@protobase/cli 0.0.0-stage → 0.1.1

package/dist/serve/lifecycle.js

@@ -0,0 +1,39 @@
+import { createPgDb } from "../project/pg-db.js";
+import { createServeApp } from "./app.js";
+import { createAdaptorServer } from "@hono/node-server";
+import pg from "pg";
+//#region src/serve/lifecycle.ts
+const listen = (server, port) => new Promise((resolve, reject) => {
+	server.once("error", reject);
+	server.listen(port, () => {
+		server.off("error", reject);
+		resolve();
+	});
+});
+const closeServer = (server) => new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+const startServe = async ({ project, env, createDb = (url) => createPgDb(pg, url), site }) => {
+	if (!project.db && !env.databaseUrl) throw new Error("No database: set DATABASE_URL or export `db` from protobase.config.ts");
+	const ownDb = project.db ? void 0 : createDb(env.databaseUrl);
+	const db = project.db ?? ownDb;
+	const app = createServeApp({
+		project,
+		db,
+		requestLog: env.requestLog,
+		site
+	});
+	const server = createAdaptorServer({ fetch: app.fetch });
+	await listen(server, env.port).catch(async (error) => {
+		await ownDb?.destroy();
+		throw error;
+	});
+	const close = async () => {
+		await closeServer(server);
+		await ownDb?.destroy();
+	};
+	return {
+		port: server.address().port,
+		close
+	};
+};
+//#endregion
+export { startServe };

package/dist/serve/load-bundle.js

@@ -0,0 +1,17 @@
+import { bundleBasePath } from "../bundle/manifest.js";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+//#region src/serve/load-bundle.ts
+const isObject = (value) => typeof value === "object" && value !== null;
+const servedProject = (module, file) => {
+	const project = module.default;
+	if (!isObject(project)) throw new Error(`${file} has no default export; build it with \`protobase build\``);
+	if (!isObject(project.config)) throw new Error(`${file} has no \`config\`: export it from protobase.config.ts or add config/index.ts`);
+	if (typeof project.authenticate !== "function") throw new Error("No authenticator: export `authenticate` (and `auth`) from protobase.config.ts; see https://docs.protobase.net/reference/auth/");
+	const basePath = isObject(project.options) ? project.options.basePath : void 0;
+	if (basePath !== void 0 && basePath !== "/api/v1") throw new Error(`options.basePath is ${JSON.stringify(basePath)}; a bundle's UI and manifest expect the API at ${bundleBasePath}, so remove it (see https://docs.protobase.net/reference/cli/#the-manifest)`);
+	return project;
+};
+const loadBundle = async (file) => servedProject(await import(pathToFileURL(path.resolve(file)).href), file);
+//#endregion
+export { loadBundle, servedProject };

package/dist/serve/main.d.ts

@@ -0,0 +1 @@
+export {}

package/dist/serve/main.js

@@ -0,0 +1,13 @@
+import { serveBundle } from "./serve-bundle.js";
+import { provideHostModules } from "./host-modules.js";
+//#region src/serve/main.ts
+const fail = (message) => {
+	process.stderr.write(`error: ${message}\n`);
+	process.exit(1);
+};
+provideHostModules();
+const [file, ...extra] = process.argv.slice(2);
+if (!file || extra.length > 0) fail("usage: protobase-serve.js <bundle.js>");
+await serveBundle(file, process.env, (text) => process.stdout.write(text)).catch((error) => fail(error.message));
+//#endregion
+export {};

package/dist/serve/serve-bundle.js

@@ -0,0 +1,21 @@
+import { checkBundleVersion } from "./bundle-version.js";
+import { readServeEnv } from "./env.js";
+import { startServe } from "./lifecycle.js";
+import { loadBundle } from "./load-bundle.js";
+import { closeOnSignals } from "./signals.js";
+//#region src/serve/serve-bundle.ts
+const serveBundle = async (file, env, out, site) => {
+	const serveEnv = readServeEnv(env);
+	await checkBundleVersion(file);
+	const project = await loadBundle(file);
+	const server = await startServe({
+		project,
+		env: serveEnv,
+		site
+	});
+	closeOnSignals(server.close);
+	out(`protobase serve listening on port ${server.port}\n`);
+	return server;
+};
+//#endregion
+export { serveBundle };

package/dist/serve/serve-dir.js

@@ -0,0 +1,15 @@
+import { readManifest } from "../bundle/manifest.js";
+import { serveBundle } from "./serve-bundle.js";
+import path from "node:path";
+//#region src/serve/serve-dir.ts
+const serveBundleDir = async (dir, env, out) => {
+	const manifest = await readManifest(dir);
+	const site = {
+		publicDir: path.resolve(dir, manifest.public),
+		spa: manifest.spa,
+		api: manifest.api
+	};
+	return serveBundle(path.join(dir, manifest.server), env, out, site);
+};
+//#endregion
+export { serveBundleDir };

package/dist/serve/signals.js

@@ -0,0 +1,11 @@
+//#region src/serve/signals.ts
+const signals = ["SIGTERM", "SIGINT"];
+const closeOnSignals = (close, exit = (code) => process.exit(code)) => {
+	const shutdown = () => {
+		signals.forEach((signal) => process.off(signal, shutdown));
+		close().then(() => exit(0));
+	};
+	signals.forEach((signal) => process.on(signal, shutdown));
+};
+//#endregion
+export { closeOnSignals };

package/dist/serve/static-site.js

@@ -0,0 +1,46 @@
+import path from "node:path";
+import { readFile, stat } from "node:fs/promises";
+import { getMimeType } from "hono/utils/mime";
+//#region src/serve/static-site.ts
+const missing = ["ENOENT", "ENOTDIR"];
+const statOrUndefined = (file) => stat(file).catch((error) => {
+	if (missing.includes(error.code ?? "")) return void 0;
+	throw error;
+});
+const decodePath = (pathname) => {
+	try {
+		return decodeURIComponent(pathname);
+	} catch (error) {
+		if (error instanceof URIError) return void 0;
+		throw error;
+	}
+};
+const fileFor = async (publicDir, pathname) => {
+	const decoded = decodePath(pathname);
+	if (decoded === void 0 || decoded.includes("\0")) return void 0;
+	const file = path.join(publicDir, decoded);
+	if (file !== publicDir && !file.startsWith(`${publicDir}${path.sep}`)) return void 0;
+	const info = await statOrUndefined(file);
+	if (info?.isFile()) return file;
+	if (!info?.isDirectory()) return void 0;
+	const index = path.join(file, "index.html");
+	return (await statOrUndefined(index))?.isFile() ? index : void 0;
+};
+const cacheControl = (publicDir, file) => file.startsWith(path.join(publicDir, "assets", path.sep)) ? "public, max-age=31536000, immutable" : "no-cache";
+const fileResponse = async (publicDir, file) => new Response(await readFile(file), { headers: {
+	"content-type": getMimeType(file) ?? "application/octet-stream",
+	"cache-control": cacheControl(publicDir, file)
+} });
+const isNavigation = (request) => (request.headers.get("accept") ?? "").includes("text/html");
+const serveStaticSite = async ({ publicDir, spa }, request) => {
+	if (request.method !== "GET" && request.method !== "HEAD") return new Response("Method Not Allowed", {
+		status: 405,
+		headers: { allow: "GET, HEAD" }
+	});
+	const file = await fileFor(publicDir, new URL(request.url).pathname);
+	if (file) return fileResponse(publicDir, file);
+	if (isNavigation(request)) return fileResponse(publicDir, path.join(publicDir, spa));
+	return new Response("Not Found", { status: 404 });
+};
+//#endregion
+export { serveStaticSite };

package/dist/users/commands.js

@@ -0,0 +1,31 @@
+import { resolvePassword } from "./password.js";
+//#region src/users/commands.ts
+const createUserCommand = async (api, options, deps, out) => {
+	if (!options.email.includes("@")) throw new Error(`"${options.email}" is not an email address`);
+	const { password, generated } = await resolvePassword(options, deps);
+	const role = !await api.hasUsers() ? "admin" : options.role;
+	const user = await api.createUser({
+		email: options.email,
+		password,
+		...role && { role },
+		...options.name && { name: options.name }
+	});
+	out(`Created ${user.role} ${user.email}\n`);
+	if (generated) out(`Password (shown once): ${password}\n`);
+};
+const listUsersCommand = async (api, out) => {
+	const users = await api.listUsers();
+	if (users.length === 0) {
+		out("No users yet. Create the first admin with: protobase users create you@example.com\n");
+		return;
+	}
+	const width = Math.max(...users.map((user) => user.email.length), 5);
+	out(`${"EMAIL".padEnd(width)}  ${"ROLE".padEnd(8)}  CREATED\n`);
+	for (const user of users) out(`${user.email.padEnd(width)}  ${user.role.padEnd(8)}  ${user.createdAt}${user.banned ? "  disabled" : ""}\n`);
+};
+const listRolesCommand = async (api, out) => {
+	const { roles, defaultRole } = await api.roles();
+	for (const role of roles) out(`${role}${role === defaultRole ? "  (default for new users)" : ""}\n`);
+};
+//#endregion
+export { createUserCommand, listRolesCommand, listUsersCommand };

package/dist/users/load-auth.js

@@ -0,0 +1,15 @@
+import { loadNearestEnvFile } from "../dev/env.js";
+import { importProjectFile } from "../project/import-project-file.js";
+import { existsSync } from "node:fs";
+import path from "node:path";
+//#region src/users/load-auth.ts
+const loadProjectAuth = async (projectDir) => {
+	loadNearestEnvFile(projectDir);
+	const file = path.join(projectDir, "protobase.config.ts");
+	if (!existsSync(file)) throw new Error(`No protobase.config.ts in ${projectDir}; run this inside a project`);
+	const auth = (await importProjectFile(file)).default?.auth;
+	if (!auth) throw new Error("protobase.config.ts does not export `auth`; users are managed by Better Auth");
+	return auth;
+};
+//#endregion
+export { loadProjectAuth };

package/dist/users/manage.js

@@ -0,0 +1,21 @@
+//#region src/users/manage.ts
+const deleteUserCommand = async (api, options, confirm, out) => {
+	if (!options.yes) {
+		if ((await confirm(`This permanently deletes ${options.email}. Type the email to confirm: `)).trim() !== options.email) throw new Error("The typed email does not match; nothing was deleted");
+	}
+	await api.deleteUser(options.email);
+	out(`Deleted ${options.email}\n`);
+};
+const setRoleCommand = async (api, options, out) => {
+	const user = await api.setUserRole(options);
+	out(`${user.email} is now ${user.role}\n`);
+};
+const setDisabledCommand = async (api, options, out) => {
+	await api.setUserBanned({
+		email: options.email,
+		banned: options.disabled
+	});
+	out(options.disabled ? `Disabled ${options.email}: sessions revoked; tokens already issued stop working within 15 minutes\n` : `Enabled ${options.email}\n`);
+};
+//#endregion
+export { deleteUserCommand, setDisabledCommand, setRoleCommand };

package/dist/users/password.js

@@ -0,0 +1,64 @@
+import { randomBytes } from "node:crypto";
+//#region src/users/password.ts
+const rejectPasswordArgument = (value) => {
+	if (value === void 0) return;
+	throw new Error("Passwords are never accepted as arguments (they end up in shell history); type it at the prompt, or use --password-stdin or --generate-password");
+};
+const generatePassword = () => randomBytes(18).toString("base64url");
+const readPasswordFromStream = async (input) => {
+	const chunks = [];
+	for await (const chunk of input) chunks.push(Buffer.from(chunk));
+	const password = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+	if (!password) throw new Error("No password on stdin");
+	return password;
+};
+const readHidden = (question) => new Promise((resolve, reject) => {
+	const { stdin, stdout } = process;
+	if (!stdin.isTTY) {
+		reject(/* @__PURE__ */ new Error("A password prompt needs a terminal; use --password-stdin or --generate-password"));
+		return;
+	}
+	stdout.write(question);
+	stdin.setRawMode(true);
+	stdin.resume();
+	let value = "";
+	const onData = (chunk) => {
+		for (const char of chunk.toString("utf8")) {
+			if (char === "") {
+				stdin.setRawMode(false);
+				stdin.off("data", onData);
+				reject(/* @__PURE__ */ new Error("Cancelled"));
+				return;
+			}
+			if (char === "\r" || char === "\n") {
+				stdin.setRawMode(false);
+				stdin.pause();
+				stdin.off("data", onData);
+				stdout.write("\n");
+				resolve(value);
+				return;
+			}
+			value = char === "" ? value.slice(0, -1) : value + char;
+		}
+	};
+	stdin.on("data", onData);
+});
+const resolvePassword = async (options, deps) => {
+	if (options.passwordStdin && options.generatePassword) throw new Error("Use either --password-stdin or --generate-password, not both");
+	if (options.generatePassword) return {
+		password: generatePassword(),
+		generated: true
+	};
+	if (options.passwordStdin) return {
+		password: await readPasswordFromStream(deps.stdin),
+		generated: false
+	};
+	const password = await deps.prompt("Password: ");
+	if (password !== await deps.prompt("Repeat password: ")) throw new Error("The passwords do not match");
+	return {
+		password,
+		generated: false
+	};
+};
+//#endregion
+export { generatePassword, readHidden, readPasswordFromStream, rejectPasswordArgument, resolvePassword };

package/dist/users/register.js

@@ -0,0 +1,94 @@
+import { readHidden, rejectPasswordArgument } from "./password.js";
+import { createUserCommand, listRolesCommand, listUsersCommand } from "./commands.js";
+import { deleteUserCommand, setDisabledCommand, setRoleCommand } from "./manage.js";
+import { loadProjectAuth } from "./load-auth.js";
+import { parseTtl } from "./ttl.js";
+import { Option } from "commander";
+import { createInterface } from "node:readline/promises";
+import { createUser, deleteUser, hasUsers, issueToken, listUsers, roleChoices, setUserBanned, setUserRole } from "@protobase/server";
+//#region src/users/register.ts
+const out = (text) => process.stdout.write(text);
+const usersApi = (auth) => ({
+	hasUsers: () => hasUsers(auth),
+	roles: async () => ({
+		roles: roleChoices(auth),
+		defaultRole: auth.defaultRole
+	}),
+	createUser: (input) => createUser(auth, input),
+	listUsers: () => listUsers(auth),
+	deleteUser: (email) => deleteUser(auth, email),
+	setUserRole: (input) => setUserRole(auth, input),
+	setUserBanned: (input) => setUserBanned(auth, input)
+});
+const projectApi = async () => usersApi(await loadProjectAuth(process.cwd()));
+const ask = async (question) => {
+	if (!process.stdin.isTTY) throw new Error("Confirmation needs a terminal; pass --yes to skip it");
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	const answer = await rl.question(question);
+	rl.close();
+	return answer;
+};
+const finish = (code) => process.exit(code);
+const registerUsers = (program) => {
+	const users = program.command("users").description("Manage the admin users of the project in the current directory");
+	users.command("create").description("Create a user; the first user is always an admin").argument("<email>").option("--name <name>", "display name").option("--role <role>", "role for users after the first (default: the project's default role; see `users roles`)").option("--password-stdin", "read the password from stdin", false).option("--generate-password", "generate a strong password and print it once", false).addOption(new Option("--password <value>").hideHelp()).action(async (email, opts) => {
+		rejectPasswordArgument(opts.password);
+		await createUserCommand(await projectApi(), {
+			email,
+			name: opts.name,
+			role: opts.role,
+			passwordStdin: opts.passwordStdin,
+			generatePassword: opts.generatePassword
+		}, {
+			stdin: process.stdin,
+			prompt: readHidden
+		}, out);
+		finish(0);
+	});
+	users.command("delete").description("Delete a user (refuses the last admin)").argument("<email>").option("--yes", "skip the confirmation", false).action(async (email, opts) => {
+		await deleteUserCommand(await projectApi(), {
+			email,
+			yes: opts.yes
+		}, ask, out);
+		finish(0);
+	});
+	users.command("set-role").description("Change a user's role, or several comma separated (refuses to demote the last admin)").argument("<email>").argument("<role>").action(async (email, role) => {
+		await setRoleCommand(await projectApi(), {
+			email,
+			role
+		}, out);
+		finish(0);
+	});
+	for (const disabled of [true, false]) users.command(disabled ? "disable" : "enable").description(disabled ? "Ban a user and revoke their sessions" : "Lift a ban").argument("<email>").action(async (email) => {
+		await setDisabledCommand(await projectApi(), {
+			email,
+			disabled
+		}, out);
+		finish(0);
+	});
+	users.command("roles").description("List the roles of the project (the first is admin)").action(async () => {
+		await listRolesCommand(await projectApi(), out);
+		finish(0);
+	});
+	users.command("list").description("List users: email, role, creation date").action(async () => {
+		await listUsersCommand(await projectApi(), out);
+		finish(0);
+	});
+};
+const registerToken = (program) => {
+	program.command("token").description("Print a bearer token (JWT) for an existing user").argument("<email>").option("--ttl <duration>", "lifetime: 30s, 15m, up to 24h", "15m").action(async (email, opts) => {
+		const ttlSeconds = parseTtl(opts.ttl);
+		const auth = await loadProjectAuth(process.cwd());
+		const { token } = await issueToken(auth, {
+			email,
+			ttlSeconds
+		});
+		out(`${token}\n`);
+		finish(0);
+	});
+};
+//#endregion
+export { registerToken, registerUsers, usersApi };

package/dist/users/ttl.js

@@ -0,0 +1,16 @@
+//#region src/users/ttl.ts
+const units = {
+	s: 1,
+	m: 60,
+	h: 3600
+};
+const maxTtlSeconds = 86400;
+const parseTtl = (text) => {
+	const match = /^(\d+)([smh])$/.exec(text);
+	if (!match) throw new Error(`Invalid --ttl "${text}", expected a number with s, m or h, for example 15m`);
+	const seconds = Number(match[1]) * units[match[2]];
+	if (seconds < 1 || seconds > 86400) throw new Error("--ttl must be between 1s and 24h");
+	return seconds;
+};
+//#endregion
+export { maxTtlSeconds, parseTtl };

package/dist/version/compatibility.js

@@ -0,0 +1,31 @@
+//#region src/version/compatibility.ts
+const versionPattern = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+const parseVersion = (value) => {
+	const match = typeof value === "string" ? versionPattern.exec(value) : null;
+	if (!match) return void 0;
+	return {
+		major: Number(match[1]),
+		minor: Number(match[2]),
+		patch: Number(match[3])
+	};
+};
+const line = (version) => `${version.major}.${version.minor}.x`;
+const servedRange = (version) => version.major === 0 ? line(version) : `${version.major}.0.x to ${line(version)}`;
+const neededRuntime = (version) => version.major === 0 ? line(version) : `${version.major}.${version.minor} or a newer ${version.major}.x`;
+/**
+* Why a runtime of Protobase `runtime` cannot serve a bundle built by Protobase `bundle`, or undefined when it can.
+* It can when both have the same major and the runtime's minor is the bundle's or newer; below 1.0, where a minor
+* may break, the minors must be the same. Patches never matter.
+*/
+const bundleVersionProblem = (runtime, bundle) => {
+	const own = parseVersion(runtime);
+	if (!own) throw new Error(`The runtime's own Protobase version ${JSON.stringify(runtime)} is no x.y.z version`);
+	const rebuild = `rebuild the bundle with Protobase ${line(own)}`;
+	if (bundle === void 0) return `the bundle names no Protobase version, so it was built before 0.1.0; ${rebuild} to serve it on this runtime (${runtime})`;
+	const built = parseVersion(bundle);
+	if (!built) return `the bundle's Protobase version ${JSON.stringify(bundle)} is no x.y.z version; ${rebuild} to serve it on this runtime (${runtime})`;
+	if (built.major === own.major && (own.major === 0 ? built.minor === own.minor : built.minor <= own.minor)) return void 0;
+	return `the bundle was built by Protobase ${bundle} and this runtime is Protobase ${runtime}, which serves bundles built by ${servedRange(own)}; ${rebuild} or serve it with a runtime of ${neededRuntime(built)}`;
+};
+//#endregion
+export { bundleVersionProblem };

package/dist/version/version.js

@@ -0,0 +1,5 @@
+import { version } from "../package.js";
+//#region src/version/version.ts
+const protobaseVersion = version;
+//#endregion
+export { protobaseVersion };

package/package.json

@@ -1,6 +1,58 @@
 {
   "name": "@protobase/cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.1",
+  "description": "The protobase command: scaffold, doctor, dev, build and serve a Protobase project.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PrototeamHQ/protobase.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://docs.protobase.net",
+  "type": "module",
+  "sideEffects": [
+    "./dist/dev/entry.js",
+    "./dist/serve/main.js"
+  ],
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "bin": {
+    "protobase": "./bin/protobase.mjs"
+  },
+  "files": [
+    "bin/protobase.mjs",
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@hono/node-server": "^2.1.3",
+    "@hono/vite-dev-server": "^0.26.1",
+    "@scalar/hono-api-reference": "^0.12.10",
+    "@tailwindcss/vite": "^4.3.3",
+    "@vitejs/plugin-react": "^6.1.2",
+    "aip-parsers": "^1.0.0",
+    "better-auth": "^1.7.7",
+    "commander": "^15.0.0",
+    "diff": "^9.0.0",
+    "hono": "^4.13.13",
+    "jose": "^6.2.12",
+    "kysely": "^0.29.6",
+    "pg": "^8.23.1",
+    "postgres": "^3.4.9",
+    "ts-morph": "^28.0.0",
+    "tsx": "^4.23.15",
+    "vite": "^8.3.3",
+    "zod": "^4.6.5",
+    "@protobase/layout": "0.1.1",
+    "@protobase/server": "0.1.1",
+    "@protobase/ui": "0.1.1",
+    "@protobase/schema": "0.1.1",
+    "@protobase/query": "0.1.1"
+  },
+  "scripts": {
+    "build": "tsdown"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.