Rownd support CLI

Named Rownd/SuperTokens credentials, read-only user investigations, and CSV passwordless-method migration. Requires Node.js 18+.

npm install -g @supertokens-plugins/rownd-support
rownd-support profiles add --profile staging
rownd-support profiles list --profile '*'
rownd-support profiles show --profile staging
rownd-support investigate-user <rownd-user-id> --profile staging
rownd-support profiles remove --profile staging

Every command requires --profile. profiles list --profile '*' explicitly lists all profiles; a name selects one. There is no active/default profile or environment credential fallback. Add prompts for Rownd appId, appKey, appSecret, SuperTokens connectionURI, optional apiKey, and tenantId (default public). Secrets and the connection URI are masked during entry. Existing names must be removed before replacement. Show/list redact secrets and URI authentication.

Credentials live in ~/.config/rownd-support/profiles.json, in plaintext with owner-only file (0600) and directory (0700) permissions. Writes use a synced temporary file, atomic rename, and an exclusive lock. If a process is killed while editing, remove profiles.json.lock only after confirming no profile editor is running. Profile-store symlinks are rejected.

Investigate a user

rownd-support investigate-user <rownd-user-id> --profile staging --output-dir ./investigations

The command fetches the full Rownd profile, tries the ID directly in SuperTokens, and independently resolves the external ID mapping. Email and phone searches run separately in the profile's tenant, using contacts from both systems—including contacts found on returned accounts. A successful ID lookup does not skip contact searches. ID/mapping lookups are Core-wide; contact lookups are tenant-scoped.

Accounts are deduplicated by the internal owning account ID, resolving externally mapped primary IDs. Multiple recipes on one account are not duplicates. Failed ID resolution leaves users explicitly unresolved rather than guessing their internal identity. Findings distinguish multiple accounts, mapping/contact mismatch, not-found results, and lookup failures. Partial failures still produce artifacts and allow other lookups to finish.

Each run creates a unique timestamped child directory below ~/.local/share/rownd-support/runs or --output-dir, containing:

• rownd-user.json: full Rownd response shape (null if unavailable).
• supertokens-results.json: lookup outcomes, full returned users, canonical accounts with lookup sources, and unresolved users.
• report.json: profile name, tenant, timestamp, contacts, account IDs, findings, partial-completion status, and full rowndUser and supertokensResults payloads.

Run directories/files are owner-only. Artifacts contain user data but no profile credentials; configured secrets are scrubbed if echoed in response data. Network errors are recorded as lookup failures without serializing request/error objects. The terminal prints the report, including both payloads and the artifact directory.

Add passwordless methods from CSV

rownd-support add-passwordless-methods --profile staging --csv users.csv
rownd-support add-passwordless-methods --profile staging --csv users.csv --execute --concurrency 5

CSV requires userId,email columns. IDs may be internal or externally mapped. Dry-run is the default. --execute promotes eligible non-primary accounts, creates an email passwordless recipe, and links it to the target. The admin API treats the supplied email as verified without sending an OTP or magic-link email. Target membership, existing-method checks, email lookup, and creation all use the profile tenant. Existing matching methods are skipped; methods belonging to other accounts are errors.

--concurrency controls rows per batch (default 10). JSONL results are flushed after each batch to a new private file, by default in a unique run directory. Use --results <new-file> for an explicit filename or --output-dir <directory> to choose the parent of the default run directory. The source CSV is preserved. Per-row failures do not stop later rows; malformed CSV or file errors stop the run. Results retain primary and recipe IDs, including newly created recipe IDs when linking fails, for reconciliation. These multi-step operations are not atomic.

The existing rownd-nodejs add-passwordless-methods command remains compatible with its original flags/environment credentials and public tenant. It delegates to this package's shared implementation.

Exit codes: 0 completed (findings may still require attention), 2 partial lookup failures or passwordless row errors, 1 command/file error.

Development

npm run build --workspace @supertokens-plugins/rownd-support
npm run typecheck --workspace @supertokens-plugins/rownd-support
npm run test --workspace @supertokens-plugins/rownd-support

Tests use temporary stores and fake clients; they do not access real credentials or mutate remote services.