@protobase/cli 0.7.0 → 0.8.0

package/dist/build/entry-code.js

@@ -1,4 +1,5 @@
 import { moduleFile } from "../module-file.js";
+import { functionFiles } from "../project/functions-folder.js";
 import { existsSync, readdirSync } from "node:fs";
 import path from "node:path";
 //#region src/build/entry-code.ts
@@ -16,8 +17,10 @@ const bundleEntryCode = (projectDir, extensions = []) => {
 		const dirs = uiDirs(configDir);
 		lines.push(`import { conventionConfig } from ${JSON.stringify(conventionModule)}`, `import * as index from ${JSON.stringify(index)}`, ...dirs.map((dir, i) => `import * as ui${i} from ${JSON.stringify(path.join(configDir, dir, "ui.ts"))}`), `const convention = conventionConfig(index, [${dirs.map((dir, i) => `[${JSON.stringify(dir)}, ui${i}]`).join(", ")}])`);
 	} else lines.push("const convention = undefined");
+	const functions = functionFiles(projectDir);
+	lines.push(...functions.map(({ file }, i) => `import * as function${i} from ${JSON.stringify(file)}`), `const functions = ${functions.length === 0 ? "undefined" : `{ ${functions.map(({ name }, i) => `${JSON.stringify(name)}: function${i}.default`).join(", ")} }`}`);
 	const configs = extensions.flatMap((extension) => extension.config ? [extension.config] : []);
-	lines.push(`import { mergeConfig } from '@protobase/server'`, ...configs.map((file, i) => `import * as extension${i} from ${JSON.stringify(file)}`), "const named = (config, file) => ({ ...config, name: config.name ?? file })", `export default mergeConfig(${[...configs.map((file, i) => `named(extension${i}.default ?? {}, ${JSON.stringify(file)})`), `named({ ...project, config: project.config ?? convention }, ${JSON.stringify(hasCustom ? "protobase.config.ts" : "config/index.ts")})`].join(", ")})`);
+	lines.push(`import { mergeConfig } from '@protobase/server'`, ...configs.map((file, i) => `import * as extension${i} from ${JSON.stringify(file)}`), "const named = (config, file) => ({ ...config, name: config.name ?? file })", `export default mergeConfig(${[...configs.map((file, i) => `named(extension${i}.default ?? {}, ${JSON.stringify(file)})`), `named({ ...project, config: project.config ?? convention, functions: project.functions ?? functions }, ${JSON.stringify(hasCustom ? "protobase.config.ts" : "config/index.ts")})`].join(", ")})`);
 	return `${lines.join("\n")}\n`;
 };
 //#endregion

package/dist/dev/entry.js

@@ -20,6 +20,8 @@ const admin = createAdmin({
 	db,
 	authenticate: project.authenticate,
 	...project.auth && { auth: project.auth },
+	...project.functions && { functions: project.functions },
+	...project.files && { files: project.files },
 	options: {
 		onUnhandledError: (error) => console.error(error),
 		...project.options

package/dist/dev/project.js

@@ -1,3 +1,4 @@
+import { functionFiles } from "../project/functions-folder.js";
 import { conventionConfig } from "../project/convention.js";
 import { sharedDb } from "./create-db.js";
 import { existsSync } from "node:fs";
@@ -22,6 +23,11 @@ const conventionExports = async (projectDir) => {
 	}
 	return conventionConfig(indexExports, uiModules);
 };
+const conventionFunctions = async (projectDir) => {
+	const files = functionFiles(projectDir);
+	if (files.length === 0) return void 0;
+	return Object.fromEntries(await Promise.all(files.map(async ({ name, file }) => [name, (await load(file)).default])));
+};
 const named = (config, file) => ({
 	...config,
 	name: config.name ?? file
@@ -33,7 +39,8 @@ const loadProject = async (projectDir, extensions = []) => {
 	for (const extension of extensions) if (extension.config) extended.push(named((await load(extension.config)).default ?? {}, extension.config));
 	const own = named({
 		...custom,
-		config: custom.config ?? await conventionExports(projectDir)
+		config: custom.config ?? await conventionExports(projectDir),
+		functions: custom.functions ?? await conventionFunctions(projectDir)
 	}, existsSync(file) ? "protobase.config.ts" : "config/index.ts");
 	const project = mergeConfig(...extended, own);
 	return {

package/dist/files/cleanup-command.js

@@ -0,0 +1,11 @@
+//#region src/files/cleanup-command.ts
+const plural = (count, word) => `${count} ${word}${count === 1 ? "" : "s"}`;
+/** Runs the scheduled file deletes that are due and says what happened to each file. */
+const cleanupCommand = async (run, out) => {
+	const { deleted, kept } = await run();
+	if (deleted.length === 0 && kept.length === 0) return out("No file deletes were due\n");
+	if (deleted.length > 0) out(`Deleted ${plural(deleted.length, "file")}:\n${deleted.map((uri) => `  ${uri}\n`).join("")}`);
+	if (kept.length > 0) out(`Kept ${plural(kept.length, "file")} a row references again:\n${kept.map((uri) => `  ${uri}\n`).join("")}`);
+};
+//#endregion
+export { cleanupCommand };

package/dist/files/load-project.js

@@ -0,0 +1,47 @@
+import { loadNearestEnvFile } from "../dev/env.js";
+import { importProjectFile } from "../project/import-project-file.js";
+import { readManifest } from "../bundle/manifest.js";
+import { createPgDb } from "../project/pg-db.js";
+import { loadBundle } from "../serve/load-bundle.js";
+import { existsSync, statSync } from "node:fs";
+import path from "node:path";
+import { configExports } from "@protobase/server";
+import pg from "pg";
+//#region src/files/load-project.ts
+const bundleProject = async (bundle) => {
+	if (!statSync(bundle).isDirectory()) return loadBundle(bundle);
+	const manifest = await readManifest(bundle);
+	return loadBundle(path.join(bundle, manifest.server));
+};
+const sourceProject = async (dir) => {
+	const file = path.join(dir, "protobase.config.ts");
+	const custom = existsSync(file) ? (await importProjectFile(file)).default ?? {} : {};
+	if (custom.config) return custom;
+	const index = path.join(dir, "config", "index.ts");
+	if (!existsSync(index)) throw new Error(`No config/index.ts or protobase.config.ts in ${dir}; run this inside a project, or name a bundle`);
+	return {
+		...custom,
+		config: await importProjectFile(index)
+	};
+};
+/**
+* What a command over a project's files needs: its resources, its files options and a database, from a bundle or from
+* the project in `dir`. `close` ends the pool it opened; a `db` the project exports stays the project's.
+*/
+const loadFilesProject = async (bundle, dir) => {
+	loadNearestEnvFile(dir);
+	const project = bundle ? await bundleProject(bundle) : await sourceProject(dir);
+	const url = process.env.DATABASE_URL;
+	if (!project.db && !url) throw new Error("No database: set DATABASE_URL or export `db` from protobase.config.ts");
+	const ownDb = project.db ? void 0 : createPgDb(pg, url);
+	return {
+		resources: configExports(project.config ?? {}).resources,
+		db: project.db ?? ownDb,
+		...project.files && { files: project.files },
+		close: async () => {
+			await ownDb?.destroy();
+		}
+	};
+};
+//#endregion
+export { loadFilesProject };

package/dist/files/register.js

@@ -0,0 +1,19 @@
+import { cleanupCommand } from "./cleanup-command.js";
+import { loadFilesProject } from "./load-project.js";
+import { createFileCleanup } from "@protobase/server";
+//#region src/files/register.ts
+const out = (text) => process.stdout.write(text);
+const registerFiles = (program) => {
+	program.command("files").description("Manage the stored files of the project in the current directory").command("cleanup").description("Delete the files whose scheduled delete is due and that no row references, such as replaced files and unused uploads").argument("[bundle]", "a bundle from `protobase build` (its folder or config module); default: the project in the current directory").action(async (bundle) => {
+		const project = await loadFilesProject(bundle, process.cwd());
+		try {
+			const cleanup = createFileCleanup(project);
+			if (cleanup) await cleanupCommand(cleanup.run, out);
+			else out("The project has no file fields\n");
+		} finally {
+			await project.close();
+		}
+	});
+};
+//#endregion
+export { registerFiles };

package/dist/infer/compat.js

@@ -8,7 +8,7 @@ const relationTargets = [
 const typesCompatible = (declared, base) => {
 	if (declared === base) return true;
 	if (declared === "relation") return relationTargets.includes(base);
-	if (declared === "currency" || declared === "country") return base === "text";
+	if (declared === "currency" || declared === "country" || declared === "file") return base === "text";
 	if (declared === "enum") return base === "text";
 	if (declared === "text") return base === "enum";
 	return false;

package/dist/main.js

@@ -11,6 +11,8 @@ import { runDoctor } from "./doctor/run.js";
 import { runScaffold } from "./scaffold/run.js";
 import { serveBundle } from "./serve/serve-bundle.js";
 import { serveBundleDir } from "./serve/serve-dir.js";
+import { registerOrganizations } from "./organizations/register.js";
+import { registerFiles } from "./files/register.js";
 import { registerToken, registerUsers } from "./users/register.js";
 import { statSync } from "node:fs";
 import path from "node:path";
@@ -84,8 +86,10 @@ program.command("serve").description("Serve a bundle written by `protobase build
 	else await serveBundle(bundle, process.env, out);
 });
 registerUsers(program);
+registerOrganizations(program);
 registerToken(program);
 registerAuth(program);
+registerFiles(program);
 const run = (argv) => program.parseAsync(argv).catch((error) => {
 	process.stderr.write(`error: ${error.message}\n`);
 	process.exitCode = 1;

package/dist/organizations/commands.js

@@ -0,0 +1,92 @@
+//#region src/organizations/commands.ts
+/** A slug from a name: lowercase ASCII words joined by dashes; diacritics are dropped, so Müller becomes muller. */
+const slugOf = (name) => name.normalize("NFKD").replace(/[̀-ͯ]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
+/** `a,b` as a list of roles; an empty text is none. */
+const parseRoleList = (text) => text === void 0 ? void 0 : text.split(",").map((name) => name.trim()).filter(Boolean);
+const listOrganizationsCommand = async (api, out) => {
+	const organizations = await api.listOrganizations();
+	if (organizations.length === 0) {
+		out("No organizations yet. Create one with: protobase organizations create \"Acme\" --owner you@example.com\n");
+		return;
+	}
+	for (const organization of organizations) {
+		out(`${organization.slug}  ${organization.name}  (${organization.id})\n`);
+		for (const member of organization.members) out(`  ${member.email}  ${member.role}${member.appRoles.length > 0 ? `  ${member.appRoles.join(",")}` : ""}\n`);
+	}
+};
+/**
+* Creates an organization owned by `owner`. With `--members all`, for an app that ran as one organization: superusers
+* join as owners with every app role and stay superusers; everyone else joins as a member, and their global roles move
+* onto the membership, since a global role would let them into every organization once there is a second.
+*/
+const createOrganizationCommand = async (api, options, out) => {
+	if (options.members !== void 0 && options.members !== "all") throw new Error(`--members takes "all", not "${options.members}"`);
+	const slug = options.slug ?? slugOf(options.name);
+	const { organization } = await api.createOrganization({
+		name: options.name,
+		slug,
+		owner: options.owner,
+		...options.id && { id: options.id }
+	});
+	out(`Created organization ${organization.slug} (${organization.id}), owned by ${options.owner}\n`);
+	if (options.members !== "all") return;
+	const holdable = api.membershipRoles();
+	for (const user of await api.listUsers()) {
+		if (user.email.toLowerCase() === options.owner.toLowerCase()) continue;
+		const global = user.role.split(",").map((name) => name.trim()).filter(Boolean);
+		if (global.includes("admin")) {
+			await api.addMember({
+				organization: organization.id,
+				email: user.email,
+				role: "owner",
+				appRoles: holdable
+			});
+			out(`  ${user.email}: owner, with every app role\n`);
+			continue;
+		}
+		const appRoles = global.filter((name) => holdable.includes(name));
+		await api.addMember({
+			organization: organization.id,
+			email: user.email,
+			role: "member",
+			appRoles
+		});
+		await api.setUserRole({
+			email: user.email,
+			role: "user"
+		});
+		out(`  ${user.email}: member${appRoles.length > 0 ? `, with ${appRoles.join(",")}` : ""}\n`);
+	}
+};
+const addMemberCommand = async (api, options, out) => {
+	const appRoles = parseRoleList(options.appRoles);
+	await api.addMember({
+		organization: options.organization,
+		email: options.email,
+		...options.orgRole && { role: options.orgRole },
+		...appRoles && { appRoles }
+	});
+	out(`Added ${options.email} to ${options.organization}\n`);
+};
+const setMemberRolesCommand = async (api, options, out) => {
+	const appRoles = parseRoleList(options.appRoles);
+	if (options.orgRole === void 0 && appRoles === void 0) throw new Error("Pass --org-role, --app-roles or both");
+	await api.setMemberRoles({
+		organization: options.organization,
+		email: options.email,
+		...options.orgRole && { role: options.orgRole },
+		...appRoles && { appRoles }
+	});
+	out(`Changed the roles of ${options.email} in ${options.organization}\n`);
+};
+const removeMemberCommand = async (api, options, out) => {
+	await api.removeMember(options);
+	out(`Removed ${options.email} from ${options.organization}\n`);
+};
+const addAppRoleCommand = async (api, options, out) => {
+	if (options.to !== "owners") throw new Error(`--to takes "owners", not "${options.to}"`);
+	const changed = await api.addAppRoleToOwners(options.role);
+	out(`Gave ${options.role} to ${changed} owner${changed === 1 ? "" : "s"}\n`);
+};
+//#endregion
+export { addAppRoleCommand, addMemberCommand, createOrganizationCommand, listOrganizationsCommand, parseRoleList, removeMemberCommand, setMemberRolesCommand, slugOf };

package/dist/organizations/register.js

@@ -0,0 +1,70 @@
+import { loadProjectAuth } from "../users/load-auth.js";
+import { addAppRoleCommand, addMemberCommand, createOrganizationCommand, listOrganizationsCommand, removeMemberCommand, setMemberRolesCommand } from "./commands.js";
+import { addAppRoleToOwners, addMember, createOrganization, listOrganizations, listUsers, removeMember, setMemberRoles, setUserRole } from "@protobase/server";
+//#region src/organizations/register.ts
+const out = (text) => process.stdout.write(text);
+const organizationsApi = (auth) => ({
+	listOrganizations: () => listOrganizations(auth),
+	createOrganization: (input) => createOrganization(auth, input),
+	addMember: (input) => addMember(auth, input),
+	setMemberRoles: (input) => setMemberRoles(auth, input),
+	removeMember: (input) => removeMember(auth, input),
+	addAppRoleToOwners: (appRole) => addAppRoleToOwners(auth, appRole),
+	listUsers: () => listUsers(auth),
+	setUserRole: (input) => setUserRole(auth, input),
+	membershipRoles: () => auth.roleDefinitions.names.filter((name) => name !== "admin" && name !== "user")
+});
+const projectApi = async () => organizationsApi(await loadProjectAuth(process.cwd()));
+const finish = (code) => process.exit(code);
+const memberOptions = (command) => command.argument("<organization>", "its slug or id").argument("<email>").option("--org-role <role>", "owner, admin or member: who manages the organization").option("--app-roles <roles>", "app roles in this organization, comma separated (see `users roles`)");
+const registerOrganizations = (program) => {
+	const organizations = program.command("organizations").description("Manage the organizations of the project in the current directory (with `organizations` in createAuth)");
+	organizations.command("list").description("List organizations with their members and roles").action(async () => {
+		await listOrganizationsCommand(await projectApi(), out);
+		finish(0);
+	});
+	organizations.command("create").description("Create an organization; its owner holds every app role").argument("<name>").requiredOption("--owner <email>", "the user who owns it").option("--slug <slug>", "default: from the name").option("--id <id>", "keep an existing tenant value, for an app that ran as one organization").option("--members <all>", "\"all\": every other user joins; their global roles move here, superusers become owners").action(async (name, opts) => {
+		await createOrganizationCommand(await projectApi(), {
+			name,
+			owner: opts.owner,
+			slug: opts.slug,
+			id: opts.id,
+			members: opts.members
+		}, out);
+		finish(0);
+	});
+	memberOptions(organizations.command("add-member").description("Add a user to an organization (organization role member unless given)")).action(async (organization, email, opts) => {
+		await addMemberCommand(await projectApi(), {
+			organization,
+			email,
+			orgRole: opts.orgRole,
+			appRoles: opts.appRoles
+		}, out);
+		finish(0);
+	});
+	memberOptions(organizations.command("set-roles").description("Change a member's organization role, app roles, or both")).action(async (organization, email, opts) => {
+		await setMemberRolesCommand(await projectApi(), {
+			organization,
+			email,
+			orgRole: opts.orgRole,
+			appRoles: opts.appRoles
+		}, out);
+		finish(0);
+	});
+	organizations.command("remove-member").description("Remove a member (refuses the last owner)").argument("<organization>", "its slug or id").argument("<email>").action(async (organization, email) => {
+		await removeMemberCommand(await projectApi(), {
+			organization,
+			email
+		}, out);
+		finish(0);
+	});
+	organizations.command("add-app-role").description("Give an app role to every owner of every organization, for a role added after they were made").argument("<role>").requiredOption("--to <owners>", "\"owners\"").action(async (role, opts) => {
+		await addAppRoleCommand(await projectApi(), {
+			role,
+			to: opts.to
+		}, out);
+		finish(0);
+	});
+};
+//#endregion
+export { organizationsApi, registerOrganizations };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.0";
+var version = "0.8.0";
 //#endregion
 export { version };

package/dist/project/functions-folder.js

@@ -0,0 +1,27 @@
+import { existsSync, readdirSync } from "node:fs";
+import path from "node:path";
+//#region src/project/functions-folder.ts
+const skipped = (entry) => entry.startsWith("_") || entry.startsWith(".") || /\.(test|spec|d)\.ts$/.test(entry);
+const functionFiles = (projectDir) => {
+	const dir = path.join(projectDir, "functions");
+	if (!existsSync(dir)) return [];
+	const found = /* @__PURE__ */ new Map();
+	const add = (name, file) => {
+		if (found.has(name)) throw new Error(`The function "${name}" is both ${found.get(name)} and ${file}; keep one of them`);
+		found.set(name, file);
+	};
+	for (const entry of readdirSync(dir, { withFileTypes: true })) {
+		if (skipped(entry.name)) continue;
+		if (entry.isDirectory()) {
+			const index = path.join(dir, entry.name, "index.ts");
+			if (!existsSync(index)) throw new Error(`functions/${entry.name} has no index.ts; a folder of shared code is named with a leading _, such as functions/_${entry.name}`);
+			add(entry.name, index);
+		} else if (entry.name.endsWith(".ts")) add(entry.name.slice(0, -3), path.join(dir, entry.name));
+	}
+	return [...found].map(([name, file]) => ({
+		name,
+		file
+	})).sort((a, b) => a.name.localeCompare(b.name));
+};
+//#endregion
+export { functionFiles };

package/dist/serve/app.js

@@ -14,6 +14,8 @@ const createServeApp = ({ project, db, requestLog, site }) => {
 		db,
 		authenticate: project.authenticate,
 		...project.auth && { auth: project.auth },
+		...project.functions && { functions: project.functions },
+		...project.files && { files: project.files },
 		options: {
 			onUnhandledError: (error) => console.error(error),
 			...project.options

package/dist/serve/cleanup-timer.js

@@ -0,0 +1,22 @@
+//#region src/serve/cleanup-timer.ts
+/**
+* Runs `run` every `minutes`, never two at once; a failed run is reported and the next one still comes. `stop` ends the
+* timer and waits for a run in progress.
+*/
+const startCleanupTimer = (run, minutes, report) => {
+	let running;
+	const tick = () => {
+		if (running) return;
+		running = run().then(() => void 0, report).finally(() => {
+			running = void 0;
+		});
+	};
+	const timer = setInterval(tick, minutes * 6e4);
+	timer.unref?.();
+	return { stop: async () => {
+		clearInterval(timer);
+		await running;
+	} };
+};
+//#endregion
+export { startCleanupTimer };

package/dist/serve/env.js

@@ -3,10 +3,13 @@ const defaultPort = 8787;
 const readServeEnv = (env) => {
 	const port = env.PORT ? Number(env.PORT) : defaultPort;
 	if (!Number.isInteger(port) || port < 0 || port > 65535) throw new Error(`PORT must be a port number, not "${env.PORT}"`);
+	const minutes = env.PROTOBASE_FILES_CLEANUP_MINUTES ? Number(env.PROTOBASE_FILES_CLEANUP_MINUTES) : 60;
+	if (!Number.isInteger(minutes) || minutes < 0) throw new Error(`PROTOBASE_FILES_CLEANUP_MINUTES must be a whole number of minutes, not "${env.PROTOBASE_FILES_CLEANUP_MINUTES}"`);
 	return {
 		port,
 		databaseUrl: env.DATABASE_URL || void 0,
-		requestLog: Boolean(env.REQUEST_LOG)
+		requestLog: Boolean(env.REQUEST_LOG),
+		filesCleanupMinutes: minutes
 	};
 };
 //#endregion

package/dist/serve/host-module-ids.js

@@ -11,6 +11,9 @@ const hostModuleIds = [
 	"postgres",
 	"better-auth",
 	"hono",
+	"hono/cors",
+	"hono/http-exception",
+	"hono/validator",
 	"jose",
 	"zod",
 	"aip-parsers",

package/dist/serve/host-modules.js

@@ -8,6 +8,9 @@ import * as hono from "hono";
 import * as apiReference from "@scalar/hono-api-reference";
 import * as aipParsers from "aip-parsers";
 import * as betterAuth from "better-auth";
+import * as honoCors from "hono/cors";
+import * as honoHttpException from "hono/http-exception";
+import * as honoValidator from "hono/validator";
 import * as jose from "jose";
 import * as kyselyPostgres from "kysely/helpers/postgres";
 import * as zod from "zod";
@@ -26,6 +29,9 @@ const hostModules = {
 	postgres: postgres$1,
 	"better-auth": betterAuth,
 	hono,
+	"hono/cors": honoCors,
+	"hono/http-exception": honoHttpException,
+	"hono/validator": honoValidator,
 	jose,
 	zod,
 	"aip-parsers": aipParsers,

package/dist/serve/lifecycle.js

@@ -1,6 +1,7 @@
 import { createPgDb } from "../project/pg-db.js";
 import { createServeApp } from "./app.js";
-import { checkAuthSchema } from "@protobase/server";
+import { startCleanupTimer } from "./cleanup-timer.js";
+import { checkAuthSchema, configExports, createFileCleanup } from "@protobase/server";
 import { createAdaptorServer } from "@hono/node-server";
 import pg from "pg";
 //#region src/serve/lifecycle.ts
@@ -28,8 +29,15 @@ const startServe = async ({ project, env, createDb = (url) => createPgDb(pg, url
 		await ownDb?.destroy();
 		throw error;
 	});
+	const cleanup = createFileCleanup({
+		resources: configExports(project.config).resources,
+		db,
+		...project.files && { files: project.files }
+	});
+	const timer = cleanup && env.filesCleanupMinutes > 0 ? startCleanupTimer(cleanup.run, env.filesCleanupMinutes, (error) => console.error(error)) : void 0;
 	const close = async () => {
 		await closeServer(server);
+		await timer?.stop();
 		await ownDb?.destroy();
 	};
 	return {

package/dist/users/register.js

@@ -1,4 +1,6 @@
 import { loadProjectAuth } from "./load-auth.js";
+import { addMemberCommand } from "../organizations/commands.js";
+import { organizationsApi } from "../organizations/register.js";
 import { readHidden, rejectPasswordArgument } from "./password.js";
 import { createUserCommand, listRolesCommand, listUsersCommand } from "./commands.js";
 import { deleteUserCommand, setDisabledCommand, setRoleCommand } from "./manage.js";
@@ -34,9 +36,10 @@ const ask = async (question) => {
 const finish = (code) => process.exit(code);
 const registerUsers = (program) => {
 	const users = program.command("users").description("Manage the admin users of the project in the current directory");
-	users.command("create").description("Create a user; the first user is always an admin").argument("<email>").option("--name <name>", "display name").option("--role <role>", "role for users after the first (default: the project's default role; see `users roles`)").option("--password-stdin", "read the password from stdin", false).option("--generate-password", "generate a strong password and print it once", false).option("--github-id <id>", "link the user to this GitHub user id, so signing in with GitHub finds them whatever their address").addOption(new Option("--password <value>").hideHelp()).action(async (email, opts) => {
+	users.command("create").description("Create a user; the first user is always an admin").argument("<email>").option("--name <name>", "display name").option("--role <role>", "role for users after the first (default: the project's default role; see `users roles`)").option("--password-stdin", "read the password from stdin", false).option("--generate-password", "generate a strong password and print it once", false).option("--github-id <id>", "link the user to this GitHub user id, so signing in with GitHub finds them whatever their address").option("--organization <organization>", "with organizations: add the user to this one (its slug or id)").option("--org-role <role>", "with --organization: owner, admin or member (default member)").option("--app-roles <roles>", "with --organization: app roles there, comma separated").addOption(new Option("--password <value>").hideHelp()).action(async (email, opts) => {
 		rejectPasswordArgument(opts.password);
-		await createUserCommand(await projectApi(), {
+		const auth = await loadProjectAuth(process.cwd());
+		await createUserCommand(usersApi(auth), {
 			email,
 			name: opts.name,
 			role: opts.role,
@@ -47,6 +50,12 @@ const registerUsers = (program) => {
 			stdin: process.stdin,
 			prompt: readHidden
 		}, out);
+		if (opts.organization) await addMemberCommand(organizationsApi(auth), {
+			organization: opts.organization,
+			email,
+			orgRole: opts.orgRole,
+			appRoles: opts.appRoles
+		}, out);
 		finish(0);
 	});
 	users.command("delete").description("Delete a user (refuses the last admin)").argument("<email>").option("--yes", "skip the confirmation", false).action(async (email, opts) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/cli",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "The protobase command: scaffold, doctor, dev, build and serve a Protobase project.",
   "license": "Apache-2.0",
   "repository": {
@@ -34,11 +34,11 @@
   "dependencies": {
     "@hono/node-server": "^2.1.3",
     "@hono/vite-dev-server": "^0.26.1",
-    "@protobase/layout": "0.7.0",
-    "@protobase/query": "0.7.0",
-    "@protobase/schema": "0.7.0",
-    "@protobase/server": "0.7.0",
-    "@protobase/ui": "0.7.0",
+    "@protobase/layout": "0.8.0",
+    "@protobase/query": "0.8.0",
+    "@protobase/schema": "0.8.0",
+    "@protobase/server": "0.8.0",
+    "@protobase/ui": "0.8.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@tailwindcss/vite": "^4.3.3",
     "@vitejs/plugin-react": "^6.1.2",