spine-framework 0.3.36 → 0.3.38

package/.framework/cli/commands/init.ts

@@ -213,7 +213,7 @@ export function registerInitCommands(program: Command) {
 function getPackageVersion(): string {
   try {
     const pkg = JSON.parse(
-      require('fs').readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf8')
+      readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf8')
     )
     return pkg.version || '0.3.0'
   } catch {

package/.framework/cli/commands/migrate.ts

@@ -5,137 +5,140 @@
  * @layer cli
  * @stability stable
  *
- * `spine-framework migrate` — applies pending SQL migrations to the configured
- * Supabase project using the Supabase Management API and direct DB connection.
+ * `spine-framework migrate` — Apply SQL migrations to a Supabase project
+ * via a direct Postgres connection.
  *
- * Reads migration files from `.framework/migrations/` and `custom/migrations/`
- * in order, skipping any already tracked in `spine_migrations` table.
+ * Requires SUPABASE_DB_PASSWORD in .env (or --db-password flag).
+ * Get it from: https://supabase.com/dashboard/project/_/settings/database
  *
  * **Usage:**
  * ```bash
  * npx spine-framework migrate
  * npx spine-framework migrate --dry-run
+ * npx spine-framework migrate --db-password <password>
  * ```
  */
 
 import type { Command } from 'commander'
-import { readFileSync, readdirSync, existsSync } from 'fs'
-import { resolve, dirname, join, basename } from 'path'
+import { existsSync, readdirSync, readFileSync } from 'fs'
+import { resolve, dirname, join } from 'path'
 import { fileURLToPath } from 'url'
-import { createClient } from '@supabase/supabase-js'
 
 const __filename = fileURLToPath(import.meta.url)
 const __dirname = dirname(__filename)
 const PACKAGE_ROOT = resolve(__dirname, '../../../')
 const PROJECT_ROOT = process.cwd()
 
+interface MigrateOptions {
+  dbPassword?: string
+  dryRun: boolean
+  frameworkOnly: boolean
+}
+
+async function migrateCommand(options: MigrateOptions): Promise<void> {
+  console.log('\nRunning Spine Framework migrations...\n')
+
+  // Load .env from project root
+  loadEnv()
+
+  const supabaseUrl = process.env.SUPABASE_URL
+  if (!supabaseUrl || supabaseUrl.includes('placeholder') || supabaseUrl.includes('your-project')) {
+    console.error('Error: SUPABASE_URL not set. Edit your .env file first.')
+    console.error('  Get it from: https://supabase.com/dashboard/project/_/settings/api')
+    process.exit(1)
+  }
+
+  const dbPassword = options.dbPassword || process.env.SUPABASE_DB_PASSWORD
+  if (!dbPassword) {
+    console.error('Error: SUPABASE_DB_PASSWORD not set.')
+    console.error('  Add it to .env or pass --db-password <password>')
+    console.error('  Get it from: https://supabase.com/dashboard/project/_/settings/database')
+    process.exit(1)
+  }
+
+  const projectRef = supabaseUrl.replace('https://', '').split('.')[0]
+  const connectionString = `postgresql://postgres:${dbPassword}@db.${projectRef}.supabase.co:5432/postgres`
+
+  // Collect migration files
+  const migrationFiles = collectMigrations(options.frameworkOnly)
+
+  if (migrationFiles.length === 0) {
+    console.log('No migration files found.')
+    return
+  }
+
+  console.log(`  Found ${migrationFiles.length} migration file(s)\n`)
+
+  if (options.dryRun) {
+    for (const file of migrationFiles) {
+      console.log(`  [dry-run] Would apply: ${file.name}`)
+    }
+    console.log('\nDry run complete — no changes made.\n')
+    return
+  }
+
+  // Dynamically import pg to avoid loading it at module init time
+  const { default: pg } = await import('pg')
+  const client = new pg.Client({ connectionString })
+
+  try {
+    await client.connect()
+    console.log('  Connected to database\n')
+  } catch (err: any) {
+    console.error(`Error: Could not connect to database: ${err.message}`)
+    console.error('  Check your SUPABASE_DB_PASSWORD and that the project is active.')
+    process.exit(1)
+  }
+
+  let applied = 0
+  let failed = 0
+
+  for (const { name, path } of migrationFiles) {
+    const sql = readFileSync(path, 'utf8')
+    process.stdout.write(`  Applying ${name}... `)
+
+    const statements = splitSqlStatements(sql)
+
+    try {
+      for (const stmt of statements) {
+        await client.query(stmt)
+      }
+      console.log('✓')
+      applied++
+    } catch (err: any) {
+      console.log('✗')
+      console.error(`    ${err.message}`)
+      failed++
+    }
+  }
+
+  await client.end()
+
+  console.log(`\n  ${applied} applied, ${failed} failed`)
+
+  if (failed > 0) {
+    console.error('\nSome migrations failed. Check errors above.')
+    process.exit(1)
+  }
+
+  console.log('\n✅ All migrations applied successfully!\n')
+  console.log('Next steps:')
+  console.log('  npx spine-framework install-app spine-framework-portal@latest')
+  console.log('  npm install && npm run assemble && netlify dev\n')
+}
+
 export function registerMigrateCommands(program: Command) {
   program
     .command('migrate')
     .description('Apply pending database migrations to your Supabase project')
+    .option('--db-password <password>', 'DB password (default: reads SUPABASE_DB_PASSWORD from .env)')
     .option('--dry-run', 'Show pending migrations without applying them', false)
     .option('--framework-only', 'Only apply .framework/migrations/, skip custom/', false)
     .action(async (opts) => {
-      console.log('\nRunning Spine Framework migrations...\n')
-
-      // Load env
-      loadEnv()
-
-      const supabaseUrl = process.env.SUPABASE_URL
-      const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY
-
-      if (!supabaseUrl || !serviceRoleKey) {
-        console.error('Error: SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY must be set in .env')
-        console.error('Run: npx spine-framework init  to create a .env template')
-        process.exit(1)
-      }
-
-      const db = createClient(supabaseUrl, serviceRoleKey, {
-        auth: { persistSession: false },
-        db: { schema: 'public' },
-      })
-
       try {
-        // Ensure tracking table exists
-        await ensureMigrationsTable(db)
-
-        // Collect migration files in order
-        const migrationFiles = collectMigrations(opts.frameworkOnly)
-
-        if (migrationFiles.length === 0) {
-          console.log('No migration files found.')
-          process.exit(0)
-        }
-
-        // Get already-applied migrations
-        const { data: applied, error: fetchErr } = await db
-          .from('spine_migrations')
-          .select('filename')
-          .order('applied_at', { ascending: true })
-
-        if (fetchErr) throw new Error(`Could not read migration state: ${fetchErr.message}`)
-
-        const appliedSet = new Set((applied || []).map((r: any) => r.filename))
-
-        const pending = migrationFiles.filter(f => !appliedSet.has(basename(f)))
-
-        if (pending.length === 0) {
-          console.log('✓ All migrations already applied. Nothing to do.\n')
-          process.exit(0)
-        }
-
-        console.log(`Found ${pending.length} pending migration(s):\n`)
-        for (const f of pending) {
-          console.log(`  ○ ${basename(f)}`)
-        }
-        console.log()
-
-        if (opts.dryRun) {
-          console.log('Dry run — no changes made.\n')
-          process.exit(0)
-        }
-
-        // Apply each pending migration
-        let applied_count = 0
-        for (const filepath of pending) {
-          const filename = basename(filepath)
-          process.stdout.write(`  Applying ${filename}...`)
-
-          const sql = readFileSync(filepath, 'utf8')
-
-          // Execute via rpc exec_sql or direct query
-          const { error } = await db.rpc('exec_sql' as any, { sql }).single()
-
-          if (error) {
-            // exec_sql may not exist — fall back to running via REST
-            const fallbackResult = await applyViaMigrationEndpoint(supabaseUrl, serviceRoleKey, sql)
-            if (!fallbackResult.ok) {
-              console.log(' ✗')
-              console.error(`\nFailed to apply ${filename}: ${fallbackResult.error}`)
-              console.error('\nFallback: Apply this migration manually in the Supabase SQL editor:')
-              console.error(`  ${filepath}`)
-              process.exit(1)
-            }
-          }
-
-          // Track as applied
-          await db.from('spine_migrations').insert({
-            filename,
-            applied_at: new Date().toISOString(),
-          })
-
-          console.log(' ✓')
-          applied_count++
-        }
-
-        console.log(`\n✅ Applied ${applied_count} migration(s) successfully.\n`)
-
-        if (applied_count > 0) {
-          console.log('Next: npx spine-framework status  — to verify the installation\n')
-        }
-
+        await migrateCommand(opts)
       } catch (err: any) {
-        console.error('\n❌ Migration failed:', err.message)
+        console.error('Error:', err.message)
         if (process.env.SPINE_CLI_DEBUG) console.error(err.stack)
         process.exit(1)
       }
@@ -155,87 +158,64 @@ function loadEnv() {
     if (eqIdx === -1) continue
     const key = trimmed.slice(0, eqIdx).trim()
     const val = trimmed.slice(eqIdx + 1).trim()
-    if (key && !(key in process.env)) {
-      process.env[key] = val
-    }
+    if (key && !(key in process.env)) process.env[key] = val
   }
 }
 
-async function ensureMigrationsTable(db: any) {
-  // Create tracking table if it doesn't exist
-  await db.rpc('exec_sql' as any, {
-    sql: `
-      CREATE TABLE IF NOT EXISTS public.spine_migrations (
-        id SERIAL PRIMARY KEY,
-        filename TEXT NOT NULL UNIQUE,
-        applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
-      );
-    `
-  })
-  // Ignore errors — table may already exist or exec_sql may not exist yet
-  // We'll handle this via the fallback path
-}
+function collectMigrations(frameworkOnly: boolean): { name: string; path: string }[] {
+  const files: { name: string; path: string }[] = []
 
-function collectMigrations(frameworkOnly: boolean): string[] {
-  const files: string[] = []
-
-  // Framework migrations (from installed package or local .framework/)
+  // Framework migrations (prefer local .framework/ copy, fall back to package)
   const fwMigrationsDir = existsSync(join(PROJECT_ROOT, '.framework/migrations'))
     ? join(PROJECT_ROOT, '.framework/migrations')
     : join(PACKAGE_ROOT, '.framework/migrations')
 
   if (existsSync(fwMigrationsDir)) {
-    const fwFiles = readdirSync(fwMigrationsDir)
+    readdirSync(fwMigrationsDir)
       .filter(f => f.endsWith('.sql') && !f.startsWith('.'))
       .sort()
-      .map(f => join(fwMigrationsDir, f))
-    files.push(...fwFiles)
+      .forEach(f => files.push({ name: f, path: join(fwMigrationsDir, f) }))
   }
 
-  // Custom migrations (from project's custom/migrations/)
+  // Custom migrations
   if (!frameworkOnly) {
     const customMigrationsDir = join(PROJECT_ROOT, 'custom/migrations')
     if (existsSync(customMigrationsDir)) {
-      const customFiles = readdirSync(customMigrationsDir)
+      readdirSync(customMigrationsDir)
         .filter(f => f.endsWith('.sql') && !f.startsWith('.'))
         .sort()
-        .map(f => join(customMigrationsDir, f))
-      files.push(...customFiles)
+        .forEach(f => files.push({ name: f, path: join(customMigrationsDir, f) }))
     }
   }
 
   return files
 }
 
-async function applyViaMigrationEndpoint(
-  supabaseUrl: string,
-  serviceRoleKey: string,
-  sql: string
-): Promise<{ ok: boolean; error?: string }> {
-  try {
-    // Use Supabase's REST SQL endpoint
-    const projectRef = supabaseUrl.match(/https:\/\/([^.]+)\.supabase\.co/)?.[1]
-    if (!projectRef) return { ok: false, error: 'Could not parse project ref from SUPABASE_URL' }
-
-    const res = await fetch(
-      `https://api.supabase.com/v1/projects/${projectRef}/database/query`,
-      {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          'Authorization': `Bearer ${serviceRoleKey}`,
-        },
-        body: JSON.stringify({ query: sql }),
-      }
-    )
+function splitSqlStatements(sql: string): string[] {
+  const dollarBlocks: string[] = []
+  let blockIndex = 0
 
-    if (!res.ok) {
-      const body = await res.text()
-      return { ok: false, error: `API error ${res.status}: ${body}` }
-    }
+  // Protect dollar-quoted blocks (they can contain semicolons)
+  const protectedSql = sql.replace(/\$[A-Za-z_]*\$[\s\S]*?\$[A-Za-z_]*\$/g, (match) => {
+    const placeholder = `__DOLLAR_BLOCK_${blockIndex}__`
+    dollarBlocks[blockIndex] = match
+    blockIndex++
+    return placeholder
+  })
 
-    return { ok: true }
-  } catch (err: any) {
-    return { ok: false, error: err.message }
-  }
+  // Strip single-line comments
+  const noComments = protectedSql.replace(/--[^\n]*/g, '')
+
+  // Split by semicolons and restore dollar blocks
+  return noComments
+    .split(';')
+    .map(s => {
+      let restored = s.trim()
+      dollarBlocks.forEach((block, idx) => {
+        restored = restored.replace(`__DOLLAR_BLOCK_${idx}__`, () => block)
+      })
+      return restored
+    })
+    .filter(s => s.length > 0)
+    .map(s => s + ';')
 }

package/.framework/migrations/003_system_data.sql

@@ -20,22 +20,7 @@ VALUES (
   NULL
 );
 
--- ============================================
--- 2. MASTER SYSTEM ACCOUNT
--- ============================================
-
-INSERT INTO public.accounts (id, slug, display_name, description, data, is_active, design_schema, validation_schema, type_id)
-VALUES (
-  gen_random_uuid(),
-  'spine-system',
-  'Spine System',
-  'Master system account for internal Spine operations',
-  '{}'::jsonb,
-  true,
-  '{}'::jsonb,
-  '{}'::jsonb,
-  gen_random_uuid()  -- placeholder, will update after types seeded
-);
+-- NOTE: System account inserted after types are seeded (section 5) to satisfy FK constraint.
 
 -- ============================================
 -- 3. SYSTEM APP (spine-core)
@@ -143,6 +128,21 @@ BEGIN
     true
   );
 
+  -- 2. MASTER SYSTEM ACCOUNT (inserted here to satisfy FK on type_id)
+  INSERT INTO public.accounts (id, slug, display_name, description, data, is_active, design_schema, validation_schema, type_id)
+  SELECT
+    gen_random_uuid(),
+    'spine-system',
+    'Spine System',
+    'Master system account for internal Spine operations',
+    '{}'::jsonb,
+    true,
+    '{}'::jsonb,
+    '{}'::jsonb,
+    id
+  FROM public.types WHERE slug = 'account' LIMIT 1
+  ON CONFLICT (slug) DO NOTHING;
+
   -- 5.2 people type
   INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
   VALUES (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spine-framework",
-  "version": "0.3.36",
+  "version": "0.3.38",
   "description": "Multi-tenant, modular application platform for modern SaaS systems",
   "type": "module",
   "bin": {
@@ -77,6 +77,7 @@
   "dependencies": {
     "tsx": "^4.21.0",
     "ws": "^8.18.0",
+    "pg": "^8.13.0",
     "@base-ui/react": "^1.4.1",
     "@fontsource-variable/inter": "^5.2.8",
     "@heroicons/react": "^2.2.0",