smoonb 1.0.8 → 1.0.10

package/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.0.10] - 2026-10-10
+
+### Fixed
+
+- When a Realtime PATCH succeeds but capacity limits remain different, show the backup and destination values and offer an explicit choice to retain the destination limits. Record accepted differences instead of failing with field names only or claiming an identical restore.
+- Retry readback without repeating PATCH, then re-read all selected Realtime settings after consent. Security switches, connection pools, invalid values, API failures and concurrent configuration changes remain failures.
+- Record refused quota differences in the failure report; allow a retry selecting only Realtime without repeating Database, Auth or Storage. Non-interactive runs never silently accept differences.
+- Preserve SMTP verification limits in combined reports and show completion with notes when any selected component has accepted differences or unverified secrets.
+- Replace obsolete manual-configuration messages in the English and Portuguese Auth/Realtime summaries.
+
+### Tests
+
+- Cover legacy and API snapshots, delayed readback, consent and rejection, non-interactive execution, strict security validation, concurrent changes, secret-safe errors, partial reports and Realtime-only retries.
+
+## [1.0.9] - 2026-10-10
+
+### Fixed
+
+- Treat SMTP passwords as write-only credentials. Never replay the protected SMTP value returned by the Management API from a legacy backup as the provider password.
+- Ask for the real SMTP password with hidden input before restoring any selected components. Fail before remote mutations if it is missing. Keep the entered password in memory only.
+- Verify readable Auth settings independently from password submission. Continue after the API accepts the supplied password, but report `applied_with_unverified_secrets` and require an authentication email test instead of claiming password or email-delivery verification.
+- Omit the protected SMTP value from new Auth snapshots and explicitly record that the provider password is required during restore. Existing backups remain usable.
+
+### Recovery from 1.0.8
+
+- If restore stopped at `Configuration verification failed: smtp_pass`, inspect its `report.json`. When Database and Edge Functions are already verified, run restore with those two components disabled and select Auth, Storage, Database Settings and Realtime as needed. Supply the real provider SMTP password when prompted; no new backup or destination project is required for this specific failure.
+
+### Tests
+
+- Cover legacy/new snapshots, hidden input, missing-password preflight, protected-value rejection, HTTP failures, readable-setting mismatches, partial verification reporting and continuation without reloading the database.
+
 ## [1.0.8] - 2026-10-10
 
 ### Fixed

package/README.md

@@ -26,7 +26,7 @@ smoonb performs a complete backup of all components of your Supabase project:
 - ✅ **Edge Functions** (download automático do servidor)
 - ✅ **Auth Settings** (configurações de autenticação via Management API)
 - ✅ **Storage Buckets** (backup completo: metadados, configurações e todos os arquivos via Management API + Supabase Client, cria ZIP no padrão do Dashboard)
-- ✅ **Realtime Settings** (7 parâmetros capturados interativamente)
+- ✅ **Realtime Settings** (current settings captured through the Management API)
 - ✅ **Supabase .temp** (arquivos temporários do Supabase CLI)
 - ✅ **Migrations** (todas as migrations do projeto via `supabase migration fetch`)
 
@@ -217,7 +217,7 @@ npx smoonb backup --skip-supabase-version-check
    - ⚡ Edge Functions (explanation about link reset and download)
    - 📦 Storage (explanation about full backup: file download + ZIP in Dashboard format)
    - 🔐 Auth Settings (explanation about configurations)
-   - 🔄 Realtime Settings (explanation about interactive capture of 7 parameters)
+   - 🔄 Realtime Settings (current configuration captured through the API)
    - 🗑️ Cleanup options (functions, .temp, migrations after backup)
 8. **Configuration summary** - Shows everything that will be done
 9. **Final confirmation** - Confirms before starting
@@ -226,7 +226,7 @@ npx smoonb backup --skip-supabase-version-check
    - 📊 2/10 - Separate Database SQL (schema, data, roles)
    - 🔧 3/10 - Database Extensions and Settings Backup
    - 🔐 4/10 - Auth Settings Backup (if selected)
-   - 🔄 5/10 - Realtime Settings Backup (if selected) - 7 parameters captured interactively
+   - 🔄 5/10 - Realtime Settings Backup (if selected) - fresh API snapshot
    - 📦 6/10 - Storage Backup (if selected) - Full file download + ZIP in Dashboard format
    - 👥 7/10 - Custom Roles Backup
    - ⚡ 8/10 - Edge Functions Backup (if selected)
@@ -313,7 +313,15 @@ Database loading uses one transaction, stops on errors, suspends triggers only o
 
 Optional URL remapping changes only the project's Supabase hostname, including URLs inside JSON and text files. It does not rename files or replace isolated project IDs. Historical URLs may also change; choose preservation when needed. Signed URLs, custom domains, external integrations and application API keys need separate validation. Destination platform keys are not replaced.
 
-Auth and Realtime are applied through the Management API and verified by reading them back. Legacy Realtime captures may be stale: restoration reproduces the recorded values and date, not the source project's current settings. New backups capture Realtime directly through the API. Legacy function backups without the JWT flag default to requiring JWT; new backups preserve that flag.
+Readable Auth and Realtime settings are applied through the Management API and verified by reading them back. The **SMTP password cannot be exported**: Supabase returns a protected value that cannot be used as the password in another project. Starting with 1.0.9, smoonb requests the real provider password with hidden input **before restoring any components**, including when using legacy backups. It stays in memory only and is sent to the destination Supabase project. The report distinguishes API password acceptance from readback verification (`applied_with_unverified_secrets`). Test an authentication email on the destination; API acceptance does not validate the password with the email provider.
+
+If a 1.0.8 restore stopped at `Configuration verification failed: smtp_pass` and its `report.json` confirms Database and Edge Functions, reuse the same backup and project: run `npx smoonb@1.0.9 restore`, answer **no** for Database and Edge Functions, and **yes** for the pending Auth, Storage, Database Settings and Realtime components. Enter the provider SMTP password when prompted. This specific failure does not require another backup or a database reload.
+
+Legacy Realtime captures may be stale: restoration reproduces the recorded values and date, not the source project's current settings. New backups capture Realtime directly through the API. Legacy function backups without the JWT flag default to requiring JWT; new backups preserve that flag.
+
+Since 1.0.10, if Supabase does not apply numeric Realtime capacity limits, smoonb shows **backup value vs current destination value** and asks whether to retain the destination values. The default is **no**. After acceptance, it re-reads the configuration and records `completed_with_accepted_differences` with exact values, without claiming an identical restore. Security switches, service activation and connection pools still require a match. The tool does not change your plan or spend cap.
+
+If an earlier restore ended only with `Configuration verification failed: max_presence_events_per_second, max_payload_size_in_kb`, consult its report and run `npx smoonb@1.0.10 restore` selecting **only Realtime Settings**. Do not repeat completed components. If you agree with the displayed limits, answer **yes** to the new prompt. Refusal leaves the step pending and records the differences; changes already applied are not undone.
 
 Reports are saved after each stage, including failures. External services cannot share the database transaction: earlier stages remain completed if a later stage fails. Do not reload the database into a populated destination. Resolve the reported stage and select only pending components, or use another empty project.
 
@@ -468,7 +476,7 @@ restore/
 #### Auth, Realtime
 - **Management API**: Uses Personal Access Token
 - **JSON Export**: Configurations exported as JSON
-- **Realtime Settings**: Interactive capture of 7 parameters:
+- **Realtime Settings**: Fresh API capture, including:
   1. Enable Realtime service
   2. Allow public access
   3. Database connection pool size
@@ -476,25 +484,25 @@ restore/
   5. Max events per second
   6. Max presence events per second
   7. Max payload size in KB
-- **Manual for some**: Some settings need to be applied manually for security
+- **SMTP password**: Not exportable; requested with hidden input during restore.
 
 ### Restore Strategy
 
 #### Database
 - **Format Support**:
-  - `.backup.gz` - Automatically decompresses via Docker
+  - `.backup.gz` - Reads compressed content without modifying the archive
   - `.backup` - Restores directly via `psql` (Docker)
-- **Clean Restore**: Can overwrite existing data (with confirmation)
+- **Empty Destination**: Requires an empty destination for the database; skip this component when retrying later stages that failed.
 
 #### Edge Functions
-- **Clean Deploy**: Cleans `supabase/functions` before deploy
-- **Link Reset**: Ensures correct link with target project
+- **Isolated Deploy**: Uses a temporary workspace, preserving local `supabase/functions` files
+- **Explicit Destination**: Passes the target project reference to the CLI
 - **Automatic Deploy**: Uses `supabase functions deploy`
 
 #### Other Components
 - **Database Settings**: Restores via SQL
 - **Storage**: Restores buckets and files from ZIP (if available) or displays information for manual configuration
-- **Auth/Realtime**: Displays information for manual configuration in Dashboard
+- **Auth/Realtime**: Applies and checks configurations through the API; reports SMTP verification limits and any explicitly accepted Realtime capacity differences.
 
 ### Cross-Platform
 

package/README.pt-BR.md

@@ -26,7 +26,7 @@ O smoonb faz backup completo de todos os componentes do seu projeto Supabase:
 - ✅ **Edge Functions** (download automático do servidor)
 - ✅ **Auth Settings** (configurações de autenticação via Management API)
 - ✅ **Storage Buckets** (backup completo: metadados, configurações e todos os arquivos via Management API + Supabase Client, cria ZIP no padrão do Dashboard)
-- ✅ **Realtime Settings** (7 parâmetros capturados interativamente)
+- ✅ **Realtime Settings** (configurações atuais capturadas pela Management API)
 - ✅ **Supabase .temp** (arquivos temporários do Supabase CLI)
 - ✅ **Migrations** (todas as migrations do projeto via `supabase migration fetch`)
 
@@ -313,7 +313,15 @@ A carga do banco usa uma transação com interrupção em erro, suspende trigger
 
 O remapeamento opcional troca apenas o domínio Supabase do projeto em URLs, inclusive em JSON e arquivos de texto. Não troca IDs isolados nem nomes de arquivos. URLs históricas também podem ser afetadas; escolha preservar quando isso for necessário. URLs assinadas, domínios personalizados, integrações externas e chaves de API da aplicação precisam de validação específica. As chaves de plataforma do destino não são substituídas.
 
-Auth e Realtime são aplicados pela Management API e conferidos por nova leitura. A captura antiga de Realtime pode conter valores desatualizados: a restauração reproduz os valores e a data registrados, não o estado atual do projeto original. Novos backups capturam Realtime diretamente pela API. Em backups antigos sem o sinalizador de JWT de Functions, o padrão seguro é exigir JWT; os novos backups guardam esse sinalizador.
+As configurações legíveis de Auth e Realtime são aplicadas pela Management API e conferidas por nova leitura. A **senha SMTP não é exportável**: o Supabase devolve um valor protegido, que não pode ser usado como senha em outro projeto. A partir da versão 1.0.9, o smoonb solicita a senha real do provedor em campo oculto **antes de restaurar os componentes**, inclusive ao usar backups antigos. Ela permanece somente na memória e é enviada ao Supabase de destino. O relatório distingue senha aceita pela API de configurações verificadas por leitura (`applied_with_unverified_secrets`). Teste o envio de e-mail de autenticação no destino; aceitar uma senha pela API não comprova sua validade junto ao provedor.
+
+Se uma restauração 1.0.8 parou em `Configuration verification failed: smtp_pass` e o `report.json` confirmou Database e Edge Functions, use o mesmo backup e projeto: execute `npx smoonb@1.0.9 restore`, responda **não** para Database e Edge Functions e **sim** para Auth, Storage, Database Settings e Realtime que ficaram pendentes. Informe a senha SMTP do provedor quando solicitada. Não é necessário refazer o backup nem recarregar o banco nesse caso.
+
+A captura antiga de Realtime pode conter valores desatualizados: a restauração reproduz os valores e a data registrados, não o estado atual do projeto original. Novos backups capturam Realtime diretamente pela API. Em backups antigos sem o sinalizador de JWT de Functions, o padrão seguro é exigir JWT; os novos backups guardam esse sinalizador.
+
+Desde a versão 1.0.10, se o Supabase não aplicar limites numéricos de Realtime, o smoonb mostra **valor do backup × valor atual do destino** e pergunta se você aceita manter os valores do destino. O padrão é **não**. Ao aceitar, ele relê as configurações e registra `completed_with_accepted_differences`, com os valores exatos, sem afirmar que o destino é idêntico ao backup. Configurações de segurança, ativação do serviço e pools de conexão continuam exigindo correspondência. A ferramenta não altera seu plano nem o limite de gastos.
+
+Se uma restauração anterior terminou apenas com `Configuration verification failed: max_presence_events_per_second, max_payload_size_in_kb`, consulte o relatório anterior e execute `npx smoonb@1.0.10 restore` selecionando **somente Realtime Settings**. Não repita componentes já concluídos. Se concordar com os limites mostrados, responda **sim** à nova pergunta. Recusar mantém a etapa pendente e registra as diferenças; alterações já aplicadas não são desfeitas.
 
 O relatório é salvo durante cada etapa, inclusive em falhas. Serviços externos não participam da transação do banco: se uma etapa posterior falhar, as anteriores permanecem registradas como concluídas. Não repita a carga do banco em um destino já preenchido. Resolva a etapa indicada e selecione apenas os componentes pendentes, ou use outro projeto vazio.
 
@@ -468,7 +476,7 @@ restore/
 #### Auth, Realtime
 - **Management API**: Usa Personal Access Token
 - **JSON Export**: Configurações exportadas como JSON
-- **Realtime Settings**: Captura interativa de 7 parâmetros:
+- **Realtime Settings**: Captura atual pela API, incluindo:
   1. Habilitar serviço Realtime
   2. Permitir acesso público
   3. Tamanho do pool de conexões do database
@@ -476,25 +484,25 @@ restore/
   5. Máximo de eventos por segundo
   6. Máximo de eventos de presença por segundo
   7. Tamanho máximo do payload em KB
-- **Manual para alguns**: Alguns settings precisam ser aplicados manualmente por segurança
+- **Senha SMTP**: Não exportável; solicitada em campo oculto durante a restauração.
 
 ### Estratégia de Restauração
 
 #### Database
 - **Suporte a Formatos**:
-  - `.backup.gz` - Descompacta automaticamente via Docker
+  - `.backup.gz` - Lê o conteúdo compactado sem alterar o arquivo original
   - `.backup` - Restaura diretamente via `psql` (Docker)
-- **Restauração Limpa**: Pode sobrescrever dados existentes (com confirmação)
+- **Destino Vazio**: Exige destino vazio para restaurar o banco; desmarque esse componente ao repetir etapas posteriores que falharam.
 
 #### Edge Functions
-- **Deploy Limpo**: Limpa `supabase/functions` antes do deploy
-- **Reset de Link**: Garante link correto com projeto destino
+- **Deploy Isolado**: Usa uma pasta temporária, preservando os arquivos locais de `supabase/functions`
+- **Destino Explícito**: Passa a referência do projeto de destino ao CLI
 - **Deploy Automático**: Usa `supabase functions deploy`
 
 #### Outros Componentes
 - **Database Settings**: Restaura via SQL
 - **Storage**: Restaura buckets e arquivos do ZIP (se disponível) ou exibe informações para configuração manual
-- **Auth/Realtime**: Exibe informações para configuração manual no Dashboard
+- **Auth/Realtime**: Aplica e confere as configurações pela API; registra os limites da verificação SMTP e diferenças de capacidade do Realtime aceitas explicitamente.
 
 ### Multiplataforma
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoonb",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "description": "Complete Supabase backup and migration tool. https://www.smoonb.com/#price",
   "preferGlobal": false,
   "preventGlobalInstall": true,

package/src/commands/backup/steps/05-auth-settings.js

@@ -2,6 +2,7 @@ const chalk = require('chalk');
 const path = require('path');
 const { writeJson } = require('../../../utils/fsx');
 const { t } = require('../../../i18n');
+const { authSnapshot } = require('../../../utils/auth-secrets');
 
 /**
  * Etapa 4: Backup Auth Settings via Management API
@@ -26,15 +27,18 @@ module.exports = async ({ projectId, accessToken, backupDir }) => {
 
     const authSettings = await authResponse.json();
     
-    // Salvar configurações de Auth
+    const snapshot = authSnapshot(authSettings);
+    // Never store the opaque SMTP readback as a recoverable password.
     const authSettingsPath = path.join(backupDir, 'auth-settings.json');
     await writeJson(authSettingsPath, {
       project_id: projectId,
       timestamp: new Date().toISOString(),
-      settings: authSettings
+      ...snapshot
     });
 
     console.log(chalk.green(`✅ Auth Settings exportadas: ${path.basename(authSettingsPath)}`));
+    if (snapshot.secrets.smtp_pass.requires_input)
+      console.log(chalk.yellow(getT('backup.smtp.passwordNotExported')));
     return { success: true };
 
   } catch (error) {

package/src/commands/restore/auth.js

@@ -0,0 +1,65 @@
+const fs = require('fs');
+const path = require('path');
+const inquirer = require('inquirer');
+const { t } = require('../../i18n');
+const { remapServiceUrls } = require('./dump');
+const { isMasked } = require('../../utils/auth-secrets');
+
+async function prepareAuth(
+  { backupPath, targetProject, remapUrls = true },
+  {
+    prompt = (questions) => inquirer.prompt(questions),
+    interactive = Boolean(process.stdin.isTTY),
+    log = console.log,
+  } = {},
+) {
+  const getT = global.smoonbI18n?.t || t;
+  const backup = JSON.parse(
+    fs.readFileSync(path.join(backupPath, 'auth-settings.json'), 'utf8'),
+  );
+  const settings =
+    backup.settings?.auth_url_config ||
+    backup.settings ||
+    backup.auth_url_config;
+  if (!settings || !Object.keys(settings).length)
+    throw new Error('Auth configuration missing from backup');
+  // Never replay an opaque value from a legacy backup as a password.
+  const { smtp_pass: stored, ...readable } = settings;
+  const desired = remapUrls
+    ? JSON.parse(
+        remapServiceUrls(
+          JSON.stringify(readable),
+          backup.project_id,
+          targetProject.targetProjectId,
+        ),
+      )
+    : readable;
+  const needsPassword = Boolean(
+    stored || settings.smtp_host || backup.secrets?.smtp_pass?.requires_input,
+  );
+  const writeOnly = {};
+  if (needsPassword) {
+    log(getT('restore.smtp.explanation'));
+    if (!interactive) throw new Error(getT('restore.smtp.interactiveRequired'));
+    const validate = (value) =>
+      typeof value === 'string' &&
+      value.trim().length > 0 &&
+      !isMasked(value) &&
+      value !== stored;
+    const answer = await prompt([
+      {
+        type: 'password',
+        name: 'smtpPassword',
+        mask: '*',
+        message: getT('restore.smtp.password'),
+        validate: (value) => validate(value) || getT('restore.smtp.required'),
+      },
+    ]);
+    if (!validate(answer.smtpPassword))
+      throw new Error(getT('restore.smtp.required'));
+    writeOnly.smtp_pass = answer.smtpPassword;
+  }
+  return { desired, writeOnly };
+}
+
+module.exports = { prepareAuth };

package/src/commands/restore/index.js

@@ -174,7 +174,10 @@ module.exports = async (options = {}) => {
     const restoreResults = await runRestore({ selectedBackup, components, targetProject, processDir, postgresMajor:parsedMajor, remapUrls });
 
     // Exibir resumo final
-    ui.success(`\n🎉 ${getT('restore.index.restoreComplete')}`);
+    if (Object.values(restoreResults).some(result => !result.verified))
+      ui.warn(`\n${getT('restore.index.restoreCompleteWithNotes')}`);
+    else
+      ui.success(`\n🎉 ${getT('restore.index.restoreComplete')}`);
     ui.link(`🎯 ${getT('restore.index.targetProjectFinal', { projectId: targetProject.targetProjectId || getT('restore.index.notConfigured') })}`);
 
     if (restoreResults.database) {
@@ -188,7 +191,10 @@ module.exports = async (options = {}) => {
     }
 
     if (restoreResults.authSettings) {
-      ui.success(`🔐 ${getT('restore.index.authSettingsRestored')}`);
+      if (restoreResults.authSettings.verified)
+        ui.success(`🔐 ${getT('restore.index.authSettingsRestored')}`);
+      else
+        ui.warn(getT('restore.smtp.accepted'));
     }
 
     if (restoreResults.storage) {
@@ -208,7 +214,10 @@ module.exports = async (options = {}) => {
     }
 
     if (restoreResults.realtimeSettings) {
-      ui.success(`🔄 ${getT('restore.index.realtimeSettingsRestored')}`);
+      if (restoreResults.realtimeSettings.verified)
+        ui.success(`🔄 ${getT('restore.index.realtimeSettingsRestored')}`);
+      else
+        ui.warn(getT('restore.realtime.accepted'));
     }
 
     sendTelemetry({

package/src/commands/restore/management.js

@@ -1,3 +1,15 @@
+const { isMasked } = require('../../utils/auth-secrets');
+
+class ConfigurationVerificationError extends Error {
+  constructor(fields, updatedFields) {
+    super(`Configuration verification failed: ${fields.join(', ')}`);
+    this.name = 'ConfigurationVerificationError';
+    // Field names only: Auth readback may contain credentials.
+    this.fields = [...fields];
+    this.updatedFields = [...updatedFields];
+  }
+}
+
 async function management(
   target,
   endpoint,
@@ -33,9 +45,29 @@ async function applyConfig(
   desired,
   allowed,
   request = management,
+  { writeOnly = {} } = {},
 ) {
+  const secretFields = Object.keys(writeOnly);
+  for (const key of secretFields) {
+    if (
+      endpoint !== 'config/auth' ||
+      key !== 'smtp_pass' ||
+      !allowed.includes(key)
+    )
+      throw new Error(`Unsupported write-only configuration: ${key}`);
+    if (
+      typeof writeOnly[key] !== 'string' ||
+      !writeOnly[key].trim() ||
+      isMasked(writeOnly[key])
+    )
+      throw new Error(`A real credential is required: ${key}`);
+  }
+  if (endpoint === 'config/auth' && Object.hasOwn(desired, 'smtp_pass'))
+    throw new Error(
+      'SMTP password must be supplied separately, never copied from a configuration response',
+    );
   const before = await request(target, endpoint);
-  const patch = {};
+  const patch = { ...writeOnly };
   const unsupported = [];
   for (const [key, value] of Object.entries(desired)) {
     if (JSON.stringify(before[key]) === JSON.stringify(value)) continue;
@@ -43,10 +75,7 @@ async function applyConfig(
       unsupported.push(key);
       continue;
     }
-    if (
-      typeof value === 'string' &&
-      /^(\*{3,}|[•●]{3,}|\[redacted\])$/i.test(value)
-    )
+    if (isMasked(value))
       throw new Error(`Masked configuration cannot be restored: ${key}`);
     patch[key] = value;
   }
@@ -61,14 +90,15 @@ async function applyConfig(
     (k) => JSON.stringify(desired[k]) !== JSON.stringify(after[k]),
   );
   if (differences.length)
-    throw new Error(
-      `Configuration verification failed: ${differences.join(', ')}`,
-    );
+    throw new ConfigurationVerificationError(differences, Object.keys(patch));
   return {
     success: true,
-    verified: true,
+    verified: secretFields.length === 0,
+    configuration_readback_verified: true,
+    write_only_fields_accepted: secretFields,
+    ...(secretFields.length ? { email_delivery_verified: false } : {}),
     fields_verified: Object.keys(desired).length,
     fields_updated: Object.keys(patch),
   };
 }
-module.exports = { management, applyConfig };
+module.exports = { management, applyConfig, ConfigurationVerificationError };

package/src/commands/restore/runner.js

@@ -3,6 +3,11 @@ const path = require('path');
 const { t } = require('../../i18n');
 const { buildRestore, readDump } = require('./dump');
 const { storagePlan } = require('./steps/06-storage');
+const { prepareAuth } = require('./auth');
+const {
+  RealtimeRestoreError,
+  capacityLimits,
+} = require('./steps/08-realtime-settings');
 const steps = {
   database: require('./steps/03-database'),
   edgeFunctions: require('./steps/04-edge-functions'),
@@ -21,6 +26,7 @@ async function runRestore(
     remapUrls = true,
   },
   implementations = steps,
+  { prepareAuthConfig = prepareAuth } = {},
 ) {
   if (selectedBackup.projectId === targetProject.targetProjectId)
     throw new Error('Restore requires a different, empty destination project');
@@ -84,24 +90,69 @@ async function runRestore(
       buildRestore(readDump(context.backupFilePath), context);
     if (components.storage)
       storagePlan(context.backupPath, context.backupFilePath);
+    // Resolve write-only credentials before restoring the database or any service.
+    if (components.authSettings)
+      context.authConfig = await prepareAuthConfig(context);
     for (const [name, step] of Object.entries(implementations)) {
       if (!components[name]) continue;
       current = name;
       report.results[name] = { success: false, status: 'running' };
       save();
       const labels = {
-        database: 'restoringDatabase', edgeFunctions: 'restoringEdgeFunctions',
-        authSettings: 'restoringAuthSettings', storage: 'restoringStorageBuckets',
-        databaseSettings: 'restoringDatabaseSettings', realtimeSettings: 'restoringRealtimeSettings',
+        database: 'restoringDatabase',
+        edgeFunctions: 'restoringEdgeFunctions',
+        authSettings: 'restoringAuthSettings',
+        storage: 'restoringStorageBuckets',
+        databaseSettings: 'restoringDatabaseSettings',
+        realtimeSettings: 'restoringRealtimeSettings',
       };
       console.log((global.smoonbI18n?.t || t)(`restore.index.${labels[name]}`));
       const result = await step(context);
-      if (!result?.success || !result?.verified)
+      const acceptedSmtp =
+        name === 'authSettings' &&
+        result?.configuration_readback_verified === true &&
+        result?.email_delivery_verified === false &&
+        result?.write_only_fields_accepted?.length === 1 &&
+        result.write_only_fields_accepted[0] === 'smtp_pass';
+      const acceptedLimits =
+        name === 'realtimeSettings' &&
+        result?.effective_configuration_verified === true &&
+        result?.destination_limits_accepted === true &&
+        Array.isArray(result?.accepted_differences) &&
+        result.accepted_differences.length > 0 &&
+        result.accepted_differences.every(
+          (d) =>
+            capacityLimits.has(d.field) &&
+            Number.isInteger(d.backup_value) &&
+            d.backup_value > 0 &&
+            Number.isInteger(d.destination_value) &&
+            d.destination_value > 0,
+        );
+      if (
+        !result?.success ||
+        (!result?.verified && !acceptedSmtp && !acceptedLimits)
+      )
         throw new Error(`Component ${name} did not pass verification`);
-      report.results[name] = { ...result, status: 'verified' };
+      report.results[name] = {
+        ...result,
+        status: result.verified
+          ? 'verified'
+          : acceptedLimits
+            ? 'completed_with_accepted_differences'
+            : 'applied_with_unverified_secrets',
+      };
       save();
+      if (acceptedSmtp)
+        console.log((global.smoonbI18n?.t || t)('restore.smtp.accepted'));
     }
-    report.status = 'verified';
+    const results = Object.values(report.results);
+    report.status = results.some(
+      (r) => r.status === 'completed_with_accepted_differences',
+    )
+      ? 'completed_with_accepted_differences'
+      : results.every((r) => r.verified)
+        ? 'verified'
+        : 'applied_with_unverified_secrets';
     report.completed_at = new Date().toISOString();
     save();
     return report.results;
@@ -109,6 +160,8 @@ async function runRestore(
     report.status = 'failed';
     report.failed_component = current;
     report.results[current] = { success: false, status: 'failed' };
+    if (current === 'realtimeSettings' && error instanceof RealtimeRestoreError)
+      report.results[current].unapplied_limits = error.differences;
     report.completed_at = new Date().toISOString();
     save();
     throw error;

package/src/commands/restore/steps/05-auth-settings.js

@@ -1,26 +1,15 @@
-const fs = require('fs');
-const path = require('path');
 const { applyConfig } = require('../management');
-const { remapServiceUrls } = require('../dump');
+const { prepareAuth } = require('../auth');
 const allowed = require('../auth-fields.json');
-module.exports = async ({ backupPath, targetProject, remapUrls = true }) => {
-  const backup = JSON.parse(
-    fs.readFileSync(path.join(backupPath, 'auth-settings.json'), 'utf8'),
+module.exports = async (context, { request } = {}) => {
+  const { desired, writeOnly } =
+    context.authConfig || (await prepareAuth(context));
+  return applyConfig(
+    context.targetProject,
+    'config/auth',
+    desired,
+    allowed,
+    request,
+    { writeOnly },
   );
-  const settings =
-    backup.settings?.auth_url_config ||
-    backup.settings ||
-    backup.auth_url_config;
-  if (!settings || !Object.keys(settings).length)
-    throw new Error('Auth configuration missing from backup');
-  const desired = remapUrls
-    ? JSON.parse(
-        remapServiceUrls(
-          JSON.stringify(settings),
-          backup.project_id,
-          targetProject.targetProjectId,
-        ),
-      )
-    : settings;
-  return applyConfig(targetProject, 'config/auth', desired, allowed);
 };

package/src/commands/restore/steps/08-realtime-settings.js

@@ -1,6 +1,12 @@
 const fs = require('fs');
 const path = require('path');
-const { applyConfig } = require('../management');
+const {
+  applyConfig,
+  management,
+  ConfigurationVerificationError,
+} = require('../management');
+const { confirm } = require('../../../utils/prompt');
+const { t } = require('../../../i18n');
 const allowed = [
   'private_only',
   'connection_pool',
@@ -15,7 +21,35 @@ const allowed = [
   'suspend',
   'presence_enabled',
 ];
-module.exports = async ({ backupPath, targetProject }) => {
+// Only capacity limits can be explicitly retained. Security, service switches
+// and database connection pools must still match the backup exactly.
+const capacityLimits = new Set([
+  'max_concurrent_users',
+  'max_events_per_second',
+  'max_bytes_per_second',
+  'max_channels_per_client',
+  'max_joins_per_second',
+  'max_presence_events_per_second',
+  'max_payload_size_in_kb',
+]);
+class RealtimeRestoreError extends Error {
+  constructor(message, differences = []) {
+    super(message);
+    this.name = 'RealtimeRestoreError';
+    this.differences = differences;
+  }
+}
+module.exports = async (
+  { backupPath, targetProject },
+  {
+    request = management,
+    confirmLimits = confirm,
+    interactive = Boolean(process.stdin.isTTY),
+    wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    log = console.log,
+  } = {},
+) => {
+  const getT = global.smoonbI18n?.t || t;
   const backup = JSON.parse(
     fs.readFileSync(path.join(backupPath, 'realtime-settings.json'), 'utf8'),
   );
@@ -44,18 +78,117 @@ module.exports = async ({ backupPath, targetProject }) => {
         ];
       }),
     );
-    console.log(
-      `Realtime: restoring the recorded snapshot (${backup.realtime_settings.captured_at || 'date unavailable'}).`,
+    log(
+      getT('restore.realtime.snapshot', {
+        date:
+          backup.realtime_settings.captured_at ||
+          getT('restore.realtime.unknownDate'),
+      }),
     );
   }
-  const result = await applyConfig(
-    targetProject,
-    'config/realtime',
-    desired,
-    allowed,
-  );
-  return {
-    ...result,
-    captured_at: backup.captured_at || backup.realtime_settings?.captured_at,
-  };
+  const capturedAt =
+    backup.captured_at || backup.realtime_settings?.captured_at;
+  const mismatches = (state) =>
+    Object.keys(desired).filter(
+      (key) => JSON.stringify(desired[key]) !== JSON.stringify(state[key]),
+    );
+  try {
+    const result = await applyConfig(
+      targetProject,
+      'config/realtime',
+      desired,
+      allowed,
+      request,
+    );
+    return { ...result, captured_at: capturedAt };
+  } catch (error) {
+    if (!(error instanceof ConfigurationVerificationError)) throw error;
+    // A successful PATCH may take time to become visible. Never repeat PATCH
+    // just to poll: changing Realtime settings can disconnect clients.
+    let actual;
+    let fields;
+    for (const delay of [1000, 2000]) {
+      await wait(delay);
+      actual = await request(targetProject, 'config/realtime');
+      fields = mismatches(actual);
+      if (!fields.length)
+        return {
+          success: true,
+          verified: true,
+          configuration_readback_verified: true,
+          fields_verified: Object.keys(desired).length,
+          fields_updated: error.updatedFields,
+          captured_at: capturedAt,
+        };
+    }
+    const canRetain = fields.every(
+      (key) =>
+        capacityLimits.has(key) &&
+        Number.isInteger(desired[key]) &&
+        desired[key] > 0 &&
+        Number.isInteger(actual[key]) &&
+        actual[key] > 0,
+    );
+    if (!canRetain)
+      throw new RealtimeRestoreError(
+        getT('restore.realtime.strictMismatch', { fields: fields.join(', ') }),
+      );
+    const differences = fields.map((field) => ({
+      field,
+      backup_value: desired[field],
+      destination_value: actual[field],
+    }));
+    log(getT('restore.realtime.limitsNotApplied'));
+    for (const difference of differences)
+      log(
+        getT('restore.realtime.difference', {
+          field: getT(`restore.realtime.fields.${difference.field}`),
+          backup: difference.backup_value,
+          destination: difference.destination_value,
+        }),
+      );
+    log(getT('restore.realtime.limitsExplanation'));
+    if (
+      !interactive ||
+      (await confirmLimits(getT('restore.realtime.acceptLimits'), false)) !==
+        true
+    )
+      throw new RealtimeRestoreError(
+        getT('restore.realtime.notAccepted'),
+        differences,
+      );
+    // The user approved these exact numeric differences. A fresh read must
+    // still match both the approved limits and every other backed-up field.
+    const accepted = {
+      ...desired,
+      ...Object.fromEntries(
+        differences.map((d) => [d.field, d.destination_value]),
+      ),
+    };
+    const final = await request(targetProject, 'config/realtime');
+    if (
+      Object.keys(accepted).some(
+        (key) => JSON.stringify(accepted[key]) !== JSON.stringify(final[key]),
+      )
+    )
+      throw new RealtimeRestoreError(
+        getT('restore.realtime.changed'),
+        differences,
+      );
+    log(getT('restore.realtime.accepted'));
+    return {
+      success: true,
+      verified: false,
+      effective_configuration_verified: true,
+      destination_limits_accepted: true,
+      accepted_differences: differences,
+      fields_verified: Object.keys(desired).length - differences.length,
+      fields_updated: error.updatedFields.filter(
+        (key) => !fields.includes(key),
+      ),
+      captured_at: capturedAt,
+    };
+  }
 };
+module.exports.RealtimeRestoreError = RealtimeRestoreError;
+module.exports.capacityLimits = capacityLimits;

package/src/i18n/locales/en.json

@@ -18,6 +18,30 @@
   "prompt.confirmYes": "(Y/n)",
   "prompt.confirmNo": "(y/N)",
   "prompt.cancelled": "Operation cancelled.",
+  "backup.smtp.passwordNotExported": "⚠️ Supabase does not export the SMTP password. Keep it in your password manager: restoring Auth will require it. You do not need to create another backup.",
+  "restore.smtp.explanation": "The backup contains SMTP settings, but Supabase does not let you retrieve the password. Enter your email provider password (or the key used as the SMTP password). It will be sent only to the destination Supabase project and will not be saved by smoonb.",
+  "restore.smtp.password": "Email provider SMTP password:",
+  "restore.smtp.required": "Enter the real provider password, not the protected value in auth-settings.json. Use Ctrl+C to cancel before restoring any components.",
+  "restore.smtp.interactiveRequired": "Restoring Auth requires the SMTP password. Run in an interactive terminal to enter it securely before any components are restored.",
+  "restore.smtp.accepted": "⚠️ Auth: settings checked; SMTP password accepted by the API. Supabase does not allow password readback verification. Test an authentication email before using the project.",
+  "restore.realtime.snapshot": "Realtime: using the snapshot recorded at {date}.",
+  "restore.realtime.unknownDate": "unknown date",
+  "restore.realtime.limitsNotApplied": "⚠️ Supabase did not apply these Realtime limits from the backup:",
+  "restore.realtime.difference": "   - {field}: backup = {backup}; destination = {destination}.",
+  "restore.realtime.limitsExplanation": "Limits may depend on the plan and organization billing restrictions; this response does not identify the cause. You can keep the current destination values. This choice will be recorded as accepted differences, without claiming an identical copy of the backup. No plan or spend cap will be changed.",
+  "restore.realtime.acceptLimits": "Keep these destination limits and complete Realtime with the differences above recorded?",
+  "restore.realtime.notAccepted": "Realtime remains pending: the backup limits were not applied and the destination values were not accepted. Changes already applied were not undone. Consult report.json and select only Realtime Settings in an interactive terminal to retry this step.",
+  "restore.realtime.changed": "Realtime configuration changed during confirmation. The step remains pending; consult report.json and select only Realtime Settings to retry.",
+  "restore.realtime.strictMismatch": "Realtime did not confirm these settings: {fields}. This difference cannot be accepted as a capacity adjustment. The step remains pending; consult report.json and select only Realtime Settings to retry.",
+  "restore.realtime.accepted": "⚠️ Realtime completed with destination limits accepted by you. Differences from the backup are recorded in report.json; the other Realtime settings from the backup were checked.",
+  "restore.realtime.fields.max_concurrent_users": "Concurrent clients",
+  "restore.realtime.fields.max_events_per_second": "Events per second",
+  "restore.realtime.fields.max_bytes_per_second": "Bytes per second",
+  "restore.realtime.fields.max_channels_per_client": "Channels per client",
+  "restore.realtime.fields.max_joins_per_second": "Channel joins per second",
+  "restore.realtime.fields.max_presence_events_per_second": "Presence events per second",
+  "restore.realtime.fields.max_payload_size_in_kb": "Maximum message size (KB)",
+  "restore.index.restoreCompleteWithNotes": "Selected components restored with notes. Review the accepted differences and pending verification below.",
 
   "error.generic": "Something went wrong.",
   "error.pathNotFound": "Path not found: {path}",
@@ -570,7 +594,7 @@
 
   "restore.steps.components.auth.title": "Auth Settings:",
   "restore.steps.components.auth.description1": "Auth settings will be applied through the API and verified on the destination.",
-  "restore.steps.components.auth.description2": "Includes SMTP and redirects recorded in the backup.",
+  "restore.steps.components.auth.description2": "Includes redirects and SMTP settings; the real provider password will be requested when needed.",
   "restore.steps.components.auth.include": "Do you want to restore Auth",
 
   "restore.steps.components.storage.title": "Storage:",
@@ -589,7 +613,7 @@
 
   "restore.steps.components.realtime.title": "Realtime Settings:",
   "restore.steps.components.realtime.description1": "Realtime settings from the backup will be applied and verified through the API.",
-  "restore.steps.components.realtime.description2": "Legacy captures reproduce the values recorded on their capture date.",
+  "restore.steps.components.realtime.description2": "Uses the recorded snapshot; limits that are not applied will be shown for your decision.",
   "restore.steps.components.realtime.include": "Do you want to restore Realtime",
   "restore.steps.components.database.include": "Do you want to restore Database",
 
@@ -746,21 +770,21 @@
   "restore.index.targetProjectFinal": "Target project: {projectId}",
   "restore.index.databaseRestored": "Database: Restored successfully via Docker",
   "restore.index.edgeFunctionsRestored": "Edge Functions: {success}/{total} functions restored",
-  "restore.index.authSettingsRestored": "Auth Settings: Settings displayed for manual configuration",
+  "restore.index.authSettingsRestored": "Auth Settings: Settings applied and checked through the API",
   "restore.index.storageRestored": "Storage: {buckets} bucket(s) restored, {files} file(s) uploaded",
   "restore.index.storageMetadataOnly": "Storage: {buckets} bucket(s) found - metadata only (.storage.zip file not found)",
   "restore.index.databaseSettingsRestored": "Database Settings: Extensions and settings restored via SQL",
-  "restore.index.realtimeSettingsRestored": "Realtime Settings: Settings displayed for manual configuration",
+  "restore.index.realtimeSettingsRestored": "Realtime Settings: Settings applied and checked through the API",
   "restore.index.error": "Error during restoration: {message}",
 
   "restore.utils.componentsTitle": "Components that will be restored:",
   "restore.utils.database": "Database (psql -f via Docker)",
   "restore.utils.edgeFunctions": "Edge Functions: {count} function(s)",
-  "restore.utils.authSettings": "Auth Settings: Display URL and values for manual configuration",
+  "restore.utils.authSettings": "Auth Settings: Apply and check through the API; SMTP password requested when needed",
   "restore.utils.storageBuckets": "Storage Buckets: Automatic restoration of buckets and files via API",
   "restore.utils.storageMetadataOnly": "Storage Buckets: Display information (metadata only - .storage.zip file not found)",
   "restore.utils.databaseSettings": "Database Extensions and Settings: Restore via SQL",
-  "restore.utils.realtimeSettings": "Realtime Settings: Display URL and values for manual configuration",
+  "restore.utils.realtimeSettings": "Realtime Settings: Apply and check through the API; limit differences require your choice",
   "restore.utils.summaryTitle": "Restoration Summary:",
   "restore.utils.summarySeparator": "═══════════════════════════════════════════════════════════════════════════════",
   "restore.utils.backup": "Backup: {name}",

package/src/i18n/locales/pt-BR.json

@@ -18,6 +18,30 @@
   "prompt.confirmYes": "(S/n)",
   "prompt.confirmNo": "(s/N)",
   "prompt.cancelled": "Operação cancelada.",
+  "backup.smtp.passwordNotExported": "⚠️ O Supabase não exporta a senha SMTP. Guarde-a no seu gerenciador de senhas: ela será solicitada ao restaurar Auth. Não é necessário refazer o backup.",
+  "restore.smtp.explanation": "O backup contém as configurações SMTP, mas o Supabase não permite recuperar a senha. Informe a senha do provedor de e-mail (ou a chave usada como senha SMTP). Ela será enviada somente ao Supabase de destino e não será gravada pelo smoonb.",
+  "restore.smtp.password": "Senha SMTP do provedor de e-mail:",
+  "restore.smtp.required": "Informe a senha real do provedor, não o valor protegido de auth-settings.json. Use Ctrl+C para cancelar antes de restaurar os componentes.",
+  "restore.smtp.interactiveRequired": "A restauração de Auth precisa da senha SMTP. Execute em um terminal interativo para informá-la de forma oculta antes de restaurar os componentes.",
+  "restore.smtp.accepted": "⚠️ Auth: configurações conferidas; senha SMTP aceita pela API. O Supabase não permite conferir a senha por leitura. Teste o envio de e-mail de autenticação antes de usar o projeto.",
+  "restore.realtime.snapshot": "Realtime: usando a captura registrada em {date}.",
+  "restore.realtime.unknownDate": "data não informada",
+  "restore.realtime.limitsNotApplied": "⚠️ O Supabase não aplicou estes limites de Realtime do backup:",
+  "restore.realtime.difference": "   - {field}: backup = {backup}; destino = {destination}.",
+  "restore.realtime.limitsExplanation": "Limites podem depender do plano e das restrições de cobrança da organização; esta resposta não informa a causa. Você pode manter os valores atuais do destino. Essa escolha será registrada no relatório como diferença aceita, sem declarar uma cópia idêntica do backup. Nenhum plano ou limite de gastos será alterado.",
+  "restore.realtime.acceptLimits": "Manter esses limites do destino e concluir Realtime com as diferenças acima registradas?",
+  "restore.realtime.notAccepted": "Realtime permanece pendente: os limites do backup não foram aplicados e os valores do destino não foram aceitos. Alterações já aplicadas não foram desfeitas. Consulte report.json e, para tentar esta etapa novamente, selecione somente Realtime Settings em um terminal interativo.",
+  "restore.realtime.changed": "A configuração Realtime mudou durante a confirmação. A etapa permanece pendente; consulte report.json e tente novamente selecionando somente Realtime Settings.",
+  "restore.realtime.strictMismatch": "Realtime não confirmou estas configurações: {fields}. Essa diferença não pode ser aceita como ajuste de limites. A etapa permanece pendente; consulte report.json e tente novamente selecionando somente Realtime Settings.",
+  "restore.realtime.accepted": "⚠️ Realtime concluído com os limites do destino aceitos por você. As diferenças do backup estão registradas em report.json; as demais configurações de Realtime do backup foram conferidas.",
+  "restore.realtime.fields.max_concurrent_users": "Clientes simultâneos",
+  "restore.realtime.fields.max_events_per_second": "Eventos por segundo",
+  "restore.realtime.fields.max_bytes_per_second": "Bytes por segundo",
+  "restore.realtime.fields.max_channels_per_client": "Canais por cliente",
+  "restore.realtime.fields.max_joins_per_second": "Entradas em canais por segundo",
+  "restore.realtime.fields.max_presence_events_per_second": "Eventos de presença por segundo",
+  "restore.realtime.fields.max_payload_size_in_kb": "Tamanho máximo da mensagem (KB)",
+  "restore.index.restoreCompleteWithNotes": "Restauração dos componentes selecionados concluída com observações. Confira abaixo as diferenças aceitas e verificações pendentes.",
 
   "error.generic": "Algo inesperado aconteceu.",
   "error.pathNotFound": "Caminho não encontrado: {path}",
@@ -569,7 +593,7 @@
 
   "restore.steps.components.auth.title": "Auth Settings:",
   "restore.steps.components.auth.description1": "As configurações de Auth serão aplicadas pela API e verificadas no destino.",
-  "restore.steps.components.auth.description2": "Inclui SMTP e redirecionamentos registrados no backup.",
+  "restore.steps.components.auth.description2": "Inclui redirecionamentos e configurações SMTP; a senha real do provedor será solicitada quando necessária.",
   "restore.steps.components.auth.include": "Deseja restaurar Auth",
 
   "restore.steps.components.storage.title": "Storage:",
@@ -588,7 +612,7 @@
 
   "restore.steps.components.realtime.title": "Realtime Settings:",
   "restore.steps.components.realtime.description1": "As configurações de Realtime do backup serão aplicadas e verificadas pela API.",
-  "restore.steps.components.realtime.description2": "Capturas antigas reproduzem os valores registrados naquela data.",
+  "restore.steps.components.realtime.description2": "Usa os valores registrados na captura; limites não aplicados serão mostrados para sua decisão.",
   "restore.steps.components.realtime.include": "Deseja restaurar Realtime",
   "restore.steps.components.database.include": "Deseja restaurar Database",
 
@@ -745,21 +769,21 @@
   "restore.index.targetProjectFinal": "Projeto destino: {projectId}",
   "restore.index.databaseRestored": "Database: Restaurada com sucesso via Docker",
   "restore.index.edgeFunctionsRestored": "Edge Functions: {success}/{total} functions restauradas",
-  "restore.index.authSettingsRestored": "Auth Settings: Configurações exibidas para configuração manual",
+  "restore.index.authSettingsRestored": "Auth Settings: Configurações aplicadas e conferidas pela API",
   "restore.index.storageRestored": "Storage: {buckets} bucket(s) restaurado(s), {files} arquivo(s) enviado(s)",
   "restore.index.storageMetadataOnly": "Storage: {buckets} bucket(s) encontrado(s) - apenas metadados (arquivo .storage.zip não encontrado)",
   "restore.index.databaseSettingsRestored": "Database Settings: Extensões e configurações restauradas via SQL",
-  "restore.index.realtimeSettingsRestored": "Realtime Settings: Configurações exibidas para configuração manual",
+  "restore.index.realtimeSettingsRestored": "Realtime Settings: Configurações aplicadas e conferidas pela API",
   "restore.index.error": "Erro na restauração: {message}",
 
   "restore.utils.componentsTitle": "Componentes que serão restaurados:",
   "restore.utils.database": "Database (psql -f via Docker)",
   "restore.utils.edgeFunctions": "Edge Functions: {count} function(s)",
-  "restore.utils.authSettings": "Auth Settings: Exibir URL e valores para configuração manual",
+  "restore.utils.authSettings": "Auth Settings: Aplicar pela API e conferir as configurações; senha SMTP solicitada quando necessária",
   "restore.utils.storageBuckets": "Storage Buckets: Restauração automática de buckets e arquivos via API",
   "restore.utils.storageMetadataOnly": "Storage Buckets: Exibir informações (apenas metadados - arquivo .storage.zip não encontrado)",
   "restore.utils.databaseSettings": "Database Extensions and Settings: Restaurar via SQL",
-  "restore.utils.realtimeSettings": "Realtime Settings: Exibir URL e valores para configuração manual",
+  "restore.utils.realtimeSettings": "Realtime Settings: Aplicar pela API e conferir; diferenças nos limites exigem sua escolha",
   "restore.utils.summaryTitle": "Resumo da Restauração:",
   "restore.utils.summarySeparator": "═══════════════════════════════════════════════════════════════════════════════",
   "restore.utils.backup": "Backup: {name}",

package/src/utils/auth-secrets.js

@@ -0,0 +1,23 @@
+// Supabase SMTP passwords are write-only. The GET response is not a
+// transferable credential, even when it looks like an ordinary string.
+// https://github.com/supabase/supabase/blob/master/apps/studio/components/interfaces/Auth/SmtpForm/SmtpForm.tsx
+function authSnapshot(settings) {
+  const { smtp_pass: smtpPass, ...readable } = settings;
+  return {
+    settings: readable,
+    secrets: {
+      smtp_pass: {
+        exportable: false,
+        requires_input: Boolean(smtpPass || settings.smtp_host),
+      },
+    },
+  };
+}
+
+function isMasked(value) {
+  return (
+    typeof value === 'string' && /^(\*{3,}|[•●]{3,}|\[redacted\])$/i.test(value)
+  );
+}
+
+module.exports = { authSnapshot, isMasked };