@geekmidas/cli 10.0.0-alpha.116 → 10.0.0-alpha.118

package/dist/index.mjs

@@ -3,27 +3,28 @@ import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mj
 import { n as isGkmError, t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { r as DEFAULT_TIMEOUT_MS, t as CommandFailed } from "./run-BJLIerMM.mjs";
 import { a as getDokployCredentials, d as removeGoDaddyCredentials, f as storeDokployCredentials, i as getCredentialsPath, l as readCredentials, m as storeHostingerToken, o as getDokployRegistryId, p as storeGoDaddyToken, s as getDokployToken, u as removeDokployCredentials } from "./credentials-B5N5yKk6.mjs";
-import { C as dockerCompose, S as sshTarget, _ as parseDigests, b as dockerHost, c as edgeRef, f as derivedCredentials, h as EDGE_PROJECT, i as ComposePushNeedsBuild, l as removeEdgeRoutes, m as stackPlan, o as stackOverrideFile, p as stackDir, r as ComposePinNeedsPull, t as composeTarget, u as composeProject, v as pinnedRef, w as projectNetwork, y as composeServer } from "./compose-BEiJWrB7.mjs";
+import { C as dockerCompose, S as sshTarget, _ as parseDigests, b as dockerHost, c as edgeRef, f as derivedCredentials, h as EDGE_PROJECT, i as ComposePushNeedsBuild, l as removeEdgeRoutes, m as stackPlan, o as stackOverrideFile, p as stackDir, r as ComposePinNeedsPull, t as composeTarget, u as composeProject, v as pinnedRef, w as projectNetwork, y as composeServer } from "./compose-qLTNYJAY.mjs";
 import { A as InvalidStages, F as stageProblems, P as deployedProblems, R as stageSampleRate, a as allConstructGlobs, d as getAppGkmConfig, j as TEST_STAGE, u as getAppBuildOrder } from "./workspace-D1QbNd55.mjs";
-import { b as runTime, d as BACKUPS_URL_KEY, f as RUNNER_PATH, g as backupDatabases, u as BACKUPS_SERVICE, v as backupFile, x as stageBackups, y as backupsPrefix } from "./dns-CsApfzLc.mjs";
-import { $t as isUnder, An as appTelemetry, At as isPortAvailable, Bn as fakeKey, Bt as maskPassword, Ct as cacheBackendFor, Dn as TELEMETRY_CONTAINER, Dt as createCredentialsPreload, G as CronGenerator, Gn as LOCAL_LOGS_EMAIL, H as workerBundleName, Hn as portsOf, Ht as toEmbeddableSecrets, It as secretsStoreFor, L as dockerCommand, Mn as scopeTelemetryEnv, Mt as loadPortState, Nn as surfaceClientTraced, Nt as loadSecretsForApp, Ot as createEntryWrapper, Pn as telemetryOf, Pt as prepareEntryCredentials, Q as assertDevServicesFlag, Tt as providerOf, U as workerEntryDir, Ut as withCustomSecret, V as WorkerGenerator, W as QueueGenerator, Wn as primaryPortKey, Xt as imageBuildCredentials, Zt as isImageBuild, a as dnsResources, an as postgresDatabaseNames, bt as pgClient, c as describeActor, dt as constructGlobs, en as workerUnits, fn as readLocalCredentials, ft as derivedContainers, gn as projectKey, gt as forgetState, ht as LOCAL_CA_PATH, jt as loadEnvFiles, kt as findAvailablePort, lt as FAKE_ENV, mn as getKeyPath, pn as FileSecretsStore, pt as reconcileWorkspace, sn as quoteIdentifier, ut as backendsOf$1, wt as eventsBackendFor, xt as CLUSTER_DATABASE, zn as describeServices } from "./seeds-CRkKeyW0.mjs";
+import { b as runTime, d as BACKUPS_URL_KEY, f as RUNNER_PATH, g as backupDatabases, u as BACKUPS_SERVICE, v as backupFile, x as stageBackups, y as backupsPrefix } from "./dns-DGq4xkJT.mjs";
+import { o as email } from "./schemas-BCwKKA42.mjs";
+import { $t as isUnder, An as appTelemetry, At as isPortAvailable, Bn as fakeKey, Bt as maskPassword, Ct as cacheBackendFor, Dn as TELEMETRY_CONTAINER, Dt as createCredentialsPreload, G as CronGenerator, Gn as LOCAL_LOGS_EMAIL, H as workerBundleName, Hn as portsOf, Ht as toEmbeddableSecrets, It as secretsStoreFor, L as dockerCommand, Mn as scopeTelemetryEnv, Mt as loadPortState, Nn as surfaceClientTraced, Nt as loadSecretsForApp, Ot as createEntryWrapper, Pn as telemetryOf, Pt as prepareEntryCredentials, Q as assertDevServicesFlag, Tt as providerOf, U as workerEntryDir, Ut as withCustomSecret, V as WorkerGenerator, W as QueueGenerator, Wn as primaryPortKey, Xt as imageBuildCredentials, Zt as isImageBuild, a as dnsResources, an as postgresDatabaseNames, bt as pgClient, c as describeActor, dt as constructGlobs, en as workerUnits, fn as readLocalCredentials, ft as derivedContainers, gn as projectKey, gt as forgetState, ht as LOCAL_CA_PATH, jt as loadEnvFiles, kt as findAvailablePort, lt as FAKE_ENV, mn as getKeyPath, pn as FileSecretsStore, pt as reconcileWorkspace, sn as quoteIdentifier, ut as backendsOf$1, wt as eventsBackendFor, xt as CLUSTER_DATABASE, zn as describeServices } from "./seeds-CYzoBDg2.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { l as isCacheBackend, n as assertTestCredentials, t as SubscriberGenerator } from "./SubscriberGenerator-DHnIYwUU.mjs";
 import { n as deployIdentity } from "./identity-CBXr4wNi.mjs";
 import { a as startTelemetryCode, c as parseTelemetryFlag, i as routeTelemetry, n as runtimeFor, o as telemetryFor, r as mountRequestSpansCode, s as writeTelemetryModule, t as EndpointGenerator } from "./EndpointGenerator-CvLX8bpx.mjs";
 import { d as ConstructGenerator, i as discover, r as consumedBy, u as withOwningTsconfigJsx } from "./discover-Ca8U75dl.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { d as awsEndpoint, f as awsProvisioningCredentials, t as deploy$1, u as awsClientConfig } from "./deploy-Cyx5fSb7.mjs";
+import { d as awsEndpoint, f as awsProvisioningCredentials, t as deploy$1, u as awsClientConfig } from "./deploy-_g-2dX38.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
 import { a as describeHolder, c as withAppPorts, i as assignAppPorts, o as describeMove, r as appTag, s as holderOf, t as APP_TAG_ENV } from "./appPorts-BoXMwolc.mjs";
-import { n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-D11JHxrD.mjs";
+import { a as opensKmsKeys, n as driversFor, r as eventsBackendsIn, t as cacheBackendsIn } from "./drivers-3klmg9Sk.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
 import { t as LocalSandbox } from "./local-BwC2v2Y8.mjs";
-import { S as createStateStore, k as keyFingerprint, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-CakkKKqQ.mjs";
+import { S as createStateStore, k as keyFingerprint, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-CRJHtBaK.mjs";
 import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-Cf5Pf8VE.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-C1rUUvBr.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-DIAY7j1O.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
-import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-CIt5SOtg.mjs";
+import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, t as TEST_READY_ENV } from "./ready-4hEoQ_cr.mjs";
 import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { Command, Option } from "commander";
@@ -51,7 +52,7 @@ import crypto from "crypto";
 import { Function } from "@geekmidas/constructs/functions";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.116";
+var version = "10.0.0-alpha.118";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -134,7 +135,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await import("./sniffer-CakkKKqQ.mjs").then((n) => n.c);
+	const { DokployApi } = await import("./sniffer-CRJHtBaK.mjs").then((n) => n.c);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -2174,7 +2175,7 @@ async function execCommand(commandArgs, options = {}, stageDeps) {
 	const cwd = options.cwd ?? process.cwd();
 	if (!commandArgs[0]) throw new NoCommandSpecified();
 	if (options.stage && !isImageBuild()) {
-		const { execOnStage } = await import("./stage-Mp6qQIoD.mjs").then((n) => n.n);
+		const { execOnStage } = await import("./stage-CIo8s2WT.mjs").then((n) => n.n);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { workspace } = await loadWorkspaceConfig(cwd);
 		if (options.stage !== workspace.stages.local) {
@@ -2747,9 +2748,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-X0Y7fz3N.mjs");
+		const { prepareDevDatabases } = await import("./migrate-WyWhSivN.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-X0Y7fz3N.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-WyWhSivN.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3825,7 +3826,7 @@ async function buildApp(input) {
 				...production,
 				...telemetry ? { telemetry } : {}
 			});
-			const { bundleServer } = await import("./bundler-CgcwaVI0.mjs");
+			const { bundleServer } = await import("./bundler-Ciim6amq.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3900,7 +3901,8 @@ async function buildApp(input) {
 		appRoot,
 		reach,
 		cacheBackend,
-		eventsBackend
+		eventsBackend,
+		target
 	}));
 	if (target === "server") buildContext.telemetry = telemetryFor({
 		node: processTelemetry(declared, derived.surface?.id, servesOnly ? [] : hosted.map((unit) => unit.id)),
@@ -3933,7 +3935,8 @@ async function buildApp(input) {
 				appRoot,
 				reach: reachedBy(declared, [workerId], work),
 				cacheBackend,
-				eventsBackend
+				eventsBackend,
+				target
 			})
 		}),
 		telemetry: (workerId) => telemetryFor({
@@ -3983,7 +3986,8 @@ function processTelemetry(declared, surfaceId, workers) {
 * The drivers a process's entry registers, from the declarations it reaches:
 * the cache's — the declaration for one that named its database, the deploy
 * target's default for one that named nowhere — and the broker's, only when
-* it reaches a topic or a queue (see `eventsBackendsIn`).
+* it reaches a topic or a queue (see `eventsBackendsIn`) — and the KMS
+* cipher, only built for AWS and only when it reaches an `Encryption`.
 */
 function runtimeDrivers(options) {
 	const eventsBackends = eventsBackendsIn(options.reach, options.eventsBackend);
@@ -3991,7 +3995,8 @@ function runtimeDrivers(options) {
 		storageDrivers: driversFor({
 			appRoot: options.appRoot,
 			cache: cacheBackendsIn(options.reach, options.cacheBackend),
-			events: eventsBackends
+			events: eventsBackends,
+			kms: opensKmsKeys(options.reach, options.target)
 		}),
 		eventsBackends
 	};
@@ -4024,7 +4029,7 @@ async function buildWorkers(input) {
 		});
 		logger$4.log(`Generated worker ${worker.id}: ${crons.length} crons, ${queues.length} queues, ${subscribers.length} subscribers`);
 		if (!input.bundle) continue;
-		const { bundleServer } = await import("./bundler-CgcwaVI0.mjs");
+		const { bundleServer } = await import("./bundler-Ciim6amq.mjs");
 		const outfile = workerBundleName(worker.id);
 		await bundleServer({
 			entryPoint,
@@ -4110,7 +4115,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-CgcwaVI0.mjs");
+			const { bundleServer } = await import("./bundler-Ciim6amq.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -5944,25 +5949,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.116",
-	"@geekmidas/auth": "~10.0.0-alpha.116",
-	"@geekmidas/cache": "~10.0.0-alpha.116",
-	"@geekmidas/client": "~10.0.0-alpha.116",
-	"@geekmidas/cloud": "~10.0.0-alpha.116",
-	"@geekmidas/constructs": "~10.0.0-alpha.116",
-	"@geekmidas/db": "~10.0.0-alpha.116",
-	"@geekmidas/emailkit": "~10.0.0-alpha.116",
-	"@geekmidas/envkit": "~10.0.0-alpha.116",
-	"@geekmidas/errors": "~10.0.0-alpha.116",
-	"@geekmidas/events": "~10.0.0-alpha.116",
-	"@geekmidas/logger": "~10.0.0-alpha.116",
-	"@geekmidas/manifest": "~10.0.0-alpha.116",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.116",
-	"@geekmidas/schema": "~10.0.0-alpha.116",
-	"@geekmidas/services": "~10.0.0-alpha.116",
-	"@geekmidas/storage": "~10.0.0-alpha.116",
-	"@geekmidas/telescope": "~10.0.0-alpha.116",
-	"@geekmidas/testkit": "~10.0.0-alpha.116",
+	"@geekmidas/audit": "~10.0.0-alpha.118",
+	"@geekmidas/auth": "~10.0.0-alpha.118",
+	"@geekmidas/cache": "~10.0.0-alpha.118",
+	"@geekmidas/client": "~10.0.0-alpha.118",
+	"@geekmidas/cloud": "~10.0.0-alpha.118",
+	"@geekmidas/constructs": "~10.0.0-alpha.118",
+	"@geekmidas/db": "~10.0.0-alpha.118",
+	"@geekmidas/emailkit": "~10.0.0-alpha.118",
+	"@geekmidas/envkit": "~10.0.0-alpha.118",
+	"@geekmidas/errors": "~10.0.0-alpha.118",
+	"@geekmidas/events": "~10.0.0-alpha.118",
+	"@geekmidas/logger": "~10.0.0-alpha.118",
+	"@geekmidas/manifest": "~10.0.0-alpha.118",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.118",
+	"@geekmidas/schema": "~10.0.0-alpha.118",
+	"@geekmidas/services": "~10.0.0-alpha.118",
+	"@geekmidas/storage": "~10.0.0-alpha.118",
+	"@geekmidas/telescope": "~10.0.0-alpha.118",
+	"@geekmidas/testkit": "~10.0.0-alpha.118",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -7155,7 +7160,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "8441f7be92366877d6802babf8ee655bcdde2489", version = cliVersion()) {
+function stagesActionUses(commit = "01a325bb2dfb75faf9c255cb3f1d9288c6c42c1e", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -9066,6 +9071,10 @@ interface SignedIn {
  * The \`users\` row for whoever signed in, made the first time they call the
  * API and given the Member role. The auth server owns who someone is; this
  * row is what the application's own tables refer to.
+ *
+ * Someone the seeds named before they signed in — an admin, in
+ * \`03_admins.ts\` — already has a row with their email and no auth user: their
+ * first sign-in claims it, roles and all.
  */
 export async function memberFor(db: Kysely<Database>, user: SignedIn) {
   const found = await db
@@ -9075,13 +9084,23 @@ export async function memberFor(db: Kysely<Database>, user: SignedIn) {
     .executeTakeFirst();
   if (found) return found;
 
-  const member = await db
-    .insertInto('users')
-    .values({ authUserId: user.id, email: user.email, name: user.name })
-    // Two first requests at once: the second finds the first's row.
-    .onConflict((oc) => oc.column('authUserId').doUpdateSet({ email: user.email }))
-    .returningAll()
-    .executeTakeFirstOrThrow();
+  const member =
+    (await db
+      .updateTable('users')
+      .set({ authUserId: user.id, ...(user.name ? { name: user.name } : {}) })
+      .where('email', '=', user.email)
+      .where('authUserId', 'is', null)
+      .returningAll()
+      .executeTakeFirst()) ??
+    (await db
+      .insertInto('users')
+      .values({ authUserId: user.id, email: user.email, name: user.name })
+      // Two first requests at once: the second finds the first's row.
+      .onConflict((oc) =>
+        oc.column('authUserId').doUpdateSet({ email: user.email }),
+      )
+      .returningAll()
+      .executeTakeFirstOrThrow());
 
   const memberRole = await db
     .selectFrom('roles')
@@ -9244,65 +9263,6 @@ export const AdminUsersSchema = z
 	}];
 }
 /**
-* `scripts/grant-admin.ts`: the first Super admin. Nobody can grant a role
-* before someone has one, so the first is granted from a terminal.
-*/
-function grantAdminScript(options) {
-	return {
-		path: "scripts/grant-admin.ts",
-		content: `/**
- * Make someone a Super admin — the first one, before the admin panel can.
- *
- *   gkm exec -- tsx scripts/grant-admin.ts you@example.com
- *
- * They need to have signed in once (the web site, the admin panel or the app),
- * which is what makes their \`users\` row.
- */
-import { database } from '@${options.name}/constructs/database.ts';
-import { SYSTEM_ROLES } from '@${options.name}/models/access';
-import { EnvironmentParser } from '@geekmidas/envkit';
-
-const email = process.argv[2]?.trim().toLowerCase();
-if (!email) {
-  console.error('Usage: gkm exec -- tsx scripts/grant-admin.ts <email>');
-  process.exit(1);
-}
-
-const db = await database.service.register({
-  envParser: new EnvironmentParser({ ...process.env }),
-} as never);
-
-try {
-  const user = await db
-    .selectFrom('users')
-    .select('id')
-    .where('email', '=', email)
-    .executeTakeFirst();
-  if (!user) {
-    console.error(\`No one has signed in as \${email} yet. Sign in once, then run this again.\`);
-    process.exit(1);
-  }
-
-  const role = await db
-    .selectFrom('roles')
-    .select('id')
-    .where('name', '=', SYSTEM_ROLES.SuperAdmin.name)
-    .executeTakeFirstOrThrow();
-
-  await db
-    .insertInto('userRoles')
-    .values({ userId: user.id, roleId: role.id })
-    .onConflict((oc) => oc.columns(['userId', 'roleId']).doNothing())
-    .execute();
-
-  console.log(\`\${email} is a \${SYSTEM_ROLES.SuperAdmin.name}.\`);
-} finally {
-  await db.destroy();
-}
-`
-	};
-}
-/**
 * The API's feature tests: signing in by email end to end, and the admin
 * panel's gate. Each runs in a transaction, against the real auth server and
 * the real mail catcher.
@@ -9365,6 +9325,39 @@ describe('the admin panel', () => {
 
     expect(users).toContainEqual(expect.objectContaining({ id: me.id }));
   });
+
+  it('lets in an admin the seeds named, on their first sign-in', async ({
+    browser,
+    db,
+    faker,
+  }) => {
+    // What \`03_admins.ts\` writes: a row with no auth user yet, and the role.
+    const email = faker.internet.email();
+    const app = await db.get('database');
+    const admin = await app
+      .insertInto('users')
+      .values({ email, name: 'Admin' })
+      .returning('id')
+      .executeTakeFirstOrThrow();
+    const superAdmin = await app
+      .selectFrom('roles')
+      .select('id')
+      .where('name', '=', SYSTEM_ROLES.SuperAdmin.name)
+      .executeTakeFirstOrThrow();
+    await app
+      .insertInto('userRoles')
+      .values({ userId: admin.id, roleId: superAdmin.id })
+      .execute();
+
+    await browser.signIn(email);
+
+    expect(await browser.api.get('/profiles/me')).toMatchObject({
+      id: admin.id,
+      email,
+    });
+    const { users } = await browser.api.get('/admin/users');
+    expect(users).toContainEqual(expect.objectContaining({ id: admin.id }));
+  });
 });
 `;
 }
@@ -9663,9 +9656,11 @@ export interface Database {
     id: Generated<string>;
     /**
      * The Better Auth user this person signs in as. The auth schema is its
-     * own, so this is a plain column, not a foreign key into it.
+     * own, so this is a plain column, not a foreign key into it. Null for
+     * someone the seeds named who has not signed in yet: their first sign-in
+     * claims the row by email.
      */
-    authUserId: string;
+    authUserId: string | null;
     name: string;
     email: string;
     createdAt: Generated<Date>;
@@ -9952,8 +9947,9 @@ export async function up(db: Kysely<unknown>): Promise<void> {
       col.primaryKey().defaultTo(db.fn('gen_random_uuid')),
     )
     // The Better Auth user this person signs in as. A plain column: the auth
-    // schema is its own, and the id's format is Better Auth's to choose.
-    .addColumn('auth_user_id', 'text', (col) => col.notNull().unique())
+    // schema is its own, and the id's format is Better Auth's to choose. Null
+    // until someone the seeds named (an admin) first signs in.
+    .addColumn('auth_user_id', 'text', (col) => col.unique())
     .addColumn('name', 'varchar(255)', (col) => col.notNull())
     .addColumn('email', 'varchar(255)', (col) => col.notNull().unique())
     .addColumn('created_at', 'timestamptz', (col) =>
@@ -10058,11 +10054,13 @@ export async function down(db: Kysely<unknown>): Promise<void> {
 * upserts, run after every migration, so a changed list is applied by running
 * them again.
 */
-function accessControlSeeds(name) {
+function accessControlSeeds(options) {
+	const { name } = options;
 	const folder = seedFolder(databaseFor().id);
-	return [{
-		path: `${folder}/01_permissions.ts`,
-		content: `import { PERMISSION_KEYS, PERMISSIONS } from '@${name}/models/access';
+	return [
+		{
+			path: `${folder}/01_permissions.ts`,
+			content: `import { PERMISSION_KEYS, PERMISSIONS } from '@${name}/models/access';
 import type { Kysely } from 'kysely';
 
 type Tables = { permissions: { key: string; description: string } };
@@ -10093,9 +10091,10 @@ export async function seed(db: Kysely<unknown>): Promise<void> {
     .execute();
 }
 `
-	}, {
-		path: `${folder}/02_system_roles.ts`,
-		content: `import { SYSTEM_ROLES } from '@${name}/models/access';
+		},
+		{
+			path: `${folder}/02_system_roles.ts`,
+			content: `import { SYSTEM_ROLES } from '@${name}/models/access';
 import type { Kysely } from 'kysely';
 
 type Tables = {
@@ -10142,7 +10141,76 @@ export async function seed(db: Kysely<unknown>): Promise<void> {
   }
 }
 `
-	}];
+		},
+		adminsSeed(folder, options)
+	];
+}
+/**
+* The Super admins, by email — the first one asked for by `gkm init`. Each
+* gets a `users` row before they have signed in, which their first sign-in
+* claims (`memberFor`), so the admin panel lets them in straight away.
+*/
+function adminsSeed(folder, options) {
+	const admins = options.adminEmail ? `[\n  '${options.adminEmail}',\n]` : "[\n  // 'you@example.com',\n]";
+	return {
+		path: `${folder}/03_admins.ts`,
+		content: `import { SYSTEM_ROLES } from '@${options.name}/models/access';
+import type { Kysely } from 'kysely';
+
+/**
+ * Who is a Super admin, by the address they sign in with. Add someone here and
+ * run the seeds (\`gkm dev --seed\`, or the next deploy); taking them off the
+ * list does not take the role away — the admin panel does that.
+ */
+const ADMINS: string[] = ${admins};
+
+type Tables = {
+  users: { id?: string; email: string; name: string };
+  roles: { id: string; name: string; is_system: boolean };
+  user_roles: { user_id: string; role_id: string };
+};
+
+/**
+ * A \`users\` row for each admin who has none — their first sign-in claims it —
+ * and the Member and Super admin roles. Runs after the system roles seed.
+ */
+export async function seed(db: Kysely<unknown>): Promise<void> {
+  // Better Auth stores addresses lowercased; so does every \`users\` row.
+  const emails = ADMINS.map((email) => email.trim().toLowerCase());
+  if (emails.length === 0) return;
+
+  const tables = db.withTables<Tables>();
+
+  await tables
+    .insertInto('users')
+    .values(emails.map((email) => ({ email, name: email.split('@')[0]! })))
+    .onConflict((oc) => oc.column('email').doNothing())
+    .execute();
+
+  const users = await tables
+    .selectFrom('users')
+    .select('id')
+    .where('email', 'in', emails)
+    .execute();
+  const roles = await tables
+    .selectFrom('roles')
+    .select('id')
+    .where('is_system', '=', true)
+    .where('name', 'in', [SYSTEM_ROLES.Member.name, SYSTEM_ROLES.SuperAdmin.name])
+    .execute();
+
+  await tables
+    .insertInto('user_roles')
+    .values(
+      users.flatMap((user) =>
+        roles.map((role) => ({ user_id: user.id!, role_id: role.id })),
+      ),
+    )
+    .onConflict((oc) => oc.columns(['user_id', 'role_id']).doNothing())
+    .execute();
+}
+`
+	};
 }
 //#endregion
 //#region src/init/generators/monorepo.ts
@@ -10659,8 +10727,7 @@ export const logger = createLogger();
 		},
 		workspaceUsersMigration(),
 		accessControlMigration(),
-		...accessControlSeeds(options.name),
-		grantAdminScript(options)
+		...accessControlSeeds(options)
 	];
 	if (uploads) {
 		const bucket = storageFor();
@@ -14870,6 +14937,27 @@ function isFullstackTemplate(name) {
 //#region src/init/index.ts
 /** `' staging, prod '` → `['staging', 'prod']`. */
 const stageList = (value) => value.split(",").map((name) => name.trim()).filter(Boolean);
+/** Whether `value` is an email address, as the API's models check one. */
+const isEmail = (value) => email().safeParse(value.trim()).success;
+/**
+* Who `git` says you are, offered as the first admin: the address you most
+* likely sign in with. Nothing when git has none.
+*/
+function gitEmail() {
+	try {
+		const email = execSync("git config user.email", {
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+		return isEmail(email) ? email.toLowerCase() : void 0;
+	} catch {
+		return;
+	}
+}
 /** `eu-west-1`, `us-gov-west-1`, `ap-southeast-2`. */
 const AWS_REGION = /^[a-z]{2}(-gov)?-[a-z]+-\d$/;
 /**
@@ -14881,6 +14969,7 @@ async function initCommand(projectName, options = {}) {
 	if (options.deploy && !deployTargetChoices.some((choice) => choice.value === options.deploy)) throw new UnknownDeployTarget(options.deploy, deployTargetChoices.map((c) => c.value));
 	if (options.web && !frontendFrameworkChoices.some((choice) => choice.value === options.web)) throw new UnknownWebFramework(options.web, frontendFrameworkChoices.map((c) => c.value));
 	if (options.region && !AWS_REGION.test(options.region)) throw new NotAnAwsRegion(options.region);
+	if (options.adminEmail && !isEmail(options.adminEmail)) throw new NotAnEmail(options.adminEmail);
 	if (options.stages || options.localStage || options.protectedStage) {
 		const deployed = stageList(options.stages ?? "");
 		const problems = [
@@ -15019,6 +15108,13 @@ async function initCommand(projectName, options = {}) {
 			name: "mobileApp",
 			message: "Include a mobile app? (Expo, with its sign-in and a site for App Store and Play Store reviewers)",
 			initial: true
+		},
+		{
+			type: (_prev, values) => !options.yes && !options.adminEmail && (options.template === "fullstack" || values.template === "fullstack") ? "text" : null,
+			name: "adminEmail",
+			message: "Admin email (the first Super admin of the admin panel):",
+			initial: gitEmail() ?? "",
+			validate: (value) => isEmail(value) || "An email address, like you@example.com"
 		}
 	], { onCancel });
 	const name = projectName || options.name || answers.name;
@@ -15053,6 +15149,7 @@ async function initCommand(projectName, options = {}) {
 	const deployTarget = options.deploy ?? (options.yes ? "none" : answers.deployTarget ?? "none");
 	const frontendFramework = isFullstack ? options.web ?? (options.yes ? "nextjs" : answers.frontendFramework ?? "nextjs") : void 0;
 	const mobileApp = isFullstack ? options.mobileApp ?? (options.yes ? true : answers.mobileApp ?? true) : void 0;
+	const adminEmail = isFullstack ? (options.adminEmail ?? (options.yes ? gitEmail() : answers.adminEmail))?.trim().toLowerCase() : void 0;
 	const templateOptions = {
 		name,
 		template,
@@ -15068,7 +15165,8 @@ async function initCommand(projectName, options = {}) {
 		...deployTarget === "sst" ? { region: options.region ?? (options.yes ? "eu-west-1" : answers.region?.trim()) } : {},
 		constructs,
 		frontendFramework,
-		...mobileApp !== void 0 ? { mobileApp } : {}
+		...mobileApp !== void 0 ? { mobileApp } : {},
+		...adminEmail ? { adminEmail } : {}
 	};
 	const targetDir = join(cwd, name);
 	const baseTemplate = getTemplate(templateOptions.template);
@@ -15307,6 +15405,14 @@ function defaultRegistry(name) {
 	return `ghcr.io/${(name ?? "my-org").toLowerCase()}`;
 }
 /** `--region` that is not shaped like one, e.g. `europe` for `eu-west-1`. */
+var NotAnEmail = class extends GkmError {
+	value;
+	constructor(value) {
+		super(`"${value}" is not an email address. Give --admin-email the address the first admin signs in with.`);
+		this.value = value;
+		this.name = "NotAnEmail";
+	}
+};
 var NotAnAwsRegion = class extends GkmError {
 	region;
 	constructor(region) {
@@ -16026,7 +16132,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-X0Y7fz3N.mjs");
+	const { migrateAndSeed } = await import("./migrate-WyWhSivN.mjs");
 	const { discover } = await import("./discover-Ca8U75dl.mjs").then((n) => n.a);
 	const sources = {};
 	const manifest = await discover({
@@ -16362,7 +16468,7 @@ const program = new Command();
 program.name("gkm").description("GeekMidas backend framework CLI").version(version).option("--cwd <path>", "Change working directory").option("--debug", "Enable debug mode (verbose errors with stack traces)").hook("preAction", () => {
 	if (program.opts().debug) enableDebug();
 });
-program.command("init").description("Scaffold a new project").argument("[name]", "Project name").option("--template <template>", "Project template (minimal, api, fullstack, serverless, worker)").option("--skip-install", "Skip dependency installation", false).option("-y, --yes", "Skip prompts, use defaults", false).option("--monorepo", "Setup as monorepo with packages/models", false).option("--api-path <path>", "API app path in monorepo (default: apps/api)").option("--pm <manager>", "Package manager (pnpm, npm, yarn, bun)").option("--deploy <target>", "Where it deploys (dokploy, compose, sst, none)").option("--region <region>", "AWS region for an SST deploy (e.g. eu-west-1)").option("--registry <registry>", "Container registry for a compose deploy (e.g. ghcr.io/acme)").option("--stages <names>", "Deployed stages, comma-separated (e.g. staging,prod)").option("--protected-stage <name>", "Which deployed stage is production").option("--local-stage <name>", "What gkm dev runs as (e.g. dev)").option("--web <framework>", "Fullstack: what the web site and admin panel use (nextjs, tanstack-start)").option("--mobile-app", "Fullstack: include the Expo app and its store-reviewer site").option("--no-mobile-app", "Fullstack: no mobile app").action(async (name, options) => {
+program.command("init").description("Scaffold a new project").argument("[name]", "Project name").option("--template <template>", "Project template (minimal, api, fullstack, serverless, worker)").option("--skip-install", "Skip dependency installation", false).option("-y, --yes", "Skip prompts, use defaults", false).option("--monorepo", "Setup as monorepo with packages/models", false).option("--api-path <path>", "API app path in monorepo (default: apps/api)").option("--pm <manager>", "Package manager (pnpm, npm, yarn, bun)").option("--deploy <target>", "Where it deploys (dokploy, compose, sst, none)").option("--region <region>", "AWS region for an SST deploy (e.g. eu-west-1)").option("--registry <registry>", "Container registry for a compose deploy (e.g. ghcr.io/acme)").option("--stages <names>", "Deployed stages, comma-separated (e.g. staging,prod)").option("--protected-stage <name>", "Which deployed stage is production").option("--local-stage <name>", "What gkm dev runs as (e.g. dev)").option("--web <framework>", "Fullstack: what the web site and admin panel use (nextjs, tanstack-start)").option("--mobile-app", "Fullstack: include the Expo app and its store-reviewer site").option("--no-mobile-app", "Fullstack: no mobile app").option("--admin-email <email>", "Fullstack: who the seeds make the first Super admin").action(async (name, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -16450,7 +16556,7 @@ program.command("eas:sync").description("Set up a mobile app's EAS project for a
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { easSync } = await import("./eas-CTfRmndW.mjs");
+		const { easSync } = await import("./eas-DJXhARYb.mjs");
 		await easSync(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16460,7 +16566,7 @@ program.command("publish").description("Ship a mobile app for a deployed stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { publish, PublishModeConflict } = await import("./publish-hhgraEhO.mjs");
+		const { publish, PublishModeConflict } = await import("./publish-BBG4zx8E.mjs");
 		if (options.build && options.update) throw new PublishModeConflict();
 		const { build, update, ...rest } = options;
 		await publish({
@@ -16476,7 +16582,7 @@ program.command("deploy:google-play").description("Let EAS Submit publish a mobi
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGooglePlay } = await import("./googlePlay-m1De-qIJ.mjs");
+		const { deployGooglePlay } = await import("./googlePlay-fw0VWly7.mjs");
 		await deployGooglePlay(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16498,7 +16604,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-X0Y7fz3N.mjs");
+		const { migrateCommand } = await import("./migrate-WyWhSivN.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16511,7 +16617,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-X0Y7fz3N.mjs");
+		const { seedCommand } = await import("./migrate-WyWhSivN.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16524,7 +16630,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-X0Y7fz3N.mjs");
+		const { migrationCommand } = await import("./migrate-WyWhSivN.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16624,7 +16730,7 @@ program.command("secrets:add").description("Build the keys a stage must be given
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsAddCommand } = await import("./add-DXdJjp0b.mjs");
+		const { secretsAddCommand } = await import("./add-BcZXHa3Z.mjs");
 		await secretsAddCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16634,7 +16740,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-BpTPmd7h.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-CldvLtip.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		exitWithError(error);
@@ -16644,7 +16750,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-BpTPmd7h.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-CldvLtip.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		exitWithError(error);
@@ -16683,7 +16789,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
-		const { secretsStoreFor } = await import("./seeds-CRkKeyW0.mjs").then((n) => n.Rt);
+		const { secretsStoreFor } = await import("./seeds-CYzoBDg2.mjs").then((n) => n.Rt);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -16692,7 +16798,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./seeds-CRkKeyW0.mjs").then((n) => n.mt);
+		const { derivedContainers } = await import("./seeds-CYzoBDg2.mjs").then((n) => n.mt);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16709,14 +16815,14 @@ program.command("secrets:migrate").description("Copy a deployed stage's secrets
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { secretsMigrateCommand } = await import("./migrate-4B4RgAjU.mjs");
+		const { secretsMigrateCommand } = await import("./migrate-1bHqjfIe.mjs");
 		await secretsMigrateCommand(options);
 	} catch (error) {
 		exitWithError(error);
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services", "Server targets: run the dev service (MinIO, Mailpit) for every bucket and mail the stage doesn't account for. Not production-grade").option("--skip-dns", "Compose: neither write the public hosts' DNS records nor check they point at GKM_SERVER_IPV4 (a CDN or proxy in front, or records written elsewhere)").option("--rotate-keys", "Deployed stage: each provider issues its runtime keys a successor (the old one is deleted by the next deploy)").option("--retire-old-keys", "Deployed stage: delete a rotated-out key now instead of on the next deploy").action(async (options) => {
-	const { deployCli } = await import("./cli-H0uB_znq.mjs");
+	const { deployCli } = await import("./cli-BkxlWYfI.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -16736,7 +16842,7 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-9t9G3c_u.mjs").then((n) => n.a);
+		const { rollbackStage } = await import("./rollback-DaEmEC2Y.mjs").then((n) => n.a);
 		const { terminalCredentials } = await import("./terminal-CybB-cjk.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
@@ -16755,7 +16861,7 @@ program.command("compose:server").description("Set up a stage's server for compo
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { composeServerCommand } = await import("./serverSetup-DlRKRfTi.mjs");
+		const { composeServerCommand } = await import("./serverSetup-0h1Vh5un.mjs");
 		await composeServerCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16780,7 +16886,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-tWAGuR9i.mjs");
+		const { deployGithubCommand } = await import("./github-BMPci2wg.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		exitWithError(error);