@vibecodemax/cli 0.1.2 → 0.1.4

package/dist/cli.js

@@ -1,8 +1,39 @@
 #!/usr/bin/env node
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import { checkS3Context, setupS3Storage, smokeTestS3 } from "./storageS3.js";
+const SETUP_STATE_PATH = path.join(".vibecodemax", "setup-state.json");
 const MANAGEMENT_API_BASE = "https://api.supabase.com";
 const DEFAULT_LOCALHOST_URL = "http://localhost:3000";
+const STORAGE_PUBLIC_BUCKET = "public-assets";
+const STORAGE_PRIVATE_BUCKET = "private-uploads";
+const STORAGE_REQUIRED_FILE_SIZE_LIMIT = 10 * 1024 * 1024;
+const STORAGE_HEALTHCHECK_PREFIX = "_vibecodemax/healthcheck/default";
+const STORAGE_MIME_TYPES_BY_CATEGORY = {
+    images: ["image/jpeg", "image/png", "image/webp", "image/gif"],
+    documents: [
+        "application/pdf",
+        "text/plain",
+        "text/csv",
+        "application/json",
+        "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+        "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    ],
+    video: ["video/mp4", "video/webm", "video/quicktime"],
+};
+const STORAGE_DEFAULT_MIME_CATEGORIES = ["images"];
+const STORAGE_REQUIRED_POLICY_NAMES = [
+    "public_assets_select_own",
+    "public_assets_insert_own",
+    "public_assets_update_own",
+    "public_assets_delete_own",
+    "private_uploads_select_own",
+    "private_uploads_insert_own",
+    "private_uploads_update_own",
+    "private_uploads_delete_own",
+];
 function printJson(value) {
     process.stdout.write(`${JSON.stringify(value)}\n`);
 }
@@ -12,8 +43,14 @@ function fail(code, message, exitCode = 1, extra = {}) {
 }
 function parseArgs(argv) {
     const [command, ...rest] = argv;
+    let subcommand;
     const flags = {};
-    for (let index = 0; index < rest.length; index += 1) {
+    let index = 0;
+    if ((command === "admin" || command === "storage") && rest[0] && !rest[0].startsWith("--")) {
+        subcommand = rest[0];
+        index = 1;
+    }
+    for (; index < rest.length; index += 1) {
         const token = rest[index];
         if (!token.startsWith("--"))
             continue;
@@ -26,7 +63,7 @@ function parseArgs(argv) {
         flags[key] = next;
         index += 1;
     }
-    return { command, flags };
+    return { command, subcommand, flags };
 }
 function readFileIfExists(filePath) {
     try {
@@ -141,6 +178,19 @@ function requireEnvValue(envValues, key, fileHint) {
     }
     return value.trim();
 }
+function requireAuthAccessToken(envValues, fileHint) {
+    return requireEnvValue(envValues, "SUPABASE_ACCESS_TOKEN", fileHint);
+}
+function requireSupabaseUrl(envValues) {
+    const value = envValues.SUPABASE_URL || envValues.NEXT_PUBLIC_SUPABASE_URL;
+    if (!isNonEmptyString(value)) {
+        fail("MISSING_ENV", "SUPABASE_URL or NEXT_PUBLIC_SUPABASE_URL is missing. Add one of them to .env.local.");
+    }
+    return value.trim();
+}
+function requireServiceRoleKey(envValues) {
+    return requireEnvValue(envValues, "SUPABASE_SERVICE_ROLE_KEY", ".env.local");
+}
 function mergeEnvFile(filePath, nextValues) {
     const existing = parseDotEnv(readFileIfExists(filePath));
     const merged = { ...existing, ...nextValues };
@@ -148,6 +198,25 @@ function mergeEnvFile(filePath, nextValues) {
     const content = `${keys.map((key) => `${key}=${merged[key]}`).join("\n")}\n`;
     fs.writeFileSync(filePath, content, "utf8");
 }
+function readSetupState() {
+    const setupStatePath = path.join(process.cwd(), SETUP_STATE_PATH);
+    const content = readFileIfExists(setupStatePath).trim();
+    if (!content) {
+        printJson({ ok: true, setupState: {} });
+        return;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        fail("INVALID_SETUP_STATE", `${SETUP_STATE_PATH} is not valid JSON.`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        fail("INVALID_SETUP_STATE", `${SETUP_STATE_PATH} must contain a JSON object.`);
+    }
+    printJson({ ok: true, setupState: parsed });
+}
 async function managementRequest({ method, projectRef, token, body }) {
     const endpoint = `${MANAGEMENT_API_BASE}/v1/projects/${projectRef}/config/auth`;
     const response = await fetch(endpoint, {
@@ -235,7 +304,7 @@ async function configureSiteRedirects(flags) {
     if (!projectRef) {
         fail("MISSING_PROJECT_REF", "SUPABASE_PROJECT_REF is missing. Add it to .env.bootstrap.local or ensure NEXT_PUBLIC_SUPABASE_URL is present in .env.local.");
     }
-    const accessToken = requireEnvValue(values, "SUPABASE_ACCESS_TOKEN", path.basename(envBootstrapPath));
+    const accessToken = requireAuthAccessToken(values, path.basename(envBootstrapPath));
     const mode = readStringFlag(flags, "mode") === "production" ? "production" : "test";
     const productionDomain = mode === "production" ? normalizeBaseUrl(readStringFlag(flags, "production-domain")) : "";
     if (mode === "production" && !productionDomain) {
@@ -273,7 +342,7 @@ async function configureEmailPassword(flags) {
     if (!projectRef) {
         fail("MISSING_PROJECT_REF", "SUPABASE_PROJECT_REF is missing. Add it to .env.bootstrap.local or ensure NEXT_PUBLIC_SUPABASE_URL is present in .env.local.");
     }
-    const accessToken = requireEnvValue(values, "SUPABASE_ACCESS_TOKEN", path.basename(envBootstrapPath));
+    const accessToken = requireAuthAccessToken(values, path.basename(envBootstrapPath));
     const emailConfirmation = readStringFlag(flags, "email-confirmation") !== "no";
     await managementRequest({
         method: "PATCH",
@@ -298,13 +367,13 @@ async function enableGoogleProvider(flags) {
     if (!projectRef) {
         fail("MISSING_PROJECT_REF", "SUPABASE_PROJECT_REF is missing. Add it to .env.bootstrap.local or ensure NEXT_PUBLIC_SUPABASE_URL is present in .env.local.");
     }
-    const managementToken = requireEnvValue(values, "SUPABASE_MANAGEMENT_TOKEN", path.basename(envBootstrapPath));
+    const accessToken = requireAuthAccessToken(values, path.basename(envBootstrapPath));
     const googleClientId = requireEnvValue(values, "GOOGLE_CLIENT_ID", path.basename(envBootstrapPath));
     const googleClientSecret = requireEnvValue(values, "GOOGLE_CLIENT_SECRET", path.basename(envBootstrapPath));
     await managementRequest({
         method: "PATCH",
         projectRef,
-        token: managementToken,
+        token: accessToken,
         body: {
             external_google_enabled: true,
             external_google_client_id: googleClientId,
@@ -325,7 +394,7 @@ async function applyAuthTemplates(flags) {
     if (!projectRef) {
         fail("MISSING_PROJECT_REF", "SUPABASE_PROJECT_REF is missing. Add it to .env.bootstrap.local or ensure NEXT_PUBLIC_SUPABASE_URL is present in .env.local.");
     }
-    const managementToken = requireEnvValue(values, "SUPABASE_MANAGEMENT_TOKEN", path.basename(envBootstrapPath));
+    const accessToken = requireAuthAccessToken(values, path.basename(envBootstrapPath));
     const desiredFields = buildTemplateDesiredFields({
         confirmEmailEnabled: readStringFlag(flags, "confirm-email-enabled") === "true",
         confirmEmailSubject: readStringFlag(flags, "confirm-email-subject"),
@@ -334,11 +403,11 @@ async function applyAuthTemplates(flags) {
         resetPasswordSubject: readStringFlag(flags, "reset-password-subject"),
         resetPasswordPath: readStringFlag(flags, "reset-password-path"),
     });
-    const current = await managementRequest({ method: "GET", projectRef, token: managementToken });
+    const current = await managementRequest({ method: "GET", projectRef, token: accessToken });
     const currentAuthConfig = readAuthConfigEnvelope(current);
     const diff = diffTemplateFields(currentAuthConfig, desiredFields);
     if (!diff.noChanges) {
-        await managementRequest({ method: "PATCH", projectRef, token: managementToken, body: diff.patch });
+        await managementRequest({ method: "PATCH", projectRef, token: accessToken, body: diff.patch });
     }
     printJson({
         ok: true,
@@ -349,12 +418,534 @@ async function applyAuthTemplates(flags) {
         noChanges: diff.noChanges,
     });
 }
+async function supabaseAdminRequest(params) {
+    const response = await fetch(`${params.supabaseUrl}${params.endpoint}`, {
+        method: params.method,
+        headers: {
+            apikey: params.serviceRoleKey,
+            Authorization: `Bearer ${params.serviceRoleKey}`,
+            "Content-Type": "application/json",
+        },
+        body: params.body ? JSON.stringify(params.body) : undefined,
+    });
+    let json = null;
+    try {
+        json = await response.json();
+    }
+    catch {
+        json = null;
+    }
+    if (!response.ok) {
+        const message = isNonEmptyString(json?.msg)
+            ? json.msg
+            : isNonEmptyString(json?.message)
+                ? json.message
+                : isNonEmptyString(json?.error)
+                    ? json.error
+                    : `Supabase returned ${response.status}`;
+        fail("SUPABASE_ADMIN_ERROR", message, 1, { status: response.status });
+    }
+    return json;
+}
+async function findUserByEmail(supabaseUrl, serviceRoleKey, email) {
+    const result = await supabaseAdminRequest({
+        supabaseUrl,
+        serviceRoleKey,
+        method: "GET",
+        endpoint: `/auth/v1/admin/users?email=${encodeURIComponent(email)}`,
+    });
+    const users = Array.isArray(result.users) ? result.users : [];
+    const user = users.find((candidate) => {
+        if (!candidate || typeof candidate !== "object")
+            return false;
+        const candidateEmail = candidate.email;
+        return typeof candidateEmail === "string" && candidateEmail.toLowerCase() === email.toLowerCase();
+    });
+    return {
+        exists: Boolean(user),
+        userId: user && typeof user.id === "string" ? user.id : null,
+    };
+}
+function generateTemporaryPassword() {
+    return `VcmAdmin!${Math.random().toString(36).slice(2, 10)}9aA`;
+}
+async function createAdminUser(supabaseUrl, serviceRoleKey, email, temporaryPassword) {
+    const result = await supabaseAdminRequest({
+        supabaseUrl,
+        serviceRoleKey,
+        method: "POST",
+        endpoint: "/auth/v1/admin/users",
+        body: {
+            email,
+            password: temporaryPassword,
+            email_confirm: true,
+            user_metadata: { name: "Admin User" },
+        },
+    });
+    const userId = typeof result.user?.id === "string"
+        ? result.user.id
+        : typeof result.id === "string"
+            ? result.id
+            : "";
+    if (!userId) {
+        fail("INVALID_RESPONSE", "Supabase did not return a user ID for the created admin user.");
+    }
+    return userId;
+}
+async function promoteAdminProfile(supabaseUrl, serviceRoleKey, userId, email) {
+    await supabaseAdminRequest({
+        supabaseUrl,
+        serviceRoleKey,
+        method: "POST",
+        endpoint: "/rest/v1/profiles?on_conflict=id",
+        body: [
+            {
+                id: userId,
+                email,
+                name: "Admin User",
+                role: "admin",
+            },
+        ],
+    });
+}
+async function verifyAdminProfile(supabaseUrl, serviceRoleKey, userId) {
+    const result = await supabaseAdminRequest({
+        supabaseUrl,
+        serviceRoleKey,
+        method: "GET",
+        endpoint: `/rest/v1/profiles?id=eq.${userId}&select=id,role`,
+    });
+    const rows = Array.isArray(result) ? result : [];
+    return rows.some((row) => row && typeof row === "object" && row.role === "admin");
+}
+async function ensureAdmin(flags) {
+    const { values } = loadLocalEnv();
+    const email = readStringFlag(flags, "email");
+    if (!email || !/^[^@]+@[^@]+\.[^@]+$/.test(email)) {
+        fail("INVALID_EMAIL", "A valid --email value is required.");
+    }
+    const supabaseUrl = requireSupabaseUrl(values);
+    const serviceRoleKey = requireServiceRoleKey(values);
+    const lookup = await findUserByEmail(supabaseUrl, serviceRoleKey, email);
+    let userId = lookup.userId;
+    let temporaryPassword = "";
+    let created = false;
+    if (!lookup.exists) {
+        temporaryPassword = generateTemporaryPassword();
+        userId = await createAdminUser(supabaseUrl, serviceRoleKey, email, temporaryPassword);
+        created = true;
+    }
+    if (!userId) {
+        fail("INVALID_RESPONSE", "Resolved admin user ID is missing after ensure-admin.");
+    }
+    await promoteAdminProfile(supabaseUrl, serviceRoleKey, userId, email);
+    const verified = await verifyAdminProfile(supabaseUrl, serviceRoleKey, userId);
+    if (!verified) {
+        fail("ADMIN_VERIFY_FAILED", "The admin role could not be verified after promotion.");
+    }
+    const result = {
+        ok: true,
+        command: "admin ensure-admin",
+        email,
+        userId,
+        userExists: lookup.exists,
+        created,
+        promoted: true,
+        verified: true,
+        defaultName: "Admin User",
+        applied: ["auth_user", "admin_profile"],
+    };
+    if (temporaryPassword) {
+        result.temporaryPassword = temporaryPassword;
+    }
+    printJson(result);
+}
+function shellQuote(value) {
+    const text = String(value);
+    return `'${text.replace(/'/g, `"'"'`)}'`;
+}
+function normalizeDependencyManagerName(value) {
+    if (value === "pnpm")
+        return "pnpm";
+    if (value === "yarn")
+        return "yarn";
+    return "npm";
+}
+function detectDependencyManager(cwd, flags) {
+    const explicitRaw = readStringFlag(flags, "dependency-manager");
+    if (explicitRaw) {
+        return normalizeDependencyManagerName(explicitRaw);
+    }
+    const packageJsonPath = path.join(cwd, "package.json");
+    try {
+        const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+        if (isNonEmptyString(packageJson.packageManager)) {
+            const manager = packageJson.packageManager.split("@")[0];
+            if (manager === "pnpm" || manager === "yarn")
+                return manager;
+            if (manager === "npm")
+                return "npm";
+        }
+    }
+    catch {
+        // ignore and fall back to lockfile detection
+    }
+    if (fs.existsSync(path.join(cwd, "pnpm-lock.yaml")))
+        return "pnpm";
+    if (fs.existsSync(path.join(cwd, "yarn.lock")))
+        return "yarn";
+    return "npm";
+}
+function getSupabaseRunner(dependencyManager) {
+    if (dependencyManager === "pnpm")
+        return "pnpm exec supabase";
+    if (dependencyManager === "yarn")
+        return "yarn supabase";
+    return "npx supabase";
+}
+function runShellCommand(command, cwd) {
+    const result = spawnSync(process.env.SHELL || "/bin/zsh", ["-lc", command], {
+        cwd,
+        env: process.env,
+        encoding: "utf8",
+    });
+    if (result.status !== 0) {
+        const message = [result.stderr, result.stdout]
+            .map((value) => (typeof value === "string" ? value.trim() : ""))
+            .find(Boolean) || `Command failed: ${command}`;
+        fail("LOCAL_COMMAND_FAILED", message);
+    }
+    return typeof result.stdout === "string" ? result.stdout.trim() : "";
+}
+function normalizeStorageMimeCategories(rawValue) {
+    const requested = rawValue
+        .split(",")
+        .map((value) => value.trim())
+        .filter(Boolean);
+    const selected = requested.filter((value) => Object.prototype.hasOwnProperty.call(STORAGE_MIME_TYPES_BY_CATEGORY, value));
+    return selected.length > 0 ? [...new Set(selected)] : [...STORAGE_DEFAULT_MIME_CATEGORIES];
+}
+function resolveStorageMimeCategories(flags) {
+    const raw = readStringFlag(flags, "mime-categories");
+    if (!raw)
+        return [...STORAGE_DEFAULT_MIME_CATEGORIES];
+    return normalizeStorageMimeCategories(raw);
+}
+function expandStorageMimeCategories(categories) {
+    const mimeTypes = [];
+    for (const category of categories) {
+        const mapped = STORAGE_MIME_TYPES_BY_CATEGORY[category] || [];
+        for (const mimeType of mapped) {
+            if (!mimeTypes.includes(mimeType)) {
+                mimeTypes.push(mimeType);
+            }
+        }
+    }
+    return mimeTypes;
+}
+function parseStorageMigrationFilename(filename) {
+    const doubleUnderscore = filename.match(/^(\d{14})__([a-z0-9_]+)\.sql$/);
+    if (doubleUnderscore) {
+        return { filename, timestamp: doubleUnderscore[1], scope: doubleUnderscore[2] };
+    }
+    const singleUnderscore = filename.match(/^(\d{14})_([a-z0-9_]+)\.sql$/);
+    if (singleUnderscore) {
+        return { filename, timestamp: singleUnderscore[1], scope: singleUnderscore[2] };
+    }
+    return null;
+}
+function discoverStorageMigrationFiles(cwd) {
+    const migrationsRoot = path.join(cwd, "supabase", "migrations");
+    if (!fs.existsSync(migrationsRoot)) {
+        fail("MISSING_STORAGE_MIGRATIONS", "supabase/migrations is missing. Run bootstrap.base first so the local Supabase project is initialized.");
+    }
+    const selected = fs.readdirSync(migrationsRoot)
+        .map((filename) => parseStorageMigrationFilename(filename))
+        .filter((entry) => entry !== null && entry.scope.startsWith("storage_"))
+        .sort((a, b) => a.filename.localeCompare(b.filename));
+    if (selected.length === 0) {
+        fail("MISSING_STORAGE_MIGRATIONS", "No storage migration files were found. Add a migration matching YYYYMMDDHHMMSS_storage_*.sql in supabase/migrations.");
+    }
+    const policyFiles = selected
+        .filter((entry) => /(^|_)storage_policies\.sql$/.test(entry.filename))
+        .map((entry) => entry.filename);
+    if (policyFiles.length === 0) {
+        fail("MISSING_STORAGE_POLICY_MIGRATION", "No storage policy migration file was found. Add a migration ending in storage_policies.sql in supabase/migrations.");
+    }
+    return {
+        files: selected.map((entry) => entry.filename),
+        policyFiles,
+    };
+}
+async function storageRequest(params) {
+    const response = await fetch(`${params.supabaseUrl}${params.endpoint}`, {
+        method: params.method,
+        headers: {
+            apikey: params.serviceRoleKey,
+            Authorization: `Bearer ${params.serviceRoleKey}`,
+            ...(params.contentType ? { "Content-Type": params.contentType } : {}),
+        },
+        body: params.rawBody ?? (params.body ? JSON.stringify(params.body) : undefined),
+    });
+    let json = null;
+    try {
+        json = await response.json();
+    }
+    catch {
+        json = null;
+    }
+    if (!response.ok) {
+        const message = isNonEmptyString(json?.error)
+            ? json.error
+            : isNonEmptyString(json?.message)
+                ? json.message
+                : isNonEmptyString(json?.msg)
+                    ? json.msg
+                    : `Supabase returned ${response.status}`;
+        fail("SUPABASE_STORAGE_ERROR", message, 1, { status: response.status });
+    }
+    return json;
+}
+function normalizeBucket(data = {}) {
+    const allowedMimeTypes = Array.isArray(data.allowed_mime_types)
+        ? data.allowed_mime_types
+        : Array.isArray(data.allowedMimeTypes)
+            ? data.allowedMimeTypes
+            : [];
+    const fileSizeLimit = Number.isFinite(data.file_size_limit)
+        ? Number(data.file_size_limit)
+        : Number.isFinite(data.fileSizeLimit)
+            ? Number(data.fileSizeLimit)
+            : null;
+    return {
+        id: isNonEmptyString(data.id) ? data.id : isNonEmptyString(data.name) ? String(data.name) : null,
+        public: Boolean(data.public),
+        allowedMimeTypes: [...allowedMimeTypes].filter((value) => typeof value === "string").sort(),
+        fileSizeLimit,
+    };
+}
+function compareBucketConfig(observed, expected) {
+    const expectedMimes = [...expected.allowedMimeTypes].sort();
+    const observedMimes = [...observed.allowedMimeTypes].sort();
+    return {
+        publicMatches: observed.public === expected.public,
+        mimeMatches: JSON.stringify(observedMimes) === JSON.stringify(expectedMimes),
+        fileSizeMatches: observed.fileSizeLimit === expected.fileSizeLimit,
+    };
+}
+async function readStorageBucket(supabaseUrl, serviceRoleKey, bucketId) {
+    const response = await fetch(`${supabaseUrl}/storage/v1/bucket/${bucketId}`, {
+        method: "GET",
+        headers: {
+            apikey: serviceRoleKey,
+            Authorization: `Bearer ${serviceRoleKey}`,
+            Accept: "application/json",
+        },
+    });
+    let json = null;
+    try {
+        json = await response.json();
+    }
+    catch {
+        json = null;
+    }
+    if (response.status === 404)
+        return null;
+    if (!response.ok) {
+        const message = isNonEmptyString(json?.error)
+            ? json.error
+            : isNonEmptyString(json?.message)
+                ? json.message
+                : isNonEmptyString(json?.msg)
+                    ? json.msg
+                    : `Supabase returned ${response.status}`;
+        fail("SUPABASE_STORAGE_ERROR", message, 1, { status: response.status });
+    }
+    return json && typeof json === "object" ? json : {};
+}
+async function ensureStorageBucket(supabaseUrl, serviceRoleKey, bucketId, isPublic, allowedMimeTypes) {
+    const existing = await readStorageBucket(supabaseUrl, serviceRoleKey, bucketId);
+    const endpoint = existing ? `/storage/v1/bucket/${bucketId}` : "/storage/v1/bucket";
+    const method = existing ? "PUT" : "POST";
+    const body = existing
+        ? {
+            public: isPublic,
+            allowed_mime_types: allowedMimeTypes,
+            file_size_limit: STORAGE_REQUIRED_FILE_SIZE_LIMIT,
+        }
+        : {
+            id: bucketId,
+            name: bucketId,
+            public: isPublic,
+            allowed_mime_types: allowedMimeTypes,
+            file_size_limit: STORAGE_REQUIRED_FILE_SIZE_LIMIT,
+        };
+    await storageRequest({
+        supabaseUrl,
+        serviceRoleKey,
+        method,
+        endpoint,
+        body,
+        contentType: "application/json",
+    });
+    const observedRaw = await readStorageBucket(supabaseUrl, serviceRoleKey, bucketId);
+    if (!observedRaw) {
+        fail("SUPABASE_STORAGE_ERROR", `Bucket ${bucketId} could not be read after configuration.`);
+    }
+    const observed = normalizeBucket(observedRaw);
+    const expected = {
+        public: isPublic,
+        allowedMimeTypes,
+        fileSizeLimit: STORAGE_REQUIRED_FILE_SIZE_LIMIT,
+    };
+    const comparison = compareBucketConfig(observed, expected);
+    if (!comparison.publicMatches || !comparison.mimeMatches || !comparison.fileSizeMatches) {
+        fail("SUPABASE_BUCKET_VERIFY_FAILED", `Bucket ${bucketId} does not match the required configuration.`);
+    }
+    return {
+        bucket: bucketId,
+        created: !existing,
+        updated: Boolean(existing),
+        verified: true,
+    };
+}
+function verifyRequiredStoragePolicies(dumpContent) {
+    const normalized = dumpContent.toLowerCase();
+    const missing = STORAGE_REQUIRED_POLICY_NAMES.filter((policyName) => !normalized.includes(`create policy \"${policyName}\"`));
+    if (missing.length > 0) {
+        fail("STORAGE_POLICY_VERIFY_FAILED", `Missing required storage policies after local Supabase CLI apply: ${missing.join(", ")}.`);
+    }
+}
+function buildStorageHealthcheckObjectPath(runId) {
+    return `${STORAGE_HEALTHCHECK_PREFIX}/${runId}/upload.txt`;
+}
+async function checkSupabaseContext() {
+    const { values, envLocalPath } = loadLocalEnv();
+    const missingKeys = [];
+    const presentKeys = [];
+    const supabaseUrl = values.SUPABASE_URL || values.NEXT_PUBLIC_SUPABASE_URL;
+    if (isNonEmptyString(supabaseUrl)) {
+        presentKeys.push(isNonEmptyString(values.SUPABASE_URL) ? "SUPABASE_URL" : "NEXT_PUBLIC_SUPABASE_URL");
+    }
+    else {
+        missingKeys.push("NEXT_PUBLIC_SUPABASE_URL");
+    }
+    if (isNonEmptyString(values.SUPABASE_SERVICE_ROLE_KEY)) {
+        presentKeys.push("SUPABASE_SERVICE_ROLE_KEY");
+    }
+    else {
+        missingKeys.push("SUPABASE_SERVICE_ROLE_KEY");
+    }
+    printJson({
+        ok: true,
+        command: "storage check-supabase-context",
+        ready: missingKeys.length === 0,
+        missingKeys,
+        presentKeys,
+        expectedExisting: true,
+        checkedFiles: [path.basename(envLocalPath)],
+        projectRef: resolveProjectRef({}, values) || null,
+    });
+}
+async function setupSupabaseStorage(flags) {
+    const cwd = process.cwd();
+    const { envLocalPath, values } = loadLocalEnv();
+    const supabaseUrl = requireSupabaseUrl(values);
+    const serviceRoleKey = requireServiceRoleKey(values);
+    const dependencyManager = detectDependencyManager(cwd, flags);
+    const supabaseRunner = getSupabaseRunner(dependencyManager);
+    const mimeCategories = resolveStorageMimeCategories(flags);
+    const allowedMimeTypes = expandStorageMimeCategories(mimeCategories);
+    const publicBucket = await ensureStorageBucket(supabaseUrl, serviceRoleKey, STORAGE_PUBLIC_BUCKET, true, allowedMimeTypes);
+    const privateBucket = await ensureStorageBucket(supabaseUrl, serviceRoleKey, STORAGE_PRIVATE_BUCKET, false, allowedMimeTypes);
+    mergeEnvFile(envLocalPath, {
+        SUPABASE_PUBLIC_BUCKET: STORAGE_PUBLIC_BUCKET,
+        SUPABASE_PRIVATE_BUCKET: STORAGE_PRIVATE_BUCKET,
+    });
+    const migrations = discoverStorageMigrationFiles(cwd);
+    runShellCommand(`${supabaseRunner} db push --linked`, cwd);
+    const dumpDir = fs.mkdtempSync(path.join(os.tmpdir(), "vibecodemax-storage-dump-"));
+    const dumpPath = path.join(dumpDir, "storage.sql");
+    runShellCommand(`${supabaseRunner} db dump --linked --schema storage -f ${shellQuote(dumpPath)} >/dev/null`, cwd);
+    const dumpContent = readFileIfExists(dumpPath);
+    verifyRequiredStoragePolicies(dumpContent);
+    fs.rmSync(dumpDir, { recursive: true, force: true });
+    printJson({
+        ok: true,
+        command: "storage setup-supabase",
+        dependencyManager,
+        publicBucket: STORAGE_PUBLIC_BUCKET,
+        privateBucket: STORAGE_PRIVATE_BUCKET,
+        bucketsConfigured: [publicBucket, privateBucket],
+        mimeCategories,
+        allowedMimeTypes,
+        fileSizeLimit: STORAGE_REQUIRED_FILE_SIZE_LIMIT,
+        migrationFiles: migrations.files,
+        policyFiles: migrations.policyFiles,
+        policyMigrationsDiscovered: true,
+        policyMigrationsApplied: true,
+        policiesVerified: true,
+        envWritten: ["SUPABASE_PUBLIC_BUCKET", "SUPABASE_PRIVATE_BUCKET"],
+    });
+}
+async function smokeTestSupabase() {
+    const { values } = loadLocalEnv();
+    const supabaseUrl = requireSupabaseUrl(values);
+    const serviceRoleKey = requireServiceRoleKey(values);
+    const runId = `run_${Date.now()}`;
+    const objectPath = buildStorageHealthcheckObjectPath(runId);
+    const prefix = `${STORAGE_HEALTHCHECK_PREFIX}/${runId}/`;
+    await storageRequest({
+        supabaseUrl,
+        serviceRoleKey,
+        method: "POST",
+        endpoint: `/storage/v1/object/${STORAGE_PUBLIC_BUCKET}/${objectPath}`,
+        rawBody: "healthcheck probe",
+        contentType: "text/plain",
+    });
+    const listResult = await storageRequest({
+        supabaseUrl,
+        serviceRoleKey,
+        method: "POST",
+        endpoint: `/storage/v1/object/list/${STORAGE_PUBLIC_BUCKET}`,
+        body: { prefix },
+        contentType: "application/json",
+    });
+    await storageRequest({
+        supabaseUrl,
+        serviceRoleKey,
+        method: "DELETE",
+        endpoint: `/storage/v1/object/${STORAGE_PUBLIC_BUCKET}`,
+        body: { prefixes: [objectPath] },
+        contentType: "application/json",
+    });
+    printJson({
+        ok: true,
+        command: "storage smoke-test-supabase",
+        runId,
+        bucketId: STORAGE_PUBLIC_BUCKET,
+        objectPath,
+        prefix,
+        upload: true,
+        list: true,
+        delete: true,
+        listedItems: Array.isArray(listResult) ? listResult.length : 0,
+    });
+}
 async function main() {
-    const { command, flags } = parseArgs(process.argv.slice(2));
+    const { command, subcommand, flags } = parseArgs(process.argv.slice(2));
     if (!command || command === "--help" || command === "help") {
         printJson({
             ok: true,
             commands: [
+                "read-setup-state",
+                "admin ensure-admin",
+                "storage check-supabase-context",
+                "storage setup-supabase",
+                "storage smoke-test-supabase",
+                "storage check-s3-context",
+                "storage setup-s3",
+                "storage smoke-test-s3",
                 "configure-site-redirects",
                 "configure-email-password",
                 "enable-google-provider",
@@ -363,6 +954,22 @@ async function main() {
         });
         return;
     }
+    if (command === "read-setup-state")
+        return readSetupState();
+    if (command === "admin" && subcommand === "ensure-admin")
+        return ensureAdmin(flags);
+    if (command === "storage" && subcommand === "check-supabase-context")
+        return checkSupabaseContext();
+    if (command === "storage" && subcommand === "setup-supabase")
+        return setupSupabaseStorage(flags);
+    if (command === "storage" && subcommand === "smoke-test-supabase")
+        return smokeTestSupabase();
+    if (command === "storage" && subcommand === "check-s3-context")
+        return checkS3Context(flags);
+    if (command === "storage" && subcommand === "setup-s3")
+        return setupS3Storage(flags);
+    if (command === "storage" && subcommand === "smoke-test-s3")
+        return smokeTestS3(flags);
     if (command === "configure-site-redirects")
         return configureSiteRedirects(flags);
     if (command === "configure-email-password")