@happier-dev/stack 0.2.0 → 0.2.11

package/scripts/auth.mjs

@@ -17,17 +17,17 @@ import { fileURLToPath } from 'node:url';
 import { parseEnvToObject } from './utils/env/dotenv.mjs';
 import { run, runCapture } from './utils/proc/proc.mjs';
 import { applyStackCacheEnv, ensureDepsInstalled } from './utils/proc/pm.mjs';
-import { applyHappyServerMigrations, ensureHappyServerManagedInfra } from './utils/server/infra/happy_server_infra.mjs';
-import { resolvePrismaClientImportForDbProvider, resolvePrismaClientImportForServerComponent } from './utils/server/flavor_scripts.mjs';
+import { ensureHappyServerManagedInfra } from './utils/server/infra/happy_server_infra.mjs';
+import { applyServerMigrations } from './utils/server/server_migrations.mjs';
+import { resolvePrismaClientImportForDbProvider } from './utils/server/prisma_client_import.mjs';
 import { clearDevAuthKey, readDevAuthKey, writeDevAuthKey } from './utils/auth/dev_key.mjs';
-import { getExpoStatePaths, isStateProcessRunning } from './utils/expo/expo.mjs';
 import { resolveAuthSeedFromEnv } from './utils/stack/startup.mjs';
 import { copyFileIfMissing, linkFileIfMissing, removeFileOrSymlinkIfExists, writeSecretFileIfMissing } from './utils/auth/files.mjs';
 import { clearStackForceLoginCredentialPaths } from './utils/auth/clearStackForceLoginCredentialPaths.mjs';
 import { resolveHandyMasterSecretFromStack } from './utils/auth/handy_master_secret.mjs';
 import { ensureDir, readTextIfExists } from './utils/fs/ops.mjs';
 import { stackExistsSync } from './utils/stack/stacks.mjs';
-import { checkDaemonState } from './daemon.mjs';
+import { checkDaemonStatePingAware } from './daemon.mjs';
 import { isTty, prompt, promptSelect, withRl } from './utils/cli/wizard.mjs';
 import { parseCliIdentityOrThrow, resolveCliHomeDirForIdentity } from './utils/stack/cli_identities.mjs';
 import {
@@ -35,14 +35,14 @@ import {
   getServerLightDataDirFromEnvOrDefault,
   resolveCliHomeDir,
 } from './utils/stack/dirs.mjs';
-import { resolveLocalhostHost, preferStackLocalhostUrl } from './utils/paths/localhost_host.mjs';
+import { preferStackLocalhostUrl } from './utils/paths/localhost_host.mjs';
 import { banner, bullets, cmd as cmdFmt, kv, ok, sectionTitle, warn } from './utils/ui/layout.mjs';
 import { bold, cyan, dim } from './utils/ui/ansi.mjs';
 import { getVerbosityLevel } from './utils/cli/verbosity.mjs';
 import { runOrchestratedGuidedAuthFlow, startDaemonPostAuth } from './utils/auth/orchestrated_stack_auth_flow.mjs';
 import { applyStackActiveServerScopeEnv } from './utils/auth/stable_scope_id.mjs';
 import { isLocalishUrl } from './utils/service/auth_guidance.mjs';
-import { resolveStackAuthCliExecutable } from './utils/auth/stack_guided_login.mjs';
+import { resolveBestExpoWebappUrlForAuth, resolveStackAuthCliExecutable } from './utils/auth/stack_guided_login.mjs';
 import {
   findAnyCredentialPathInCliHome,
   findExistingStackCredentialPath,
@@ -51,8 +51,13 @@ import {
 import { decodeJwtPayloadUnsafe } from './utils/auth/decode_jwt_payload_unsafe.mjs';
 import { fileHasContent } from './utils/fs/file_has_content.mjs';
 import { buildConfigureServerLinks } from '@happier-dev/cli-common/links';
+import {
+  renderPrismaCompatibleSqliteDatabaseUrl,
+  resolveServerLightSqliteDatabaseUrlOptionsFromEnv,
+} from '@happier-dev/cli-common/firstPartyRuntime';
 import { getStackRuntimeStatePath, isPidAlive as isRuntimePidAlive, readStackRuntimeStateFile } from './utils/stack/runtime_state.mjs';
 import { resolveStackRuntimeLaunchContext } from './runtime/launch/resolveStackRuntimeLaunchContext.mjs';
+import { applyEffectiveDbProviderEnv } from './utils/server/effective_db_provider.mjs';
 
 function resolveGuidedStartAction({ healthOk = false, runtimeOwnerAlive = false, autoStart = false } = {}) {
   if (healthOk) return 'proceed';
@@ -90,25 +95,87 @@ async function getInternalServerUrlCompat() {
   return { port, url: internalServerUrl };
 }
 
-async function resolveWebappUrlFromRunningExpo({ rootDir, stackName }) {
+function resolveAuthStackCliHomeDir({ stackName }) {
+  const { baseDir, envPath } = resolveStackEnvPath(stackName);
+  let stackEnv = {};
   try {
-    const baseDir = resolveStackEnvPath(stackName).baseDir;
-    const uiDir = getComponentDir(rootDir, 'happier-ui');
-    const uiPaths = getExpoStatePaths({
-      baseDir,
-      kind: 'expo-dev',
-      projectDir: uiDir,
-      stateFileName: 'expo.state.json',
-    });
-    const uiRunning = await isStateProcessRunning(uiPaths.statePath);
-    if (!uiRunning.running) return null;
-    const port = Number(uiRunning.state?.port);
-    if (!Number.isFinite(port) || port <= 0) return null;
-    const host = resolveLocalhostHost({ stackMode: stackName !== 'main', stackName });
-    return `http://${host}:${port}`;
+    if (existsSync(envPath)) {
+      const raw = readFileSync(envPath, 'utf-8');
+      stackEnv = raw ? parseEnvToObject(raw) : {};
+    }
   } catch {
-    return null;
+    stackEnv = {};
+  }
+
+  const mergedEnv = { ...stackEnv, ...process.env };
+  if (!String(mergedEnv.HAPPIER_STACK_CLI_HOME_DIR ?? '').trim()) {
+    mergedEnv.HAPPIER_STACK_CLI_HOME_DIR = getCliHomeDirFromEnvOrDefault({ stackBaseDir: baseDir, env: stackEnv });
+  }
+  return resolveCliHomeDir(mergedEnv, { preferStackCliHomeDir: true });
+}
+
+async function resolveWebappUrlFromRunningExpo({ rootDir, stackName }) {
+  return await resolveBestExpoWebappUrlForAuth({ rootDir, stackName, timeoutMs: 250 });
+}
+
+function resolveAuthCredentialValidationAttempts(env = process.env) {
+  const raw = String(env.HAPPIER_STACK_AUTH_CREDENTIAL_VALIDATION_ATTEMPTS ?? '').trim();
+  if (!raw) return 4;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 1 ? Math.floor(n) : 4;
+}
+
+function resolveAuthCredentialValidationRetryDelayMs(env = process.env) {
+  const raw = String(env.HAPPIER_STACK_AUTH_CREDENTIAL_VALIDATION_RETRY_DELAY_MS ?? '').trim();
+  if (!raw) return 250;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? Math.floor(n) : 250;
+}
+
+async function validateAuthTokenAgainstServerWithRetries({
+  credentialPath,
+  internalServerUrl,
+  env = process.env,
+}) {
+  const attempts = resolveAuthCredentialValidationAttempts(env);
+  const retryDelayMs = resolveAuthCredentialValidationRetryDelayMs(env);
+  let lastValidation = null;
+
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    lastValidation = await validateAuthTokenAgainstServer({
+      credentialPath,
+      internalServerUrl,
+    });
+    if (!shouldRetryAuthTokenValidation(lastValidation) || lastValidation.code === 'missing-token') {
+      return lastValidation;
+    }
+    if (attempt < attempts - 1 && retryDelayMs > 0) {
+      await new Promise((resolve) => setTimeout(resolve, retryDelayMs));
+    }
   }
+
+  return (
+    lastValidation ?? {
+      checked: false,
+      valid: null,
+      status: null,
+      code: 'not-checked',
+      error: null,
+    }
+  );
+}
+
+function shouldRetryAuthTokenValidation(validation) {
+  if (!validation || validation.code === 'missing-token') {
+    return false;
+  }
+  if (validation.valid === null) {
+    return true;
+  }
+  if (validation.status === 401) {
+    return true;
+  }
+  return typeof validation.status === 'number' && validation.status >= 500;
 }
 
 // NOTE: common fs helpers live in scripts/utils/fs/ops.mjs
@@ -211,6 +278,42 @@ async function validateAuthTokenAgainstServer({ credentialPath, internalServerUr
   }
 }
 
+async function assertLoginProducedUsableCredentials({
+  stackName,
+  cliHomeDir,
+  internalServerUrl,
+  env,
+}) {
+  const credentialPath = findExistingStackCredentialPath({
+    cliHomeDir,
+    serverUrl: internalServerUrl,
+    env,
+  });
+  if (!credentialPath) {
+    throw new Error(
+      `[auth] ${stackName}: guided login finished, but usable credentials were not created.\n` +
+      `[auth] Aborting before post-auth daemon start.`,
+    );
+  }
+
+  const validation = await validateAuthTokenAgainstServerWithRetries({
+    credentialPath,
+    internalServerUrl,
+    env,
+  });
+  if (validation.valid === true) {
+    return credentialPath;
+  }
+
+  const statusText = validation.status != null ? ` status=${validation.status}` : '';
+  const codeText = validation.code ? ` code=${validation.code}` : '';
+  const errorText = validation.error ? ` error=${validation.error}` : '';
+  throw new Error(
+    `[auth] ${stackName}: guided login finished, but the resulting credentials are not usable for this stack server.${statusText}${codeText}${errorText}\n` +
+    `[auth] Aborting before post-auth daemon start.`,
+  );
+}
+
 function authLoginSuggestion(stackName) {
   return stackName === 'main' ? 'hstack auth login' : `hstack stack auth ${stackName} login`;
 }
@@ -492,14 +595,14 @@ function resolveDatabaseUrlFromEnvOrThrow({ env, stackName, label, provider }) {
   return resolvePostgresDatabaseUrlFromEnvOrThrow({ env, stackName, label });
 }
 
-function resolveLightDirsForStack({ env, baseDir }) {
+function resolveEmbeddedDirsForStack({ env, baseDir }) {
   const dataDir = (env.HAPPIER_SERVER_LIGHT_DATA_DIR ?? env.HAPPY_SERVER_LIGHT_DATA_DIR ?? '').toString().trim() || join(baseDir, 'server-light');
   const filesDir = (env.HAPPIER_SERVER_LIGHT_FILES_DIR ?? env.HAPPY_SERVER_LIGHT_FILES_DIR ?? '').toString().trim() || join(dataDir, 'files');
   const dbDir = (env.HAPPIER_SERVER_LIGHT_DB_DIR ?? env.HAPPY_SERVER_LIGHT_DB_DIR ?? '').toString().trim() || join(dataDir, 'pglite');
   return { dataDir, filesDir, dbDir };
 }
 
-export function buildLightMigrationBaseEnv(processEnv, envIn) {
+export function buildEmbeddedMigrationBaseEnv(processEnv, envIn) {
   const baseEnv = { ...(processEnv && typeof processEnv === 'object' ? processEnv : {}) };
   delete baseEnv.DATABASE_URL;
   delete baseEnv.HAPPIER_SERVER_LIGHT_DATA_DIR;
@@ -513,29 +616,27 @@ export function buildLightMigrationBaseEnv(processEnv, envIn) {
   return { ...baseEnv, ...(envIn && typeof envIn === 'object' ? envIn : {}) };
 }
 
-export function resolveDbProviderForLightFromEnv(env) {
-  const raw = (env.HAPPIER_DB_PROVIDER ?? env.HAPPY_DB_PROVIDER ?? '').toString().trim().toLowerCase();
-  if (raw === 'sqlite') return 'sqlite';
-  if (raw === 'pglite') return 'pglite';
-  // Default for light flavor.
-  return 'sqlite';
-}
-
-function resolveDbProviderForFullFromEnv(env) {
-  const raw = (env.HAPPIER_DB_PROVIDER ?? env.HAPPY_DB_PROVIDER ?? '').toString().trim().toLowerCase();
-  if (raw === 'mysql') return 'mysql';
-  return 'postgres';
+export function resolveDbProviderFromEnv({ serverComponentName, env }) {
+  return applyEffectiveDbProviderEnv({
+    serverComponentName,
+    env,
+    targetEnv: { ...env },
+  });
 }
 
-function resolveSqliteDatabaseUrlForLight({ dataDir }) {
-  return `file:${join(dataDir, 'happier-server-light.sqlite')}`;
+function resolveEmbeddedSqliteDatabaseUrl({ dataDir, env }) {
+  return renderPrismaCompatibleSqliteDatabaseUrl({
+    dbPath: join(dataDir, 'happier-server-light.sqlite'),
+    platform: process.platform,
+    sqlite: resolveServerLightSqliteDatabaseUrlOptionsFromEnv(env ?? {}),
+  });
 }
 
-async function ensureLightMigrationsApplied({ serverDir, baseDir, envIn, quiet = false }) {
+async function ensureEmbeddedMigrationsApplied({ serverComponentName, serverDir, baseDir, envIn, quiet = false }) {
   // IMPORTANT: envIn is often parsed from a stack env file (so it does not include PATH).
   // Start from the current process env so we can spawn Yarn reliably, then overlay stack-specific vars.
-  const env = buildLightMigrationBaseEnv(process.env, envIn);
-  const { dataDir, filesDir, dbDir } = resolveLightDirsForStack({ env, baseDir });
+  const env = buildEmbeddedMigrationBaseEnv(process.env, envIn);
+  const { dataDir, filesDir, dbDir } = resolveEmbeddedDirsForStack({ env, baseDir });
   env.HAPPIER_SERVER_LIGHT_DATA_DIR = dataDir;
   env.HAPPIER_SERVER_LIGHT_FILES_DIR = filesDir;
   env.HAPPIER_SERVER_LIGHT_DB_DIR = dbDir;
@@ -543,17 +644,14 @@ async function ensureLightMigrationsApplied({ serverDir, baseDir, envIn, quiet =
   env.HAPPY_SERVER_LIGHT_FILES_DIR = env.HAPPY_SERVER_LIGHT_FILES_DIR ?? filesDir;
   env.HAPPY_SERVER_LIGHT_DB_DIR = env.HAPPY_SERVER_LIGHT_DB_DIR ?? dbDir;
 
-  const provider = resolveDbProviderForLightFromEnv(env);
-  env.HAPPIER_DB_PROVIDER = env.HAPPIER_DB_PROVIDER ?? provider;
+  const provider = resolveDbProviderFromEnv({ serverComponentName, env });
+  if (provider !== 'sqlite' && provider !== 'pglite') {
+    throw new Error(`[auth] embedded migration path does not support provider ${provider}`);
+  }
+  env.HAPPIER_DB_PROVIDER = provider;
 
-  // Migration step:
-  // - pglite: spins a temporary pglite socket and runs prisma migrate deploy against prisma/schema.prisma
-  // - sqlite: runs migrate:sqlite:deploy against prisma/sqlite/schema.prisma
-  //
-  // Both are idempotent and safe to re-run when the light DB is not held open.
   const envWithCache = await applyStackCacheEnv(env);
-  const migrateScript = provider === 'sqlite' ? 'migrate:sqlite:deploy' : 'migrate:light:deploy';
-  await run('yarn', ['-s', migrateScript], { cwd: serverDir, env: envWithCache, stdio: quiet ? 'ignore' : 'inherit' });
+  await applyServerMigrations({ serverDir, env: envWithCache, dbProvider: provider, quiet });
   return { dataDir, filesDir, dbDir };
 }
 
@@ -814,139 +912,6 @@ const accounts = raw ? JSON.parse(raw) : [];
 function resolveServerComponentDir({ rootDir, serverComponent }) {
   return getComponentDir(rootDir, serverComponent === 'happier-server' ? 'happier-server' : 'happier-server-light');
 }
-
-async function seedAccountsFromSourceDbToTargetDb({
-  rootDir,
-  fromStackName,
-  fromServerComponent,
-  fromDatabaseUrl,
-  targetStackName,
-  targetServerComponent,
-  targetDatabaseUrl,
-  force = false,
-}) {
-  const sourceCwd = resolveServerComponentDir({ rootDir, serverComponent: fromServerComponent });
-  const targetCwd = resolveServerComponentDir({ rootDir, serverComponent: targetServerComponent });
-
-  const sourceClientImport = resolvePrismaClientImportForServerComponent({
-    serverComponentName: fromServerComponent,
-    serverDir: sourceCwd,
-  });
-  const targetClientImport = resolvePrismaClientImportForServerComponent({
-    serverComponentName: targetServerComponent,
-    serverDir: targetCwd,
-  });
-
-  const listScript = `
-process.on('uncaughtException', (e) => {
-  console.error(e instanceof Error ? e.message : String(e));
-  process.exit(1);
-});
-process.on('unhandledRejection', (e) => {
-  console.error(e instanceof Error ? e.message : String(e));
-  process.exit(1);
-});
-const mod = await import(${JSON.stringify(sourceClientImport)});
-const PrismaClient = mod?.PrismaClient ?? mod?.default?.PrismaClient;
-if (!PrismaClient) {
-  throw new Error('Failed to load PrismaClient for DB seed (source).');
-}
-const db = new PrismaClient();
-try {
-  const accounts = await db.account.findMany({ select: { id: true, publicKey: true } });
-  console.log(JSON.stringify(accounts));
-} finally {
-  await db.$disconnect();
-}
-`.trim();
-
-  const insertScript = `
-process.on('uncaughtException', (e) => {
-  console.error(e instanceof Error ? e.message : String(e));
-  process.exit(1);
-});
-process.on('unhandledRejection', (e) => {
-  console.error(e instanceof Error ? e.message : String(e));
-  process.exit(1);
-});
-const mod = await import(${JSON.stringify(targetClientImport)});
-const PrismaClient = mod?.PrismaClient ?? mod?.default?.PrismaClient;
-if (!PrismaClient) {
-  throw new Error('Failed to load PrismaClient for DB seed (target).');
-}
-import fs from 'node:fs';
-const FORCE = ${force ? 'true' : 'false'};
-const raw = fs.readFileSync(0, 'utf8').trim();
-const accounts = raw ? JSON.parse(raw) : [];
-const db = new PrismaClient();
-try {
-  let insertedCount = 0;
-  for (const a of accounts) {
-    // eslint-disable-next-line no-await-in-loop
-    try {
-      await db.account.create({ data: { id: a.id, publicKey: a.publicKey } });
-      insertedCount += 1;
-    } catch (e) {
-      // Prisma unique constraint violation
-      if (e && typeof e === 'object' && 'code' in e && e.code === 'P2002') {
-        // Two common cases:
-        // - id already exists (fine)
-        // - publicKey already exists on a different id (auth mismatch -> machine FK failures later)
-        //
-        // For --force, we try to delete the conflicting row by publicKey and then retry insert.
-        // Without --force, fail-closed with a helpful error so users don't end up with "seeded" but broken stacks.
-        try {
-          const existing = await db.account.findUnique({ where: { publicKey: a.publicKey }, select: { id: true } });
-          if (existing?.id && existing.id !== a.id) {
-            if (!FORCE) {
-              throw new Error(
-                \`account publicKey conflict: target already has publicKey for id=\${existing.id}, but seed wants id=\${a.id}. Re-run with --force to replace the conflicting account row.\`
-              );
-            }
-            // Best-effort delete; will fail if other rows reference this account (then we fail closed).
-            await db.account.delete({ where: { publicKey: a.publicKey } });
-            await db.account.create({ data: { id: a.id, publicKey: a.publicKey } });
-            insertedCount += 1;
-            continue;
-          }
-        } catch (inner) {
-          throw inner;
-        }
-        continue;
-      }
-      throw e;
-    }
-  }
-  console.log(JSON.stringify({ sourceCount: accounts.length, insertedCount }));
-} finally {
-  await db.$disconnect();
-}
-`.trim();
-
-  const { stdout: srcOut } = await runNodeCapture({
-    cwd: sourceCwd,
-    env: { ...process.env, DATABASE_URL: fromDatabaseUrl },
-    args: ['--input-type=module', '-e', listScript],
-  });
-  const accounts = srcOut.trim() ? JSON.parse(srcOut.trim()) : [];
-
-  const { stdout: insOut } = await runNodeCapture({
-    cwd: targetCwd,
-    env: { ...process.env, DATABASE_URL: targetDatabaseUrl },
-    args: ['--input-type=module', '-e', insertScript],
-    stdin: JSON.stringify(accounts),
-  });
-  const res = insOut.trim() ? JSON.parse(insOut.trim()) : { sourceCount: accounts.length, insertedCount: 0 };
-
-  return {
-    ok: true,
-    fromStackName,
-    targetStackName,
-    sourceCount: Number(res.sourceCount ?? accounts.length) || 0,
-    insertedCount: Number(res.insertedCount ?? 0) || 0,
-  };
-}
-
 async function cmdCopyFrom({ argv, json }) {
   const rootDir = getRootDir(import.meta.url);
   const stackName = getStackName();
@@ -1091,7 +1056,7 @@ async function cmdCopyFrom({ argv, json }) {
   const serverComponent = resolveServerComponentForCurrentStack();
   const serverDirForPrisma = resolveServerComponentDir({ rootDir, serverComponent });
   const targetBaseDir = getDefaultAutostartPaths().baseDir;
-  const targetCli = resolveCliHomeDir();
+  const targetCli = resolveAuthStackCliHomeDir({ stackName });
   const targetServerLightDataDir =
     (process.env.HAPPIER_SERVER_LIGHT_DATA_DIR ?? '').trim() || join(targetBaseDir, 'server-light');
   const targetSecretFile =
@@ -1173,39 +1138,23 @@ async function cmdCopyFrom({ argv, json }) {
 
   const sourceCwd = resolveServerComponentDir({ rootDir, serverComponent: fromServerComponent });
   const targetCwd = resolveServerComponentDir({ rootDir, serverComponent: targetServerComponent });
-  const sourceDbProvider =
-    fromServerComponent === 'happier-server-light'
-      ? resolveDbProviderForLightFromEnv(sourceEnv)
-      : resolveDbProviderForFullFromEnv(sourceEnv);
-  const targetDbProvider =
-    targetServerComponent === 'happier-server-light'
-      ? resolveDbProviderForLightFromEnv(targetEnv)
-      : resolveDbProviderForFullFromEnv(targetEnv);
-
-  const sourceClientImport =
-    fromServerComponent === 'happier-server-light'
-      ? sourceDbProvider === 'sqlite'
-        ? resolvePrismaClientImportForDbProvider({ serverDir: sourceCwd, provider: 'sqlite' })
-        : resolvePrismaClientImportForServerComponent({ serverComponentName: fromServerComponent, serverDir: sourceCwd })
-      : resolvePrismaClientImportForDbProvider({ serverDir: sourceCwd, provider: sourceDbProvider });
-  const targetClientImport =
-    targetServerComponent === 'happier-server-light'
-      ? targetDbProvider === 'sqlite'
-        ? resolvePrismaClientImportForDbProvider({ serverDir: targetCwd, provider: 'sqlite' })
-        : resolvePrismaClientImportForServerComponent({ serverComponentName: targetServerComponent, serverDir: targetCwd })
-      : resolvePrismaClientImportForDbProvider({ serverDir: targetCwd, provider: targetDbProvider });
+  const sourceDbProvider = resolveDbProviderFromEnv({ serverComponentName: fromServerComponent, env: sourceEnv });
+  const targetDbProvider = resolveDbProviderFromEnv({ serverComponentName: targetServerComponent, env: targetEnv });
+
+  const sourceClientImport = resolvePrismaClientImportForDbProvider({ serverDir: sourceCwd, provider: sourceDbProvider });
+  const targetClientImport = resolvePrismaClientImportForDbProvider({ serverDir: targetCwd, provider: targetDbProvider });
 
   const readSourceAccounts = async () => {
-    if (fromServerComponent === 'happier-server-light') {
-      const lightProvider = resolveDbProviderForLightFromEnv(sourceEnv);
-      const { dataDir, dbDir } = await ensureLightMigrationsApplied({
+    if (sourceDbProvider === 'sqlite' || sourceDbProvider === 'pglite') {
+      const { dataDir, dbDir } = await ensureEmbeddedMigrationsApplied({
+        serverComponentName: fromServerComponent,
         serverDir: sourceCwd,
         baseDir: sourceBaseDir,
         envIn: sourceEnv,
         quiet: json,
       });
-      if (lightProvider === 'sqlite') {
-        const url = resolveSqliteDatabaseUrlForLight({ dataDir });
+      if (sourceDbProvider === 'sqlite') {
+        const url = resolveEmbeddedSqliteDatabaseUrl({ dataDir, env: sourceEnv });
         return await listAccountsFromPostgres({ cwd: sourceCwd, clientImport: sourceClientImport, databaseUrl: url });
       }
       return await listAccountsFromPglite({ cwd: sourceCwd, dbDir });
@@ -1246,7 +1195,7 @@ async function cmdCopyFrom({ argv, json }) {
   const canValidateSourceTokenSubject =
     !(sourceTokenValidation && sourceTokenValidation.checked && sourceTokenValidation.valid === true) &&
     Boolean(sourceTokenSubject) &&
-    (fromServerComponent === 'happier-server-light' || hasSourceDatabaseUrl);
+    (sourceDbProvider === 'sqlite' || sourceDbProvider === 'pglite' || hasSourceDatabaseUrl);
   if (canValidateSourceTokenSubject) {
     try {
       sourceAccounts = await readSourceAccounts();
@@ -1331,11 +1280,10 @@ async function cmdCopyFrom({ argv, json }) {
 
     // 2) Insert Account rows into the target DB.
     const runInsert = async () => {
-	      if (targetServerComponent === 'happier-server-light') {
-	        const lightProvider = resolveDbProviderForLightFromEnv(targetEnv);
-	        const { dataDir, dbDir } = await ensureLightMigrationsApplied({ serverDir: targetCwd, baseDir: targetBaseDir, envIn: targetEnv, quiet: json });
-	        if (lightProvider === 'sqlite') {
-	          const url = resolveSqliteDatabaseUrlForLight({ dataDir });
+	      if (targetDbProvider === 'sqlite' || targetDbProvider === 'pglite') {
+	        const { dataDir, dbDir } = await ensureEmbeddedMigrationsApplied({ serverComponentName: targetServerComponent, serverDir: targetCwd, baseDir: targetBaseDir, envIn: targetEnv, quiet: json });
+	        if (targetDbProvider === 'sqlite') {
+	          const url = resolveEmbeddedSqliteDatabaseUrl({ dataDir, env: targetEnv });
 	          return await insertAccountsIntoPostgres({
 	            cwd: targetCwd,
 	            clientImport: targetClientImport,
@@ -1370,6 +1318,7 @@ async function cmdCopyFrom({ argv, json }) {
             publicServerUrl,
             envPath,
             env: targetEnv,
+            dbProvider: targetDbProvider,
             quiet: json,
             // Auth seeding only needs Postgres; don't block on Minio bucket init.
             skipMinioInit: true,
@@ -1398,10 +1347,15 @@ async function cmdCopyFrom({ argv, json }) {
         if (!looksLikeMissingTable) throw e;
 
         // Best-effort: apply schema, then retry once.
-        if (targetServerComponent === 'happier-server-light') {
-          await ensureLightMigrationsApplied({ serverDir: targetCwd, baseDir: targetBaseDir, envIn: targetEnv, quiet: json }).catch(() => {});
-        } else if (targetServerComponent === 'happier-server') {
-          await applyHappyServerMigrations({ serverDir: targetCwd, env: targetEnv, quiet: json }).catch(() => {});
+        if (targetDbProvider === 'sqlite' || targetDbProvider === 'pglite') {
+          await ensureEmbeddedMigrationsApplied({ serverComponentName: targetServerComponent, serverDir: targetCwd, baseDir: targetBaseDir, envIn: targetEnv, quiet: json }).catch(() => {});
+        } else {
+          await applyServerMigrations({
+            serverDir: targetCwd,
+            env: targetEnv,
+            quiet: json,
+            dbProvider: targetDbProvider,
+          }).catch(() => {});
         }
         return await runInsert();
       }
@@ -1456,7 +1410,10 @@ async function cmdStatus({ json }) {
     stackName,
   });
 
-  const cliHomeDir = resolveCliHomeDirForIdentity({ cliHomeDir: resolveCliHomeDir(), identity });
+  const cliHomeDir = resolveCliHomeDirForIdentity({
+    cliHomeDir: resolveAuthStackCliHomeDir({ stackName }),
+    identity,
+  });
   const credentialPaths = resolveStackCredentialPaths({ cliHomeDir, serverUrl: internalServerUrl, env: process.env });
   const existingCredentialPath = findExistingStackCredentialPath({ cliHomeDir, serverUrl: internalServerUrl, env: process.env });
   const settingsPath = join(cliHomeDir, 'settings.json');
@@ -1477,7 +1434,7 @@ async function cmdStatus({ json }) {
     },
   };
 
-  const daemon = checkDaemonState(cliHomeDir, { serverUrl: internalServerUrl });
+  const daemon = await checkDaemonStatePingAware(cliHomeDir, { serverUrl: internalServerUrl });
   const healthRaw = await fetchHappierHealth(internalServerUrl);
   const health = {
     ok: Boolean(healthRaw.ok),
@@ -1535,6 +1492,8 @@ async function cmdStatus({ json }) {
       ? `✅ daemon: running (pid=${daemon.pid})`
       : daemon.status === 'starting'
         ? `⏳ daemon: starting (pid=${daemon.pid})`
+        : daemon.status === 'unreachable'
+          ? `⚠️ daemon: process alive but control unavailable (pid=${daemon.pid})`
         : daemon.status === 'stale_state'
           ? `⚠️ daemon: stale state file (pid=${daemon.pid} not running)`
           : daemon.status === 'stale_lock'
@@ -1570,7 +1529,7 @@ async function cmdStatus({ json }) {
     console.log(`  ↪ this stack does not appear to be running. Start it with: ${startHint}`);
     return;
   }
-  if (auth.ok && daemon.status !== 'running') {
+  if (auth.ok && daemon.status !== 'running' && daemon.status !== 'unreachable') {
     console.log(`  ↪ daemon is not running for this stack. If you expected it to be running, try: hstack doctor`);
   }
 }
@@ -1609,7 +1568,7 @@ async function cmdLogin({ argv, json }) {
   const runtimeSnapshotActive = Boolean(runtimeLaunchContext.snapshot);
 
   const serviceMode = (process.env.HAPPIER_STACK_SERVICE_MODE ?? '').toString().trim() === '1';
-  const wantsDefaultExpoInAuto =
+  const prefersExpoAuthInAuto =
     requestedWebappMode === 'auto' &&
     !explicitWebappUrl &&
     !envWebappUrl &&
@@ -1617,9 +1576,21 @@ async function cmdLogin({ argv, json }) {
     tty &&
     !serviceMode &&
     !runtimeSnapshotActive;
-  const effectiveWebappMode = wantsDefaultExpoInAuto ? 'expo' : requestedWebappMode;
+  const effectiveWebappMode =
+    prefersExpoAuthInAuto && expoWebappUrl
+      ? 'expo'
+      : requestedWebappMode;
   const shouldUseRuntimeStart = runtimeSnapshotActive && effectiveWebappMode !== 'expo';
-  const guidedStartKind = shouldUseRuntimeStart ? 'runtime' : effectiveWebappMode === 'expo' ? 'dev' : 'start';
+  const shouldStartDevForAutoAuth =
+    !shouldUseRuntimeStart &&
+    requestedWebappMode === 'auto' &&
+    prefersExpoAuthInAuto;
+  const guidedStartKind =
+    shouldUseRuntimeStart
+      ? 'runtime'
+      : effectiveWebappMode === 'expo' || shouldStartDevForAutoAuth
+        ? 'dev'
+        : 'start';
   const guidedStartCommand = resolveGuidedStackStartCommand({
     stackName,
     startKind: guidedStartKind,
@@ -1653,7 +1624,10 @@ async function cmdLogin({ argv, json }) {
   const flow = 'guided';
 
   const identity = parseCliIdentityOrThrow((kv.get('--identity') ?? '').trim());
-  const cliHomeDir = resolveCliHomeDirForIdentity({ cliHomeDir: resolveCliHomeDir(), identity });
+  const cliHomeDir = resolveCliHomeDirForIdentity({
+    cliHomeDir: resolveAuthStackCliHomeDir({ stackName }),
+    identity,
+  });
 
   const force =
     argv.includes('--force') ||
@@ -1738,6 +1712,7 @@ async function cmdLogin({ argv, json }) {
   }
 
   const shouldAutoStart = flags.has('--start-if-needed');
+  let startedStackForExpoAuth = false;
   const guidedReadyTimeoutMs = resolveGuidedServerReadyTimeoutMs(process.env);
   const waitForGuidedServerReadyOrThrow = async (reason) => {
     const ready = await waitForHappierHealthOk(internalServerUrl, {
@@ -1831,7 +1806,7 @@ async function cmdLogin({ argv, json }) {
         process.execPath,
         [
           join(rootDir, 'scripts', 'stack.mjs'),
-          shouldUseRuntimeStart ? 'start' : effectiveWebappMode === 'expo' ? 'dev' : 'start',
+          shouldUseRuntimeStart ? 'start' : effectiveWebappMode === 'expo' || shouldStartDevForAutoAuth ? 'dev' : 'start',
           stackName,
           '--background',
           ...(shouldUseRuntimeStart ? ['--runtime'] : []),
@@ -1840,7 +1815,13 @@ async function cmdLogin({ argv, json }) {
         ],
         {
           cwd: rootDir,
-          env: { ...process.env, ...(!shouldUseRuntimeStart && effectiveWebappMode === 'expo' ? { HAPPIER_STACK_AUTH_FLOW: '1' } : {}) },
+          env: {
+            ...process.env,
+            HAPPIER_STACK_SKIP_REFRESH_DEPS: '1',
+            ...(!shouldUseRuntimeStart && (effectiveWebappMode === 'expo' || shouldStartDevForAutoAuth)
+              ? { HAPPIER_STACK_AUTH_FLOW: '1' }
+              : {}),
+          },
         }
       ).catch((err) => {
         const msg =
@@ -1850,6 +1831,7 @@ async function cmdLogin({ argv, json }) {
           `${String(err?.stack ?? err)}`;
         throw new Error(msg);
       });
+      startedStackForExpoAuth = !shouldUseRuntimeStart && (effectiveWebappMode === 'expo' || shouldStartDevForAutoAuth);
 
       await waitForGuidedServerReadyOrThrow('starting in background');
     }
@@ -1871,7 +1853,7 @@ async function cmdLogin({ argv, json }) {
   };
 
   let webappUrlForDaemon = webappUrl;
-  if (method !== 'mobile' && effectiveWebappMode === 'expo') {
+  if (method !== 'mobile' && (effectiveWebappMode === 'expo' || webappUrlSource === 'expo' || startedStackForExpoAuth)) {
     const guidedEnv = applyStackActiveServerScopeEnv({
       env: { ...scopedEnv, HAPPIER_STACK_AUTH_FLOW: '1' },
       stackName,
@@ -2003,6 +1985,13 @@ async function cmdLogin({ argv, json }) {
     await runLogin(scopedEnv);
   }
 
+  await assertLoginProducedUsableCredentials({
+    stackName,
+    cliHomeDir,
+    internalServerUrl,
+    env: scopedEnv,
+  });
+
   try {
     const daemonStart = await startDaemonPostAuth({
       rootDir,