vibecarbon 0.3.1 → 0.4.0

package/src/lib/deploy/compose/ha.js

@@ -14,7 +14,6 @@ import { join } from 'node:path';
 import * as p from '@clack/prompts';
 import { setupHA as setupCloudflareHA } from '../../cloudflare.js';
 import { c } from '../../colors.js';
-import { runCommand } from '../../command.js';
 import {
   loadCredentials,
   loadProjectConfig,
@@ -24,6 +23,8 @@ import {
 import { fetchWithRetry } from '../../fetch-retry.js';
 import { perfAsync } from '../../perf.js';
 import { getProvider } from '../../providers/index.js';
+import { useDnsChallenge } from '../acme.js';
+import { generateSSHKeyPair, readReplPassword } from '../utils.js';
 import {
   createAdminUser,
   dockerLoginOnServer,
@@ -32,26 +33,12 @@ import {
   runMigrations,
   setupServer,
   setupServerFiles,
+  sshRun,
   sshRunAsync,
   startComposeStack,
   waitForSSH,
 } from './index.js';
 
-const SSH_OPTS = '-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes';
-
-/**
- * Run a command on a remote server via SSH
- */
-function sshRun(ip, sshKeyPath, command, options = {}) {
-  const { timeout = 120_000 } = options;
-  return runCommand(['ssh', ...SSH_OPTS.split(' '), '-i', sshKeyPath, `root@${ip}`, command], {
-    stdio: 'pipe',
-    timeout,
-    encoding: 'utf-8',
-    ...options,
-  });
-}
-
 /**
  * Look up a Hetzner firewall by exact name and DELETE it. Polls afterwards
  * until the GET returns nothing (firewall actually gone) or the deadline
@@ -170,37 +157,6 @@ async function deleteFirewallByName(name, hetznerHeaders, deadlineMs = 30_000) {
   return false;
 }
 
-/**
- * Read REPL_PASSWORD — process.env first (CI may export it), then .env.local
- * (where `vibecarbon create` writes it at project-init time). Every HA code
- * path funnels through this so one fix handles all three call sites that
- * previously threw `REPL_PASSWORD is not set` when run without the env var.
- * Returns null if the value is not present anywhere.
- */
-function readReplPassword(cwd = process.cwd()) {
-  if (process.env.REPL_PASSWORD) return process.env.REPL_PASSWORD;
-  const envLocalPath = join(cwd, '.env.local');
-  if (!existsSync(envLocalPath)) return null;
-  const content = readFileSync(envLocalPath, 'utf-8');
-  // Accept both double-quoted (machine secrets) and single-quoted
-  // (escapeDotenv'd user secrets) forms, matching create.js output.
-  const m =
-    content.match(/^REPL_PASSWORD="([^"]+)"/m) || content.match(/^REPL_PASSWORD='([^']+)'/m);
-  return m ? m[1] : null;
-}
-
-/**
- * Generate SSH key pair for deployment
- */
-function generateSSHKeyPair(sshKeyPath) {
-  if (!existsSync(sshKeyPath)) {
-    runCommand(
-      ['ssh-keygen', '-t', 'ed25519', '-f', sshKeyPath, '-N', '', '-C', 'vibecarbon-deploy'],
-      { stdio: 'pipe' },
-    );
-  }
-}
-
 // ============================================================================
 // POSTGRESQL STREAMING REPLICATION SETUP
 // ============================================================================
@@ -1022,7 +978,11 @@ export async function deployComposeHA(options) {
   // future deploys that shrink that gap. Same fix lives in orchestrator.js
   // for single-region compose where the race was actively biting (RCA from
   // vibecarbon.com cold-deploy 2026-05-19).
-  if (domain && dnsProvider && dnsProvider !== 'manual') {
+  // HTTP-01 only: managed-DNS HA deploys issue certs via DNS-01 (the shared
+  // bundle ships docker-compose.dns01.prod.yml to both nodes), which doesn't
+  // gate on the A record propagating — so skip the wait there. `manual` keeps
+  // HTTP-01 but isn't reached here (the guard already excludes it).
+  if (domain && dnsProvider && dnsProvider !== 'manual' && !useDnsChallenge(dnsProvider)) {
     // Surface this in the enclosing tracker spinner so the operator sees
     // why we're waiting (up to 120s on a cold edge). Without the message
     // the HA spinner sits on the prior "Configuring servers..." text for
@@ -1471,54 +1431,80 @@ export async function destroyComposeHA(options) {
 }
 
 // ============================================================================
-// STATUS
+// FAILOVER
 // ============================================================================
 
 /**
- * Get status of both Compose HA servers in parallel
+ * Build the curl used to probe the new primary's real API endpoint locally.
+ *
+ * `--resolve <domain>:443:127.0.0.1` pins the hostname to loopback, so the
+ * probe hits Traefik on the new-primary host itself and is independent of DNS
+ * propagation (the DNS flip happens later in failover, and the operator host's
+ * resolver may still be cached). `-k` skips the LE-staging cert. The path is
+ * the *exact* endpoint verify-failover checks, so a 200 here means the whole
+ * app → Kong → PostgREST → DB path is serving — including PostgREST's schema
+ * cache, the thing that's still cold right after `docker compose restart`.
+ *
+ * @param {string} domain
+ * @returns {string}
  */
-export async function getComposeHAStatus(envConfig, sshKeyPath, projectName) {
-  const results = await Promise.all(
-    (envConfig.servers || []).map(async (server) => {
-      try {
-        const remoteDir = `/opt/${projectName}`;
-        const output = await sshRunAsync(
-          server.ip,
-          sshKeyPath,
-          `cd ${remoteDir} && docker compose ps --format json`,
-          { timeout: 15_000 },
-        );
-        if (!output?.trim()) {
-          return { ...server, running: false, services: [] };
-        }
-        const services = output
-          .trim()
-          .split('\n')
-          .filter(Boolean)
-          .map((line) => {
-            try {
-              return JSON.parse(line);
-            } catch {
-              return null;
-            }
-          })
-          .filter(Boolean);
-        return {
-          ...server,
-          running: services.some((s) => s.State === 'running'),
-          services,
-        };
-      } catch {
-        return { ...server, running: false, error: 'Unreachable' };
-      }
-    }),
-  );
-  return results;
+export function newPrimaryApiProbeCmd(domain) {
+  const url = `https://${domain}/api/v1/notifications`;
+  return `curl -sk -o /dev/null -w '%{http_code}' --max-time 5 --resolve ${domain}:443:127.0.0.1 ${url}`;
 }
 
-// ============================================================================
-// FAILOVER
-// ============================================================================
+/**
+ * Poll the new primary until it actually SERVES a DB-backed API request.
+ *
+ * Root-cause fix for the compose-ha failover-readiness race: Step 1b runs
+ * `docker compose restart … rest app …` to force a clean reconnect against the
+ * now-read-write DB, but `restart` returns when containers *start*, not when
+ * they're *ready*. PostgREST then spends ~10-30s reconnecting and rebuilding
+ * its schema cache; until it does, /api/v1/notifications 500s with a
+ * PGRST schema-cache miss. failover used to return straight into that window,
+ * and verify-failover (which does NOT retry on 500) caught it. Gating on the
+ * real endpoint closes the race for the e2e *and* real operators (a failover
+ * that reports success before the app serves traffic is itself a bug).
+ *
+ * Best-effort: returns false (and logs the last status) on timeout rather than
+ * throwing — a not-yet-confirmed new primary is still better than aborting a
+ * promotion that already happened.
+ *
+ * @param {string} ip - new primary IP
+ * @param {string} sshKeyPath
+ * @param {string} domain
+ * @param {object} [opts]
+ * @param {number} [opts.attempts=40]
+ * @param {number} [opts.intervalMs=3000]
+ * @param {(ip: string, key: string, cmd: string, o: object) => string|false} [opts.runner=sshRun]
+ * @param {(ms: number) => Promise<void>} [opts.sleep]
+ * @returns {Promise<boolean>}
+ */
+export async function waitForNewPrimaryApi(ip, sshKeyPath, domain, opts = {}) {
+  const {
+    attempts = 40,
+    intervalMs = 3000,
+    runner = sshRun,
+    sleep = (ms) => new Promise((r) => setTimeout(r, ms)),
+  } = opts;
+  const cmd = newPrimaryApiProbeCmd(domain);
+  let lastCode = '';
+  for (let i = 0; i < attempts; i++) {
+    try {
+      const code = runner(ip, sshKeyPath, cmd, { silent: true, timeout: 12_000 });
+      lastCode = typeof code === 'string' ? code.trim() : '';
+      if (lastCode === '200') return true;
+    } catch {
+      lastCode = 'error';
+    }
+    if (i < attempts - 1) await sleep(intervalMs);
+  }
+  console.error(
+    `[ha] new primary did not serve /api/v1/notifications (last HTTP ${lastCode || 'none'}) ` +
+      `after ${attempts} probes — proceeding, but verify-failover may race PostgREST readiness`,
+  );
+  return false;
+}
 
 /**
  * Perform failover for a Compose HA environment.
@@ -1632,7 +1618,7 @@ export async function failoverComposeHA(envName, envConfig, projectConfig, parse
   // and returns the result. We retry a handful of times because the very
   // first call can race the postmaster startup ("connection refused" /
   // "the database system is starting up").
-  // `silent: true` is load-bearing: ha.js's local sshRun wraps runCommand,
+  // `silent: true` is load-bearing: the shared compose sshRun wraps runCommand,
   // which on non-zero exit returns `false` (not throws) unless silent — so
   // without it, a still-booting postmaster's exit-1 manifests downstream as
   // `false?.trim is not a function`, the catch records it, and all 5 attempts
@@ -1749,6 +1735,23 @@ export async function failoverComposeHA(envName, envConfig, projectConfig, parse
   }
   s.stop('New-primary app-tier restarted');
 
+  // Step 1c: Gate on the new primary actually SERVING a DB-backed request
+  // before we stop the old primary and flip DNS. The Step 1b restart only
+  // *starts* the app tier; PostgREST's schema cache is cold for ~10-30s after,
+  // during which /api/v1/notifications 500s. Without this wait, failover
+  // returned into that window and verify-failover (no retry on 500) failed.
+  // Probed locally via curl --resolve so readiness is independent of the DNS
+  // flip below. Best-effort — see waitForNewPrimaryApi.
+  if (envConfig.domain) {
+    s.start('Waiting for new primary to serve API traffic');
+    const apiReady = await waitForNewPrimaryApi(standbyServer.ip, sshKeyPath, envConfig.domain);
+    s.stop(
+      apiReady
+        ? 'New primary serving API traffic'
+        : 'New primary API not confirmed — proceeding (verify may race readiness)',
+    );
+  }
+
   // Step 2: Stop old primary services to prevent split-brain
   s.start('Stopping old primary services');
   try {

package/src/lib/deploy/compose/index.js

@@ -19,8 +19,9 @@ import * as p from '@clack/prompts';
 import { uploadS3Backup } from '../../backup-s3.js';
 import { runCommand, runCommandAsync } from '../../command.js';
 import { perfAsync, perfTimer } from '../../perf.js';
-import { shEscape } from '../../shell.js';
-import { scpDownload } from '../../ssh.js';
+import { parseDotenv, shEscape } from '../../shell.js';
+import { NO_PIN_SSH_OPTS, scpDownload } from '../../ssh.js';
+import { postAdminUser, waitForGotrueHealth } from '../admin-user.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -41,18 +42,20 @@ export function loadCloudInitScript() {
   return readFileSync(CLOUD_INIT_PATH, 'utf-8');
 }
 
-// ServerAliveInterval+CountMax: force ssh to give up after 60s of no
-// SSH-protocol traffic, so a freshly-provisioned VPS that accepts TCP on 22
-// but never sends the SSH banner ("Connection timed out during banner
-// exchange") fails fast instead of hanging the caller indefinitely. Same
-// fix applied in lib/ssh.js — keep them in lockstep.
-const SSH_OPTS =
-  '-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -o ServerAliveInterval=15 -o ServerAliveCountMax=4';
+// Single-sourced from lib/ssh.js (sshHostKeyOpts) so the string form used by
+// the runners below can't drift from the argv form — notably keeping the
+// ServerAlive keepalives that fail a banner-exchange hang fast instead of
+// stalling for ~600s. Re-exported as the canonical compose deploy SSH opts.
+// shell-safety-ignore: NO_PIN_SSH_OPTS is derived from lib/ssh.js sshHostKeyOpts(), which bakes in BatchMode=yes (validated there)
+const SSH_OPTS = NO_PIN_SSH_OPTS;
 
 /**
- * Run a command on a remote server via SSH
+ * Run a command on a remote server via SSH.
+ *
+ * Shared with compose/ha.js (imported, not re-copied) so both halves of the
+ * compose path use identical, single-sourced SSH options.
  */
-function sshRun(ip, sshKeyPath, command, options = {}) {
+export function sshRun(ip, sshKeyPath, command, options = {}) {
   const { timeout = 120_000 } = options;
   return runCommand(['ssh', ...SSH_OPTS.split(' '), '-i', sshKeyPath, `root@${ip}`, command], {
     stdio: 'pipe',
@@ -700,16 +703,6 @@ export async function verifyAppHealth(ip, sshKeyPath, projectName, options = {})
   return { healthy: false, status: lastStatus, details };
 }
 
-/**
- * Stop the Docker Compose stack on the remote server
- */
-export async function stopComposeStack(ip, sshKeyPath, projectName, options = {}) {
-  const remoteDir = `/opt/${projectName}`;
-  const flags = composeFileFlags(options);
-  const composeCmd = `cd ${remoteDir} && docker compose ${flags} down --timeout 30`;
-  await sshRunAsync(ip, sshKeyPath, composeCmd, { timeout: 120_000 });
-}
-
 /**
  * Pre-pull container images on the remote server.
  * Run this in parallel with the local Docker build to overlap I/O.
@@ -803,9 +796,8 @@ export async function runMigrations(ip, sshKeyPath, projectName) {
   // 2026-05-26. Use the canonical SQL NOTIFY on the pgrst channel instead
   // (db-channel-enabled defaults on); fall back to restarting rest if NOTIFY
   // doesn't land. Best-effort: a missed reload self-heals on the next deploy.
-  // Lives here (not just in deployCompose) so every caller — deployCompose,
-  // deployComposeHA, and the orchestrator's inline single-compose path — gets
-  // a queryable schema instead of PGRST205.
+  // Lives here so every caller — deployComposeHA and the orchestrator's inline
+  // single-compose path — gets a queryable schema instead of PGRST205.
   await sshRunAsync(
     ip,
     sshKeyPath,
@@ -815,153 +807,6 @@ export async function runMigrations(ip, sshKeyPath, projectName) {
   );
 }
 
-/**
- * Main Compose deployment orchestrator
- *
- * @param {object} options
- * @param {string} options.projectName - Project name
- * @param {string} options.environment - Environment name (prod, staging, etc.)
- * @param {string} options.ip - Server IP address
- * @param {string} options.sshKeyPath - Path to SSH private key
- * @param {string} [options.domain] - Custom domain
- * @param {boolean} [options.isNewServer] - Whether server was just provisioned
- * @param {object} [options.services] - Enabled services (observability, n8n, etc.)
- * @param {Function} [options.onProgress] - Progress callback
- * @returns {object} Deployment result
- */
-export async function deployCompose(options) {
-  const {
-    projectName,
-    ip,
-    sshKeyPath,
-    domain,
-    isNewServer = false,
-    services = {},
-    imageRef,
-    onProgress = () => {},
-  } = options;
-
-  if (!imageRef) {
-    throw new Error('deployCompose requires options.imageRef (ghcr.io/<owner>/<repo>:<tag>)');
-  }
-
-  // Step 1: Install Docker on new servers
-  if (isNewServer) {
-    onProgress('Configuring server...');
-    await setupServer(ip, sshKeyPath);
-  }
-
-  const serviceOpts = {
-    observability: services.observability,
-    n8n: services.n8n,
-    metabase: services.metabase,
-    redis: services.redis,
-  };
-
-  // Step 2: Copy project files + point APP_IMAGE at the CI-built ghcr.io tag
-  onProgress('Copying project files to server...');
-  await setupServerFiles(ip, sshKeyPath, projectName, {
-    domain,
-    image: imageRef,
-    ...serviceOpts,
-  });
-
-  // Step 3: Pull all images (app + Supabase) — docker compose pull handles it.
-  onProgress('Pulling images...');
-  await pullComposeImages(ip, sshKeyPath, projectName, serviceOpts);
-
-  // Step 4: Start Docker Compose stack
-  onProgress('Starting services...');
-  await startComposeStack(ip, sshKeyPath, projectName, serviceOpts);
-
-  // Step 5: Run migrations. A failure here means an empty/partial schema, which
-  // makes every DB-backed feature 500 — so let it abort the deploy rather than
-  // swallowing it (RCA prod-1 2026-05-26: the previous blanket try/catch hid a
-  // fully-failed migration and shipped a schema-less prod that reported success).
-  onProgress('Running database migrations...');
-  // runMigrations applies supabase/migrations/* AND reloads PostgREST's schema
-  // cache, so the new tables are immediately queryable (no PGRST205).
-  await runMigrations(ip, sshKeyPath, projectName);
-
-  return {
-    success: true,
-    ip,
-    domain,
-    deployMode: 'compose',
-  };
-}
-
-/**
- * Fast re-deploy: sync new config and reconcile.
- */
-export async function redeployCompose(options) {
-  const { projectName, ip, sshKeyPath, services = {}, imageRef, onProgress = () => {} } = options;
-
-  if (!imageRef) {
-    throw new Error('redeployCompose requires options.imageRef');
-  }
-
-  // Step 1: Sync new files (including .env with new image tag)
-  onProgress('Syncing configuration...');
-  await setupServerFiles(ip, sshKeyPath, projectName, {
-    image: imageRef,
-    observability: services.observability,
-    n8n: services.n8n,
-    metabase: services.metabase,
-    redis: services.redis,
-    domain: options.domain,
-  });
-
-  // Step 2: Reconcile (pulls images if needed and restarts)
-  onProgress('Reconciling services...');
-  await startComposeStack(ip, sshKeyPath, projectName, {
-    observability: services.observability,
-    n8n: services.n8n,
-    metabase: services.metabase,
-    redis: services.redis,
-  });
-
-  return { success: true };
-}
-
-/**
- * Get status of Docker Compose services on the remote server
- */
-export function getComposeStatus(ip, sshKeyPath, projectName) {
-  const remoteDir = `/opt/${projectName}`;
-
-  try {
-    const output = sshRun(ip, sshKeyPath, `cd ${remoteDir} && docker compose ps --format json`, {
-      timeout: 15_000,
-    });
-
-    if (!output?.trim()) {
-      return { running: false, services: [] };
-    }
-
-    // docker compose ps --format json outputs one JSON object per line
-    const services = output
-      .trim()
-      .split('\n')
-      .filter(Boolean)
-      .map((line) => {
-        try {
-          return JSON.parse(line);
-        } catch {
-          return null;
-        }
-      })
-      .filter(Boolean);
-
-    return {
-      running: services.some((s) => s.State === 'running'),
-      services,
-    };
-  } catch {
-    return { running: false, services: [] };
-  }
-}
-
 /**
  * Destroy a Docker Compose deployment
  */
@@ -1193,37 +1038,6 @@ export async function restoreCompose(ip, sshKeyPath, projectName, backupFile, op
   await sshRunAsync(ip, sshKeyPath, `cd ${remoteDir} && docker compose start app`);
 }
 
-/**
- * Wait for an HTTPS endpoint to respond with a valid certificate.
- * Polls until a successful response (2xx/3xx) or timeout.
- *
- * @param {string} url - Full HTTPS URL to check
- * @param {object} [options]
- * @param {number} [options.timeout=90000] - Max wait time in ms
- * @param {number} [options.interval=5000] - Poll interval in ms
- * @returns {Promise<boolean>} true if SSL is ready, false if timed out
- */
-export async function waitForSSL(url, { timeout = 90_000, interval = 5_000 } = {}) {
-  const deadline = Date.now() + timeout;
-  while (Date.now() < deadline) {
-    try {
-      const result = runCommand(
-        ['curl', '-sf', '--max-time', '5', '-o', '/dev/null', '-w', '%{http_code}', url],
-        {
-          stdio: 'pipe',
-          encoding: 'utf-8',
-          timeout: 10_000,
-        },
-      );
-      if (result?.trim().match(/^[23]\d\d$/)) return true;
-    } catch {
-      // Not ready yet
-    }
-    await new Promise((r) => setTimeout(r, interval));
-  }
-  return false;
-}
-
 /**
  * Create the admin user in production Supabase via the GoTrue admin API.
  *
@@ -1236,6 +1050,28 @@ export async function waitForSSL(url, { timeout = 90_000, interval = 5_000 } = {
  * @param {string} projectName - Project name (for remote dir)
  * @returns {Promise<{success: boolean, message: string}>}
  */
+/**
+ * Extract the admin credentials a deploy needs to provision the super-admin
+ * out of a project `.env` file's text.
+ *
+ * `create` writes these via `escapeDotenv` (ADMIN_PASSWORD is POSIX
+ * single-quoted) and double-quotes for the rest, so the on-disk shapes are a
+ * mix of `'…'` and `"…"`. Decoding MUST go through `parseDotenv`/`unescapeDotenv`
+ * — the inverse of `escapeDotenv` — or single-quote wrappers leak into the
+ * value and GoTrue provisions a password the operator can never type.
+ *
+ * @param {string} envContent
+ * @returns {{adminEmail?: string, adminPassword?: string, serviceRoleKey?: string}}
+ */
+export function readAdminCredentials(envContent) {
+  const env = parseDotenv(envContent);
+  return {
+    adminEmail: env.ADMIN_EMAIL,
+    adminPassword: env.ADMIN_PASSWORD,
+    serviceRoleKey: env.SUPABASE_SERVICE_ROLE_KEY,
+  };
+}
+
 export async function createAdminUser(serverIp, sshKeyPath, projectName) {
   const envPath = join(process.cwd(), '.env');
   if (!existsSync(envPath)) {
@@ -1243,9 +1079,7 @@ export async function createAdminUser(serverIp, sshKeyPath, projectName) {
   }
 
   const envContent = readFileSync(envPath, 'utf-8');
-  const adminEmail = envContent.match(/^ADMIN_EMAIL="?([^"\n]+)"?/m)?.[1];
-  const adminPassword = envContent.match(/^ADMIN_PASSWORD="?([^"\n]+)"?/m)?.[1];
-  const serviceRoleKey = envContent.match(/^SUPABASE_SERVICE_ROLE_KEY="?([^"\n]+)"?/m)?.[1];
+  const { adminEmail, adminPassword, serviceRoleKey } = readAdminCredentials(envContent);
 
   if (!adminEmail || !adminPassword || !serviceRoleKey) {
     return { success: false, message: 'Admin credentials not found in .env' };
@@ -1299,54 +1133,22 @@ export async function createAdminUser(serverIp, sshKeyPath, projectName) {
   );
 
   try {
-    // Wait for port-forward to be ready. ssh -L is usually listening on
-    // localhost within 200-500ms; first few retries are at 200ms before
-    // falling back to 1s.
-    let connected = false;
-    for (let i = 0; i < 15; i++) {
-      try {
-        await fetch(`http://localhost:${localPort}/auth/v1/health`, {
-          signal: AbortSignal.timeout(2000),
-        });
-        connected = true;
-        break;
-      } catch {
-        const interval = i < 5 ? 200 : 1000;
-        await new Promise((r) => setTimeout(r, interval));
-      }
-    }
-
+    // Wait for the ssh -L tunnel to start forwarding (usually <500ms).
+    const connected = await waitForGotrueHealth(`http://localhost:${localPort}/auth/v1/health`, {
+      attempts: 15,
+      intervalMs: 500,
+    });
     if (!connected) {
       return { success: false, message: 'Could not reach auth service via SSH tunnel' };
     }
 
-    const response = await fetch(`http://localhost:${localPort}/auth/v1/admin/users`, {
-      method: 'POST',
-      headers: {
-        Authorization: `Bearer ${serviceRoleKey}`,
-        apikey: serviceRoleKey,
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({
-        email: adminEmail,
-        password: adminPassword,
-        email_confirm: true,
-        app_metadata: { role: 'super_admin' },
-      }),
-      signal: AbortSignal.timeout(15000),
+    // POST through Kong, which rewrites /auth/v1 → GoTrue's /.
+    return await postAdminUser({
+      adminUsersUrl: `http://localhost:${localPort}/auth/v1/admin/users`,
+      serviceRoleKey,
+      adminEmail,
+      adminPassword,
     });
-
-    if (response.ok) {
-      return { success: true, message: `Admin user created: ${adminEmail}` };
-    }
-    if (response.status === 422) {
-      return { success: true, message: `Admin user already exists: ${adminEmail}` };
-    }
-    const body = await response.text().catch(() => '');
-    return {
-      success: false,
-      message: `Auth returned ${response.status}${body ? `: ${body}` : ''}`,
-    };
   } finally {
     pf.kill();
   }