fix(cli): render SMS/MFA config templates instead of emitting the raw text/template escape

[Coly010]

What changed

supabase init (and the bootstrap scratch-project path — both go through the shared renderProjectConfigTemplate in apps/cli/src/shared/init/project-init.templates.ts) wrote two broken lines into the generated supabase/config.toml:

template = "Your code is {{ `{{ .Code }}` }}"

for both [auth.sms] and [auth.mfa.phone]. The Go CLI's template source contains that text/template self-escape, but Go renders the scaffold through text/template (config.Eject, pkg/config/config.go:555,572), which resolves the backtick raw-string action to the literal GoTrue template. The TS renderer copied the escape verbatim and runs no template engine, so the raw escape landed in users' configs — a functionally broken SMS/MFA OTP template (GoTrue would send the literal text instead of substituting the code).

The fix pre-renders the two lines in the TS template constant:

template = "Your code is {{ .Code }}"

Verified byte-identical against the Go CLI's actual config.Eject output (dumped via a throwaway Go test harness): these two lines were the only divergence, and after the fix the full generated file matches Go's eject byte-for-byte, including the trailing newline.

Test changes

The existing byte-parity test compared the TS render against the raw Go template source, so both sides carried the unresolved escape and the test passed while the shipped output was broken. It now emulates Go's eject-time rendering (resolveGoTemplateEscapes) before comparing, so it would have caught this bug. Also added:

• a dedicated regression test asserting the two generated template = lines are the rendered GoTrue templates, not raw Go escapes;
• a guard test that fails loudly if the Go scaffold ever gains a {{ ... }} construct the suite does not model, so this class of parity drift cannot silently return (raised by review).

Deliberately out of scope (from review)

• Configs already generated with the broken lines are not auto-migrated. Users who ran init/bootstrap with an affected build keep the raw escape in their config.toml; the manual fix is replacing the two template = lines under [auth.sms] and [auth.mfa.phone] with "Your code is {{ .Code }}". A detect-and-warn on config load (particularly on the config push path, which can carry the broken template to hosted GoTrue) was suggested in review as a possible fast-follow, but auto-editing or warning about user-owned config is a scope/UX decision beyond this parity fix.

Fixes CLI-1971

Linear: https://linear.app/supabase/issue/CLI-1971/initbootstrap-write-broken-smsmfa-template-lines-into-configtoml

[Coly010]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 3b76fc960f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@3b76fc960f91156262050bd6cc46dab3944b14b0

Preview package for commit 3b76fc9.