create-bw-app 0.24.9 → 0.25.0

package/README.md

@@ -32,12 +32,14 @@ From a generated app, use `bw` to manage the machine-readable `.brightweb/app-ma
 ```bash
 bw add projects
 bw upgrade
+bw upgrade projects --through-migration 20260811121700_project_client_meta_preview.sql
 bw doctor
 bw admin create --email owner@example.com
 ```
 
 - `bw add <moduleKey>` resolves requirements, installs thin package mounts and module wiring, and appends migrations.
-- `bw upgrade [moduleKey]` includes the existing managed update flow plus forward-only module migrations.
+- `bw upgrade [moduleKey]` includes the existing managed update flow plus forward-only module migrations. For a staged database rollout, `bw upgrade <moduleKey> --through-migration <filename>` still updates packages and managed files but appends and records that module only through the named migration.
+- Destructive migrations are held at the preceding safe boundary. After compatible code is deployed and affected data is backed up, apply a held migration with an explicit module-scoped `bw upgrade <moduleKey> --include-destructive-migrations`. A destructive `--through-migration` target also requires that opt-in.
 - `bw doctor` checks package, config, scaffold, environment-name, migration, configured function-region, and deployed function-region consistency. Pass `--deployment-url` to inspect the deployed `x-vercel-id`; add `--report` to stamp the result in the app manifest.
 - `bw admin create --email <email>` creates a passwordless Supabase Auth user, transactionally ensures its profile and `admin` assignment, then sends the Core Auth `/reset-password` flow. It always refuses when the project already has an admin (use the in-app admin role controls to add administrators) and never promotes an existing Auth user.
 - All mutating commands support `--dry-run`.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "create-bw-app",
   "private": false,
-  "version": "0.24.9",
+  "version": "0.25.0",
   "type": "module",
   "bin": {
     "create-bw-app": "bin/create-bw-app.mjs",

package/src/bw.mjs

@@ -13,7 +13,7 @@ const HELP = `Usage: bw <command> [options]\n\nCommands:\n  add <moduleKey>
 function parseOptions(argv) {
   const options = {};
   const positionals = [];
-  const booleanFlags = new Set(["help", "dry-run", "strict", "report", "install", "refresh-starters", "allow-stale-fallback", "allow-uncursored", "force", "list", "yes"]);
+  const booleanFlags = new Set(["help", "dry-run", "strict", "report", "install", "refresh-starters", "include-destructive-migrations", "allow-stale-fallback", "allow-uncursored", "force", "list", "yes"]);
   const repeatableFlags = new Set(["cursor", "owned-surface", "own", "skip"]);
   for (let index = 0; index < argv.length; index += 1) {
     const token = argv[index];

package/src/constants.mjs

@@ -123,13 +123,18 @@ export const MODULE_STARTER_FILES = {
     "app/(shell)/account/projetos/[projectId]/page.tsx",
     "app/(shell)/account/projetos/[projectId]/loading.tsx",
     "app/api/projects/_handlers.ts",
+    "app/api/account/projects/route.ts",
+    "app/api/account/projects/[id]/route.ts",
     "app/api/dashboard/projects/route.ts",
     "app/api/dashboard/tasks/route.ts",
     "app/api/projects/route.ts",
     "app/api/projects/stats/route.ts",
     "app/api/projects/organizations/route.ts",
+    "app/api/projects/setup-options/route.ts",
     "app/api/projects/[id]/route.ts",
     "app/api/projects/[id]/activity/route.ts",
+    "app/api/projects/[id]/client-access/route.ts",
+    "app/api/projects/[id]/organizations/route.ts",
     "app/api/projects/[id]/members/route.ts",
     "app/api/projects/[id]/links/route.ts",
     "app/api/projects/[id]/links/[itemId]/route.ts",
@@ -176,16 +181,16 @@ export const PLATFORM_STARTER_FILES = [
 ];
 
 export const APP_DEPENDENCY_DEFAULTS = {
-  "@brightweblabs/app-shell": "^0.15.9",
-  "@brightweblabs/core-auth": "^0.10.11",
+  "@brightweblabs/app-shell": "^0.16.0",
+  "@brightweblabs/core-auth": "^0.11.0",
   "@brightweblabs/infra": "^0.7.0",
-  "@brightweblabs/module-admin": "^0.9.1",
-  "@brightweblabs/module-crm": "^0.17.2",
-  "@brightweblabs/module-marketing": "^0.4.22",
-  "@brightweblabs/module-orgs": "^0.6.1",
-  "@brightweblabs/module-projects": "^0.17.10",
-  "@brightweblabs/theme": "^0.8.2",
-  "@brightweblabs/ui": "^1.5.3",
+  "@brightweblabs/module-admin": "^0.9.2",
+  "@brightweblabs/module-crm": "^0.17.3",
+  "@brightweblabs/module-marketing": "^0.4.23",
+  "@brightweblabs/module-orgs": "^0.6.2",
+  "@brightweblabs/module-projects": "^0.18.0",
+  "@brightweblabs/theme": "^0.8.3",
+  "@brightweblabs/ui": "^1.5.4",
   "geist": "1.7.2",
   "lucide-react": "^1.8.0",
   "next": "^16.0.0",

package/src/generator.mjs

@@ -976,7 +976,7 @@ export function createShellConfig(selectedModules) {
     "const dashboardModuleRegistration: ShellModuleRegistration<ShellContextualAction> = {",
     '  key: "dashboard",',
     '  placement: "primary",',
-    '  navItems: [{ href: "/dashboard", label: "Dashboard", icon: LayoutDashboard }],',
+    '  navItems: [{ href: "/dashboard", label: "Dashboard", icon: LayoutDashboard, visibility: "staff" }],',
     '  toolbarRoutes: [{ surface: "dashboard", match: { exact: ["/dashboard"] } }],',
     "};",
     "",
@@ -994,7 +994,7 @@ export function createShellConfig(selectedModules) {
     "  return registrations;",
     "}",
     "",
-    "export function getStarterShellConfig() {",
+    "export function getStarterShellConfig(viewer = { isAdmin: true, isStaff: true }) {",
     "  const enabledModules = getEnabledStarterModules();",
     "  const modules = applyShellRegistrationOverrides(",
     "    getStarterModuleRegistrations(),",
@@ -1015,10 +1015,7 @@ export function createShellConfig(selectedModules) {
     "  };",
     "",
     "  const builtRegistration = buildClientAppShellRegistration(shellRegistration);",
-    "  const shellPreview = resolveClientAppShellConfig(builtRegistration.shellConfig, {",
-    "    isAdmin: true,",
-    "    isStaff: true,",
-    "  });",
+    "  const shellPreview = resolveClientAppShellConfig(builtRegistration.shellConfig, viewer);",
     "",
     "  return {",
     "    enabledModules,",

package/src/migrations.mjs

@@ -25,12 +25,28 @@ export async function getModuleMigrations(moduleKey, catalogEntry = {}) {
   for (const directory of candidates) {
     if (!(await pathExists(directory))) continue;
     const fileNames = (await fs.readdir(directory)).filter((fileName) => fileName.endsWith(".sql")).sort();
-    if (fileNames.length > 0) return fileNames.map((fileName) => ({ fileName, sourcePath: path.join(directory, fileName) }));
+    if (fileNames.length > 0) {
+      return Promise.all(fileNames.map(async (fileName) => {
+        const sourcePath = path.join(directory, fileName);
+        const source = await fs.readFile(sourcePath, "utf8");
+        return {
+          fileName,
+          sourcePath,
+          destructive: /^\s*--\s*bw-migration-safety:\s*destructive\s*$/im.test(source),
+        };
+      }));
+    }
   }
   return [];
 }
 
-export async function planMigrationAppends({ targetDir, moduleKeys, catalog, migrationCursor = {} }) {
+export async function planMigrationAppends({
+  targetDir,
+  moduleKeys,
+  catalog,
+  migrationCursor = {},
+  migrationUpperBounds = {},
+}) {
   const migrationsDir = await findAppMigrationsDirectory(targetDir);
   const existing = (await pathExists(migrationsDir))
     ? (await fs.readdir(migrationsDir)).filter((fileName) => fileName.endsWith(".sql")).sort()
@@ -40,11 +56,33 @@ export async function planMigrationAppends({ targetDir, moduleKeys, catalog, mig
     return Math.max(maximum, Number(match?.[1] || 0));
   }, 0);
   const writes = [];
+  const deferred = [];
   const nextCursor = { ...migrationCursor };
   for (const moduleKey of moduleKeys) {
     const migrations = await getModuleMigrations(moduleKey, catalog[moduleKey]);
     const cursor = migrationCursor[moduleKey];
-    const pending = cursor ? migrations.filter((entry) => entry.fileName > cursor) : migrations;
+    const upperBound = migrationUpperBounds[moduleKey];
+    let migrationsInScope = migrations;
+    if (upperBound) {
+      const upperBoundIndex = migrations.findIndex((entry) => entry.fileName === upperBound);
+      if (upperBoundIndex === -1) {
+        throw new Error(`Migration cutoff ${upperBound} does not exist for module ${moduleKey}.`);
+      }
+      if (cursor) {
+        const cursorIndex = migrations.findIndex((entry) => entry.fileName === cursor);
+        if (cursorIndex === -1) {
+          throw new Error(`Migration cutoff blocked: current cursor ${cursor} does not exist in the shipped ${moduleKey} migration history.`);
+        }
+        if (upperBoundIndex < cursorIndex) {
+          throw new Error(`Migration cutoff ${upperBound} is before the current ${moduleKey} cursor ${cursor}.`);
+        }
+      }
+      migrationsInScope = migrations.slice(0, upperBoundIndex + 1);
+      deferred.push(...migrations.slice(upperBoundIndex + 1).map((entry) => ({ moduleKey, ...entry })));
+    }
+    const pending = cursor
+      ? migrationsInScope.filter((entry) => entry.fileName > cursor)
+      : migrationsInScope;
     for (const entry of pending) {
       sequence += 1;
       const targetFileName = `${String(sequence).padStart(4, "0")}_${moduleKey}__${entry.fileName}`;
@@ -58,9 +96,9 @@ export async function planMigrationAppends({ targetDir, moduleKeys, catalog, mig
         content: `-- bw-module: ${moduleKey}@${version} ${entry.fileName}\n${source}`,
       });
     }
-    if (migrations.length > 0) nextCursor[moduleKey] = migrations.at(-1).fileName;
+    if (migrationsInScope.length > 0) nextCursor[moduleKey] = migrationsInScope.at(-1).fileName;
   }
-  return { writes, nextCursor };
+  return { writes, deferred, nextCursor };
 }
 
 export async function applyMigrationWrites(writes) {

package/src/upgrade.mjs

@@ -7,10 +7,23 @@ import { applyMigrationWrites, getModuleMigrations, planMigrationAppends } from
 import { buildBrightwebAppUpdatePlan } from "./update.mjs";
 import { resolveSafeRelativePath } from "./safe-path.mjs";
 
-const HELP = `Usage: bw upgrade [moduleKey] [options]\n\nOptions:\n  --target-dir <path>          App directory (defaults to cwd)\n  --workspace-root <path>      BrightWeb workspace root\n  --allow-stale-fallback       Use baked-in versions if npm lookup fails\n  --install                    Install changed dependencies\n  --refresh-starters           Refresh unchanged starter files\n  --dry-run                    Print the upgrade plan without writing\n  --help                       Show this help`;
+const HELP = `Usage: bw upgrade [moduleKey] [options]\n\nOptions:\n  --target-dir <path>                 App directory (defaults to cwd)\n  --workspace-root <path>             BrightWeb workspace root\n  --through-migration <file>          Advance the named module only through this migration\n  --include-destructive-migrations    Explicitly include held destructive migrations\n  --allow-stale-fallback              Use baked-in versions if npm lookup fails\n  --install                           Install changed dependencies\n  --refresh-starters                  Refresh unchanged starter files\n  --dry-run                           Print the upgrade plan without writing\n  --help                              Show this help`;
 
 export async function upgradeBrightwebApp(moduleKey, argvOptions = {}, runtimeOptions = {}) {
   if (argvOptions.help) { output.write(`${HELP}\n`); return { help: true }; }
+  const throughMigration = typeof argvOptions.throughMigration === "string"
+    ? argvOptions.throughMigration.trim()
+    : "";
+  if (argvOptions.throughMigration != null && !throughMigration) {
+    throw new Error("--through-migration requires a migration filename.");
+  }
+  if (throughMigration && !moduleKey) {
+    throw new Error("--through-migration requires an explicit module key, for example: bw upgrade projects --through-migration <filename>.");
+  }
+  const includeDestructiveMigrations = argvOptions.includeDestructiveMigrations === true;
+  if (includeDestructiveMigrations && !moduleKey) {
+    throw new Error("--include-destructive-migrations requires an explicit module key so destructive scope cannot expand implicitly.");
+  }
   const targetDir = path.resolve(runtimeOptions.targetDir || argvOptions.targetDir || process.cwd());
   const appManifest = await readAppManifest(targetDir);
   if (moduleKey && !appManifest.modules[moduleKey]) throw new Error(`Module ${moduleKey} is not installed according to ${path.join(".brightweb", "app-manifest.json")}.`);
@@ -50,8 +63,47 @@ export async function upgradeBrightwebApp(moduleKey, argvOptions = {}, runtimeOp
     if (appManifest.migrationCursor?.[key] == null && (await getModuleMigrations(key, catalog[key])).length > 0) uncursored.push(key);
   }
   if (uncursored.length > 0) throw new Error(`Migration upgrade blocked: ${uncursored.join(", ")} ${uncursored.length === 1 ? "has" : "have"} a null migration cursor. Set an explicit cursor with bw adopt --force --cursor before upgrading.`);
-  const migrationPlan = await planMigrationAppends({ targetDir, moduleKeys, catalog, migrationCursor: appManifest.migrationCursor });
+  const migrationUpperBounds = {};
+  const safetyBoundaries = [];
+  for (const key of moduleKeys) {
+    const migrations = await getModuleMigrations(key, catalog[key]);
+    const destructiveIndex = migrations.findIndex((entry) => entry.destructive);
+    if (throughMigration && key === moduleKey) {
+      const cutoffIndex = migrations.findIndex((entry) => entry.fileName === throughMigration);
+      if (cutoffIndex >= destructiveIndex && destructiveIndex >= 0 && !includeDestructiveMigrations) {
+        throw new Error(`Migration cutoff ${throughMigration} includes destructive migration ${migrations[destructiveIndex].fileName}. Re-run with --include-destructive-migrations after reviewing and backing up affected data.`);
+      }
+      migrationUpperBounds[key] = throughMigration;
+      continue;
+    }
+    if (includeDestructiveMigrations || destructiveIndex < 0) continue;
+    const cursorIndex = migrations.findIndex((entry) => entry.fileName === appManifest.migrationCursor?.[key]);
+    if (cursorIndex >= destructiveIndex) continue;
+    if (destructiveIndex === 0) {
+      throw new Error(`Migration upgrade blocked: ${key} begins with destructive migration ${migrations[0].fileName}; use --include-destructive-migrations after review.`);
+    }
+    const boundary = migrations[destructiveIndex - 1].fileName;
+    migrationUpperBounds[key] = boundary;
+    safetyBoundaries.push({ moduleKey: key, boundary, destructiveMigration: migrations[destructiveIndex].fileName });
+  }
+  const migrationPlan = await planMigrationAppends({
+    targetDir,
+    moduleKeys,
+    catalog,
+    migrationCursor: appManifest.migrationCursor,
+    migrationUpperBounds,
+  });
   output.write(`bw upgrade\nPackages to update: ${plan.packageUpdates.length}\nManaged files to write: ${plan.fileWrites.length}\nMigrations to append: ${migrationPlan.writes.length}\n`);
+  if (throughMigration) output.write(`Migration cutoff: ${moduleKey} through ${throughMigration}\n`);
+  for (const boundary of safetyBoundaries) {
+    output.write(`Migration safety boundary: ${boundary.moduleKey} through ${boundary.boundary}; held ${boundary.destructiveMigration}\n`);
+  }
+  if (migrationPlan.deferred.length > 0) {
+    output.write(`Migrations deferred: ${migrationPlan.deferred.length}\n`);
+    for (const entry of migrationPlan.deferred) {
+      output.write(`- deferred migration: ${entry.moduleKey}/${entry.fileName}\n`);
+    }
+  }
   for (const relativePath of missing) output.write(`- missing: ${relativePath}\n`);
   for (const relativePath of drifted) output.write(`- drifted: ${relativePath}\n`);
   for (const relativePath of intentional) output.write(`- intent-protected: ${relativePath}\n`);

package/template/base/app/(shell)/dashboard/dashboard-page-mount.tsx

@@ -0,0 +1,7 @@
+import { requireServerPageRoleAccess } from "@brightweblabs/core-auth/server";
+import { DashboardLiveMount } from "./dashboard-live-mount";
+
+export async function DashboardPageMount() {
+  await requireServerPageRoleAccess(["admin", "staff"]);
+  return <DashboardLiveMount />;
+}

package/template/base/app/(shell)/dashboard/page.tsx

@@ -1 +1 @@
-export { DashboardLiveMount as default } from "./dashboard-live-mount";
+export { DashboardPageMount as default } from "./dashboard-page-mount";

package/template/base/app/(shell)/shell-layout-client.tsx

@@ -5,6 +5,7 @@ import { usePathname, useRouter } from "next/navigation";
 import {
   AppHeader,
   AppShellFrame,
+  ClientPortalFrame,
   DesktopSidebar,
   MobileNav,
   ShellActionsProvider,
@@ -51,8 +52,8 @@ function ShellLayoutInner({
   const pathname = usePathname() ?? "";
   const router = useRouter();
   const { shellPreview: config, toolbarRoutes, toolbarActions } = useMemo(
-    () => getStarterShellConfig(),
-    [],
+    () => getStarterShellConfig({ isAdmin: viewer.isAdmin, isStaff: viewer.isStaff }),
+    [viewer.isAdmin, viewer.isStaff],
   );
   const shellGroups = useMemo<ShellNavStateGroup[]>(
     () => [
@@ -100,6 +101,30 @@ function ShellLayoutInner({
     if (item.action) dispatchShellAction(item.action);
   };
 
+  const handleSignOut = async () => {
+    await authClient.signOutLocal();
+    router.replace("/login");
+    router.refresh();
+  };
+
+  if (!viewer.isStaff && !viewer.isAdmin) {
+    return (
+      <ClientPortalFrame
+        brand={config.brand}
+        pathname={pathname}
+        displayName={displayName}
+        onSignOut={handleSignOut}
+        user={{
+          email: viewer.email,
+          user_metadata: { first_name: viewer.firstName, last_name: viewer.lastName },
+        }}
+        userInitials={computeInitials(viewer.email, viewer.firstName ?? undefined, viewer.lastName ?? undefined)}
+      >
+        {children}
+      </ClientPortalFrame>
+    );
+  }
+
   return (
     <AppShellFrame
       collapsed={isSidebarCollapsed}
@@ -125,11 +150,7 @@ function ShellLayoutInner({
           account={{
             displayName,
             isStaff: viewer.isStaff,
-            onSignOut: async () => {
-              await authClient.signOutLocal();
-              router.replace("/login");
-              router.refresh();
-            },
+            onSignOut: handleSignOut,
             user: {
               email: viewer.email,
               user_metadata: {

package/template/modules/crm/app/(shell)/crm/organizations/[id]/page.tsx

@@ -1 +1 @@
-export { CrmOrganizationRoutePage as default } from "@brightweblabs/module-crm/ui";
+export { CrmOrganizationRoutePage as default } from "@brightweblabs/module-crm/routes";

package/template/modules/crm/app/(shell)/crm/organizations/page.tsx

@@ -1,3 +1 @@
-import { CrmOrganizationsPage } from "@brightweblabs/module-crm/ui";
-
-export default function OrganizationsPage() { return <CrmOrganizationsPage />; }
+export { CrmOrganizationsRoutePage as default } from "@brightweblabs/module-crm/routes";

package/template/modules/crm/app/(shell)/crm/page.tsx

@@ -1,5 +1 @@
-import { CrmDashboard } from "@brightweblabs/module-crm/ui";
-
-export default function CrmPage() {
-  return <CrmDashboard />;
-}
+export { CrmDashboardRoutePage as default } from "@brightweblabs/module-crm/routes";

package/template/modules/crm/app/(shell)/crm/report/page.tsx

@@ -1,5 +1 @@
-import { CrmReportPage } from "@brightweblabs/module-crm/ui";
-
-export default function ReportPage() {
-  return <CrmReportPage />;
-}
+export { CrmReportRoutePage as default } from "@brightweblabs/module-crm/routes";

package/template/modules/projects/app/(shell)/account/page.tsx

@@ -1 +1,5 @@
-export { ClientAccountPage as default } from "@brightweblabs/module-projects";
+import { ClientAccountPage } from "@brightweblabs/module-projects";
+
+export default function Page() {
+  return <ClientAccountPage />;
+}

package/template/modules/projects/app/(shell)/account/perfil/page.tsx

@@ -0,0 +1 @@
+export { ClientProfilePage as default } from "@brightweblabs/module-projects";

package/template/modules/projects/app/(shell)/projetos/projetos-server-mounts.tsx

@@ -1,4 +1,4 @@
-import { requireServerPageAccess } from "@brightweblabs/core-auth/server";
+import { requireServerPageRoleAccess } from "@brightweblabs/core-auth/server";
 import {
   getProjectDashboard,
   getProjectAccess,
@@ -18,6 +18,7 @@ const navigation = {
 };
 
 export async function ProjectsServerMount() {
+  await requireServerPageRoleAccess(["admin", "staff"]);
   const { organizationOptions, portfolioStats, result } = await getProjectsPortfolioPageData();
   const attentionSummary = {
     total: result.total,
@@ -38,7 +39,7 @@ export async function ProjectsServerMount() {
 
 async function getInitialProject(params: Promise<{ projectId: string }>) {
   const { projectId } = await params;
-  const { supabase, profileId, role } = await requireServerPageAccess();
+  const { supabase, profileId, role } = await requireServerPageRoleAccess(["admin", "staff"]);
   const [initialData, access] = await Promise.all([
     getProjectDashboard(supabase, projectId),
     getProjectAccess(supabase, projectId, profileId, role),

package/template/modules/projects/app/api/account/projects/[id]/route.ts

@@ -0,0 +1,2 @@
+export const dynamic = "force-dynamic";
+export { clientProjectDetailGet as GET } from "../../../projects/_handlers";

package/template/modules/projects/app/api/account/projects/route.ts

@@ -0,0 +1,2 @@
+export const dynamic = "force-dynamic";
+export { clientProjectsGet as GET } from "../../projects/_handlers";

package/template/modules/projects/app/api/projects/[id]/client-access/route.ts

@@ -0,0 +1,2 @@
+export const dynamic = "force-dynamic";
+export { projectClientAccessGet as GET, projectClientAccessPatch as PATCH } from "../../_handlers";

package/template/modules/projects/app/api/projects/[id]/organizations/route.ts

@@ -0,0 +1,2 @@
+export const dynamic = "force-dynamic";
+export { projectOrganizationsPatch as PATCH } from "../../_handlers";

package/template/modules/projects/app/api/projects/_handlers.ts

@@ -1,4 +1,9 @@
 import {
+  handleClientProjectDetailGetRequest,
+  handleClientProjectsGetRequest,
+  handleProjectClientAccessGetRequest,
+  handleProjectClientAccessPatchRequest,
+  handleProjectOrganizationsPatchRequest,
   handleProjectsActivityGetRequest,
   handleProjectsAssignableProfilesGetRequest,
   handleProjectsDashboardGetRequest,
@@ -16,6 +21,7 @@ import {
   handleProjectsPatchRequest,
   handleProjectsPostRequest,
   handleProjectsStatsGetRequest,
+  handleProjectsSetupOptionsGetRequest,
   handleProjectsTasksDeleteRequest,
   handleProjectsTasksPatchRequest,
   handleProjectsTasksPostRequest,
@@ -27,6 +33,24 @@ type ItemRouteContext = { params: Promise<{ id: string; itemId: string }> };
 export function projectsGet(request: Request) {
   return handleProjectsGetRequest(request);
 }
+export function clientProjectsGet(request: Request) {
+  return handleClientProjectsGetRequest(request);
+}
+export function clientProjectDetailGet(request: Request, context: IdRouteContext) {
+  return handleClientProjectDetailGetRequest(request, context);
+}
+export function projectClientAccessGet(request: Request, context: IdRouteContext) {
+  return handleProjectClientAccessGetRequest(request, context);
+}
+export function projectClientAccessPatch(request: Request, context: IdRouteContext) {
+  return handleProjectClientAccessPatchRequest(request, context);
+}
+export function projectOrganizationsPatch(request: Request, context: IdRouteContext) {
+  return handleProjectOrganizationsPatchRequest(request, context);
+}
+export function projectsSetupOptionsGet(request: Request) {
+  return handleProjectsSetupOptionsGetRequest(request);
+}
 export function projectsPost(request: Request) {
   return handleProjectsPostRequest(request);
 }

package/template/modules/projects/app/api/projects/setup-options/route.ts

@@ -0,0 +1,2 @@
+export const dynamic = "force-dynamic";
+export { projectsSetupOptionsGet as GET } from "../_handlers";

package/template/supabase/modules/orgs/migrations/20260812120000_staff_only_organization_access_management.sql

@@ -0,0 +1,7 @@
+-- Organization roles remain useful client-facing membership metadata, but
+-- only global staff and administrators may manage members or invitations.
+DROP POLICY IF EXISTS "Org admins manage org members"
+  ON public.organization_members;
+
+DROP POLICY IF EXISTS "Org admins manage organization invitations"
+  ON public.organization_invitations;