@supatype/cli 0.1.12 → 0.2.0

package/src/compose-services.ts

@@ -0,0 +1,174 @@
+/**
+ * What the local stack is actually running, asked of Docker rather than guessed.
+ *
+ * `status` and `logs` each used to carry a hardcoded list of container names.
+ * Both lists were wrong: they named containers the compose file does not create
+ * (`supatype-postgres`, `supatype-kong`), omitted every service it does create
+ * (`server`, `storage`, `functions-worker`, `schema-engine`, `valkey`), and used
+ * a naming scheme the compose file never applies, since it sets no
+ * `container_name` and Docker therefore names containers
+ * `<project>-<service>-<n>`.
+ *
+ * A list of services in the source is a list that goes stale the next time the
+ * stack changes shape. `docker compose ps` cannot.
+ */
+import { spawnSync } from "node:child_process"
+import { existsSync } from "node:fs"
+import { loadConfig } from "./config.js"
+import { composeProjectName, selfHostComposePaths } from "./self-host-compose.js"
+
+/** Where the local stack's compose file is, and what project name it runs under. */
+export interface ComposeContext {
+  composePath: string
+  projectRoot: string
+  projectName: string
+}
+
+/** One service in the local stack. */
+export interface ComposeService {
+  /** The compose service name, which is what `logs --service` takes. */
+  service: string
+  /** The container Docker created for it, if any. */
+  container: string
+  /** Docker's own word: running, exited, created, restarting, and so on. */
+  state: string
+  /** Published ports, as Docker reports them. */
+  ports: string
+  /** How long it has been up, as Docker reports it. */
+  status: string
+}
+
+/**
+ * composeContext locates the generated compose file for this project.
+ *
+ * Returns undefined when the stack has never been generated, which is the
+ * ordinary case in a project that only uses `supatype dev`.
+ */
+export function composeContext(cwd: string): ComposeContext | undefined {
+  const paths = selfHostComposePaths(cwd)
+  if (!existsSync(paths.composePath)) return undefined
+
+  let projectName = "supatype"
+  try {
+    const config = loadConfig(cwd)
+    if (config) projectName = composeProjectName(config.project.name)
+  } catch {
+    // A project whose config will not load can still have a running stack, and
+    // reporting on it is more useful than refusing to.
+  }
+  return { composePath: paths.composePath, projectRoot: cwd, projectName }
+}
+
+/**
+ * composeServices asks Docker what the stack is running.
+ *
+ * `--all` so a stopped service is reported as stopped rather than vanishing,
+ * which is the question `supatype status` is usually asked.
+ */
+export function composeServices(ctx: ComposeContext): ComposeService[] {
+  const result = spawnSync("docker", [...composeArgs(ctx), "ps", "--all", "--format", "json"], {
+    encoding: "utf8",
+    timeout: 15_000,
+  })
+  if (result.status !== 0 || !result.stdout) return []
+  return parseComposePs(result.stdout)
+}
+
+/**
+ * parseComposePs reads `docker compose ps --format json`.
+ *
+ * Compose v2 emits one JSON object per line; some versions emit a single JSON
+ * array instead. Both are accepted, because which one you get depends on the
+ * Docker version the developer happens to have.
+ */
+export function parseComposePs(stdout: string): ComposeService[] {
+  const trimmed = stdout.trim()
+  if (trimmed === "") return []
+
+  const rows: unknown[] = []
+  if (trimmed.startsWith("[")) {
+    try {
+      const parsed: unknown = JSON.parse(trimmed)
+      if (Array.isArray(parsed)) rows.push(...parsed)
+    } catch {
+      return []
+    }
+  } else {
+    for (const line of trimmed.split("\n")) {
+      if (line.trim() === "") continue
+      try {
+        rows.push(JSON.parse(line))
+      } catch {
+        // A line that is not JSON is progress noise, not a service.
+      }
+    }
+  }
+
+  const services: ComposeService[] = []
+  for (const row of rows) {
+    if (typeof row !== "object" || row === null) continue
+    const record = row as Record<string, unknown>
+    const service = typeof record["Service"] === "string" ? record["Service"] : ""
+    if (service === "") continue
+    services.push({
+      service,
+      container: typeof record["Name"] === "string" ? record["Name"] : "",
+      state: typeof record["State"] === "string" ? record["State"] : "unknown",
+      ports: typeof record["Publishers"] === "string" ? record["Publishers"] : formatPorts(record["Publishers"]),
+      status: typeof record["Status"] === "string" ? record["Status"] : "",
+    })
+  }
+  services.sort((a, b) => a.service.localeCompare(b.service))
+  return services
+}
+
+/**
+ * formatPorts renders the structured Publishers array Compose emits, keeping
+ * only the ports actually reachable from the host.
+ */
+function formatPorts(publishers: unknown): string {
+  if (!Array.isArray(publishers)) return ""
+  const published: string[] = []
+  for (const entry of publishers) {
+    if (typeof entry !== "object" || entry === null) continue
+    const record = entry as Record<string, unknown>
+    const host = record["PublishedPort"]
+    const target = record["TargetPort"]
+    if (typeof host === "number" && host > 0 && typeof target === "number") {
+      published.push(`${host}->${target}`)
+    }
+  }
+  return [...new Set(published)].join(", ")
+}
+
+/**
+ * composeArgs is the invocation prefix every compose call needs.
+ *
+ * The compose file lives under `.supatype/self-host/`, so the project directory
+ * has to be given explicitly: without it Compose resolves relative build
+ * contexts and env files against the file's own directory rather than the
+ * project root.
+ */
+export function composeArgs(ctx: ComposeContext): string[] {
+  return ["compose", "-p", ctx.projectName, "--project-directory", ctx.projectRoot, "-f", ctx.composePath]
+}
+
+/**
+ * composeServiceNames lists the services the compose file defines.
+ *
+ * This is what `logs --service` should be validated against, not the running
+ * containers: a service that failed to start is exactly the one whose logs you
+ * want, and it has no container.
+ */
+export function composeServiceNames(ctx: ComposeContext): string[] {
+  const result = spawnSync("docker", [...composeArgs(ctx), "config", "--services"], {
+    encoding: "utf8",
+    timeout: 15_000,
+  })
+  if (result.status !== 0 || !result.stdout) return []
+  return result.stdout
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line !== "")
+    .sort()
+}

package/src/config.ts

@@ -45,7 +45,7 @@ export interface SelfHostConfig {
    */
   services?: {
     db?: ServiceVersionPin
-    gotrue?: ServiceVersionPin
+    auth?: ServiceVersionPin
     postgrest?: ServiceVersionPin
     kong?: ServiceVersionPin
     caddy?: ServiceVersionPin

package/src/dev-compose.ts

@@ -14,10 +14,12 @@ import {
   connectionString,
   projectRootFromConfig,
   resolveRuntimeProvider,
+  hooksPathFromProject,
   schemaPathFromProject,
   usesExternalDatabase,
   type SupatypeProjectConfig,
 } from "./project-config.js"
+import { syncManifestHooks, writeHooksModule } from "./model-hooks.js"
 import { signJwt } from "./jwt.js"
 import { ensureDevDbPort, ensureKongPort } from "./dev-ports.js"
 import { handleComposeProjectRename } from "./compose-rename.js"
@@ -37,11 +39,16 @@ import {
 import type { DockerBrandOptions } from "./docker-runtime.js"
 import { hasEngineOverride } from "./binary-cache.js"
 import { STUDIO_DEV_PORT, startStudioViteDevServer } from "./studio-dev-server.js"
-import { ensureLocalServerDockerImage } from "./compose-local-server-image.js"
+import {
+  ensureLocalServerDockerImage,
+  usesLocalServerImage,
+  LOCAL_SERVER_DOCKER_IMAGE,
+} from "./compose-local-server-image.js"
 import { ensureEngine, engineRequest, type DiffResult } from "./engine-client.js"
 import { writeSchemaSourcePushArtifacts, type SchemaSourcePushArtifacts } from "./schema-sources.js"
 import { readEnvValue, upsertEnvFile } from "./env-file.js"
 import {
+  devAuthenticatorPassword,
   devJwtSecret,
   devPostgresPassword,
   seedMissingDatabaseIdentity,
@@ -137,7 +144,7 @@ export async function ensureDockerDbPublishedForHostEngine(
   }
 
   const project = composeProjectName(config.project.name)
-  const kongPort = await resolveKongPort(cwd)
+  const kongPort = await resolveKongPort(cwd, project)
   const devDbPort = await resolveDevDbPort(cwd)
 
   const now = Math.floor(Date.now() / 1000)
@@ -185,8 +192,40 @@ export async function resolveHostEngineDatabaseUrl(
   return connectionString(config)
 }
 
-async function resolveKongPort(cwd: string): Promise<number> {
-  return ensureKongPort(cwd, { context: "dev" })
+/**
+ * `email.provider` and `email.smtp` for the compose server service.
+ *
+ * The native dev path has mapped these since it existed; the compose path never
+ * did, so a project that asked for smtp got the auth service's noop client and
+ * no message at all. Console is the documented default, and it at least says
+ * that a message would have been sent.
+ */
+function composeMailerEnv(config: SupatypeProjectConfig): Record<string, string> {
+  const email = config.email
+  const out: Record<string, string> = {
+    // Mailer.MailerProvider, so the doubled word is the real name.
+    SUPATYPE_MAILER_MAILER_PROVIDER: email?.provider ?? "console",
+  }
+  const smtp = email?.smtp
+  if (email?.provider !== "smtp" || smtp === undefined) return out
+
+  if (smtp.host !== undefined && smtp.host !== "") out.SUPATYPE_SMTP_HOST = smtp.host
+  if (smtp.port !== undefined) out.SUPATYPE_SMTP_PORT = String(smtp.port)
+  if (smtp.user !== undefined && smtp.user !== "") out.SUPATYPE_SMTP_USER = smtp.user
+  if (smtp.pass !== undefined && smtp.pass !== "") out.SUPATYPE_SMTP_PASS = smtp.pass
+  if (smtp.admin_email !== undefined && smtp.admin_email !== "") {
+    out.SUPATYPE_SMTP_ADMIN_EMAIL = smtp.admin_email
+  }
+  if (smtp.sender_name !== undefined && smtp.sender_name !== "") {
+    out.SUPATYPE_SMTP_SENDER_NAME = smtp.sender_name
+  }
+  return out
+}
+
+async function resolveKongPort(cwd: string, composeProject?: string): Promise<number> {
+  // The compose project is passed so an already-running stack of *this* project counts as
+  // available rather than as a collision.
+  return ensureKongPort(cwd, { context: "dev", ...(composeProject !== undefined && { composeProject }) })
 }
 
 /**
@@ -219,14 +258,13 @@ async function startComposeDatabase(
   await waitComposeHealthy(paths, cwd, timeoutMs, project)
 }
 
-function upsertDevComposeEnv(
+export function upsertDevComposeEnv(
   cwd: string,
   config: SupatypeProjectConfig,
   anonKey: string,
   serviceRoleKey: string,
   kongPort: number,
   devDbPort?: number,
-  localServerImage?: string,
 ): void {
   const apiUrl = `http://localhost:${kongPort}`
   const imagePins = composeDockerImageEnv(config)
@@ -259,9 +297,9 @@ function upsertDevComposeEnv(
     SUPATYPE_KONG_PORT: String(kongPort),
     API_EXTERNAL_URL: apiUrl,
     SITE_URL: apiUrl,
-    GOTRUE_MAILER_AUTOCONFIRM: "true",
+    SUPATYPE_MAILER_AUTOCONFIRM: "true",
+    ...composeMailerEnv(config),
     ...imagePins,
-    ...(localServerImage !== undefined && { SUPATYPE_SERVER_IMAGE: localServerImage }),
   }
   // Never for an external database: this URL describes the `db` container, which that project does
   // not have. Writing it overwrote the operator's own DATABASE_URL, the value the whole stack and
@@ -278,10 +316,25 @@ function upsertDevComposeEnv(
     updates.DATABASE_URL =
       `postgresql://${dbUser}:${devPostgresPassword(cwd)}@localhost:${devDbPort}/${dbName}?sslmode=disable`
   }
-  const removeImageKeys = COMPOSE_PINNED_IMAGE_ENV_KEYS.filter((key) => !(key in imagePins))
+  // `SUPATYPE_SERVER_IMAGE` is written here, not passed in, and it is deliberately *not* marked
+  // managed. The managed marker means "this value came from `versions` in the config and is mine to
+  // clean up when the pin goes away". The locally built image comes from `overrides`, so removing
+  // it as an unpinned managed key was wrong: any `.env` write that did not know about the local
+  // image deleted it, and compose then recreated the server from the published image.
+  const wantsLocalServer = usesLocalServerImage(cwd, config)
+  if (wantsLocalServer) updates.SUPATYPE_SERVER_IMAGE = LOCAL_SERVER_DOCKER_IMAGE
+
+  const managedImageKeys = COMPOSE_PINNED_IMAGE_ENV_KEYS.filter(
+    (key) => !(wantsLocalServer && key === "SUPATYPE_SERVER_IMAGE"),
+  )
+  const removeImageKeys = managedImageKeys.filter((key) => !(key in imagePins))
   upsertEnvFile(cwd, updates, {
     removeManaged: removeImageKeys,
-    managed: COMPOSE_PINNED_IMAGE_ENV_KEYS,
+    managed: managedImageKeys,
+    // A local image left in `.env` after the project stopped asking for one would keep pointing
+    // compose at a stale build, and it carries no marker for `removeManaged` to act on.
+    ...(!wantsLocalServer &&
+      !("SUPATYPE_SERVER_IMAGE" in imagePins) && { remove: ["SUPATYPE_SERVER_IMAGE"] }),
   })
 }
 
@@ -293,9 +346,8 @@ function ensureDevComposeEnv(
   serviceRoleKey: string,
   kongPort: number,
   devDbPort?: number,
-  localServerImage?: string,
 ): void {
-  upsertDevComposeEnv(cwd, config, anonKey, serviceRoleKey, kongPort, devDbPort, localServerImage)
+  upsertDevComposeEnv(cwd, config, anonKey, serviceRoleKey, kongPort, devDbPort)
 }
 
 async function waitComposeHealthy(paths: SelfHostComposePaths, cwd: string, maxMs: number, composeProject: string): Promise<void> {
@@ -371,21 +423,98 @@ function dumpComposeDbLogs(
   console.error(tail)
 }
 
-async function waitKongReady(kongPort: number, maxSec: number): Promise<void> {
-  const base = `http://localhost:${kongPort}`
+/**
+ * The gateway as the CLI reaches it, over IPv4.
+ *
+ * Not `localhost`. Docker publishes on `0.0.0.0`, so the IPv4 address is the one that is certainly
+ * bound, while `localhost` resolves to `::1` first on Windows and macOS. Docker Desktop does forward
+ * IPv6 through a relay, and when that relay is unhealthy it accepts the connection and then never
+ * answers, so every readiness poll hangs rather than failing.
+ *
+ * The URLs written to `.env` and printed for the operator stay on `localhost`: those are for a
+ * browser, where the name is the friendlier thing to see and the browser will fall back on its own.
+ */
+function loopbackBase(port: number): string {
+  return `http://127.0.0.1:${port}`
+}
+
+/**
+ * `fetch` with a deadline, because the built-in has none.
+ *
+ * A poll loop bounded by `maxSec` iterations is only bounded if each attempt can end. Against a
+ * socket that accepts and never responds, an un-timed `fetch` never settles, the loop never reaches
+ * its second iteration, and a wait advertised as 120 seconds runs until someone kills it. That is
+ * how `supatype push` came to hang indefinitely after reporting the schema applied.
+ */
+async function fetchWithin(url: string, ms: number, init?: RequestInit): Promise<Response> {
+  return await fetch(url, { ...init, signal: AbortSignal.timeout(ms) })
+}
+
+/**
+ * Print what the stack is doing when the gateway never comes up.
+ *
+ * A 503 through the gateway means Kong is running and something behind it is
+ * not, and until now the only thing said was that the gateway was not ready.
+ * That sends people to look at Kong, which is almost never the problem, and in
+ * CI the containers are gone by the time anything else can inspect them.
+ */
+function reportUnhealthyStack(composePath: string, cwd: string, project: string): void {
+  const capture = (args: string[]): string => {
+    const result = spawnSync("docker", ["compose", "-p", project, "--project-directory", cwd, "-f", composePath, ...args], {
+      encoding: "utf8",
+      cwd,
+    })
+    return `${result.stdout ?? ""}${result.stderr ?? ""}`.trim()
+  }
+
+  console.error("")
+  console.error("[supatype] The gateway is up but a service behind it is not. Container state:")
+  const state = capture(["ps", "-a"])
+  console.error(state === "" ? "  (no containers)" : state)
+
+  // The two the gateway health check depends on, and db because both need it.
+  for (const service of ["server", "realtime", "db"]) {
+    const logs = capture(["logs", "--no-color", "--tail", "40", service])
+    if (logs === "") continue
+    console.error("")
+    console.error(`[supatype] last 40 lines from ${service}:`)
+    console.error(logs)
+  }
+  console.error("")
+}
+
+async function waitKongReady(
+  kongPort: number,
+  maxSec: number,
+  stack?: { composePath: string; cwd: string; project: string },
+): Promise<void> {
+  const base = loopbackBase(kongPort)
+  // Remembered so the failure can name the unhealthy upstream. Blaming "the
+  // Kong gateway" sent more than one investigation after Kong when Kong was
+  // fine and a service behind it was not.
+  let lastAuth = "no response"
+  let lastRealtime = "no response"
   for (let i = 0; i < maxSec; i++) {
     try {
       const [auth, realtime] = await Promise.all([
-        fetch(`${base}/auth/v1/health`),
-        fetch(`${base}/realtime/v1/health`),
+        fetchWithin(`${base}/auth/v1/health`, 2000),
+        fetchWithin(`${base}/realtime/v1/health`, 2000),
       ])
+      lastAuth = `HTTP ${auth.status}`
+      lastRealtime = `HTTP ${realtime.status}`
       if (auth.ok && realtime.ok) return
-    } catch {
-      /* retry */
+    } catch (err) {
+      lastAuth = lastRealtime = err instanceof Error ? err.message : String(err)
     }
     await new Promise((r) => setTimeout(r, 1000))
   }
-  throw new Error(`Kong gateway at ${base} did not become ready within ${maxSec}s`)
+  if (stack !== undefined) {
+    reportUnhealthyStack(stack.composePath, stack.cwd, stack.project)
+  }
+  throw new Error(
+    `Gateway at ${base} did not become ready within ${maxSec}s ` +
+      `(auth/v1/health: ${lastAuth}, realtime/v1/health: ${lastRealtime})`,
+  )
 }
 
 /** Kong may be up while server → storage is still starting (503 or upstream errors). */
@@ -394,11 +523,11 @@ async function waitStorageApiReady(
   serviceRoleKey: string,
   maxSec: number,
 ): Promise<void> {
-  const url = `http://localhost:${kongPort}/storage/v1/bucket`
+  const url = `${loopbackBase(kongPort)}/storage/v1/bucket`
   const headers = { Authorization: `Bearer ${serviceRoleKey}` }
   for (let i = 0; i < maxSec; i++) {
     try {
-      const res = await fetch(url, { headers })
+      const res = await fetchWithin(url, 2000, { headers })
       if (res.ok) return
       const body = await res.text()
       const kongUpstreamDown = body.includes("invalid response was received from the upstream server")
@@ -421,7 +550,7 @@ async function provisionDockerStorageBuckets(
   kongPort: number,
   serviceRoleKey: string,
 ): Promise<void> {
-  await provisionBucketsFromAst(ast, `http://localhost:${kongPort}/storage/v1`, serviceRoleKey)
+  await provisionBucketsFromAst(ast, `${loopbackBase(kongPort)}/storage/v1`, serviceRoleKey)
 }
 
 let _lastPushedAst: string | null = null
@@ -441,6 +570,20 @@ async function refreshSchemaArtifacts(
   const supatypeDir = join(cwd, ".supatype")
   const adminConfigPath = join(supatypeDir, "admin-config.json")
 
+  // Before the engine gate below: these are read straight off the AST, so a push whose engine is
+  // unavailable should still leave the server the right maps. The server watches this file, so a
+  // hook or validator added to the schema takes effect without restarting the stack.
+  //
+  // `dev` used to skip both entirely, because only the `direct`/`local` push branch wrote them.
+  // Every project running on Compose therefore had a manifest with no `hooks` and no `validators`
+  // key, and the server, having nothing to call, ran neither. A hook silently not firing is bad; a
+  // validator silently not firing means a write the schema says is checked is accepted with a 201.
+  const hooksModule = writeHooksModule(cwd, hooksPathFromProject(config, cwd), ast)
+  if (hooksModule !== null) console.log(`[supatype] Hook handler types written to ${hooksModule}`)
+  if (syncManifestHooks(cwd, ast)) {
+    console.log("[supatype] Hook and validator maps written to .supatype/manifest.json")
+  }
+
   try {
     await ensureEngine()
   } catch (err) {
@@ -734,7 +877,7 @@ export async function diffSchemaDocker(cwd: string, config: SupatypeProjectConfi
     })
   }
 
-  const kongPort = await resolveKongPort(cwd)
+  const kongPort = await resolveKongPort(cwd, project)
   const now = Math.floor(Date.now() / 1000)
   const jwtBase = { iss: "supatype", iat: now, exp: now + 315_360_000 }
   const anonKey = signJwt({ ...jwtBase, role: "anon" }, devJwtSecret(cwd))
@@ -780,7 +923,7 @@ export async function pushSchemaDocker(cwd: string, config: SupatypeProjectConfi
     throw new Error("pushSchemaDocker requires provider: docker")
   }
   const project = composeProjectName(config.project.name)
-  const kongPort = await resolveKongPort(cwd)
+  const kongPort = await resolveKongPort(cwd, project)
   // No dev db port for an external database: `ensureDevDbPort` allocates a host port for the `db`
   // container *and persists a matching DATABASE_URL*, which overwrote the operator's own URL, the
   // one the whole stack and every CLI command reads.
@@ -812,7 +955,7 @@ export async function pushSchemaDocker(cwd: string, config: SupatypeProjectConfi
   if (upGateway !== 0) {
     exitComposeFailed(upGateway, "Could not start the Compose gateway stack.", pushBrand)
   }
-  await waitKongReady(kongPort, 120)
+  await waitKongReady(kongPort, 120, { composePath: paths.composePath, cwd, project })
   await waitStorageApiReady(kongPort, serviceRoleKey, 90)
   await provisionDockerStorageBuckets(ast, kongPort, serviceRoleKey)
 
@@ -831,7 +974,7 @@ export async function runDevCompose(cwd: string, config: SupatypeProjectConfig,
   // Per-project compose name + port isolate this project from any other Supatype
   // stack on the machine (own containers, volumes, network, and gateway port).
   const project = composeProjectName(config.project.name)
-  const kongPort = await resolveKongPort(cwd)
+  const kongPort = await resolveKongPort(cwd, project)
   // No dev db port for an external database: `ensureDevDbPort` allocates a host port for the `db`
   // container *and persists a matching DATABASE_URL*, which overwrote the operator's own URL, the
   // one the whole stack and every CLI command reads.
@@ -848,7 +991,7 @@ export async function runDevCompose(cwd: string, config: SupatypeProjectConfig,
   const devBrand = { intro: "Local development" }
   const localServerImage = await ensureLocalServerDockerImage(cwd, config, devBrand)
 
-  ensureDevComposeEnv(cwd, config, anonKey, serviceRoleKey, kongPort, devDbPort, localServerImage)
+  ensureDevComposeEnv(cwd, config, anonKey, serviceRoleKey, kongPort, devDbPort)
 
   console.log(`[supatype] provider docker, starting self-host Compose stack (project ${project}, gateway :${kongPort})...`)
   const paths = writeSelfHostCompose(cwd, config, { devLocal: true })
@@ -901,6 +1044,10 @@ export async function runDevCompose(cwd: string, config: SupatypeProjectConfig,
   // Settle before DDL: pg_isready can pass slightly before the instance is stable.
   await new Promise((r) => setTimeout(r, 3000))
 
+  if (!usesExternalDatabase(config)) {
+    reconcileAuthenticatorPassword(paths, cwd, project)
+  }
+
   // A: apply schema before realtime (and the rest of the stack) starts decoding WAL.
   const schemaPath = schemaPathFromProject(config, cwd)
   {
@@ -985,7 +1132,7 @@ export async function runDevCompose(cwd: string, config: SupatypeProjectConfig,
   }
 
   console.log("[supatype] Waiting for API gateway...")
-  await waitKongReady(kongPort, 120)
+  await waitKongReady(kongPort, 120, { composePath: paths.composePath, cwd, project })
   console.log("[supatype] Waiting for storage API...")
   await waitStorageApiReady(kongPort, serviceRoleKey, 90)
 
@@ -1025,7 +1172,7 @@ export async function runDevCompose(cwd: string, config: SupatypeProjectConfig,
       cwd,
       studioOverride,
       pidDir,
-      serviceRoleKey,
+      anonKey,
       proxyTarget: `http://localhost:${kongPort}`,
       viteSupatypeUrl: `http://localhost:${STUDIO_DEV_PORT}`,
       basePath: "/studio/",
@@ -1104,6 +1251,56 @@ function astHasSystemAuthRelation(ast: unknown): boolean {
   return false
 }
 
+/**
+ * Set `authenticator`'s password to the one `.env` holds, every time the stack starts.
+ *
+ * The Postgres image passwords that role from `AUTHENTICATOR_PASSWORD` in its init scripts, which
+ * run once, on an empty data directory. So the value the role actually has is whatever `.env` said
+ * the day the volume was created, and `.env` can move afterwards. When the two diverge PostgREST
+ * cannot log in, exits, and every REST request answers 502 with the real reason visible only in a
+ * container log the developer has no reason to read.
+ *
+ * Reconciling here makes `.env` the answer to what the password is, rather than the volume's
+ * birthday. It is idempotent, and it runs before the schema push so the API is already reachable by
+ * the time the stack reports ready.
+ */
+function reconcileAuthenticatorPassword(
+  paths: SelfHostComposePaths,
+  cwd: string,
+  composeProject: string,
+): void {
+  const composeDir = dirname(paths.composePath)
+  const owner = readEnvValue(cwd, "POSTGRES_USER", "supatype_admin")
+  const database = readEnvValue(cwd, "POSTGRES_DB", "supatype")
+  const result = spawnSync(
+    "docker",
+    [
+      "compose", "-p", composeProject, "-f", paths.composePath,
+      "exec", "-T",
+      "-e", `PGPASSWORD=${devPostgresPassword(cwd)}`,
+      "-e", `SUPATYPE_AUTHENTICATOR_PASSWORD=${devAuthenticatorPassword(cwd)}`,
+      "db", "psql", "-v", "ON_ERROR_STOP=1", "-U", owner, "-d", database,
+    ],
+    {
+      cwd: composeDir,
+      encoding: "utf8",
+      timeout: 10_000,
+      // `\getenv` reads the value from the container's environment, so the password is never a
+      // `docker exec` argument, which any process listing on the machine would show.
+      input: [
+        "\\getenv pw SUPATYPE_AUTHENTICATOR_PASSWORD",
+        "ALTER ROLE authenticator WITH LOGIN PASSWORD :'pw';",
+        "",
+      ].join("\n"),
+    },
+  )
+  if (result.status !== 0) {
+    console.warn(
+      "[supatype] Could not set the authenticator password; the REST API may answer 502.",
+    )
+  }
+}
+
 function grantAuthSchemaAccess(
   paths: SelfHostComposePaths,
   cwd: string,

package/src/dev-ports.ts

@@ -4,6 +4,7 @@
  * availability so multiple projects and port collisions are surfaced clearly.
  */
 
+import { spawnSync } from "node:child_process"
 import { CLACK_CANCEL, isCancel, p } from "./ui/clack.js"
 import { COMPOSE_DEV_KONG_PORT } from "./project-config.js"
 import { isPortInUse } from "./postgres-ctl.js"
@@ -14,6 +15,41 @@ import { fatalError } from "./ui/fatal.js"
 const MIN_PORT = 1024
 const MAX_PORT = 65535
 
+/**
+ * Which compose project publishes a host port, from `docker ps` output.
+ *
+ * Separated from the spawn so the decision is testable: the question "is this port held by my own
+ * stack" is the whole point of the check, and a check that can only be exercised by starting Docker
+ * is a check nobody exercises.
+ *
+ * Docker prints one line per matching container, and a container with no compose label prints an
+ * empty line. Any line naming a different project means someone else holds the port.
+ */
+export function composeProjectOwnsPort(dockerPsOutput: string, project: string): boolean {
+  const owners = dockerPsOutput
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0)
+  return owners.length > 0 && owners.every((owner) => owner === project)
+}
+
+/**
+ * True when the container publishing `port` belongs to this project's compose stack.
+ *
+ * Asks Docker rather than probing the port over HTTP. A health check would answer just as happily
+ * for a *different* project's gateway on the same port, and proceeding there would push a schema
+ * into the wrong database. Refusing is the safe answer for a stranger; only our own stack is fine.
+ */
+export function portHeldByComposeProject(port: number, project: string): boolean {
+  const result = spawnSync(
+    "docker",
+    ["ps", "--filter", `publish=${port}`, "--format", '{{.Label "com.docker.compose.project"}}'],
+    { encoding: "utf8" },
+  )
+  if (result.status !== 0 || typeof result.stdout !== "string") return false
+  return composeProjectOwnsPort(result.stdout, project)
+}
+
 export function isValidHostPort(port: number): boolean {
   return Number.isInteger(port) && port >= MIN_PORT && port <= MAX_PORT
 }
@@ -62,6 +98,11 @@ export interface EnsureKongPortOptions {
   interactive?: boolean
   /** init wizard: slightly different copy */
   context?: "dev" | "init"
+  /**
+   * Compose project for this directory. When given, a port published by that project is accepted
+   * rather than refused: that is this project's own stack, not a stranger's.
+   */
+  composeProject?: string
 }
 
 /**
@@ -81,6 +122,13 @@ export async function ensureKongPort(
   if (persisted !== null) {
     if (!(await isPortInUse(persisted))) return persisted
 
+    // Occupied by this project's own stack is not a conflict, it is the normal state after
+    // `supatype self-host compose up -d`. Refusing here made a hand-run `up -d` followed by
+    // `push` impossible, and it stopped the validation soak, which does exactly that.
+    if (opts.composeProject !== undefined && portHeldByComposeProject(persisted, opts.composeProject)) {
+      return persisted
+    }
+
     if (!interactive) {
       fatalError(`Port ${persisted} is already in use (SUPATYPE_KONG_PORT in .env).`, [
         "Stop the other service or set a different SUPATYPE_KONG_PORT.",