create-bw-app 0.27.2 → 0.27.4

package/README.md

@@ -40,7 +40,7 @@ bw admin create --email owner@example.com
 - `bw add <moduleKey>` resolves requirements, installs thin package mounts and module wiring, and appends migrations.
 - `bw upgrade [moduleKey]` includes the existing managed update flow plus forward-only module migrations. For a staged database rollout, `bw upgrade <moduleKey> --through-migration <filename>` still updates packages and managed files but appends and records that module only through the named migration.
 - Destructive migrations are held at the preceding safe boundary. After compatible code is deployed and affected data is backed up, apply a held migration with an explicit module-scoped `bw upgrade <moduleKey> --include-destructive-migrations`. A destructive `--through-migration` target also requires that opt-in.
-- `bw doctor` checks package, config, scaffold, environment-name, migration, configured function-region, and deployed function-region consistency. Pass `--deployment-url` to inspect the deployed `x-vercel-id`; add `--report` to stamp the result in the app manifest.
+- `bw doctor` checks package, config, scaffold, environment-name, migration, configured function-region, and deployed function-region consistency. App-owned scaffold files are preserved on upgrade; doctor warns when their recorded template baseline is outdated and their contents differ from the current template. Use `bw diff`, reconcile relevant changes, and verify behavior before recording the reviewed baseline with `bw scaffold manage <path>` followed by `bw scaffold own <path>` (neither replaces file contents). Live database objects, applied migrations, and authenticated permissions are explicitly **NOT VERIFIED** by doctor; a successful local result does not certify deployed behavior. Pass `--deployment-url` to inspect the deployed `x-vercel-id`; add `--report` to stamp the result in the app manifest.
 - `bw admin create --email <email>` creates a passwordless Supabase Auth user, transactionally ensures its profile and `admin` assignment, then sends the Core Auth `/reset-password` flow. It always refuses when the project already has an admin (use the in-app admin role controls to add administrators) and never promotes an existing Auth user.
 - All mutating commands support `--dry-run`.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "create-bw-app",
   "private": false,
-  "version": "0.27.2",
+  "version": "0.27.4",
   "type": "module",
   "bin": {
     "create-bw-app": "bin/create-bw-app.mjs",

package/src/add.mjs

@@ -6,7 +6,7 @@ import { SELECTABLE_MODULES } from "./constants.mjs";
 import { TEMPLATE_ROOT, createDbInstallPlan, createManagedPlatformFiles, getDbModuleRegistry, getVersionMap, pathExists, readJsonIfPresent } from "./generator.mjs";
 import { collectScaffoldFiles, findWorkspaceRoot, loadModuleCatalog, MODULE_PACKAGES, readAppManifest, resolveModuleClosure, satisfiesVersion, writeAppManifest } from "./app-manifest.mjs";
 import { assertNoUntrackedScaffoldWrites, scaffoldDrift } from "./scaffold.mjs";
-import { applyMigrationWrites, planMigrationAppends } from "./migrations.mjs";
+import { assertMigrationMutationTargets, applyMigrationWrites, planMigrationAppends } from "./migrations.mjs";
 
 const HELP = `Usage: bw add <moduleKey> [options]\n\nOptions:\n  --target-dir <path>       App directory (defaults to cwd)\n  --workspace-root <path>   BrightWeb workspace root\n  --dry-run                 Print the install plan without writing\n  --help                    Show this help`;
 
@@ -109,7 +109,8 @@ export async function addBrightwebModule(moduleKey, argvOptions = {}, runtimeOpt
     }
   }
 
-  await assertMutationTargets(targetDir, ["package.json", ".brightweb/app-manifest.json", ...Object.keys(managedWrites), ...overlayFiles, ...migrationPlan.writes.map((write) => path.relative(targetDir, write.targetPath))]);
+  await assertMutationTargets(targetDir, ["package.json", ".brightweb/app-manifest.json", ...Object.keys(managedWrites), ...overlayFiles]);
+  await assertMigrationMutationTargets(targetDir, migrationPlan.writes);
 
   const summary = [
     "bw add",

package/src/constants.mjs

@@ -116,6 +116,7 @@ export const MODULE_STARTER_FILES = {
     "app/(shell)/projetos/[projectId]/page.tsx",
     "app/(shell)/projetos/[projectId]/quadro/page.tsx",
     "app/(shell)/projetos/[projectId]/tarefas/page.tsx",
+    "app/(shell)/account/perfil/page.tsx",
     "app/(shell)/account/projetos/page.tsx",
     "app/(shell)/account/projetos/loading.tsx",
     "app/(shell)/account/projetos/[projectId]/page.tsx",
@@ -186,14 +187,14 @@ export const PLATFORM_STARTER_FILES = [
 ];
 
 export const APP_DEPENDENCY_DEFAULTS = {
-  "@brightweblabs/app-shell": "^0.16.3",
+  "@brightweblabs/app-shell": "^0.16.4",
   "@brightweblabs/core-auth": "^0.12.2",
   "@brightweblabs/infra": "^0.7.0",
-  "@brightweblabs/module-admin": "^0.9.7",
-  "@brightweblabs/module-crm": "^0.18.4",
-  "@brightweblabs/module-marketing": "^0.5.2",
-  "@brightweblabs/module-orgs": "^0.7.3",
-  "@brightweblabs/module-projects": "^0.19.3",
+  "@brightweblabs/module-admin": "^0.9.8",
+  "@brightweblabs/module-crm": "^0.18.5",
+  "@brightweblabs/module-marketing": "^0.5.3",
+  "@brightweblabs/module-orgs": "^0.7.4",
+  "@brightweblabs/module-projects": "^0.19.4",
   "@brightweblabs/theme": "^0.8.4",
   "@brightweblabs/ui": "^1.5.6",
   "geist": "1.7.2",

package/src/doctor.mjs

@@ -3,11 +3,11 @@ import path from "node:path";
 import { stdout as output } from "node:process";
 import { APP_DEPENDENCY_DEFAULTS, BRIGHTWEB_PACKAGE_NAMES } from "./constants.mjs";
 import { cursorMigrationStatus, exactMigrationCompatibilityStatus } from "./migrations.mjs";
-import { findWorkspaceRoot, loadModuleCatalog, MODULE_PACKAGES, readAppManifest, readConfiguredModuleFlags, satisfiesVersion, validateAppManifest, writeAppManifest } from "./app-manifest.mjs";
+import { findWorkspaceRoot, hashFile, loadModuleCatalog, MODULE_PACKAGES, readAppManifest, readConfiguredModuleFlags, satisfiesVersion, validateAppManifest, writeAppManifest } from "./app-manifest.mjs";
 import { loadAppEnvironment, readFirstEnvironmentValue } from "./env.mjs";
 import { pathExists, readJsonIfPresent } from "./generator.mjs";
 import { nearestVercelRegion, normalizeSupabaseRegion } from "./regions.mjs";
-import { scaffoldDrift } from "./scaffold.mjs";
+import { canonicalScaffoldHash, scaffoldDrift } from "./scaffold.mjs";
 
 const HELP = `Usage: bw doctor [options]\n\nOptions:\n  --target-dir <path>       App directory (defaults to cwd)\n  --workspace-root <path>   BrightWeb workspace root\n  --deployment-url <url>    Deployed app URL (defaults to PUBLIC_APP_URL/NEXT_PUBLIC_APP_URL)\n  --supabase-region <id>    Current Supabase project region override\n  --strict                  Treat warnings as failures\n  --report                  Stamp lastDoctor in the app manifest\n  --help                    Show this help`;
 const RUNTIME_PACKAGE_NAMES = ["react", "react-dom", "next"];
@@ -378,6 +378,18 @@ export async function doctorBrightwebApp(argvOptions = {}, runtimeOptions = {})
   add(topologyProblems.length ? "FAIL" : "PASS", "topology", topologyProblems.join("; ") || "Module requirements are satisfied.");
 
   const scaffold = await scaffoldDrift(targetDir, appManifest.scaffoldFiles);
+  const ownedTemplateUpdates = [];
+  for (const entry of scaffold.entries) {
+    if (entry.intent !== "owned" || entry.status === "missing") continue;
+    const templateHash = await canonicalScaffoldHash({ relativePath: entry.relativePath, manifest: appManifest, targetDir, workspaceRoot });
+    // Ownership preserves the recorded baseline during upgrades; it does not prove
+    // that later starter fixes have been reconciled into the app's custom file.
+    if (templateHash && templateHash !== appManifest.scaffoldFiles[entry.relativePath].hash
+      && templateHash !== await hashFile(path.join(targetDir, entry.relativePath))) {
+      ownedTemplateUpdates.push(entry.relativePath);
+    }
+  }
+  if (ownedTemplateUpdates.length) add("WARN", "scaffold-owned-template-updates", `Current templates changed for preserved app-owned files: ${ownedTemplateUpdates.join(", ")}. Compatibility is NOT VERIFIED. Run bw diff, reconcile relevant fixes and verify behavior. After review, use bw scaffold manage followed by bw scaffold own for each custom file to record the current template baseline; these commands do not replace file contents.`);
   const scaffoldGroups = {
     current: scaffold.entries.filter((entry) => entry.status === "current" && entry.intent !== "skipped"),
     owned: scaffold.entries.filter((entry) => entry.intent === "owned" && entry.status === "drifted"),
@@ -391,7 +403,7 @@ export async function doctorBrightwebApp(argvOptions = {}, runtimeOptions = {})
   if (scaffoldGroups.undecidedDrift.length) add("WARN", "scaffold-undecided-drift", `Unacknowledged drift: ${scaffoldGroups.undecidedDrift.map((entry) => entry.relativePath).join(", ")} (use bw scaffold own or bw diff).`);
   if (scaffoldGroups.undecidedMissing.length) add("WARN", "scaffold-undecided-missing", `Unacknowledged missing files: ${scaffoldGroups.undecidedMissing.map((entry) => entry.relativePath).join(", ")} (use bw scaffold skip after review).`);
   if (scaffoldGroups.mismatched.length) add("FAIL", "scaffold-intent-mismatch", `Recorded scaffold intent no longer matches reality: ${scaffoldGroups.mismatched.map((entry) => `${entry.relativePath} (${entry.intent}, ${entry.status})`).join(", ")}.`);
-  const scaffoldStatus = scaffoldGroups.mismatched.length ? "FAIL" : scaffoldGroups.undecidedDrift.length || scaffoldGroups.undecidedMissing.length ? "WARN" : "PASS";
+  const scaffoldStatus = scaffoldGroups.mismatched.length ? "FAIL" : ownedTemplateUpdates.length || scaffoldGroups.undecidedDrift.length || scaffoldGroups.undecidedMissing.length ? "WARN" : "PASS";
   add(scaffoldStatus, "scaffold", `${scaffoldGroups.current.length} current, ${scaffoldGroups.owned.length} owned, ${scaffoldGroups.skipped.length} skipped, ${scaffoldGroups.undecidedDrift.length} undecided-drift, ${scaffoldGroups.undecidedMissing.length} undecided-missing, ${scaffoldGroups.mismatched.length} intent-mismatch.`);
   add("INFO", "owned-surfaces", `Owned surfaces: ${(appManifest.ownedSurfaces || []).join(", ") || "none"}.`);
 
@@ -456,7 +468,7 @@ export async function doctorBrightwebApp(argvOptions = {}, runtimeOptions = {})
       add("INFO", `migration-legacy-equivalent-${key}`, `${key}: ${status.legacyEquivalent.length} immutable historical migration file${status.legacyEquivalent.length === 1 ? " matches" : "s match"} a reviewed SQL-equivalent legacy hash.`);
     }
   }
-  add("WARN", "db-objects", "SKIP live database checks are not available yet.");
+  add("WARN", "db-objects", "NOT VERIFIED: live database objects, applied migrations, and authenticated row-level permissions. Local migration provenance does not establish deployed behavior; apply pending migrations and run authenticated admin/client permission checks against the target database.");
   return finish(checks, argvOptions, appManifest, targetDir);
 }
 

package/src/migrations.mjs

@@ -1,4 +1,5 @@
 import semver from "semver";
+import { assertMutationTargets } from "./mutation-paths.mjs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { createHash } from "node:crypto";
@@ -16,6 +17,33 @@ export async function findAppMigrationsDirectory(targetDir) {
   }
 }
 
+// Database migrations may belong to the containing consumer workspace, while
+// app files remain bounded to the app itself. Never realpath the migration
+// directory: that would hide links below the legitimate workspace boundary.
+export async function assertMigrationMutationTargets(targetDir, writes) {
+  if (writes.length === 0) return;
+  const appRoot = await fs.realpath(path.resolve(targetDir));
+  let boundary = appRoot;
+  let current = appRoot;
+  while (true) {
+    if (await pathExists(path.join(current, "pnpm-workspace.yaml"))
+      || await pathExists(path.join(current, ".git"))) {
+      boundary = current;
+      break;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  const migrationsDir = await findAppMigrationsDirectory(appRoot);
+  for (const write of writes) {
+    if (path.dirname(write.targetPath) !== migrationsDir) {
+      throw new Error("Migration write must target the app's discovered migrations directory.");
+    }
+  }
+  await assertMutationTargets(boundary, writes.map((write) => path.relative(boundary, write.targetPath)));
+}
+
 export async function getModuleMigrations(moduleKey, catalogEntry = {}) {
   const candidates = [];
   const configuredPath = catalogEntry.manifest?.database?.migrations;

package/src/upgrade.mjs

@@ -4,7 +4,7 @@ import path from "node:path";
 import { stdout as output } from "node:process";
 import { hashFile, findWorkspaceRoot, loadModuleCatalog, readAppManifest, writeAppManifest, cleanVersion } from "./app-manifest.mjs";
 import { pathExists, runInstall } from "./generator.mjs";
-import { applyMigrationWrites, getModuleMigrations, planMigrationAppends } from "./migrations.mjs";
+import { assertMigrationMutationTargets, applyMigrationWrites, getModuleMigrations, planMigrationAppends } from "./migrations.mjs";
 import { buildBrightwebAppUpdatePlan } from "./update.mjs";
 import { resolveSafeRelativePath } from "./safe-path.mjs";
 import { scaffoldDrift } from "./scaffold.mjs";
@@ -102,7 +102,8 @@ export async function upgradeBrightwebApp(moduleKey, argvOptions = {}, runtimeOp
     migrationCursor: appManifest.migrationCursor,
     migrationUpperBounds,
   });
-  await assertMutationTargets(targetDir, [".brightweb/app-manifest.json", ...plan.fileWrites.map((write) => write.relativePath), ...plan.fileDeletes.map((entry) => entry.relativePath), ...migrationPlan.writes.map((write) => path.relative(targetDir, write.targetPath))]);
+  await assertMutationTargets(targetDir, [".brightweb/app-manifest.json", ...plan.fileWrites.map((write) => write.relativePath), ...plan.fileDeletes.map((entry) => entry.relativePath)]);
+  await assertMigrationMutationTargets(targetDir, migrationPlan.writes);
   output.write(`bw upgrade\nPackages to update: ${plan.packageUpdates.length}\nManaged files to write: ${plan.fileWrites.length}\nObsolete managed files to remove: ${plan.fileDeletes.length}\nMigrations to append: ${migrationPlan.appends.length}\n`);
   if (throughMigration) output.write(`Migration cutoff: ${moduleKey} through ${throughMigration}\n`);
   for (const boundary of safetyBoundaries) {

package/template/supabase/modules/admin/migrations/20260908120000_admin_profile_directory_visibility.sql

@@ -0,0 +1,9 @@
+-- The admin directory joins role assignments to profiles using the caller's
+-- authenticated session. Grant the corresponding profile reads through RLS.
+-- Staff and clients retain their existing profile visibility and write rules.
+DROP POLICY IF EXISTS "Admins can view profiles" ON public.profiles;
+CREATE POLICY "Admins can view profiles"
+  ON public.profiles
+  FOR SELECT
+  TO authenticated
+  USING (public.is_admin());