@chimerai/cli 0.2.73

package/dist/commands/setup.js

@@ -0,0 +1,788 @@
+"use strict";
+/**
+ * Setup Command - Configure integrations
+ * REFACTORED: Provider setup creates DB entries (Phase 2), falls back to .env
+ * REFACTORED PHASE 4: Uses shared updateEnvFile() from utils
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupCommand = setupCommand;
+const inquirer_1 = __importDefault(require("inquirer"));
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const path_1 = __importDefault(require("path"));
+const provider_db_js_1 = require("../utils/provider-db.js");
+const utils_js_1 = require("../utils.js");
+const templates = __importStar(require("../templates/index.js"));
+async function setupCommand(service, options = { dir: '.' }) {
+    console.log(chalk_1.default.bold.cyan(`\n⚙️  Setting up ${service} integration\n`));
+    const targetDir = (0, utils_js_1.resolveTargetDir)(options.dir);
+    switch (service) {
+        case 'database':
+            await setupDatabase(targetDir);
+            break;
+        case 'auth':
+            await setupAuth(targetDir);
+            break;
+        case 'openai':
+            await setupOpenAI(targetDir);
+            break;
+        case 'anthropic':
+            await setupAnthropic(targetDir);
+            break;
+        case 'ollama':
+            await setupOllama(targetDir);
+            break;
+        case 'providers':
+            await setupProviders(targetDir);
+            break;
+        case 'azure':
+            await setupAzure(targetDir);
+            break;
+        case 'stripe':
+            await setupStripe(targetDir);
+            break;
+        case 'permissions':
+            await setupPermissions(targetDir);
+            break;
+        default:
+            console.log(chalk_1.default.red(`❌ Unknown service: ${service}`));
+            console.log(chalk_1.default.yellow('\nAvailable services:'));
+            console.log(chalk_1.default.white('  - database'));
+            console.log(chalk_1.default.white('  - auth'));
+            console.log(chalk_1.default.white('  - openai'));
+            console.log(chalk_1.default.white('  - anthropic'));
+            console.log(chalk_1.default.white('  - ollama'));
+            console.log(chalk_1.default.white('  - azure'));
+            console.log(chalk_1.default.white('  - providers (configure all AI providers)'));
+            console.log(chalk_1.default.white('  - stripe (billing)'));
+            console.log(chalk_1.default.white('  - permissions (RBAC system)'));
+            (0, utils_js_1.handleCliError)(`Unknown service: ${service}`);
+    }
+    console.log(chalk_1.default.bold.green(`\n✨ ${service} setup complete!\n`));
+}
+async function setupDatabase(targetDir) {
+    const answers = await inquirer_1.default.prompt([
+        {
+            type: 'list',
+            name: 'provider',
+            message: 'Which database provider?',
+            choices: ['postgresql', 'mysql', 'sqlite'],
+            default: 'postgresql',
+        },
+        {
+            type: 'input',
+            name: 'url',
+            message: 'Database connection URL:',
+            default: 'postgresql://user:password@localhost:5432/chimerai',
+        },
+    ]);
+    const spinner = (0, ora_1.default)('Configuring database...').start();
+    try {
+        await (0, utils_js_1.updateEnvFile)({ DATABASE_URL: answers.url }, path_1.default.join(targetDir, '.env.local'));
+        // === Scaffold Prisma schema if it doesn't exist ===
+        const schemaPath = path_1.default.join(targetDir, 'prisma', 'schema.prisma');
+        if (!(await fs_extra_1.default.pathExists(schemaPath))) {
+            await fs_extra_1.default.ensureDir(path_1.default.join(targetDir, 'prisma'));
+            const baseSchema = `generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "${answers.provider}"
+  url      = env("DATABASE_URL")
+}
+`;
+            await fs_extra_1.default.writeFile(schemaPath, baseSchema);
+            console.log(chalk_1.default.cyan(`\n  📄 Created prisma/schema.prisma (provider: ${answers.provider})`));
+        }
+        // === Create lib/prisma.ts (PrismaClient singleton) if not present ===
+        const prismaLibPath = path_1.default.join(targetDir, 'lib', 'prisma.ts');
+        if (!(await fs_extra_1.default.pathExists(prismaLibPath))) {
+            await fs_extra_1.default.ensureDir(path_1.default.join(targetDir, 'lib'));
+            await fs_extra_1.default.writeFile(prismaLibPath, templates.generatePrismaLib());
+            console.log(chalk_1.default.cyan(`  📄 Created lib/prisma.ts`));
+        }
+        // === Add Prisma dependencies + scripts to package.json ===
+        const packageJsonPath = path_1.default.join(targetDir, 'package.json');
+        if (await fs_extra_1.default.pathExists(packageJsonPath)) {
+            const packageJson = await fs_extra_1.default.readJson(packageJsonPath);
+            let depsChanged = false;
+            packageJson.dependencies = packageJson.dependencies || {};
+            packageJson.devDependencies = packageJson.devDependencies || {};
+            if (!packageJson.dependencies['@prisma/client']) {
+                packageJson.dependencies['@prisma/client'] = '^5.22.0';
+                depsChanged = true;
+            }
+            if (!packageJson.devDependencies['prisma']) {
+                packageJson.devDependencies['prisma'] = '^5.22.0';
+                depsChanged = true;
+            }
+            packageJson.scripts = packageJson.scripts || {};
+            if (!packageJson.scripts['db:push']) {
+                packageJson.scripts['db:push'] = 'prisma db push';
+            }
+            if (!packageJson.scripts['db:generate']) {
+                packageJson.scripts['db:generate'] = 'prisma generate';
+            }
+            if (!packageJson.scripts['db:studio']) {
+                packageJson.scripts['db:studio'] = 'prisma studio';
+            }
+            await fs_extra_1.default.writeJson(packageJsonPath, packageJson, { spaces: 2 });
+            if (depsChanged) {
+                console.log(chalk_1.default.cyan(`  📦 Added @prisma/client + prisma to package.json`));
+                console.log(chalk_1.default.yellow(`  → Run: pnpm install`));
+            }
+        }
+        spinner.succeed(chalk_1.default.green('Database configured'));
+        console.log(chalk_1.default.cyan('\nNext steps:'));
+        console.log(chalk_1.default.white('  1. Run: pnpm install'));
+        console.log(chalk_1.default.white('  2. Run: pnpm db:push'));
+        console.log(chalk_1.default.white('  3. Run: pnpm db:seed (optional)'));
+    }
+    catch (error) {
+        spinner.fail(chalk_1.default.red('Failed to configure database'));
+        console.error(error.message);
+    }
+}
+async function setupAuth(targetDir) {
+    const answers = await inquirer_1.default.prompt([
+        {
+            type: 'input',
+            name: 'secret',
+            message: 'NextAuth secret (leave empty to generate):',
+            default: '',
+        },
+        {
+            type: 'input',
+            name: 'url',
+            message: 'NextAuth URL:',
+            default: 'http://localhost:3000',
+        },
+    ]);
+    const spinner = (0, ora_1.default)('Configuring authentication...').start();
+    try {
+        const secret = answers.secret || generateRandomSecret();
+        await (0, utils_js_1.updateEnvFile)({
+            NEXTAUTH_SECRET: secret,
+            NEXTAUTH_URL: answers.url,
+        }, path_1.default.join(targetDir, '.env.local'));
+        spinner.succeed(chalk_1.default.green('Authentication configured in .env'));
+    }
+    catch (error) {
+        spinner.fail(chalk_1.default.red('Failed to configure authentication'));
+        console.error(error.message);
+    }
+}
+async function setupOpenAI(targetDir) {
+    const answers = await inquirer_1.default.prompt([
+        {
+            type: 'password',
+            name: 'apiKey',
+            message: 'OpenAI API Key:',
+            mask: '*',
+        },
+    ]);
+    // 1. Validate key
+    const validateSpinner = (0, ora_1.default)('Validating API Key...').start();
+    const validation = await (0, provider_db_js_1.validateOpenAIKey)(answers.apiKey);
+    if (validation.valid) {
+        validateSpinner.succeed(chalk_1.default.green(`API Key valid (${validation.modelCount} models available)`));
+    }
+    else {
+        validateSpinner.warn(chalk_1.default.yellow('Could not validate key (offline?) — saving anyway'));
+    }
+    // 2. Try to create provider in database
+    const dbSpinner = (0, ora_1.default)('Creating provider in database...').start();
+    const dbSuccess = await (0, provider_db_js_1.createProviderInDB)({
+        targetDir,
+        providerId: 'cli-openai',
+        name: 'OpenAI',
+        type: 'openai',
+        description: 'Configured via ChimerAI CLI',
+        apiKey: answers.apiKey,
+        baseUrl: 'https://api.openai.com/v1',
+        isDefault: true,
+        priority: 1,
+        models: provider_db_js_1.OPENAI_MODELS,
+    });
+    if (dbSuccess) {
+        dbSpinner.succeed(chalk_1.default.green('Provider "OpenAI" created in database'));
+        console.log(chalk_1.default.green(`  ✓ Models registered: ${provider_db_js_1.OPENAI_MODELS.map((m) => m.modelId).join(', ')}`));
+        console.log(chalk_1.default.green('  ✓ Set as default provider'));
+        console.log(chalk_1.default.cyan(`\n  Manage at: ${chalk_1.default.white('http://localhost:3000/providers')}`));
+    }
+    else {
+        dbSpinner.warn(chalk_1.default.yellow('Could not create provider in database'));
+        console.log(chalk_1.default.gray('  Database might not be running — falling back to .env'));
+        // 3. Fallback: Write to .env
+        await (0, utils_js_1.updateEnvFile)({ OPENAI_API_KEY: answers.apiKey }, path_1.default.join(targetDir, '.env.local'));
+        console.log(chalk_1.default.green('  ✓ OpenAI API Key saved to .env.local'));
+        console.log(chalk_1.default.cyan('  💡 Run ') +
+            chalk_1.default.white('chimerai doctor --fix') +
+            chalk_1.default.cyan(' to migrate to database later'));
+    }
+}
+async function setupProviders(targetDir) {
+    console.log(chalk_1.default.bold.cyan('\n🔌 Configure AI Model Providers\n'));
+    const answers = await inquirer_1.default.prompt([
+        {
+            type: 'checkbox',
+            name: 'providers',
+            message: 'Which providers do you want to configure?',
+            choices: [
+                { name: 'OpenAI', value: 'openai', checked: true },
+                { name: 'Anthropic', value: 'anthropic', checked: true },
+                { name: 'Azure OpenAI', value: 'azure', checked: false },
+                { name: 'Ollama (local)', value: 'ollama', checked: false },
+            ],
+        },
+    ]);
+    for (const provider of answers.providers) {
+        console.log(chalk_1.default.cyan(`\n→ Configuring ${provider}...\n`));
+        switch (provider) {
+            case 'openai':
+                await setupOpenAI(targetDir);
+                break;
+            case 'anthropic':
+                await setupAnthropic(targetDir);
+                break;
+            case 'azure':
+                await setupAzure(targetDir);
+                break;
+            case 'ollama':
+                await setupOllama(targetDir);
+                break;
+        }
+    }
+    console.log(chalk_1.default.bold.green('\n✨ All providers configured!'));
+    console.log(chalk_1.default.cyan('\nNext steps:'));
+    console.log(chalk_1.default.white('  1. Add provider configurations to database'));
+    console.log(chalk_1.default.white('  2. Test connections at /providers-demo'));
+    console.log(chalk_1.default.white('  3. Discover available models'));
+}
+async function setupAzure(targetDir) {
+    const answers = await inquirer_1.default.prompt([
+        {
+            type: 'input',
+            name: 'apiKey',
+            message: 'Azure OpenAI API Key:',
+        },
+        {
+            type: 'input',
+            name: 'endpoint',
+            message: 'Azure OpenAI Endpoint:',
+            default: 'https://your-resource.openai.azure.com',
+        },
+        {
+            type: 'input',
+            name: 'deployment',
+            message: 'Deployment name:',
+            default: 'gpt-4',
+        },
+    ]);
+    const spinner = (0, ora_1.default)('Configuring Azure OpenAI...').start();
+    try {
+        await (0, utils_js_1.updateEnvFile)({
+            AZURE_OPENAI_API_KEY: answers.apiKey,
+            AZURE_OPENAI_ENDPOINT: answers.endpoint,
+            AZURE_OPENAI_DEPLOYMENT: answers.deployment,
+        }, path_1.default.join(targetDir, '.env.local'));
+        spinner.succeed(chalk_1.default.green('Azure OpenAI configured in .env.local'));
+    }
+    catch (error) {
+        spinner.fail(chalk_1.default.red('Failed to configure Azure OpenAI'));
+        console.error(error.message);
+    }
+}
+async function setupStripe(targetDir) {
+    const answers = await inquirer_1.default.prompt([
+        {
+            type: 'input',
+            name: 'publishableKey',
+            message: 'Stripe Publishable Key:',
+        },
+        {
+            type: 'input',
+            name: 'secretKey',
+            message: 'Stripe Secret Key:',
+        },
+        {
+            type: 'input',
+            name: 'webhookSecret',
+            message: 'Stripe Webhook Secret (optional):',
+            default: '',
+        },
+    ]);
+    const spinner = (0, ora_1.default)('Configuring Stripe...').start();
+    try {
+        const envVars = {
+            STRIPE_PUBLISHABLE_KEY: answers.publishableKey,
+            STRIPE_SECRET_KEY: answers.secretKey,
+        };
+        if (answers.webhookSecret) {
+            envVars.STRIPE_WEBHOOK_SECRET = answers.webhookSecret;
+        }
+        await (0, utils_js_1.updateEnvFile)(envVars, path_1.default.join(targetDir, '.env.local'));
+        spinner.succeed(chalk_1.default.green('Stripe configured in .env.local'));
+        console.log(chalk_1.default.cyan('\nNext steps:'));
+        console.log(chalk_1.default.white('  1. Test webhook: stripe listen --forward-to localhost:3000/api/webhooks/stripe'));
+        console.log(chalk_1.default.white('  2. Create products in Stripe Dashboard'));
+        console.log(chalk_1.default.white('  3. Configure pricing tiers in your app'));
+    }
+    catch (error) {
+        spinner.fail(chalk_1.default.red('Failed to configure Stripe'));
+        console.error(error.message);
+    }
+}
+async function setupAnthropic(targetDir) {
+    const answers = await inquirer_1.default.prompt([
+        {
+            type: 'password',
+            name: 'apiKey',
+            message: 'Anthropic API Key:',
+            mask: '*',
+        },
+    ]);
+    // 1. Validate key
+    const validateSpinner = (0, ora_1.default)('Validating API Key...').start();
+    const validation = await (0, provider_db_js_1.validateAnthropicKey)(answers.apiKey);
+    if (validation.valid) {
+        validateSpinner.succeed(chalk_1.default.green('API Key valid'));
+    }
+    else {
+        validateSpinner.warn(chalk_1.default.yellow('Could not validate key (offline?) — saving anyway'));
+    }
+    // 2. Try to create provider in database
+    const dbSpinner = (0, ora_1.default)('Creating provider in database...').start();
+    const dbSuccess = await (0, provider_db_js_1.createProviderInDB)({
+        targetDir,
+        providerId: 'cli-anthropic',
+        name: 'Anthropic',
+        type: 'anthropic',
+        description: 'Configured via ChimerAI CLI',
+        apiKey: answers.apiKey,
+        baseUrl: 'https://api.anthropic.com/v1',
+        isDefault: false,
+        priority: 2,
+        models: provider_db_js_1.ANTHROPIC_MODELS,
+    });
+    if (dbSuccess) {
+        dbSpinner.succeed(chalk_1.default.green('Provider "Anthropic" created in database'));
+        console.log(chalk_1.default.green(`  ✓ Models registered: ${provider_db_js_1.ANTHROPIC_MODELS.map((m) => m.modelId).join(', ')}`));
+        console.log(chalk_1.default.cyan(`\n  Manage at: ${chalk_1.default.white('http://localhost:3000/providers')}`));
+    }
+    else {
+        dbSpinner.warn(chalk_1.default.yellow('Could not create provider in database'));
+        console.log(chalk_1.default.gray('  Database might not be running — falling back to .env'));
+        await (0, utils_js_1.updateEnvFile)({ ANTHROPIC_API_KEY: answers.apiKey }, path_1.default.join(targetDir, '.env.local'));
+        console.log(chalk_1.default.green('  ✓ Anthropic API Key saved to .env.local'));
+        console.log(chalk_1.default.cyan('  💡 Run ') +
+            chalk_1.default.white('chimerai doctor --fix') +
+            chalk_1.default.cyan(' to migrate to database later'));
+    }
+}
+async function setupOllama(targetDir) {
+    const answers = await inquirer_1.default.prompt([
+        {
+            type: 'input',
+            name: 'url',
+            message: 'Ollama API URL:',
+            default: 'http://localhost:11434',
+        },
+    ]);
+    // 1. Validate connection + discover models
+    const validateSpinner = (0, ora_1.default)('Connecting to Ollama...').start();
+    const validation = await (0, provider_db_js_1.validateOllamaConnection)(answers.url);
+    if (validation.valid) {
+        validateSpinner.succeed(chalk_1.default.green(`Connected! ${validation.models.length} models available`));
+        if (validation.models.length > 0) {
+            console.log(chalk_1.default.gray(`  Models: ${validation.models.slice(0, 5).join(', ')}${validation.models.length > 5 ? '...' : ''}`));
+        }
+    }
+    else {
+        validateSpinner.warn(chalk_1.default.yellow(`Could not connect to Ollama at ${answers.url}`));
+        console.log(chalk_1.default.gray('  Make sure Ollama is running: ollama serve'));
+    }
+    // 2. Build model definitions from discovered models (or empty)
+    const ollamaModels = validation.models.map((name) => ({
+        modelId: `ollama/${name}`,
+        name: name,
+        capabilities: ['chat'],
+        contextWindow: 4096,
+        inputCost: 0,
+        outputCost: 0,
+    }));
+    // 3. Try to create provider in database
+    const dbSpinner = (0, ora_1.default)('Creating provider in database...').start();
+    const dbSuccess = await (0, provider_db_js_1.createProviderInDB)({
+        targetDir,
+        providerId: 'cli-ollama',
+        name: 'Ollama (Local)',
+        type: 'ollama',
+        description: 'Local Ollama instance',
+        baseUrl: answers.url,
+        isDefault: false,
+        priority: 10,
+        models: ollamaModels,
+    });
+    if (dbSuccess) {
+        dbSpinner.succeed(chalk_1.default.green('Provider "Ollama" created in database'));
+        if (ollamaModels.length > 0) {
+            console.log(chalk_1.default.green(`  ✓ ${ollamaModels.length} models registered`));
+        }
+        console.log(chalk_1.default.cyan(`\n  Manage at: ${chalk_1.default.white('http://localhost:3000/providers')}`));
+    }
+    else {
+        dbSpinner.warn(chalk_1.default.yellow('Could not create provider in database'));
+        console.log(chalk_1.default.gray('  Database might not be running — falling back to .env'));
+        await (0, utils_js_1.updateEnvFile)({ OLLAMA_API_URL: answers.url }, path_1.default.join(targetDir, '.env.local'));
+        console.log(chalk_1.default.green('  ✓ Ollama URL saved to .env.local'));
+        console.log(chalk_1.default.cyan('  💡 Run ') +
+            chalk_1.default.white('chimerai doctor --fix') +
+            chalk_1.default.cyan(' to migrate to database later'));
+    }
+}
+function generateRandomSecret() {
+    return Array.from({ length: 32 }, () => Math.floor(Math.random() * 16).toString(16)).join('');
+}
+async function setupPermissions(targetDir) {
+    const spinner = (0, ora_1.default)('Setting up RBAC permissions system...').start();
+    try {
+        // 1. Create lib/permissions.ts - Core permission utilities
+        const permissionsUtilContent = `/**
+ * Permission utility functions
+ * Handles permission checks and role-based access control
+ */
+
+export const AVAILABLE_PERMISSIONS = [
+  'users:read',
+  'users:write',
+  'users:delete',
+  'roles:read',
+  'roles:write',
+  'roles:delete',
+  'settings:read',
+  'settings:write',
+  'admin:*',
+] as const;
+
+export type Permission = typeof AVAILABLE_PERMISSIONS[number];
+
+interface User {
+  id: string;
+  email: string;
+  roles?: Array<{ permissions: string[] }>;
+}
+
+/**
+ * Check if user has a specific permission
+ */
+export function hasPermission(user: User | null, permission: string): boolean {
+  if (!user || !user.roles) return false;
+
+  // Collect all permissions from all roles
+  const allPermissions = user.roles.flatMap(role => role.permissions || []);
+
+  // Check for admin wildcard
+  if (allPermissions.includes('admin:*')) return true;
+
+  // Check for specific permission
+  return allPermissions.includes(permission);
+}
+
+/**
+ * Check if user has ANY of the specified permissions
+ */
+export function hasAnyPermission(user: User | null, permissions: string[]): boolean {
+  if (!user) return false;
+  return permissions.some(permission => hasPermission(user, permission));
+}
+
+/**
+ * Check if user has ALL of the specified permissions
+ */
+export function hasAllPermissions(user: User | null, permissions: string[]): boolean {
+  if (!user) return false;
+  return permissions.every(permission => hasPermission(user, permission));
+}
+
+/**
+ * Get all permissions for a user (from all their roles)
+ */
+export function getUserPermissions(user: User | null): string[] {
+  if (!user || !user.roles) return [];
+  return [...new Set(user.roles.flatMap(role => role.permissions || []))];
+}
+
+/**
+ * Check if a permission string is valid
+ */
+export function isValidPermission(permission: string): boolean {
+  return AVAILABLE_PERMISSIONS.includes(permission as Permission);
+}
+`;
+        await fs_extra_1.default.ensureDir(path_1.default.join(targetDir, 'lib'));
+        await fs_extra_1.default.writeFile(path_1.default.join(targetDir, 'lib/permissions.ts'), permissionsUtilContent);
+        // 2. Create lib/auth/require-permission.ts - Server-side helper
+        const requirePermissionContent = `import { getServerSession } from 'next-auth';
+import { NextResponse } from 'next/server';
+import { hasPermission } from '@/lib/permissions';
+
+/**
+ * Server-side permission check for API routes
+ * Returns NextResponse with 401/403 if check fails
+ */
+export async function requirePermission(permission: string) {
+  const session = await getServerSession();
+
+  if (!session || !session.user) {
+    return NextResponse.json(
+      { error: 'Unauthorized - Please sign in' },
+      { status: 401 }
+    );
+  }
+
+  // Get user with roles from database
+  const user = await getServerSessionWithPermissions();
+
+  if (!user || !hasPermission(user as any, permission)) {
+    return NextResponse.json(
+      { error: \`Forbidden - Required permission: \${permission}\` },
+      { status: 403 }
+    );
+  }
+
+  return null; // No error, permission granted
+}
+
+/**
+ * Get server session with full user data including roles
+ */
+export async function getServerSessionWithPermissions() {
+  const session = await getServerSession();
+  if (!session?.user?.email) return null;
+
+  // Fetch user with roles from database (through UserRole join table)
+  const { prisma } = await import('@/lib/prisma');
+  const user = await prisma.user.findUnique({
+    where: { email: session.user.email },
+    include: {
+      roles: {
+        select: {
+          role: {
+            select: {
+              id: true,
+              name: true,
+              permissions: true
+            }
+          }
+        }
+      }
+    }
+  });
+
+  if (!user) return null;
+
+  // Flatten UserRole[] → { permissions: string[] }[]
+  return {
+    ...user,
+    roles: (user.roles as any[]).map((ur: any) => ur.role),
+  };
+}
+`;
+        await fs_extra_1.default.ensureDir(path_1.default.join(targetDir, 'lib/auth'));
+        await fs_extra_1.default.writeFile(path_1.default.join(targetDir, 'lib/auth/require-permission.ts'), requirePermissionContent);
+        // 3. Create hooks/usePermissions.ts - Client-side hook
+        const usePermissionsContent = `'use client';
+
+import { useSession } from 'next-auth/react';
+import { useMemo } from 'react';
+import { hasPermission, hasAnyPermission, hasAllPermissions, getUserPermissions } from '@/lib/permissions';
+
+/**
+ * Client-side hook for permission checks
+ * Usage:
+ *   const { hasPermission, permissions } = usePermissions();
+ *   if (hasPermission('users:write')) { ... }
+ */
+export function usePermissions() {
+  const { data: session } = useSession();
+  const user = session?.user as any;
+
+  const permissions = useMemo(() => getUserPermissions(user), [user]);
+
+  return {
+    /**
+     * Check if current user has a specific permission
+     */
+    hasPermission: (permission: string) => hasPermission(user, permission),
+
+    /**
+     * Check if current user has ANY of the permissions
+     */
+    hasAnyPermission: (perms: string[]) => hasAnyPermission(user, perms),
+
+    /**
+     * Check if current user has ALL of the permissions
+     */
+    hasAllPermissions: (perms: string[]) => hasAllPermissions(user, perms),
+
+    /**
+     * All permissions the user has (from all roles)
+     */
+    permissions,
+
+    /**
+     * Is user admin (has admin:* permission)
+     */
+    isAdmin: permissions.includes('admin:*'),
+
+    /**
+     * Is session loading
+     */
+    isLoading: !session,
+  };
+}
+
+/**
+ * Simple hook to check a single permission
+ * Usage: const canWrite = useHasPermission('users:write');
+ */
+export function useHasPermission(permission: string): boolean {
+  const { hasPermission } = usePermissions();
+  return hasPermission(permission);
+}
+`;
+        await fs_extra_1.default.ensureDir(path_1.default.join(targetDir, 'hooks'));
+        await fs_extra_1.default.writeFile(path_1.default.join(targetDir, 'hooks/usePermissions.ts'), usePermissionsContent);
+        // 4. Create components/PermissionGate.tsx - Conditional rendering component
+        const permissionGateContent = `'use client';
+
+import { usePermissions } from '@/hooks/usePermissions';
+import { ReactNode } from 'react';
+
+interface PermissionGateProps {
+  /** Required permission */
+  permission?: string;
+  /** List of permissions (requires ANY by default) */
+  permissions?: string[];
+  /** If true, requires ALL permissions instead of ANY */
+  requireAll?: boolean;
+  /** Content to show if user has permission */
+  children: ReactNode;
+  /** Optional fallback content if permission denied */
+  fallback?: ReactNode;
+}
+
+/**
+ * Conditionally render content based on permissions
+ *
+ * Usage:
+ *   <PermissionGate permission="users:write">
+ *     <button>Edit User</button>
+ *   </PermissionGate>
+ */
+export function PermissionGate({
+  permission,
+  permissions,
+  requireAll = false,
+  children,
+  fallback = null,
+}: PermissionGateProps) {
+  const { hasPermission, hasAnyPermission, hasAllPermissions } = usePermissions();
+
+  let hasAccess = false;
+
+  if (permission) {
+    hasAccess = hasPermission(permission);
+  } else if (permissions) {
+    hasAccess = requireAll
+      ? hasAllPermissions(permissions)
+      : hasAnyPermission(permissions);
+  }
+
+  return <>{hasAccess ? children : fallback}</>;
+}
+`;
+        await fs_extra_1.default.ensureDir(path_1.default.join(targetDir, 'components'));
+        await fs_extra_1.default.writeFile(path_1.default.join(targetDir, 'components/PermissionGate.tsx'), permissionGateContent);
+        spinner.succeed(chalk_1.default.green('RBAC permissions system installed'));
+        console.log(chalk_1.default.cyan('\\n📁 Created files:'));
+        console.log(chalk_1.default.white('  ✓ lib/permissions.ts - Core utilities'));
+        console.log(chalk_1.default.white('  ✓ lib/auth/require-permission.ts - Server helpers'));
+        console.log(chalk_1.default.white('  ✓ hooks/usePermissions.ts - Client hooks'));
+        console.log(chalk_1.default.white('  ✓ components/PermissionGate.tsx - Conditional rendering'));
+        console.log(chalk_1.default.cyan('\\n📖 Usage Examples:'));
+        console.log(chalk_1.default.yellow('\\nServer-side (API Routes):'));
+        console.log(chalk_1.default.white(`
+  import { requirePermission } from '@/lib/auth/require-permission';
+
+  export async function POST(req: NextRequest) {
+    const error = await requirePermission('users:write');
+    if (error) return error;
+
+    // User has permission, proceed...
+  }`));
+        console.log(chalk_1.default.yellow('\\nClient-side (Components):'));
+        console.log(chalk_1.default.white(`
+  import { usePermissions } from '@/hooks/usePermissions';
+
+  function MyComponent() {
+    const { hasPermission } = usePermissions();
+
+    return (
+      <button disabled={!hasPermission('users:write')}>
+        Edit User
+      </button>
+    );
+  }`));
+        console.log(chalk_1.default.yellow('\\nConditional Rendering:'));
+        console.log(chalk_1.default.white(`
+  import { PermissionGate } from '@/components/PermissionGate';
+
+  <PermissionGate permission="users:delete">
+    <button>Delete User</button>
+  </PermissionGate>`));
+    }
+    catch (error) {
+        spinner.fail(chalk_1.default.red('Failed to setup permissions system'));
+        console.error(error.message);
+    }
+}