create-bw-app 0.18.6 → 0.20.0

package/src/safe-path.mjs

@@ -0,0 +1,46 @@
+import path from "node:path";
+
+const WINDOWS_DRIVE_PATH = /^[A-Za-z]:/;
+
+export function normalizeSafeRelativePath(relativePath, label = "Path") {
+  if (typeof relativePath !== "string" || relativePath.trim() === "") {
+    throw new Error(`${label} must be a non-empty relative path.`);
+  }
+
+  const value = relativePath.trim();
+  if (
+    path.posix.isAbsolute(value)
+    || path.win32.isAbsolute(value)
+    || WINDOWS_DRIVE_PATH.test(value)
+    || value.startsWith("\\\\")
+  ) {
+    throw new Error(`${label} must be relative to the target directory: ${relativePath}`);
+  }
+
+  const portablePath = value.replaceAll("\\", "/");
+  if (portablePath.split("/").includes("..")) {
+    throw new Error(`${label} must not contain parent-directory traversal: ${relativePath}`);
+  }
+
+  const normalized = path.posix.normalize(portablePath).replace(/^\.\//, "");
+  if (normalized === "." || normalized === "") {
+    throw new Error(`${label} must identify a path inside the target directory.`);
+  }
+  return normalized;
+}
+
+export function resolveSafeRelativePath(targetDir, relativePath, label = "Path") {
+  const root = path.resolve(targetDir);
+  const normalized = normalizeSafeRelativePath(relativePath, label);
+  const resolved = path.resolve(root, ...normalized.split("/"));
+  const relativeToRoot = path.relative(root, resolved);
+  if (
+    relativeToRoot === ""
+    || relativeToRoot === ".."
+    || relativeToRoot.startsWith(`..${path.sep}`)
+    || path.isAbsolute(relativeToRoot)
+  ) {
+    throw new Error(`${label} resolves outside the target directory: ${relativePath}`);
+  }
+  return resolved;
+}

package/src/scaffold-cmd.mjs

@@ -3,17 +3,10 @@ import { stdout as output } from "node:process";
 import { findWorkspaceRoot, hashFile, readAppManifest, writeAppManifest } from "./app-manifest.mjs";
 import { pathExists } from "./generator.mjs";
 import { findTrackedTemplate, scaffoldDrift } from "./scaffold.mjs";
+import { normalizeSafeRelativePath, resolveSafeRelativePath } from "./safe-path.mjs";
 
 const HELP = `Usage: bw scaffold <action> [paths...] [options]\n\nActions:\n  list                List tracked files, live status, and intent\n  own <path>...       Mark existing tracked files as app-owned\n  skip <path>...      Mark missing tracked files as intentionally absent\n  manage <path>...    Return tracked files to BrightWeb management\n\nOptions:\n  --target-dir <path>       App directory (defaults to cwd)\n  --workspace-root <path>   BrightWeb workspace root\n  --help                    Show this help`;
 
-function normalizeTrackedPath(relativePath) {
-  const normalized = path.normalize(String(relativePath)).replace(/^\.\//, "");
-  if (path.isAbsolute(String(relativePath)) || normalized === ".." || normalized.startsWith(`..${path.sep}`)) {
-    throw new Error(`Scaffold path must be relative to the app: ${relativePath}`);
-  }
-  return normalized;
-}
-
 export async function scaffoldBrightwebApp(action, paths = [], argvOptions = {}, runtimeOptions = {}) {
   if (argvOptions.help || !action) { output.write(`${HELP}\n`); return { help: true }; }
   if (!Array.isArray(paths)) paths = [paths];
@@ -30,7 +23,7 @@ export async function scaffoldBrightwebApp(action, paths = [], argvOptions = {},
     return { action, entries: live.entries };
   }
 
-  const normalizedPaths = Array.from(new Set(paths.map(normalizeTrackedPath)));
+  const normalizedPaths = Array.from(new Set(paths.map((entry) => normalizeSafeRelativePath(entry, "Scaffold path"))));
   for (const relativePath of normalizedPaths) {
     if (!manifest.scaffoldFiles?.[relativePath]) throw new Error(`${relativePath} is not a tracked scaffold file.`);
   }
@@ -47,7 +40,7 @@ export async function scaffoldBrightwebApp(action, paths = [], argvOptions = {},
     const record = manifest.scaffoldFiles[relativePath];
     const previousIntent = record.intent || "managed";
     const nextIntent = action === "manage" ? "managed" : action === "own" ? "owned" : "skipped";
-    const appPath = path.join(targetDir, relativePath);
+    const appPath = resolveSafeRelativePath(targetDir, relativePath, "Manifest scaffold file path");
     const exists = await pathExists(appPath);
     if (action === "manage") {
       const located = await findTrackedTemplate({ relativePath, manifest, targetDir, workspaceRoot });

package/src/scaffold.mjs

@@ -4,6 +4,7 @@ import { fileURLToPath } from "node:url";
 import { MODULE_STARTER_FILES, PLATFORM_STARTER_FILES, SELECTABLE_MODULES } from "./constants.mjs";
 import { hashFile } from "./app-manifest.mjs";
 import { pathExists } from "./generator.mjs";
+import { resolveSafeRelativePath } from "./safe-path.mjs";
 
 const BUNDLED_TEMPLATE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "template");
 
@@ -42,7 +43,7 @@ export async function inventoryScaffoldFiles({ targetDir, moduleKeys, templateRo
       unsupported.push(definition.relativePath);
       continue;
     }
-    const appPath = path.join(targetDir, definition.relativePath);
+    const appPath = resolveSafeRelativePath(targetDir, definition.relativePath, "Scaffold file path");
     const templateHash = await hashFile(templatePath);
     const exists = await pathExists(appPath);
     records[definition.relativePath] = {
@@ -60,7 +61,7 @@ export async function scaffoldDrift(targetDir, scaffoldFiles = {}) {
   const missing = [];
   const entries = [];
   for (const [relativePath, record] of Object.entries(scaffoldFiles)) {
-    const appPath = path.join(targetDir, relativePath);
+    const appPath = resolveSafeRelativePath(targetDir, relativePath, "Manifest scaffold file path");
     const intent = record.intent || "managed";
     let status = "missing";
     if (await pathExists(appPath)) {

package/src/update.mjs

@@ -13,7 +13,9 @@ import {
   TEMPLATE_ROOT,
   createAppContextFile,
   createDbInstallPlan,
+  createModuleToolbarControlsConfig,
   createNextConfig,
+  createOptionalModuleRouteFiles,
   createPackageJson,
   createPlatformGlobalsCss,
   createPlatformModulesConfigFile,
@@ -25,12 +27,19 @@ import {
   readJsonIfPresent,
   runInstall,
 } from "./generator.mjs";
+import { readAppManifest } from "./app-manifest.mjs";
 
 const MANAGED_PLATFORM_FILES = [
   "next.config.ts",
   path.join("app", "globals.css"),
+  path.join("config", "module-toolbar-controls.tsx"),
   path.join("config", "modules.ts"),
   path.join("config", "shell.ts"),
+  path.join("app", "api", "invitations", "_dependencies.ts"),
+  path.join("app", "api", "organizations", "route.ts"),
+  path.join("app", "api", "organizations", "[id]", "route.ts"),
+  path.join("app", "api", "organizations", "[id]", "invitations", "route.ts"),
+  path.join("app", "api", "organizations", "[id]", "invitations", "[invitationId]", "route.ts"),
   path.join("docs", "ai", "app-context.json"),
 ];
 
@@ -38,6 +47,14 @@ const MANAGED_SITE_FILES = [
   path.join("docs", "ai", "app-context.json"),
 ];
 
+const MODULE_SELECTED_PLATFORM_FILES = new Set([
+  path.join("app", "api", "invitations", "_dependencies.ts"),
+  path.join("app", "api", "organizations", "route.ts"),
+  path.join("app", "api", "organizations", "[id]", "route.ts"),
+  path.join("app", "api", "organizations", "[id]", "invitations", "route.ts"),
+  path.join("app", "api", "organizations", "[id]", "invitations", "[invitationId]", "route.ts"),
+]);
+
 function resolveUpdateTargetDirectory(runtimeOptions, argvOptions) {
   if (runtimeOptions.targetDir || argvOptions.targetDir) {
     return path.resolve(runtimeOptions.targetDir || argvOptions.targetDir);
@@ -264,6 +281,21 @@ async function getStarterFileStatus(targetDir, installedModules) {
       continue;
     }
 
+    // These base files are generated from the installed module set and are
+    // validated/repaired through MANAGED_PLATFORM_FILES, not raw template
+    // byte parity.
+    if (MODULE_SELECTED_PLATFORM_FILES.has(relativePath)) {
+      starterFiles.push({
+        moduleKey: "platform-base",
+        relativePath,
+        sourcePath,
+        targetPath,
+        status: "current",
+        refreshable: false,
+      });
+      continue;
+    }
+
     const [sourceContent, targetContent] = await Promise.all([
       fs.readFile(sourcePath, "utf8"),
       fs.readFile(targetPath, "utf8"),
@@ -424,6 +456,7 @@ function renderPlanSummary(plan, options = {}) {
 
 export async function buildBrightwebAppUpdatePlan(argvOptions = {}, runtimeOptions = {}) {
   const targetDir = resolveUpdateTargetDirectory(runtimeOptions, argvOptions);
+  await readAppManifest(targetDir, { required: false });
   const packageJsonPath = path.join(targetDir, "package.json");
   const manifest = await readJsonIfPresent(packageJsonPath);
 
@@ -493,8 +526,10 @@ export async function buildBrightwebAppUpdatePlan(argvOptions = {}, runtimeOptio
     const canonicalConfigFiles = {
       "next.config.ts": createNextConfig({ template: "platform", selectedModules: installedModules }),
       [path.join("app", "globals.css")]: await createPlatformGlobalsCss(installedModules),
+      [path.join("config", "module-toolbar-controls.tsx")]: createModuleToolbarControlsConfig(installedModules),
       [path.join("config", "modules.ts")]: createPlatformModulesConfigFile(installedModules),
       [path.join("config", "shell.ts")]: createShellConfig(installedModules),
+      ...createOptionalModuleRouteFiles(installedModules),
       [path.join("docs", "ai", "app-context.json")]: createAppContextFile({
         slug: manifest.name || path.basename(targetDir),
         template: "platform",

package/src/upgrade.mjs

@@ -5,6 +5,7 @@ import { hashFile, findWorkspaceRoot, loadModuleCatalog, readAppManifest, writeA
 import { pathExists, runInstall } from "./generator.mjs";
 import { applyMigrationWrites, getModuleMigrations, planMigrationAppends } from "./migrations.mjs";
 import { buildBrightwebAppUpdatePlan } from "./update.mjs";
+import { resolveSafeRelativePath } from "./safe-path.mjs";
 
 const HELP = `Usage: bw upgrade [moduleKey] [options]\n\nOptions:\n  --target-dir <path>          App directory (defaults to cwd)\n  --workspace-root <path>      BrightWeb workspace root\n  --allow-stale-fallback       Use baked-in versions if npm lookup fails\n  --install                    Install changed dependencies\n  --refresh-starters           Refresh unchanged starter files\n  --dry-run                    Print the upgrade plan without writing\n  --help                       Show this help`;
 
@@ -21,7 +22,7 @@ export async function upgradeBrightwebApp(moduleKey, argvOptions = {}, runtimeOp
   const intentional = [];
   for (const [relativePath, record] of Object.entries(appManifest.scaffoldFiles)) {
     if (["owned", "skipped"].includes(record.intent)) intentional.push(relativePath);
-    const filePath = path.join(targetDir, relativePath);
+    const filePath = resolveSafeRelativePath(targetDir, relativePath, "Manifest scaffold file path");
     if (!(await pathExists(filePath))) { missing.push(relativePath); continue; }
     if (await hashFile(filePath) !== record.hash) drifted.push(relativePath);
   }
@@ -60,8 +61,9 @@ export async function upgradeBrightwebApp(moduleKey, argvOptions = {}, runtimeOp
     if (key && appManifest.modules[key]) appManifest.modules[key].version = cleanVersion(update.to) || appManifest.modules[key].version;
   }
   for (const relativePath of plan.starterFilesToRefresh || []) {
-    if (!protectedPaths.has(relativePath) && appManifest.scaffoldFiles[relativePath] && await pathExists(path.join(targetDir, relativePath))) {
-      appManifest.scaffoldFiles[relativePath].hash = await hashFile(path.join(targetDir, relativePath));
+    const targetPath = resolveSafeRelativePath(targetDir, relativePath, "Manifest scaffold file path");
+    if (!protectedPaths.has(relativePath) && appManifest.scaffoldFiles[relativePath] && await pathExists(targetPath)) {
+      appManifest.scaffoldFiles[relativePath].hash = await hashFile(targetPath);
       appManifest.scaffoldFiles[relativePath].status = "current";
     }
   }

package/template/base/app/(auth)/login/page.tsx

@@ -1 +1,5 @@
-export { LoginPage as default } from "@brightweblabs/core-auth/ui";
+import { LoginPage } from "@brightweblabs/core-auth/ui";
+
+export default function Page() {
+  return <LoginPage />;
+}

package/template/base/app/(shell)/shell-layout-client.tsx

@@ -7,14 +7,18 @@ import {
   AppShellFrame,
   DesktopSidebar,
   MobileNav,
+  ShellActionsProvider,
   computeInitials,
   isShellNavItemActive,
+  useShellAction,
+  useShellActionDispatch,
   useShellNavState,
   type ShellContextualAction,
   type ShellNavStateGroup,
 } from "@brightweblabs/app-shell";
 import { createAuthUiClient } from "@brightweblabs/core-auth/ui";
 import { Toaster } from "@brightweblabs/ui";
+import { getModuleToolbarControls } from "../../config/module-toolbar-controls";
 import { getStarterShellConfig } from "../../config/shell";
 import "@brightweblabs/app-shell/dashboard.css";
 
@@ -36,6 +40,17 @@ const toolbarWindowEventByAction: Record<string, string> = {
 export function ShellLayoutClient({
   children,
   viewer,
+}: Readonly<{ children: ReactNode; viewer: ShellViewer }>) {
+  return (
+    <ShellActionsProvider aliases={toolbarWindowEventByAction}>
+      <ShellLayoutInner viewer={viewer}>{children}</ShellLayoutInner>
+    </ShellActionsProvider>
+  );
+}
+
+function ShellLayoutInner({
+  children,
+  viewer,
 }: Readonly<{ children: ReactNode; viewer: ShellViewer }>) {
   const pathname = usePathname() ?? "";
   const router = useRouter();
@@ -72,23 +87,21 @@ export function ShellLayoutClient({
     viewer.email ||
     "Conta";
   const projectsBaseHref = pathname.startsWith("/projects") ? "/projects" : "/projetos";
+  const toolbarControls = getModuleToolbarControls(pathname, projectsBaseHref);
 
-  const handleToolbarAction = (item: ShellContextualAction) => {
-    if (item.action === "projects-back-to-portfolio") {
-      router.push(projectsBaseHref);
-      return;
-    }
-    if (item.action === "projects-open-board") {
-      const projectId = pathname.split("/")[2];
-      if (projectId) {
-        router.push(`${projectsBaseHref}/${projectId}/${projectsBaseHref === "/projects" ? "tasks" : "tarefas"}`);
-      }
-      return;
+  const dispatchShellAction = useShellActionDispatch();
+  useShellAction("projects-back-to-portfolio", () => {
+    router.push(projectsBaseHref);
+  });
+  useShellAction("projects-open-board", () => {
+    const projectId = pathname.split("/")[2];
+    if (projectId) {
+      router.push(`${projectsBaseHref}/${projectId}/${projectsBaseHref === "/projects" ? "tasks" : "tarefas"}`);
     }
+  });
 
-    if (item.action) {
-      window.dispatchEvent(new Event(toolbarWindowEventByAction[item.action] ?? item.action));
-    }
+  const handleToolbarAction = (item: ShellContextualAction) => {
+    if (item.action) dispatchShellAction(item.action);
   };
 
   return (
@@ -143,8 +156,9 @@ export function ShellLayoutClient({
           toolbarRoutes={toolbarRoutes}
           toolbarActions={toolbarActions}
           onToolbarAction={handleToolbarAction}
+          notifications={{}}
         >
-          {null}
+          {toolbarControls}
         </AppHeader>
       }
       mobileNav={

package/template/base/app/layout.tsx

@@ -1,22 +1,30 @@
 import type { ReactNode } from "react";
+import type { Metadata, Viewport } from "next";
 import { starterBrandConfig } from "../config/brand";
 import { ThemeProvider, ThemeScript } from "@brightweblabs/app-shell";
 import { geistMono, geistSans } from "./fonts";
 import "./globals.css";
 
-export const metadata = {
+export const metadata: Metadata = {
   title: `${starterBrandConfig.companyName} Starter`,
   description: starterBrandConfig.tagline,
 };
 
+export const viewport: Viewport = {
+  themeColor: [
+    { media: "(prefers-color-scheme: light)", color: "white" },
+    { media: "(prefers-color-scheme: dark)", color: "black" },
+  ],
+};
+
 export default function RootLayout({ children }: { children: ReactNode }) {
   return (
-    <html lang="en" className={`${geistSans.variable} ${geistMono.variable}`} suppressHydrationWarning>
+    <html lang="pt-PT" className={`${geistSans.variable} ${geistMono.variable}`} suppressHydrationWarning>
       <head>
-        <ThemeScript defaultTheme="light" />
+        <ThemeScript defaultTheme="system" />
       </head>
       <body>
-        <ThemeProvider defaultTheme="light" disableTransitionOnChange>
+        <ThemeProvider defaultTheme="system" disableTransitionOnChange>
           {children}
         </ThemeProvider>
       </body>

package/template/base/config/module-toolbar-controls.tsx

@@ -0,0 +1,6 @@
+"use client";
+
+// MANAGED BY BRIGHTWEB — regenerated when modules are added, removed, or updated.
+export function getModuleToolbarControls(_pathname: string, _projectsBaseHref: string) {
+  return null;
+}

package/template/supabase/modules/admin/migrations/20260729120000_bootstrap_first_admin.sql

@@ -0,0 +1,114 @@
+-- Transactional database half of `bw admin create`.
+
+CREATE OR REPLACE FUNCTION public.bootstrap_first_admin(
+  p_user_id uuid,
+  p_email text,
+  p_force boolean DEFAULT false
+)
+RETURNS TABLE (
+  profile_id uuid,
+  previous_role_code text
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, auth
+AS $$
+DECLARE
+  v_email text;
+  v_auth_email text;
+  v_profile_id uuid;
+  v_previous_role_code text;
+BEGIN
+  IF COALESCE(auth.jwt() ->> 'role', '') <> 'service_role' THEN
+    RAISE EXCEPTION 'bootstrap_first_admin requires service_role'
+      USING ERRCODE = '42501';
+  END IF;
+
+  v_email := NULLIF(lower(trim(COALESCE(p_email, ''))), '');
+  IF p_user_id IS NULL OR v_email IS NULL THEN
+    RAISE EXCEPTION 'A user id and email are required'
+      USING ERRCODE = '22023';
+  END IF;
+
+  SELECT lower(trim(u.email))
+  INTO v_auth_email
+  FROM auth.users u
+  WHERE u.id = p_user_id;
+
+  IF v_auth_email IS NULL OR v_auth_email <> v_email THEN
+    RAISE EXCEPTION 'Auth user and email do not match'
+      USING ERRCODE = '22023';
+  END IF;
+
+  PERFORM pg_advisory_xact_lock(hashtextextended('brightweb:first-admin-bootstrap', 0));
+
+  IF NOT p_force AND EXISTS (
+    SELECT 1
+    FROM public.user_role_assignments ura
+    WHERE ura.role_code = 'admin'
+  ) THEN
+    RAISE EXCEPTION 'A project administrator already exists'
+      USING ERRCODE = '42501';
+  END IF;
+
+  SELECT p.id
+  INTO v_profile_id
+  FROM public.profiles p
+  WHERE p.user_id = p_user_id
+  FOR UPDATE;
+
+  IF v_profile_id IS NULL THEN
+    IF EXISTS (
+      SELECT 1
+      FROM public.profiles p
+      WHERE lower(p.email) = v_email
+    ) THEN
+      RAISE EXCEPTION 'A profile already exists for this email'
+        USING ERRCODE = '23505';
+    END IF;
+
+    INSERT INTO public.profiles (user_id, email)
+    VALUES (p_user_id, v_email)
+    RETURNING id INTO v_profile_id;
+  ELSE
+    UPDATE public.profiles
+    SET email = v_email,
+        updated_at = now()
+    WHERE id = v_profile_id;
+  END IF;
+
+  SELECT ura.role_code
+  INTO v_previous_role_code
+  FROM public.user_role_assignments ura
+  WHERE ura.profile_id = v_profile_id
+  FOR UPDATE;
+
+  INSERT INTO public.user_role_assignments (
+    profile_id,
+    role_code,
+    assigned_by_profile_id,
+    assigned_at,
+    reason
+  )
+  VALUES (
+    v_profile_id,
+    'admin',
+    NULL,
+    now(),
+    'bw_admin_create_bootstrap'
+  )
+  ON CONFLICT (profile_id)
+  DO UPDATE SET
+    role_code = EXCLUDED.role_code,
+    assigned_by_profile_id = NULL,
+    assigned_at = EXCLUDED.assigned_at,
+    reason = EXCLUDED.reason;
+
+  RETURN QUERY SELECT v_profile_id, v_previous_role_code;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.bootstrap_first_admin(uuid, text, boolean) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.bootstrap_first_admin(uuid, text, boolean) FROM anon;
+REVOKE ALL ON FUNCTION public.bootstrap_first_admin(uuid, text, boolean) FROM authenticated;
+GRANT EXECUTE ON FUNCTION public.bootstrap_first_admin(uuid, text, boolean) TO service_role;

package/template/supabase/modules/admin/migrations/20260729150000_bootstrap_first_admin_remove_force.sql

@@ -0,0 +1,116 @@
+-- Removes the p_force escape hatch from `bw admin create`.
+-- The 3-arg signature is already applied in production, so drop and recreate.
+
+DROP FUNCTION IF EXISTS public.bootstrap_first_admin(uuid, text, boolean);
+
+CREATE FUNCTION public.bootstrap_first_admin(
+  p_user_id uuid,
+  p_email text
+)
+RETURNS TABLE (
+  profile_id uuid,
+  previous_role_code text
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, auth
+AS $$
+DECLARE
+  v_email text;
+  v_auth_email text;
+  v_profile_id uuid;
+  v_previous_role_code text;
+BEGIN
+  IF COALESCE(auth.jwt() ->> 'role', '') <> 'service_role' THEN
+    RAISE EXCEPTION 'bootstrap_first_admin requires service_role'
+      USING ERRCODE = '42501';
+  END IF;
+
+  v_email := NULLIF(lower(trim(COALESCE(p_email, ''))), '');
+  IF p_user_id IS NULL OR v_email IS NULL THEN
+    RAISE EXCEPTION 'A user id and email are required'
+      USING ERRCODE = '22023';
+  END IF;
+
+  SELECT lower(trim(u.email))
+  INTO v_auth_email
+  FROM auth.users u
+  WHERE u.id = p_user_id;
+
+  IF v_auth_email IS NULL OR v_auth_email <> v_email THEN
+    RAISE EXCEPTION 'Auth user and email do not match'
+      USING ERRCODE = '22023';
+  END IF;
+
+  PERFORM pg_advisory_xact_lock(hashtextextended('brightweb:first-admin-bootstrap', 0));
+
+  IF EXISTS (
+    SELECT 1
+    FROM public.user_role_assignments ura
+    WHERE ura.role_code = 'admin'
+  ) THEN
+    RAISE EXCEPTION 'A project administrator already exists'
+      USING ERRCODE = '42501';
+  END IF;
+
+  SELECT p.id
+  INTO v_profile_id
+  FROM public.profiles p
+  WHERE p.user_id = p_user_id
+  FOR UPDATE;
+
+  IF v_profile_id IS NULL THEN
+    IF EXISTS (
+      SELECT 1
+      FROM public.profiles p
+      WHERE lower(p.email) = v_email
+    ) THEN
+      RAISE EXCEPTION 'A profile already exists for this email'
+        USING ERRCODE = '23505';
+    END IF;
+
+    INSERT INTO public.profiles (user_id, email)
+    VALUES (p_user_id, v_email)
+    RETURNING id INTO v_profile_id;
+  ELSE
+    UPDATE public.profiles
+    SET email = v_email,
+        updated_at = now()
+    WHERE id = v_profile_id;
+  END IF;
+
+  SELECT ura.role_code
+  INTO v_previous_role_code
+  FROM public.user_role_assignments ura
+  WHERE ura.profile_id = v_profile_id
+  FOR UPDATE;
+
+  INSERT INTO public.user_role_assignments (
+    profile_id,
+    role_code,
+    assigned_by_profile_id,
+    assigned_at,
+    reason
+  )
+  VALUES (
+    v_profile_id,
+    'admin',
+    NULL,
+    now(),
+    'bw_admin_create_bootstrap'
+  )
+  ON CONFLICT (profile_id)
+  DO UPDATE SET
+    role_code = EXCLUDED.role_code,
+    assigned_by_profile_id = NULL,
+    assigned_at = EXCLUDED.assigned_at,
+    reason = EXCLUDED.reason;
+
+  RETURN QUERY SELECT v_profile_id, v_previous_role_code;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.bootstrap_first_admin(uuid, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.bootstrap_first_admin(uuid, text) FROM anon;
+REVOKE ALL ON FUNCTION public.bootstrap_first_admin(uuid, text) FROM authenticated;
+GRANT EXECUTE ON FUNCTION public.bootstrap_first_admin(uuid, text) TO service_role;