
Security News
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.
appwrite-ctl
Advanced tools
A Node.js (ESM) package to manage Appwrite infrastructure via Version Snapshots. Uses the Appwrite CLI for schema pull/push operations and the Appwrite SDK for data migration scripts.
appwrite.config.json snapshots alongside your code.appwrite-cli pull/push for reliable schema synchronization.up and down) using the Node.js SDK.system.migrations).available before running data scripts.npm install -g appwrite-ctl
# or
npm install --save-dev appwrite-ctl
npm install github:bfbechlin/appwrite-ctl
npm install -g appwrite-cli). The tool configures the CLI automatically using API key — no interactive login required.APPWRITE_ENDPOINT=https://cloud.appwrite.io/v1
APPWRITE_PROJECT_ID=your_project_id
APPWRITE_API_KEY=your_api_key
BACKUP_COMMAND="docker exec appwrite-mariadb mysqldump ..." # Optional
The tool uses a clear separation of concerns:
| Operation | Tool | Why |
|---|---|---|
| Schema snapshots (pull/push) | Appwrite CLI | Has full serialization/deserialization of schemas via appwrite.config.json |
| Data migrations (up/down) | Appwrite SDK | Provides programmatic access to databases, documents, etc. |
| Migration tracking | Appwrite SDK | Creates/reads documents in the system.migrations collection |
# Default (uses .env)
npx appwrite-ctl migrations run
# Custom environment file
npx appwrite-ctl migrations run --env .env.prod
npx appwrite-ctl init
Creates:
appwrite/migration/ directoryappwrite/migration/config.json configuration filenpx appwrite-ctl migrations setup
npx appwrite-ctl migrations create
This command:
appwrite/migration/vN/ (auto-increments version).index.ts file with a boilerplate migration script.appwrite.config.json from the project root (or pulls from Appwrite via CLI if no local snapshot exists).Folder Structure:
/appwrite
schema.md <-- Generated by `docs` command
/migration
config.json
/v1
index.ts <-- Migration logic (SDK)
appwrite.config.json <-- Schema snapshot (CLI format)
schema.md <-- Auto-generated on create/update
/v2
index.ts
appwrite.config.json
schema.md
import { Migration } from 'appwrite-ctl';
const migration: Migration = {
id: 'uuid-generated-id',
description: 'Update finance schema',
requiresBackup: true,
up: async ({ client, databases, log }) => {
log('Seeding initial data...');
await databases.createDocument('db', 'users', 'unique()', {
name: 'Admin',
role: 'admin',
});
},
down: async ({ client, databases, log }) => {
// Logic to revert changes
},
};
export default migration;
After making schema changes in the Appwrite console, update a migration version's snapshot:
npx appwrite-ctl migrations update v1
This pulls the current state from Appwrite via CLI and saves it as the version's appwrite.config.json.
npx appwrite-ctl migrations run
The runner performs these steps for each pending version:
BACKUP_COMMAND if requiresBackup is true.appwrite.config.json via CLI (settings, tables, buckets, teams, topics).available (via SDK).up function defined in index.ts (via SDK).npx appwrite-ctl migrations status
# Generate from latest version → appwrite/schema.md
npx appwrite-ctl migrations docs
# Generate from a specific version
npx appwrite-ctl migrations docs v1
Generates a Markdown file with:
Note: Schema docs are also auto-generated inside the version folder (
vN/schema.md) when runningmigrations createormigrations update.
appwrite/migration/config.json){
"collection": "migrations",
"database": "system"
}
npm install -g appwrite-cliAPPWRITE_ENDPOINT, APPWRITE_PROJECT_ID, APPWRITE_API_KEYappwrite client --key — no login required.Required API Key Scopes:
collections.read, collections.writedocuments.read, documents.writeattributes.read, attributes.writeindexes.read, indexes.write| Command | Description |
|---|---|
init | Initialize the project folder structure and config. |
migrations setup | Create the system database and migrations collection. |
migrations create | Create a new migration version pulling the latest snapshot from Appwrite via CLI. |
migrations update <version> | Update a version's snapshot by pulling from Appwrite via CLI. |
migrations run | Execute all pending migrations in order. |
migrations status | List applied and pending migrations. |
migrations docs | Pull current schema state from Appwrite and generate documentation with ER diagrams. |
📌 schema.md — The Source of Truth
The most important file for understanding the application's data model is:
appwrite/schema.md
This is an auto-generated Markdown file that documents the current state of every database, collection, attribute, relationship, index, and storage bucket in the Appwrite project. It is generated from the latest appwrite.config.json snapshot via the migrations docs command.
When you need to understand the data model — always read appwrite/schema.md first.
It contains:
oneToMany, manyToOne, etc.), related collection, on-delete behavior, and two-way configuration.This project uses appwrite-ctl to manage schema migrations. The available commands are:
| Command | Description |
|---|---|
appwrite-ctl migrations create | Create a new migration version pulling the latest snapshot from Appwrite via CLI. |
appwrite-ctl migrations update <version> | Pull the current Appwrite state and update a version's snapshot. |
appwrite-ctl migrations run | Execute all pending migrations in order (push schema → poll attributes → run script). |
appwrite-ctl migrations status | List applied and pending migrations. |
appwrite-ctl migrations docs | Pull current schema state from Appwrite and generate/regenerate schema.md. |
Each migration version lives in appwrite/migration/vN/ and contains:
appwrite.config.json — the schema snapshot (Appwrite CLI format).index.ts — the migration script with up (and optional down) functions.schema.md — auto-generated docs for that version's snapshot.When a change to the data model is needed (e.g. adding a collection, modifying attributes, creating indexes), follow these steps:
Create a new migration version:
npx appwrite-ctl migrations create
This creates appwrite/migration/vN/ and automatically pulls the current schema snapshot from Appwrite into appwrite.config.json via the CLI.
Edit the snapshot (appwrite.config.json) inside the new version folder. Apply the desired schema changes directly to this JSON file — add/remove/modify collections, attributes, indexes, relationships, or buckets.
Write the migration script in appwrite/migration/vN/index.ts if data manipulation is needed (e.g. seeding data, transforming existing documents). If the change is schema-only, the default empty up function is sufficient.
Regenerate the schema docs:
npx appwrite-ctl migrations docs
This updates both appwrite/migration/vN/schema.md and the root appwrite/schema.md.
Verify the updated appwrite/schema.md to confirm the changes are correct.
⚠️ Never edit
schema.mdfiles manually — they are auto-generated. Always modify theappwrite.config.jsonsnapshot and runmigrations docsto regenerate.
FAQs
Appwrite infrastructure as code and migration CLI tool.
The npm package appwrite-ctl receives a total of 0 weekly downloads. As such, appwrite-ctl popularity was classified as not popular.
We found that appwrite-ctl demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.