]]+`, every other character is literal. */
+export function sqlFindPattern(find) {
+  const escaped = find.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return escaped.replace(WS_RUN, '[[:space:]]+');
+}
+
+/** Text between `AS $tag$` and the closing `$tag$` of a function snapshot, or null. */
+export function functionBody(snapshot) {
+  const open = /\bAS\s+(\$[A-Za-z0-9_]*\$)/.exec(snapshot);
+  if (!open) return null;
+  const from = open.index + open[0].length;
+  const end = snapshot.indexOf(open[1], from);
+  return end === -1 ? null : snapshot.slice(from, end);
+}
+
+/** True when the table snapshot names the trigger, policy or constraint of `o`. */
+function hasNamedObject(text, o) {
+  const kinds =
+    o.kind === 'constraint' ? 'CONSTRAINT|FK CONSTRAINT' : o.kind.toUpperCase();
+  const header = new RegExp(
+    `^-- Name: ${o.table} ${o.name}; Type: (?:${kinds});`,
+    'm',
+  );
+  if (header.test(text)) return true;
+  return (
+    o.kind === 'constraint' && new RegExp(`\\bCONSTRAINT ${o.name} `).test(text)
+  );
+}
+
+const edits = (entry) => [
+  entry,
+  ...(Array.isArray(entry.also) ? entry.also : []),
+];
+const TABLE_KINDS = new Set(['trigger', 'policy', 'constraint']);
+
+/**
+ * Why an sql entry is not valid, one string each; [] when valid. Shape rules
+ * always; snapshot rules unless `opts.shapeOnly` (a key new on this branch).
+ * `readFile(path)` returns the text or throws when the file is missing.
+ */
+export function checkSqlEntry(entry, readFile, opts = {}) {
+  const errors = [];
+  if (WHOLE_BODY.test(entry.apply ?? ''))
+    errors.push(
+      'whole-body apply: a function edit uses object + find + replace',
+    );
+  if (entry.object === undefined && !PRIVILEGE_ONLY.test(entry.apply ?? ''))
+    errors.push(
+      'apply without object: only grants, revokes and cron are object-less',
+    );
+  const own = parseObject(entry.object);
+  const hasFind = entry.find !== undefined;
+  if (own?.kind === 'function' && hasFind)
+    for (const [i, e] of edits(entry).entries()) {
+      const at = i === 0 ? entry.object : `also[${i - 1}] ${e.object}`;
+      if (parseObject(e.object)?.kind !== 'function')
+        errors.push(`${at}: find and replace edit a function object`);
+      if (typeof e.find !== 'string' || e.find === '')
+        errors.push(`${at}: find must be a non-empty string`);
+      if (typeof e.replace !== 'string')
+        errors.push(`${at}: replace must be a string`);
+    }
+  else if (own?.kind === 'function' && !PRIVILEGE_ONLY.test(entry.apply ?? ''))
+    errors.push(
+      `function object without find: edit it with find + replace; apply alone is only for grants`,
+    );
+  if (own && own.kind !== 'function' && (hasFind || entry.also !== undefined))
+    errors.push(
+      `${entry.object}: only a function object takes find, replace or also`,
+    );
+  if (own && own.kind === 'cron' && !PRIVILEGE_ONLY.test(entry.apply ?? ''))
+    errors.push('cron object: apply must be cron.schedule or cron.unschedule');
+  if (opts.shapeOnly) return errors;
+
+  for (const edit of edits(entry)) {
+    const o = parseObject(edit.object);
+    if (!o) continue;
+    const file = snapshotPath(edit.object)[0];
+    let text = null;
+    try {
+      text = readFile(file);
+    } catch {
+      text = null;
+    }
+    const exists = text !== null;
+    if (!exists) {
+      errors.push(`unknown object ${edit.object}: ${file} does not exist`);
+      continue;
+    }
+    if (o.kind === 'function') {
+      const header = `-- Name: ${o.name}(${o.args}); Type: FUNCTION;`;
+      if (!text.includes(header)) {
+        errors.push(`unknown object ${edit.object}: no "${header}" in ${file}`);
+        continue;
+      }
+      if (typeof edit.find !== 'string' || edit.find === '') continue;
+      const body = functionBody(text.slice(text.indexOf(header)));
+      const n = body === null ? 0 : locate(body, edit.find).count;
+      if (n !== 1)
+        errors.push(
+          `find occurs ${n} times in the body of ${edit.object}, must be exactly 1`,
+        );
+    } else if (TABLE_KINDS.has(o.kind)) {
+      if (!hasNamedObject(text, o))
+        errors.push(`unknown object ${entry.object} in ${file}`);
+    }
+  }
+  return errors;
+}
+
+export { checkProtects } from '#engine/mutations/kinds.mjs';
+
+// A dollar tag whose `$tag$` occurs in none of `texts`.
+function freeTag(texts, taken = []) {
+  for (let i = 0; ; i++) {
+    const tag = `m${i === 0 ? '' : i}`;
+    if (!taken.includes(tag) && !texts.some((t) => t.includes(`$${tag}$`)))
+      return tag;
+  }
+}
+
+/** The SQL `applySql` receives for an entry. */
+export function expandSql(entry) {
+  if (entry.find === undefined) return entry.apply;
+  const list = edits(entry);
+  const patterns = list.map((e) => sqlFindPattern(e.find));
+  const texts = [
+    entry.apply ?? '',
+    ...patterns,
+    ...list.map((e) => e.find),
+    ...list.map((e) => e.replace),
+  ];
+  const outer = freeTag(texts);
+  const inner = freeTag(texts, [outer]);
+  const q = (s) => `$${inner}$${s}$${inner}$`;
+  const groups = new Map();
+  list.forEach((e, i) => {
+    groups.set(e.object, [...(groups.get(e.object) ?? []), i]);
+  });
+  const body = [];
+  for (const [object, idx] of groups) {
+    const o = parseObject(object);
+    const label = object.replace(/%/g, '%%');
+    body.push(
+      `d := pg_get_functiondef('${o.schema}.${o.name}(${o.args})'::regprocedure);`,
+      // Edit the body only (prosrc, the last text in the definition): a find in the signature is never meant.
+      `b := (select prosrc from pg_proc where oid = '${o.schema}.${o.name}(${o.args})'::regprocedure);`,
+      'k := length(d) - strpos(reverse(d), reverse(b)) - length(b) + 2;',
+      `if substr(d, k, length(b)) <> b then raise exception 'mutation cannot locate the body of ${label}'; end if;`,
+      'h := substr(d, 1, k - 1); t := substr(d, k + length(b));',
+    );
+    for (const i of idx) {
+      const p = q(patterns[i]);
+      const r = q(list[i].replace.replace(/\\/g, '\\\\'));
+      body.push(
+        `if regexp_count(b, ${p}) <> 1 then raise exception 'mutation find occurs % times in ${label}', regexp_count(b, ${p}); end if;`,
+        `n := regexp_replace(b, ${p}, ${r});`,
+        `if n = b then raise exception 'mutation replace changed nothing in ${label}'; end if;`,
+        'b := n;',
+      );
+    }
+    body.push('execute h || b || t;');
+  }
+  const block = `do $${outer}$ declare d text; n text; b text; h text; t text; k int; begin\n${body.join('\n')}\nend $${outer}$;`;
+  return entry.apply ? `${entry.apply.trimEnd()}\n${block}` : block;
+}

package/nightly/stack-payload.mjs

@@ -0,0 +1,48 @@
+// The Supabase stack as a nightly payload: docker must be up, the
+// stack must already be running (the nightly never starts it), it is reset
+// before the suites and again after them for the main checkout.
+import { spawnSync } from 'node:child_process';
+
+export const dockerInfo = async () =>
+  spawnSync('docker', ['info'], { stdio: 'ignore', timeout: 10_000 }).status ===
+  0;
+
+export function supabaseStack({ preflight, reset } = {}) {
+  if (
+    !Array.isArray(preflight) ||
+    preflight.length === 0 ||
+    !Array.isArray(reset) ||
+    reset.length === 0
+  )
+    throw new TypeError(
+      'supabase-next: supabaseStack needs preflight and reset argv arrays',
+    );
+  return {
+    name: 'supabase-stack',
+    io: { dockerUp: dockerInfo },
+    async preflight(main, io) {
+      if (!(await io.dockerUp())) return { reason: 'docker-down' };
+      return { ok: true };
+    },
+    async before(wt, io) {
+      const pre = await io.run(preflight[0], preflight.slice(1), {
+        cwd: wt,
+        limitS: 180,
+      });
+      if (pre.code !== 0) return { reason: 'stack-down', runAfter: false };
+      const rst = await io.run(reset[0], reset.slice(1), {
+        cwd: wt,
+        limitS: 600,
+      });
+      if (rst.code !== 0) return { reason: 'reset-failed', runAfter: true };
+      return { ok: true };
+    },
+    async after(main, io) {
+      const fr = await io.run(reset[0], reset.slice(1), {
+        cwd: main,
+        limitS: 600,
+      });
+      return fr.code === 0 ? 'pass' : 'fail';
+    },
+  };
+}

package/package.json

@@ -1,6 +1,21 @@
 {
   "name": "@ticket-gate/supabase-next",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0-rc.1",
+  "description": "The Supabase and Next.js pack for @ticket-gate/engine.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "engines": { "node": ">=22" },
+  "exports": {
+    "./*": "./*",
+    "./package.json": "./package.json"
+  },
+  "imports": { "#engine/*": "@ticket-gate/engine/*" },
+  "dependencies": { "@ticket-gate/engine": "0.1.0-rc.1" },
+  "files": ["*", "!test"],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dmitry-prohorov/ticket-gate.git",
+    "directory": "packages/supabase-next"
+  },
+  "publishConfig": { "access": "public", "provenance": true }
+}

package/profile-build.mjs

@@ -0,0 +1,10 @@
+const NEXT = 'npx --no-install next';
+
+/** The profiling build of a Next.js app in the `app` directory. */
+export const nextProfiling = ({ app }) => ({
+  command: `cd ${app} && ${NEXT} build --profile --no-mangling`,
+  unmangle: '--no-mangling',
+  start: `cd ${app} && ${NEXT} start`,
+  port: 3000,
+  noBuildLabel: 'unknown (existing server on :3000)',
+});

package/profile-hooks.mjs

@@ -0,0 +1,72 @@
+// Supabase hooks for the React profiler: reset the local database, read the
+// magic link from Mailpit, and the two service probes.
+import {
+  runBounded,
+  stackPreflight,
+} from './checks/stack-preflight.mjs';
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/** Reset the local db. Re-checks the stack first (a red stack throws, no reset) and bounds the reset to 300 s. */
+export async function dbReset(io) {
+  const problems = await io.checkStack(['db']);
+  if (problems.length > 0) throw new Error(`dbReset: ${problems.join('; ')}`);
+  const r = await io.run('pnpm db:reset', { limitS: 300 });
+  if (r.timedOut === true) throw new Error('dbReset: TIMEOUT after 300 s');
+  if (r.code !== 0 && r.code !== undefined)
+    throw new Error(`dbReset: pnpm db:reset exited ${r.code}`);
+}
+
+export function mailpitMagicLink({ mailUrl, email }) {
+  return async (since) => {
+    for (let i = 0; i < 40; i++) {
+      await sleep(500);
+      const query = encodeURIComponent(`to:"${email}"`);
+      const list = await (
+        await fetch(`${mailUrl}/api/v1/search?query=${query}`, {
+          signal: AbortSignal.timeout(10_000),
+        })
+      ).json();
+      const m = (list.messages ?? []).find(
+        (x) => Date.parse(x.Created) >= since - 2000,
+      );
+      if (!m) continue;
+      const msg = await (
+        await fetch(`${mailUrl}/api/v1/message/${m.ID}`, {
+          signal: AbortSignal.timeout(10_000),
+        })
+      ).json();
+      await fetch(`${mailUrl}/api/v1/messages`, {
+        method: 'DELETE',
+        body: JSON.stringify({ IDs: [m.ID] }),
+        signal: AbortSignal.timeout(10_000),
+      });
+      const url = (msg.Text ?? '').match(/https?:\/\/\S+\/auth\/v1\/verify\S*/);
+      if (url) return url[0];
+    }
+    throw new Error(`no magic link for ${email} in Mailpit (${mailUrl})`);
+  };
+}
+
+/** `stack` is { ...STACK_PREFLIGHT, services }. */
+export function profileHooks({ root, stack, apiUrl, mailUrl, email }) {
+  const checked = stackPreflight({ ...stack, root });
+  const io = {
+    checkStack: async (steps) =>
+      (await checked.checkStack({ steps }, checked.realIo(root))).problems,
+    run: (cmd, opts) => runBounded(cmd, { cwd: root, ...opts }),
+  };
+  const problems = {
+    noSupabase: `the Supabase API (${apiUrl}) does not answer: pnpm supabase start`,
+    noMailpit: `Mailpit (${mailUrl}) does not answer: pnpm supabase start`,
+  };
+  return {
+    reset: () => dbReset(io),
+    magicLink: mailpitMagicLink({ mailUrl, email }),
+    services: [
+      { url: `${apiUrl}/auth/v1/health`, problem: problems.noSupabase },
+      { url: `${mailUrl}/livez`, problem: problems.noMailpit },
+    ],
+    problems,
+  };
+}

package/score.mjs

@@ -0,0 +1,26 @@
+// The base-worktree install of a pnpm workspace package: the `baseInstall` a score
+// config needs, built from the package name or filter pattern.
+
+/**
+ * A `score.baseInstall` that installs `filter` and the packages it depends on, frozen
+ * to the lockfile. The marker is written only after a successful install.
+ */
+export function pnpmFilterInstall(filter) {
+  if (typeof filter !== "string" || filter === "" || /[\s'"`]/.test(filter))
+    throw new Error(
+      "pnpmFilterInstall: filter must be a package name or pattern",
+    );
+  return {
+    cmd: "pnpm",
+    args: [
+      "install",
+      "--frozen-lockfile",
+      "--prefer-offline",
+      "--filter",
+      `${filter}...`,
+    ],
+    label: "pnpm install",
+    hint: `pnpm install --frozen-lockfile --filter '${filter}...'`,
+    marker: ".ticket-gate-install-done",
+  };
+}

package/selection/next-routes.mjs

@@ -0,0 +1,40 @@
+import { listFiles } from '#engine/graph/js.mjs';
+
+// ---------------------------------------------------------------- graph root and check
+
+/** @param {string} relToApp path relative to the app dir; '*' = shell entry, null = orphan */
+export function routeAreaIn(table, relToApp) {
+  let best = null;
+  for (const [prefix, area] of table) {
+    if (!relToApp.startsWith(prefix)) continue;
+    if (best === null || prefix.length > best[0].length) best = [prefix, area];
+  }
+  return best ? best[1] : null;
+}
+
+/**
+ * The Next app router as a graph Root and a Check: entries() maps each route file to its area,
+ * run() reports an unmapped route (orphan) and counts the entries.
+ */
+export function nextAppRoutes({ appDir, entryRe, routeAreas }) {
+  const routes = (root) =>
+    listFiles(root, appDir, (p) =>
+      entryRe.test(p.slice(appDir.length + 1)),
+    ).map((file) => ({
+      file,
+      area: routeAreaIn(routeAreas, file.slice(appDir.length + 1)),
+    }));
+  return {
+    name: 'next-routes',
+    entries: (root) => routes(root).filter((e) => e.area !== null),
+    run(root) {
+      const all = routes(root);
+      return {
+        problems: all
+          .filter((e) => e.area === null)
+          .map((e) => `orphan-route ${e.file.slice(appDir.length + 1)}`),
+        entries: all.length,
+      };
+    },
+  };
+}

package/selection/supabase-rules.mjs

@@ -0,0 +1,18 @@
+/**
+ * The Supabase Edge Functions as a selection rule. Any change under `dir` is a full run
+ * except a function that has its own area (`areas`: sub-path prefix -> area), which adds only
+ * that area. Runs after the triggers, so the shared function config files stay triggers.
+ */
+export function supabaseFunctions({ dir, areas }) {
+  return {
+    name: 'supabase-functions',
+    stage: 'after-triggers',
+    rule(path) {
+      if (!path.startsWith(dir)) return null;
+      const sub = path.slice(dir.length);
+      for (const [prefix, area] of Object.entries(areas))
+        if (sub.startsWith(prefix)) return { areas: [area] };
+      return { full: 'function' };
+    },
+  };
+}

package/selection/workspace-exports.mjs

@@ -0,0 +1,44 @@
+import { posix } from 'node:path';
+
+/**
+ * A workspace package as a resolver: `name` -> `${dir}/src/index.ts`, `name/sub` through the
+ * package.json exports map (dist/ mirrors src/), else the same path under src/.
+ * @param {string} name package name, e.g. '@scope/pkg'
+ * @param {string} dir package directory relative to the repo root
+ */
+export function workspaceExports(name, dir) {
+  const src = `${dir}/src`;
+  // One exports map per graph (ctx), not per process: config.mjs builds this resolver once.
+  const maps = new WeakMap();
+  const target = (sub, ctx) => {
+    if (!maps.has(ctx)) {
+      let exp = {};
+      try {
+        exp = JSON.parse(ctx.readText(`${dir}/package.json`)).exports ?? {};
+      } catch {
+        exp = {};
+      }
+      maps.set(ctx, exp);
+    }
+    const e = maps.get(ctx)[`./${sub}`];
+    const t = typeof e === 'string' ? e : (e?.types ?? e?.import);
+    const m =
+      typeof t === 'string' ? /^\.\/dist\/(.+?)(\.d\.ts|\.js)$/.exec(t) : null;
+    return m ? m[1] : null;
+  };
+  return {
+    name: `workspace ${name}`,
+    resolve(spec, _from, ctx) {
+      if (spec === name) {
+        const file = posix.join(src, 'index.ts');
+        return ctx.exists(file) ? { file } : { unresolved: true };
+      }
+      if (!spec.startsWith(`${name}/`)) return null;
+      const sub = spec.slice(name.length + 1);
+      const mapped = target(sub, ctx);
+      let out = ctx.viaTs(`./${mapped ?? sub}`, `${src}/_.ts`);
+      if (!out && mapped) out = ctx.viaTs(`./${sub}`, `${src}/_.ts`);
+      return out ?? { unresolved: true };
+    },
+  };
+}