config diff always reports auth.sms.twilio.enabled on a project with phone sign-in off, and no config.toml can clear it

[phdemotions]

Affected area

Auth

Supabase CLI version

2.117.0

Operating system

macOS 26 (Darwin 25.6.0, arm64)

Installation method

brew

Command

supabase config diff --project-ref <ref> --output-format json
supabase config push --project-ref <ref>

Actual output

On a hosted project that has never set up SMS, config diff always reports one change:

{"path":["auth","sms","twilio","enabled"],"class":"update","declared":true,"local":false,"remote":true}

config push skips it:

Note: 1 declared property could not be encoded and was not pushed: auth.sms.twilio.enabled (config push can switch between SMS providers but cannot turn the active provider off; disable phone sign-in or use the dashboard)

The project's GET /auth/v1/settings answers "external": {"phone": false, ...} and "sms_provider": "twilio". Phone sign-in is off. twilio is only the value sms_provider always holds.

No declaration makes the diff empty:

Declared in [remotes.<name>.auth.sms.twilio]	Result
enabled = false	reported as update; config push cannot encode it (above)
enabled = true	config load fails: Missing required field in config: auth.sms.twilio.account_sid (then message_service_sid, auth_token)
not declared	reported as remote_only (remote true against the default false)

Following the message's advice does not clear it either. Phone sign-in is already off: [auth.sms] enable_signup = false matches external_phone_enabled on the project, and the line is still reported.

Expected behavior

For a project with phone sign-in off (external_phone_enabled: false) and no SMS provider credentials, config diff reports no difference for auth.sms.<provider>.enabled when the file declares it false or leaves it out. Two ways to get there:

1. Compare a provider's enabled as sms_provider == <provider> && external_phone_enabled.
2. Skip auth.sms.<provider>.enabled while phone sign-in is off on both sides.

As it stands, the diff can never come back clean for any project with SMS unused. A diff that always shows one line teaches its reader to skip the next one.

Steps to reproduce

1. Use a hosted project where phone sign-in has never been enabled and no SMS provider is configured. GET /auth/v1/settings shows external.phone: false.
2. supabase config pull --project-ref <ref>, or use a config.toml with no [auth.sms.twilio] table.
3. supabase config diff --project-ref <ref>: reports auth.sms.twilio.enabled as remote_only.
4. Add [remotes.<name>.auth.sms.twilio] with enabled = false, then run config diff: reports update, local false, remote true.
5. supabase config push --project-ref <ref>: prints the note above and writes nothing.
6. Change it to enabled = true and run any command that loads the config: fails with Missing required field in config: auth.sms.twilio.account_sid.

Additional context

In the bundled CLI, auth.sms.<provider>.enabled is mapped to sms_provider (the configPath [auth, sms, <provider>, enabled] / apiPath [auth, sms_provider] entries), and auth.sms.enable_signup to external_phone_enabled. The note text is the config push constant introduced with the diff-first rebuild (#6454).