Merge branch 'develop' into 7ttp/cli-2270-ssl-enforcement-command-family-coverage

Author: 7ttp

.github/actions/setup/action.yml

@@ -19,9 +19,9 @@ runs:
   using: "composite"
   steps:
     - name: Install toolchains
-      uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4
+      uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
       with:
-        version: 2026.7.0
+        version: 2026.9.0
 
     - name: Resolve pnpm store path
       if: inputs.dependency-cache == 'true'

.github/workflows/cli-go-ci.yml

@@ -91,9 +91,9 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
-          version: 2026.7.0
+          version: 2026.9.0
           install: true
           install_args: >-
             go

.github/workflows/publish-preview-cli-packages.yml

@@ -131,6 +131,9 @@ jobs:
           PREVIEW_URL: ${{ steps.preview-metadata.outputs.preview_url }}
         run: |
           set -euo pipefail
+          # Run outside the checkout: npm enforces the root package.json's
+          # devEngines.packageManager (pnpm) against itself and would refuse.
+          cd "${RUNNER_TEMP}"
           npx --yes "${PREVIEW_URL}" --version
 
   comment:

.node-version

@@ -0,0 +1 @@
+24

CONTRIBUTING.md

@@ -34,8 +34,6 @@ See the [`mise` installation docs](https://mise.jdx.dev/getting-started.html) fo
 
 `mise` needs to hook into your shell so it can inject the right tool versions into your `PATH` as you move between directories. Follow the `mise activate` instructions [in this section](https://mise.jdx.dev/getting-started.html#activate-mise) to add the activation line for your shell to its startup file.
 
-This repo relies on `mise` support for reading Node and pnpm versions from `package.json`, so use mise `2026.7.0` or newer.
-
 #### Installing the pinned tool versions
 
 Trust this repo's `mise.toml` once from the repo root so `mise` can read the project setting that enables idiomatic version files:
@@ -52,21 +50,21 @@ mise install
 
 `mise install` resolves the versions this repo expects from a handful of files, rather than hardcoding them all in one place:
 
-| Tool          | Version source                               |
-| ------------- | -------------------------------------------- |
-| Bun           | `.bun-version`                               |
-| Node.js       | `devEngines.runtime` field in `package.json` |
-| pnpm          | `packageManager` field in `package.json`     |
-| Go            | `mise.toml`                                  |
-| golangci-lint | `mise.toml`                                  |
+| Tool          | Version source                                      |
+| ------------- | --------------------------------------------------- |
+| Bun           | `.bun-version`                                      |
+| Node.js       | `.node-version`                                     |
+| pnpm          | `devEngines.packageManager` field in `package.json` |
+| Go            | `mise.toml`                                         |
+| golangci-lint | `mise.toml`                                         |
 
 The Go and golangci-lint entries in `mise.toml` are intentionally temporary while the Go CLI remains in the repo. The canonical Go module metadata still lives in `apps/cli-go/go.mod`; keep the `mise.toml` entries aligned only until the Go code is removed.
 
 Once installed, `mise` activates these versions automatically whenever your shell is inside this repo — no manual `nvm use`, `gvm use`, or similar switching required.
 
 #### Without mise
 
-`mise` is not required. If you already have Bun, Node, pnpm, and Go installed and managed some other way, just make sure your versions match the ones pinned in `.bun-version`, `mise.toml`, `package.json`, and `apps/cli-go/go.mod`.
+`mise` is not required. If you already have Bun, Node, pnpm, and Go installed and managed some other way, just make sure your versions match the ones pinned in `.bun-version`, `.node-version`, `mise.toml`, `package.json`, and `apps/cli-go/go.mod`.
 
 ### Install dependencies
 

apps/cli/src/legacy/commands/config/diff/diff.live.test.ts

@@ -1,3 +1,4 @@
+import { type ConfigChangeClass, projectConfigMappingRows } from "@supabase/config/internal";
 import { expect } from "vitest";
 
 import { requireLiveSuccess, test } from "../../../../../tests/helpers/live.ts";
@@ -8,18 +9,36 @@ import { requireLiveSuccess, test } from "../../../../../tests/helpers/live.ts";
 // in diff.integration.test.ts. The `workspace` fixture behind `cli` is a
 // fresh `supabase init` project directory.
 test("diffs a freshly-initialized config against the project", async ({ cli, project }) => {
-  const result = await cli(["config", "diff", "--project-ref", project.ref]);
-  expect(`${result.stdout}${result.stderr}`).not.toContain("Unauthorized");
-  expect(result.stderr).toContain(`Comparing against project ${project.ref} using base config`);
-  expect(result.stderr).toContain("Comparison scope:");
-  // The GoTrue-keyed auth record — the one surface mocks cannot prove — must
-  // classify CLEANLY against a fresh config: the platform's reports of
-  // unconfigured state (session zeros canonicalized to "0s" via
-  // unconfiguredValue, platform-rendered mailer subjects via platformRendered,
-  // disabled notification toggles) are suppressed by the registry's declared
-  // baselines, not flagged as drift. Asserting only exit 0 here would let that noise through silently.
-  const authChangeLines = result.stdout.split("\n").filter((line) => line.startsWith("auth."));
-  expect(authChangeLines, result.stdout).toEqual([]);
+  const result = await cli([
+    "config",
+    "diff",
+    "--project-ref",
+    project.ref,
+    "--output-format",
+    "json",
+  ]);
   // Read-only success regardless of drift (no --exit-code passed).
   requireLiveSuccess(result, "config diff");
+  expect(result.stderr).toContain(`Comparing against project ${project.ref} using base config`);
+  const payload = JSON.parse(result.stdout) as {
+    scope: { present: string[] };
+    changes: Array<{ path: string[]; class: ConfigChangeClass }>;
+  };
+  expect(payload.scope.present).toContain("auth");
+  const changes = payload.changes.map(({ path, class: kind }) => ({ path: path.join("."), kind }));
+  const classified = changes.map((change) => `${change.path} [${change.kind}]`).join("\n");
+  // A fresh project legitimately drifts from the init template (confirmations,
+  // TOTP, site URL), so remote auth values must reach classification, while
+  // the registry's declared baselines suppress the platform's own defaults.
+  expect(
+    changes.some((change) => change.path.startsWith("auth.") && change.kind !== "local_only"),
+    classified,
+  ).toBe(true);
+  const baselines = projectConfigMappingRows
+    .filter((row) => row.unconfiguredValue !== undefined || row.platformRendered === true)
+    .map((row) => row.configPath.join("."));
+  expect(
+    changes.filter((change) => baselines.includes(change.path)),
+    classified,
+  ).toEqual([]);
 });

mise.lock

@@ -1,4 +1,4 @@
-min_version = '2026.7.0'
+min_version = '2026.9.0'
 
 [tools]
 go = "1.26.5"

mise.toml

@@ -42,10 +42,10 @@
     "verdaccio": "^6.10.0"
   },
   "devEngines": {
-    "runtime": {
-      "name": "node",
-      "version": "24"
+    "packageManager": {
+      "name": "pnpm",
+      "version": "12.3.0",
+      "onFail": "error"
     }
-  },
-  "packageManager": "pnpm@11.4.0"
+  }
 }