@supatype/cli 0.1.6 → 0.1.7

package/src/cloud-credentials.ts

@@ -0,0 +1,183 @@
+/**
+ * Cloud session credentials (access + refresh) for CLI ↔ control plane.
+ * Self-host links keep using long-lived SERVICE_ROLE_KEY and ignore this store.
+ */
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs"
+import { homedir } from "node:os"
+import { join } from "node:path"
+import {
+  loadProjectLink,
+  saveProjectLink,
+  type ProjectLink,
+} from "./link.js"
+
+export const CREDENTIALS_VERSION = 1 as const
+
+export interface CloudCredentials {
+  version: typeof CREDENTIALS_VERSION
+  apiUrl: string
+  accessToken: string
+  refreshToken?: string
+  email?: string
+  updatedAt: string
+}
+
+export function credentialsPath(): string {
+  return join(homedir(), ".supatype", "credentials.json")
+}
+
+export function loadCloudCredentials(): CloudCredentials | null {
+  const path = credentialsPath()
+  if (!existsSync(path)) return null
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf8")) as CloudCredentials
+    if (!raw.accessToken || !raw.apiUrl) return null
+    return raw
+  } catch {
+    return null
+  }
+}
+
+export function saveCloudCredentials(creds: CloudCredentials): void {
+  const dir = join(homedir(), ".supatype")
+  mkdirSync(dir, { recursive: true })
+  writeFileSync(credentialsPath(), `${JSON.stringify(creds, null, 2)}\n`, "utf8")
+}
+
+export function clearCloudCredentials(): void {
+  const path = credentialsPath()
+  if (!existsSync(path)) return
+  try {
+    unlinkSync(path)
+  } catch {
+    /* ignore */
+  }
+}
+
+/** Prefer link tokens; fall back to ~/.supatype/credentials.json for cloud. */
+export function resolveCloudAccessToken(link: ProjectLink): string | undefined {
+  if (link.token) return link.token
+  if (link.kind !== "cloud") return undefined
+  const creds = loadCloudCredentials()
+  if (!creds) return undefined
+  const linkApi = (link.cloudApiUrl ?? "").replace(/\/$/, "")
+  const credApi = creds.apiUrl.replace(/\/$/, "")
+  if (linkApi && credApi && linkApi !== credApi) return undefined
+  return creds.accessToken
+}
+
+export function resolveCloudRefreshToken(link: ProjectLink): string | undefined {
+  if (link.refreshToken) return link.refreshToken
+  if (link.kind !== "cloud") return undefined
+  const creds = loadCloudCredentials()
+  if (!creds?.refreshToken) return undefined
+  const linkApi = (link.cloudApiUrl ?? "").replace(/\/$/, "")
+  const credApi = creds.apiUrl.replace(/\/$/, "")
+  if (linkApi && credApi && linkApi !== credApi) return undefined
+  return creds.refreshToken
+}
+
+/** Write tokens to global credentials and the current project's cloud link (if any). */
+export function persistCloudSession(
+  cwd: string,
+  params: {
+    apiUrl: string
+    accessToken: string
+    refreshToken?: string
+    email?: string
+  },
+): void {
+  const apiUrl = params.apiUrl.replace(/\/$/, "")
+  const existing = loadCloudCredentials()
+  saveCloudCredentials({
+    version: CREDENTIALS_VERSION,
+    apiUrl,
+    accessToken: params.accessToken,
+    updatedAt: new Date().toISOString(),
+    ...(params.refreshToken !== undefined
+      ? { refreshToken: params.refreshToken }
+      : existing?.refreshToken !== undefined
+        ? { refreshToken: existing.refreshToken }
+        : {}),
+    ...(params.email !== undefined
+      ? { email: params.email }
+      : existing?.email !== undefined
+        ? { email: existing.email }
+        : {}),
+  })
+
+  const link = loadProjectLink(cwd)
+  if (!link || link.kind !== "cloud") return
+  link.token = params.accessToken
+  if (params.refreshToken !== undefined) {
+    link.refreshToken = params.refreshToken
+  }
+  saveProjectLink(cwd, link)
+}
+
+export interface CloudLoginResult {
+  accessToken: string
+  refreshToken?: string
+  expiresIn?: number
+  email?: string
+}
+
+/** Password login against control-plane `/auth/login` (not `/api/v1`). */
+export async function cloudPasswordLogin(
+  apiUrl: string,
+  email: string,
+  password: string,
+): Promise<CloudLoginResult> {
+  const base = apiUrl.replace(/\/$/, "")
+  const res = await fetch(`${base}/auth/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ email: email.toLowerCase(), password }),
+  })
+  const json = (await res.json().catch(() => ({}))) as {
+    message?: string
+    error?: string
+    access_token?: string
+    refresh_token?: string
+    expires_in?: number
+    user?: { email?: string }
+  }
+  if (!res.ok || !json.access_token) {
+    throw new Error(json.message ?? json.error ?? `Login failed (${res.status})`)
+  }
+  return {
+    accessToken: json.access_token,
+    ...(json.refresh_token !== undefined ? { refreshToken: json.refresh_token } : {}),
+    ...(json.expires_in !== undefined ? { expiresIn: json.expires_in } : {}),
+    ...(json.user?.email !== undefined
+      ? { email: json.user.email }
+      : { email: email.toLowerCase() }),
+  }
+}
+
+export async function cloudRefreshSession(
+  apiUrl: string,
+  refreshToken: string,
+): Promise<CloudLoginResult> {
+  const base = apiUrl.replace(/\/$/, "")
+  const res = await fetch(`${base}/auth/refresh`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ refresh_token: refreshToken }),
+  })
+  const json = (await res.json().catch(() => ({}))) as {
+    message?: string
+    error?: string
+    access_token?: string
+    refresh_token?: string
+    expires_in?: number
+  }
+  if (!res.ok || !json.access_token) {
+    throw new Error(json.message ?? json.error ?? `Token refresh failed (${res.status})`)
+  }
+  return {
+    accessToken: json.access_token,
+    ...(json.refresh_token !== undefined ? { refreshToken: json.refresh_token } : {}),
+    ...(json.expires_in !== undefined ? { expiresIn: json.expires_in } : {}),
+  }
+}

package/src/commands/admin.ts

@@ -32,6 +32,26 @@ export const ADMIN_PASSWORD_ENV = "SUPATYPE_ADMIN_PASSWORD"
 
 const BCRYPT_ROUNDS = 10
 
+/**
+ * Studio roles a membership row may hold, most privileged first.
+ *
+ * Must match `studioRolePermissions` in supatype-server and
+ * `STUDIO_ROLE_PERMISSIONS` in the control plane: capability checks refuse a role
+ * they do not recognise, so an unvalidated `--role` here would create a user who
+ * is locked out of the very panel they were made for.
+ */
+export const STUDIO_ROLES = ["admin", "developer", "editor"] as const
+
+function assertStudioRole(role: string): void {
+  if ((STUDIO_ROLES as readonly string[]).includes(role)) return
+  error(
+    `Unknown Studio role "${role}". Choose one of: ${STUDIO_ROLES.join(", ")}.\n` +
+      "  Studio roles are Supatype's own; your application's roles are separate " +
+      "and belong in your access rules.",
+  )
+  process.exit(1)
+}
+
 /** GoTrue scopes users to the nil instance id in single-tenant/self-host mode. */
 export const GOTRUE_NIL_INSTANCE_ID = "00000000-0000-0000-0000-000000000000"
 
@@ -89,7 +109,7 @@ export function registerAdmin(program: Command): void {
     .description("Create an admin user for the admin panel")
     .option("--email <email>", "Admin user email address")
     .option("--password <password>", "Admin user password (prompted if not provided)")
-    .option("--role <role>", "Admin role to assign", "admin")
+    .option("--role <role>", `Studio role to assign (${STUDIO_ROLES.join(" | ")})`, "admin")
     .option("--connection <url>", "Database connection URL (overrides config)")
     .action(
       async (opts: {
@@ -116,6 +136,7 @@ export function registerAdmin(program: Command): void {
         }
 
         const role = opts.role
+        assertStudioRole(role)
 
         info(`Creating admin user: ${email} (role: ${role})...`)
 
@@ -154,10 +175,11 @@ export function registerAdmin(program: Command): void {
     .command("set-role")
     .description("Change an existing user's admin role")
     .requiredOption("--email <email>", "User email address")
-    .requiredOption("--role <role>", "New role to assign")
+    .requiredOption("--role <role>", `New Studio role (${STUDIO_ROLES.join(" | ")})`)
     .option("--connection <url>", "Database connection URL (overrides config)")
     .action(
       async (opts: { email: string; role: string; connection?: string }) => {
+        assertStudioRole(opts.role)
         const cwd = process.cwd()
         const config = loadConfig(cwd)
         const connection = resolveAdminConnection(cwd, config, opts.connection)
@@ -166,13 +188,23 @@ export function registerAdmin(program: Command): void {
         const pool = new pg.Pool({ connectionString: connection, max: 2 })
 
         try {
+          // Studio roles live in `_supatype.studio_members`, not in
+          // `app_metadata`: that key is the developer's namespace for their own
+          // app roles, and writing Studio access there means assigning an app
+          // role could hand out admin UI access by accident.
+          await ensureStudioMembersTable((sql, params) => pool.query(sql, params))
           const result = await pool.query(
-            `UPDATE auth.users
-             SET raw_app_meta_data = raw_app_meta_data || $1::jsonb,
-                 updated_at = now()
-             WHERE email = $2
-             RETURNING id, email, raw_app_meta_data`,
-            [JSON.stringify({ role: opts.role }), opts.email.toLowerCase()],
+            `WITH target AS (
+               SELECT id, email FROM auth.users WHERE email = $2
+             ), upsert AS (
+               INSERT INTO _supatype.studio_members (user_id, role)
+               SELECT id, $1 FROM target
+               ON CONFLICT (user_id) DO UPDATE
+                 SET role = EXCLUDED.role, updated_at = now()
+               RETURNING user_id
+             )
+             SELECT id, email FROM target`,
+            [opts.role, opts.email.toLowerCase()],
           )
 
           if (result.rows.length === 0) {
@@ -180,11 +212,7 @@ export function registerAdmin(program: Command): void {
             process.exit(1)
           }
 
-          const user = result.rows[0] as {
-            id: string
-            email: string
-            raw_app_meta_data: Record<string, unknown>
-          }
+          const user = result.rows[0] as { id: string; email: string }
 
           info("Role updated successfully.")
           plain(`  ID:    ${user.id}`)
@@ -203,7 +231,7 @@ export function registerAdmin(program: Command): void {
 
   adminCmd
     .command("list-users")
-    .description("List users with admin roles")
+    .description("List users with Studio access")
     .option("--connection <url>", "Database connection URL (overrides config)")
     .action(async (opts: { connection?: string }) => {
       const cwd = process.cwd()
@@ -214,12 +242,17 @@ export function registerAdmin(program: Command): void {
       const pool = new pg.Pool({ connectionString: connection, max: 2 })
 
       try {
+        // Studio access is membership, not a claim — list the grant that
+        // actually decides admission. LEFT JOIN, because a membership held by a
+        // Supatype Cloud account has no row in this project's `auth.users`;
+        // hiding those would make `list-users` disagree with who can log in.
         const result = await pool.query(
-          `SELECT id, email, raw_app_meta_data->>'role' as role, created_at
-           FROM auth.users
-           WHERE raw_app_meta_data->>'role' IS NOT NULL
-             AND raw_app_meta_data->>'role' != 'authenticated'
-           ORDER BY created_at ASC`,
+          `SELECT COALESCE(m.user_id, m.platform_user_id) AS id,
+                  COALESCE(u.email, '(cloud account)') AS email,
+                  m.role, m.created_at
+             FROM _supatype.studio_members m
+             LEFT JOIN auth.users u ON u.id = m.user_id
+            ORDER BY m.created_at ASC`,
         )
 
         if (result.rows.length === 0) {
@@ -318,7 +351,8 @@ export async function ensureFirstAdminUserForProject(
   await ensureFirstAdminUser(connection, merged)
 }
 
-async function ensureFirstAdminWithQuery(
+/** Exported for tests: the DB seam both the pool and compose paths share. */
+export async function ensureFirstAdminWithQuery(
   query: DbQuery,
   options: EnsureFirstAdminOptions,
 ): Promise<void> {
@@ -408,7 +442,9 @@ async function resolveAdminCredentials(
 }
 
 export function clearAdminSeedPassword(cwd: string): void {
-  upsertEnvFile(cwd, {}, [ADMIN_PASSWORD_ENV])
+  // Unconditional: this is a one-time seed password being retired, and whoever wrote it wanted it
+  // gone once used.
+  upsertEnvFile(cwd, {}, { remove: [ADMIN_PASSWORD_ENV] })
 }
 
 export async function hashPasswordForAuth(password: string): Promise<string> {
@@ -442,8 +478,11 @@ async function createAdminUser(
   }
 
   const passwordHash = await hashPasswordForAuth(password)
+  // No `role` here: `app_metadata` is the developer's namespace for their own
+  // application roles, and Studio access is granted through
+  // `_supatype.studio_members` instead. Writing it in both places means an app
+  // role assignment can silently confer admin UI access.
   const appMetadata = JSON.stringify({
-    role,
     provider: "email",
     providers: ["email"],
   })
@@ -472,6 +511,7 @@ async function createAdminUser(
   )
 
   const user = result.rows[0] as { id: string; email: string }
+  await recordStudioMembership(query, user.id, role)
   if (!opts.quiet) {
     info("Admin user created successfully.")
     plain(`  ID:    ${user.id}`)
@@ -481,6 +521,31 @@ async function createAdminUser(
   return user
 }
 
+/**
+ * Record Studio access in `_supatype.studio_members`.
+ *
+ * Studio capability is deliberately not a JWT claim: `app_metadata` belongs to
+ * the developer's own app roles, and letting it grant Studio access means a
+ * developer assigning an app role could hand out admin UI access by accident.
+ *
+ * This is now the *only* grant, so a failure here is fatal to the command — a
+ * user created without a membership row cannot reach Studio at all, and
+ * reporting success would leave no clue why.
+ */
+async function recordStudioMembership(
+  query: DbQuery,
+  userId: string,
+  role: string,
+): Promise<void> {
+  await ensureStudioMembersTable(query)
+  await query(
+    `INSERT INTO _supatype.studio_members (user_id, role)
+     VALUES ($1, $2)
+     ON CONFLICT (user_id) DO UPDATE SET role = EXCLUDED.role, updated_at = now()`,
+    [userId, role],
+  )
+}
+
 async function ensureAuthUsersTable(pool: Pool): Promise<void> {
   await pool.query(`
     CREATE SCHEMA IF NOT EXISTS auth;
@@ -521,16 +586,66 @@ async function authUsersTableExists(query: DbQuery): Promise<boolean> {
   return Boolean(result.rows[0]?.exists)
 }
 
+/**
+ * Whether anyone can already reach Studio.
+ *
+ * Counts membership rows, not `app_metadata` claims: the claim no longer grants
+ * anything, so counting it would report an admin exists while nobody can log in.
+ * A missing table means the project has never been pushed — no admins.
+ */
 async function hasAdminUsers(query: DbQuery): Promise<boolean> {
+  // Postgres resolves relations at parse time, so the table has to be checked
+  // separately rather than guarded inside the count query. Absent means the
+  // project has never been pushed — no admins, and `createAdminUser` will
+  // create the table itself.
+  if (!(await studioMembersTableExists(query))) return false
+
+  // Inner JOIN on purpose, unlike `list-users`: a membership held by a cloud
+  // account cannot log in to a self-hosted GoTrue, so a project exported from
+  // cloud with only those grants genuinely still needs a first admin.
   const adminCount = await query(
-    `SELECT COUNT(*)::int as count FROM auth.users
-     WHERE raw_app_meta_data->>'role' IS NOT NULL
-       AND raw_app_meta_data->>'role' != 'authenticated'`,
+    `SELECT COUNT(*)::int as count
+       FROM _supatype.studio_members m
+       JOIN auth.users u ON u.id = m.user_id
+      WHERE m.role <> 'authenticated'`,
   )
   const count = (adminCount.rows[0] as { count: number } | undefined)?.count ?? 0
   return count > 0
 }
 
+/**
+ * A project whose engine predates the membership table, or one that has never
+ * been pushed, still needs working `admin create-user` / `admin set-role`.
+ * Mirrors the engine's own definition (`create_studio_members_table_sql`).
+ *
+ * A row is held by exactly one identity: `user_id` for a project user (what the
+ * CLI grants), or `platform_user_id` for a Supatype Cloud account. The engine
+ * migrates older single-identity tables; this only has to create the current
+ * shape when there is nothing there at all.
+ */
+async function ensureStudioMembersTable(query: DbQuery): Promise<void> {
+  await query(`CREATE SCHEMA IF NOT EXISTS _supatype`)
+  await query(
+    `CREATE TABLE IF NOT EXISTS _supatype.studio_members (
+       id                UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+       user_id           UUID UNIQUE,
+       platform_user_id  UUID UNIQUE,
+       role              TEXT NOT NULL,
+       created_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+       updated_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+       CONSTRAINT studio_members_one_identity
+         CHECK (num_nonnulls(user_id, platform_user_id) = 1)
+     )`,
+  )
+}
+
+async function studioMembersTableExists(query: DbQuery): Promise<boolean> {
+  const result = await query(
+    `SELECT to_regclass('_supatype.studio_members') IS NOT NULL as exists`,
+  )
+  return Boolean(result.rows[0]?.exists)
+}
+
 /** Postgres password for compose `exec psql` (db is not published to the host). */
 export function composePostgresPassword(cwd: string): string {
   return readEnvValue(cwd, "POSTGRES_PASSWORD", "postgres")

package/src/commands/cache.ts

@@ -3,8 +3,14 @@
  */
 
 import type { Command } from "commander"
-import { existsSync, readdirSync, rmSync, statSync } from "node:fs"
-import { join } from "node:path"
+import { existsSync } from "node:fs"
+import {
+  BINARY_COMPONENTS,
+  formatBytes,
+  listCacheEntries,
+  resolveCacheProjectDirs,
+} from "../cache-clean.js"
+import { cleanCachedBinaries } from "../cache-pins.js"
 import { cacheRoot, type Component } from "../binary-cache.js"
 import {
   deleteRestCacheEntry,
@@ -12,9 +18,11 @@ import {
   getRestCacheEntry,
   listRestCacheEntries,
 } from "../rest-cache-admin.js"
-import { error, info, plain } from "../ui/messages.js"
+import { error, info, plain, warn } from "../ui/messages.js"
 
-const COMPONENTS: Component[] = ["engine", "server", "postgres", "deno"]
+function isComponent(value: string): value is Component {
+  return (BINARY_COMPONENTS as readonly string[]).includes(value)
+}
 
 export function registerCache(program: Command): void {
   const cache = program
@@ -24,79 +32,106 @@ export function registerCache(program: Command): void {
   cache
     .command("list")
     .description("List cached component binaries and their sizes")
-    .action(async () => {
+    .option("--project <path>", "Include pins from another project directory", collectPaths, [])
+    .action(async (opts: { project: string[] }) => {
+      const cwd = process.cwd()
+      const projectDirs = resolveCacheProjectDirs(cwd, opts.project)
       const root = cacheRoot()
+
       if (!existsSync(root)) {
         info("Cache is empty.")
         return
       }
 
-      let totalBytes = 0
-      let found = false
-
-      for (const component of COMPONENTS) {
-        const compDir = join(root, component)
-        if (!existsSync(compDir)) continue
-
-        const versions = readdirSync(compDir).filter(
-          (v) => statSync(join(compDir, v)).isDirectory(),
-        )
-        for (const version of versions) {
-          const vDir = join(compDir, version)
-          const size = dirSize(vDir)
-          totalBytes += size
-          found = true
-          plain(`  ${component}@${version}  ${formatBytes(size)}`)
-        }
-      }
-
-      if (!found) {
+      const entries = listCacheEntries(projectDirs)
+      if (entries.length === 0) {
         info("Cache is empty.")
         return
       }
 
+      let totalBytes = 0
+      for (const entry of entries) {
+        totalBytes += entry.bytes
+        const pinLabel = entry.pinned ? "  (pinned)" : ""
+        plain(`  ${entry.component}@${entry.version}  ${formatBytes(entry.bytes)}${pinLabel}`)
+      }
+
       plain(`\nTotal: ${formatBytes(totalBytes)}`)
       info(`Cache root: ${root}`)
+      if (projectDirs.length > 0) {
+        info(`Pin scan: ${projectDirs.length} project(s)`)
+      }
     })
 
   cache
     .command("clean [component] [version]")
     .description(
-      "Remove cached binaries. Optionally specify a component and/or version.\n" +
+      "Remove cached binaries not pinned by local project configs.\n" +
+        "Use --force to remove everything (legacy behavior).\n" +
         "Examples:\n" +
-        "  supatype cache clean           # remove everything\n" +
-        "  supatype cache clean engine    # remove all engine versions\n" +
-        "  supatype cache clean engine 0.4.2",
+        "  supatype cache clean                    # remove unpinned versions\n" +
+        "  supatype cache clean engine             # remove unpinned engine versions\n" +
+        "  supatype cache clean engine 0.4.2       # remove one version (warns if pinned)\n" +
+        "  supatype cache clean --force            # remove all cached binaries",
     )
-    .action(async (component?: string, version?: string) => {
-      const root = cacheRoot()
-      if (!existsSync(root)) {
-        info("Cache is already empty.")
-        return
-      }
+    .option("--dry-run", "Show what would be removed without deleting")
+    .option("--force", "Remove all matching cache entries, ignoring version pins")
+    .option("--project <path>", "Include pins from another project directory", collectPaths, [])
+    .action(
+      async (
+        component?: string,
+        version?: string,
+        opts?: { dryRun?: boolean; force?: boolean; project?: string[] },
+      ) => {
+        const cwd = process.cwd()
+        const projectDirs = resolveCacheProjectDirs(cwd, opts?.project ?? [])
+        const root = cacheRoot()
+
+        if (!existsSync(root)) {
+          info("Cache is already empty.")
+          return
+        }
 
-      const targets = component ? [component as Component] : COMPONENTS
+        if (component && !isComponent(component)) {
+          error(
+            `Unknown component "${component}". Valid: ${BINARY_COMPONENTS.join(", ")}`,
+          )
+          process.exitCode = 1
+          return
+        }
 
-      for (const comp of targets) {
-        const compDir = join(root, comp)
-        if (!existsSync(compDir)) continue
+        const components: Component[] =
+          component !== undefined ? [component as Component] : [...BINARY_COMPONENTS]
+        const result = cleanCachedBinaries({
+          components,
+          ...(version !== undefined && version !== "" ? { version } : {}),
+          ...(opts?.force !== undefined ? { force: opts.force } : {}),
+          ...(opts?.dryRun !== undefined ? { dryRun: opts.dryRun } : {}),
+          projectDirs,
+        })
+
+        for (const message of result.warned) {
+          warn(message)
+        }
 
-        if (version) {
-          const vDir = join(compDir, version)
-          if (!existsSync(vDir)) {
-            info(`${comp}@${version} not cached.`)
-            continue
-          }
-          rmSync(vDir, { recursive: true, force: true })
-          plain(`  removed  ${comp}@${version}`)
-        } else {
-          rmSync(compDir, { recursive: true, force: true })
-          plain(`  removed  ${comp} (all versions)`)
+        for (const entry of result.skipped) {
+          plain(`  kept     ${entry.component}@${entry.version}  (${entry.reason})`)
         }
-      }
 
-      info("Done.")
-    })
+        for (const entry of result.removed) {
+          const prefix = opts?.dryRun ? "would remove" : "removed"
+          plain(`  ${prefix}  ${entry.component}@${entry.version}`)
+        }
+
+        if (result.removed.length === 0 && result.skipped.length === 0) {
+          info("Nothing to clean.")
+        } else if (opts?.dryRun) {
+          info(`Dry run — ${result.removed.length} entr${result.removed.length === 1 ? "y" : "ies"} would be removed.`)
+        } else {
+          info("Done.")
+        }
+      },
+    )
 
   const rest = cache
     .command("rest")
@@ -193,26 +228,6 @@ export function registerCache(program: Command): void {
     })
 }
 
-function dirSize(dir: string): number {
-  let total = 0
-  try {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      const full = join(dir, entry.name)
-      if (entry.isDirectory()) {
-        total += dirSize(full)
-      } else {
-        total += statSync(full).size
-      }
-    }
-  } catch {
-    // Skip unreadable entries.
-  }
-  return total
-}
-
-function formatBytes(bytes: number): string {
-  if (bytes < 1024) return `${bytes} B`
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`
-  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`
-  return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`
+function collectPaths(value: string, previous: string[]): string[] {
+  return [...previous, value]
 }