sim-setup 1.0.24-preview.146.1 → 1.0.24-preview.149.1

package/dist/docker-compose.prod.yml

@@ -15,7 +15,7 @@ services:
           memory: 8G
     environment:
       - NODE_ENV=production
-      - DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-simstudio}
+      - 'DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:?is required. For a new install set it in .env to the output of: openssl rand -hex 24. An install created before it was required uses the password postgres - set POSTGRES_PASSWORD=postgres to keep its data.}@db:5432/${POSTGRES_DB:-simstudio}'
       - BETTER_AUTH_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
       - NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
       # TRUSTED_ORIGINS: comma-separated public origins to trust for auth in
@@ -85,7 +85,7 @@ services:
           memory: 1G
     environment:
       - NODE_ENV=production
-      - DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-simstudio}
+      - 'DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:?is required. For a new install set it in .env to the output of: openssl rand -hex 24. An install created before it was required uses the password postgres - set POSTGRES_PASSWORD=postgres to keep its data.}@db:5432/${POSTGRES_DB:-simstudio}'
       - NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
       # Derived from NEXT_PUBLIC_APP_URL, matching the simstudio service — a
       # single public-origin variable keeps the two from disagreeing.
@@ -109,7 +109,7 @@ services:
     image: ghcr.io/simstudioai/migrations:${SIM_VERSION:-latest}
     working_dir: /app/packages/db
     environment:
-      - DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-simstudio}
+      - 'DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:?is required. For a new install set it in .env to the output of: openssl rand -hex 24. An install created before it was required uses the password postgres - set POSTGRES_PASSWORD=postgres to keep its data.}@db:5432/${POSTGRES_DB:-simstudio}'
     depends_on:
       db:
         condition: service_healthy
@@ -151,14 +151,21 @@ services:
       simstudio:
         condition: service_healthy
 
+  # Not published to the host: app, realtime and migrations reach it over the
+  # Compose network as db:5432. A host `ports:` mapping binds every interface and
+  # Docker's own iptables rules bypass host firewalls, so it would put the
+  # database on the network. For host access (psql, a desktop client), use
+  # `docker compose exec db psql -U postgres simstudio`, or pass a second -f
+  # file that publishes '127.0.0.1:5432:5432' (-f disables override files).
   db:
     image: pgvector/pgvector:pg17
     restart: unless-stopped
-    ports:
-      - '${POSTGRES_PORT:-5432}:5432'
     environment:
       - POSTGRES_USER=${POSTGRES_USER:-postgres}
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
+      # Postgres applies this only when it creates the data volume; later
+      # changes are ignored. An install created before this was required got
+      # the password `postgres` — set exactly that to keep it working.
+      - 'POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?is required. For a new install set it in .env to the output of: openssl rand -hex 24. An install created before it was required uses the password postgres - set POSTGRES_PASSWORD=postgres to keep its data.}'
       - POSTGRES_DB=${POSTGRES_DB:-simstudio}
     volumes:
       - postgres_data:/var/lib/postgresql/data

package/dist/index.js

@@ -11415,6 +11415,76 @@ var init_compose_asset = __esm(() => {
   init_context();
 });
 
+// src/compose-database.ts
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { readFileSync as readFileSync7 } from "node:fs";
+function composeFileRequiresPostgresPassword(composeFile) {
+  return readFileSync7(composeFile, "utf8").includes("${POSTGRES_PASSWORD:?");
+}
+function choosePostgresPassword(envFileValue, project, { shell = process.env, hasDatabaseVolume = composeDatabaseVolumeExists } = {}) {
+  const shellValue = shell.POSTGRES_PASSWORD;
+  if (shellValue === "") {
+    throw new SetupError("POSTGRES_PASSWORD is exported but empty, and Compose uses it over .env.", ["unset it (unset POSTGRES_PASSWORD) so the value in .env applies"]);
+  }
+  if (shellValue !== undefined || envFileValue)
+    return null;
+  return hasDatabaseVolume(project) ? { value: LEGACY_POSTGRES_PASSWORD, source: "legacy" } : { value: generateSecret(), source: "generated" };
+}
+function composeDatabaseVolumeExists(project) {
+  const result = spawnSync5("docker", [
+    "volume",
+    "ls",
+    "-q",
+    "--filter",
+    `label=com.docker.compose.project=${project}`,
+    "--filter",
+    `label=com.docker.compose.volume=${POSTGRES_VOLUME}`
+  ], { encoding: "utf8" });
+  if (result.status !== 0) {
+    throw new SetupError(`could not check for an existing database volume: ${result.stderr.trim() || result.stdout.trim()}`);
+  }
+  return result.stdout.trim().length > 0;
+}
+function composeProjectName(composeFile, cwd) {
+  const result = spawnSync5("docker", ["compose", "-f", composeFile, "config", "--no-interpolate", "--format", "json"], { cwd, encoding: "utf8" });
+  const name = result.status === 0 ? parseProjectName(result.stdout) : null;
+  if (name)
+    return name;
+  throw new SetupError(`could not resolve the Compose project name for ${composeFile}: ${result.stderr.trim() || "no name in docker compose config"}`);
+}
+function parseProjectName(stdout) {
+  try {
+    const { name } = JSON.parse(stdout);
+    return typeof name === "string" && name ? name : null;
+  } catch {
+    return null;
+  }
+}
+function reportPostgresPasswordChoice(choice, { compose, user, envPath }) {
+  if (choice.source === "generated") {
+    log2.step(`Generated POSTGRES_PASSWORD in ${envPath}`);
+    return;
+  }
+  note2([
+    `This database was created with the password "${LEGACY_POSTGRES_PASSWORD}", so ${envPath}`,
+    `now sets POSTGRES_PASSWORD=${LEGACY_POSTGRES_PASSWORD} to keep it working. The database is not`,
+    "published to the host, so only the containers in this stack can reach it. To rotate it:",
+    `  ${compose} exec db psql -U ${user} -c "ALTER ROLE CURRENT_USER PASSWORD '<new password>'"`,
+    "  then set POSTGRES_PASSWORD=<new password> in .env and run: npx sim-setup start"
+  ].join(`
+`), "Database password");
+}
+function postgresUser(envFileValue) {
+  const shellUser = process.env.POSTGRES_USER;
+  return shellUser === undefined ? envFileValue || "postgres" : shellUser || "postgres";
+}
+var LEGACY_POSTGRES_PASSWORD = "postgres", POSTGRES_VOLUME = "postgres_data";
+var init_compose_database = __esm(() => {
+  init_env_files();
+  init_errors2();
+  init_prompter();
+});
+
 // src/compose-project.ts
 import { createHash as createHash3 } from "node:crypto";
 import path7 from "node:path";
@@ -11432,12 +11502,12 @@ function legacyComposeProjectName(root) {
 var init_compose_project = () => {};
 
 // src/docker.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
+import { spawnSync as spawnSync6 } from "node:child_process";
 import { existsSync as existsSync7 } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 function daemonUp() {
-  return spawnSync5("docker", ["info"], { stdio: "ignore" }).status === 0;
+  return spawnSync6("docker", ["info"], { stdio: "ignore" }).status === 0;
 }
 function installed() {
   return executableExists("docker");
@@ -11446,7 +11516,7 @@ function orbstackSelected() {
   const host = process.env.DOCKER_HOST;
   if (host)
     return host.includes(".orbstack/");
-  const result = spawnSync5("docker", ["context", "show"], { encoding: "utf8" });
+  const result = spawnSync6("docker", ["context", "show"], { encoding: "utf8" });
   return result.status === 0 && result.stdout.trim() === "orbstack";
 }
 function appInstalled(app) {
@@ -11459,7 +11529,7 @@ function macDockerApp() {
   return { app: orbstackOnly ? ORBSTACK_APP : DOCKER_DESKTOP_APP, explicit: false };
 }
 function openApp(app) {
-  return spawnSync5("open", ["-a", app.name], { stdio: "ignore" }).status === 0;
+  return spawnSync6("open", ["-a", app.name], { stdio: "ignore" }).status === 0;
 }
 function startDockerApp({ app, explicit }) {
   if (openApp(app))
@@ -11544,9 +11614,9 @@ var init_docker = __esm(() => {
 });
 
 // src/modes/k8s.ts
-import { spawn, spawnSync as spawnSync6 } from "node:child_process";
+import { spawn, spawnSync as spawnSync7 } from "node:child_process";
 function run(command, args, failMessage, input) {
-  const result = spawnSync6(command, args, { encoding: "utf8", input, cwd: ROOT });
+  const result = spawnSync7(command, args, { encoding: "utf8", input, cwd: ROOT });
   if (result.status !== 0) {
     throw new Error(`${failMessage}: ${result.stderr.trim() || result.stdout.trim()}`);
   }
@@ -11560,12 +11630,12 @@ function isLocalKubeContext(context) {
   return server !== null && LOCAL_SERVER_HOSTS.has(server);
 }
 function clusterReachable(context) {
-  return spawnSync6("kubectl", ["cluster-info", "--context", context, "--request-timeout=5s"], {
+  return spawnSync7("kubectl", ["cluster-info", "--context", context, "--request-timeout=5s"], {
     stdio: "ignore"
   }).status === 0;
 }
 function contextServerHost(context) {
-  const result = spawnSync6("kubectl", [
+  const result = spawnSync7("kubectl", [
     "config",
     "view",
     "--minify",
@@ -11638,7 +11708,7 @@ async function ensureLocalContext(detection) {
       const nodes = run("kind", ["get", "nodes", "--name", "sim"], "kind get nodes failed").trim().split(`
 `).filter(Boolean);
       for (const node of nodes)
-        spawnSync6("docker", ["start", node], { stdio: "ignore" });
+        spawnSync7("docker", ["start", node], { stdio: "ignore" });
       const up = await waitFor(() => Promise.resolve(clusterReachable("kind-sim")), 60000, 2000);
       if (!up) {
         spin.stop(`${glyph.fail} kind cluster "sim" would not start`);
@@ -11658,7 +11728,7 @@ async function ensureLocalContext(detection) {
   return "kind-sim";
 }
 function podProgress(context) {
-  const result = spawnSync6("kubectl", [
+  const result = spawnSync7("kubectl", [
     "get",
     "pods",
     "--context",
@@ -11728,7 +11798,7 @@ async function helmInstall(args, input, context, spin) {
 }
 function existingReleaseValues(context) {
   const scope = ["--kube-context", context, "-n", NAMESPACE];
-  const status = spawnSync6("helm", ["status", RELEASE, ...scope], { stdio: "ignore" });
+  const status = spawnSync7("helm", ["status", RELEASE, ...scope], { stdio: "ignore" });
   if (status.status !== 0)
     return null;
   return JSON.parse(run("helm", ["get", "values", RELEASE, ...scope, "-o", "json"], "helm get values failed"));
@@ -11825,7 +11895,7 @@ async function runK8sMode(detection) {
   spin.stop("Release deployed, all pods ready");
   const testSpin = spinner2();
   testSpin.start("Running helm test…");
-  const test = spawnSync6("helm", ["test", RELEASE, "--kube-context", context, "-n", NAMESPACE], {
+  const test = spawnSync7("helm", ["test", RELEASE, "--kube-context", context, "-n", NAMESPACE], {
     encoding: "utf8",
     cwd: ROOT
   });
@@ -11876,7 +11946,7 @@ ${forwardCommands(context).map((command) => `  ${command}`).join(`
     log2.warn(`The realtime forward (:3002) stopped — the editor's socket will not connect. ${realtimeError.trim() || `Check that :3002 is free and svc/${RELEASE}-realtime exists.`}`);
   });
   log2.step(`Forwarding ${APP_URL} (app) and :3002 (realtime) — Ctrl-C to stop`);
-  spawnSync6("kubectl", [...scope, "port-forward", `svc/${RELEASE}-app`, "3000:3000"], {
+  spawnSync7("kubectl", [...scope, "port-forward", `svc/${RELEASE}-app`, "3000:3000"], {
     stdio: "inherit"
   });
   stopping = true;
@@ -11907,8 +11977,8 @@ var init_k8s = __esm(() => {
 });
 
 // src/lifecycle.ts
-import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
+import { spawnSync as spawnSync8 } from "node:child_process";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "node:fs";
 import path8 from "node:path";
 function shq2(value) {
   if (/^[A-Za-z0-9._/-]+$/.test(value))
@@ -11916,17 +11986,17 @@ function shq2(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function dockerReachable() {
-  return spawnSync7("docker", ["info"], { stdio: "ignore" }).status === 0;
+  return spawnSync8("docker", ["info"], { stdio: "ignore" }).status === 0;
 }
 function dockerText(args, cwd = ROOT) {
-  const result = spawnSync7("docker", args, { cwd, encoding: "utf8" });
+  const result = spawnSync8("docker", args, { cwd, encoding: "utf8" });
   return result.status === 0 ? result.stdout.trim() : null;
 }
 function dockerInherit(args, cwd = ROOT) {
-  return spawnSync7("docker", args, { cwd, stdio: "inherit" }).status ?? 1;
+  return spawnSync8("docker", args, { cwd, stdio: "inherit" }).status ?? 1;
 }
 function dockerRun(args, failMessage, cwd = ROOT) {
-  const result = spawnSync7("docker", args, { cwd, encoding: "utf8" });
+  const result = spawnSync8("docker", args, { cwd, encoding: "utf8" });
   if (result.status !== 0) {
     throw new SetupError(`${failMessage}: ${result.stderr.trim() || result.stdout.trim()}`);
   }
@@ -11935,7 +12005,7 @@ function isSimComposeFile(file) {
   if (!COMPOSE_FILES2.includes(path8.basename(file)))
     return false;
   try {
-    const contents = readFileSync7(file, "utf8");
+    const contents = readFileSync8(file, "utf8");
     return SIM_COMPOSE_MARKERS2.some((marker) => contents.includes(marker));
   } catch {
     return false;
@@ -11972,7 +12042,7 @@ function composeInstallFromDirectory(root, activeInstalls) {
   if (activeInstalls.some((install) => path8.resolve(install.file) === path8.resolve(file)))
     return null;
   const envFile = path8.join(root, ".env");
-  const configuredProject = existsSync8(envFile) ? parseEnv(readFileSync7(envFile, "utf8")).get("COMPOSE_PROJECT_NAME") : undefined;
+  const configuredProject = existsSync8(envFile) ? parseEnv(readFileSync8(envFile, "utf8")).get("COMPOSE_PROJECT_NAME") : undefined;
   return {
     kind: "compose",
     file,
@@ -11983,6 +12053,22 @@ function composeInstallFromDirectory(root, activeInstalls) {
 function composeArgs(install, ...verb) {
   return ["compose", "-p", install.project, "-f", install.file, ...verb];
 }
+function ensureComposePostgresPassword(install) {
+  if (!composeFileRequiresPostgresPassword(install.file))
+    return;
+  const envPath = path8.join(install.dir, ".env");
+  const content = existsSync8(envPath) ? readFileSync8(envPath, "utf8") : "";
+  const vars = parseEnv(content);
+  const choice = choosePostgresPassword(vars.get("POSTGRES_PASSWORD"), install.project);
+  if (!choice)
+    return;
+  writeEnvFile(envPath, upsertEnv(content, "POSTGRES_PASSWORD", choice.value));
+  reportPostgresPasswordChoice(choice, {
+    compose: `docker compose -p ${install.project} -f ${install.file}`,
+    user: postgresUser(vars.get("POSTGRES_USER")),
+    envPath
+  });
+}
 function devInstall(detection) {
   const postgres = detection.dbContainer?.managed ?? false;
   const redis = detection.redisContainer?.managed ?? false;
@@ -11995,7 +12081,7 @@ function k8sInstall(detection) {
   const context = detection.kubeContext;
   if (!context)
     return null;
-  const status = spawnSync7("helm", ["status", K8S_RELEASE, "--kube-context", context, "-n", K8S_NAMESPACE], { stdio: "ignore" });
+  const status = spawnSync8("helm", ["status", K8S_RELEASE, "--kube-context", context, "-n", K8S_NAMESPACE], { stdio: "ignore" });
   if (status.status !== 0)
     return null;
   return { kind: "k8s", context, local: isLocalKubeContext(context) };
@@ -12060,6 +12146,7 @@ function k8sReachHints(context) {
 }
 function start(install) {
   if (install.kind === "compose") {
+    ensureComposePostgresPassword(install);
     const spin = spinner2();
     spin.start("Starting containers…");
     dockerRun(composeArgs(install, "up", "-d"), "docker compose up failed", install.dir);
@@ -12113,6 +12200,7 @@ function stop(install) {
 }
 function restart(install) {
   if (install.kind === "compose") {
+    ensureComposePostgresPassword(install);
     const spin = spinner2();
     spin.start("Restarting containers…");
     dockerRun(composeArgs(install, "restart"), "docker compose restart failed", install.dir);
@@ -12156,9 +12244,11 @@ function update(install) {
     ]);
   }
   const mode = getComposeUpdateMode(install.file);
+  if (mode === "pull")
+    install.file = refreshComposeFileForUpdate(install.file, install.dir);
+  ensureComposePostgresPassword(install);
   const spin = spinner2();
   if (mode === "pull") {
-    install.file = refreshComposeFileForUpdate(install.file, install.dir);
     spin.start("Pulling configured Sim images…");
     dockerRun(composeArgs(install, "pull"), "docker compose pull failed", install.dir);
   } else {
@@ -12189,7 +12279,7 @@ function showLogs(install) {
 `), "Logs");
     return;
   }
-  spawnSync7("kubectl", ["--context", install.context, "-n", K8S_NAMESPACE, "logs", "-f", `deploy/${K8S_RELEASE}-app`], { stdio: "inherit" });
+  spawnSync8("kubectl", ["--context", install.context, "-n", K8S_NAMESPACE, "logs", "-f", `deploy/${K8S_RELEASE}-app`], { stdio: "inherit" });
 }
 async function down(install) {
   const ok = await confirm2({
@@ -12209,13 +12299,13 @@ async function down(install) {
     const names = managedNames(install);
     if (names.length) {
       dockerRun(["rm", "-f", ...names], "docker rm failed");
-      log2.step(`Removed ${names.join(", ")} (Postgres volume ${POSTGRES_VOLUME} kept)`);
+      log2.step(`Removed ${names.join(", ")} (Postgres volume ${POSTGRES_VOLUME2} kept)`);
     } else {
       log2.info("No managed containers to remove.");
     }
     return;
   }
-  const result = spawnSync7("helm", ["uninstall", K8S_RELEASE, "--kube-context", install.context, "-n", K8S_NAMESPACE], { stdio: "inherit" });
+  const result = spawnSync8("helm", ["uninstall", K8S_RELEASE, "--kube-context", install.context, "-n", K8S_NAMESPACE], { stdio: "inherit" });
   if (result.status !== 0)
     throw new SetupError("helm uninstall failed");
   log2.step(`Uninstalled ${K8S_RELEASE}`);
@@ -12247,11 +12337,11 @@ async function reset2(install) {
   } else if (install?.kind === "dev") {
     const names = managedNames(install);
     if (names.length)
-      spawnSync7("docker", ["rm", "-f", ...names], { cwd: ROOT, stdio: "ignore" });
-    spawnSync7("docker", ["volume", "rm", POSTGRES_VOLUME], { cwd: ROOT, stdio: "ignore" });
+      spawnSync8("docker", ["rm", "-f", ...names], { cwd: ROOT, stdio: "ignore" });
+    spawnSync8("docker", ["volume", "rm", POSTGRES_VOLUME2], { cwd: ROOT, stdio: "ignore" });
     log2.step("Managed containers and Postgres volume removed");
   } else if (install?.kind === "k8s") {
-    const uninstall = spawnSync7("helm", ["uninstall", K8S_RELEASE, "--kube-context", install.context, "-n", K8S_NAMESPACE], { stdio: "inherit" });
+    const uninstall = spawnSync8("helm", ["uninstall", K8S_RELEASE, "--kube-context", install.context, "-n", K8S_NAMESPACE], { stdio: "inherit" });
     if (uninstall.status !== 0) {
       throw new SetupError(`env files were archived, but helm uninstall failed — the ${K8S_RELEASE} release is still running.`, [
         `retry: ${theme.command(`helm uninstall ${K8S_RELEASE} --kube-context ${shq2(install.context)} -n ${K8S_NAMESPACE}`)}`,
@@ -12318,9 +12408,10 @@ async function runLifecycle(command) {
       return down(install);
   }
 }
-var REALTIME_HEALTH = "http://localhost:3002/health", POSTGRES_VOLUME = "sim-postgres-data", COMPOSE_FILES2, K8S_RELEASE = "sim-dev", K8S_NAMESPACE = "sim-dev", SIM_COMPOSE_MARKERS2;
+var REALTIME_HEALTH = "http://localhost:3002/health", POSTGRES_VOLUME2 = "sim-postgres-data", COMPOSE_FILES2, K8S_RELEASE = "sim-dev", K8S_NAMESPACE = "sim-dev", SIM_COMPOSE_MARKERS2;
 var init_lifecycle = __esm(() => {
   init_compose_asset();
+  init_compose_database();
   init_compose_project();
   init_context();
   init_detect();
@@ -12472,10 +12563,10 @@ var init_ports = __esm(() => {
 });
 
 // src/modes/compose.ts
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 import path9 from "node:path";
 function activeComposeProject(composeFile) {
-  const result = spawnSync8("docker", ["compose", "ls", "-a", "--format", "json"], {
+  const result = spawnSync9("docker", ["compose", "ls", "-a", "--format", "json"], {
     encoding: "utf8"
   });
   if (result.status !== 0)
@@ -12496,7 +12587,7 @@ function composeCommand(composeFile, project) {
   return `docker compose${project ? ` -p ${project}` : ""} -f ${composeFile}`;
 }
 function composePublishedPorts(composeFile, project) {
-  const ids = spawnSync8("docker", composeArgs2(composeFile, project, "ps", "-q"), {
+  const ids = spawnSync9("docker", composeArgs2(composeFile, project, "ps", "-q"), {
     cwd: ROOT,
     encoding: "utf8"
   });
@@ -12504,7 +12595,7 @@ function composePublishedPorts(composeFile, project) {
 `).filter(Boolean) : [];
   if (containers.length === 0)
     return new Set;
-  const inspect = spawnSync8("docker", [
+  const inspect = spawnSync9("docker", [
     "inspect",
     ...containers,
     "--format",
@@ -12569,6 +12660,9 @@ async function runComposeMode(detection, quick) {
   if (composeProject && !configuredComposeProject) {
     values.COMPOSE_PROJECT_NAME = composeProject;
   }
+  const postgresPassword = composeFileRequiresPostgresPassword(composeFile) ? choosePostgresPassword(root.vars.get("POSTGRES_PASSWORD"), composeProject ?? composeProjectName(composeFile, ROOT)) : null;
+  if (postgresPassword)
+    values.POSTGRES_PASSWORD = postgresPassword.value;
   Object.assign(values, mothershipOverride());
   const copilotKey = await promptCopilotKey(root.vars.get("COPILOT_API_KEY"));
   if (copilotKey)
@@ -12607,7 +12701,14 @@ async function runComposeMode(detection, quick) {
     remove.delete(key);
   reconcileEnvValues("root", [...remove], values);
   log2.step("Wrote .env (compose reads it for variable substitution)");
-  const validation = spawnSync8("docker", composeArgs2(composeFile, composeProject, "config"), {
+  if (postgresPassword) {
+    reportPostgresPasswordChoice(postgresPassword, {
+      compose: composeCommand(composeFile, composeProject),
+      user: postgresUser(root.vars.get("POSTGRES_USER")),
+      envPath: root.path
+    });
+  }
+  const validation = spawnSync9("docker", composeArgs2(composeFile, composeProject, "config"), {
     cwd: ROOT,
     encoding: "utf8"
   });
@@ -12617,7 +12718,7 @@ async function runComposeMode(detection, quick) {
   await ensureComposePortsFree(composeFile, composeProject);
   const command = composeCommand(composeFile, composeProject);
   log2.step(`Running ${command} up -d`);
-  const result = spawnSync8("docker", composeArgs2(composeFile, composeProject, "up", "-d"), {
+  const result = spawnSync9("docker", composeArgs2(composeFile, composeProject, "up", "-d"), {
     cwd: ROOT,
     stdio: "inherit"
   });
@@ -12646,6 +12747,7 @@ var init_compose = __esm(() => {
   init_capability_config();
   init_capability_setup();
   init_compose_asset();
+  init_compose_database();
   init_compose_project();
   init_context();
   init_docker();
@@ -12661,18 +12763,18 @@ var init_compose = __esm(() => {
 });
 
 // src/db.ts
-import { spawnSync as spawnSync9 } from "node:child_process";
+import { spawnSync as spawnSync10 } from "node:child_process";
 function buildDsn(password, hostPort) {
   return `postgresql://postgres:${encodeURIComponent(password)}@localhost:${hostPort}/simstudio`;
 }
 function docker(args) {
-  const result = spawnSync9("docker", args, { encoding: "utf8" });
+  const result = spawnSync10("docker", args, { encoding: "utf8" });
   if (result.status !== 0) {
     throw new Error(`docker ${args[0]} failed: ${result.stderr.trim() || result.stdout.trim()}`);
   }
 }
 function dockerOutput(args) {
-  const result = spawnSync9("docker", args, { encoding: "utf8" });
+  const result = spawnSync10("docker", args, { encoding: "utf8" });
   return result.status === 0 ? result.stdout.trim() : null;
 }
 function inspectManagedContainer() {
@@ -12753,10 +12855,10 @@ async function promptExternalDsn() {
   }
 }
 function volumeInitialized() {
-  if (spawnSync9("docker", ["volume", "inspect", DB_VOLUME], { stdio: "ignore" }).status !== 0) {
+  if (spawnSync10("docker", ["volume", "inspect", DB_VOLUME], { stdio: "ignore" }).status !== 0) {
     return false;
   }
-  return spawnSync9("docker", [
+  return spawnSync10("docker", [
     "run",
     "--rm",
     "-v",
@@ -12862,7 +12964,7 @@ async function startManagedContainer(detection) {
         `or discard the old data: ${theme.command(`docker rm -f ${DB_CONTAINER} && docker volume rm ${DB_VOLUME}`)}`
       ]);
     }
-    const logs = spawnSync9("docker", ["logs", "--tail", "20", DB_CONTAINER], { encoding: "utf8" });
+    const logs = spawnSync10("docker", ["logs", "--tail", "20", DB_CONTAINER], { encoding: "utf8" });
     throw new SetupError(`the Postgres container failed to start. Last logs:
 ${logs.stdout}${logs.stderr}`, [
       `inspect: ${theme.command(`docker logs ${DB_CONTAINER}`)}`,
@@ -12923,9 +13025,9 @@ var init_db = __esm(() => {
 });
 
 // src/redis.ts
-import { spawnSync as spawnSync10 } from "node:child_process";
+import { spawnSync as spawnSync11 } from "node:child_process";
 function managedRedisUrl() {
-  const result = spawnSync10("docker", ["port", REDIS_CONTAINER, "6379/tcp"], { encoding: "utf8" });
+  const result = spawnSync11("docker", ["port", REDIS_CONTAINER, "6379/tcp"], { encoding: "utf8" });
   if (result.status !== 0)
     return null;
   const port = result.stdout.trim().split(`
@@ -12942,7 +13044,7 @@ async function pingWithSpinner(url, label) {
 async function startManagedRedis(detection) {
   const hostPort = detection.redisPortOpen ? 6380 : 6379;
   const url = `redis://localhost:${hostPort}`;
-  spawnSync10("docker", ["rm", "-f", REDIS_CONTAINER], { stdio: "ignore" });
+  spawnSync11("docker", ["rm", "-f", REDIS_CONTAINER], { stdio: "ignore" });
   docker([
     "run",
     "-d",
@@ -13053,12 +13155,12 @@ var init_redis = __esm(() => {
 });
 
 // src/modes/dev.ts
-import { spawnSync as spawnSync11 } from "node:child_process";
+import { spawnSync as spawnSync12 } from "node:child_process";
 import path10 from "node:path";
 async function runMigrations(dsn) {
   const spin = spinner2();
   spin.start("Running database migrations…");
-  const result = spawnSync11("bun", ["run", "db:migrate"], {
+  const result = spawnSync12("bun", ["run", "db:migrate"], {
     cwd: path10.join(ROOT, "packages/db"),
     encoding: "utf8"
   });
@@ -13201,7 +13303,7 @@ var init_dev = __esm(() => {
 });
 
 // src/wizard.ts
-import { spawnSync as spawnSync12 } from "node:child_process";
+import { spawnSync as spawnSync13 } from "node:child_process";
 async function handleExistingConfig(detection) {
   const present = Object.entries(detection.envFiles).filter(([, exists]) => exists).map(([target]) => target === "root" ? ".env" : `${target}/.env`);
   if (present.length === 0)
@@ -13327,11 +13429,11 @@ async function runWizard(flags) {
 `), "Next steps");
   outro2(theme.accent("Sim is ready."));
   if (mode === "compose" && process.platform === "darwin") {
-    spawnSync12("open", [APP_SIGNUP_URL], { stdio: "ignore" });
+    spawnSync13("open", [APP_SIGNUP_URL], { stdio: "ignore" });
   }
   if (startDevNow) {
     if (await ensurePortsFree([3000, 3002])) {
-      const child = spawnSync12("bun", ["run", devScript], { cwd: ROOT, stdio: "inherit" });
+      const child = spawnSync13("bun", ["run", devScript], { cwd: ROOT, stdio: "inherit" });
       process.exitCode = child.status ?? 0;
     } else {
       log2.warn(`Ports still in use — Sim wasn't started. Free them, then run ${theme.command(`bun run ${devScript}`)}.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sim-setup",
-  "version": "1.0.24-preview.146.1",
+  "version": "1.0.24-preview.149.1",
   "description": "Set up and manage a self-hosted Sim installation",
   "type": "module",
   "bin": {