@supatype/cli 0.1.12 → 0.2.0

package/dist/compose-services.js

@@ -0,0 +1,160 @@
+/**
+ * What the local stack is actually running, asked of Docker rather than guessed.
+ *
+ * `status` and `logs` each used to carry a hardcoded list of container names.
+ * Both lists were wrong: they named containers the compose file does not create
+ * (`supatype-postgres`, `supatype-kong`), omitted every service it does create
+ * (`server`, `storage`, `functions-worker`, `schema-engine`, `valkey`), and used
+ * a naming scheme the compose file never applies, since it sets no
+ * `container_name` and Docker therefore names containers
+ * `<project>-<service>-<n>`.
+ *
+ * A list of services in the source is a list that goes stale the next time the
+ * stack changes shape. `docker compose ps` cannot.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { loadConfig } from "./config.js";
+import { composeProjectName, selfHostComposePaths } from "./self-host-compose.js";
+/**
+ * composeContext locates the generated compose file for this project.
+ *
+ * Returns undefined when the stack has never been generated, which is the
+ * ordinary case in a project that only uses `supatype dev`.
+ */
+export function composeContext(cwd) {
+    const paths = selfHostComposePaths(cwd);
+    if (!existsSync(paths.composePath))
+        return undefined;
+    let projectName = "supatype";
+    try {
+        const config = loadConfig(cwd);
+        if (config)
+            projectName = composeProjectName(config.project.name);
+    }
+    catch {
+        // A project whose config will not load can still have a running stack, and
+        // reporting on it is more useful than refusing to.
+    }
+    return { composePath: paths.composePath, projectRoot: cwd, projectName };
+}
+/**
+ * composeServices asks Docker what the stack is running.
+ *
+ * `--all` so a stopped service is reported as stopped rather than vanishing,
+ * which is the question `supatype status` is usually asked.
+ */
+export function composeServices(ctx) {
+    const result = spawnSync("docker", [...composeArgs(ctx), "ps", "--all", "--format", "json"], {
+        encoding: "utf8",
+        timeout: 15_000,
+    });
+    if (result.status !== 0 || !result.stdout)
+        return [];
+    return parseComposePs(result.stdout);
+}
+/**
+ * parseComposePs reads `docker compose ps --format json`.
+ *
+ * Compose v2 emits one JSON object per line; some versions emit a single JSON
+ * array instead. Both are accepted, because which one you get depends on the
+ * Docker version the developer happens to have.
+ */
+export function parseComposePs(stdout) {
+    const trimmed = stdout.trim();
+    if (trimmed === "")
+        return [];
+    const rows = [];
+    if (trimmed.startsWith("[")) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (Array.isArray(parsed))
+                rows.push(...parsed);
+        }
+        catch {
+            return [];
+        }
+    }
+    else {
+        for (const line of trimmed.split("\n")) {
+            if (line.trim() === "")
+                continue;
+            try {
+                rows.push(JSON.parse(line));
+            }
+            catch {
+                // A line that is not JSON is progress noise, not a service.
+            }
+        }
+    }
+    const services = [];
+    for (const row of rows) {
+        if (typeof row !== "object" || row === null)
+            continue;
+        const record = row;
+        const service = typeof record["Service"] === "string" ? record["Service"] : "";
+        if (service === "")
+            continue;
+        services.push({
+            service,
+            container: typeof record["Name"] === "string" ? record["Name"] : "",
+            state: typeof record["State"] === "string" ? record["State"] : "unknown",
+            ports: typeof record["Publishers"] === "string" ? record["Publishers"] : formatPorts(record["Publishers"]),
+            status: typeof record["Status"] === "string" ? record["Status"] : "",
+        });
+    }
+    services.sort((a, b) => a.service.localeCompare(b.service));
+    return services;
+}
+/**
+ * formatPorts renders the structured Publishers array Compose emits, keeping
+ * only the ports actually reachable from the host.
+ */
+function formatPorts(publishers) {
+    if (!Array.isArray(publishers))
+        return "";
+    const published = [];
+    for (const entry of publishers) {
+        if (typeof entry !== "object" || entry === null)
+            continue;
+        const record = entry;
+        const host = record["PublishedPort"];
+        const target = record["TargetPort"];
+        if (typeof host === "number" && host > 0 && typeof target === "number") {
+            published.push(`${host}->${target}`);
+        }
+    }
+    return [...new Set(published)].join(", ");
+}
+/**
+ * composeArgs is the invocation prefix every compose call needs.
+ *
+ * The compose file lives under `.supatype/self-host/`, so the project directory
+ * has to be given explicitly: without it Compose resolves relative build
+ * contexts and env files against the file's own directory rather than the
+ * project root.
+ */
+export function composeArgs(ctx) {
+    return ["compose", "-p", ctx.projectName, "--project-directory", ctx.projectRoot, "-f", ctx.composePath];
+}
+/**
+ * composeServiceNames lists the services the compose file defines.
+ *
+ * This is what `logs --service` should be validated against, not the running
+ * containers: a service that failed to start is exactly the one whose logs you
+ * want, and it has no container.
+ */
+export function composeServiceNames(ctx) {
+    const result = spawnSync("docker", [...composeArgs(ctx), "config", "--services"], {
+        encoding: "utf8",
+        timeout: 15_000,
+    });
+    if (result.status !== 0 || !result.stdout)
+        return [];
+    return result.stdout
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line !== "")
+        .sort();
+}
+//# sourceMappingURL=compose-services.js.map

package/dist/compose-services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose-services.js","sourceRoot":"","sources":["../src/compose-services.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAuBjF;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAA;IAEpD,IAAI,WAAW,GAAG,UAAU,CAAA;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,MAAM;YAAE,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,mDAAmD;IACrD,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAmB;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;QAC3F,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACpD,OAAO,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;IAC7B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAE7B,MAAM,IAAI,GAAc,EAAE,CAAA;IAC1B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,SAAQ;YAChC,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAqB,EAAE,CAAA;IACrC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,SAAQ;QACrD,MAAM,MAAM,GAAG,GAA8B,CAAA;QAC7C,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC9E,IAAI,OAAO,KAAK,EAAE;YAAE,SAAQ;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO;YACP,SAAS,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;YACnE,KAAK,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YACxE,KAAK,EAAE,OAAO,MAAM,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1G,MAAM,EAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;SACrE,CAAC,CAAA;IACJ,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;IAC3D,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,UAAmB;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAA;IACzC,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAQ;QACzD,MAAM,MAAM,GAAG,KAAgC,CAAA;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;QACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACvE,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAmB;IAC7C,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,qBAAqB,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;AAC1G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAmB;IACrD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE;QAChF,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACpD,OAAO,MAAM,CAAC,MAAM;SACjB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;SAC7B,IAAI,EAAE,CAAA;AACX,CAAC"}

package/dist/config.d.ts

@@ -30,7 +30,7 @@ export interface SelfHostConfig {
      */
     services?: {
         db?: ServiceVersionPin;
-        gotrue?: ServiceVersionPin;
+        auth?: ServiceVersionPin;
         postgrest?: ServiceVersionPin;
         kong?: ServiceVersionPin;
         caddy?: ServiceVersionPin;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAE9D,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAEhE,+EAA+E;AAC/E,MAAM,MAAM,cAAc,GAAG,qBAAqB,CAAA;AAElD,MAAM,WAAW,iBAAiB;IAChC,iHAAiH;IACjH,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAA;IACd,sDAAsD;IACtD,GAAG,CAAC,EAAE;QACJ,kEAAkE;QAClE,UAAU,EAAE,MAAM,CAAA;QAClB,+BAA+B;QAC/B,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,gFAAgF;QAChF,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAA;QAC1B,+EAA+E;QAC/E,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QACT,EAAE,CAAC,EAAE,iBAAiB,CAAA;QACtB,MAAM,CAAC,EAAE,iBAAiB,CAAA;QAC1B,SAAS,CAAC,EAAE,iBAAiB,CAAA;QAC7B,IAAI,CAAC,EAAE,iBAAiB,CAAA;QACxB,KAAK,CAAC,EAAE,iBAAiB,CAAA;QACzB,SAAS,CAAC,EAAE,iBAAiB,CAAA;KAC9B,CAAA;CACF;AAED,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,WAAW,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,CAAA;AAEtG,MAAM,WAAW,SAAS;IACxB,wEAAwE;IACxE,SAAS,CAAC,EAAE,YAAY,CAAA;IACxB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,MAAM,EAAE,qBAAqB,GAAG,qBAAqB,CAEjF;AAiCD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAsB,GAAG,qBAAqB,CA+B7E;AAcD;;;;;;;;;GASG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;gBAEf,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAK/C;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAExD;AAqED,2EAA2E;AAC3E,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAsB,GAC1B,oBAAoB,CActB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAE9D,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAEhE,+EAA+E;AAC/E,MAAM,MAAM,cAAc,GAAG,qBAAqB,CAAA;AAElD,MAAM,WAAW,iBAAiB;IAChC,iHAAiH;IACjH,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAA;IACd,sDAAsD;IACtD,GAAG,CAAC,EAAE;QACJ,kEAAkE;QAClE,UAAU,EAAE,MAAM,CAAA;QAClB,+BAA+B;QAC/B,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,gFAAgF;QAChF,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAA;QAC1B,+EAA+E;QAC/E,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QACT,EAAE,CAAC,EAAE,iBAAiB,CAAA;QACtB,IAAI,CAAC,EAAE,iBAAiB,CAAA;QACxB,SAAS,CAAC,EAAE,iBAAiB,CAAA;QAC7B,IAAI,CAAC,EAAE,iBAAiB,CAAA;QACxB,KAAK,CAAC,EAAE,iBAAiB,CAAA;QACzB,SAAS,CAAC,EAAE,iBAAiB,CAAA;KAC9B,CAAA;CACF;AAED,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,WAAW,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,CAAA;AAEtG,MAAM,WAAW,SAAS;IACxB,wEAAwE;IACxE,SAAS,CAAC,EAAE,YAAY,CAAA;IACxB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,MAAM,EAAE,qBAAqB,GAAG,qBAAqB,CAEjF;AAiCD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAsB,GAAG,qBAAqB,CA+B7E;AAcD;;;;;;;;;GASG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;gBAEf,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAK/C;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAExD;AAqED,2EAA2E;AAC3E,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAsB,GAC1B,oBAAoB,CActB"}

package/dist/dev-compose.d.ts

@@ -27,6 +27,7 @@ export declare function usesLocalDockerEngineDb(config: SupatypeProjectConfig, e
  * Remote self-host → set `connection` in config or pass `--connection`.
  */
 export declare function resolveHostEngineDatabaseUrl(cwd: string, config: SupatypeProjectConfig, explicit?: string): Promise<string>;
+export declare function upsertDevComposeEnv(cwd: string, config: SupatypeProjectConfig, anonKey: string, serviceRoleKey: string, kongPort: number, devDbPort?: number): void;
 /**
  * `supatype diff` when `provider: docker`. Uses in-compose schema-engine unless
  * `overrides.engine` is set: then Postgres is published to the host and diff runs

package/dist/dev-compose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-compose.d.ts","sourceRoot":"","sources":["../src/dev-compose.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,OAAO,EAOL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAA;AAiB5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAI7D,OAAO,EAA+B,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAA;AA2BjF,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,GAAG,IAAI,CASrF;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAA;CACf;AAED,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIhD;AA+BD;;;GAGG;AACH,wBAAsB,oCAAoC,CACxD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,qBAAqB,EAC7B,KAAK,CAAC,EAAE,kBAAkB,GACzB,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAOT;AAED;;;;GAIG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAQjB;AA8gBD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAsDtG;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8ChG;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2QtH"}
+{"version":3,"file":"dev-compose.d.ts","sourceRoot":"","sources":["../src/dev-compose.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,OAAO,EAQL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAA;AAkB5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAQ7D,OAAO,EAA+B,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAA;AA4BjF,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,GAAG,IAAI,CASrF;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAA;CACf;AAED,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIhD;AA+BD;;;GAGG;AACH,wBAAsB,oCAAoC,CACxD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,qBAAqB,EAC7B,KAAK,CAAC,EAAE,kBAAkB,GACzB,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAOT;AAED;;;;GAIG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAoED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI,CAuEN;AAogBD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAsDtG;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8ChG;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+QtH"}

package/dist/dev-compose.js

@@ -8,7 +8,8 @@ import { spawnSync } from "node:child_process";
 import { startProxyDevApp, resolveProxyDevScript } from "./app/proxy-dev-app.js";
 import { loadSchemaAst } from "./config.js";
 import { withComposeSchemaPushLock } from "./schema-push-lock.js";
-import { connectionString, projectRootFromConfig, resolveRuntimeProvider, schemaPathFromProject, usesExternalDatabase, } from "./project-config.js";
+import { connectionString, projectRootFromConfig, resolveRuntimeProvider, hooksPathFromProject, schemaPathFromProject, usesExternalDatabase, } from "./project-config.js";
+import { syncManifestHooks, writeHooksModule } from "./model-hooks.js";
 import { signJwt } from "./jwt.js";
 import { ensureDevDbPort, ensureKongPort } from "./dev-ports.js";
 import { handleComposeProjectRename } from "./compose-rename.js";
@@ -18,11 +19,11 @@ import { ensureDevApiConfig } from "./ensure-dev-api-config.js";
 import { COMPOSE_PINNED_IMAGE_ENV_KEYS, composeDockerImageEnv, composeProjectName, exitComposeFailed, runDockerCompose, schemaEngineImageForPush, writeSelfHostCompose, } from "./self-host-compose.js";
 import { hasEngineOverride } from "./binary-cache.js";
 import { STUDIO_DEV_PORT, startStudioViteDevServer } from "./studio-dev-server.js";
-import { ensureLocalServerDockerImage } from "./compose-local-server-image.js";
+import { ensureLocalServerDockerImage, usesLocalServerImage, LOCAL_SERVER_DOCKER_IMAGE, } from "./compose-local-server-image.js";
 import { ensureEngine, engineRequest } from "./engine-client.js";
 import { writeSchemaSourcePushArtifacts } from "./schema-sources.js";
 import { readEnvValue, upsertEnvFile } from "./env-file.js";
-import { devJwtSecret, devPostgresPassword, seedMissingDatabaseIdentity, seedMissingLocalSecrets, } from "./local-secrets.js";
+import { devAuthenticatorPassword, devJwtSecret, devPostgresPassword, seedMissingDatabaseIdentity, seedMissingLocalSecrets, } from "./local-secrets.js";
 import { writeLocalEnvironment } from "./link.js";
 import { registerDevShutdown } from "./dev-shutdown.js";
 import { filterComposeNoise, formatEnginePushMessage, parseEngineJsonOutput, parseEnginePushOutput, } from "./engine-push-output.js";
@@ -90,7 +91,7 @@ export async function ensureDockerDbPublishedForHostEngine(cwd, config, brand) {
             "Set overrides.engine in supatype.local.config.ts or pass --connection.");
     }
     const project = composeProjectName(config.project.name);
-    const kongPort = await resolveKongPort(cwd);
+    const kongPort = await resolveKongPort(cwd, project);
     const devDbPort = await resolveDevDbPort(cwd);
     const now = Math.floor(Date.now() / 1000);
     const jwtBase = { iss: "supatype", iat: now, exp: now + 315_360_000 };
@@ -131,8 +132,43 @@ export async function resolveHostEngineDatabaseUrl(cwd, config, explicit) {
     }
     return connectionString(config);
 }
-async function resolveKongPort(cwd) {
-    return ensureKongPort(cwd, { context: "dev" });
+/**
+ * `email.provider` and `email.smtp` for the compose server service.
+ *
+ * The native dev path has mapped these since it existed; the compose path never
+ * did, so a project that asked for smtp got the auth service's noop client and
+ * no message at all. Console is the documented default, and it at least says
+ * that a message would have been sent.
+ */
+function composeMailerEnv(config) {
+    const email = config.email;
+    const out = {
+        // Mailer.MailerProvider, so the doubled word is the real name.
+        SUPATYPE_MAILER_MAILER_PROVIDER: email?.provider ?? "console",
+    };
+    const smtp = email?.smtp;
+    if (email?.provider !== "smtp" || smtp === undefined)
+        return out;
+    if (smtp.host !== undefined && smtp.host !== "")
+        out.SUPATYPE_SMTP_HOST = smtp.host;
+    if (smtp.port !== undefined)
+        out.SUPATYPE_SMTP_PORT = String(smtp.port);
+    if (smtp.user !== undefined && smtp.user !== "")
+        out.SUPATYPE_SMTP_USER = smtp.user;
+    if (smtp.pass !== undefined && smtp.pass !== "")
+        out.SUPATYPE_SMTP_PASS = smtp.pass;
+    if (smtp.admin_email !== undefined && smtp.admin_email !== "") {
+        out.SUPATYPE_SMTP_ADMIN_EMAIL = smtp.admin_email;
+    }
+    if (smtp.sender_name !== undefined && smtp.sender_name !== "") {
+        out.SUPATYPE_SMTP_SENDER_NAME = smtp.sender_name;
+    }
+    return out;
+}
+async function resolveKongPort(cwd, composeProject) {
+    // The compose project is passed so an already-running stack of *this* project counts as
+    // available rather than as a collision.
+    return ensureKongPort(cwd, { context: "dev", ...(composeProject !== undefined && { composeProject }) });
 }
 /**
  * Bring up the compose `db` service and wait for it to answer.
@@ -155,7 +191,7 @@ async function startComposeDatabase(config, paths, cwd, project, brand, timeoutM
     }
     await waitComposeHealthy(paths, cwd, timeoutMs, project);
 }
-function upsertDevComposeEnv(cwd, config, anonKey, serviceRoleKey, kongPort, devDbPort, localServerImage) {
+export function upsertDevComposeEnv(cwd, config, anonKey, serviceRoleKey, kongPort, devDbPort) {
     const apiUrl = `http://localhost:${kongPort}`;
     const imagePins = composeDockerImageEnv(config);
     // `POSTGRES_PASSWORD` and `JWT_SECRET` are deliberately absent.
@@ -187,9 +223,9 @@ function upsertDevComposeEnv(cwd, config, anonKey, serviceRoleKey, kongPort, dev
         SUPATYPE_KONG_PORT: String(kongPort),
         API_EXTERNAL_URL: apiUrl,
         SITE_URL: apiUrl,
-        GOTRUE_MAILER_AUTOCONFIRM: "true",
+        SUPATYPE_MAILER_AUTOCONFIRM: "true",
+        ...composeMailerEnv(config),
         ...imagePins,
-        ...(localServerImage !== undefined && { SUPATYPE_SERVER_IMAGE: localServerImage }),
     };
     // Never for an external database: this URL describes the `db` container, which that project does
     // not have. Writing it overwrote the operator's own DATABASE_URL, the value the whole stack and
@@ -206,15 +242,28 @@ function upsertDevComposeEnv(cwd, config, anonKey, serviceRoleKey, kongPort, dev
         updates.DATABASE_URL =
             `postgresql://${dbUser}:${devPostgresPassword(cwd)}@localhost:${devDbPort}/${dbName}?sslmode=disable`;
     }
-    const removeImageKeys = COMPOSE_PINNED_IMAGE_ENV_KEYS.filter((key) => !(key in imagePins));
+    // `SUPATYPE_SERVER_IMAGE` is written here, not passed in, and it is deliberately *not* marked
+    // managed. The managed marker means "this value came from `versions` in the config and is mine to
+    // clean up when the pin goes away". The locally built image comes from `overrides`, so removing
+    // it as an unpinned managed key was wrong: any `.env` write that did not know about the local
+    // image deleted it, and compose then recreated the server from the published image.
+    const wantsLocalServer = usesLocalServerImage(cwd, config);
+    if (wantsLocalServer)
+        updates.SUPATYPE_SERVER_IMAGE = LOCAL_SERVER_DOCKER_IMAGE;
+    const managedImageKeys = COMPOSE_PINNED_IMAGE_ENV_KEYS.filter((key) => !(wantsLocalServer && key === "SUPATYPE_SERVER_IMAGE"));
+    const removeImageKeys = managedImageKeys.filter((key) => !(key in imagePins));
     upsertEnvFile(cwd, updates, {
         removeManaged: removeImageKeys,
-        managed: COMPOSE_PINNED_IMAGE_ENV_KEYS,
+        managed: managedImageKeys,
+        // A local image left in `.env` after the project stopped asking for one would keep pointing
+        // compose at a stale build, and it carries no marker for `removeManaged` to act on.
+        ...(!wantsLocalServer &&
+            !("SUPATYPE_SERVER_IMAGE" in imagePins) && { remove: ["SUPATYPE_SERVER_IMAGE"] }),
     });
 }
 /** Keep compose + Studio on the same freshly signed dev JWTs; sync optional image pins from config. */
-function ensureDevComposeEnv(cwd, config, anonKey, serviceRoleKey, kongPort, devDbPort, localServerImage) {
-    upsertDevComposeEnv(cwd, config, anonKey, serviceRoleKey, kongPort, devDbPort, localServerImage);
+function ensureDevComposeEnv(cwd, config, anonKey, serviceRoleKey, kongPort, devDbPort) {
+    upsertDevComposeEnv(cwd, config, anonKey, serviceRoleKey, kongPort, devDbPort);
 }
 async function waitComposeHealthy(paths, cwd, maxMs, composeProject) {
     const composeDir = dirname(paths.composePath);
@@ -273,31 +322,98 @@ function dumpComposeDbLogs(paths, cwd, composeProject, reason) {
     console.error(`[supatype] Postgres logs after ${reason} (saved ${logPath}):`);
     console.error(tail);
 }
-async function waitKongReady(kongPort, maxSec) {
-    const base = `http://localhost:${kongPort}`;
+/**
+ * The gateway as the CLI reaches it, over IPv4.
+ *
+ * Not `localhost`. Docker publishes on `0.0.0.0`, so the IPv4 address is the one that is certainly
+ * bound, while `localhost` resolves to `::1` first on Windows and macOS. Docker Desktop does forward
+ * IPv6 through a relay, and when that relay is unhealthy it accepts the connection and then never
+ * answers, so every readiness poll hangs rather than failing.
+ *
+ * The URLs written to `.env` and printed for the operator stay on `localhost`: those are for a
+ * browser, where the name is the friendlier thing to see and the browser will fall back on its own.
+ */
+function loopbackBase(port) {
+    return `http://127.0.0.1:${port}`;
+}
+/**
+ * `fetch` with a deadline, because the built-in has none.
+ *
+ * A poll loop bounded by `maxSec` iterations is only bounded if each attempt can end. Against a
+ * socket that accepts and never responds, an un-timed `fetch` never settles, the loop never reaches
+ * its second iteration, and a wait advertised as 120 seconds runs until someone kills it. That is
+ * how `supatype push` came to hang indefinitely after reporting the schema applied.
+ */
+async function fetchWithin(url, ms, init) {
+    return await fetch(url, { ...init, signal: AbortSignal.timeout(ms) });
+}
+/**
+ * Print what the stack is doing when the gateway never comes up.
+ *
+ * A 503 through the gateway means Kong is running and something behind it is
+ * not, and until now the only thing said was that the gateway was not ready.
+ * That sends people to look at Kong, which is almost never the problem, and in
+ * CI the containers are gone by the time anything else can inspect them.
+ */
+function reportUnhealthyStack(composePath, cwd, project) {
+    const capture = (args) => {
+        const result = spawnSync("docker", ["compose", "-p", project, "--project-directory", cwd, "-f", composePath, ...args], {
+            encoding: "utf8",
+            cwd,
+        });
+        return `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
+    };
+    console.error("");
+    console.error("[supatype] The gateway is up but a service behind it is not. Container state:");
+    const state = capture(["ps", "-a"]);
+    console.error(state === "" ? "  (no containers)" : state);
+    // The two the gateway health check depends on, and db because both need it.
+    for (const service of ["server", "realtime", "db"]) {
+        const logs = capture(["logs", "--no-color", "--tail", "40", service]);
+        if (logs === "")
+            continue;
+        console.error("");
+        console.error(`[supatype] last 40 lines from ${service}:`);
+        console.error(logs);
+    }
+    console.error("");
+}
+async function waitKongReady(kongPort, maxSec, stack) {
+    const base = loopbackBase(kongPort);
+    // Remembered so the failure can name the unhealthy upstream. Blaming "the
+    // Kong gateway" sent more than one investigation after Kong when Kong was
+    // fine and a service behind it was not.
+    let lastAuth = "no response";
+    let lastRealtime = "no response";
     for (let i = 0; i < maxSec; i++) {
         try {
             const [auth, realtime] = await Promise.all([
-                fetch(`${base}/auth/v1/health`),
-                fetch(`${base}/realtime/v1/health`),
+                fetchWithin(`${base}/auth/v1/health`, 2000),
+                fetchWithin(`${base}/realtime/v1/health`, 2000),
             ]);
+            lastAuth = `HTTP ${auth.status}`;
+            lastRealtime = `HTTP ${realtime.status}`;
             if (auth.ok && realtime.ok)
                 return;
         }
-        catch {
-            /* retry */
+        catch (err) {
+            lastAuth = lastRealtime = err instanceof Error ? err.message : String(err);
         }
         await new Promise((r) => setTimeout(r, 1000));
     }
-    throw new Error(`Kong gateway at ${base} did not become ready within ${maxSec}s`);
+    if (stack !== undefined) {
+        reportUnhealthyStack(stack.composePath, stack.cwd, stack.project);
+    }
+    throw new Error(`Gateway at ${base} did not become ready within ${maxSec}s ` +
+        `(auth/v1/health: ${lastAuth}, realtime/v1/health: ${lastRealtime})`);
 }
 /** Kong may be up while server → storage is still starting (503 or upstream errors). */
 async function waitStorageApiReady(kongPort, serviceRoleKey, maxSec) {
-    const url = `http://localhost:${kongPort}/storage/v1/bucket`;
+    const url = `${loopbackBase(kongPort)}/storage/v1/bucket`;
     const headers = { Authorization: `Bearer ${serviceRoleKey}` };
     for (let i = 0; i < maxSec; i++) {
         try {
-            const res = await fetch(url, { headers });
+            const res = await fetchWithin(url, 2000, { headers });
             if (res.ok)
                 return;
             const body = await res.text();
@@ -315,7 +431,7 @@ async function waitStorageApiReady(kongPort, serviceRoleKey, maxSec) {
     console.warn(`[supatype] Storage API at ${url} did not become ready within ${maxSec}s, bucket provisioning may fail.`);
 }
 async function provisionDockerStorageBuckets(ast, kongPort, serviceRoleKey) {
-    await provisionBucketsFromAst(ast, `http://localhost:${kongPort}/storage/v1`, serviceRoleKey);
+    await provisionBucketsFromAst(ast, `${loopbackBase(kongPort)}/storage/v1`, serviceRoleKey);
 }
 let _lastPushedAst = null;
 let _lastFailedAst = null;
@@ -328,6 +444,20 @@ let _composePushQueued = false;
 async function refreshSchemaArtifacts(cwd, config, ast) {
     const supatypeDir = join(cwd, ".supatype");
     const adminConfigPath = join(supatypeDir, "admin-config.json");
+    // Before the engine gate below: these are read straight off the AST, so a push whose engine is
+    // unavailable should still leave the server the right maps. The server watches this file, so a
+    // hook or validator added to the schema takes effect without restarting the stack.
+    //
+    // `dev` used to skip both entirely, because only the `direct`/`local` push branch wrote them.
+    // Every project running on Compose therefore had a manifest with no `hooks` and no `validators`
+    // key, and the server, having nothing to call, ran neither. A hook silently not firing is bad; a
+    // validator silently not firing means a write the schema says is checked is accepted with a 201.
+    const hooksModule = writeHooksModule(cwd, hooksPathFromProject(config, cwd), ast);
+    if (hooksModule !== null)
+        console.log(`[supatype] Hook handler types written to ${hooksModule}`);
+    if (syncManifestHooks(cwd, ast)) {
+        console.log("[supatype] Hook and validator maps written to .supatype/manifest.json");
+    }
     try {
         await ensureEngine();
     }
@@ -554,7 +684,7 @@ export async function diffSchemaDocker(cwd, config) {
             schema: pgSchema,
         });
     }
-    const kongPort = await resolveKongPort(cwd);
+    const kongPort = await resolveKongPort(cwd, project);
     const now = Math.floor(Date.now() / 1000);
     const jwtBase = { iss: "supatype", iat: now, exp: now + 315_360_000 };
     const anonKey = signJwt({ ...jwtBase, role: "anon" }, devJwtSecret(cwd));
@@ -594,7 +724,7 @@ export async function pushSchemaDocker(cwd, config) {
         throw new Error("pushSchemaDocker requires provider: docker");
     }
     const project = composeProjectName(config.project.name);
-    const kongPort = await resolveKongPort(cwd);
+    const kongPort = await resolveKongPort(cwd, project);
     // No dev db port for an external database: `ensureDevDbPort` allocates a host port for the `db`
     // container *and persists a matching DATABASE_URL*, which overwrote the operator's own URL, the
     // one the whole stack and every CLI command reads.
@@ -620,7 +750,7 @@ export async function pushSchemaDocker(cwd, config) {
     if (upGateway !== 0) {
         exitComposeFailed(upGateway, "Could not start the Compose gateway stack.", pushBrand);
     }
-    await waitKongReady(kongPort, 120);
+    await waitKongReady(kongPort, 120, { composePath: paths.composePath, cwd, project });
     await waitStorageApiReady(kongPort, serviceRoleKey, 90);
     await provisionDockerStorageBuckets(ast, kongPort, serviceRoleKey);
     await ensureFirstAdminUserForProject(cwd, config, {
@@ -635,7 +765,7 @@ export async function runDevCompose(cwd, config, opts) {
     // Per-project compose name + port isolate this project from any other Supatype
     // stack on the machine (own containers, volumes, network, and gateway port).
     const project = composeProjectName(config.project.name);
-    const kongPort = await resolveKongPort(cwd);
+    const kongPort = await resolveKongPort(cwd, project);
     // No dev db port for an external database: `ensureDevDbPort` allocates a host port for the `db`
     // container *and persists a matching DATABASE_URL*, which overwrote the operator's own URL, the
     // one the whole stack and every CLI command reads.
@@ -648,7 +778,7 @@ export async function runDevCompose(cwd, config, opts) {
     const serviceRoleKey = signJwt({ ...jwtBase, role: "service_role" }, devJwtSecret(cwd));
     const devBrand = { intro: "Local development" };
     const localServerImage = await ensureLocalServerDockerImage(cwd, config, devBrand);
-    ensureDevComposeEnv(cwd, config, anonKey, serviceRoleKey, kongPort, devDbPort, localServerImage);
+    ensureDevComposeEnv(cwd, config, anonKey, serviceRoleKey, kongPort, devDbPort);
     console.log(`[supatype] provider docker, starting self-host Compose stack (project ${project}, gateway :${kongPort})...`);
     const paths = writeSelfHostCompose(cwd, config, { devLocal: true });
     if (ensureDevApiConfig(cwd)) {
@@ -689,6 +819,9 @@ export async function runDevCompose(cwd, config, opts) {
     await startComposeDatabase(config, paths, cwd, project, devBrand, 180_000, endDevSession);
     // Settle before DDL: pg_isready can pass slightly before the instance is stable.
     await new Promise((r) => setTimeout(r, 3000));
+    if (!usesExternalDatabase(config)) {
+        reconcileAuthenticatorPassword(paths, cwd, project);
+    }
     // A: apply schema before realtime (and the rest of the stack) starts decoding WAL.
     const schemaPath = schemaPathFromProject(config, cwd);
     {
@@ -753,7 +886,7 @@ export async function runDevCompose(cwd, config, opts) {
         }
     }
     console.log("[supatype] Waiting for API gateway...");
-    await waitKongReady(kongPort, 120);
+    await waitKongReady(kongPort, 120, { composePath: paths.composePath, cwd, project });
     console.log("[supatype] Waiting for storage API...");
     await waitStorageApiReady(kongPort, serviceRoleKey, 90);
     await ensureFirstAdminUserForProject(cwd, config, {
@@ -786,7 +919,7 @@ export async function runDevCompose(cwd, config, opts) {
             cwd,
             studioOverride,
             pidDir,
-            serviceRoleKey,
+            anonKey,
             proxyTarget: `http://localhost:${kongPort}`,
             viteSupatypeUrl: `http://localhost:${STUDIO_DEV_PORT}`,
             basePath: "/studio/",
@@ -858,6 +991,45 @@ function astHasSystemAuthRelation(ast) {
     }
     return false;
 }
+/**
+ * Set `authenticator`'s password to the one `.env` holds, every time the stack starts.
+ *
+ * The Postgres image passwords that role from `AUTHENTICATOR_PASSWORD` in its init scripts, which
+ * run once, on an empty data directory. So the value the role actually has is whatever `.env` said
+ * the day the volume was created, and `.env` can move afterwards. When the two diverge PostgREST
+ * cannot log in, exits, and every REST request answers 502 with the real reason visible only in a
+ * container log the developer has no reason to read.
+ *
+ * Reconciling here makes `.env` the answer to what the password is, rather than the volume's
+ * birthday. It is idempotent, and it runs before the schema push so the API is already reachable by
+ * the time the stack reports ready.
+ */
+function reconcileAuthenticatorPassword(paths, cwd, composeProject) {
+    const composeDir = dirname(paths.composePath);
+    const owner = readEnvValue(cwd, "POSTGRES_USER", "supatype_admin");
+    const database = readEnvValue(cwd, "POSTGRES_DB", "supatype");
+    const result = spawnSync("docker", [
+        "compose", "-p", composeProject, "-f", paths.composePath,
+        "exec", "-T",
+        "-e", `PGPASSWORD=${devPostgresPassword(cwd)}`,
+        "-e", `SUPATYPE_AUTHENTICATOR_PASSWORD=${devAuthenticatorPassword(cwd)}`,
+        "db", "psql", "-v", "ON_ERROR_STOP=1", "-U", owner, "-d", database,
+    ], {
+        cwd: composeDir,
+        encoding: "utf8",
+        timeout: 10_000,
+        // `\getenv` reads the value from the container's environment, so the password is never a
+        // `docker exec` argument, which any process listing on the machine would show.
+        input: [
+            "\\getenv pw SUPATYPE_AUTHENTICATOR_PASSWORD",
+            "ALTER ROLE authenticator WITH LOGIN PASSWORD :'pw';",
+            "",
+        ].join("\n"),
+    });
+    if (result.status !== 0) {
+        console.warn("[supatype] Could not set the authenticator password; the REST API may answer 502.");
+    }
+}
 function grantAuthSchemaAccess(paths, cwd, composeProject) {
     const composeDir = dirname(paths.composePath);
     const baseArgs = [