@constructive-sdk/cli 0.29.8 → 0.30.1

package/esm/api/orm/models/index.d.ts

@@ -47,5 +47,5 @@ export { DatabaseModel } from './database';
 export { RlsSettingModel } from './rlsSetting';
 export { SqlActionModel } from './sqlAction';
 export { DatabaseSettingModel } from './databaseSetting';
-export { WebauthnSettingModel } from './webauthnSetting';
 export { AstMigrationModel } from './astMigration';
+export { WebauthnSettingModel } from './webauthnSetting';

package/esm/api/orm/models/index.js

@@ -47,5 +47,5 @@ export { DatabaseModel } from './database';
 export { RlsSettingModel } from './rlsSetting';
 export { SqlActionModel } from './sqlAction';
 export { DatabaseSettingModel } from './databaseSetting';
-export { WebauthnSettingModel } from './webauthnSetting';
 export { AstMigrationModel } from './astMigration';
+export { WebauthnSettingModel } from './webauthnSetting';

package/esm/api/orm/mutation/index.d.ts

@@ -6,7 +6,7 @@
 import { OrmClient } from '../client';
 import { QueryBuilder } from '../query-builder';
 import type { InferSelectResult, StrictSelect } from '../select-types';
-import type { AcceptDatabaseTransferInput, CancelDatabaseTransferInput, RejectDatabaseTransferInput, ProvisionDatabaseWithUserInput, BootstrapUserInput, SetFieldOrderInput, ApplyRlsInput, CreateUserDatabaseInput, ProvisionBucketInput, AcceptDatabaseTransferPayload, CancelDatabaseTransferPayload, RejectDatabaseTransferPayload, ProvisionDatabaseWithUserPayload, BootstrapUserPayload, SetFieldOrderPayload, ApplyRlsPayload, CreateUserDatabasePayload, ProvisionBucketPayload, AcceptDatabaseTransferPayloadSelect, CancelDatabaseTransferPayloadSelect, RejectDatabaseTransferPayloadSelect, ProvisionDatabaseWithUserPayloadSelect, BootstrapUserPayloadSelect, SetFieldOrderPayloadSelect, ApplyRlsPayloadSelect, CreateUserDatabasePayloadSelect, ProvisionBucketPayloadSelect } from '../input-types';
+import type { AcceptDatabaseTransferInput, CancelDatabaseTransferInput, RejectDatabaseTransferInput, SetFieldOrderInput, ApplyRlsInput, RequestDatabaseInput, ProvisionBucketInput, AcceptDatabaseTransferPayload, CancelDatabaseTransferPayload, RejectDatabaseTransferPayload, SetFieldOrderPayload, ApplyRlsPayload, RequestDatabasePayload, ProvisionBucketPayload, AcceptDatabaseTransferPayloadSelect, CancelDatabaseTransferPayloadSelect, RejectDatabaseTransferPayloadSelect, SetFieldOrderPayloadSelect, ApplyRlsPayloadSelect, RequestDatabasePayloadSelect, ProvisionBucketPayloadSelect } from '../input-types';
 export interface AcceptDatabaseTransferVariables {
     input: AcceptDatabaseTransferInput;
 }
@@ -16,12 +16,6 @@ export interface CancelDatabaseTransferVariables {
 export interface RejectDatabaseTransferVariables {
     input: RejectDatabaseTransferInput;
 }
-export interface ProvisionDatabaseWithUserVariables {
-    input: ProvisionDatabaseWithUserInput;
-}
-export interface BootstrapUserVariables {
-    input: BootstrapUserInput;
-}
 export interface SetFieldOrderVariables {
     input: SetFieldOrderInput;
 }
@@ -29,26 +23,17 @@ export interface ApplyRlsVariables {
     input: ApplyRlsInput;
 }
 /**
- * Variables for createUserDatabase
- * Creates a new user database with all required modules, permissions, and RLS policies.
+ * Variables for requestDatabase
+ * Requests a database and returns a ticket (database_provision_module row) to poll.
 
-Parameters:
-  - database_name: Name for the new database (required)
-  - owner_id: UUID of the owner user (required)
-  - include_invites: Include invite system (default: true)
-  - include_groups: Include group-level memberships (default: false)
-  - include_levels: Include events/analytics (default: false)
-  - bitlen: Bit length for permission masks (default: 64)
-  - tokens_expiration: Token expiration interval (default: 30 days)
-
-Returns the database_id UUID of the newly created database.
+Pass exactly one of preset_slug or modules. The pool, presets, and owner bootstrap are private implementation details: a warm pool hit fulfills the ticket immediately (fulfilled_at set, deferred owner bootstrap), otherwise the database is cold-provisioned with exactly the requested modules. Poll the ticket until status = 'completed'; it then carries database_id and fulfilled_at.
 
 Example usage:
-  SELECT metaschema_public.create_user_database('my_app', 'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11'::uuid);
-  SELECT metaschema_public.create_user_database('my_app', 'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11'::uuid, true, true);  -- with invites and groups
+  SELECT * FROM metaschema_public.request_database('my_app', 'example.com', preset_slug := 'full');
+  SELECT * FROM metaschema_public.request_database('my_app', 'example.com', modules := '["users_module", "emails_module"]'::jsonb);
  */
-export interface CreateUserDatabaseVariables {
-    input: CreateUserDatabaseInput;
+export interface RequestDatabaseVariables {
+    input: RequestDatabaseInput;
 }
 /**
  * Variables for provisionBucket
@@ -76,16 +61,6 @@ export declare function createMutationOperations(client: OrmClient): {
     } & StrictSelect<S, RejectDatabaseTransferPayloadSelect>) => QueryBuilder<{
         rejectDatabaseTransfer: InferSelectResult<RejectDatabaseTransferPayload, S> | null;
     }>;
-    provisionDatabaseWithUser: <S extends ProvisionDatabaseWithUserPayloadSelect>(args: ProvisionDatabaseWithUserVariables, options: {
-        select: S;
-    } & StrictSelect<S, ProvisionDatabaseWithUserPayloadSelect>) => QueryBuilder<{
-        provisionDatabaseWithUser: InferSelectResult<ProvisionDatabaseWithUserPayload, S> | null;
-    }>;
-    bootstrapUser: <S extends BootstrapUserPayloadSelect>(args: BootstrapUserVariables, options: {
-        select: S;
-    } & StrictSelect<S, BootstrapUserPayloadSelect>) => QueryBuilder<{
-        bootstrapUser: InferSelectResult<BootstrapUserPayload, S> | null;
-    }>;
     setFieldOrder: <S extends SetFieldOrderPayloadSelect>(args: SetFieldOrderVariables, options: {
         select: S;
     } & StrictSelect<S, SetFieldOrderPayloadSelect>) => QueryBuilder<{
@@ -96,10 +71,10 @@ export declare function createMutationOperations(client: OrmClient): {
     } & StrictSelect<S, ApplyRlsPayloadSelect>) => QueryBuilder<{
         applyRls: InferSelectResult<ApplyRlsPayload, S> | null;
     }>;
-    createUserDatabase: <S extends CreateUserDatabasePayloadSelect>(args: CreateUserDatabaseVariables, options: {
+    requestDatabase: <S extends RequestDatabasePayloadSelect>(args: RequestDatabaseVariables, options: {
         select: S;
-    } & StrictSelect<S, CreateUserDatabasePayloadSelect>) => QueryBuilder<{
-        createUserDatabase: InferSelectResult<CreateUserDatabasePayload, S> | null;
+    } & StrictSelect<S, RequestDatabasePayloadSelect>) => QueryBuilder<{
+        requestDatabase: InferSelectResult<RequestDatabasePayload, S> | null;
     }>;
     provisionBucket: <S extends ProvisionBucketPayloadSelect>(args: ProvisionBucketVariables, options: {
         select: S;

package/esm/api/orm/mutation/index.js

@@ -38,30 +38,6 @@ export function createMutationOperations(client) {
                 },
             ], connectionFieldsMap, 'RejectDatabaseTransferPayload'),
         }),
-        provisionDatabaseWithUser: (args, options) => new QueryBuilder({
-            client,
-            operation: 'mutation',
-            operationName: 'ProvisionDatabaseWithUser',
-            fieldName: 'provisionDatabaseWithUser',
-            ...buildCustomDocument('mutation', 'ProvisionDatabaseWithUser', 'provisionDatabaseWithUser', options.select, args, [
-                {
-                    name: 'input',
-                    type: 'ProvisionDatabaseWithUserInput!',
-                },
-            ], connectionFieldsMap, 'ProvisionDatabaseWithUserPayload'),
-        }),
-        bootstrapUser: (args, options) => new QueryBuilder({
-            client,
-            operation: 'mutation',
-            operationName: 'BootstrapUser',
-            fieldName: 'bootstrapUser',
-            ...buildCustomDocument('mutation', 'BootstrapUser', 'bootstrapUser', options.select, args, [
-                {
-                    name: 'input',
-                    type: 'BootstrapUserInput!',
-                },
-            ], connectionFieldsMap, 'BootstrapUserPayload'),
-        }),
         setFieldOrder: (args, options) => new QueryBuilder({
             client,
             operation: 'mutation',
@@ -86,17 +62,17 @@ export function createMutationOperations(client) {
                 },
             ], connectionFieldsMap, 'ApplyRlsPayload'),
         }),
-        createUserDatabase: (args, options) => new QueryBuilder({
+        requestDatabase: (args, options) => new QueryBuilder({
             client,
             operation: 'mutation',
-            operationName: 'CreateUserDatabase',
-            fieldName: 'createUserDatabase',
-            ...buildCustomDocument('mutation', 'CreateUserDatabase', 'createUserDatabase', options.select, args, [
+            operationName: 'RequestDatabase',
+            fieldName: 'requestDatabase',
+            ...buildCustomDocument('mutation', 'RequestDatabase', 'requestDatabase', options.select, args, [
                 {
                     name: 'input',
-                    type: 'CreateUserDatabaseInput!',
+                    type: 'RequestDatabaseInput!',
                 },
-            ], connectionFieldsMap, 'CreateUserDatabasePayload'),
+            ], connectionFieldsMap, 'RequestDatabasePayload'),
         }),
         provisionBucket: (args, options) => new QueryBuilder({
             client,

package/esm/auth/cli/commands/delete-principal.d.ts

@@ -0,0 +1,8 @@
+/**
+ * CLI command for mutation deletePrincipal
+ * @generated by @constructive-io/graphql-codegen
+ * DO NOT EDIT - changes will be overwritten
+ */
+import { CLIOptions, Inquirerer } from 'inquirerer';
+declare const _default: (argv: Partial<Record<string, unknown>>, prompter: Inquirerer, _options: CLIOptions) => Promise<void>;
+export default _default;

package/esm/{config/cli/commands/org-secrets-rotate.js → auth/cli/commands/delete-principal.js}

@@ -3,7 +3,7 @@ import { unflattenDotNotation, buildSelectFromPaths } from '../utils';
 export default async (argv, prompter, _options) => {
     try {
         if (argv.help || argv.h) {
-            console.log('org-secrets-rotate - orgSecretsRotate\n\nUsage: org-secrets-rotate [OPTIONS]\n');
+            console.log('delete-principal - deletePrincipal\n\nUsage: delete-principal [OPTIONS]\n');
             process.exit(0);
         }
         const answers = await prompter.prompt(argv, [
@@ -18,14 +18,14 @@ export default async (argv, prompter, _options) => {
         const parsedAnswers = unflattenDotNotation(answers);
         const selectFields = buildSelectFromPaths(argv.select ?? 'clientMutationId');
         const result = await client.mutation
-            .orgSecretsRotate(parsedAnswers, {
+            .deletePrincipal(parsedAnswers, {
             select: selectFields,
         })
             .execute();
         console.log(JSON.stringify(result, null, 2));
     }
     catch (error) {
-        console.error('Failed: orgSecretsRotate');
+        console.error('Failed: deletePrincipal');
         if (error instanceof Error) {
             console.error(error.message);
         }

package/esm/auth/cli/commands/principal-scope-override.js

@@ -13,7 +13,8 @@ const fieldSchema = {
     principalId: 'uuid',
     membershipType: 'int',
     allowedMask: 'string',
-    isAdmin: 'boolean',
+    useAdminOwner: 'boolean',
+    isActive: 'boolean',
     isReadOnly: 'boolean',
 };
 const usage = '\nprincipal-scope-override <command>\n\nCommands:\n  list                  List principalScopeOverride records\n  find-first            Find first matching principalScopeOverride record\n  create                Create a new principalScopeOverride\n\nList Options:\n  --limit <n>           Max number of records to return (forward pagination)\n  --last <n>            Number of records from the end (backward pagination)\n  --after <cursor>      Cursor for forward pagination\n  --before <cursor>     Cursor for backward pagination\n  --offset <n>          Number of records to skip\n  --select <fields>     Comma-separated list of fields to return\n  --where.<field>.<op>  Filter (dot-notation, e.g. --where.name.equalTo foo)\n  --condition.<f>.<op>  Condition filter (dot-notation)\n  --orderBy <values>    Comma-separated ordering values (e.g. NAME_ASC,CREATED_AT_DESC)\n\nFind-First Options:\n  --select <fields>     Comma-separated list of fields to return\n  --where.<field>.<op>  Filter (dot-notation, e.g. --where.status.equalTo active)\n  --condition.<f>.<op>  Condition filter (dot-notation)\n  --orderBy <values>    Comma-separated ordering values (e.g. NAME_ASC,CREATED_AT_DESC)\n\n  --help, -h            Show this help message\n';
@@ -58,7 +59,8 @@ async function handleList(argv, _prompter) {
             principalId: true,
             membershipType: true,
             allowedMask: true,
-            isAdmin: true,
+            useAdminOwner: true,
+            isActive: true,
             isReadOnly: true,
         };
         const findManyArgs = parseFindManyArgs(argv, defaultSelect);
@@ -83,7 +85,8 @@ async function handleFindFirst(argv, _prompter) {
             principalId: true,
             membershipType: true,
             allowedMask: true,
-            isAdmin: true,
+            useAdminOwner: true,
+            isActive: true,
             isReadOnly: true,
         };
         const findFirstArgs = parseFindFirstArgs(argv, defaultSelect);
@@ -122,8 +125,14 @@ async function handleCreate(argv, prompter) {
             },
             {
                 type: 'boolean',
-                name: 'isAdmin',
-                message: 'isAdmin',
+                name: 'useAdminOwner',
+                message: 'useAdminOwner',
+                required: true,
+            },
+            {
+                type: 'boolean',
+                name: 'isActive',
+                message: 'isActive',
                 required: true,
             },
             {
@@ -142,7 +151,8 @@ async function handleCreate(argv, prompter) {
                 principalId: cleanedData.principalId,
                 membershipType: cleanedData.membershipType,
                 allowedMask: cleanedData.allowedMask,
-                isAdmin: cleanedData.isAdmin,
+                useAdminOwner: cleanedData.useAdminOwner,
+                isActive: cleanedData.isActive,
                 isReadOnly: cleanedData.isReadOnly,
             },
             select: {
@@ -152,7 +162,8 @@ async function handleCreate(argv, prompter) {
                 principalId: true,
                 membershipType: true,
                 allowedMask: true,
-                isAdmin: true,
+                useAdminOwner: true,
+                isActive: true,
                 isReadOnly: true,
             },
         })

package/esm/auth/cli/commands/principal.d.ts

@@ -3,6 +3,6 @@
  * @generated by @constructive-io/graphql-codegen
  * DO NOT EDIT - changes will be overwritten
  */
-import { CLIOptions, Inquirerer } from "inquirerer";
+import { CLIOptions, Inquirerer } from 'inquirerer';
 declare const _default: (argv: Partial<Record<string, unknown>>, prompter: Inquirerer, _options: CLIOptions) => Promise<void>;
 export default _default;

package/esm/auth/cli/commands/principal.js

@@ -3,21 +3,21 @@
  * @generated by @constructive-io/graphql-codegen
  * DO NOT EDIT - changes will be overwritten
  */
-import { extractFirst } from "inquirerer";
-import { getClient } from "../executor";
-import { coerceAnswers, parseFindFirstArgs, parseFindManyArgs, stripUndefined } from "../utils";
+import { extractFirst } from 'inquirerer';
+import { getClient } from '../executor';
+import { coerceAnswers, parseFindFirstArgs, parseFindManyArgs, stripUndefined } from '../utils';
 const fieldSchema = {
-    id: "uuid",
-    createdAt: "string",
-    updatedAt: "string",
-    ownerId: "uuid",
-    userId: "uuid",
-    name: "string",
-    allowedMask: "string",
-    isReadOnly: "boolean",
-    bypassStepUp: "boolean"
+    id: 'uuid',
+    createdAt: 'string',
+    updatedAt: 'string',
+    ownerId: 'uuid',
+    userId: 'uuid',
+    name: 'string',
+    useAdminOwner: 'boolean',
+    isReadOnly: 'boolean',
+    bypassStepUp: 'boolean',
 };
-const usage = "\nprincipal <command>\n\nCommands:\n  list                  List principal records\n  find-first            Find first matching principal record\n  create                Create a new principal\n\nList Options:\n  --limit <n>           Max number of records to return (forward pagination)\n  --last <n>            Number of records from the end (backward pagination)\n  --after <cursor>      Cursor for forward pagination\n  --before <cursor>     Cursor for backward pagination\n  --offset <n>          Number of records to skip\n  --select <fields>     Comma-separated list of fields to return\n  --where.<field>.<op>  Filter (dot-notation, e.g. --where.name.equalTo foo)\n  --condition.<f>.<op>  Condition filter (dot-notation)\n  --orderBy <values>    Comma-separated ordering values (e.g. NAME_ASC,CREATED_AT_DESC)\n\nFind-First Options:\n  --select <fields>     Comma-separated list of fields to return\n  --where.<field>.<op>  Filter (dot-notation, e.g. --where.status.equalTo active)\n  --condition.<f>.<op>  Condition filter (dot-notation)\n  --orderBy <values>    Comma-separated ordering values (e.g. NAME_ASC,CREATED_AT_DESC)\n\n  --help, -h            Show this help message\n";
+const usage = '\nprincipal <command>\n\nCommands:\n  list                  List principal records\n  find-first            Find first matching principal record\n  create                Create a new principal\n\nList Options:\n  --limit <n>           Max number of records to return (forward pagination)\n  --last <n>            Number of records from the end (backward pagination)\n  --after <cursor>      Cursor for forward pagination\n  --before <cursor>     Cursor for backward pagination\n  --offset <n>          Number of records to skip\n  --select <fields>     Comma-separated list of fields to return\n  --where.<field>.<op>  Filter (dot-notation, e.g. --where.name.equalTo foo)\n  --condition.<f>.<op>  Condition filter (dot-notation)\n  --orderBy <values>    Comma-separated ordering values (e.g. NAME_ASC,CREATED_AT_DESC)\n\nFind-First Options:\n  --select <fields>     Comma-separated list of fields to return\n  --where.<field>.<op>  Filter (dot-notation, e.g. --where.status.equalTo active)\n  --condition.<f>.<op>  Condition filter (dot-notation)\n  --orderBy <values>    Comma-separated ordering values (e.g. NAME_ASC,CREATED_AT_DESC)\n\n  --help, -h            Show this help message\n';
 export default async (argv, prompter, _options) => {
     if (argv.help || argv.h) {
         console.log(usage);
@@ -25,23 +25,25 @@ export default async (argv, prompter, _options) => {
     }
     const { first: subcommand, newArgv } = extractFirst(argv);
     if (!subcommand) {
-        const answer = await prompter.prompt(argv, [{
-                type: "autocomplete",
-                name: "subcommand",
-                message: "What do you want to do?",
-                options: ["list", "find-first", "create"]
-            }]);
+        const answer = await prompter.prompt(argv, [
+            {
+                type: 'autocomplete',
+                name: 'subcommand',
+                message: 'What do you want to do?',
+                options: ['list', 'find-first', 'create'],
+            },
+        ]);
         return handleTableSubcommand(answer.subcommand, newArgv, prompter);
     }
     return handleTableSubcommand(subcommand, newArgv, prompter);
 };
 async function handleTableSubcommand(subcommand, argv, prompter) {
     switch (subcommand) {
-        case "list":
+        case 'list':
             return handleList(argv, prompter);
-        case "find-first":
+        case 'find-first':
             return handleFindFirst(argv, prompter);
-        case "create":
+        case 'create':
             return handleCreate(argv, prompter);
         default:
             console.log(usage);
@@ -57,9 +59,9 @@ async function handleList(argv, _prompter) {
             ownerId: true,
             userId: true,
             name: true,
-            allowedMask: true,
+            useAdminOwner: true,
             isReadOnly: true,
-            bypassStepUp: true
+            bypassStepUp: true,
         };
         const findManyArgs = parseFindManyArgs(argv, defaultSelect);
         const client = getClient();
@@ -67,7 +69,7 @@ async function handleList(argv, _prompter) {
         console.log(JSON.stringify(result, null, 2));
     }
     catch (error) {
-        console.error("Failed to list records.");
+        console.error('Failed to list records.');
         if (error instanceof Error) {
             console.error(error.message);
         }
@@ -83,9 +85,9 @@ async function handleFindFirst(argv, _prompter) {
             ownerId: true,
             userId: true,
             name: true,
-            allowedMask: true,
+            useAdminOwner: true,
             isReadOnly: true,
-            bypassStepUp: true
+            bypassStepUp: true,
         };
         const findFirstArgs = parseFindFirstArgs(argv, defaultSelect);
         const client = getClient();
@@ -93,7 +95,7 @@ async function handleFindFirst(argv, _prompter) {
         console.log(JSON.stringify(result, null, 2));
     }
     catch (error) {
-        console.error("Failed to find record.");
+        console.error('Failed to find record.');
         if (error instanceof Error) {
             console.error(error.message);
         }
@@ -102,48 +104,56 @@ async function handleFindFirst(argv, _prompter) {
 }
 async function handleCreate(argv, prompter) {
     try {
-        const rawAnswers = await prompter.prompt(argv, [{
-                type: "text",
-                name: "ownerId",
-                message: "ownerId",
-                required: true
-            }, {
-                type: "text",
-                name: "userId",
-                message: "userId",
-                required: true
-            }, {
-                type: "text",
-                name: "name",
-                message: "name",
-                required: true
-            }, {
-                type: "text",
-                name: "allowedMask",
-                message: "allowedMask",
-                required: true
-            }, {
-                type: "boolean",
-                name: "isReadOnly",
-                message: "isReadOnly",
-                required: true
-            }, {
-                type: "boolean",
-                name: "bypassStepUp",
-                message: "bypassStepUp",
-                required: true
-            }]);
+        const rawAnswers = await prompter.prompt(argv, [
+            {
+                type: 'text',
+                name: 'ownerId',
+                message: 'ownerId',
+                required: true,
+            },
+            {
+                type: 'text',
+                name: 'userId',
+                message: 'userId',
+                required: true,
+            },
+            {
+                type: 'text',
+                name: 'name',
+                message: 'name',
+                required: true,
+            },
+            {
+                type: 'boolean',
+                name: 'useAdminOwner',
+                message: 'useAdminOwner',
+                required: true,
+            },
+            {
+                type: 'boolean',
+                name: 'isReadOnly',
+                message: 'isReadOnly',
+                required: true,
+            },
+            {
+                type: 'boolean',
+                name: 'bypassStepUp',
+                message: 'bypassStepUp',
+                required: true,
+            },
+        ]);
         const answers = coerceAnswers(rawAnswers, fieldSchema);
         const cleanedData = stripUndefined(answers, fieldSchema);
         const client = getClient();
-        const result = await client.principal.create({
+        const result = await client.principal
+            .create({
             data: {
                 ownerId: cleanedData.ownerId,
                 userId: cleanedData.userId,
                 name: cleanedData.name,
-                allowedMask: cleanedData.allowedMask,
+                useAdminOwner: cleanedData.useAdminOwner,
                 isReadOnly: cleanedData.isReadOnly,
-                bypassStepUp: cleanedData.bypassStepUp
+                bypassStepUp: cleanedData.bypassStepUp,
             },
             select: {
                 id: true,
@@ -152,15 +162,16 @@ async function handleCreate(argv, prompter) {
                 ownerId: true,
                 userId: true,
                 name: true,
-                allowedMask: true,
+                useAdminOwner: true,
                 isReadOnly: true,
-                bypassStepUp: true
-            }
-        }).execute();
+                bypassStepUp: true,
+            },
+        })
+            .execute();
         console.log(JSON.stringify(result, null, 2));
     }
     catch (error) {
-        console.error("Failed to create record.");
+        console.error('Failed to create record.');
         if (error instanceof Error) {
             console.error(error.message);
         }

package/esm/auth/cli/commands.js

@@ -28,6 +28,7 @@ import signOutCmd from './commands/sign-out';
 import sendAccountDeletionEmailCmd from './commands/send-account-deletion-email';
 import checkPasswordCmd from './commands/check-password';
 import deleteOrgPrincipalCmd from './commands/delete-org-principal';
+import deletePrincipalCmd from './commands/delete-principal';
 import disconnectAccountCmd from './commands/disconnect-account';
 import revokeApiKeyCmd from './commands/revoke-api-key';
 import revokeSessionCmd from './commands/revoke-session';
@@ -39,13 +40,13 @@ import setPasswordCmd from './commands/set-password';
 import verifyEmailCmd from './commands/verify-email';
 import provisionNewUserCmd from './commands/provision-new-user';
 import resetPasswordCmd from './commands/reset-password';
+import createOrgPrincipalCmd from './commands/create-org-principal';
 import signInCrossOriginCmd from './commands/sign-in-cross-origin';
 import signInSmsOtpCmd from './commands/sign-in-sms-otp';
 import signUpSmsCmd from './commands/sign-up-sms';
 import signUpCmd from './commands/sign-up';
 import signInCmd from './commands/sign-in';
 import linkIdentityCmd from './commands/link-identity';
-import createOrgPrincipalCmd from './commands/create-org-principal';
 import extendTokenExpiresCmd from './commands/extend-token-expires';
 import createOrgApiKeyCmd from './commands/create-org-api-key';
 import createApiKeyCmd from './commands/create-api-key';
@@ -78,6 +79,7 @@ const createCommandMap = () => ({
     'send-account-deletion-email': sendAccountDeletionEmailCmd,
     'check-password': checkPasswordCmd,
     'delete-org-principal': deleteOrgPrincipalCmd,
+    'delete-principal': deletePrincipalCmd,
     'disconnect-account': disconnectAccountCmd,
     'revoke-api-key': revokeApiKeyCmd,
     'revoke-session': revokeSessionCmd,
@@ -89,13 +91,13 @@ const createCommandMap = () => ({
     'verify-email': verifyEmailCmd,
     'provision-new-user': provisionNewUserCmd,
     'reset-password': resetPasswordCmd,
+    'create-org-principal': createOrgPrincipalCmd,
     'sign-in-cross-origin': signInCrossOriginCmd,
     'sign-in-sms-otp': signInSmsOtpCmd,
     'sign-up-sms': signUpSmsCmd,
     'sign-up': signUpCmd,
     'sign-in': signInCmd,
     'link-identity': linkIdentityCmd,
-    'create-org-principal': createOrgPrincipalCmd,
     'extend-token-expires': extendTokenExpiresCmd,
     'create-org-api-key': createOrgApiKeyCmd,
     'create-api-key': createApiKeyCmd,
@@ -104,7 +106,7 @@ const createCommandMap = () => ({
     'send-verification-email': sendVerificationEmailCmd,
     'provision-bucket': provisionBucketCmd,
 });
-const usage = '\ncsdk <command>\n\nCommands:\n  context               Manage API contexts\n  auth                  Manage authentication\n  principal            principal CRUD operations\n  principal-entity     principalEntity CRUD operations\n  principal-scope-override principalScopeOverride CRUD operations\n  email                email CRUD operations\n  phone-number         phoneNumber CRUD operations\n  crypto-address       cryptoAddress CRUD operations\n  webauthn-credential  webauthnCredential CRUD operations\n  audit-log-auth       auditLogAuth CRUD operations\n  identity-provider    identityProvider CRUD operations\n  role-type            roleType CRUD operations\n  user-connected-account userConnectedAccount CRUD operations\n  org-api-key-list     orgApiKeyList CRUD operations\n  user                 user CRUD operations\n  current-user-agent   currentUserAgent\n  current-user-id      currentUserId\n  current-ip-address   currentIpAddress\n  require-step-up      requireStepUp\n  current-user         currentUser\n  sign-out             signOut\n  send-account-deletion-email sendAccountDeletionEmail\n  check-password       checkPassword\n  delete-org-principal deleteOrgPrincipal\n  disconnect-account   disconnectAccount\n  revoke-api-key       revokeApiKey\n  revoke-session       revokeSession\n  verify-password      verifyPassword\n  verify-totp          verifyTotp\n  confirm-delete-account confirmDeleteAccount\n  revoke-org-api-key   revokeOrgApiKey\n  set-password         setPassword\n  verify-email         verifyEmail\n  provision-new-user   provisionNewUser\n  reset-password       resetPassword\n  sign-in-cross-origin signInCrossOrigin\n  sign-in-sms-otp      signInSmsOtp\n  sign-up-sms          signUpSms\n  sign-up              signUp\n  sign-in              signIn\n  link-identity        linkIdentity\n  create-org-principal createOrgPrincipal\n  extend-token-expires extendTokenExpires\n  create-org-api-key   createOrgApiKey\n  create-api-key       createApiKey\n  request-cross-origin-token requestCrossOriginToken\n  forgot-password      forgotPassword\n  send-verification-email sendVerificationEmail\n  provision-bucket     Provision an S3 bucket for a logical bucket in the database.\nReads the bucket config via RLS, then creates and configures\nthe S3 bucket with the appropriate privacy policies, CORS rules,\nand lifecycle settings.\n\n  --help, -h            Show this help message\n  --version, -v         Show version\n';
+const usage = '\ncsdk <command>\n\nCommands:\n  context               Manage API contexts\n  auth                  Manage authentication\n  principal            principal CRUD operations\n  principal-entity     principalEntity CRUD operations\n  principal-scope-override principalScopeOverride CRUD operations\n  email                email CRUD operations\n  phone-number         phoneNumber CRUD operations\n  crypto-address       cryptoAddress CRUD operations\n  webauthn-credential  webauthnCredential CRUD operations\n  audit-log-auth       auditLogAuth CRUD operations\n  identity-provider    identityProvider CRUD operations\n  role-type            roleType CRUD operations\n  user-connected-account userConnectedAccount CRUD operations\n  org-api-key-list     orgApiKeyList CRUD operations\n  user                 user CRUD operations\n  current-user-agent   currentUserAgent\n  current-user-id      currentUserId\n  current-ip-address   currentIpAddress\n  require-step-up      requireStepUp\n  current-user         currentUser\n  sign-out             signOut\n  send-account-deletion-email sendAccountDeletionEmail\n  check-password       checkPassword\n  delete-org-principal deleteOrgPrincipal\n  delete-principal     deletePrincipal\n  disconnect-account   disconnectAccount\n  revoke-api-key       revokeApiKey\n  revoke-session       revokeSession\n  verify-password      verifyPassword\n  verify-totp          verifyTotp\n  confirm-delete-account confirmDeleteAccount\n  revoke-org-api-key   revokeOrgApiKey\n  set-password         setPassword\n  verify-email         verifyEmail\n  provision-new-user   provisionNewUser\n  reset-password       resetPassword\n  create-org-principal createOrgPrincipal\n  sign-in-cross-origin signInCrossOrigin\n  sign-in-sms-otp      signInSmsOtp\n  sign-up-sms          signUpSms\n  sign-up              signUp\n  sign-in              signIn\n  link-identity        linkIdentity\n  extend-token-expires extendTokenExpires\n  create-org-api-key   createOrgApiKey\n  create-api-key       createApiKey\n  request-cross-origin-token requestCrossOriginToken\n  forgot-password      forgotPassword\n  send-verification-email sendVerificationEmail\n  provision-bucket     Provision an S3 bucket for a logical bucket in the database.\nReads the bucket config via RLS, then creates and configures\nthe S3 bucket with the appropriate privacy policies, CORS rules,\nand lifecycle settings.\n\n  --help, -h            Show this help message\n  --version, -v         Show version\n';
 export const commands = async (argv, prompter, options) => {
     if (argv.help || argv.h) {
         console.log(usage);

package/esm/auth/cli/executor.d.ts

@@ -61,6 +61,11 @@ export declare function getClient(contextName?: string): {
         } & import("..").StrictSelect<S, import("../orm/input-types").DeleteOrgPrincipalPayloadSelect>) => import("..").QueryBuilder<{
             deleteOrgPrincipal: import("..").InferSelectResult<import("../orm/input-types").DeleteOrgPrincipalPayload, S> | null;
         }>;
+        deletePrincipal: <S extends import("../orm/input-types").DeletePrincipalPayloadSelect>(args: import("../orm/mutation").DeletePrincipalVariables, options: {
+            select: S;
+        } & import("..").StrictSelect<S, import("../orm/input-types").DeletePrincipalPayloadSelect>) => import("..").QueryBuilder<{
+            deletePrincipal: import("..").InferSelectResult<import("../orm/input-types").DeletePrincipalPayload, S> | null;
+        }>;
         disconnectAccount: <S extends import("../orm/input-types").DisconnectAccountPayloadSelect>(args: import("../orm/mutation").DisconnectAccountVariables, options: {
             select: S;
         } & import("..").StrictSelect<S, import("../orm/input-types").DisconnectAccountPayloadSelect>) => import("..").QueryBuilder<{
@@ -116,6 +121,11 @@ export declare function getClient(contextName?: string): {
         } & import("..").StrictSelect<S, import("../orm/input-types").ResetPasswordPayloadSelect>) => import("..").QueryBuilder<{
             resetPassword: import("..").InferSelectResult<import("../orm/input-types").ResetPasswordPayload, S> | null;
         }>;
+        createOrgPrincipal: <S extends import("../orm/input-types").CreateOrgPrincipalPayloadSelect>(args: import("../orm/mutation").CreateOrgPrincipalVariables, options: {
+            select: S;
+        } & import("..").StrictSelect<S, import("../orm/input-types").CreateOrgPrincipalPayloadSelect>) => import("..").QueryBuilder<{
+            createOrgPrincipal: import("..").InferSelectResult<import("../orm/input-types").CreateOrgPrincipalPayload, S> | null;
+        }>;
         signInCrossOrigin: <S extends import("../orm/input-types").SignInCrossOriginPayloadSelect>(args: import("../orm/mutation").SignInCrossOriginVariables, options: {
             select: S;
         } & import("..").StrictSelect<S, import("../orm/input-types").SignInCrossOriginPayloadSelect>) => import("..").QueryBuilder<{
@@ -146,11 +156,6 @@ export declare function getClient(contextName?: string): {
         } & import("..").StrictSelect<S, import("../orm/input-types").LinkIdentityPayloadSelect>) => import("..").QueryBuilder<{
             linkIdentity: import("..").InferSelectResult<import("../orm/input-types").LinkIdentityPayload, S> | null;
         }>;
-        createOrgPrincipal: <S extends import("../orm/input-types").CreateOrgPrincipalPayloadSelect>(args: import("../orm/mutation").CreateOrgPrincipalVariables, options: {
-            select: S;
-        } & import("..").StrictSelect<S, import("../orm/input-types").CreateOrgPrincipalPayloadSelect>) => import("..").QueryBuilder<{
-            createOrgPrincipal: import("..").InferSelectResult<import("../orm/input-types").CreateOrgPrincipalPayload, S> | null;
-        }>;
         extendTokenExpires: <S extends import("../orm/input-types").ExtendTokenExpiresPayloadSelect>(args: import("../orm/mutation").ExtendTokenExpiresVariables, options: {
             select: S;
         } & import("..").StrictSelect<S, import("../orm/input-types").ExtendTokenExpiresPayloadSelect>) => import("..").QueryBuilder<{

package/esm/auth/orm/index.d.ts

@@ -104,6 +104,11 @@ export declare function createClient(config: OrmClientConfig): {
         } & import("./select-types").StrictSelect<S, import("./input-types").DeleteOrgPrincipalPayloadSelect>) => import("./query-builder").QueryBuilder<{
             deleteOrgPrincipal: import("./select-types").InferSelectResult<import("./input-types").DeleteOrgPrincipalPayload, S> | null;
         }>;
+        deletePrincipal: <S extends import("./input-types").DeletePrincipalPayloadSelect>(args: import("./mutation").DeletePrincipalVariables, options: {
+            select: S;
+        } & import("./select-types").StrictSelect<S, import("./input-types").DeletePrincipalPayloadSelect>) => import("./query-builder").QueryBuilder<{
+            deletePrincipal: import("./select-types").InferSelectResult<import("./input-types").DeletePrincipalPayload, S> | null;
+        }>;
         disconnectAccount: <S extends import("./input-types").DisconnectAccountPayloadSelect>(args: import("./mutation").DisconnectAccountVariables, options: {
             select: S;
         } & import("./select-types").StrictSelect<S, import("./input-types").DisconnectAccountPayloadSelect>) => import("./query-builder").QueryBuilder<{
@@ -159,6 +164,11 @@ export declare function createClient(config: OrmClientConfig): {
         } & import("./select-types").StrictSelect<S, import("./input-types").ResetPasswordPayloadSelect>) => import("./query-builder").QueryBuilder<{
             resetPassword: import("./select-types").InferSelectResult<import("./input-types").ResetPasswordPayload, S> | null;
         }>;
+        createOrgPrincipal: <S extends import("./input-types").CreateOrgPrincipalPayloadSelect>(args: import("./mutation").CreateOrgPrincipalVariables, options: {
+            select: S;
+        } & import("./select-types").StrictSelect<S, import("./input-types").CreateOrgPrincipalPayloadSelect>) => import("./query-builder").QueryBuilder<{
+            createOrgPrincipal: import("./select-types").InferSelectResult<import("./input-types").CreateOrgPrincipalPayload, S> | null;
+        }>;
         signInCrossOrigin: <S extends import("./input-types").SignInCrossOriginPayloadSelect>(args: import("./mutation").SignInCrossOriginVariables, options: {
             select: S;
         } & import("./select-types").StrictSelect<S, import("./input-types").SignInCrossOriginPayloadSelect>) => import("./query-builder").QueryBuilder<{
@@ -189,11 +199,6 @@ export declare function createClient(config: OrmClientConfig): {
         } & import("./select-types").StrictSelect<S, import("./input-types").LinkIdentityPayloadSelect>) => import("./query-builder").QueryBuilder<{
             linkIdentity: import("./select-types").InferSelectResult<import("./input-types").LinkIdentityPayload, S> | null;
         }>;
-        createOrgPrincipal: <S extends import("./input-types").CreateOrgPrincipalPayloadSelect>(args: import("./mutation").CreateOrgPrincipalVariables, options: {
-            select: S;
-        } & import("./select-types").StrictSelect<S, import("./input-types").CreateOrgPrincipalPayloadSelect>) => import("./query-builder").QueryBuilder<{
-            createOrgPrincipal: import("./select-types").InferSelectResult<import("./input-types").CreateOrgPrincipalPayload, S> | null;
-        }>;
         extendTokenExpires: <S extends import("./input-types").ExtendTokenExpiresPayloadSelect>(args: import("./mutation").ExtendTokenExpiresVariables, options: {
             select: S;
         } & import("./select-types").StrictSelect<S, import("./input-types").ExtendTokenExpiresPayloadSelect>) => import("./query-builder").QueryBuilder<{