Visions of Kirk
Sign in

Production account setup

Admin Registration

This is the browser-facing checklist for creating Kirk's Admin account on the live Vercel app alias. It explains what Kirk does in the browser, what the workspace does afterward, and why sign-up alone never grants Admin access.

Open sign-upVerify account

Current blocker

Vercel is using live-mode Clerk keys, but Admin promotion still waits for the workspace live-mode Clerk secret key, browser sign-up, email verification, and the dry-run/apply seed commands.

Run npm run status:admin-registration first, add the live-mode Clerk secret key to /Users/kl2/Documents/VisionsOfKirk/.env.local.private, sign up at https://staging.visionsofkirk.com/sign-up, verify the Admin email, activate Admin with npm run seed:admin -- --email=<verified-email> --dry-run followed by --apply, and finish with npm run verify:production-admin-cms -- --cookie-file=/private/path/admin-cookie.txt.

Live app

https://staging.visionsofkirk.com

Admin state

Admin not active yet

Clerk mode

production

Service status

Configured

How Admin Is Known

Sign-up creates a normal Clerk visitor account first.
The account becomes Admin only after that exact verified Clerk user is promoted from the workspace.
The seed command writes Clerk private metadata role=admin and vokRole=admin.
When Supabase service credentials are configured, the same seed mirrors Admin into site_user_profiles.role.
The top navigation shows Insights and CMS only when /api/account/access returns isAdmin=true.
Do not store an Admin password in env. VOK_ADMIN_EMAILS is only an exact-email fallback.

Workspace Commands

cd /Users/kl2/Documents/VisionsOfKirk/site
npm run status:admin-registration
npm run status:admin-registration -- --email=<verified-email>
npm run seed:admin -- --email=<verified-email> --dry-run
npm run seed:admin -- --email=<verified-email> --apply

The status commands are read-only. The dry run must identify the correct verified Clerk user before the apply command writes Admin metadata.

Pre-DNS Activation Sequence

  1. Step 1 / Workspace

    Snapshot current browser state

    Confirm the public Vercel app alias, auth UI, database-backed CMS evidence, and current blockers before changing credentials.

    npm run verify:production-smoke && npm run verify:production-auth-ui && npm run sync:live-access

  2. Step 2 / Workspace/Vercel

    Configure R2 CMS upload storage

    Add Cloudflare R2 CMS upload values to the private env, mirror the same key names into Vercel Production, and keep values out of generated docs.

    npm run verify:r2-cms-upload-storage -- --probe

  3. Step 3 / Workspace/Vercel

    Rotate Clerk to live mode

    Vercel Production is already using live-mode Clerk keys; keep staging verified and rerun the production smoke/auth UI checks after any Clerk or deploy change.

    npm run verify:production-smoke && npm run verify:production-auth-ui && npm run sync:production-readiness

  4. Step 4 / Kirk

    Create verified Admin account

    Sign up in the browser on the staging URL with the exact Admin email and complete Clerk email verification.

    npm run status:admin-registration -- --email=<verified-email>

  5. Step 5 / Workspace

    Promote verified user to Admin

    Dry-run the exact verified email, then apply Clerk private metadata and Supabase profile mirror only after the dry run identifies the correct live user.

    npm run seed:admin -- --email=<verified-email> --dry-run && npm run seed:admin -- --email=<verified-email> --apply

  6. Step 6 / Workspace

    Verify authenticated CMS browser path

    Use a private signed-in Admin cookie file outside the repo to prove live account access and database-backed project-template reads.

    npm run verify:production-admin-cms -- --cookie-file=/private/path/admin-cookie.txt

  7. Step 7 / Workspace

    Refresh launch handoffs

    Regenerate production readiness, live access, launch approval, launch decisions, and launch readiness before any DNS decision.

    npm run sync:production-readiness && npm run sync:live-access && npm run check:launch -- --write

This sequence updates only the Vercel app alias and production service configuration; it does not switch GoDaddy DNS, approve final art, expose credential values, or write CMS records during verification.