@supatype/cli 0.1.6 → 0.1.7

package/dist/cli-install-method.js

@@ -0,0 +1,60 @@
+/**
+ * Detect how the supatype CLI was installed (npm, Homebrew, standalone CDN).
+ */
+function normalizePath(path) {
+    return path.replace(/\\/g, "/");
+}
+/** The running binary sits in an npm or workspace layout. */
+function hasNpmInstallPath() {
+    const main = normalizePath(process.argv[1] ?? "");
+    return (main.includes("node_modules") ||
+        main.includes("/dist/cli") ||
+        main.includes("/bin/supatype.js"));
+}
+/** Launched through an npm/pnpm/yarn script, whatever the binary's own layout. */
+function ranUnderPackageManager() {
+    return Boolean(process.env["npm_execpath"]) || Boolean(process.env["npm_lifecycle_event"]);
+}
+/** npm global, project dependency, or monorepo workspace build. */
+export function looksLikeNpmOrWorkspaceCLI() {
+    return hasNpmInstallPath() || ranUnderPackageManager();
+}
+/** Homebrew / Linuxbrew Cellar layout. */
+export function looksLikeHomebrewCLI() {
+    const main = normalizePath(process.argv[1] ?? "");
+    if (!main)
+        return false;
+    if (/(?:^|\/)Cellar\/supatype\//.test(main))
+        return true;
+    const cellar = process.env["HOMEBREW_CELLAR"];
+    if (cellar && normalizePath(main).startsWith(normalizePath(cellar) + "/") && main.includes("/supatype/")) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Which installer owns the running binary — this decides what `self-update`
+ * tells the user to run, so it has to describe the binary on disk.
+ *
+ * Path shape wins over `npm_*` in the environment: those are set whenever the
+ * CLI is invoked from a package script, which says nothing about how the binary
+ * got there. Trusting them meant a Homebrew or curl install called from an npm
+ * script was told to update itself with npm.
+ */
+export function detectCliInstallMethod() {
+    if (hasNpmInstallPath())
+        return "npm";
+    if (looksLikeHomebrewCLI())
+        return "homebrew";
+    if (isStandalonePath())
+        return "standalone";
+    if (ranUnderPackageManager())
+        return "npm";
+    return "standalone";
+}
+/** The `curl | sh` installer's default target. */
+function isStandalonePath() {
+    const main = normalizePath(process.argv[1] ?? "");
+    return main.includes("/.supatype/bin/");
+}
+//# sourceMappingURL=cli-install-method.js.map

package/dist/cli-install-method.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-install-method.js","sourceRoot":"","sources":["../src/cli-install-method.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AACjC,CAAC;AAED,6DAA6D;AAC7D,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACjD,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAClC,CAAA;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,sBAAsB;IAC7B,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAA;AAC5F,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,0BAA0B;IACxC,OAAO,iBAAiB,EAAE,IAAI,sBAAsB,EAAE,CAAA;AACxD,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,oBAAoB;IAClC,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAExD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IAC7C,IAAI,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACzG,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB;IACpC,IAAI,iBAAiB,EAAE;QAAE,OAAO,KAAK,CAAA;IACrC,IAAI,oBAAoB,EAAE;QAAE,OAAO,UAAU,CAAA;IAC7C,IAAI,gBAAgB,EAAE;QAAE,OAAO,YAAY,CAAA;IAC3C,IAAI,sBAAsB,EAAE;QAAE,OAAO,KAAK,CAAA;IAC1C,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,kDAAkD;AAClD,SAAS,gBAAgB;IACvB,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;AACzC,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAmCA,wBAAsB,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CA6CzC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAsCA,wBAAsB,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAgDzC"}

package/dist/cli.js

@@ -18,6 +18,7 @@ import { registerApp } from "./commands/app.js";
 import { registerAdd } from "./commands/add.js";
 import { registerSelfHost } from "./commands/self-host.js";
 import { registerCloud } from "./commands/cloud.js";
+import { registerLogin } from "./commands/login.js";
 import { registerEngine } from "./commands/engine.js";
 import { registerDb } from "./commands/db.js";
 import { registerDeploy } from "./commands/deploy.js";
@@ -25,10 +26,12 @@ import { registerStatus } from "./commands/status.js";
 import { registerLogs } from "./commands/logs.js";
 import { registerAdmin } from "./commands/admin.js";
 import { registerFunctions } from "./commands/functions.js";
+import { registerHooks } from "./commands/hooks.js";
 import { registerPlugins } from "./commands/plugins.js";
 import { registerTypes } from "./commands/types.js";
 import { registerMigrateFromV1 } from "./commands/migrate-from-v1.js";
 import { registerSelfUpdate } from "./commands/self-update.js";
+import { registerInternalCommands } from "./commands/internal.js";
 import { cliPackageVersion } from "./cli-package-version.js";
 import { reportCliFatal } from "./ui/fatal.js";
 import { wrapProgramActionsWithChrome } from "./ui/runtime/command-chrome.js";
@@ -41,6 +44,7 @@ export async function run() {
     registerDev(program);
     registerCache(program);
     registerSelfUpdate(program);
+    registerInternalCommands(program);
     registerUpdate(program);
     registerPg(program);
     registerPush(program);
@@ -56,6 +60,7 @@ export async function run() {
     registerApp(program);
     registerAdd(program);
     registerSelfHost(program);
+    registerLogin(program);
     registerCloud(program);
     registerEngine(program);
     registerDb(program);
@@ -64,6 +69,7 @@ export async function run() {
     registerLogs(program);
     registerAdmin(program);
     registerFunctions(program);
+    registerHooks(program);
     registerPlugins(program);
     registerTypes(program);
     registerMigrateFromV1(program);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAA;AAE7E,MAAM,CAAC,KAAK,UAAU,GAAG;IACvB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;SAC1B,IAAI,CAAC,UAAU,CAAC;SAChB,WAAW,CAAC,+CAA+C,CAAC;SAC5D,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAE/B,YAAY,CAAC,OAAO,CAAC,CAAA;IACrB,WAAW,CAAC,OAAO,CAAC,CAAA;IACpB,aAAa,CAAC,OAAO,CAAC,CAAA;IACtB,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC3B,cAAc,CAAC,OAAO,CAAC,CAAA;IACvB,UAAU,CAAC,OAAO,CAAC,CAAA;IACnB,YAAY,CAAC,OAAO,CAAC,CAAA;IACrB,YAAY,CAAC,OAAO,CAAC,CAAA;IACrB,YAAY,CAAC,OAAO,CAAC,CAAA;IACrB,cAAc,CAAC,OAAO,CAAC,CAAA;IACvB,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC3B,aAAa,CAAC,OAAO,CAAC,CAAA;IACtB,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACzB,eAAe,CAAC,OAAO,CAAC,CAAA;IACxB,YAAY,CAAC,OAAO,CAAC,CAAA;IACrB,YAAY,CAAC,OAAO,CAAC,CAAA;IACrB,WAAW,CAAC,OAAO,CAAC,CAAA;IACpB,WAAW,CAAC,OAAO,CAAC,CAAA;IACpB,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACzB,aAAa,CAAC,OAAO,CAAC,CAAA;IACtB,cAAc,CAAC,OAAO,CAAC,CAAA;IACvB,UAAU,CAAC,OAAO,CAAC,CAAA;IACnB,cAAc,CAAC,OAAO,CAAC,CAAA;IACvB,cAAc,CAAC,OAAO,CAAC,CAAA;IACvB,YAAY,CAAC,OAAO,CAAC,CAAA;IACrB,aAAa,CAAC,OAAO,CAAC,CAAA;IACtB,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,eAAe,CAAC,OAAO,CAAC,CAAA;IACxB,aAAa,CAAC,OAAO,CAAC,CAAA;IACtB,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAE9B,4BAA4B,CAAC,OAAO,CAAC,CAAA;IAErC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,cAAc,CAAC,GAAG,CAAC,CAAA;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAA;AAE7E,MAAM,CAAC,KAAK,UAAU,GAAG;IACvB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;SAC1B,IAAI,CAAC,UAAU,CAAC;SAChB,WAAW,CAAC,+CAA+C,CAAC;SAC5D,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAE/B,YAAY,CAAC,OAAO,CAAC,CAAA;IACrB,WAAW,CAAC,OAAO,CAAC,CAAA;IACpB,aAAa,CAAC,OAAO,CAAC,CAAA;IACtB,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC3B,wBAAwB,CAAC,OAAO,CAAC,CAAA;IACjC,cAAc,CAAC,OAAO,CAAC,CAAA;IACvB,UAAU,CAAC,OAAO,CAAC,CAAA;IACnB,YAAY,CAAC,OAAO,CAAC,CAAA;IACrB,YAAY,CAAC,OAAO,CAAC,CAAA;IACrB,YAAY,CAAC,OAAO,CAAC,CAAA;IACrB,cAAc,CAAC,OAAO,CAAC,CAAA;IACvB,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC3B,aAAa,CAAC,OAAO,CAAC,CAAA;IACtB,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACzB,eAAe,CAAC,OAAO,CAAC,CAAA;IACxB,YAAY,CAAC,OAAO,CAAC,CAAA;IACrB,YAAY,CAAC,OAAO,CAAC,CAAA;IACrB,WAAW,CAAC,OAAO,CAAC,CAAA;IACpB,WAAW,CAAC,OAAO,CAAC,CAAA;IACpB,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACzB,aAAa,CAAC,OAAO,CAAC,CAAA;IACtB,aAAa,CAAC,OAAO,CAAC,CAAA;IACtB,cAAc,CAAC,OAAO,CAAC,CAAA;IACvB,UAAU,CAAC,OAAO,CAAC,CAAA;IACnB,cAAc,CAAC,OAAO,CAAC,CAAA;IACvB,cAAc,CAAC,OAAO,CAAC,CAAA;IACvB,YAAY,CAAC,OAAO,CAAC,CAAA;IACrB,aAAa,CAAC,OAAO,CAAC,CAAA;IACtB,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,aAAa,CAAC,OAAO,CAAC,CAAA;IACtB,eAAe,CAAC,OAAO,CAAC,CAAA;IACxB,aAAa,CAAC,OAAO,CAAC,CAAA;IACtB,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAE9B,4BAA4B,CAAC,OAAO,CAAC,CAAA;IAErC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,cAAc,CAAC,GAAG,CAAC,CAAA;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC"}

package/dist/cloud-credentials.d.ts

@@ -0,0 +1,34 @@
+import { type ProjectLink } from "./link.js";
+export declare const CREDENTIALS_VERSION: 1;
+export interface CloudCredentials {
+    version: typeof CREDENTIALS_VERSION;
+    apiUrl: string;
+    accessToken: string;
+    refreshToken?: string;
+    email?: string;
+    updatedAt: string;
+}
+export declare function credentialsPath(): string;
+export declare function loadCloudCredentials(): CloudCredentials | null;
+export declare function saveCloudCredentials(creds: CloudCredentials): void;
+export declare function clearCloudCredentials(): void;
+/** Prefer link tokens; fall back to ~/.supatype/credentials.json for cloud. */
+export declare function resolveCloudAccessToken(link: ProjectLink): string | undefined;
+export declare function resolveCloudRefreshToken(link: ProjectLink): string | undefined;
+/** Write tokens to global credentials and the current project's cloud link (if any). */
+export declare function persistCloudSession(cwd: string, params: {
+    apiUrl: string;
+    accessToken: string;
+    refreshToken?: string;
+    email?: string;
+}): void;
+export interface CloudLoginResult {
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn?: number;
+    email?: string;
+}
+/** Password login against control-plane `/auth/login` (not `/api/v1`). */
+export declare function cloudPasswordLogin(apiUrl: string, email: string, password: string): Promise<CloudLoginResult>;
+export declare function cloudRefreshSession(apiUrl: string, refreshToken: string): Promise<CloudLoginResult>;
+//# sourceMappingURL=cloud-credentials.d.ts.map

package/dist/cloud-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-credentials.d.ts","sourceRoot":"","sources":["../src/cloud-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,WAAW,CAAA;AAElB,eAAO,MAAM,mBAAmB,EAAG,CAAU,CAAA;AAE7C,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,mBAAmB,CAAA;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,oBAAoB,IAAI,gBAAgB,GAAG,IAAI,CAU9D;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAIlE;AAED,wBAAgB,qBAAqB,IAAI,IAAI,CAQ5C;AAED,+EAA+E;AAC/E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAS7E;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAS9E;AAED,wFAAwF;AACxF,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE;IACN,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GACA,IAAI,CA2BN;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,0EAA0E;AAC1E,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,CAAC,CA0B3B;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAsB3B"}

package/dist/cloud-credentials.js

@@ -0,0 +1,139 @@
+/**
+ * Cloud session credentials (access + refresh) for CLI ↔ control plane.
+ * Self-host links keep using long-lived SERVICE_ROLE_KEY and ignore this store.
+ */
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { loadProjectLink, saveProjectLink, } from "./link.js";
+export const CREDENTIALS_VERSION = 1;
+export function credentialsPath() {
+    return join(homedir(), ".supatype", "credentials.json");
+}
+export function loadCloudCredentials() {
+    const path = credentialsPath();
+    if (!existsSync(path))
+        return null;
+    try {
+        const raw = JSON.parse(readFileSync(path, "utf8"));
+        if (!raw.accessToken || !raw.apiUrl)
+            return null;
+        return raw;
+    }
+    catch {
+        return null;
+    }
+}
+export function saveCloudCredentials(creds) {
+    const dir = join(homedir(), ".supatype");
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(credentialsPath(), `${JSON.stringify(creds, null, 2)}\n`, "utf8");
+}
+export function clearCloudCredentials() {
+    const path = credentialsPath();
+    if (!existsSync(path))
+        return;
+    try {
+        unlinkSync(path);
+    }
+    catch {
+        /* ignore */
+    }
+}
+/** Prefer link tokens; fall back to ~/.supatype/credentials.json for cloud. */
+export function resolveCloudAccessToken(link) {
+    if (link.token)
+        return link.token;
+    if (link.kind !== "cloud")
+        return undefined;
+    const creds = loadCloudCredentials();
+    if (!creds)
+        return undefined;
+    const linkApi = (link.cloudApiUrl ?? "").replace(/\/$/, "");
+    const credApi = creds.apiUrl.replace(/\/$/, "");
+    if (linkApi && credApi && linkApi !== credApi)
+        return undefined;
+    return creds.accessToken;
+}
+export function resolveCloudRefreshToken(link) {
+    if (link.refreshToken)
+        return link.refreshToken;
+    if (link.kind !== "cloud")
+        return undefined;
+    const creds = loadCloudCredentials();
+    if (!creds?.refreshToken)
+        return undefined;
+    const linkApi = (link.cloudApiUrl ?? "").replace(/\/$/, "");
+    const credApi = creds.apiUrl.replace(/\/$/, "");
+    if (linkApi && credApi && linkApi !== credApi)
+        return undefined;
+    return creds.refreshToken;
+}
+/** Write tokens to global credentials and the current project's cloud link (if any). */
+export function persistCloudSession(cwd, params) {
+    const apiUrl = params.apiUrl.replace(/\/$/, "");
+    const existing = loadCloudCredentials();
+    saveCloudCredentials({
+        version: CREDENTIALS_VERSION,
+        apiUrl,
+        accessToken: params.accessToken,
+        updatedAt: new Date().toISOString(),
+        ...(params.refreshToken !== undefined
+            ? { refreshToken: params.refreshToken }
+            : existing?.refreshToken !== undefined
+                ? { refreshToken: existing.refreshToken }
+                : {}),
+        ...(params.email !== undefined
+            ? { email: params.email }
+            : existing?.email !== undefined
+                ? { email: existing.email }
+                : {}),
+    });
+    const link = loadProjectLink(cwd);
+    if (!link || link.kind !== "cloud")
+        return;
+    link.token = params.accessToken;
+    if (params.refreshToken !== undefined) {
+        link.refreshToken = params.refreshToken;
+    }
+    saveProjectLink(cwd, link);
+}
+/** Password login against control-plane `/auth/login` (not `/api/v1`). */
+export async function cloudPasswordLogin(apiUrl, email, password) {
+    const base = apiUrl.replace(/\/$/, "");
+    const res = await fetch(`${base}/auth/login`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email: email.toLowerCase(), password }),
+    });
+    const json = (await res.json().catch(() => ({})));
+    if (!res.ok || !json.access_token) {
+        throw new Error(json.message ?? json.error ?? `Login failed (${res.status})`);
+    }
+    return {
+        accessToken: json.access_token,
+        ...(json.refresh_token !== undefined ? { refreshToken: json.refresh_token } : {}),
+        ...(json.expires_in !== undefined ? { expiresIn: json.expires_in } : {}),
+        ...(json.user?.email !== undefined
+            ? { email: json.user.email }
+            : { email: email.toLowerCase() }),
+    };
+}
+export async function cloudRefreshSession(apiUrl, refreshToken) {
+    const base = apiUrl.replace(/\/$/, "");
+    const res = await fetch(`${base}/auth/refresh`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ refresh_token: refreshToken }),
+    });
+    const json = (await res.json().catch(() => ({})));
+    if (!res.ok || !json.access_token) {
+        throw new Error(json.message ?? json.error ?? `Token refresh failed (${res.status})`);
+    }
+    return {
+        accessToken: json.access_token,
+        ...(json.refresh_token !== undefined ? { refreshToken: json.refresh_token } : {}),
+        ...(json.expires_in !== undefined ? { expiresIn: json.expires_in } : {}),
+    };
+}
+//# sourceMappingURL=cloud-credentials.js.map

package/dist/cloud-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-credentials.js","sourceRoot":"","sources":["../src/cloud-credentials.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EACL,eAAe,EACf,eAAe,GAEhB,MAAM,WAAW,CAAA;AAElB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAU,CAAA;AAW7C,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAA;IAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAqB,CAAA;QACtE,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAChD,OAAO,GAAG,CAAA;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAuB;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAA;IACxC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnC,aAAa,CAAC,eAAe,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAA;IAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAM;IAC7B,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAA;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CAAC,IAAiB;IACvD,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,CAAA;IACjC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAA;IAC3C,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAA;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC/C,IAAI,OAAO,IAAI,OAAO,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,SAAS,CAAA;IAC/D,OAAO,KAAK,CAAC,WAAW,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAiB;IACxD,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC,YAAY,CAAA;IAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAA;IAC3C,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAA;IACpC,IAAI,CAAC,KAAK,EAAE,YAAY;QAAE,OAAO,SAAS,CAAA;IAC1C,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC/C,IAAI,OAAO,IAAI,OAAO,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,SAAS,CAAA;IAC/D,OAAO,KAAK,CAAC,YAAY,CAAA;AAC3B,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,MAKC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAA;IACvC,oBAAoB,CAAC;QACnB,OAAO,EAAE,mBAAmB;QAC5B,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACvC,CAAC,CAAC,QAAQ,EAAE,YAAY,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE;gBACzC,CAAC,CAAC,EAAE,CAAC;QACT,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;YAC5B,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;YACzB,CAAC,CAAC,QAAQ,EAAE,KAAK,KAAK,SAAS;gBAC7B,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;gBAC3B,CAAC,CAAC,EAAE,CAAC;KACV,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAM;IAC1C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,WAAW,CAAA;IAC/B,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAA;IACzC,CAAC;IACD,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AAC5B,CAAC;AASD,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,KAAa,EACb,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACtC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,aAAa,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC;KAC/D,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAO/C,CAAA;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,iBAAiB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE;YAC5B,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;KACpC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACtC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,eAAe,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAM/C,CAAA;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,yBAAyB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IACvF,CAAC;IACD,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAA;AACH,CAAC"}

package/dist/commands/admin.d.ts

@@ -3,6 +3,15 @@ import type { QueryResult } from "pg";
 import { type SupatypeProjectConfig } from "../project-config.js";
 export declare const ADMIN_EMAIL_ENV = "SUPATYPE_ADMIN_EMAIL";
 export declare const ADMIN_PASSWORD_ENV = "SUPATYPE_ADMIN_PASSWORD";
+/**
+ * Studio roles a membership row may hold, most privileged first.
+ *
+ * Must match `studioRolePermissions` in supatype-server and
+ * `STUDIO_ROLE_PERMISSIONS` in the control plane: capability checks refuse a role
+ * they do not recognise, so an unvalidated `--role` here would create a user who
+ * is locked out of the very panel they were made for.
+ */
+export declare const STUDIO_ROLES: readonly ["admin", "developer", "editor"];
 /** GoTrue scopes users to the nil instance id in single-tenant/self-host mode. */
 export declare const GOTRUE_NIL_INSTANCE_ID = "00000000-0000-0000-0000-000000000000";
 /** Audience claim used by GoTrue when looking up users (matches GOTRUE_JWT_AUD in compose). */
@@ -35,6 +44,8 @@ export declare function ensureFirstAdminUser(connection: string, options?: Ensur
  * is not published to the host).
  */
 export declare function ensureFirstAdminUserForProject(cwd: string, config: SupatypeProjectConfig, options?: EnsureFirstAdminOptions): Promise<void>;
+/** Exported for tests: the DB seam both the pool and compose paths share. */
+export declare function ensureFirstAdminWithQuery(query: DbQuery, options: EnsureFirstAdminOptions): Promise<void>;
 export declare function clearAdminSeedPassword(cwd: string): void;
 export declare function hashPasswordForAuth(password: string): Promise<string>;
 /** Postgres password for compose `exec psql` (db is not published to the host). */

package/dist/commands/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/commands/admin.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAKxC,OAAO,KAAK,EAAQ,WAAW,EAAE,MAAM,IAAI,CAAA;AAE3C,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAA;AAa7B,eAAO,MAAM,eAAe,yBAAyB,CAAA;AACrD,eAAO,MAAM,kBAAkB,4BAA4B,CAAA;AAI3D,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,yCAAyC,CAAA;AAE5E,+FAA+F;AAC/F,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,KAAK,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;AACxE,KAAK,mBAAmB,GAAG,oBAAoB,GAAG,cAAc,CAAA;AAEhE,uFAAuF;AACvF,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAc/F;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CACnD;AAYD,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+KpD;AAED,2CAA2C;AAC3C,eAAO,MAAM,oBAAoB,6BAAuB,CAAA;AAExD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,qBAAqB,EAC7B,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AA2FD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3E;AAsHD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/commands/admin.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAKxC,OAAO,KAAK,EAAQ,WAAW,EAAE,MAAM,IAAI,CAAA;AAE3C,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAA;AAa7B,eAAO,MAAM,eAAe,yBAAyB,CAAA;AACrD,eAAO,MAAM,kBAAkB,4BAA4B,CAAA;AAI3D;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,2CAA4C,CAAA;AAYrE,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,yCAAyC,CAAA;AAE5E,+FAA+F;AAC/F,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,KAAK,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;AACxE,KAAK,mBAAmB,GAAG,oBAAoB,GAAG,cAAc,CAAA;AAEhE,uFAAuF;AACvF,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAc/F;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CACnD;AAYD,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA4LpD;AAED,2CAA2C;AAC3C,eAAO,MAAM,oBAAoB,6BAAuB,CAAA;AAExD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,qBAAqB,EAC7B,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,6EAA6E;AAC7E,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAwDD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAIxD;AAED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3E;AAqMD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D"}

package/dist/commands/admin.js

@@ -20,6 +20,23 @@ import { getActiveDevSession, } from "../dev-session.js";
 export const ADMIN_EMAIL_ENV = "SUPATYPE_ADMIN_EMAIL";
 export const ADMIN_PASSWORD_ENV = "SUPATYPE_ADMIN_PASSWORD";
 const BCRYPT_ROUNDS = 10;
+/**
+ * Studio roles a membership row may hold, most privileged first.
+ *
+ * Must match `studioRolePermissions` in supatype-server and
+ * `STUDIO_ROLE_PERMISSIONS` in the control plane: capability checks refuse a role
+ * they do not recognise, so an unvalidated `--role` here would create a user who
+ * is locked out of the very panel they were made for.
+ */
+export const STUDIO_ROLES = ["admin", "developer", "editor"];
+function assertStudioRole(role) {
+    if (STUDIO_ROLES.includes(role))
+        return;
+    error(`Unknown Studio role "${role}". Choose one of: ${STUDIO_ROLES.join(", ")}.\n` +
+        "  Studio roles are Supatype's own; your application's roles are separate " +
+        "and belong in your access rules.");
+    process.exit(1);
+}
 /** GoTrue scopes users to the nil instance id in single-tenant/self-host mode. */
 export const GOTRUE_NIL_INSTANCE_ID = "00000000-0000-0000-0000-000000000000";
 /** Audience claim used by GoTrue when looking up users (matches GOTRUE_JWT_AUD in compose). */
@@ -57,7 +74,7 @@ export function registerAdmin(program) {
         .description("Create an admin user for the admin panel")
         .option("--email <email>", "Admin user email address")
         .option("--password <password>", "Admin user password (prompted if not provided)")
-        .option("--role <role>", "Admin role to assign", "admin")
+        .option("--role <role>", `Studio role to assign (${STUDIO_ROLES.join(" | ")})`, "admin")
         .option("--connection <url>", "Database connection URL (overrides config)")
         .action(async (opts) => {
         const cwd = process.cwd();
@@ -74,6 +91,7 @@ export function registerAdmin(program) {
             process.exit(1);
         }
         const role = opts.role;
+        assertStudioRole(role);
         info(`Creating admin user: ${email} (role: ${role})...`);
         const compose = opts.connection === undefined ? resolveDockerComposeContext(cwd, config) : null;
         try {
@@ -103,20 +121,31 @@ export function registerAdmin(program) {
         .command("set-role")
         .description("Change an existing user's admin role")
         .requiredOption("--email <email>", "User email address")
-        .requiredOption("--role <role>", "New role to assign")
+        .requiredOption("--role <role>", `New Studio role (${STUDIO_ROLES.join(" | ")})`)
         .option("--connection <url>", "Database connection URL (overrides config)")
         .action(async (opts) => {
+        assertStudioRole(opts.role);
         const cwd = process.cwd();
         const config = loadConfig(cwd);
         const connection = resolveAdminConnection(cwd, config, opts.connection);
         const pg = await importPg();
         const pool = new pg.Pool({ connectionString: connection, max: 2 });
         try {
-            const result = await pool.query(`UPDATE auth.users
-             SET raw_app_meta_data = raw_app_meta_data || $1::jsonb,
-                 updated_at = now()
-             WHERE email = $2
-             RETURNING id, email, raw_app_meta_data`, [JSON.stringify({ role: opts.role }), opts.email.toLowerCase()]);
+            // Studio roles live in `_supatype.studio_members`, not in
+            // `app_metadata`: that key is the developer's namespace for their own
+            // app roles, and writing Studio access there means assigning an app
+            // role could hand out admin UI access by accident.
+            await ensureStudioMembersTable((sql, params) => pool.query(sql, params));
+            const result = await pool.query(`WITH target AS (
+               SELECT id, email FROM auth.users WHERE email = $2
+             ), upsert AS (
+               INSERT INTO _supatype.studio_members (user_id, role)
+               SELECT id, $1 FROM target
+               ON CONFLICT (user_id) DO UPDATE
+                 SET role = EXCLUDED.role, updated_at = now()
+               RETURNING user_id
+             )
+             SELECT id, email FROM target`, [opts.role, opts.email.toLowerCase()]);
             if (result.rows.length === 0) {
                 error(`No user found with email "${opts.email}".`);
                 process.exit(1);
@@ -138,7 +167,7 @@ export function registerAdmin(program) {
     });
     adminCmd
         .command("list-users")
-        .description("List users with admin roles")
+        .description("List users with Studio access")
         .option("--connection <url>", "Database connection URL (overrides config)")
         .action(async (opts) => {
         const cwd = process.cwd();
@@ -147,11 +176,16 @@ export function registerAdmin(program) {
         const pg = await importPg();
         const pool = new pg.Pool({ connectionString: connection, max: 2 });
         try {
-            const result = await pool.query(`SELECT id, email, raw_app_meta_data->>'role' as role, created_at
-           FROM auth.users
-           WHERE raw_app_meta_data->>'role' IS NOT NULL
-             AND raw_app_meta_data->>'role' != 'authenticated'
-           ORDER BY created_at ASC`);
+            // Studio access is membership, not a claim — list the grant that
+            // actually decides admission. LEFT JOIN, because a membership held by a
+            // Supatype Cloud account has no row in this project's `auth.users`;
+            // hiding those would make `list-users` disagree with who can log in.
+            const result = await pool.query(`SELECT COALESCE(m.user_id, m.platform_user_id) AS id,
+                  COALESCE(u.email, '(cloud account)') AS email,
+                  m.role, m.created_at
+             FROM _supatype.studio_members m
+             LEFT JOIN auth.users u ON u.id = m.user_id
+            ORDER BY m.created_at ASC`);
             if (result.rows.length === 0) {
                 info("No admin users found.");
                 info("Create one with: supatype admin create-user --email admin@example.com --role admin");
@@ -219,7 +253,8 @@ export async function ensureFirstAdminUserForProject(cwd, config, options = {})
         : options.connection ?? readEnvValue(root, "DATABASE_URL", connectionString(config));
     await ensureFirstAdminUser(connection, merged);
 }
-async function ensureFirstAdminWithQuery(query, options) {
+/** Exported for tests: the DB seam both the pool and compose paths share. */
+export async function ensureFirstAdminWithQuery(query, options) {
     const cwd = options.cwd ? resolve(options.cwd) : process.cwd();
     if (!(await authUsersTableExists(query)))
         return;
@@ -292,7 +327,9 @@ async function resolveAdminCredentials(options, cwd) {
     return { email, password };
 }
 export function clearAdminSeedPassword(cwd) {
-    upsertEnvFile(cwd, {}, [ADMIN_PASSWORD_ENV]);
+    // Unconditional: this is a one-time seed password being retired, and whoever wrote it wanted it
+    // gone once used.
+    upsertEnvFile(cwd, {}, { remove: [ADMIN_PASSWORD_ENV] });
 }
 export async function hashPasswordForAuth(password) {
     return bcrypt.hash(password, BCRYPT_ROUNDS);
@@ -312,8 +349,11 @@ async function createAdminUser(db, email, password, role, opts = {}) {
         throw new Error(`User with email "${email}" already exists.`);
     }
     const passwordHash = await hashPasswordForAuth(password);
+    // No `role` here: `app_metadata` is the developer's namespace for their own
+    // application roles, and Studio access is granted through
+    // `_supatype.studio_members` instead. Writing it in both places means an app
+    // role assignment can silently confer admin UI access.
     const appMetadata = JSON.stringify({
-        role,
         provider: "email",
         providers: ["email"],
     });
@@ -337,6 +377,7 @@ async function createAdminUser(db, email, password, role, opts = {}) {
       now(), now()
     ) RETURNING id, email`, [GOTRUE_NIL_INSTANCE_ID, aud, normalized, passwordHash, appMetadata, userMetadata]);
     const user = result.rows[0];
+    await recordStudioMembership(query, user.id, role);
     if (!opts.quiet) {
         info("Admin user created successfully.");
         plain(`  ID:    ${user.id}`);
@@ -345,6 +386,23 @@ async function createAdminUser(db, email, password, role, opts = {}) {
     }
     return user;
 }
+/**
+ * Record Studio access in `_supatype.studio_members`.
+ *
+ * Studio capability is deliberately not a JWT claim: `app_metadata` belongs to
+ * the developer's own app roles, and letting it grant Studio access means a
+ * developer assigning an app role could hand out admin UI access by accident.
+ *
+ * This is now the *only* grant, so a failure here is fatal to the command — a
+ * user created without a membership row cannot reach Studio at all, and
+ * reporting success would leave no clue why.
+ */
+async function recordStudioMembership(query, userId, role) {
+    await ensureStudioMembersTable(query);
+    await query(`INSERT INTO _supatype.studio_members (user_id, role)
+     VALUES ($1, $2)
+     ON CONFLICT (user_id) DO UPDATE SET role = EXCLUDED.role, updated_at = now()`, [userId, role]);
+}
 async function ensureAuthUsersTable(pool) {
     await pool.query(`
     CREATE SCHEMA IF NOT EXISTS auth;
@@ -381,13 +439,57 @@ async function authUsersTableExists(query) {
     ) as exists`);
     return Boolean(result.rows[0]?.exists);
 }
+/**
+ * Whether anyone can already reach Studio.
+ *
+ * Counts membership rows, not `app_metadata` claims: the claim no longer grants
+ * anything, so counting it would report an admin exists while nobody can log in.
+ * A missing table means the project has never been pushed — no admins.
+ */
 async function hasAdminUsers(query) {
-    const adminCount = await query(`SELECT COUNT(*)::int as count FROM auth.users
-     WHERE raw_app_meta_data->>'role' IS NOT NULL
-       AND raw_app_meta_data->>'role' != 'authenticated'`);
+    // Postgres resolves relations at parse time, so the table has to be checked
+    // separately rather than guarded inside the count query. Absent means the
+    // project has never been pushed — no admins, and `createAdminUser` will
+    // create the table itself.
+    if (!(await studioMembersTableExists(query)))
+        return false;
+    // Inner JOIN on purpose, unlike `list-users`: a membership held by a cloud
+    // account cannot log in to a self-hosted GoTrue, so a project exported from
+    // cloud with only those grants genuinely still needs a first admin.
+    const adminCount = await query(`SELECT COUNT(*)::int as count
+       FROM _supatype.studio_members m
+       JOIN auth.users u ON u.id = m.user_id
+      WHERE m.role <> 'authenticated'`);
     const count = adminCount.rows[0]?.count ?? 0;
     return count > 0;
 }
+/**
+ * A project whose engine predates the membership table, or one that has never
+ * been pushed, still needs working `admin create-user` / `admin set-role`.
+ * Mirrors the engine's own definition (`create_studio_members_table_sql`).
+ *
+ * A row is held by exactly one identity: `user_id` for a project user (what the
+ * CLI grants), or `platform_user_id` for a Supatype Cloud account. The engine
+ * migrates older single-identity tables; this only has to create the current
+ * shape when there is nothing there at all.
+ */
+async function ensureStudioMembersTable(query) {
+    await query(`CREATE SCHEMA IF NOT EXISTS _supatype`);
+    await query(`CREATE TABLE IF NOT EXISTS _supatype.studio_members (
+       id                UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+       user_id           UUID UNIQUE,
+       platform_user_id  UUID UNIQUE,
+       role              TEXT NOT NULL,
+       created_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+       updated_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+       CONSTRAINT studio_members_one_identity
+         CHECK (num_nonnulls(user_id, platform_user_id) = 1)
+     )`);
+}
+async function studioMembersTableExists(query) {
+    const result = await query(`SELECT to_regclass('_supatype.studio_members') IS NOT NULL as exists`);
+    return Boolean(result.rows[0]?.exists);
+}
 /** Postgres password for compose `exec psql` (db is not published to the host). */
 export function composePostgresPassword(cwd) {
     return readEnvValue(cwd, "POSTGRES_PASSWORD", "postgres");