@supatype/cli 0.1.2 → 0.1.4

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
 
-> @supatype/cli@0.1.2 build /home/runner/work/supatype/supatype/packages/cli
+> @supatype/cli@0.1.4 build /home/runner/work/supatype/supatype/packages/cli
 > tsc --project tsconfig.json && node --input-type=module -e "import{cpSync,mkdirSync}from'node:fs';const a='dist/assets';mkdirSync(a,{recursive:true});cpSync('assets/supatype-logo-wordmark.ascii.txt',a+'/supatype-logo-wordmark.ascii.txt')"
 

package/.turbo/turbo-test.log

@@ -1,12 +1,12 @@
 
-> @supatype/cli@0.1.2 test /home/runner/work/supatype/supatype/packages/cli
+> @supatype/cli@0.1.4 test /home/runner/work/supatype/supatype/packages/cli
 > vitest run
 
 
  RUN  v4.0.18 /home/runner/work/supatype/supatype/packages/cli
 
- ✓ tests/type-extractor.test.ts (34 tests) 174ms
- ✓ tests/runtime-contract.test.ts (41 tests) 157ms
+ ✓ tests/type-extractor.test.ts (36 tests) 229ms
+ ✓ tests/runtime-contract.test.ts (41 tests) 131ms
 stdout | tests/init.test.ts > scaffold() > creates all expected files
   created  package.json
   created  supatype.config.ts
@@ -291,7 +291,11 @@
   created  public/.gitkeep
   created  .gitignore
 
- ✓ tests/init.test.ts (26 tests) 70ms
+ ✓ tests/init.test.ts (26 tests) 95ms
+
+ ✓ tests/dev-ui.test.ts (21 tests) 108ms
+
+[supatype] Shutting down…
 stdout | tests/docker-runtime.test.ts > requireDockerDaemon > exits when the daemon is unavailable
 
   Start the Docker daemon (e.g. sudo systemctl start docker), then try again.
@@ -300,22 +304,21 @@
 
   docker: daemon down
 
- ✓ tests/docker-runtime.test.ts (10 tests) 13ms
-
- ✓ tests/dev-ui.test.ts (21 tests) 102ms
-
-[supatype] Shutting down…
- ✓ tests/config.test.ts (18 tests) 4407ms
-     ✓ loads a valid supatype.config.ts (plain export default, no package imports)  600ms
-     ✓ normalizes shorthand schema string to { path, pg_schema }  582ms
-     ✓ loads a supatype.config.js (plain ESM)  579ms
-     ✓ loads config without a versions section (latest by default)  503ms
-     ✓ prefers supatype.config.ts over supatype.config.js when both exist  555ms
-     ✓ supports optional output field in config  559ms
-     ✓ merges supatype.local.config.ts over base  1016ms
- ✓ tests/command-chrome-coverage.test.ts (1 test) 17ms
+ ✓ tests/docker-runtime.test.ts (10 tests) 17ms
+ ✓ tests/config.test.ts (19 tests) 5201ms
+     ✓ loads a valid supatype.config.ts (plain export default, no package imports)  515ms
+     ✓ normalizes shorthand schema string to { path, pg_schema }  598ms
+     ✓ loads a supatype.config.js (plain ESM)  563ms
+     ✓ loads config without a versions section (latest by default)  502ms
+     ✓ prefers supatype.config.ts over supatype.config.js when both exist  484ms
+     ✓ supports optional output field in config  599ms
+     ✓ merges supatype.local.config.ts over base  1065ms
+     ✓ loads defineConfig import before @supatype/cli is installed (init scaffold)  863ms
+ ✓ tests/command-chrome-coverage.test.ts (1 test) 12ms
 stdout | tests/link.test.ts > link model > migrates cloud.json into link.json
   created  package.json
+stderr | tests/link.test.ts > link model > migrates cloud.json into link.json
+[supatype] Migrated .supatype/cloud.json → .supatype/link.json (legacy files kept; remove manually when ready).
   created  supatype.config.ts
   created  schema/index.ts
   created  .env
@@ -324,57 +327,11 @@
   created  public/.gitkeep
   created  .gitignore
 
-stderr | tests/link.test.ts > link model > migrates cloud.json into link.json
-[supatype] Migrated .supatype/cloud.json → .supatype/link.json (legacy files kept; remove manually when ready).
-
- ✓ tests/link.test.ts (4 tests) 2778ms
-     ✓ resolveTarget returns cloud mode with /api/v1 prefix  895ms
-     ✓ resolveTarget returns self-host mode with /platform/v1 prefix  894ms
-     ✓ targetSchemaRollback posts to /platform/v1 when linked  981ms
- ✓ tests/pull-utils.test.ts (49 tests) 11ms
- ✓ tests/schema-sources.test.ts (5 tests) 1117ms
-     ✓ buildSchemaSourcesPayload includes manifest metadata  524ms
-     ✓ restore overwrites modified local files  543ms
-stderr | tests/binary-cache-cloud-overrides.test.ts > isLinkedToCloudProject > is true when .supatype/cloud.json has projectSlug
-[supatype] Migrated .supatype/cloud.json → .supatype/link.json (legacy files kept; remove manually when ready).
-
- ✓ tests/binary-cache-cloud-overrides.test.ts (11 tests) 22ms
- ✓ tests/minisign.test.ts (5 tests) 13ms
-stdout | tests/storage-provision.test.ts > provisionBuckets > POSTs each bucket to the storage API
-[supatype] Storage bucket "photos" ready.
-
-stdout | tests/storage-provision.test.ts > provisionBuckets > POSTs each bucket to the storage API
-[supatype] Storage bucket "avatars" ready.
 
- ✓ tests/storage-provision.test.ts (6 tests) 9ms
- ✓ tests/cached-artifact-format.test.ts (7 tests) 13ms
- ✓ tests/proxy-dev-app.test.ts (7 tests) 6ms
- ✓ tests/init-dependency-versions.test.ts (4 tests) 35ms
- ✓ tests/tsx-runner.test.ts (7 tests) 2856ms
-       ✓ evaluates a simple expression and returns stdout  351ms
-       ✓ evaluates TypeScript syntax (type annotations)  369ms
-       ✓ can serialize a JSON object to stdout  399ms
-       ✓ returns non-zero exit code on syntax error  393ms
-       ✓ returns non-zero exit code on runtime error  387ms
-       ✓ captures stderr separately from stdout  402ms
-       ✓ runs a .ts file and returns its stdout  551ms
- ✓ tests/augmentation-generator.test.ts (3 tests) 12ms
- ✓ tests/keys.test.ts (11 tests) 16973ms
-     ✓ exits 0 with --secret  1455ms
-     ✓ outputs ANON_KEY= line  1401ms
-     ✓ outputs SERVICE_ROLE_KEY= line  1425ms
-     ✓ ANON_KEY is a valid three-part JWT  1343ms
-     ✓ SERVICE_ROLE_KEY payload has role: service_role  1477ms
-     ✓ JWT has exp in the future  1476ms
-     ✓ --exp-years changes the expiry window  2796ms
-     ✓ reads JWT_SECRET from environment variable  1383ms
-     ✓ reads JWT_SECRET from .env file  1398ms
-     ✓ exits non-zero when no secret is available  1399ms
-     ✓ keys --help shows --secret and --exp-years options  1415ms
- ✓ tests/engine-push-output.test.ts (7 tests) 7ms
- ✓ tests/type-resolver.test.ts (2 tests) 16ms
- ✓ tests/command-chrome-wrap.test.ts (3 tests) 7ms
- ✓ tests/ensure-binary.test.ts (2 tests) 10ms
+ ✓ tests/link.test.ts (4 tests) 2930ms
+     ✓ resolveTarget returns cloud mode with /api/v1 prefix  1014ms
+     ✓ resolveTarget returns self-host mode with /platform/v1 prefix  964ms
+     ✓ targetSchemaRollback posts to /platform/v1 when linked  941ms
 stdout | tests/admin-ensure.test.ts > init admin seed in .env > writes SUPATYPE_ADMIN_* when scaffold options include credentials
   created  package.json
   created  supatype.config.ts
@@ -385,10 +342,55 @@
   created  public/.gitkeep
   created  .gitignore
 
- ✓ tests/admin-ensure.test.ts (3 tests) 145ms
- ✓ tests/ui-messages.test.ts (5 tests) 6ms
+ ✓ tests/admin-ensure.test.ts (10 tests) 196ms
+ ✓ tests/pull-utils.test.ts (49 tests) 14ms
+ ✓ tests/schema-sources.test.ts (5 tests) 1185ms
+     ✓ buildSchemaSourcesPayload includes manifest metadata  584ms
+     ✓ restore overwrites modified local files  555ms
+stderr | tests/binary-cache-cloud-overrides.test.ts > isLinkedToCloudProject > is true when .supatype/cloud.json has projectSlug
+[supatype] Migrated .supatype/cloud.json → .supatype/link.json (legacy files kept; remove manually when ready).
+
+ ✓ tests/binary-cache-cloud-overrides.test.ts (11 tests) 21ms
+ ✓ tests/minisign.test.ts (5 tests) 15ms
+stdout | tests/storage-provision.test.ts > provisionBuckets > POSTs each bucket to the storage API
+[supatype] Storage bucket "photos" ready.
+
+stdout | tests/storage-provision.test.ts > provisionBuckets > POSTs each bucket to the storage API
+[supatype] Storage bucket "avatars" ready.
+
+ ✓ tests/storage-provision.test.ts (6 tests) 14ms
+ ✓ tests/cached-artifact-format.test.ts (7 tests) 10ms
+ ✓ tests/proxy-dev-app.test.ts (7 tests) 5ms
+ ✓ tests/init-dependency-versions.test.ts (4 tests) 40ms
+ ✓ tests/keys.test.ts (11 tests) 17122ms
+     ✓ exits 0 with --secret  1522ms
+     ✓ outputs ANON_KEY= line  1453ms
+     ✓ outputs SERVICE_ROLE_KEY= line  1442ms
+     ✓ ANON_KEY is a valid three-part JWT  1502ms
+     ✓ SERVICE_ROLE_KEY payload has role: service_role  1494ms
+     ✓ JWT has exp in the future  1371ms
+     ✓ --exp-years changes the expiry window  2798ms
+     ✓ reads JWT_SECRET from environment variable  1349ms
+     ✓ reads JWT_SECRET from .env file  1454ms
+     ✓ exits non-zero when no secret is available  1351ms
+     ✓ keys --help shows --secret and --exp-years options  1380ms
+ ✓ tests/augmentation-generator.test.ts (3 tests) 11ms
+ ✓ tests/type-resolver.test.ts (2 tests) 18ms
+ ✓ tests/engine-push-output.test.ts (7 tests) 5ms
+ ✓ tests/command-chrome-wrap.test.ts (3 tests) 8ms
+ ✓ tests/tsx-runner.test.ts (7 tests) 2945ms
+       ✓ evaluates a simple expression and returns stdout  425ms
+       ✓ evaluates TypeScript syntax (type annotations)  342ms
+       ✓ can serialize a JSON object to stdout  368ms
+       ✓ returns non-zero exit code on syntax error  437ms
+       ✓ returns non-zero exit code on runtime error  357ms
+       ✓ captures stderr separately from stdout  417ms
+       ✓ runs a .ts file and returns its stdout  593ms
+ ✓ tests/ensure-binary.test.ts (2 tests) 11ms
+ ✓ tests/init-project-detect.test.ts (4 tests) 12ms
+ ✓ tests/ui-messages.test.ts (5 tests) 8ms
  ✓ tests/required-host-components.test.ts (4 tests) 7ms
- ✓ tests/normalize-admin-config.test.ts (1 test) 6ms
+ ✓ tests/normalize-admin-config.test.ts (1 test) 5ms
 stdout | tests/app-command.test.ts > supatype app add --static > sets app.mode=static and static_dir in supatype.config.ts
   created  package.json
   created  supatype.config.ts
@@ -399,11 +401,10 @@
   created  public/.gitkeep
   created  .gitignore
 
- ✓ tests/dev-session-lock.test.ts (2 tests) 5ms
- ✓ tests/ui-confirm.test.ts (3 tests) 9ms
+ ✓ tests/dev-session-lock.test.ts (2 tests) 6ms
+ ✓ tests/ui-confirm.test.ts (3 tests) 8ms
  ✓ tests/docker-postgres.test.ts (5 tests) 5ms
- ✓ tests/binary-download-lock.test.ts (2 tests) 7ms
- ✓ tests/dev-ports.test.ts (3 tests) 6ms
+ ✓ tests/binary-download-lock.test.ts (2 tests) 8ms
 stdout | tests/app-command.test.ts > supatype app add --static > creates the static directory when missing
   created  package.json
   created  supatype.config.ts
@@ -414,41 +415,43 @@
   created  public/.gitkeep
   created  .gitignore
 
- ✓ tests/seed-discover.test.ts (2 tests) 20ms
- ✓ tests/studio-admin-roles.test.ts (3 tests) 5ms
- ✓ tests/cli-help.test.ts (16 tests) 22078ms
-     ✓ --help lists all top-level commands  1455ms
-     ✓ --version prints package.json version  1304ms
-     ✓ self-update --help describes the command  1444ms
-     ✓ init --help describes the init command  1357ms
-     ✓ push --help describes the push command and --yes flag  1477ms
-     ✓ diff --help describes the diff command  1369ms
-     ✓ pull --help describes scaffold pull command  1401ms
-     ✓ doctor --help describes drift report command  1293ms
-     ✓ introspect --help describes database introspection command  1298ms
-     ✓ adopt --help describes adoption ceremony command  1462ms
-     ✓ reset --help shows --yes flag  1360ms
-     ✓ app --help describes the app command with add/remove subcommands  1388ms
-     ✓ app add --help shows --static and --port options  1371ms
-     ✓ self-host --help shows compose only (legacy commands hidden)  1315ms
-     ✓ self-host compose --help shows compose subcommands  1354ms
-     ✓ unknown command exits non-zero  1427ms
- ✓ tests/release-pins.test.ts (2 tests) 5ms
+ ✓ tests/dev-ports.test.ts (3 tests) 7ms
+ ✓ tests/cli-help.test.ts (16 tests) 22108ms
+     ✓ --help lists all top-level commands  1433ms
+     ✓ --version prints package.json version  1339ms
+     ✓ self-update --help describes the command  1410ms
+     ✓ init --help describes the init command  1366ms
+     ✓ push --help describes the push command and --yes flag  1476ms
+     ✓ diff --help describes the diff command  1376ms
+     ✓ pull --help describes scaffold pull command  1374ms
+     ✓ doctor --help describes drift report command  1246ms
+     ✓ introspect --help describes database introspection command  1412ms
+     ✓ adopt --help describes adoption ceremony command  1344ms
+     ✓ reset --help shows --yes flag  1291ms
+     ✓ app --help describes the app command with add/remove subcommands  1455ms
+     ✓ app add --help shows --static and --port options  1401ms
+     ✓ self-host --help shows compose only (legacy commands hidden)  1380ms
+     ✓ self-host compose --help shows compose subcommands  1467ms
+     ✓ unknown command exits non-zero  1331ms
+ ✓ tests/dev-ready-panel.test.ts (2 tests) 4ms
+ ✓ tests/studio-admin-roles.test.ts (3 tests) 4ms
+ ✓ tests/release-pins.test.ts (2 tests) 4ms
+ ✓ tests/seed-discover.test.ts (2 tests) 13ms
+ ✓ tests/app-command.test.ts (2 tests) 2875ms
+     ✓ sets app.mode=static and static_dir in supatype.config.ts  1454ms
+     ✓ creates the static directory when missing  1419ms
  ✓ tests/ensure-dev-api-config.test.ts (1 test) 5ms
- ✓ tests/app-command.test.ts (2 tests) 2894ms
-     ✓ sets app.mode=static and static_dir in supatype.config.ts  1541ms
-     ✓ creates the static directory when missing  1350ms
  ✓ tests/rest-cache-admin.test.ts (1 test) 48ms
- ✓ tests/resolve-api-url.test.ts (2 tests) 4ms
  ✓ tests/init-package-json.test.ts (1 test) 4ms
- ✓ tests/migrate-from-v1.test.ts (1 test) 11ms
+ ✓ tests/resolve-api-url.test.ts (2 tests) 4ms
  ✓ tests/pg-spawn-env.test.ts (2 tests) 5ms
- ✓ tests/cli-package-version.test.ts (1 test) 4ms
- ✓ tests/postgres-archive-tag.test.ts (1 test) 3ms
- ✓ tests/dev-ready-panel.test.ts (1 test) 2ms
-
- Test Files  46 passed (46)
-      Tests  348 passed (348)
-   Start at  11:55:52
-   Duration  28.26s (transform 4.10s, setup 0ms, import 21.64s, tests 54.11s, environment 9ms)
+ ✓ tests/migrate-from-v1.test.ts (1 test) 18ms
+ ✓ tests/cli-package-version.test.ts (1 test) 3ms
+ ✓ tests/postgres-archive-tag.test.ts (1 test) 2ms
+ ✓ tests/stdin-after-ink.test.ts (1 test) 3ms
+
+ Test Files  48 passed (48)
+      Tests  364 passed (364)
+   Start at  07:44:14
+   Duration  28.86s (transform 3.82s, setup 0ms, import 21.76s, tests 55.51s, environment 9ms)
 

package/.turbo/turbo-typecheck.log

@@ -1,4 +1,4 @@
 
-> @supatype/cli@0.1.2 typecheck /home/runner/work/supatype/supatype/packages/cli
+> @supatype/cli@0.1.4 typecheck /home/runner/work/supatype/supatype/packages/cli
 > tsc --project tsconfig.json --noEmit && tsc --project tests/tsconfig.json --noEmit
 

package/dist/commands/admin.d.ts

@@ -1,7 +1,16 @@
 import type { Command } from "commander";
+import type { QueryResult } from "pg";
 import { type SupatypeProjectConfig } from "../project-config.js";
 export declare const ADMIN_EMAIL_ENV = "SUPATYPE_ADMIN_EMAIL";
 export declare const ADMIN_PASSWORD_ENV = "SUPATYPE_ADMIN_PASSWORD";
+/** GoTrue scopes users to the nil instance id in single-tenant/self-host mode. */
+export declare const GOTRUE_NIL_INSTANCE_ID = "00000000-0000-0000-0000-000000000000";
+/** Audience claim used by GoTrue when looking up users (matches GOTRUE_JWT_AUD in compose). */
+export declare function gotrueJwtAud(cwd: string): string;
+type DbQuery = (sql: string, params?: unknown[]) => Promise<QueryResult>;
+type AuthConfirmedColumn = "email_confirmed_at" | "confirmed_at";
+/** Prefer GoTrue's column when migrated; fall back to postgres init `confirmed_at`. */
+export declare function resolveAuthConfirmedAtColumn(query: DbQuery): Promise<AuthConfirmedColumn>;
 export interface EnsureFirstAdminOptions {
     email?: string;
     password?: string;
@@ -28,4 +37,7 @@ export declare function ensureFirstAdminUser(connection: string, options?: Ensur
 export declare function ensureFirstAdminUserForProject(cwd: string, config: SupatypeProjectConfig, options?: EnsureFirstAdminOptions): Promise<void>;
 export declare function clearAdminSeedPassword(cwd: string): void;
 export declare function hashPasswordForAuth(password: string): Promise<string>;
+/** Postgres password for compose `exec psql` (db is not published to the host). */
+export declare function composePostgresPassword(cwd: string): string;
+export {};
 //# sourceMappingURL=admin.d.ts.map

package/dist/commands/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/commands/admin.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAOxC,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAA;AAW7B,eAAO,MAAM,eAAe,yBAAyB,CAAA;AACrD,eAAO,MAAM,kBAAkB,4BAA4B,CAAA;AAI3D,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CACnD;AAID,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAkKpD;AAED,2CAA2C;AAC3C,eAAO,MAAM,oBAAoB,6BAAuB,CAAA;AAExD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,qBAAqB,EAC7B,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAwFD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3E"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/commands/admin.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAKxC,OAAO,KAAK,EAAQ,WAAW,EAAE,MAAM,IAAI,CAAA;AAE3C,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAA;AAa7B,eAAO,MAAM,eAAe,yBAAyB,CAAA;AACrD,eAAO,MAAM,kBAAkB,4BAA4B,CAAA;AAI3D,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,yCAAyC,CAAA;AAE5E,+FAA+F;AAC/F,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,KAAK,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;AACxE,KAAK,mBAAmB,GAAG,oBAAoB,GAAG,cAAc,CAAA;AAEhE,uFAAuF;AACvF,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAc/F;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CACnD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+KpD;AAED,2CAA2C;AAC3C,eAAO,MAAM,oBAAoB,6BAAuB,CAAA;AAExD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,qBAAqB,EAC7B,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AA2FD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3E;AAsHD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D"}

package/dist/commands/admin.js

@@ -10,6 +10,8 @@ import { loadConfig } from "../config.js";
 import { connectionString, resolveRuntimeProvider, } from "../project-config.js";
 import { readEnvValue, upsertEnvFile } from "../env-file.js";
 import { hasEngineOverride } from "../binary-cache.js";
+import { readDevSessionLock } from "../dev-session-lock.js";
+import { composeProjectName } from "../self-host-compose.js";
 import { confirm as uiConfirm } from "../ui/confirm.js";
 import { error, info, plain } from "../ui/messages.js";
 import { promptPassword, promptText } from "../ui/prompts.js";
@@ -18,6 +20,27 @@ import { getActiveDevSession, } from "../dev-session.js";
 export const ADMIN_EMAIL_ENV = "SUPATYPE_ADMIN_EMAIL";
 export const ADMIN_PASSWORD_ENV = "SUPATYPE_ADMIN_PASSWORD";
 const BCRYPT_ROUNDS = 10;
+/** GoTrue scopes users to the nil instance id in single-tenant/self-host mode. */
+export const GOTRUE_NIL_INSTANCE_ID = "00000000-0000-0000-0000-000000000000";
+/** Audience claim used by GoTrue when looking up users (matches GOTRUE_JWT_AUD in compose). */
+export function gotrueJwtAud(cwd) {
+    return readEnvValue(cwd, "GOTRUE_JWT_AUD", "authenticated");
+}
+/** Prefer GoTrue's column when migrated; fall back to postgres init `confirmed_at`. */
+export async function resolveAuthConfirmedAtColumn(query) {
+    const result = await query(`SELECT column_name
+     FROM information_schema.columns
+     WHERE table_schema = 'auth'
+       AND table_name = 'users'
+       AND column_name IN ('email_confirmed_at', 'confirmed_at')
+     ORDER BY CASE column_name WHEN 'email_confirmed_at' THEN 0 ELSE 1 END
+     LIMIT 1`);
+    const row = result.rows[0];
+    const name = row?.column_name ?? row?.value;
+    if (name === "email_confirmed_at" || name === "confirmed_at")
+        return name;
+    return "confirmed_at";
+}
 export function registerAdmin(program) {
     const adminCmd = program
         .command("admin")
@@ -45,11 +68,22 @@ export function registerAdmin(program) {
         }
         const role = opts.role;
         info(`Creating admin user: ${email} (role: ${role})...`);
-        const pg = await importPg();
-        const pool = new pg.Pool({ connectionString: connection, max: 2 });
+        const compose = opts.connection === undefined ? resolveDockerComposeContext(cwd, config) : null;
         try {
-            await ensureAuthUsersTable(pool);
-            await createAdminUser(pool, email, password, role);
+            if (compose) {
+                await createAdminUser((sql, params) => composeExecQuery(cwd, compose, sql, params), email, password, role, { cwd });
+            }
+            else {
+                const pg = await importPg();
+                const pool = new pg.Pool({ connectionString: connection, max: 2 });
+                try {
+                    await ensureAuthUsersTable(pool);
+                    await createAdminUser(pool, email, password, role, { cwd });
+                }
+                finally {
+                    await pool.end();
+                }
+            }
             info("This user can now log in to the admin panel at /admin");
         }
         catch (err) {
@@ -57,9 +91,6 @@ export function registerAdmin(program) {
             error(`Failed to create admin user: ${message}`);
             process.exit(1);
         }
-        finally {
-            await pool.end();
-        }
     });
     adminCmd
         .command("set-role")
@@ -170,8 +201,9 @@ export async function ensureFirstAdminUserForProject(cwd, config, options = {})
         try {
             await ensureFirstAdminWithQuery((sql, params) => composeExecQuery(root, merged.compose, sql, params), merged);
         }
-        catch {
-            // Non-fatal
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            error(`Could not ensure first admin user: ${message}`);
         }
         return;
     }
@@ -196,7 +228,10 @@ async function ensureFirstAdminWithQuery(query, options) {
     }
     const role = options.role ?? "admin";
     try {
-        await createAdminUser(query, credentials.email, credentials.password, role, { quiet: true });
+        await createAdminUser(query, credentials.email, credentials.password, role, {
+            quiet: true,
+            cwd,
+        });
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -260,9 +295,12 @@ async function createAdminUser(db, email, password, role, opts = {}) {
         ? (sql, params) => db.query(sql, params)
         : db;
     const normalized = email.toLowerCase();
-    const existing = await query(`SELECT id FROM auth.users WHERE email = $1`, [
-        normalized,
-    ]);
+    const aud = opts.aud ?? (opts.cwd ? gotrueJwtAud(opts.cwd) : "authenticated");
+    const existing = await query(`SELECT id FROM auth.users
+     WHERE instance_id = $1::uuid
+       AND LOWER(email) = $2
+       AND aud = $3
+       AND is_sso_user = false`, [GOTRUE_NIL_INSTANCE_ID, normalized, aud]);
     if (existing.rows.length > 0) {
         throw new Error(`User with email "${email}" already exists.`);
     }
@@ -273,15 +311,24 @@ async function createAdminUser(db, email, password, role, opts = {}) {
         providers: ["email"],
     });
     const userMetadata = JSON.stringify({});
+    const confirmedCol = await resolveAuthConfirmedAtColumn(query);
     const result = await query(`INSERT INTO auth.users (
-      id, email, encrypted_password, role, aud,
+      instance_id, id, aud, role, email, encrypted_password,
       raw_app_meta_data, raw_user_meta_data,
-      email_confirmed_at, created_at, updated_at
+      ${confirmedCol},
+      confirmation_token, recovery_token,
+      email_change_token_new, email_change, email_change_token_current,
+      phone_change, phone_change_token, reauthentication_token,
+      is_sso_user, is_anonymous,
+      created_at, updated_at
     ) VALUES (
-      gen_random_uuid(), $1, $2, 'authenticated', 'authenticated',
-      $3::jsonb, $4::jsonb,
-      now(), now(), now()
-    ) RETURNING id, email`, [normalized, passwordHash, appMetadata, userMetadata]);
+      $1::uuid, gen_random_uuid(), $2, 'authenticated', $3, $4,
+      $5::jsonb, $6::jsonb,
+      now(),
+      '', '', '', '', '', '', '', '',
+      false, false,
+      now(), now()
+    ) RETURNING id, email`, [GOTRUE_NIL_INSTANCE_ID, aud, normalized, passwordHash, appMetadata, userMetadata]);
     const user = result.rows[0];
     if (!opts.quiet) {
         info("Admin user created successfully.");
@@ -297,7 +344,7 @@ async function ensureAuthUsersTable(pool) {
 
     CREATE TABLE IF NOT EXISTS auth.users (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-      instance_id   UUID,
+      instance_id   UUID DEFAULT '00000000-0000-0000-0000-000000000000'::uuid,
       aud           TEXT DEFAULT 'authenticated',
       role          TEXT DEFAULT 'authenticated',
       email         TEXT UNIQUE,
@@ -310,7 +357,13 @@ async function ensureAuthUsersTable(pool) {
       confirmation_token TEXT DEFAULT '',
       recovery_token TEXT DEFAULT '',
       email_change_token_new TEXT DEFAULT '',
-      email_change  TEXT DEFAULT ''
+      email_change_token_current TEXT DEFAULT '',
+      email_change  TEXT DEFAULT '',
+      phone_change  TEXT DEFAULT '',
+      phone_change_token TEXT DEFAULT '',
+      reauthentication_token TEXT DEFAULT '',
+      is_sso_user   BOOLEAN NOT NULL DEFAULT false,
+      is_anonymous  BOOLEAN NOT NULL DEFAULT false
     );
   `);
 }
@@ -328,9 +381,30 @@ async function hasAdminUsers(query) {
     const count = adminCount.rows[0]?.count ?? 0;
     return count > 0;
 }
+/** Postgres password for compose `exec psql` (db is not published to the host). */
+export function composePostgresPassword(cwd) {
+    return readEnvValue(cwd, "POSTGRES_PASSWORD", "postgres");
+}
+function resolveDockerComposeContext(cwd, config) {
+    if (resolveRuntimeProvider(config) !== "docker" || hasEngineOverride(config)) {
+        return null;
+    }
+    const session = readDevSessionLock(cwd);
+    if (session?.composeProject && session.composePath && existsSync(session.composePath)) {
+        return { project: session.composeProject, composePath: session.composePath };
+    }
+    const composePath = resolve(cwd, ".supatype/self-host/docker-compose.yml");
+    if (!existsSync(composePath))
+        return null;
+    return {
+        project: composeProjectName(config.project?.name ?? "project"),
+        composePath,
+    };
+}
 function composeExecQuery(cwd, compose, sql, params = []) {
     const db = readEnvValue(cwd, "POSTGRES_DB", "supatype");
     const user = readEnvValue(cwd, "POSTGRES_USER", "supatype_admin");
+    const pgPassword = composePostgresPassword(cwd);
     const envFile = join(cwd, ".env");
     const composeDir = dirname(compose.composePath);
     const args = [
@@ -345,7 +419,7 @@ function composeExecQuery(cwd, compose, sql, params = []) {
     if (existsSync(envFile))
         args.push("--env-file", envFile);
     if (params.length === 0) {
-        args.push("exec", "-T", "db", "psql", "-U", user, "-d", db, "-tAc", sql);
+        args.push("exec", "-T", "-e", `PGPASSWORD=${pgPassword}`, "db", "psql", "-U", user, "-d", db, "-tAc", sql);
         const result = spawnSync("docker", args, { cwd: composeDir, encoding: "utf8" });
         if (result.status !== 0) {
             throw new Error((result.stderr ?? result.stdout ?? "compose psql failed").trim());
@@ -368,7 +442,7 @@ function composeExecQuery(cwd, compose, sql, params = []) {
             fields: [],
         });
     }
-    args.push("exec", "-T", "db", "psql", "-U", user, "-d", db, "-v", "ON_ERROR_STOP=1", "-c", interpolateSql(sql, params));
+    args.push("exec", "-T", "-e", `PGPASSWORD=${pgPassword}`, "db", "psql", "-U", user, "-d", db, "-v", "ON_ERROR_STOP=1", "-c", interpolateSql(sql, params));
     const result = spawnSync("docker", args, { cwd: composeDir, encoding: "utf8" });
     if (result.status !== 0) {
         throw new Error((result.stderr ?? result.stdout ?? "compose psql failed").trim());