@gonvex/cli 0.1.9 → 0.1.12

package/README.md

@@ -25,6 +25,28 @@ Most apps run it through a package script:
 
 ## Commands
 
+Authenticate with an account session or an existing personal access token:
+
+```bash
+npx gonvex login --runtime-url https://gonvex.example.com --email you@example.com
+npx gonvex login --runtime-url https://gonvex.example.com --token gvx_pat_...
+```
+
+Create a scoped account token and provision a project without leaving the terminal:
+
+```bash
+npx gonvex token create "Developer CLI"
+npx gonvex project create my-app
+```
+
+The default token permissions are `projects:read`, `projects:create`, and
+`projects:keys:read`. Use repeated `--permission` flags or `--permission 'projects:*'`
+to choose broader owner-scoped access. Dashboard administrators can combine
+`projects:*` with `admin:projects` for runtime-wide project automation, or create the
+same admin key from their profile in the dashboard. Account credentials are stored
+per runtime in a user config file with mode `0600`; project credentials stay in the
+app's `.env.local`.
+
 Initialize Gonvex files in an existing app:
 
 ```bash
@@ -55,16 +77,52 @@ Manage project environment variables:
 
 ```bash
 npx gonvex env list
+npx gonvex env get NAME
 npx gonvex env set NAME value
 npx gonvex env push .env.production
 npx gonvex env remove NAME
 ```
 
+Enable native Google login for an app without Firebase or a per-app Google Cloud
+project:
+
+```bash
+npx gonvex auth add google --origin http://localhost:5173
+npx gonvex auth status
+npx gonvex auth doctor
+npx gonvex auth users
+```
+
+The command registers the exact callback with the runtime and writes
+`gonvex/auth.tsx`, which exports a configured provider, hook, and Google sign-in
+button. A Gonvex installation operator configures one central Google OAuth client;
+future app projects reuse it through the runtime.
+
+For a new app, provision and wire everything at once:
+
+```bash
+npm create gonvex@latest my-app -- --runtime-url https://gonvex.example.com --google-auth --origin https://my-app.example.com
+```
+
+Both single-database and multi-tenant projects are supported. Use
+`--signup-mode personal|inviteOnly`, `gonvex auth tenants`, and
+`gonvex auth memberships` for workspace onboarding. An invite-only app created in
+one command also takes `--owner <verified-google-email>` to bootstrap its first
+scope/workspace invitation. Retire a callback with
+`gonvex auth remove google --origin <url>` without disabling the provider.
+
 `env push` resolves the file from the selected project root and atomically
 replaces that project's server-side environment-variable set. Pass a dedicated
 deployment env file; the CLI refuses to upload `GONVEX_PROJECT_KEY` and related
 CLI credentials.
 
+Environment commands require a runtime built from Gonvex v0.1.9 or newer. The
+CLI sends the selected project key in both supported authentication headers, and
+the runtime scopes that key to the exact project in the request. If environment
+commands return `dashboard sign-in is required` while `gonvex dev --once` works,
+upgrade and recreate the runtime; updating this npm package alone does not update
+the deployed Go runtime.
+
 ## Runtime Settings
 
 The CLI reads `.env.local` and `.env`:

package/dist/index.d.ts

@@ -1,3 +1,4 @@
 #!/usr/bin/env node
 export declare function main(argv?: string[]): Promise<void>;
 export declare function runCreate(argv: string[]): Promise<void>;
+export declare function runAuth(argv: string[]): Promise<void>;