@supatype/cli 0.1.1 → 0.1.3

package/dist/valkey-sidecar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"valkey-sidecar.js","sourceRoot":"","sources":["../src/valkey-sidecar.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE3C,MAAM,YAAY,GAAG,WAAW,CAAA;AAChC,MAAM,YAAY,GAAG,IAAI,CAAA;AACzB,MAAM,KAAK,GAAG,wBAAwB,CAAA;AAEtC,SAAS,aAAa,CAAC,WAAmB;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACrE,OAAO,uBAAuB,IAAI,EAAE,CAAA;AACtC,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC5D,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY,EAAE,SAAS,GAAG,GAAG;IAClE,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,SAAS,CACjB,OAAO,CAAC,QAAQ,EAChB;YACE,IAAI;YACJ,2DAA2D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK;gBAC/F,kFAAkF;gBAClF,kCAAkC,SAAS,GAAG;SACjD,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAA;QACD,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,EAAU;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAA;IAC3B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;QACxB,UAAU;IACZ,CAAC;AACH,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAA;IAC3D,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,YAAY,IAAI,YAAY,EAAE,CAAA;IAE9C,IAAI,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACtD,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CACV,2DAA2D;YACzD,sFAAsF,CACzF,CAAA;QACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,WAAW,CAAC,CAAA;IACvC,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IAE5D,MAAM,GAAG,GAAG,SAAS,CACnB,QAAQ,EACR,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,YAAY,OAAO,EAAE,KAAK,CAAC,EAClE,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAA;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QACtD,OAAO,CAAC,IAAI,CACV,iDAAiD,MAAM,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,IAAI;YACjF,4DAA4D,CAC/D,CAAA;QACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC1D,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,sCAAsC,IAAI,GAAG,CAAC,CAAA;YAC1D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QACrD,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAA;IACd,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAA;IACxG,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AACrD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,aAA4B;IAC5D,IAAI,CAAC,aAAa;QAAE,OAAM;IAC1B,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;AACvE,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAY;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1C,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,CAAC,CAAC,OAAO,EAAE,CAAA;YACX,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;QACF,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;QACrC,UAAU,CAAC,GAAG,EAAE;YACd,CAAC,CAAC,OAAO,EAAE,CAAA;YACX,OAAO,CAAC,KAAK,CAAC,CAAA;QAChB,CAAC,EAAE,GAAG,CAAC,CAAA;IACT,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supatype/cli",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Supatype CLI — schema push, introspect, generate",
   "type": "module",
   "bin": {
@@ -19,8 +19,12 @@
     }
   },
   "dependencies": {
-    "@clack/prompts": "^1.6.0",
     "bcryptjs": "^3.0.2",
+    "ink": "^5.2.1",
+    "ink-select-input": "^6.2.0",
+    "ink-spinner": "^5.0.0",
+    "ink-text-input": "^6.0.0",
+    "react": "^18.3.1",
     "commander": "^12.1.0",
     "pg": "^8.13.0",
     "ts-morph": "^28.0.0",
@@ -29,6 +33,7 @@
   },
   "devDependencies": {
     "@types/bcryptjs": "^2.4.6",
+    "@types/react": "^18.3.18",
     "@types/node": "^22",
     "@types/pg": "^8",
     "vitest": "^4.0.18"
@@ -36,7 +41,8 @@
   "scripts": {
     "build": "tsc --project tsconfig.json && node --input-type=module -e \"import{cpSync,mkdirSync}from'node:fs';const a='dist/assets';mkdirSync(a,{recursive:true});cpSync('assets/supatype-logo-wordmark.ascii.txt',a+'/supatype-logo-wordmark.ascii.txt')\"",
     "dev": "tsc --project tsconfig.json --watch",
-    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "typecheck": "tsc --project tsconfig.json --noEmit && tsc --project tests/tsconfig.json --noEmit",
+    "typecheck:tests": "tsc --project tests/tsconfig.json --noEmit",
     "postinstall": "node --input-type=module --eval \"import{existsSync}from'node:fs';import{resolve}from'node:path';import{pathToFileURL}from'node:url';const f=resolve(process.cwd(),'dist/scripts/postinstall.js');if(existsSync(f))await import(pathToFileURL(f).href)\"",
     "test": "vitest run",
     "clean": "rm -rf dist *.tsbuildinfo"

package/src/binary-cache.ts

@@ -37,6 +37,12 @@ import { basename, join, resolve, isAbsolute } from "node:path"
 import type { SupatypeProjectConfig } from "./project-config.js"
 import { loadProjectLink, migrateLegacyLinkFiles } from "./link.js"
 import { releasePublicKey } from "./release-public-key.js"
+import {
+  isDownloadInProgress,
+  releaseDownloadLock,
+  tryAcquireDownloadLock,
+  waitForComponentDownload,
+} from "./binary-download-lock.js"
 
 /**
  * Set `versions.{engine|server|postgres|deno}: VERSION_PIN_LOCAL` to mean “use `overrides.*` only”
@@ -167,6 +173,16 @@ export function cachedBinaryPath(component: Component, version: string, platform
   return join(cachePath(component, version), binaryName(component, version, platform))
 }
 
+/** True when the platform binary for `version` is present and passes format checks. */
+export function isCachedBinaryReady(
+  component: Component,
+  version: string,
+  platform: PlatformId = currentPlatform(),
+): boolean {
+  const destPath = cachedBinaryPath(component, version, platform)
+  return existsSync(destPath) && cachedArtifactLooksValid(component, destPath)
+}
+
 function binaryName(component: Component, version: string, platform: PlatformId): string {
   const win = platform.os === "windows"
   switch (component) {
@@ -299,6 +315,45 @@ export async function ensureCachedBinary(
   return download(component, version, platform)
 }
 
+async function acquireDownloadSlot(
+  component: Component,
+  version: string,
+  platform: PlatformId,
+): Promise<void> {
+  const isReady = () => isCachedBinaryReady(component, version, platform)
+
+  for (let attempt = 0; attempt < 3; attempt++) {
+    if (isReady()) return
+
+    if (tryAcquireDownloadLock(component, version)) return
+
+    if (isDownloadInProgress(component, version)) {
+      console.log(
+        `[supatype] ${component} v${version} is downloading in another process — waiting...`,
+      )
+      const outcome = await waitForComponentDownload(component, version, isReady, (c) => {
+        console.log(`[supatype] Still waiting for ${c} download...`)
+      })
+      if (outcome === "ready") return
+      if (outcome === "timeout") {
+        throw new Error(
+          `Timed out waiting for ${component} v${version} download. Run: supatype update`,
+        )
+      }
+      console.warn(
+        `[supatype] ${component} v${version} download did not finish in the other process — retrying.`,
+      )
+      continue
+    }
+
+    if (tryAcquireDownloadLock(component, version)) return
+  }
+
+  throw new Error(
+    `Could not acquire download lock for ${component} v${version}. Run: supatype update`,
+  )
+}
+
 export async function download(
   component: Component,
   version: string,
@@ -327,6 +382,11 @@ export async function download(
     unlinkSync(destPath)
   }
 
+  await acquireDownloadSlot(component, version, platform)
+  if (isCachedBinaryReady(component, version, platform)) {
+    return destPath
+  }
+
   const binaryUrl = `${CDN_BASE}${CDN_PATHS[component](version, platform)}`
   const checksumsUrl = `${CDN_BASE}${checksumsDirPath(component, version)}`
   const minisigUrl = `${checksumsUrl}.minisig`
@@ -361,6 +421,7 @@ export async function download(
       `Failed to download ${component} v${version} from ${CDN_BASE}: ${(err as Error).message}`,
     )
   } finally {
+    releaseDownloadLock(component, version)
     if (existsSync(tmpPath)) {
       try { unlinkSync(tmpPath) } catch { /* ignore */ }
     }

package/src/binary-download-lock.ts

@@ -0,0 +1,124 @@
+/**
+ * Coordinates concurrent component-binary downloads (postinstall, init, dev).
+ * A second CLI process waits for an in-flight download instead of racing the CDN.
+ */
+
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { cachePath, type Component } from "./binary-cache.js"
+
+const LOCK_VERSION = 1 as const
+const STALE_MS = 30 * 60 * 1000
+const POLL_MS = 500
+const WAIT_NOTICE_MS = 3000
+
+interface DownloadLockPayload {
+  version: typeof LOCK_VERSION
+  pid: number
+  component: Component
+  semver: string
+  startedAt: string
+}
+
+function lockPath(component: Component, version: string): string {
+  return join(cachePath(component, version), ".downloading")
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+function isPidAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch {
+    return false
+  }
+}
+
+function readLock(component: Component, version: string): DownloadLockPayload | null {
+  const path = lockPath(component, version)
+  if (!existsSync(path)) return null
+  try {
+    const data = JSON.parse(readFileSync(path, "utf8")) as DownloadLockPayload
+    if (data.version !== LOCK_VERSION) return null
+    return data
+  } catch {
+    return null
+  }
+}
+
+function isLockStale(lock: DownloadLockPayload): boolean {
+  if (!isPidAlive(lock.pid)) return true
+  const age = Date.now() - Date.parse(lock.startedAt)
+  return Number.isNaN(age) || age > STALE_MS
+}
+
+export function clearDownloadLock(component: Component, version: string): void {
+  const path = lockPath(component, version)
+  if (existsSync(path)) unlinkSync(path)
+}
+
+/** Atomically claim the download lock for this process, or return false if another live holder exists. */
+export function tryAcquireDownloadLock(component: Component, version: string): boolean {
+  mkdirSync(cachePath(component, version), { recursive: true })
+  const existing = readLock(component, version)
+  if (existing && !isLockStale(existing)) return false
+  if (existing) clearDownloadLock(component, version)
+
+  const payload: DownloadLockPayload = {
+    version: LOCK_VERSION,
+    pid: process.pid,
+    component,
+    semver: version,
+    startedAt: new Date().toISOString(),
+  }
+  try {
+    writeFileSync(lockPath(component, version), JSON.stringify(payload), { flag: "wx" })
+    return true
+  } catch {
+    return false
+  }
+}
+
+export function releaseDownloadLock(component: Component, version: string): void {
+  const lock = readLock(component, version)
+  if (!lock || lock.pid !== process.pid) return
+  clearDownloadLock(component, version)
+}
+
+export function isDownloadInProgress(component: Component, version: string): boolean {
+  const lock = readLock(component, version)
+  return lock !== null && !isLockStale(lock)
+}
+
+export async function waitForComponentDownload(
+  component: Component,
+  version: string,
+  isReady: () => boolean,
+  onWait?: (component: Component) => void,
+): Promise<"ready" | "failed" | "timeout"> {
+  const deadline = Date.now() + STALE_MS
+  let lastNotice = 0
+
+  while (Date.now() < deadline) {
+    if (isReady()) return "ready"
+
+    const lock = readLock(component, version)
+    if (!lock || isLockStale(lock)) {
+      if (isReady()) return "ready"
+      return "failed"
+    }
+
+    const now = Date.now()
+    if (onWait && now - lastNotice >= WAIT_NOTICE_MS) {
+      onWait(component)
+      lastNotice = now
+    }
+
+    await sleep(POLL_MS)
+  }
+
+  return isReady() ? "ready" : "timeout"
+}

package/src/cli-package-version.ts

@@ -0,0 +1,15 @@
+import { readFileSync } from "node:fs"
+import { dirname, join } from "node:path"
+import { fileURLToPath } from "node:url"
+
+const CLI_PACKAGE_JSON = join(dirname(fileURLToPath(import.meta.url)), "..", "package.json")
+
+/** Installed @supatype/cli version from package.json (used by --version and init scaffolding). */
+export function cliPackageVersion(): string {
+  try {
+    const pkg = JSON.parse(readFileSync(CLI_PACKAGE_JSON, "utf8")) as { version?: string }
+    return pkg.version ?? "0.0.0"
+  } catch {
+    return "0.0.0"
+  }
+}

package/src/cli.ts

@@ -29,13 +29,15 @@ import { registerPlugins } from "./commands/plugins.js"
 import { registerTypes } from "./commands/types.js"
 import { registerMigrateFromV1 } from "./commands/migrate-from-v1.js"
 import { registerSelfUpdate } from "./commands/self-update.js"
+import { cliPackageVersion } from "./cli-package-version.js"
 import { reportCliFatal } from "./ui/fatal.js"
+import { wrapProgramActionsWithChrome } from "./ui/runtime/command-chrome.js"
 
 export async function run(): Promise<void> {
   const program = new Command()
     .name("supatype")
-    .description("Supatype — schema-first Postgres API")
-    .version("0.1.0")
+    .description("Supatype — type-first platform for PostgreSQL")
+    .version(cliPackageVersion())
 
   registerInit(program)
   registerDev(program)
@@ -68,6 +70,8 @@ export async function run(): Promise<void> {
   registerTypes(program)
   registerMigrateFromV1(program)
 
+  wrapProgramActionsWithChrome(program)
+
   try {
     await program.parseAsync(process.argv)
   } catch (err) {

package/src/commands/add.ts

@@ -1,9 +1,9 @@
 import type { Command } from "commander"
-import * as p from "@clack/prompts"
+import { p, runClackFlow } from "../ui/clack.js"
 import { loadConfig } from "../config.js"
 import { selfHostTlsEnabled } from "../project-config.js"
 import { updateServerConfigInProject } from "../app-config.js"
-import { ensureNotCancelled, printLogo } from "../ui/prompts.js"
+import { ensureNotCancelled } from "../ui/prompts.js"
 import { file, error, info, plain } from "../ui/messages.js"
 import { nextSteps } from "../ui/next-steps.js"
 
@@ -49,26 +49,33 @@ async function addDomain(domainArg?: string, emailArg?: string): Promise<void> {
   const cwd = process.cwd()
   const interactive = !domainArg?.trim() || !emailArg?.trim()
 
-  if (interactive) {
-    printLogo()
-    p.intro("Add a custom domain")
-  }
-
-  const domain = await promptDomain(domainArg)
-  const email = await promptEmail(emailArg)
+  const run = async (): Promise<void> => {
+    const domain = await promptDomain(domainArg)
+    const email = await promptEmail(emailArg)
 
-  try {
-    const configPath = updateServerConfigInProject(cwd, { domain, tlsEmail: email })
-    if (interactive) {
-      p.outro(`Updated ${configPath}`)
-    } else {
-      file("updated", configPath)
+    try {
+      const configPath = updateServerConfigInProject(cwd, { domain, tlsEmail: email })
+      if (interactive) {
+        p.outro(`Updated ${configPath}`)
+      } else {
+        file("updated", configPath)
+      }
+      printDomainNextSteps(cwd, domain)
+    } catch (err) {
+      error((err as Error).message)
+      process.exit(1)
     }
-    printDomainNextSteps(cwd, domain)
-  } catch (err) {
-    error((err as Error).message)
-    process.exit(1)
   }
+
+  if (interactive) {
+    await runClackFlow(async () => {
+      p.intro("Add a custom domain")
+      await run()
+    })
+    return
+  }
+
+  await run()
 }
 
 function printDomainNextSteps(cwd: string, domain: string): void {

package/src/commands/admin.ts

@@ -17,16 +17,49 @@ import {
 } from "../project-config.js"
 import { readEnvValue, upsertEnvFile } from "../env-file.js"
 import { hasEngineOverride } from "../binary-cache.js"
+import { readDevSessionLock } from "../dev-session-lock.js"
+import { composeProjectName } from "../self-host-compose.js"
 import { confirm as uiConfirm } from "../ui/confirm.js"
 import { error, info, plain } from "../ui/messages.js"
-import { promptText } from "../ui/prompts.js"
+import { promptPassword, promptText } from "../ui/prompts.js"
 import { isInteractive } from "../ui/interactive.js"
+import {
+  getActiveDevSession,
+} from "../dev-session.js"
 
 export const ADMIN_EMAIL_ENV = "SUPATYPE_ADMIN_EMAIL"
 export const ADMIN_PASSWORD_ENV = "SUPATYPE_ADMIN_PASSWORD"
 
 const BCRYPT_ROUNDS = 10
 
+/** GoTrue scopes users to the nil instance id in single-tenant/self-host mode. */
+export const GOTRUE_NIL_INSTANCE_ID = "00000000-0000-0000-0000-000000000000"
+
+/** Audience claim used by GoTrue when looking up users (matches GOTRUE_JWT_AUD in compose). */
+export function gotrueJwtAud(cwd: string): string {
+  return readEnvValue(cwd, "GOTRUE_JWT_AUD", "authenticated")
+}
+
+type DbQuery = (sql: string, params?: unknown[]) => Promise<QueryResult>
+type AuthConfirmedColumn = "email_confirmed_at" | "confirmed_at"
+
+/** Prefer GoTrue's column when migrated; fall back to postgres init `confirmed_at`. */
+export async function resolveAuthConfirmedAtColumn(query: DbQuery): Promise<AuthConfirmedColumn> {
+  const result = await query(
+    `SELECT column_name
+     FROM information_schema.columns
+     WHERE table_schema = 'auth'
+       AND table_name = 'users'
+       AND column_name IN ('email_confirmed_at', 'confirmed_at')
+     ORDER BY CASE column_name WHEN 'email_confirmed_at' THEN 0 ELSE 1 END
+     LIMIT 1`,
+  )
+  const row = result.rows[0] as { column_name?: string; value?: string } | undefined
+  const name = row?.column_name ?? row?.value
+  if (name === "email_confirmed_at" || name === "confirmed_at") return name
+  return "confirmed_at"
+}
+
 export interface EnsureFirstAdminOptions {
   email?: string
   password?: string
@@ -36,8 +69,6 @@ export interface EnsureFirstAdminOptions {
   compose?: { project: string; composePath: string }
 }
 
-type DbQuery = (sql: string, params?: unknown[]) => Promise<QueryResult>
-
 export function registerAdmin(program: Command): void {
   const adminCmd = program
     .command("admin")
@@ -78,20 +109,33 @@ export function registerAdmin(program: Command): void {
 
         info(`Creating admin user: ${email} (role: ${role})...`)
 
-        const pg = await importPg()
-        const pool = new pg.Pool({ connectionString: connection, max: 2 })
+        const compose =
+          opts.connection === undefined ? resolveDockerComposeContext(cwd, config) : null
 
         try {
-          await ensureAuthUsersTable(pool)
-          await createAdminUser(pool, email, password, role)
+          if (compose) {
+            await createAdminUser(
+              (sql, params) => composeExecQuery(cwd, compose, sql, params),
+              email,
+              password,
+              role,
+              { cwd },
+            )
+          } else {
+            const pg = await importPg()
+            const pool = new pg.Pool({ connectionString: connection, max: 2 })
+            try {
+              await ensureAuthUsersTable(pool)
+              await createAdminUser(pool, email, password, role, { cwd })
+            } finally {
+              await pool.end()
+            }
+          }
           info("This user can now log in to the admin panel at /admin")
         } catch (err) {
-          const message =
-            err instanceof Error ? err.message : "Unknown error"
+          const message = err instanceof Error ? err.message : "Unknown error"
           error(`Failed to create admin user: ${message}`)
           process.exit(1)
-        } finally {
-          await pool.end()
         }
       },
     )
@@ -249,8 +293,9 @@ export async function ensureFirstAdminUserForProject(
         (sql, params) => composeExecQuery(root, merged.compose!, sql, params),
         merged,
       )
-    } catch {
-      // Non-fatal
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err)
+      error(`Could not ensure first admin user: ${message}`)
     }
     return
   }
@@ -284,9 +329,27 @@ async function ensureFirstAdminWithQuery(
   }
 
   const role = options.role ?? "admin"
-  await createAdminUser(query, credentials.email, credentials.password, role, { quiet: true })
+  try {
+    await createAdminUser(query, credentials.email, credentials.password, role, {
+      quiet: true,
+      cwd,
+    })
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
+    error(`Failed to create admin user: ${message}`)
+    return
+  }
   clearAdminSeedPassword(cwd)
-  info(`Admin user "${credentials.email}" created (role: ${role}).`)
+  logFirstAdminCreated(credentials.email, role)
+}
+
+function logFirstAdminCreated(email: string, role: string): void {
+  if (getActiveDevSession()?.isTui()) {
+    console.log(`Admin user "${email}" created (role: ${role}).`)
+    console.log("Log in at /admin after starting the dev server.")
+    return
+  }
+  info(`Admin user "${email}" created (role: ${role}).`)
   info("Log in at /admin after starting the dev server.")
 }
 
@@ -325,7 +388,7 @@ async function resolveAdminCredentials(
     return null
   }
 
-  const password = await promptText("Admin password (min 8 chars)")
+  const password = await promptPassword("Admin password (min 8 chars)")
   if (!password || password.length < 8) {
     info("Password too short. Skipping admin user creation.")
     return null
@@ -347,7 +410,7 @@ async function createAdminUser(
   email: string,
   password: string,
   role: string,
-  opts: { quiet?: boolean } = {},
+  opts: { quiet?: boolean; aud?: string; cwd?: string } = {},
 ): Promise<{ id: string; email: string }> {
   const query: DbQuery =
     typeof (db as Pool).query === "function"
@@ -355,9 +418,15 @@ async function createAdminUser(
       : (db as DbQuery)
 
   const normalized = email.toLowerCase()
-  const existing = await query(`SELECT id FROM auth.users WHERE email = $1`, [
-    normalized,
-  ])
+  const aud = opts.aud ?? (opts.cwd ? gotrueJwtAud(opts.cwd) : "authenticated")
+  const existing = await query(
+    `SELECT id FROM auth.users
+     WHERE instance_id = $1::uuid
+       AND LOWER(email) = $2
+       AND aud = $3
+       AND is_sso_user = false`,
+    [GOTRUE_NIL_INSTANCE_ID, normalized, aud],
+  )
   if (existing.rows.length > 0) {
     throw new Error(`User with email "${email}" already exists.`)
   }
@@ -369,18 +438,27 @@ async function createAdminUser(
     providers: ["email"],
   })
   const userMetadata = JSON.stringify({})
+  const confirmedCol = await resolveAuthConfirmedAtColumn(query)
 
   const result = await query(
     `INSERT INTO auth.users (
-      email, encrypted_password, role, aud,
+      instance_id, id, aud, role, email, encrypted_password,
       raw_app_meta_data, raw_user_meta_data,
-      email_confirmed_at, created_at, updated_at
+      ${confirmedCol},
+      confirmation_token, recovery_token,
+      email_change_token_new, email_change, email_change_token_current,
+      phone_change, phone_change_token, reauthentication_token,
+      is_sso_user, is_anonymous,
+      created_at, updated_at
     ) VALUES (
-      $1, $2, 'authenticated', 'authenticated',
-      $3::jsonb, $4::jsonb,
-      now(), now(), now()
+      $1::uuid, gen_random_uuid(), $2, 'authenticated', $3, $4,
+      $5::jsonb, $6::jsonb,
+      now(),
+      '', '', '', '', '', '', '', '',
+      false, false,
+      now(), now()
     ) RETURNING id, email`,
-    [normalized, passwordHash, appMetadata, userMetadata],
+    [GOTRUE_NIL_INSTANCE_ID, aud, normalized, passwordHash, appMetadata, userMetadata],
   )
 
   const user = result.rows[0] as { id: string; email: string }
@@ -399,7 +477,7 @@ async function ensureAuthUsersTable(pool: Pool): Promise<void> {
 
     CREATE TABLE IF NOT EXISTS auth.users (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-      instance_id   UUID,
+      instance_id   UUID DEFAULT '00000000-0000-0000-0000-000000000000'::uuid,
       aud           TEXT DEFAULT 'authenticated',
       role          TEXT DEFAULT 'authenticated',
       email         TEXT UNIQUE,
@@ -412,7 +490,13 @@ async function ensureAuthUsersTable(pool: Pool): Promise<void> {
       confirmation_token TEXT DEFAULT '',
       recovery_token TEXT DEFAULT '',
       email_change_token_new TEXT DEFAULT '',
-      email_change  TEXT DEFAULT ''
+      email_change_token_current TEXT DEFAULT '',
+      email_change  TEXT DEFAULT '',
+      phone_change  TEXT DEFAULT '',
+      phone_change_token TEXT DEFAULT '',
+      reauthentication_token TEXT DEFAULT '',
+      is_sso_user   BOOLEAN NOT NULL DEFAULT false,
+      is_anonymous  BOOLEAN NOT NULL DEFAULT false
     );
   `)
 }
@@ -437,6 +521,33 @@ async function hasAdminUsers(query: DbQuery): Promise<boolean> {
   return count > 0
 }
 
+/** Postgres password for compose `exec psql` (db is not published to the host). */
+export function composePostgresPassword(cwd: string): string {
+  return readEnvValue(cwd, "POSTGRES_PASSWORD", "postgres")
+}
+
+function resolveDockerComposeContext(
+  cwd: string,
+  config: SupatypeProjectConfig,
+): { project: string; composePath: string } | null {
+  if (resolveRuntimeProvider(config) !== "docker" || hasEngineOverride(config)) {
+    return null
+  }
+
+  const session = readDevSessionLock(cwd)
+  if (session?.composeProject && session.composePath && existsSync(session.composePath)) {
+    return { project: session.composeProject, composePath: session.composePath }
+  }
+
+  const composePath = resolve(cwd, ".supatype/self-host/docker-compose.yml")
+  if (!existsSync(composePath)) return null
+
+  return {
+    project: composeProjectName(config.project?.name ?? "project"),
+    composePath,
+  }
+}
+
 function composeExecQuery(
   cwd: string,
   compose: { project: string; composePath: string },
@@ -445,6 +556,7 @@ function composeExecQuery(
 ): Promise<QueryResult> {
   const db = readEnvValue(cwd, "POSTGRES_DB", "supatype")
   const user = readEnvValue(cwd, "POSTGRES_USER", "supatype_admin")
+  const pgPassword = composePostgresPassword(cwd)
   const envFile = join(cwd, ".env")
   const composeDir = dirname(compose.composePath)
   const args = [
@@ -459,7 +571,20 @@ function composeExecQuery(
   if (existsSync(envFile)) args.push("--env-file", envFile)
 
   if (params.length === 0) {
-    args.push("exec", "-T", "db", "psql", "-U", user, "-d", db, "-tAc", sql)
+    args.push(
+      "exec",
+      "-T",
+      "-e",
+      `PGPASSWORD=${pgPassword}`,
+      "db",
+      "psql",
+      "-U",
+      user,
+      "-d",
+      db,
+      "-tAc",
+      sql,
+    )
     const result = spawnSync("docker", args, { cwd: composeDir, encoding: "utf8" })
     if (result.status !== 0) {
       throw new Error((result.stderr ?? result.stdout ?? "compose psql failed").trim())
@@ -486,6 +611,8 @@ function composeExecQuery(
   args.push(
     "exec",
     "-T",
+    "-e",
+    `PGPASSWORD=${pgPassword}`,
     "db",
     "psql",
     "-U",