feat(webapp): seed a local CLI personal access token

The db seed now mints and prints a PAT for the seeded local@trigger.dev user
so the CLI can authenticate against a local instance via TRIGGER_ACCESS_TOKEN
without the browser magic-link flow (needed for headless/agent onboarding).
Idempotent: re-seeding decrypts and reprints the existing local-dev-cli token.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TGWWyG9GcRa7f5zqBccRyd

Author: 1stvamp

.server-changes/seed-local-cli-pat.md

@@ -0,0 +1,10 @@
+---
+area: webapp
+type: improvement
+---
+
+The db seed now mints (and prints) a Personal Access Token for the seeded
+`local@trigger.dev` user. This lets the CLI authenticate against a local
+instance via `TRIGGER_ACCESS_TOKEN` without the browser magic-link flow, which
+matters for headless/agent onboarding. Idempotent: re-seeding decrypts and
+reprints the existing `local-dev-cli` token instead of creating new ones.

apps/webapp/seed.mts

@@ -3,6 +3,9 @@ import { createOrganization } from "./app/models/organization.server";
 import { createProject } from "./app/models/project.server";
 import type { Organization, Prisma, User } from "@trigger.dev/database";
 import { AuthenticationMethod } from "@trigger.dev/database";
+import { createPersonalAccessToken } from "./app/services/personalAccessToken.server";
+import { decryptToken } from "./app/utils/tokens.server";
+import { env } from "./app/env.server";
 
 async function seed() {
   console.log("🌱 Starting seed...");
@@ -81,16 +84,40 @@ async function seed() {
   await createBatchLimitOrgs(user);
   await ensureDefaultWorkerGroup();
 
+  const localPat = await ensureLocalCliPat(user);
+
   console.log("\n🎉 Seed complete!\n");
   console.log("Summary:");
   console.log(`User: ${user.email}`);
   console.log(`Organization: ${organization.title} (${organization.slug})`);
   console.log(`Projects: ${referenceProjects.map((p) => p.name).join(", ")}`);
+  console.log(`\n🔑 CLI access token for ${user.email} (name: ${localPat.name}):`);
+  console.log(`  ${localPat.token}`);
+  console.log(`  Point the CLI at this local instance without a browser login:`);
+  console.log(`    export TRIGGER_ACCESS_TOKEN=${localPat.token}`);
+  console.log(`    export TRIGGER_API_URL=http://localhost:3030`);
   console.log("\n⚠️  Note: in your triggerdotdev/references clone, set TRIGGER_PROJECT_REF in:");
   console.log(`  - projects/d3-chat/.env: TRIGGER_PROJECT_REF=proj_cdmymsrobxmcgjqzhdkq`);
   console.log(`  - projects/realtime-streams/.env: TRIGGER_PROJECT_REF=proj_klxlzjnzxmbgiwuuwhvb`);
 }
 
+// Mints (or reuses) a Personal Access Token for the seeded local user so the
+// CLI can authenticate against this instance without the browser magic-link
+// flow. Idempotent: on re-seed we decrypt and reprint the existing token
+// rather than piling up new ones.
+async function ensureLocalCliPat(user: User) {
+  const name = "local-dev-cli";
+  const existing = await prisma.personalAccessToken.findFirst({
+    where: { userId: user.id, name, revokedAt: null },
+  });
+  if (existing) {
+    const enc = existing.encryptedToken as { nonce: string; ciphertext: string; tag: string };
+    return { name, token: decryptToken(enc.nonce, enc.ciphertext, enc.tag, env.ENCRYPTION_KEY) };
+  }
+  const created = await createPersonalAccessToken({ name, userId: user.id });
+  return { name, token: created.token };
+}
+
 async function createBatchLimitOrgs(user: User) {
   const org1 = await findOrCreateOrganization("batch-limit-org-1", user, {
     batchQueueConcurrencyConfig: { processingConcurrency: 1 },