spotcraft 0.0.0-stage → 0.3.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,8 @@
+Spotcraft
+Copyright 2026 Ivan Vinski
+
+This product is licensed under the Apache License, Version 2.0 (see LICENSE).
+
+The agent skills vendored in .claude/skills/ are third-party works under their own
+licenses (MIT, Apache-2.0, MPL-2.0); each skill folder carries its LICENSE, and
+skills-lock.json records the source and license of every one.

package/README.md

@@ -1,3 +1,53 @@
-# Temporary Holding Version
+# spotcraft
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The `spotcraft` command. For now it has one job: `spotcraft dev` runs, on your machine, the same
+Postgres and app database setup an app gets on a Spotcraft apps server
+([ADR 0017](https://github.com/vindotski/spotcraft/blob/main/docs/decisions/0017-local-stack.md)). It needs Docker.
+
+```bash
+npm install --save-dev spotcraft   # same version as the Spotcraft you deploy to
+npx spotcraft dev start            # start the local Postgres and set up this app's database
+npx spotcraft dev env --write      # add DATABASE_URL and AUTH_SECRET to .env (only if missing)
+```
+
+| Command             | What                                                                                  |
+| ------------------- | ------------------------------------------------------------------------------------- |
+| `dev start`         | starts the local Postgres if needed, sets up this app's database, prints its settings |
+| `dev stop`          | stops the local Postgres; the data stays                                              |
+| `dev status`        | whether it runs, and this app's `auth` schema version                                 |
+| `dev env [--write]` | prints `DATABASE_URL` and `AUTH_SECRET`; `--write` adds missing ones to `.env`        |
+| `dev reset [--yes]` | deletes this app's database and creates it empty again (asks first)                   |
+| `dev migrate`       | brings this app's database up to date after upgrading the CLI                         |
+
+How an app uses it with the kit: [Guest accounts with the backend kit](https://github.com/vindotski/spotcraft/blob/main/docs/guides/backend-kit.md).
+
+The app name comes from `--name`, or from the `name` in `package.json` made into an app name
+(`@acme/Blog_API` → `blog-api`). Its database is `app_<name>`, with dashes as underscores.
+
+## Same as the server
+
+- **One Postgres for every app on the machine.** It's a Compose project, `spotcraft-dev`, with
+  the data in the `spotcraft-dev_data` volume. Each app gets its own role and database,
+  created with the kit's `provision`, the same code the agent uses. So one app can't open
+  another's database here either.
+- **The same image and login rules** as the apps server: the pinned Postgres image, and the
+  superuser only over the container's socket. **The same admin role**: `spotcraft_agent`, set up
+  with the deploy script's SQL. Tests fail if the CLI's copies of the image, the rules or that
+  SQL drift from `infra/`.
+- **The same `auth` schema**: the CLI's version matches the Spotcraft it deploys to (one
+  version for the project).
+
+## Local only
+
+Postgres listens on `127.0.0.1:54340` only. The port isn't 54322, which Supabase uses. The
+passwords are fixed (`local-<name>-password` for an app), so `DATABASE_URL` stays the same
+across runs and in `.env`. That's fine for throwaway data on your own machine and nowhere else.
+`AUTH_SECRET` is random; `env --write` keeps the one already in `.env`.
+
+To remove everything: `docker compose -p spotcraft-dev down -v`.
+
+## Developing
+
+In the workspace, run it from source with `pnpm --filter spotcraft spotcraft dev …`. Note
+that pnpm runs it in `packages/cli`, so pass `--name`. `pnpm --filter spotcraft build`
+writes `dist/` (the `spotcraft` bin); it uses the kit's build, so build the kit first.

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export declare function main(argv: string[]): Promise<number>;

package/dist/cli.js

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+import { createInterface } from 'node:readline/promises';
+import { parseArgs } from 'node:util';
+import { appDatabaseName, authSchemaVersion, provision, purge } from '@spotcraft/kit/provision';
+import { AUTH_SCHEMA_VERSION } from '@spotcraft/kit/schema';
+import pg from 'pg';
+import { appName, localEnv, writeMissing } from "./project.js";
+import { adminUrl, appPassword, databaseUrl, down, isRunning, PORT, StackError, up, } from "./stack.js";
+const HELP = `Usage: spotcraft dev <command> [--name <app>]
+
+Runs the same Postgres and app database setup as a Spotcraft apps server, on this machine.
+
+Commands:
+  start         start the local Postgres and set up this app's database
+  stop          stop the local Postgres (the data stays)
+  status        show whether it runs and this app's database
+  env [--write] print DATABASE_URL and AUTH_SECRET; --write adds missing ones to .env
+  reset [--yes] delete this app's database and start it empty
+  migrate       bring this app's database up to date after upgrading
+
+The app name comes from --name or package.json. Needs Docker.
+`;
+const print = (line = '') => process.stdout.write(`${line}\n`);
+async function ensureRunning() {
+    if (!(await isRunning()))
+        throw new StackError('The local Postgres is not running; run `spotcraft dev start`');
+}
+/** The auth schema version of the app's database, or undefined if it doesn't exist. */
+async function appDatabaseVersion(name) {
+    const admin = new pg.Client({ connectionString: adminUrl() });
+    await admin.connect();
+    try {
+        const found = await admin.query('SELECT 1 FROM pg_database WHERE datname = $1', [
+            appDatabaseName(name),
+        ]);
+        if (!found.rowCount)
+            return undefined;
+    }
+    finally {
+        await admin.end();
+    }
+    const db = new pg.Client({ connectionString: databaseUrl(name) });
+    await db.connect();
+    try {
+        return await authSchemaVersion(db);
+    }
+    finally {
+        await db.end();
+    }
+}
+async function confirm(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        return /^y(es)?$/i.test((await rl.question(`${question} [y/N] `)).trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function main(argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        allowPositionals: true,
+        options: {
+            name: { type: 'string' },
+            write: { type: 'boolean', default: false },
+            yes: { type: 'boolean', default: false },
+            help: { type: 'boolean', short: 'h', default: false },
+        },
+    });
+    const [group, command] = positionals;
+    if (values.help || group !== 'dev' || !command) {
+        print(HELP);
+        return values.help ? 0 : 1;
+    }
+    const cwd = process.cwd();
+    switch (command) {
+        case 'start': {
+            const name = await appName(cwd, values.name);
+            await up();
+            await provision(adminUrl(), { name, password: appPassword(name) });
+            print(`Local Postgres on 127.0.0.1:${PORT}; database ${appDatabaseName(name)} is ready.`);
+            print();
+            for (const [key, value] of await localEnv(cwd, databaseUrl(name)))
+                print(`${key}=${value}`);
+            print();
+            print('Add these to .env with: spotcraft dev env --write');
+            return 0;
+        }
+        case 'stop':
+            await down();
+            print('Local Postgres stopped; the data stays.');
+            return 0;
+        case 'status': {
+            const name = await appName(cwd, values.name);
+            if (!(await isRunning())) {
+                print('Local Postgres: stopped (spotcraft dev start)');
+                return 0;
+            }
+            // Running but never set up (e.g. started by hand) reads as "no database yet".
+            const version = await appDatabaseVersion(name).catch(() => undefined);
+            print(`Local Postgres: running on 127.0.0.1:${PORT}`);
+            if (version === undefined)
+                print(`${appDatabaseName(name)}: none yet (spotcraft dev start)`);
+            else {
+                const note = version < AUTH_SCHEMA_VERSION ? ' (spotcraft dev migrate)' : '';
+                print(`${appDatabaseName(name)}: auth schema ${version} of ${AUTH_SCHEMA_VERSION}${note}`);
+            }
+            return 0;
+        }
+        case 'env': {
+            const name = await appName(cwd, values.name);
+            const env = await localEnv(cwd, databaseUrl(name));
+            if (!values.write) {
+                for (const [key, value] of env)
+                    print(`${key}=${value}`);
+                return 0;
+            }
+            const { added, kept } = await writeMissing(cwd, env);
+            if (added.length)
+                print(`Added to .env: ${added.join(', ')}`);
+            if (kept.length)
+                print(`Already in .env, left as they are: ${kept.join(', ')}`);
+            return 0;
+        }
+        case 'reset': {
+            const name = await appName(cwd, values.name);
+            await ensureRunning();
+            const db = appDatabaseName(name);
+            if (!values.yes &&
+                !(await confirm(`Delete every row in the local ${db} and start it empty?`))) {
+                print('Nothing changed.');
+                return 1;
+            }
+            await purge(adminUrl(), name);
+            await provision(adminUrl(), { name, password: appPassword(name) });
+            print(`${db} is empty again.`);
+            return 0;
+        }
+        case 'migrate': {
+            const name = await appName(cwd, values.name);
+            await ensureRunning();
+            await provision(adminUrl(), { name, password: appPassword(name) });
+            print(`${appDatabaseName(name)}: auth schema ${AUTH_SCHEMA_VERSION}.`);
+            return 0;
+        }
+        default:
+            print(HELP);
+            return 1;
+    }
+}
+// Run when executed (not when a test imports it).
+if (import.meta.main) {
+    main(process.argv.slice(2)).then((code) => process.exit(code), (error) => {
+        process.stderr.write(`spotcraft: ${error instanceof Error ? error.message : String(error)}\n`);
+        process.exit(1);
+    });
+}

package/dist/project.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The app's name: `--name`, or else the `name` in package.json, made into a Spotcraft app
+ * name (`@acme/Blog_API` → `blog-api`). Throws when neither gives a valid one.
+ */
+export declare function appName(dir: string, flag?: string): Promise<string>;
+/** KEY=value lines of a .env file (comments and blank lines skipped). */
+export declare function parseEnv(text: string): Map<string, string>;
+/** The local settings an app needs; AUTH_SECRET is kept if .env already has one. */
+export declare function localEnv(dir: string, databaseUrl: string): Promise<Map<string, string>>;
+/**
+ * Adds the variables .env doesn't have yet, at the end, and leaves every existing line alone.
+ * Returns which were added and which were already there (possibly with another value).
+ */
+export declare function writeMissing(dir: string, values: Map<string, string>): Promise<{
+    added: string[];
+    kept: string[];
+}>;

package/dist/project.js

@@ -0,0 +1,82 @@
+import { randomBytes } from 'node:crypto';
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { appDatabaseName } from '@spotcraft/kit/provision';
+/**
+ * The app's name: `--name`, or else the `name` in package.json, made into a Spotcraft app
+ * name (`@acme/Blog_API` → `blog-api`). Throws when neither gives a valid one.
+ */
+export async function appName(dir, flag) {
+    let candidate = flag;
+    if (!candidate) {
+        let pkg;
+        try {
+            pkg = JSON.parse(await readFile(join(dir, 'package.json'), 'utf8'));
+        }
+        catch {
+            throw new Error('No package.json here; pass the app name with --name');
+        }
+        if (typeof pkg.name !== 'string')
+            throw new Error('package.json has no name; pass --name');
+        candidate = pkg.name
+            .replace(/^@[^/]+\//, '')
+            .toLowerCase()
+            .replace(/[^a-z0-9-]+/g, '-')
+            .replace(/^[^a-z]+|-+$/g, '')
+            .slice(0, 32)
+            .replace(/-+$/, '');
+    }
+    try {
+        appDatabaseName(candidate);
+    }
+    catch {
+        throw new Error(`"${candidate}" is not a Spotcraft app name (lower-case letters, digits and dashes, 2–32 characters); pass --name`);
+    }
+    return candidate;
+}
+/** KEY=value lines of a .env file (comments and blank lines skipped). */
+export function parseEnv(text) {
+    const entries = new Map();
+    for (const line of text.split(/\r?\n/)) {
+        const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/.exec(line);
+        if (match)
+            entries.set(match[1], match[2].trim());
+    }
+    return entries;
+}
+async function readEnvFile(path) {
+    try {
+        return await readFile(path, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return '';
+        throw error;
+    }
+}
+/** The local settings an app needs; AUTH_SECRET is kept if .env already has one. */
+export async function localEnv(dir, databaseUrl) {
+    const existing = parseEnv(await readEnvFile(join(dir, '.env')));
+    return new Map([
+        ['DATABASE_URL', databaseUrl],
+        ['AUTH_SECRET', existing.get('AUTH_SECRET') || randomBytes(32).toString('hex')],
+    ]);
+}
+/**
+ * Adds the variables .env doesn't have yet, at the end, and leaves every existing line alone.
+ * Returns which were added and which were already there (possibly with another value).
+ */
+export async function writeMissing(dir, values) {
+    const path = join(dir, '.env');
+    const text = await readEnvFile(path);
+    const existing = parseEnv(text);
+    const added = [...values.keys()].filter((key) => !existing.has(key));
+    const kept = [...values.keys()].filter((key) => existing.has(key));
+    if (added.length > 0) {
+        const lines = added.map((key) => `${key}=${values.get(key)}`);
+        const separator = text === '' || text.endsWith('\n') ? '' : '\n';
+        const header = '# Local stack (npx spotcraft dev env --write)\n';
+        await writeFile(path, `${text}${separator}${header}${lines.join('\n')}\n`);
+    }
+    return { added, kept };
+}

package/dist/stack.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The local stack: one Postgres for every app repository on this machine, set up like the
+ * apps server's (ADR 0017). Tests keep the values below equal to the server's files.
+ */
+export declare const PROJECT = "spotcraft-dev";
+export declare const CONTAINER = "spotcraft-dev-postgres-1";
+export declare const PORT = 54340;
+/** The apps server's Postgres image (infra/apps-server/compose.yaml). */
+export declare const POSTGRES_IMAGE = "postgres:18.6-trixie@sha256:e3d24f6906d0760bf4da0dae872415391ededefad23fd471c47dc53b0ddf3c42";
+/** The apps server's login rules (infra/apps-server/pg_hba.conf). */
+export declare const PG_HBA = "# TYPE  DATABASE  USER      ADDRESS  METHOD\nlocal   all       postgres           peer\nlocal   all       all                reject\nhost    all       postgres  all      reject\nhost    all       all       all      scram-sha-256\n";
+/** The agent's role, exactly as the deploy script sets it up (infra/remote-deploy.sh). */
+export declare const ADMIN_SQL = "SELECT NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'spotcraft_agent') AS missing \\gset\n\\if :missing\n  CREATE ROLE spotcraft_agent LOGIN CREATEDB CREATEROLE PASSWORD :'pw';\n\\else\n  ALTER ROLE spotcraft_agent LOGIN CREATEDB CREATEROLE NOSUPERUSER PASSWORD :'pw';\n\\endif\n-- Roles the agent creates (one per app) are ones it may SET ROLE to, which Postgres requires\n-- to make them a database's owner; it doesn't inherit their rights.\nALTER ROLE spotcraft_agent SET createrole_self_grant = 'set';\n-- Apps get CONNECT on their own database only; the built-in ones are the agent's.\nREVOKE CONNECT ON DATABASE postgres, template1 FROM PUBLIC;\nGRANT CONNECT ON DATABASE postgres TO spotcraft_agent;\n";
+export declare const appPassword: (name: string) => string;
+export declare const adminUrl: () => string;
+/** What the app gets, as on the server but on localhost. */
+export declare function databaseUrl(name: string): string;
+/** The Compose file, as JSON (valid YAML), passed to Docker on stdin. */
+export declare function composeFile(): string;
+export interface RunResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+/** Runs a command without a shell, optionally feeding `input` on stdin. */
+export declare function run(file: string, args: string[], input?: string): Promise<RunResult>;
+export type Runner = typeof run;
+export declare class StackError extends Error {
+}
+/** Starts Postgres (if needed), waits until it is healthy, and sets up the agent's role. */
+export declare function up(runner?: Runner): Promise<void>;
+/** Stops Postgres; the data stays in its volume. */
+export declare function down(runner?: Runner): Promise<void>;
+/** Whether the local Postgres container is running. */
+export declare function isRunning(runner?: Runner): Promise<boolean>;

package/dist/stack.js

@@ -0,0 +1,138 @@
+import { spawn } from 'node:child_process';
+import { appDatabaseName } from '@spotcraft/kit/provision';
+/**
+ * The local stack: one Postgres for every app repository on this machine, set up like the
+ * apps server's (ADR 0017). Tests keep the values below equal to the server's files.
+ */
+export const PROJECT = 'spotcraft-dev';
+export const CONTAINER = `${PROJECT}-postgres-1`;
+export const PORT = 54340;
+/** The apps server's Postgres image (infra/apps-server/compose.yaml). */
+export const POSTGRES_IMAGE = 'postgres:18.6-trixie@sha256:e3d24f6906d0760bf4da0dae872415391ededefad23fd471c47dc53b0ddf3c42';
+/** The apps server's login rules (infra/apps-server/pg_hba.conf). */
+export const PG_HBA = `# TYPE  DATABASE  USER      ADDRESS  METHOD
+local   all       postgres           peer
+local   all       all                reject
+host    all       postgres  all      reject
+host    all       all       all      scram-sha-256
+`;
+/** The agent's role, exactly as the deploy script sets it up (infra/remote-deploy.sh). */
+export const ADMIN_SQL = `SELECT NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'spotcraft_agent') AS missing \\gset
+\\if :missing
+  CREATE ROLE spotcraft_agent LOGIN CREATEDB CREATEROLE PASSWORD :'pw';
+\\else
+  ALTER ROLE spotcraft_agent LOGIN CREATEDB CREATEROLE NOSUPERUSER PASSWORD :'pw';
+\\endif
+-- Roles the agent creates (one per app) are ones it may SET ROLE to, which Postgres requires
+-- to make them a database's owner; it doesn't inherit their rights.
+ALTER ROLE spotcraft_agent SET createrole_self_grant = 'set';
+-- Apps get CONNECT on their own database only; the built-in ones are the agent's.
+REVOKE CONNECT ON DATABASE postgres, template1 FROM PUBLIC;
+GRANT CONNECT ON DATABASE postgres TO spotcraft_agent;
+`;
+// Fixed local passwords keep DATABASE_URL the same across runs (and in .env). Acceptable only
+// because the port is bound to 127.0.0.1 and the data is throwaway.
+const SUPERUSER_PASSWORD = 'spotcraft-dev-superuser';
+const ADMIN_PASSWORD = 'spotcraft-dev-admin-password';
+export const appPassword = (name) => `local-${name}-password`;
+export const adminUrl = () => `postgres://spotcraft_agent:${ADMIN_PASSWORD}@127.0.0.1:${PORT}/postgres`;
+/** What the app gets, as on the server but on localhost. */
+export function databaseUrl(name) {
+    const db = appDatabaseName(name);
+    return `postgres://${db}:${appPassword(name)}@127.0.0.1:${PORT}/${db}`;
+}
+/** The Compose file, as JSON (valid YAML), passed to Docker on stdin. */
+export function composeFile() {
+    return JSON.stringify({
+        name: PROJECT,
+        services: {
+            postgres: {
+                image: POSTGRES_IMAGE,
+                restart: 'unless-stopped',
+                environment: { POSTGRES_PASSWORD: SUPERUSER_PASSWORD },
+                command: [
+                    'postgres',
+                    '-c',
+                    'hba_file=/etc/postgresql/pg_hba.conf',
+                    '-c',
+                    'password_encryption=scram-sha-256',
+                ],
+                configs: [{ source: 'pg_hba', target: '/etc/postgresql/pg_hba.conf' }],
+                ports: [`127.0.0.1:${PORT}:5432`],
+                volumes: ['data:/var/lib/postgresql'],
+                healthcheck: {
+                    test: ['CMD', 'pg_isready', '-q', '-h', '/var/run/postgresql', '-U', 'postgres'],
+                    interval: '2s',
+                    timeout: '5s',
+                    retries: 30,
+                },
+            },
+        },
+        volumes: { data: {} },
+        configs: { pg_hba: { content: PG_HBA } },
+    });
+}
+/** Runs a command without a shell, optionally feeding `input` on stdin. */
+export function run(file, args, input) {
+    return new Promise((resolve) => {
+        const child = spawn(file, args, { stdio: ['pipe', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.on('data', (chunk) => {
+            stdout += chunk;
+        });
+        child.stderr.on('data', (chunk) => {
+            stderr += chunk;
+        });
+        child.on('error', (error) => resolve({ code: 127, stdout, stderr: error.message }));
+        child.on('close', (code) => resolve({ code: code ?? 1, stdout, stderr }));
+        child.stdin.end(input ?? '');
+    });
+}
+export class StackError extends Error {
+}
+/** Docker Compose for the local stack; the file comes on stdin. */
+async function compose(runner, args) {
+    return runner('docker', ['compose', '-p', PROJECT, '-f', '-', ...args], composeFile());
+}
+function fail(what, result) {
+    throw new StackError(`${what}\n${`${result.stderr}${result.stdout}`.trim()}`);
+}
+/** Starts Postgres (if needed), waits until it is healthy, and sets up the agent's role. */
+export async function up(runner = run) {
+    const docker = await runner('docker', ['version', '--format', '{{.Server.Version}}']);
+    if (docker.code !== 0)
+        fail('Docker is not running (the local stack needs it).', docker);
+    const started = await compose(runner, ['up', '-d', '--wait', '--wait-timeout', '120']);
+    if (started.code !== 0)
+        fail('Could not start the local Postgres.', started);
+    // As the OS user `postgres`: the superuser only logs in over the socket with `peer`.
+    const role = await runner('docker', [
+        'exec',
+        '-i',
+        '-u',
+        'postgres',
+        CONTAINER,
+        'psql',
+        '-q',
+        '-v',
+        'ON_ERROR_STOP=1',
+        '-U',
+        'postgres',
+        '-d',
+        'postgres',
+    ], `\\set pw ${ADMIN_PASSWORD}\n${ADMIN_SQL}`);
+    if (role.code !== 0)
+        fail("Could not set up the agent's role.", role);
+}
+/** Stops Postgres; the data stays in its volume. */
+export async function down(runner = run) {
+    const stopped = await compose(runner, ['stop']);
+    if (stopped.code !== 0)
+        fail('Could not stop the local Postgres.', stopped);
+}
+/** Whether the local Postgres container is running. */
+export async function isRunning(runner = run) {
+    const state = await runner('docker', ['inspect', '--format', '{{.State.Running}}', CONTAINER]);
+    return state.code === 0 && state.stdout.trim() === 'true';
+}

package/package.json

@@ -1,6 +1,52 @@
 {
   "name": "spotcraft",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.0",
+  "description": "The spotcraft command: run the Spotcraft apps server's database setup locally",
+  "keywords": [
+    "spotcraft",
+    "cli",
+    "postgres",
+    "local-development"
+  ],
+  "homepage": "https://spotcraft.dev",
+  "bugs": {
+    "url": "https://github.com/vindotski/spotcraft/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vindotski/spotcraft.git",
+    "directory": "packages/cli"
+  },
+  "license": "Apache-2.0",
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "files": [
+    "LICENSE",
+    "NOTICE",
+    "dist"
+  ],
+  "bin": {
+    "spotcraft": "./dist/cli.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc",
+    "test": "node --conditions=spotcraft-source --test 'test/**/*.test.ts'",
+    "spotcraft": "node --conditions=spotcraft-source src/cli.ts",
+    "prepack": "node -e \"const fs = require('node:fs'); if (!fs.existsSync('dist')) throw new Error('Build first: pnpm --recursive run build'); for (const f of ['LICENSE', 'NOTICE']) fs.copyFileSync('../../' + f, f)\""
+  },
+  "dependencies": {
+    "@spotcraft/kit": "0.3.0",
+    "pg": "^8.23.1"
+  },
+  "devDependencies": {
+    "@types/node": "catalog:",
+    "@types/pg": "^8.23.1",
+    "typescript": "catalog:"
+  }
+}