@zveltio/cli 3.0.0-beta.77 → 3.0.0-beta.79

package/dist/index.js

@@ -2398,7 +2398,7 @@ __export(exports_admin_marketplace, {
   adminMarketplaceEnrollPublisher: () => adminMarketplaceEnrollPublisher,
   adminMarketplaceApprove: () => adminMarketplaceApprove
 });
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 function getRegistryUrl(opts) {
   return opts.registryUrl ?? process.env.ZVELTIO_REGISTRY_URL ?? "https://registry.zveltio.com";
 }
@@ -2619,7 +2619,7 @@ async function adminMarketplaceEnrollPublisher(opts) {
   }
   let keyJwk;
   try {
-    keyJwk = readFileSync7(opts.keyFile, "utf8").trim();
+    keyJwk = readFileSync9(opts.keyFile, "utf8").trim();
   } catch (err2) {
     console.error(c15.red(`Could not read key file ${opts.keyFile}: ${err2.message}`));
     process.exit(1);
@@ -3460,10 +3460,14 @@ Creating extension: ${extName}
       slots: []
     }
   }, null, 2));
-  await writeFile(join8(targetDir, "engine", "index.ts"), `import type { ZveltioExtension } from '@zveltio/sdk/extension';
+  await writeFile(join8(targetDir, "engine", "index.ts"), `import { defineExtension } from '@zveltio/sdk/extension';
 import { join } from 'path';
 
-const extension: ZveltioExtension = {
+// The capabilities this extension uses \u2014 the same list as "permissions" in
+// manifest.json (\`zveltio extension validate\` compares them). It types \`ctx\`:
+// a ctx.internals member whose capability is not listed is a compile error,
+// not a refusal on the first request that needs it. Start with none.
+export default defineExtension([], {
   name: '${extName}',
   category: '${category}',
 
@@ -3486,9 +3490,7 @@ const extension: ZveltioExtension = {
       return c.json({ data });
     });
   },
-};
-
-export default extension;
+});
 `);
   await writeFile(join8(targetDir, "engine", "migrations", "001_init.sql"), `-- ${name} \u2014 initial schema.
 --
@@ -3661,7 +3663,7 @@ Where UI goes:
 Do NOT add studio/vite.config.ts, studio/package.json, or studio/dist/ \u2014 removed in alpha.94/beta.15.
 `);
   if (codePage) {
-    console.warn(`\x1B[33mScaffolded a CODE page. Across the 56 shipped extensions, 61 pages are
+    console.warn(`\x1B[33mScaffolded a CODE page. Across the 55 shipped extensions, 60 pages are
 schemas and seven are code \u2014 and each of those seven sits beside a schema, for
 the part a schema could not express. On this road you own fetching,
 loading and error states, i18n by hand, and a Studio release to ship a change.
@@ -3992,6 +3994,91 @@ function emitTypeScript(schema, opts = {}) {
 function quoteIdentifierIfNeeded(name) {
   return /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name) ? name : `'${name.replace(/'/g, "\\'")}'`;
 }
+var CORE_FIELD_TS_TYPES = {
+  text: "string",
+  number: "number",
+  boolean: "boolean",
+  date: "string",
+  datetime: "string",
+  email: "string",
+  url: "string",
+  uuid: "string",
+  json: "Record<string, any>",
+  richtext: "string",
+  file: "{ url: string; name: string; size: number; type: string }",
+  enum: "string",
+  reference: "string",
+  m2o: "string",
+  location: "{ lat: number; lng: number }",
+  computed: "never",
+  integer: "number",
+  float: "number",
+  textarea: "string",
+  password: "string",
+  slug: "string",
+  color: "string",
+  phone: "string",
+  tags: "string[]",
+  image: "{ url: string; name: string; size: number; width?: number; height?: number; alt?: string }",
+  o2m: "string[]",
+  m2m: "string[]",
+  m2a: "{ collection: string; id: string }[]",
+  geometry: "{ type: string; coordinates: any }",
+  vector: "number[]",
+  smallint: "number",
+  real: "number",
+  decimal: "number",
+  money: "number",
+  varchar: "string",
+  char: "string",
+  time: "string",
+  timetz: "string",
+  interval: "string",
+  bytea: "string",
+  tsvector: "string",
+  inet: "string",
+  cidr: "string",
+  macaddr: "string",
+  xml: "string",
+  bit: "string",
+  varbit: "string",
+  int4range: "{ lower: number; upper: number }",
+  int8range: "{ lower: number; upper: number }",
+  numrange: "{ lower: number; upper: number }",
+  daterange: "{ lower: string; upper: string }",
+  tsrange: "{ lower: string; upper: string }",
+  tstzrange: "{ lower: string; upper: string }"
+};
+function emitCollectionTypes(collection, tsTypeOf = (t) => CORE_FIELD_TS_TYPES[t]) {
+  const typeName = collection.name.charAt(0).toUpperCase() + collection.name.slice(1);
+  const inputFields = collection.fields.map((f) => `  ${f.name}${f.required ? "" : "?"}: ${tsTypeOf(f.type) || "any"};`).join(`
+`);
+  return `export interface ${typeName}Input {
+${inputFields}
+}
+
+export interface ${typeName} extends ${typeName}Input {
+  id: string;
+  created_at: string;
+  updated_at: string;
+  status: string;
+}`;
+}
+function emitCollectionTypesFile(collections, tsTypeOf) {
+  const types = collections.map((c6) => emitCollectionTypes(c6, tsTypeOf)).join(`
+
+`);
+  return `// Auto-generated by Zveltio
+// Do not edit manually
+
+${types}`;
+}
+function collectionsFromSchemaFiles(files) {
+  return Object.keys(files).filter((p) => /^collections\/[^/]+\.json$/.test(p)).sort().map((p) => {
+    const file = JSON.parse(files[p]);
+    return { name: file.name, fields: file.fields ?? [] };
+  });
+}
 
 // src/commands/extension-types.ts
 var c6 = {
@@ -4059,7 +4146,7 @@ import { join as join10 } from "path";
 
 // ../sdk/dist/validate/migration-parse.js
 function parseMigrationSql(raw) {
-  const downIdx = raw.search(/^--\s*DOWN\b/im);
+  const downIdx = raw.search(/^--\s*DOWN\s*$/im);
   if (downIdx < 0) {
     return { up: raw.trim(), down: null };
   }
@@ -4287,6 +4374,7 @@ var SHARED_MESSAGE_KEYS = new Set([
 ]);
 
 // ../sdk/dist/validate/index.js
+var CREDENTIAL_HEADERS = ["authorization", "cookie", "proxy-authorization", "x-api-key"];
 var SEMVER_RE = /^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/;
 var KNOWN_CATEGORIES = new Set([
   "auth",
@@ -4350,6 +4438,32 @@ function validateManifest(input) {
   if (typeof obj.zveltioMaxVersion === "string" && !SEMVER_RE.test(obj.zveltioMaxVersion)) {
     out.push(err("MANIFEST_BAD_MAX_VERSION", `zveltioMaxVersion "${obj.zveltioMaxVersion}" is not valid semver`));
   }
+  const depNames = new Map;
+  for (const field of ["dependencies", "optionalDependencies"]) {
+    const list = obj[field];
+    if (list === undefined)
+      continue;
+    if (!Array.isArray(list)) {
+      out.push(err("MANIFEST_BAD_DEPENDENCY", `"${field}" must be an array of { name, minVersion? }`));
+      continue;
+    }
+    for (const d of list) {
+      const depName = d && typeof d === "object" ? d.name : undefined;
+      const min = d && typeof d === "object" ? d.minVersion : undefined;
+      if (typeof depName !== "string" || depName.trim() === "") {
+        out.push(err("MANIFEST_BAD_DEPENDENCY", `"${field}" entry ${JSON.stringify(d)} has no name`));
+        continue;
+      }
+      if (min !== undefined && (typeof min !== "string" || !SEMVER_RE.test(min))) {
+        out.push(err("MANIFEST_BAD_DEPENDENCY", `"${field}" ${depName}: minVersion ${JSON.stringify(min)} is not semver`));
+      }
+      const seen = depNames.get(depName);
+      if (seen) {
+        out.push(err("MANIFEST_BAD_DEPENDENCY", `"${depName}" is listed in "${seen}" and "${field}"`));
+      }
+      depNames.set(depName, field);
+    }
+  }
   if (obj.apiKeyRoutes !== undefined) {
     const routes = Array.isArray(obj.apiKeyRoutes) ? obj.apiKeyRoutes : [obj.apiKeyRoutes];
     for (const r of routes) {
@@ -4358,6 +4472,25 @@ function validateManifest(input) {
       }
     }
   }
+  if (obj.forwardCredentials !== undefined) {
+    const fwd = obj.forwardCredentials;
+    const publicRoutes = Array.isArray(obj.publicRoutes) ? obj.publicRoutes : [];
+    if (!fwd || typeof fwd !== "object" || Array.isArray(fwd)) {
+      out.push(err("MANIFEST_BAD_FORWARD_CREDENTIALS", '"forwardCredentials" must map a route to headers'));
+    } else {
+      for (const [route, names] of Object.entries(fwd)) {
+        if (!publicRoutes.includes(route)) {
+          out.push(err("MANIFEST_BAD_FORWARD_CREDENTIALS", `forwardCredentials names "${route}", which is not a publicRoutes entry`));
+        }
+        const list = Array.isArray(names) ? names : [names];
+        for (const n of list) {
+          if (typeof n !== "string" || !CREDENTIAL_HEADERS.includes(n)) {
+            out.push(err("MANIFEST_BAD_FORWARD_CREDENTIALS", `forwardCredentials "${route}": ${JSON.stringify(n)} is not one of ${CREDENTIAL_HEADERS.join(", ")}`));
+          }
+        }
+      }
+    }
+  }
   if (typeof obj.category === "string" && !KNOWN_CATEGORIES.has(obj.category)) {
     out.push(warn("MANIFEST_UNKNOWN_CATEGORY", `category "${obj.category}" isn't in the known set \u2014 typo? Known: ${[...KNOWN_CATEGORIES].sort().join(", ")}`));
   }
@@ -4898,6 +5031,51 @@ function inferExpectedName(dir) {
   }
   return norm.split("/").filter(Boolean).pop() ?? "";
 }
+function checkDeclaredCapabilities(sources, manifest) {
+  const call = sources.map((src) => /defineExtension\s*(?:<[^>]*>)?\(\s*\[([^\]]*)\]/.exec(src)).find((m) => m !== null);
+  if (!call)
+    return [];
+  const typed = new Set([...(call[1] ?? "").matchAll(/['"`]([^'"`]+)['"`]/g)].map((m) => m[1]));
+  const raw = manifest && typeof manifest === "object" ? manifest.permissions : undefined;
+  const legacy = new Set(["database", "settings", "network"]);
+  const declared = new Set((Array.isArray(raw) ? raw : []).filter((p) => typeof p === "string" && !legacy.has(p)));
+  const out = [];
+  const onlyTyped = [...typed].filter((c8) => !declared.has(c8)).sort();
+  const onlyManifest = [...declared].filter((c8) => !typed.has(c8)).sort();
+  if (onlyTyped.length > 0) {
+    out.push({
+      code: "CAPABILITY_NOT_IN_MANIFEST",
+      message: `defineExtension declares ${onlyTyped.join(", ")}, which manifest.json "permissions" ` + "does not: the code type-checks and the engine refuses it at runtime. Add it to the manifest.",
+      file: "manifest.json"
+    });
+  }
+  if (onlyManifest.length > 0) {
+    out.push({
+      code: "CAPABILITY_NOT_IN_DEFINE",
+      message: `manifest.json "permissions" asks for ${onlyManifest.join(", ")}, which defineExtension ` + "does not declare: the administrator is asked for power the code says it does not use. " + "Remove it from the manifest, or add it to defineExtension.",
+      file: "manifest.json"
+    });
+  }
+  return out;
+}
+function readEngineTypeScript(dir) {
+  const out = [];
+  const walk = (d) => {
+    if (!existsSync11(d))
+      return;
+    for (const name of readdirSync3(d)) {
+      if (name === "node_modules")
+        continue;
+      const p = join10(d, name);
+      if (statSync(p).isDirectory())
+        walk(p);
+      else if (p.endsWith(".ts") && !p.endsWith(".test.ts") && !p.endsWith(".d.ts"))
+        out.push(readFileSync4(p, "utf8"));
+    }
+  };
+  walk(join10(dir, "engine"));
+  return out;
+}
 function checkBundleIntegrity(dir, manifest) {
   const bundle = join10(dir, "engine", "index.js");
   const integrity = manifest?.integrity;
@@ -5128,6 +5306,11 @@ ${c7.bold("Extension validate")}
     if (integrityErrors.some((e) => e.severity !== "warning"))
       result.ok = false;
   }
+  const capabilityErrors = checkDeclaredCapabilities(readEngineTypeScript(dir), manifest);
+  if (capabilityErrors.length > 0) {
+    result.errors.push(...capabilityErrors);
+    result.ok = false;
+  }
   const warnings = result.errors.filter((e) => e.severity === "warning");
   const hardErrors = result.errors.filter((e) => e.severity !== "warning");
   if (warnings.length > 0) {
@@ -5790,8 +5973,8 @@ ${c10.dim(`Ready. Edit engine/ files to trigger a hot-reload. Ctrl+C to stop.
 }
 
 // src/commands/generate-types.ts
-import { mkdirSync as mkdirSync5 } from "fs";
-import { dirname as dirname4 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync5, readdirSync as readdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname4, join as join14 } from "path";
 var c11 = {
   bold: (s) => `\x1B[1m${s}\x1B[0m`,
   green: (s) => `\x1B[32m${s}\x1B[0m`,
@@ -5800,6 +5983,8 @@ var c11 = {
   red: (s) => `\x1B[31m${s}\x1B[0m`
 };
 async function generateTypesCommand(collection, opts) {
+  if (opts.from)
+    return typesFromFiles(collection, opts.from, opts.output || "./types/zveltio.d.ts");
   const engineUrl = opts.url || process.env.ZVELTIO_URL || "http://localhost:3000";
   const outputPath = opts.output || "./types/zveltio.d.ts";
   console.log(`
@@ -5846,11 +6031,157 @@ ${c11.bold("Generate Types")}
     process.exit(1);
   }
 }
+function typesFromFiles(collection, dir, outputPath) {
+  const collectionsDir = join14(dir, "collections");
+  if (!existsSync15(collectionsDir)) {
+    console.error(c11.red(`No collections/ in ${dir}. Run \`zveltio schema pull\` first.`));
+    process.exit(1);
+  }
+  const files = {};
+  for (const f of readdirSync6(collectionsDir)) {
+    if (f.endsWith(".json"))
+      files[`collections/${f}`] = readFileSync7(join14(collectionsDir, f), "utf8");
+  }
+  const collections = collectionsFromSchemaFiles(files);
+  let types;
+  if (collection) {
+    const one = collections.find((col) => col.name === collection);
+    if (!one) {
+      console.error(c11.red(`Collection ${collection} is not in ${dir}`));
+      process.exit(1);
+    }
+    types = emitCollectionTypes(one);
+  } else {
+    types = emitCollectionTypesFile(collections);
+  }
+  mkdirSync5(dirname4(outputPath), { recursive: true });
+  writeFileSync5(outputPath, types);
+  console.log(`${c11.green("Types generated:")} ${outputPath} ${c11.dim(`from ${dir}`)}`);
+}
+
+// src/commands/schema.ts
+import { existsSync as existsSync16, mkdirSync as mkdirSync6, readdirSync as readdirSync7, readFileSync as readFileSync8, rmSync, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname5, join as join15 } from "path";
+import { createInterface as createInterface2 } from "readline";
+async function schemaPullCommand(opts) {
+  const dir = opts.dir || "./schema";
+  const engineUrl = opts.url || process.env.ZVELTIO_URL || "http://localhost:3000";
+  const res = await fetch(`${engineUrl}/api/admin/schema/export`, {
+    headers: { Authorization: `Bearer ${process.env.ZVELTIO_API_KEY || ""}` }
+  });
+  if (!res.ok) {
+    console.error(`Schema export failed: ${res.status} ${res.statusText}`);
+    if (res.status === 401 || res.status === 403) {
+      console.error("  Set ZVELTIO_API_KEY to a key of an instance admin.");
+    }
+    process.exit(1);
+  }
+  const { files } = await res.json();
+  for (const [path, content] of Object.entries(files)) {
+    const target = join15(dir, path);
+    mkdirSync6(dirname5(target), { recursive: true });
+    writeFileSync6(target, content);
+  }
+  const collectionsDir = join15(dir, "collections");
+  let removed = 0;
+  if (existsSync16(collectionsDir)) {
+    for (const f of readdirSync7(collectionsDir)) {
+      if (f.endsWith(".json") && !(`collections/${f}` in files)) {
+        rmSync(join15(collectionsDir, f));
+        removed++;
+      }
+    }
+  }
+  console.log(`Wrote ${Object.keys(files).length} files to ${dir}` + (removed ? `, removed ${removed} for collections that no longer exist` : ""));
+}
+function readSchemaDir(dir) {
+  const files = {};
+  for (const path of ["zveltio-schema.json", "roles.json"]) {
+    if (existsSync16(join15(dir, path)))
+      files[path] = readFileSync8(join15(dir, path), "utf8");
+  }
+  for (const sub of ["collections", "migrations"]) {
+    const subDir = join15(dir, sub);
+    if (!existsSync16(subDir))
+      continue;
+    for (const f of readdirSync7(subDir).filter((f2) => f2.endsWith(".json"))) {
+      files[`${sub}/${f}`] = readFileSync8(join15(subDir, f), "utf8");
+    }
+  }
+  return files;
+}
+async function postSchema(engineUrl, route, files, allowDestructive = false) {
+  const res = await fetch(`${engineUrl}/api/admin/schema/${route}`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${process.env.ZVELTIO_API_KEY || ""}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({ files, allowDestructive })
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => null);
+    console.error(`Schema ${route} failed: ${res.status} ${body?.detail ?? res.statusText}`);
+    if (res.status === 401 || res.status === 403) {
+      console.error("  Set ZVELTIO_API_KEY to a key of an instance admin.");
+    }
+    process.exit(1);
+  }
+  return (await res.json()).steps;
+}
+function printSteps(steps) {
+  const width = Math.max(...steps.map((s) => s.target.length));
+  for (const s of steps) {
+    console.log(`${s.change} ${s.target.padEnd(width)}  ${s.action}${s.destructive ? "   (destructive)" : ""}`);
+  }
+  const destructive = steps.filter((s) => s.destructive).length;
+  console.log(`
+${steps.length} change(s)` + (destructive ? `, ${destructive} destructive` : ""));
+}
+async function schemaDiffCommand(opts) {
+  const dir = opts.dir || "./schema";
+  const engineUrl = opts.url || process.env.ZVELTIO_URL || "http://localhost:3000";
+  const steps = await postSchema(engineUrl, "plan", readSchemaDir(dir));
+  if (!steps.length) {
+    console.log(`No changes: the instance matches ${dir}`);
+    return;
+  }
+  printSteps(steps);
+  process.exit(1);
+}
+async function schemaApplyCommand(opts) {
+  const dir = opts.dir || "./schema";
+  const engineUrl = opts.url || process.env.ZVELTIO_URL || "http://localhost:3000";
+  const files = readSchemaDir(dir);
+  const plan = await postSchema(engineUrl, "plan", files);
+  if (!plan.length) {
+    console.log(`No changes: the instance matches ${dir}`);
+    return;
+  }
+  printSteps(plan);
+  if (plan.some((s) => s.destructive) && !opts.allowDestructive) {
+    console.error(`
+The plan has destructive steps; nothing was changed. Rerun with --allow-destructive.`);
+    process.exit(1);
+  }
+  if (!opts.yes) {
+    const rl2 = createInterface2({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise((resolve4) => rl2.question(`
+Apply these changes? Type "yes" to continue: `, resolve4));
+    rl2.close();
+    if (answer.trim().toLowerCase() !== "yes") {
+      console.log("Cancelled; nothing was changed.");
+      return;
+    }
+  }
+  const applied = await postSchema(engineUrl, "apply", files, opts.allowDestructive);
+  console.log(`Applied ${applied.length} change(s).`);
+}
 
 // src/commands/install.ts
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 import { readFile, mkdir as mkdir2, cp } from "fs/promises";
-import { join as join14 } from "path";
+import { join as join16 } from "path";
 async function installCommand(name, opts) {
   const engineUrl = opts.url || process.env.ENGINE_URL || "http://localhost:3000";
   console.log(`
@@ -5863,13 +6194,13 @@ async function installCommand(name, opts) {
   await installFromCatalog(name, engineUrl);
 }
 async function installFromPath(name, sourcePath, engineUrl, force) {
-  if (!existsSync15(join14(sourcePath, "manifest.json"))) {
+  if (!existsSync17(join16(sourcePath, "manifest.json"))) {
     console.error("\u274C No manifest.json found at", sourcePath);
     process.exit(1);
   }
   let manifest;
   try {
-    manifest = JSON.parse(await readFile(join14(sourcePath, "manifest.json"), "utf-8"));
+    manifest = JSON.parse(await readFile(join16(sourcePath, "manifest.json"), "utf-8"));
   } catch {
     console.error("\u274C Failed to read manifest.json");
     process.exit(1);
@@ -5893,8 +6224,8 @@ async function installFromPath(name, sourcePath, engineUrl, force) {
   console.log(`  Name:     ${manifest.displayName || manifest.name}`);
   console.log(`  Version:  ${manifest.version || "?"}`);
   console.log(`  Category: ${category}`);
-  const enginePkgPath = join14(process.cwd(), "packages/engine/package.json");
-  if (existsSync15(enginePkgPath)) {
+  const enginePkgPath = join16(process.cwd(), "packages/engine/package.json");
+  if (existsSync17(enginePkgPath)) {
     const enginePkg = JSON.parse(await readFile(enginePkgPath, "utf-8"));
     const engineVersion = enginePkg.version || "unknown";
     if (manifest.zveltioMinVersion) {
@@ -5905,8 +6236,8 @@ async function installFromPath(name, sourcePath, engineUrl, force) {
     }
   }
   const extName = manifest.name;
-  const targetDir = join14(process.cwd(), "extensions", category, extName);
-  if (existsSync15(targetDir) && !force) {
+  const targetDir = join16(process.cwd(), "extensions", category, extName);
+  if (existsSync17(targetDir) && !force) {
     console.error(`\u274C Extension already exists at ${targetDir}`);
     console.error(`   Use --force to overwrite.`);
     process.exit(1);
@@ -6032,7 +6363,7 @@ async function activateViaApi(name, category, engineUrl) {
 }
 
 // src/commands/create-god.ts
-import { createInterface as createInterface2 } from "readline";
+import { createInterface as createInterface3 } from "readline";
 async function prompt(rl2, question) {
   return new Promise((resolve4) => {
     rl2.question(question, resolve4);
@@ -6087,7 +6418,7 @@ async function createGodCommand(opts) {
   console.log("  \u2022 Audit logins for this account separately");
   console.log(`\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
 `);
-  const rlConfirm = createInterface2({
+  const rlConfirm = createInterface3({
     input: process.stdin,
     output: process.stdout
   });
@@ -6100,7 +6431,7 @@ async function createGodCommand(opts) {
   console.log(`
 Creating God (super-admin) user at ${engineUrl}
 `);
-  const rl2 = createInterface2({ input: process.stdin, output: process.stdout });
+  const rl2 = createInterface3({ input: process.stdin, output: process.stdout });
   try {
     const email = opts.email || await prompt(rl2, "Email: ");
     const name = opts.name || await prompt(rl2, "Name: ");
@@ -6394,8 +6725,8 @@ var versionCommand = new Command("version").description("Show version informatio
 });
 
 // src/commands/update.ts
-import { existsSync as existsSync16 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync18 } from "fs";
+import { join as join17 } from "path";
 var c12 = {
   bold: (s) => `\x1B[1m${s}\x1B[0m`,
   green: (s) => `\x1B[32m${s}\x1B[0m`,
@@ -6409,10 +6740,10 @@ var updateCommand = new Command("update").description("Update Zveltio to the lat
   console.log(`
 ${c12.bold("Zveltio Update")}
 `);
-  const installDir = opts.dir || process.env.ZVELTIO_DIR || join15(process.cwd(), "zveltio");
-  const metaPath = join15(installDir, ".zveltio-install.json");
+  const installDir = opts.dir || process.env.ZVELTIO_DIR || join17(process.cwd(), "zveltio");
+  const metaPath = join17(installDir, ".zveltio-install.json");
   let meta = null;
-  if (existsSync16(metaPath)) {
+  if (existsSync18(metaPath)) {
     try {
       meta = JSON.parse(await Bun.file(metaPath).text());
     } catch {}
@@ -6524,11 +6855,11 @@ ${c12.bold("Zveltio Update")}
 });
 async function getVersionFromPackageJson() {
   const candidates = [
-    join15(process.cwd(), "packages/engine/package.json"),
-    join15(process.cwd(), "package.json")
+    join17(process.cwd(), "packages/engine/package.json"),
+    join17(process.cwd(), "package.json")
   ];
   for (const pkgPath of candidates) {
-    if (!existsSync16(pkgPath))
+    if (!existsSync18(pkgPath))
       continue;
     try {
       const pkg = JSON.parse(await Bun.file(pkgPath).text());
@@ -6551,15 +6882,15 @@ async function getCurrentVersionFromAPI(port) {
   }
 }
 async function runUpdateScript(targetVersion, installDir, meta, force) {
-  const envPath = join15(installDir, ".env");
-  if (existsSync16(envPath)) {
+  const envPath = join17(installDir, ".env");
+  if (existsSync18(envPath)) {
     const backupPath = `${envPath}.backup.${Date.now()}`;
     const envContent = await Bun.file(envPath).text();
     await Bun.write(backupPath, envContent);
     console.log(`  Backed up .env \u2192 ${backupPath}`);
   }
-  const installScript = join15(installDir, "install.sh");
-  if (existsSync16(installScript)) {
+  const installScript = join17(installDir, "install.sh");
+  if (existsSync18(installScript)) {
     const args = [
       "bash",
       installScript,
@@ -6578,7 +6909,7 @@ async function runUpdateScript(targetVersion, installDir, meta, force) {
     if (code !== 0) {
       console.error(`
   Update failed. Your previous version is still running.`);
-      if (existsSync16(envPath)) {
+      if (existsSync18(envPath)) {
         console.log(`  Restore .env: copy ${envPath}.backup.* to ${envPath}`);
       }
       process.exit(1);
@@ -6743,14 +7074,14 @@ ${c13.bold("Zveltio Status")}
   console.log("");
 }
 async function getLocalVersion() {
-  const { existsSync: existsSync17 } = await import("fs");
-  const { join: join16 } = await import("path");
+  const { existsSync: existsSync19 } = await import("fs");
+  const { join: join18 } = await import("path");
   const candidates = [
-    join16(process.cwd(), "packages/engine/package.json"),
-    join16(process.cwd(), "package.json")
+    join18(process.cwd(), "packages/engine/package.json"),
+    join18(process.cwd(), "package.json")
   ];
   for (const p of candidates) {
-    if (!existsSync17(p))
+    if (!existsSync19(p))
       continue;
     try {
       const pkg = JSON.parse(await Bun.file(p).text());
@@ -6763,7 +7094,7 @@ async function getLocalVersion() {
 // package.json
 var package_default = {
   name: "@zveltio/cli",
-  version: "3.0.0-beta.77",
+  version: "3.0.0-beta.79",
   type: "module",
   bin: {
     zveltio: "./dist/index.js"
@@ -6778,7 +7109,7 @@ var package_default = {
     dev: "bun run --watch src/index.ts"
   },
   dependencies: {
-    "@zveltio/sdk": "3.0.0-beta.77",
+    "@zveltio/sdk": "3.0.0-beta.79",
     commander: "^12.1.0"
   },
   devDependencies: {
@@ -6805,8 +7136,12 @@ program2.addCommand(versionCommand);
 program2.addCommand(updateCommand);
 program2.command("create-god").description("Create the first super-admin (god) user interactively").option("--url <url>", "Engine URL", "http://localhost:3000").option("--email <email>", "Admin email (skip prompt)").option("--name <name>", "Admin name (skip prompt)").option("--recovery-token <token>", "RECOVERY_TOKEN the engine was started with \u2014 required to grant the god role (env: RECOVERY_TOKEN)").action(createGodCommand);
 var generate = program2.command("generate").description("Code generation utilities");
-generate.command("types [collection]").description("Generate TypeScript types for collections (writes to ./types/zveltio.d.ts)").option("-o, --output <path>", "Output file path", "./types/zveltio.d.ts").option("--url <url>", "Engine URL", "http://localhost:3000").action(generateTypesCommand);
-program2.command("generate-types [collection]").description("Generate TypeScript types for your collections").option("-o, --output <path>", "Output file path", "./types/zveltio.d.ts").option("--url <url>", "Engine URL", "http://localhost:3000").action(generateTypesCommand);
+generate.command("types [collection]").description("Generate TypeScript types for collections (writes to ./types/zveltio.d.ts)").option("-o, --output <path>", "Output file path", "./types/zveltio.d.ts").option("--url <url>", "Engine URL", "http://localhost:3000").option("--from <dir>", "Build from schema files (zveltio schema pull) instead of an engine").action(generateTypesCommand);
+program2.command("generate-types [collection]").description("Generate TypeScript types for your collections").option("-o, --output <path>", "Output file path", "./types/zveltio.d.ts").option("--url <url>", "Engine URL", "http://localhost:3000").option("--from <dir>", "Build from schema files (zveltio schema pull) instead of an engine").action(generateTypesCommand);
+var schema = program2.command("schema").description("Schema as code: the live schema as reviewable JSON files");
+schema.command("pull").description("Write the live schema to ./schema (collections, roles)").option("--dir <path>", "Schema directory", "./schema").option("--url <url>", "Engine URL (env: ZVELTIO_URL)").action(schemaPullCommand);
+schema.command("diff").description("Print what apply would change to match ./schema; exits 1 on drift").option("--dir <path>", "Schema directory", "./schema").option("--url <url>", "Engine URL (env: ZVELTIO_URL)").action(schemaDiffCommand);
+schema.command("apply").description("Make the instance match ./schema; shows the plan and asks first").option("--dir <path>", "Schema directory", "./schema").option("--url <url>", "Engine URL (env: ZVELTIO_URL)").option("--yes", "Apply without asking").option("--allow-destructive", "Run drops and type changes that a migration in migrations/ names").action(schemaApplyCommand);
 program2.command("install <name>").description("Install a Zveltio extension from marketplace or local path").option("--path <path>", "Install from local directory (offline)").option("--url <url>", "Engine URL for marketplace install", "http://localhost:3000").option("--force", "Overwrite existing extension (local install only)").action((name, opts) => installCommand(name, opts));
 var extensions = program2.command("extensions").description("Manage Zveltio extensions");
 extensions.command("list").description("List all available and installed extensions").option("--url <url>", "Engine URL", "http://localhost:3000").option("--category <category>", "Filter by category").option("--json", "Output as JSON").action((opts) => extensionsListCommand(opts));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zveltio/cli",
-  "version": "3.0.0-beta.77",
+  "version": "3.0.0-beta.79",
   "type": "module",
   "bin": {
     "zveltio": "./dist/index.js"
@@ -15,7 +15,7 @@
     "dev": "bun run --watch src/index.ts"
   },
   "dependencies": {
-    "@zveltio/sdk": "3.0.0-beta.77",
+    "@zveltio/sdk": "3.0.0-beta.79",
     "commander": "^12.1.0"
   },
   "devDependencies": {