-
-
- Welcome to {brand.displayName}
-
- Create the first operator account. This account governs the entire deployment.
- Subsequent users sign up via invitation.
-
-
-
-
-
-
- )
-}
diff --git a/apps/dashboard/src/instrumentation.ts b/apps/dashboard/src/instrumentation.ts
new file mode 100644
index 00000000..a195cda6
--- /dev/null
+++ b/apps/dashboard/src/instrumentation.ts
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: Apache-2.0
+
+// Next.js instrumentation hook — runs once when the server process starts
+// (never at build time). We use it to seed the default operator account on
+// first boot so the operator console is usable immediately, with no signup
+// wizard. See src/lib/bootstrap-operator.ts.
+
+export async function register() {
+ // Only the Node.js server runtime can touch Postgres; skip the edge runtime.
+ if (process.env.NEXT_RUNTIME !== "nodejs") {
+ return
+ }
+ const { seedDefaultOperator } = await import("@/lib/bootstrap-operator")
+ await seedDefaultOperator()
+}
diff --git a/apps/dashboard/src/lib/auth.ts b/apps/dashboard/src/lib/auth.ts
index 1048eb8e..49bd5155 100644
--- a/apps/dashboard/src/lib/auth.ts
+++ b/apps/dashboard/src/lib/auth.ts
@@ -65,28 +65,42 @@ function makeAuth() {
trustedOrigins,
// Mirror every better-auth user into suite_users on create so the
// runtime's tenant_resolver can join on email and find the canonical
- // suite user id. Without this hook a freshly-signed-up operator gets
- // 401 on /api/v1/secrets and friends until someone hand-inserts the
- // row.
+ // suite user id. Without this hook a freshly-created user (via SSO /
+ // OAuth / magic-link — email/password sign-up is disabled below) gets
+ // 401 on /api/v1/secrets and friends until someone hand-inserts the row.
+ //
+ // Each mirror step runs INDEPENDENTLY and best-effort. The previous
+ // version wrapped all three in one transaction, so a failure in the
+ // membership step (e.g. the default tenant row not existing yet) rolled
+ // back the suite_operators insert too — leaving the deployment with zero
+ // operators and an infinite /setup redirect. The default operator is now
+ // seeded at boot (see lib/bootstrap-operator.ts); this hook must never be
+ // able to undo operator creation.
databaseHooks: {
user: {
create: {
after: async (user) => {
- const client = await pool.connect()
- try {
- await client.query("begin")
- await ensureOperatorsTable(pool)
- await client.query(
+ const step = async (label: string, fn: () => Promise
- {brand.logos.light ? (
- 
- ) : (
-
-
-
-