From 6fa4c974cf1bb4c085aed052e700ea355aa2a3c1 Mon Sep 17 00:00:00 2001
From: Julien Goux <hi@jgoux.dev>
Date: Thu, 25 Jun 2026 13:03:07 +0200
Subject: [PATCH 01/29] feat(db): add reset sql path override (#5691)

Adds a repeatable `--sql-paths` flag to `supabase db reset` so users can
override `[db.seed].sql_paths` for a single reset without editing
`config.toml`.

The flag accepts the same file path or glob pattern syntax as
`sql_paths`, resolves relative values from the `supabase` directory, and
remains mutually exclusive with `--no-seed`. Passing `--sql-paths`
force-enables seeding for that reset even when config disables seeding,
and remote resets warn before applying override seeds to a `--linked` or
`--db-url` target. The TypeScript legacy command wrapper forwards the
flag to the current Go implementation while `db reset` remains on the
legacy path.

Addresses #2191
Supersedes #4680
---
 apps/cli-go/cmd/db.go                         |  76 ++++++++-
 apps/cli-go/cmd/db_test.go                    | 100 ++++++++++++
 apps/cli-go/docs/supabase/db/reset.md         |   4 +
 apps/cli/docs/go-cli-porting-status.md        |   2 +-
 .../legacy/commands/db/reset/SIDE_EFFECTS.md  |  13 +-
 .../legacy/commands/db/reset/reset.command.ts |   9 ++
 .../legacy/commands/db/reset/reset.handler.ts |   1 +
 .../db/reset/reset.integration.test.ts        | 147 ++++++++++++++++++
 8 files changed, 342 insertions(+), 10 deletions(-)
 create mode 100644 apps/cli/src/legacy/commands/db/reset/reset.integration.test.ts

diff --git a/apps/cli-go/cmd/db.go b/apps/cli-go/cmd/db.go
index 3f8d3d82a8..df04364e44 100644
--- a/apps/cli-go/cmd/db.go
+++ b/apps/cli-go/cmd/db.go
@@ -1,8 +1,10 @@
 package cmd
 
 import (
+	"errors"
 	"fmt"
 	"os"
+	"path"
 	"path/filepath"
 
 	"github.com/spf13/afero"
@@ -24,6 +26,7 @@ import (
 	"github.com/supabase/cli/legacy/branch/delete"
 	"github.com/supabase/cli/legacy/branch/list"
 	"github.com/supabase/cli/legacy/branch/switch_"
+	"github.com/supabase/cli/pkg/config"
 	"github.com/supabase/cli/pkg/migration"
 )
 
@@ -300,15 +303,23 @@ var (
 		},
 	}
 
-	noSeed      bool
-	lastVersion uint
+	noSeed       bool
+	lastVersion  uint
+	seedSqlPaths []string
 
 	dbResetCmd = &cobra.Command{
 		Use:   "reset",
 		Short: "Resets the local database to current migrations",
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			if err := validateDbResetSeedFlags(noSeed, seedSqlPaths); err != nil {
+				return err
+			}
+			warnRemoteResetSeedOverride(cmd, seedSqlPaths)
+			return nil
+		},
 		RunE: func(cmd *cobra.Command, args []string) error {
-			if noSeed {
-				utils.Config.Db.Seed.Enabled = false
+			if err := applyDbResetSeedFlags(noSeed, seedSqlPaths); err != nil {
+				return err
 			}
 			return reset.Run(cmd.Context(), migrationVersion, lastVersion, flags.DbConfig, afero.NewOsFs())
 		},
@@ -470,6 +481,62 @@ func resolvePullDiffEngine(engineFlagChanged bool, engine string, pgDeltaDefault
 	return pgDeltaDefault
 }
 
+func validateDbResetSeedFlags(noSeed bool, patterns []string) error {
+	if noSeed && len(patterns) > 0 {
+		utils.CmdSuggestion = fmt.Sprintf("Use either %s to skip seeding or %s to override seed files, not both.", utils.Aqua("--no-seed"), utils.Aqua("--sql-paths"))
+		return errors.New("--no-seed cannot be used with --sql-paths")
+	}
+	for _, pattern := range patterns {
+		if len(pattern) == 0 {
+			utils.CmdSuggestion = fmt.Sprintf("Pass a non-empty file path or glob pattern to %s.", utils.Aqua("--sql-paths"))
+			return errors.New("--sql-paths requires a non-empty path or glob pattern")
+		}
+	}
+	return nil
+}
+
+func warnRemoteResetSeedOverride(cmd *cobra.Command, patterns []string) {
+	if len(patterns) == 0 {
+		return
+	}
+	if cmd.Flags().Changed("linked") || cmd.Flags().Changed("db-url") {
+		fmt.Fprintln(os.Stderr, utils.Yellow("WARNING:"), "--sql-paths overrides [db.seed].sql_paths and seeds the remote database selected by --linked or --db-url.")
+	}
+}
+
+func applyDbResetSeedFlags(noSeed bool, patterns []string) error {
+	if noSeed {
+		utils.Config.Db.Seed.Enabled = false
+		return nil
+	}
+	if len(patterns) == 0 {
+		return nil
+	}
+	resolved, err := resolveSeedSqlPaths(patterns)
+	if err != nil {
+		return err
+	}
+	utils.Config.Db.Seed.Enabled = true
+	utils.Config.Db.Seed.SqlPaths = resolved
+	return nil
+}
+
+func resolveSeedSqlPaths(patterns []string) ([]string, error) {
+	resolved := make([]string, len(patterns))
+	base := config.NewPathBuilder("").SupabaseDirPath
+	for i, pattern := range patterns {
+		if len(pattern) == 0 {
+			return nil, errors.New("--sql-paths requires a non-empty path or glob pattern")
+		}
+		if !filepath.IsAbs(pattern) {
+			resolved[i] = path.Join(base, pattern)
+		} else {
+			resolved[i] = pattern
+		}
+	}
+	return resolved, nil
+}
+
 func init() {
 	// Build branch command
 	dbBranchCmd.AddCommand(dbBranchCreateCmd)
@@ -570,6 +637,7 @@ func init() {
 	resetFlags.Bool("linked", false, "Resets the linked project with local migrations.")
 	resetFlags.Bool("local", true, "Resets the local database with local migrations.")
 	resetFlags.BoolVar(&noSeed, "no-seed", false, "Skip running the seed script after reset.")
+	resetFlags.StringArrayVar(&seedSqlPaths, "sql-paths", nil, "Override [db.seed].sql_paths for this reset. May be repeated; each value accepts a SQL file path or glob pattern relative to the supabase directory and force-enables seeding.")
 	dbResetCmd.MarkFlagsMutuallyExclusive("db-url", "linked", "local")
 	resetFlags.StringVar(&migrationVersion, "version", "", "Reset up to the specified version.")
 	resetFlags.UintVar(&lastVersion, "last", 0, "Reset up to the last n migration versions.")
diff --git a/apps/cli-go/cmd/db_test.go b/apps/cli-go/cmd/db_test.go
index 654278d059..d12bb1cf8f 100644
--- a/apps/cli-go/cmd/db_test.go
+++ b/apps/cli-go/cmd/db_test.go
@@ -1,9 +1,12 @@
 package cmd
 
 import (
+	"path/filepath"
 	"testing"
 
+	"github.com/spf13/pflag"
 	"github.com/stretchr/testify/assert"
+	"github.com/supabase/cli/internal/utils"
 )
 
 func TestResolvePullDiffEngine(t *testing.T) {
@@ -45,3 +48,100 @@ func TestResolveDiffEngine(t *testing.T) {
 		assert.False(t, resolveDiffEngine(false, true, false, true))
 	})
 }
+
+func TestResolveSeedSqlPaths(t *testing.T) {
+	t.Run("resolves relative paths against the supabase directory", func(t *testing.T) {
+		absoluteSeedPath := filepath.Join(t.TempDir(), "seed.sql")
+		got, err := resolveSeedSqlPaths([]string{
+			"./seeds/minimal.sql",
+			"./seeds/demo/*.sql",
+			"./seeds/tenant,one.sql",
+			absoluteSeedPath,
+		})
+
+		assert.NoError(t, err)
+		assert.Equal(t, []string{
+			filepath.Join(utils.SupabaseDirPath, "seeds", "minimal.sql"),
+			filepath.Join(utils.SupabaseDirPath, "seeds", "demo", "*.sql"),
+			filepath.Join(utils.SupabaseDirPath, "seeds", "tenant,one.sql"),
+			absoluteSeedPath,
+		}, got)
+	})
+
+	t.Run("rejects empty paths", func(t *testing.T) {
+		got, err := resolveSeedSqlPaths([]string{""})
+		assert.Nil(t, got)
+		assert.EqualError(t, err, "--sql-paths requires a non-empty path or glob pattern")
+	})
+}
+
+func TestValidateDbResetSeedFlags(t *testing.T) {
+	t.Run("rejects no seed with sql paths", func(t *testing.T) {
+		utils.CmdSuggestion = ""
+		t.Cleanup(func() { utils.CmdSuggestion = "" })
+
+		err := validateDbResetSeedFlags(true, []string{"./seed.sql"})
+
+		assert.EqualError(t, err, "--no-seed cannot be used with --sql-paths")
+		assert.Contains(t, utils.CmdSuggestion, "Use either")
+		assert.Contains(t, utils.CmdSuggestion, "--no-seed")
+		assert.Contains(t, utils.CmdSuggestion, "--sql-paths")
+	})
+
+	t.Run("rejects empty sql paths", func(t *testing.T) {
+		utils.CmdSuggestion = ""
+		t.Cleanup(func() { utils.CmdSuggestion = "" })
+
+		err := validateDbResetSeedFlags(false, []string{""})
+
+		assert.EqualError(t, err, "--sql-paths requires a non-empty path or glob pattern")
+		assert.Contains(t, utils.CmdSuggestion, "non-empty")
+		assert.Contains(t, utils.CmdSuggestion, "--sql-paths")
+	})
+}
+
+func TestApplyDbResetSeedFlags(t *testing.T) {
+	oldSeed := utils.Config.Db.Seed
+	t.Cleanup(func() { utils.Config.Db.Seed = oldSeed })
+
+	t.Run("leaves config unchanged without seed flags", func(t *testing.T) {
+		utils.Config.Db.Seed.Enabled = false
+		utils.Config.Db.Seed.SqlPaths = []string{"supabase/original.sql"}
+
+		assert.NoError(t, applyDbResetSeedFlags(false, nil))
+		assert.False(t, utils.Config.Db.Seed.Enabled)
+		assert.Equal(t, []string{"supabase/original.sql"}, []string(utils.Config.Db.Seed.SqlPaths))
+	})
+
+	t.Run("disables seed when no seed is set", func(t *testing.T) {
+		utils.Config.Db.Seed.Enabled = true
+		utils.Config.Db.Seed.SqlPaths = []string{"supabase/original.sql"}
+
+		assert.NoError(t, applyDbResetSeedFlags(true, nil))
+		assert.False(t, utils.Config.Db.Seed.Enabled)
+		assert.Equal(t, []string{"supabase/original.sql"}, []string(utils.Config.Db.Seed.SqlPaths))
+	})
+
+	t.Run("force enables seed and overrides sql paths", func(t *testing.T) {
+		utils.Config.Db.Seed.Enabled = false
+		utils.Config.Db.Seed.SqlPaths = []string{"supabase/original.sql"}
+
+		assert.NoError(t, applyDbResetSeedFlags(false, []string{"./seeds/base.sql"}))
+		assert.True(t, utils.Config.Db.Seed.Enabled)
+		assert.Equal(t, []string{filepath.Join(utils.SupabaseDirPath, "seeds", "base.sql")}, []string(utils.Config.Db.Seed.SqlPaths))
+	})
+}
+
+func TestSeedSqlPathsFlagPreservesCommas(t *testing.T) {
+	var values []string
+	flags := pflag.NewFlagSet("test", pflag.ContinueOnError)
+	flags.StringArrayVar(&values, "sql-paths", nil, "")
+
+	assert.NoError(t, flags.Parse([]string{
+		"--sql-paths",
+		"./seeds/tenant,one.sql",
+		"--sql-paths",
+		"./seeds/two.sql",
+	}))
+	assert.Equal(t, []string{"./seeds/tenant,one.sql", "./seeds/two.sql"}, values)
+}
diff --git a/apps/cli-go/docs/supabase/db/reset.md b/apps/cli-go/docs/supabase/db/reset.md
index acb9b9832b..9a60a67711 100644
--- a/apps/cli-go/docs/supabase/db/reset.md
+++ b/apps/cli-go/docs/supabase/db/reset.md
@@ -6,4 +6,8 @@ Requires the local development stack to be started by running `supabase start`.
 
 Recreates the local Postgres container and applies all local migrations found in `supabase/migrations` directory. If test data is defined in `supabase/seed.sql`, it will be seeded after the migrations are run. Any other data or schema changes made during local development will be discarded.
 
+Use the `--no-seed` flag to skip seeding entirely. To override `[db.seed].sql_paths` for a single reset, pass one or more `--sql-paths` flags. Each value accepts the same file path or glob pattern syntax as `sql_paths`, relative to the `supabase` directory. Passing `--sql-paths` force-enables seeding for that reset even when `[db.seed].enabled = false`.
+
 When running db reset with `--linked` or `--db-url` flag, a SQL script is executed to identify and drop all user created entities in the remote database. Since Postgres roles are cluster level entities, any custom roles created through the dashboard or `supabase/roles.sql` will not be deleted by remote reset.
+
+If you combine `--sql-paths` with `--linked` or `--db-url`, the override seed files are applied to the selected remote database after migrations. Use this only when you intend to seed that remote target.
diff --git a/apps/cli/docs/go-cli-porting-status.md b/apps/cli/docs/go-cli-porting-status.md
index 9cebb1a5f5..9b22759d95 100644
--- a/apps/cli/docs/go-cli-porting-status.md
+++ b/apps/cli/docs/go-cli-porting-status.md
@@ -302,7 +302,7 @@ Legend:
 | `db dump`                              | `ported`      | [`../src/legacy/commands/db/dump/dump.command.ts`](../src/legacy/commands/db/dump/dump.command.ts)                                                                                                                                                                         |
 | `db push`                              | `wrapped`     | [`../src/legacy/commands/db/push/push.command.ts`](../src/legacy/commands/db/push/push.command.ts)                                                                                                                                                                         |
 | `db pull`                              | `ported`      | [`../src/legacy/commands/db/pull/pull.command.ts`](../src/legacy/commands/db/pull/pull.command.ts) — native pg-delta / migra; `--declarative` (deprecated alias `--use-pg-delta`) + `--diff-engine` (migra\|pg-delta); `--experimental` / initial `pg_dump` delegate to Go |
-| `db reset`                             | `wrapped`     | [`../src/legacy/commands/db/reset/reset.command.ts`](../src/legacy/commands/db/reset/reset.command.ts)                                                                                                                                                                     |
+| `db reset`                             | `wrapped`     | [`../src/legacy/commands/db/reset/reset.command.ts`](../src/legacy/commands/db/reset/reset.command.ts) — includes Go-parity `--sql-paths` override for `[db.seed].sql_paths`                                                                                               |
 | `db lint`                              | `ported`      | [`../src/legacy/commands/db/lint/lint.command.ts`](../src/legacy/commands/db/lint/lint.command.ts)                                                                                                                                                                         |
 | `db start`                             | `wrapped`     | [`../src/legacy/commands/db/start/start.command.ts`](../src/legacy/commands/db/start/start.command.ts)                                                                                                                                                                     |
 | `db query`                             | `ported`      | [`../src/legacy/commands/db/query/query.command.ts`](../src/legacy/commands/db/query/query.command.ts)                                                                                                                                                                     |
diff --git a/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md
index a2c24f24d2..d1291e27a4 100644
--- a/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md
@@ -2,11 +2,11 @@
 
 ## Files Read
 
-| Path                             | Format     | When                                              |
-| -------------------------------- | ---------- | ------------------------------------------------- |
-| `~/.supabase/access-token`       | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` |
-| `<workdir>/supabase/migrations/` | directory  | always, to load migration files                   |
-| seed files from config           | SQL        | unless `--no-seed` is set                         |
+| Path                                    | Format     | When                                              |
+| --------------------------------------- | ---------- | ------------------------------------------------- |
+| `~/.supabase/access-token`              | plain text | when `SUPABASE_ACCESS_TOKEN` unset and `--linked` |
+| `<workdir>/supabase/migrations/`        | directory  | always, to load migration files                   |
+| seed files from config or `--sql-paths` | SQL        | unless `--no-seed` is set                         |
 
 ## Files Written
 
@@ -52,6 +52,9 @@ Not applicable.
 ## Notes
 
 - `--no-seed` skips running the seed script after reset.
+- `--sql-paths` overrides `[db.seed].sql_paths` for one reset; repeat it to seed multiple files or glob patterns.
+- `--sql-paths` force-enables seeding for that reset even when `[db.seed].enabled = false`.
+- With `--linked` or `--db-url`, `--sql-paths` seeds the selected remote database after migrations.
 - `--version` resets up to the specified migration version.
 - `--last` resets up to the last n migration versions; mutually exclusive with `--version`.
 - `--db-url`, `--linked`, and `--local` (default true) are mutually exclusive.
diff --git a/apps/cli/src/legacy/commands/db/reset/reset.command.ts b/apps/cli/src/legacy/commands/db/reset/reset.command.ts
index 11764e9db7..15a61c8d88 100644
--- a/apps/cli/src/legacy/commands/db/reset/reset.command.ts
+++ b/apps/cli/src/legacy/commands/db/reset/reset.command.ts
@@ -2,6 +2,8 @@ import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
 import { legacyDbReset } from "./reset.handler.ts";
 
+const noSqlPaths: ReadonlyArray<string> = [];
+
 const config = {
   dbUrl: Flag.string("db-url").pipe(
     Flag.withDescription(
@@ -18,6 +20,13 @@ const config = {
   noSeed: Flag.boolean("no-seed").pipe(
     Flag.withDescription("Skip running the seed script after reset."),
   ),
+  sqlPaths: Flag.string("sql-paths").pipe(
+    Flag.atLeast(0),
+    Flag.withDescription(
+      "Override [db.seed].sql_paths for this reset. May be repeated; each value accepts a SQL file path or glob pattern relative to the supabase directory and force-enables seeding.",
+    ),
+    Flag.withDefault(noSqlPaths),
+  ),
   version: Flag.string("version").pipe(
     Flag.withDescription("Reset up to the specified version."),
     Flag.optional,
diff --git a/apps/cli/src/legacy/commands/db/reset/reset.handler.ts b/apps/cli/src/legacy/commands/db/reset/reset.handler.ts
index 406485fe53..de35923ac2 100644
--- a/apps/cli/src/legacy/commands/db/reset/reset.handler.ts
+++ b/apps/cli/src/legacy/commands/db/reset/reset.handler.ts
@@ -9,6 +9,7 @@ export const legacyDbReset = Effect.fn("legacy.db.reset")(function* (flags: Lega
   if (flags.linked) args.push("--linked");
   if (flags.local) args.push("--local");
   if (flags.noSeed) args.push("--no-seed");
+  for (const path of flags.sqlPaths) args.push("--sql-paths", path);
   if (Option.isSome(flags.version)) args.push("--version", flags.version.value);
   if (Option.isSome(flags.last)) args.push("--last", String(flags.last.value));
   yield* proxy.exec(args);
diff --git a/apps/cli/src/legacy/commands/db/reset/reset.integration.test.ts b/apps/cli/src/legacy/commands/db/reset/reset.integration.test.ts
new file mode 100644
index 0000000000..bd533d2adc
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/reset/reset.integration.test.ts
@@ -0,0 +1,147 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Layer, Option } from "effect";
+import { CliOutput, Command } from "effect/unstable/cli";
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { textCliOutputFormatter } from "../../../../shared/output/text-formatter.ts";
+import { legacyDbResetCommand } from "./reset.command.ts";
+import { legacyDbReset } from "./reset.handler.ts";
+import type { LegacyDbResetFlags } from "./reset.command.ts";
+
+function setupLegacyDbReset() {
+  const calls: Array<ReadonlyArray<string>> = [];
+  const layer = Layer.succeed(LegacyGoProxy, {
+    exec: (args) =>
+      Effect.sync(() => {
+        calls.push(args);
+      }),
+    execCapture: () => Effect.succeed(""),
+  });
+  return { layer, calls };
+}
+
+const baseFlags: LegacyDbResetFlags = {
+  dbUrl: Option.none(),
+  linked: false,
+  local: false,
+  noSeed: false,
+  sqlPaths: [],
+  version: Option.none(),
+  last: Option.none(),
+};
+
+describe("legacy db reset", () => {
+  it.live("forwards the empty-array baseline without seed override flags", () => {
+    const { layer, calls } = setupLegacyDbReset();
+    return Effect.gen(function* () {
+      yield* legacyDbReset(baseFlags);
+      expect(calls).toEqual([["db", "reset"]]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("forwards --no-seed alone", () => {
+    const { layer, calls } = setupLegacyDbReset();
+    return Effect.gen(function* () {
+      yield* legacyDbReset({ ...baseFlags, noSeed: true });
+      expect(calls).toEqual([["db", "reset", "--no-seed"]]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("forwards a single --sql-paths flag", () => {
+    const { layer, calls } = setupLegacyDbReset();
+    return Effect.gen(function* () {
+      yield* legacyDbReset({
+        ...baseFlags,
+        sqlPaths: ["./seeds/base.sql"],
+      });
+      expect(calls).toEqual([["db", "reset", "--sql-paths", "./seeds/base.sql"]]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("forwards repeated --sql-paths flags in order", () => {
+    const { layer, calls } = setupLegacyDbReset();
+    return Effect.gen(function* () {
+      yield* legacyDbReset({
+        ...baseFlags,
+        sqlPaths: ["./seeds/base.sql", "./seeds/demo/*.sql"],
+      });
+      expect(calls).toEqual([
+        ["db", "reset", "--sql-paths", "./seeds/base.sql", "--sql-paths", "./seeds/demo/*.sql"],
+      ]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("forwards --no-seed with --sql-paths so Go owns the diagnostic", () => {
+    const { layer, calls } = setupLegacyDbReset();
+    return Effect.gen(function* () {
+      yield* legacyDbReset({
+        ...baseFlags,
+        noSeed: true,
+        sqlPaths: ["./seeds/base.sql"],
+      });
+      expect(calls).toEqual([["db", "reset", "--no-seed", "--sql-paths", "./seeds/base.sql"]]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("forwards an empty --sql-paths value so Go owns the diagnostic", () => {
+    const { layer, calls } = setupLegacyDbReset();
+    return Effect.gen(function* () {
+      yield* legacyDbReset({
+        ...baseFlags,
+        sqlPaths: [""],
+      });
+      expect(calls).toEqual([["db", "reset", "--sql-paths", ""]]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it("parses repeated --sql-paths flags from the command surface", async () => {
+    const { layer, calls } = setupLegacyDbReset();
+    await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          yield* Command.runWith(legacyDbResetCommand, { version: "0.0.0-test" })([
+            "--sql-paths",
+            "./seeds/base.sql",
+            "--sql-paths",
+            "./seeds/demo/*.sql",
+          ]);
+          expect(calls).toEqual([
+            ["db", "reset", "--sql-paths", "./seeds/base.sql", "--sql-paths", "./seeds/demo/*.sql"],
+          ]);
+        }),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(
+            layer,
+            mockOutput({ format: "text" }).layer,
+            CliOutput.layer(textCliOutputFormatter()),
+          ),
+        ),
+      ) as Effect.Effect<void>,
+    );
+  });
+
+  it("forwards mutually exclusive seed flags from the command surface", async () => {
+    const { layer, calls } = setupLegacyDbReset();
+    await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          yield* Command.runWith(legacyDbResetCommand, { version: "0.0.0-test" })([
+            "--no-seed",
+            "--sql-paths",
+            "./seeds/base.sql",
+          ]);
+          expect(calls).toEqual([["db", "reset", "--no-seed", "--sql-paths", "./seeds/base.sql"]]);
+        }),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(
+            layer,
+            mockOutput({ format: "text" }).layer,
+            CliOutput.layer(textCliOutputFormatter()),
+          ),
+        ),
+      ) as Effect.Effect<void>,
+    );
+  });
+});

From 229493c288043cf0b9d69dbbcc1e16db848a5c44 Mon Sep 17 00:00:00 2001
From: Luc Peng <wendingp@gmail.com>
Date: Thu, 25 Jun 2026 22:11:36 +0800
Subject: [PATCH 02/29] fix(cli): detect stale local postgres before
 declarative sync (#5646)

## What
- Add a declarative schema sync guard that inspects the local Postgres
container image tag before generating a migration.
- Fail with an actionable stop/start suggestion when the running local
Postgres container tag is stale.
- Cover missing, matching, registry-different, and stale local container
cases with regression tests.

## Why
A stale local Postgres container after a CLI upgrade can produce
declarative sync output against an inconsistent local stack, such as
incorrect extension drops.

## Validation
- `cd apps/cli-go && go test ./cmd ./internal/db/declarative`
- `cd apps/cli-go && GOMAXPROCS=4 go test ./...`
- `git diff --check`

Fixes #5555

---------

Co-authored-by: Julien Goux <hi@jgoux.dev>
---
 apps/cli-go/cmd/db_schema_declarative.go      |  52 ++++-
 apps/cli-go/cmd/db_schema_declarative_test.go |  70 +++++++
 .../internal/db/declarative/declarative.go    |  18 +-
 .../db/declarative/declarative_test.go        |   9 +-
 .../commands/db/diff/diff.integration.test.ts |   1 +
 .../commands/db/pull/pull.integration.test.ts |   1 +
 ...eclarative.orchestrate.integration.test.ts |   1 +
 .../declarative/declarative.smart-target.ts   |   4 +
 .../declarative/generate/generate.handler.ts  |   5 +-
 .../generate/generate.integration.test.ts     |  56 ++++++
 .../schema/declarative/sync/sync.handler.ts   |   7 +-
 .../declarative/sync/sync.integration.test.ts | 181 +++++++++++++++++-
 .../db/shared/legacy-pgdelta.seam.layer.ts    | 148 ++++++++++++++
 .../legacy-pgdelta.seam.layer.unit.test.ts    |  56 ++++++
 .../db/shared/legacy-pgdelta.seam.service.ts  |   9 +
 15 files changed, 606 insertions(+), 12 deletions(-)
 create mode 100644 apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.layer.unit.test.ts

diff --git a/apps/cli-go/cmd/db_schema_declarative.go b/apps/cli-go/cmd/db_schema_declarative.go
index 45f3f6aaaa..bcc689ca0b 100644
--- a/apps/cli-go/cmd/db_schema_declarative.go
+++ b/apps/cli-go/cmd/db_schema_declarative.go
@@ -8,6 +8,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/containerd/errdefs"
+	"github.com/docker/docker/api/types/container"
 	"github.com/jackc/pgconn"
 	"github.com/jackc/pgx/v4"
 	"github.com/spf13/afero"
@@ -157,6 +159,39 @@ func ensureLocalDatabaseStarted(ctx context.Context, local bool, isRunning func(
 	return nil
 }
 
+type inspectContainerFunc func(context.Context, string) (container.InspectResponse, error)
+
+func dockerImageTag(image string) string {
+	image = strings.TrimSpace(image)
+	index := strings.LastIndexByte(image, ':')
+	if index < 0 || index == len(image)-1 {
+		return ""
+	}
+	return image[index+1:]
+}
+
+func ensureLocalPostgresImageCurrent(ctx context.Context, inspect inspectContainerFunc) error {
+	resp, err := inspect(ctx, utils.DbId)
+	if err != nil {
+		if errdefs.IsNotFound(err) {
+			return nil
+		}
+		return fmt.Errorf("failed to inspect local Postgres container: %w", err)
+	}
+	if resp.Config == nil || len(strings.TrimSpace(resp.Config.Image)) == 0 {
+		return nil
+	}
+	actual := strings.TrimSpace(resp.Config.Image)
+	expected := strings.TrimSpace(utils.GetRegistryImageUrl(utils.Config.Db.Image))
+	actualTag := dockerImageTag(actual)
+	expectedTag := dockerImageTag(expected)
+	if len(actualTag) == 0 || len(expectedTag) == 0 || actualTag == expectedTag {
+		return nil
+	}
+	utils.CmdSuggestion = fmt.Sprintf("Run %s, then %s before syncing declarative schemas.", utils.Aqua("supabase stop --all --no-backup"), utils.Aqua("supabase start"))
+	return fmt.Errorf("local Postgres container image is stale: running %s but expected %s", actual, expected)
+}
+
 // hasExplicitTargetFlag returns true if the user explicitly set --local, --linked, or --db-url.
 func hasExplicitTargetFlag(cmd *cobra.Command) bool {
 	return cmd.Flags().Changed("local") || cmd.Flags().Changed("linked") || cmd.Flags().Changed("db-url")
@@ -208,6 +243,11 @@ func runDeclarativeGenerate(cmd *cobra.Command, args []string) error {
 
 	// When an explicit target flag is provided, use the direct path.
 	if hasExplicitTargetFlag(cmd) {
+		if cmd.Flags().Changed("local") {
+			if err := ensureLocalPostgresImageCurrent(ctx, utils.Docker.ContainerInspect); err != nil {
+				return err
+			}
+		}
 		if err := ensureLocalDatabaseStarted(ctx, declarativeLocal, utils.AssertSupabaseDbIsRunning, func(ctx context.Context) error {
 			return start.Run(ctx, "", fsys)
 		}); err != nil {
@@ -267,6 +307,9 @@ func runDeclarativeGenerate(cmd *cobra.Command, args []string) error {
 
 		switch choice.Index {
 		case 0: // Local database
+			if err := ensureLocalPostgresImageCurrent(ctx, utils.Docker.ContainerInspect); err != nil {
+				return err
+			}
 			if err := ensureLocalDatabaseStarted(ctx, true, utils.AssertSupabaseDbIsRunning, func(ctx context.Context) error {
 				return start.Run(ctx, "", fsys)
 			}); err != nil {
@@ -309,6 +352,9 @@ func runDeclarativeGenerate(cmd *cobra.Command, args []string) error {
 		}
 	} else {
 		// No migrations — generate from local DB
+		if err := ensureLocalPostgresImageCurrent(ctx, utils.Docker.ContainerInspect); err != nil {
+			return err
+		}
 		if err := ensureLocalDatabaseStarted(ctx, true, utils.AssertSupabaseDbIsRunning, func(ctx context.Context) error {
 			return start.Run(ctx, "", fsys)
 		}); err != nil {
@@ -325,9 +371,10 @@ func runDeclarativeSync(cmd *cobra.Command, args []string) error {
 	ctx := cmd.Context()
 	fsys := afero.NewOsFs()
 	console := utils.NewConsole()
+	declarativeFilesExist := hasDeclarativeFiles(fsys)
 
 	// Step 1: Check if declarative dir has files
-	if !hasDeclarativeFiles(fsys) {
+	if !declarativeFilesExist {
 		if !isTTY() && !viper.GetBool("YES") {
 			return fmt.Errorf("no declarative schema found. Run %s first", utils.Aqua("supabase db schema declarative generate"))
 		}
@@ -416,6 +463,9 @@ func runDeclarativeSync(cmd *cobra.Command, args []string) error {
 	}
 
 	if shouldApply {
+		if err := ensureLocalPostgresImageCurrent(ctx, utils.Docker.ContainerInspect); err != nil {
+			return err
+		}
 		if applyErr := applyMigrationToLocal(ctx, path, fsys); applyErr != nil {
 			fmt.Fprintln(os.Stderr, utils.Red("Migration failed to apply: "+applyErr.Error()))
 
diff --git a/apps/cli-go/cmd/db_schema_declarative_test.go b/apps/cli-go/cmd/db_schema_declarative_test.go
index a799ad0fb8..738e204111 100644
--- a/apps/cli-go/cmd/db_schema_declarative_test.go
+++ b/apps/cli-go/cmd/db_schema_declarative_test.go
@@ -6,6 +6,8 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/containerd/errdefs"
+	"github.com/docker/docker/api/types/container"
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -194,6 +196,74 @@ func TestEnsureLocalDatabaseStarted(t *testing.T) {
 	})
 }
 
+func TestDockerImageTag(t *testing.T) {
+	testCases := map[string]string{
+		"public.ecr.aws/supabase/postgres:17.6.1.138": "17.6.1.138",
+		"localhost:5000/supabase/postgres:17.6.1.138": "17.6.1.138",
+		"supabase/postgres":                           "",
+	}
+	for image, expected := range testCases {
+		t.Run(image, func(t *testing.T) {
+			assert.Equal(t, expected, dockerImageTag(image))
+		})
+	}
+}
+
+func TestEnsureLocalPostgresImageCurrent(t *testing.T) {
+	originalImage := utils.Config.Db.Image
+	originalSuggestion := utils.CmdSuggestion
+	t.Cleanup(func() {
+		utils.Config.Db.Image = originalImage
+		utils.CmdSuggestion = originalSuggestion
+	})
+	utils.Config.Db.Image = "supabase/postgres:17.6.1.138"
+	expectedImage := utils.GetRegistryImageUrl(utils.Config.Db.Image)
+
+	t.Run("passes when no local container exists", func(t *testing.T) {
+		utils.CmdSuggestion = ""
+		err := ensureLocalPostgresImageCurrent(context.Background(), func(context.Context, string) (container.InspectResponse, error) {
+			return container.InspectResponse{}, errdefs.ErrNotFound
+		})
+
+		assert.NoError(t, err)
+		assert.Empty(t, utils.CmdSuggestion)
+	})
+
+	t.Run("passes when local container image matches expected postgres image", func(t *testing.T) {
+		utils.CmdSuggestion = ""
+		err := ensureLocalPostgresImageCurrent(context.Background(), func(_ context.Context, containerID string) (container.InspectResponse, error) {
+			assert.Equal(t, utils.DbId, containerID)
+			return container.InspectResponse{Config: &container.Config{Image: expectedImage}}, nil
+		})
+
+		assert.NoError(t, err)
+		assert.Empty(t, utils.CmdSuggestion)
+	})
+
+	t.Run("passes when registry differs but postgres tag matches", func(t *testing.T) {
+		utils.CmdSuggestion = ""
+		err := ensureLocalPostgresImageCurrent(context.Background(), func(context.Context, string) (container.InspectResponse, error) {
+			return container.InspectResponse{Config: &container.Config{Image: "docker.io/supabase/postgres:17.6.1.138"}}, nil
+		})
+
+		assert.NoError(t, err)
+		assert.Empty(t, utils.CmdSuggestion)
+	})
+
+	t.Run("fails when local container image is stale", func(t *testing.T) {
+		utils.CmdSuggestion = ""
+		err := ensureLocalPostgresImageCurrent(context.Background(), func(context.Context, string) (container.InspectResponse, error) {
+			return container.InspectResponse{Config: &container.Config{Image: "public.ecr.aws/supabase/postgres:17.6.1.106"}}, nil
+		})
+
+		assert.ErrorContains(t, err, "local Postgres container image is stale")
+		assert.ErrorContains(t, err, "17.6.1.106")
+		assert.ErrorContains(t, err, "17.6.1.138")
+		assert.Contains(t, utils.CmdSuggestion, "supabase stop --all --no-backup")
+		assert.Contains(t, utils.CmdSuggestion, "supabase start")
+	})
+}
+
 func TestHasDeclarativeFiles(t *testing.T) {
 	t.Run("returns false when dir does not exist", func(t *testing.T) {
 		assert.False(t, hasDeclarativeFiles(mockFsys()))
diff --git a/apps/cli-go/internal/db/declarative/declarative.go b/apps/cli-go/internal/db/declarative/declarative.go
index 9b17efa078..c79df6289f 100644
--- a/apps/cli-go/internal/db/declarative/declarative.go
+++ b/apps/cli-go/internal/db/declarative/declarative.go
@@ -363,8 +363,8 @@ func getGenerateBaselineCatalogRef(ctx context.Context, noCache bool, fsys afero
 // getMigrationsCatalogRef returns a catalog reference representing local
 // migrations applied to a shadow database.
 //
-// A migration-content hash keys the cache so it is reused only when local
-// migration state is unchanged.
+// A migration-content hash plus setup-input token keys the cache so it is reused
+// only when both local migration state and platform baseline inputs are unchanged.
 func getMigrationsCatalogRef(ctx context.Context, noCache bool, fsys afero.Fs, prefix string, options ...func(*pgx.ConnConfig)) (string, error) {
 	migrations, err := migration.ListLocalMigrations(utils.MigrationsDir, afero.NewIOFS(fsys))
 	if err != nil {
@@ -390,7 +390,7 @@ func getMigrationsCatalogRef(ctx context.Context, noCache bool, fsys afero.Fs, p
 			}
 		}
 	}
-	hash, err := pgcache.HashMigrations(fsys)
+	hash, err := migrationsCatalogCacheKey(fsys)
 	if err != nil {
 		return "", err
 	}
@@ -762,6 +762,18 @@ func declarativeCatalogCacheKey(fsys afero.Fs) (string, error) {
 	return setup + "-" + schemaHash, nil
 }
 
+func migrationsCatalogCacheKey(fsys afero.Fs) (string, error) {
+	migrationsHash, err := hashMigrations(fsys)
+	if err != nil {
+		return "", err
+	}
+	setup, err := setupInputsToken(fsys)
+	if err != nil {
+		return "", err
+	}
+	return setup + "-" + migrationsHash, nil
+}
+
 func sanitizedCatalogPrefix(prefix string) string {
 	prefix = strings.TrimSpace(prefix)
 	if len(prefix) == 0 {
diff --git a/apps/cli-go/internal/db/declarative/declarative_test.go b/apps/cli-go/internal/db/declarative/declarative_test.go
index fa17a12a2b..cbd67d29de 100644
--- a/apps/cli-go/internal/db/declarative/declarative_test.go
+++ b/apps/cli-go/internal/db/declarative/declarative_test.go
@@ -241,22 +241,27 @@ func TestGetMigrationsCatalogRefUsesCache(t *testing.T) {
 	fsys := afero.NewMemMapFs()
 	p := filepath.Join(utils.MigrationsDir, "20240101000000_first.sql")
 	require.NoError(t, afero.WriteFile(fsys, p, []byte("create table a();"), 0644))
-	hash, err := hashMigrations(fsys)
+	legacyHash, err := hashMigrations(fsys)
 	require.NoError(t, err)
+	stalePath := filepath.Join(utils.TempDir, "pgdelta", "catalog-local-migrations-"+legacyHash+"-1000.json")
+	require.NoError(t, afero.WriteFile(fsys, stalePath, []byte(`{"version":"stale"}`), 0644))
 
+	hash, err := migrationsCatalogCacheKey(fsys)
+	require.NoError(t, err)
 	cachePath := filepath.Join(utils.TempDir, "pgdelta", "catalog-local-migrations-"+hash+"-1000.json")
 	require.NoError(t, afero.WriteFile(fsys, cachePath, []byte(`{"version":1}`), 0644))
 
 	ref, err := getMigrationsCatalogRef(t.Context(), false, fsys, "local")
 	require.NoError(t, err)
 	assert.Equal(t, cachePath, ref)
+	assert.NotEqual(t, stalePath, ref)
 }
 
 func TestGetMigrationsCatalogRefUsesProjectPrefix(t *testing.T) {
 	fsys := afero.NewMemMapFs()
 	p := filepath.Join(utils.MigrationsDir, "20240101000000_first.sql")
 	require.NoError(t, afero.WriteFile(fsys, p, []byte("create table a();"), 0644))
-	hash, err := hashMigrations(fsys)
+	hash, err := migrationsCatalogCacheKey(fsys)
 	require.NoError(t, err)
 
 	cachePath := filepath.Join(utils.TempDir, "pgdelta", "catalog-testproject-migrations-"+hash+"-1000.json")
diff --git a/apps/cli/src/legacy/commands/db/diff/diff.integration.test.ts b/apps/cli/src/legacy/commands/db/diff/diff.integration.test.ts
index bb52810856..bc2d759e52 100644
--- a/apps/cli/src/legacy/commands/db/diff/diff.integration.test.ts
+++ b/apps/cli/src/legacy/commands/db/diff/diff.integration.test.ts
@@ -63,6 +63,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     },
     execInherit: () => Effect.succeed(0),
     ensureLocalDatabaseStarted: () => Effect.void,
+    ensureLocalPostgresImageCurrent: () => Effect.void,
     provisionShadow: ({ mode, targetLocal, usePgDelta, projectRef }) => {
       provisionCalls.push({ mode, targetLocal, usePgDelta, projectRef });
       return Effect.succeed({
diff --git a/apps/cli/src/legacy/commands/db/pull/pull.integration.test.ts b/apps/cli/src/legacy/commands/db/pull/pull.integration.test.ts
index f7ee1b0396..794b61ab5e 100644
--- a/apps/cli/src/legacy/commands/db/pull/pull.integration.test.ts
+++ b/apps/cli/src/legacy/commands/db/pull/pull.integration.test.ts
@@ -81,6 +81,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     exportCatalog: () => Effect.succeed("supabase/.temp/pgdelta/x.json"),
     execInherit: () => Effect.succeed(0),
     ensureLocalDatabaseStarted: () => Effect.void,
+    ensureLocalPostgresImageCurrent: () => Effect.void,
     provisionShadow: ({ mode, usePgDelta, targetLocal, projectRef }) => {
       provisionCalls.push({ mode, usePgDelta, targetLocal, projectRef });
       return Effect.succeed({
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/declarative.orchestrate.integration.test.ts b/apps/cli/src/legacy/commands/db/schema/declarative/declarative.orchestrate.integration.test.ts
index ff49d1be91..19da790379 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/declarative.orchestrate.integration.test.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/declarative.orchestrate.integration.test.ts
@@ -29,6 +29,7 @@ function mockSeam(paths: Record<LegacyCatalogMode, string>) {
     },
     execInherit: () => Effect.succeed(0),
     ensureLocalDatabaseStarted: () => Effect.void,
+    ensureLocalPostgresImageCurrent: () => Effect.void,
     provisionShadow: () => Effect.die("provisionShadow not used in declarative tests"),
     removeShadowContainer: () => Effect.void,
   });
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/declarative.smart-target.ts b/apps/cli/src/legacy/commands/db/schema/declarative/declarative.smart-target.ts
index 167520a3d4..7e6cbab323 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/declarative.smart-target.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/declarative.smart-target.ts
@@ -19,6 +19,7 @@ import {
   LegacyDeclarativeApplyError,
   LegacyDeclarativeInvalidDbUrlError,
 } from "./declarative.errors.ts";
+import type { LegacyDeclarativeShadowDbError } from "../../shared/legacy-pgdelta.errors.ts";
 import { LegacyDeclarativeSeam } from "../../shared/legacy-pgdelta.seam.service.ts";
 
 /**
@@ -84,10 +85,12 @@ export const legacyResolveSmartTargetUrl = Effect.fnUntraced(function* (
   path: Path.Path,
   workdir: string,
   linkedRef: Option.Option<string>,
+  beforeLocalTarget: Effect.Effect<void, LegacyDeclarativeShadowDbError> = Effect.void,
 ) {
   if (!hasMigrations) {
     // No migrations → generate from local. Go runs ensureLocalDatabaseStarted first
     // (db_schema_declarative.go:291), starting a stopped stack.
+    yield* beforeLocalTarget;
     yield* (yield* LegacyDeclarativeSeam).ensureLocalDatabaseStarted();
     return legacyLocalUrl(local);
   }
@@ -149,6 +152,7 @@ export const legacyResolveSmartTargetUrl = Effect.fnUntraced(function* (
 
   // "Local database" choice: Go runs ensureLocalDatabaseStarted before the reset
   // prompt (db_schema_declarative.go:249), starting a stopped stack.
+  yield* beforeLocalTarget;
   yield* (yield* LegacyDeclarativeSeam).ensureLocalDatabaseStarted();
 
   let shouldReset = flags.reset;
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.handler.ts b/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.handler.ts
index 5e090a8633..fbcb89a721 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.handler.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.handler.ts
@@ -132,14 +132,16 @@ export const legacyDbSchemaDeclarativeGenerate = Effect.fn("legacy.db.schema.dec
       let targetUrl: string;
       let overwrite: boolean;
       if (hasExplicitTarget) {
+        const seam = yield* LegacyDeclarativeSeam;
         if (Option.isSome(flags.local)) {
           // Target selection keys off flag presence (Go's `Changed`), but the
           // auto-start gates on the boolean VALUE: Go passes `declarativeLocal` to
           // `ensureLocalDatabaseStarted` (`db_schema_declarative.go:190`), which
           // short-circuits `if !local { return nil }` (`:127-128`). So `--local=false`
           // selects the local target but must NOT start a stopped stack.
+          yield* seam.ensureLocalPostgresImageCurrent();
           if (Option.getOrElse(flags.local, () => false)) {
-            yield* (yield* LegacyDeclarativeSeam).ensureLocalDatabaseStarted();
+            yield* seam.ensureLocalDatabaseStarted();
           }
           targetUrl = legacyLocalUrl(local);
         } else {
@@ -206,6 +208,7 @@ export const legacyDbSchemaDeclarativeGenerate = Effect.fn("legacy.db.schema.dec
           path,
           cliConfig.workdir,
           linkedRef,
+          (yield* LegacyDeclarativeSeam).ensureLocalPostgresImageCurrent(),
         );
         overwrite = true;
       }
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.integration.test.ts b/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.integration.test.ts
index b49cf92592..938ceab885 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.integration.test.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/generate/generate.integration.test.ts
@@ -58,6 +58,7 @@ interface SetupOpts {
   networkId?: Option.Option<string>;
   projectId?: Option.Option<string>;
   exportFailsForMode?: LegacyCatalogMode;
+  staleLocalImage?: boolean;
 }
 
 function setup(workdir: string, opts: SetupOpts = {}) {
@@ -71,6 +72,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
   const seamCalls: LegacyCatalogMode[] = [];
   const seamExportCalls: Array<{ mode: LegacyCatalogMode; projectRef?: string }> = [];
   const execInheritCalls: ReadonlyArray<string>[] = [];
+  const localPostgresImageChecks: Array<true> = [];
   let ensureStartedCalls = 0;
   const seam = Layer.succeed(LegacyDeclarativeSeam, {
     exportCatalog: ({ mode, projectRef }) => {
@@ -88,6 +90,20 @@ function setup(workdir: string, opts: SetupOpts = {}) {
       Effect.sync(() => {
         ensureStartedCalls += 1;
       }),
+    ensureLocalPostgresImageCurrent: () =>
+      Effect.sync(() => {
+        localPostgresImageChecks.push(true);
+      }).pipe(
+        Effect.flatMap(() =>
+          opts.staleLocalImage === true
+            ? Effect.fail(
+                new LegacyDeclarativeShadowDbError({
+                  message: "local Postgres container image is stale",
+                }),
+              )
+            : Effect.void,
+        ),
+      ),
     provisionShadow: () => Effect.die("provisionShadow not used in declarative tests"),
     removeShadowContainer: () => Effect.void,
   });
@@ -148,6 +164,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     edgeCalls,
     resolverCalls,
     proxyCalls,
+    localPostgresImageChecks,
     get ensureStartedCalls() {
       return ensureStartedCalls;
     },
@@ -228,6 +245,23 @@ describe("legacy db schema declarative generate integration", () => {
     }).pipe(Effect.provide(s.layer));
   });
 
+  it.effect("explicit --local checks the local Postgres image before generating", () => {
+    const s = setup(tmp.current, { experimental: true, staleLocalImage: true });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyDbSchemaDeclarativeGenerate(flags({ local: Option.some(true) })),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(failError(exit)).toMatchObject({
+        _tag: "LegacyDeclarativeShadowDbError",
+        message: "local Postgres container image is stale",
+      });
+      expect(s.localPostgresImageChecks).toHaveLength(1);
+      expect(s.ensureStartedCalls).toBe(0);
+      expect(s.edgeCalls).toEqual([]);
+    }).pipe(Effect.provide(s.layer));
+  });
+
   it.effect("honors --yes to overwrite existing declarative files without prompting", () => {
     // Pre-seed the declarative dir so the overwrite branch is reached. With --yes,
     // Go's confirmOverwrite returns true immediately (Console.PromptYesNo); the
@@ -416,6 +450,7 @@ describe("legacy db schema declarative generate integration", () => {
       expect(s.seamCalls).toContain("baseline");
       // ... but did NOT auto-start (value is false).
       expect(s.ensureStartedCalls).toBe(0);
+      expect(s.localPostgresImageChecks).toHaveLength(1);
     }).pipe(Effect.provide(s.layer));
   });
 
@@ -561,6 +596,27 @@ describe("legacy db schema declarative generate integration", () => {
     }).pipe(Effect.provide(s.layer));
   });
 
+  it.effect("smart mode: local target checks the local Postgres image before generating", () => {
+    mkdirSync(join(tmp.current, "supabase", "migrations"), { recursive: true });
+    writeFileSync(join(tmp.current, "supabase", "migrations", "0001_init.sql"), "select 1;");
+    const s = setup(tmp.current, {
+      experimental: true,
+      stdinIsTty: true,
+      staleLocalImage: true,
+      promptSelectResponses: ["local"],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyDbSchemaDeclarativeGenerate(flags()));
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(failError(exit)).toMatchObject({
+        _tag: "LegacyDeclarativeShadowDbError",
+        message: "local Postgres container image is stale",
+      });
+      expect(s.localPostgresImageChecks).toHaveLength(1);
+      expect(s.edgeCalls).toEqual([]);
+    }).pipe(Effect.provide(s.layer));
+  });
+
   it.effect(
     "smart mode: caches the linked project even when the user picks local (Go PostRun)",
     () => {
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.handler.ts b/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.handler.ts
index 8213bd9df9..d70db8625c 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.handler.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.handler.ts
@@ -109,7 +109,6 @@ export const legacyDbSchemaDeclarativeSync = Effect.fn("legacy.db.schema.declara
         pgDeltaEnabled: toml.pgDelta.enabled,
         configPath: path.join("supabase", "config.toml"),
       });
-
       // `path.resolve` (not `path.join`) so an absolute `declarative_schema_path` is
       // used as-is, matching Go's `config.resolve` (which only prefixes the workdir onto
       // a relative path). `path.join(workdir, abs)` would mangle the absolute path.
@@ -131,6 +130,8 @@ export const legacyDbSchemaDeclarativeSync = Effect.fn("legacy.db.schema.declara
         schema: flags.schema,
         noCache: flags.noCache,
       };
+      const ensureLocalPostgresImageCurrent = seam.ensureLocalPostgresImageCurrent();
+      const declarativeFilesExist = yield* declarativeDirHasFiles(fs, declarativeDir);
 
       // Go's `saveApplyDebugBundle`: warn (rather than masking the apply error) and
       // treat the bundle path as empty when the debug directory cannot be created, so
@@ -148,7 +149,7 @@ export const legacyDbSchemaDeclarativeSync = Effect.fn("legacy.db.schema.declara
         );
 
       // Step 1: declarative files must exist; in a TTY, offer to generate them.
-      if (!(yield* declarativeDirHasFiles(fs, declarativeDir))) {
+      if (!declarativeFilesExist) {
         const noFiles = new LegacyDeclarativeNonInteractiveError({
           message: "no declarative schema found. Run supabase db schema declarative generate first",
         });
@@ -207,6 +208,7 @@ export const legacyDbSchemaDeclarativeSync = Effect.fn("legacy.db.schema.declara
           path,
           cliConfig.workdir,
           linkedRef,
+          ensureLocalPostgresImageCurrent,
         );
         const generated = yield* legacyGenerateDeclarativeOutput(run, targetUrl);
         yield* legacyWriteDeclarativeSchemas(fs, path, declarativeDir, generated);
@@ -307,6 +309,7 @@ export const legacyDbSchemaDeclarativeSync = Effect.fn("legacy.db.schema.declara
       if (!shouldApply) return;
 
       // Step 8: apply the migration to the local database (native).
+      yield* ensureLocalPostgresImageCurrent;
       const applyExit = yield* applyMigrationToLocal(
         { port: toml.port, password: toml.password, dnsResolver },
         migrationPath,
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.integration.test.ts b/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.integration.test.ts
index 0420d274f0..aa2718ac62 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.integration.test.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.integration.test.ts
@@ -24,10 +24,24 @@ import {
   LegacyEdgeRuntimeScript,
 } from "../../../../../shared/legacy-edge-runtime-script.service.ts";
 import { LegacyPgDeltaSslProbe } from "../../../../../shared/legacy-pgdelta-ssl-probe.service.ts";
+import { LegacyDeclarativeShadowDbError } from "../../../shared/legacy-pgdelta.errors.ts";
 import { LegacyDeclarativeSeam } from "../../../shared/legacy-pgdelta.seam.service.ts";
 import type { LegacyDbSchemaDeclarativeSyncFlags } from "./sync.command.ts";
 import { legacyDbSchemaDeclarativeSync } from "./sync.handler.ts";
 
+const EXPORT_JSON = JSON.stringify({
+  version: 1,
+  mode: "declarative",
+  files: [
+    {
+      path: "schemas/public/tables/players.sql",
+      order: 0,
+      statements: 1,
+      sql: "create table players ();",
+    },
+  ],
+});
+
 interface SetupOpts {
   experimental?: boolean;
   yes?: boolean;
@@ -40,6 +54,8 @@ interface SetupOpts {
   promptTextResponses?: ReadonlyArray<string>;
   networkId?: string;
   projectId?: Option.Option<string>;
+  staleLocalImage?: boolean;
+  exportJson?: string;
 }
 
 function setup(workdir: string, opts: SetupOpts = {}) {
@@ -51,6 +67,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
   const telemetry = mockLegacyTelemetryStateTracked();
   const cache = mockLegacyLinkedProjectCacheTracked();
   const execInheritCalls: ReadonlyArray<string>[] = [];
+  const localPostgresImageChecks: Array<true> = [];
   const seam = Layer.succeed(LegacyDeclarativeSeam, {
     exportCatalog: ({ mode }) => Effect.succeed(`supabase/.temp/pgdelta/${mode}.json`),
     execInherit: (args) =>
@@ -59,12 +76,33 @@ function setup(workdir: string, opts: SetupOpts = {}) {
         return opts.resetExitCode ?? 0;
       }),
     ensureLocalDatabaseStarted: () => Effect.void,
+    ensureLocalPostgresImageCurrent: () =>
+      Effect.sync(() => {
+        localPostgresImageChecks.push(true);
+      }).pipe(
+        Effect.flatMap(() =>
+          opts.staleLocalImage === true
+            ? Effect.fail(
+                new LegacyDeclarativeShadowDbError({
+                  message: "local Postgres container image is stale",
+                }),
+              )
+            : Effect.void,
+        ),
+      ),
     provisionShadow: () => Effect.die("provisionShadow not used in declarative tests"),
     removeShadowContainer: () => Effect.void,
   });
   const edge = Layer.succeed(LegacyEdgeRuntimeScript, {
-    run: (_opts: LegacyEdgeRuntimeRunOpts) =>
-      Effect.succeed({ stdout: opts.diffSql ?? "", stderr: "" }),
+    run: (runOpts: LegacyEdgeRuntimeRunOpts) =>
+      Effect.succeed({
+        stdout:
+          opts.exportJson !== undefined &&
+          runOpts.errPrefix === "error exporting declarative schema"
+            ? opts.exportJson
+            : (opts.diffSql ?? ""),
+        stderr: "",
+      }),
   });
   const dbExec: string[] = [];
   const dbConn = Layer.succeed(LegacyDbConnection, {
@@ -123,7 +161,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     Layer.succeed(LegacyPgDeltaSslProbe, { requireSsl: () => Effect.succeed(false) }),
     BunServices.layer,
   );
-  return { layer, out, execInheritCalls, dbExec, cache };
+  return { layer, out, execInheritCalls, dbExec, cache, localPostgresImageChecks };
 }
 
 const flags = (
@@ -205,6 +243,59 @@ describe("legacy db schema declarative sync integration", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.effect("non-interactive default dry-run does not check the local Postgres image", () => {
+    seedDeclarative(tmp.current);
+    const s = setup(tmp.current, {
+      experimental: true,
+      staleLocalImage: true,
+      diffSql: "ALTER TABLE a ADD COLUMN b int;\n",
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbSchemaDeclarativeSync(flags());
+      const migrations = readdirSync(join(tmp.current, "supabase", "migrations"));
+      expect(migrations).toHaveLength(1);
+      expect(s.localPostgresImageChecks).toEqual([]);
+      expect(s.dbExec).toEqual([]);
+    }).pipe(Effect.provide(s.layer));
+  });
+
+  it.effect("--apply checks the local Postgres image before applying", () => {
+    seedDeclarative(tmp.current);
+    const s = setup(tmp.current, {
+      experimental: true,
+      staleLocalImage: true,
+      diffSql: "ALTER TABLE a ADD COLUMN b int;\n",
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyDbSchemaDeclarativeSync(flags({ apply: Option.some(true) })),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(failError(exit)).toMatchObject({
+        _tag: "LegacyDeclarativeShadowDbError",
+        message: "local Postgres container image is stale",
+      });
+      expect(s.localPostgresImageChecks).toHaveLength(1);
+      expect(s.dbExec).toEqual([]);
+    }).pipe(Effect.provide(s.layer));
+  });
+
+  it.effect("--no-apply skips the local Postgres image check", () => {
+    seedDeclarative(tmp.current);
+    const s = setup(tmp.current, {
+      experimental: true,
+      staleLocalImage: true,
+      diffSql: "ALTER TABLE a ADD COLUMN b int;\n",
+    });
+    return Effect.gen(function* () {
+      yield* legacyDbSchemaDeclarativeSync(flags({ noApply: Option.some(true) }));
+      const migrations = readdirSync(join(tmp.current, "supabase", "migrations"));
+      expect(migrations).toHaveLength(1);
+      expect(s.localPostgresImageChecks).toEqual([]);
+      expect(s.dbExec).toEqual([]);
+    }).pipe(Effect.provide(s.layer));
+  });
+
   it.effect("--yes bypasses the bootstrap prompt when no declarative files exist", () => {
     // Without --yes + non-TTY this fails at the "no declarative schema found" gate
     // (prior test). With --yes, Go's PromptYesNo auto-confirms, so the bootstrap is
@@ -239,6 +330,90 @@ describe("legacy db schema declarative sync integration", () => {
     }).pipe(Effect.provide(s.layer));
   });
 
+  it.effect("bootstrap linked target does not run the local Postgres image check", () => {
+    // The stale-image guard only matters once bootstrap chooses a local source. A
+    // linked/custom bootstrap can build fresh catalogs and skip local apply, so it
+    // must reach the target prompt before any local-container inspection.
+    mkdirSync(join(tmp.current, "supabase", "migrations"), { recursive: true });
+    writeFileSync(join(tmp.current, "supabase", "migrations", "0001_init.sql"), "select 1;");
+    const s = setup(tmp.current, {
+      experimental: true,
+      stdinIsTty: true,
+      staleLocalImage: true,
+      projectId: Option.some("abcdefghijklmnopqrst"),
+      promptConfirmResponses: [true], // generate a new one? yes
+      promptSelectResponses: ["linked"],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyDbSchemaDeclarativeSync(flags({ noCache: true, noApply: Option.some(true) })),
+      );
+      expect(s.localPostgresImageChecks).toEqual([]);
+      expect(JSON.stringify(exit)).not.toContain("local Postgres container image is stale");
+      expect((s.out.promptSelectCalls[0]?.options ?? []).map((o) => o.value)).toEqual([
+        "local",
+        "linked",
+        "custom",
+      ]);
+    }).pipe(Effect.provide(s.layer));
+  });
+
+  it.effect("bootstrap linked target checks the local Postgres image before apply", () => {
+    mkdirSync(join(tmp.current, "supabase", "migrations"), { recursive: true });
+    writeFileSync(join(tmp.current, "supabase", "migrations", "0001_init.sql"), "select 1;");
+    const s = setup(tmp.current, {
+      experimental: true,
+      stdinIsTty: true,
+      staleLocalImage: true,
+      projectId: Option.some("abcdefghijklmnopqrst"),
+      diffSql: "ALTER TABLE a ADD COLUMN b int;\n",
+      exportJson: EXPORT_JSON,
+      promptConfirmResponses: [true], // generate a new one? yes
+      promptSelectResponses: ["linked"],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyDbSchemaDeclarativeSync(
+          flags({
+            noCache: true,
+            apply: Option.some(true),
+            name: Option.some("bootstrap_apply"),
+          }),
+        ),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(failError(exit)).toMatchObject({
+        _tag: "LegacyDeclarativeShadowDbError",
+        message: "local Postgres container image is stale",
+      });
+      expect(s.localPostgresImageChecks).toHaveLength(1);
+      expect(s.dbExec).toEqual([]);
+    }).pipe(Effect.provide(s.layer));
+  });
+
+  it.effect("bootstrap local target checks the local Postgres image", () => {
+    mkdirSync(join(tmp.current, "supabase", "migrations"), { recursive: true });
+    writeFileSync(join(tmp.current, "supabase", "migrations", "0001_init.sql"), "select 1;");
+    const s = setup(tmp.current, {
+      experimental: true,
+      stdinIsTty: true,
+      staleLocalImage: true,
+      promptConfirmResponses: [true], // generate a new one? yes
+      promptSelectResponses: ["local"],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        legacyDbSchemaDeclarativeSync(flags({ noCache: true, noApply: Option.some(true) })),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(failError(exit)).toMatchObject({
+        _tag: "LegacyDeclarativeShadowDbError",
+        message: "local Postgres container image is stale",
+      });
+      expect(s.localPostgresImageChecks).toHaveLength(1);
+    }).pipe(Effect.provide(s.layer));
+  });
+
   it.effect("bootstrap: an unreadable migrations path is treated as no migrations", () => {
     // Go's delegated hasMigrationFiles returns false on ANY ListLocalMigrations error
     // (db_schema_declarative.go:164-169), flowing into the no-migrations local generate.
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.layer.ts b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.layer.ts
index 30c03b827f..634c4c7b56 100644
--- a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.layer.ts
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.layer.ts
@@ -6,7 +6,9 @@ import { LegacyNetworkIdFlag, LegacyProfileFlag } from "../../../../shared/legac
 import { resolveBinary } from "../../../../shared/legacy/go-proxy.layer.ts";
 import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
 import { containerCliExitCode, spawnContainerCli } from "../../../shared/legacy-container-cli.ts";
+import { legacyResolveDbImage } from "../../../shared/legacy-db-image.ts";
 import { legacyReadDbToml } from "../../../shared/legacy-db-config.toml-read.ts";
+import { legacyGetRegistryImageUrl } from "../../../shared/legacy-docker-registry.ts";
 import {
   legacyResolveLocalProjectId,
   localDbContainerId,
@@ -265,6 +267,116 @@ export const legacyDeclarativeSeamLayer = Layer.effect(
             }
           }),
         ),
+      ensureLocalPostgresImageCurrent: () =>
+        Effect.scoped(
+          Effect.gen(function* () {
+            const toml = yield* legacyReadDbToml(fs, path, cliConfig.workdir).pipe(
+              Effect.mapError(
+                (error) =>
+                  new LegacyDeclarativeShadowDbError({
+                    message: `failed to read config for local Postgres image check: ${error.message}`,
+                  }),
+              ),
+            );
+            const image = yield* legacyResolveDbImage(
+              fs,
+              path,
+              cliConfig.workdir,
+              toml.majorVersion,
+              Option.getOrUndefined(toml.orioledbVersion),
+            );
+            const tomlProjectId = toml.projectId;
+            const projectId = legacyResolveLocalProjectId(
+              Option.getOrUndefined(cliConfig.projectId),
+              Option.getOrUndefined(tomlProjectId),
+              cliConfig.workdir,
+            );
+            const containerId = localDbContainerId(projectId);
+            const child = yield* spawnContainerCli(spawner, ["container", "inspect", containerId], {
+              stdin: "ignore",
+              stdout: "pipe",
+              stderr: "pipe",
+              extendEnv: true,
+            }).pipe(
+              Effect.mapError(
+                () =>
+                  new LegacyDeclarativeShadowDbError({
+                    message: "failed to inspect local Postgres container.",
+                  }),
+              ),
+            );
+            const stdoutChunks: Array<Uint8Array> = [];
+            const stderrChunks: Array<Uint8Array> = [];
+            yield* Stream.runForEach(child.stdout, (chunk) =>
+              Effect.sync(() => {
+                stdoutChunks.push(chunk);
+              }),
+            ).pipe(
+              Effect.mapError(
+                () =>
+                  new LegacyDeclarativeShadowDbError({
+                    message: "failed to inspect local Postgres container.",
+                  }),
+              ),
+            );
+            yield* Stream.runForEach(child.stderr, (chunk) =>
+              Effect.sync(() => {
+                stderrChunks.push(chunk);
+              }),
+            ).pipe(
+              Effect.mapError(
+                () =>
+                  new LegacyDeclarativeShadowDbError({
+                    message: "failed to inspect local Postgres container.",
+                  }),
+              ),
+            );
+            const inspectExit = yield* child.exitCode.pipe(
+              Effect.map(Number),
+              Effect.mapError(
+                () =>
+                  new LegacyDeclarativeShadowDbError({
+                    message: "failed to inspect local Postgres container.",
+                  }),
+              ),
+            );
+            const decodeChunks = (chunks: ReadonlyArray<Uint8Array>): string => {
+              const total = chunks.reduce((size, chunk) => size + chunk.length, 0);
+              const bytes = new Uint8Array(total);
+              let offset = 0;
+              for (const chunk of chunks) {
+                bytes.set(chunk, offset);
+                offset += chunk.length;
+              }
+              return new TextDecoder().decode(bytes).trim();
+            };
+            const stderr = decodeChunks(stderrChunks);
+            const stdout = decodeChunks(stdoutChunks);
+            if (inspectExit !== 0) {
+              if (legacyIsMissingContainerInspectError(stderr)) return;
+              return yield* Effect.fail(
+                new LegacyDeclarativeShadowDbError({
+                  message:
+                    stderr.length > 0
+                      ? `failed to inspect local Postgres container: ${stderr}`
+                      : "failed to inspect local Postgres container.",
+                }),
+              );
+            }
+            const actual = legacyResolveContainerInspectImageName(stdout);
+            const expected = legacyGetRegistryImageUrl(image).trim();
+            const actualTag = dockerImageTag(actual);
+            const expectedTag = dockerImageTag(expected);
+            if (actualTag.length === 0 || expectedTag.length === 0 || actualTag === expectedTag) {
+              return;
+            }
+            return yield* Effect.fail(
+              new LegacyDeclarativeShadowDbError({
+                message: `local Postgres container image is stale: running ${actual} but expected ${expected}. Run supabase stop --all --no-backup, then supabase start before syncing declarative schemas.`,
+              }),
+            );
+          }),
+        ),
       provisionShadow: ({ mode, targetLocal, usePgDelta, schema, projectRef }) =>
         Effect.scoped(
           Effect.gen(function* () {
@@ -398,3 +510,39 @@ const failure = (exitCode?: number) =>
         ? "failed to provision the shadow database."
         : `failed to provision the shadow database: exit ${exitCode}`,
   });
+
+function dockerImageTag(image: string): string {
+  const trimmed = image.trim();
+  const index = trimmed.lastIndexOf(":");
+  if (index < 0 || index === trimmed.length - 1) return "";
+  return trimmed.slice(index + 1);
+}
+
+export function legacyIsMissingContainerInspectError(stderr: string): boolean {
+  return stderr.toLowerCase().includes("no such container");
+}
+
+export function legacyResolveContainerInspectImageName(stdout: string): string {
+  const trimmed = stdout.trim();
+  if (trimmed.length === 0) return "";
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return trimmed;
+  }
+  const inspect = Array.isArray(parsed) ? parsed[0] : parsed;
+  if (!isJsonRecord(inspect)) return "";
+  const imageName = inspect["ImageName"];
+  if (typeof imageName === "string" && imageName.trim().length > 0) {
+    return imageName.trim();
+  }
+  const config = inspect["Config"];
+  if (!isJsonRecord(config)) return "";
+  const configImage = config["Image"];
+  return typeof configImage === "string" && configImage.trim().length > 0 ? configImage.trim() : "";
+}
+
+function isJsonRecord(value: unknown): value is { readonly [key: string]: unknown } {
+  return typeof value === "object" && value !== null;
+}
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.layer.unit.test.ts b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.layer.unit.test.ts
new file mode 100644
index 0000000000..b6b0251a10
--- /dev/null
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.layer.unit.test.ts
@@ -0,0 +1,56 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  legacyIsMissingContainerInspectError,
+  legacyResolveContainerInspectImageName,
+} from "./legacy-pgdelta.seam.layer.ts";
+
+describe("legacyIsMissingContainerInspectError", () => {
+  it("matches Docker and Podman missing-container stderr", () => {
+    expect(legacyIsMissingContainerInspectError("Error: No such container: supabase_db_test")).toBe(
+      true,
+    );
+    expect(legacyIsMissingContainerInspectError("Error: no such container: supabase_db_test")).toBe(
+      true,
+    );
+  });
+
+  it("does not match unrelated inspect failures", () => {
+    expect(legacyIsMissingContainerInspectError("Cannot connect to the Docker daemon")).toBe(false);
+  });
+});
+
+describe("legacyResolveContainerInspectImageName", () => {
+  it("reads Docker's config image from inspect JSON", () => {
+    expect(
+      legacyResolveContainerInspectImageName(
+        JSON.stringify([{ Config: { Image: "public.ecr.aws/supabase/postgres:17.4.1.056" } }]),
+      ),
+    ).toBe("public.ecr.aws/supabase/postgres:17.4.1.056");
+  });
+
+  it("prefers Podman's image name from inspect JSON", () => {
+    expect(
+      legacyResolveContainerInspectImageName(
+        JSON.stringify([
+          {
+            Image: "sha256:0123456789",
+            ImageName: "public.ecr.aws/supabase/postgres:17.4.1.056",
+          },
+        ]),
+      ),
+    ).toBe("public.ecr.aws/supabase/postgres:17.4.1.056");
+  });
+
+  it("keeps raw formatter output as a compatibility fallback", () => {
+    expect(legacyResolveContainerInspectImageName("supabase/postgres:15.1.0")).toBe(
+      "supabase/postgres:15.1.0",
+    );
+  });
+
+  it("returns empty when JSON inspect output has no image-name field", () => {
+    expect(legacyResolveContainerInspectImageName(JSON.stringify([{ Image: "sha256:0123" }]))).toBe(
+      "",
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.service.ts b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.service.ts
index de657d0af7..16593f5f75 100644
--- a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.service.ts
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.seam.service.ts
@@ -73,6 +73,15 @@ interface LegacyDeclarativeSeamShape {
    * of failing to connect, matching Go.
    */
   readonly ensureLocalDatabaseStarted: () => Effect.Effect<void, LegacyDeclarativeShadowDbError>;
+  /**
+   * Checks the running local Postgres container image tag against the currently
+   * resolved Postgres image. A missing container is accepted: catalog cache keys
+   * self-invalidate on setup inputs, and local-apply paths will start/connect later.
+   */
+  readonly ensureLocalPostgresImageCurrent: () => Effect.Effect<
+    void,
+    LegacyDeclarativeShadowDbError
+  >;
   /**
    * Provisions a live shadow database via the bundled Go binary's hidden
    * `db __shadow` command and returns it running (the container is NOT removed —

From 9332ce07e08a024c1fdb7e5b5a49790f872f59c4 Mon Sep 17 00:00:00 2001
From: Julien Goux <hi@jgoux.dev>
Date: Thu, 25 Jun 2026 17:13:01 +0200
Subject: [PATCH 03/29] chore(ci): allow API sync automerge (#5698)

Generated API sync PRs only touch generated output, but the Go API files
still inherited the catch-all CODEOWNERS rule and requested CLI team
review.

This adds an ownerless CODEOWNERS override for
`apps/cli-go/pkg/api/*.gen.go` so green Go API sync PRs can be
auto-merged by the existing app bypass.

It also removes the ignored self-approval steps from both API sync
workflows. GitHub rejects those approvals for PRs created by the same
app, and the workflows already enable auto-merge with the app token
after opening or updating the PR.
---
 .github/CODEOWNERS                     | 1 +
 .github/workflows/api-package-sync.yml | 8 --------
 .github/workflows/cli-go-api-sync.yml  | 8 --------
 3 files changed, 1 insertion(+), 16 deletions(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 8cfe4c1b59..c39f909e34 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -13,4 +13,5 @@
 
 # Generated code. These ownerless rules override the catch-all above so
 # CI-green sync PRs (e.g. Management API OpenAPI spec) can be auto-merged.
+/apps/cli-go/pkg/api/*.gen.go
 /packages/api/src/generated/
diff --git a/.github/workflows/api-package-sync.yml b/.github/workflows/api-package-sync.yml
index 20a2f31178..bb1117b38a 100644
--- a/.github/workflows/api-package-sync.yml
+++ b/.github/workflows/api-package-sync.yml
@@ -65,14 +65,6 @@ jobs:
           branch: sync/api-package
           base: develop
 
-      - name: Approve a PR
-        if: steps.check.outputs.has_changes == 'true' && steps.cpr.outputs.pull-request-operation == 'created'
-        continue-on-error: true
-        run: gh pr review --approve --repo "${{ github.repository }}" "${STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER}"
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
-
       - name: Enable Pull Request Automerge
         if: steps.check.outputs.has_changes == 'true'
         run: gh pr merge --auto --squash --repo "${{ github.repository }}" "${STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER}"
diff --git a/.github/workflows/cli-go-api-sync.yml b/.github/workflows/cli-go-api-sync.yml
index f4656d09a4..2ae59ca5a0 100644
--- a/.github/workflows/cli-go-api-sync.yml
+++ b/.github/workflows/cli-go-api-sync.yml
@@ -61,14 +61,6 @@ jobs:
           branch: sync/api-types
           base: develop
 
-      - name: Approve a PR
-        if: steps.check.outputs.has_changes == 'true' && steps.cpr.outputs.pull-request-operation == 'created'
-        continue-on-error: true
-        run: gh pr review --approve --repo "${{ github.repository }}" "${STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER}"
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
-
       - name: Enable Pull Request Automerge
         if: steps.check.outputs.has_changes == 'true'
         run: gh pr merge --auto --squash --repo "${{ github.repository }}" "${STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER}"

From 7eb5d161ed27f88f3b11cb74de2093319b912396 Mon Sep 17 00:00:00 2001
From: "supabase-cli-releaser[bot]"
 <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>
Date: Thu, 25 Jun 2026 17:19:41 +0200
Subject: [PATCH 04/29] chore: sync API types from infrastructure (#5697)

This PR was automatically created to sync API types from the
infrastructure repository.

Changes were detected in the generated API code after syncing with the
latest spec from infrastructure.

Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>
---
 apps/cli-go/pkg/api/client.gen.go | 163 ++++++++++++++++++++++++++++++
 apps/cli-go/pkg/api/types.gen.go  |   8 ++
 2 files changed, 171 insertions(+)

diff --git a/apps/cli-go/pkg/api/client.gen.go b/apps/cli-go/pkg/api/client.gen.go
index 528ea9d8bd..7ff5b0a26c 100644
--- a/apps/cli-go/pkg/api/client.gen.go
+++ b/apps/cli-go/pkg/api/client.gen.go
@@ -218,6 +218,9 @@ type ClientInterface interface {
 	// V1GetProjectLogs request
 	V1GetProjectLogs(ctx context.Context, ref string, params *V1GetProjectLogsParams, reqEditors ...RequestEditorFn) (*http.Response, error)
 
+	// V1GetProjectLogsAll request
+	V1GetProjectLogsAll(ctx context.Context, ref string, params *V1GetProjectLogsAllParams, reqEditors ...RequestEditorFn) (*http.Response, error)
+
 	// V1GetProjectUsageApiCount request
 	V1GetProjectUsageApiCount(ctx context.Context, ref string, params *V1GetProjectUsageApiCountParams, reqEditors ...RequestEditorFn) (*http.Response, error)
 
@@ -1267,6 +1270,18 @@ func (c *Client) V1GetProjectLogs(ctx context.Context, ref string, params *V1Get
 	return c.Client.Do(req)
 }
 
+func (c *Client) V1GetProjectLogsAll(ctx context.Context, ref string, params *V1GetProjectLogsAllParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewV1GetProjectLogsAllRequest(c.Server, ref, params)
+	if err != nil {
+		return nil, err
+	}
+	req = req.WithContext(ctx)
+	if err := c.applyEditors(ctx, req, reqEditors); err != nil {
+		return nil, err
+	}
+	return c.Client.Do(req)
+}
+
 func (c *Client) V1GetProjectUsageApiCount(ctx context.Context, ref string, params *V1GetProjectUsageApiCountParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
 	req, err := NewV1GetProjectUsageApiCountRequest(c.Server, ref, params)
 	if err != nil {
@@ -5316,6 +5331,94 @@ func NewV1GetProjectLogsRequest(server string, ref string, params *V1GetProjectL
 		return nil, err
 	}
 
+	operationPath := fmt.Sprintf("/v1/projects/%s/analytics/endpoints/logs", pathParam0)
+	if operationPath[0] == '/' {
+		operationPath = "." + operationPath
+	}
+
+	queryURL, err := serverURL.Parse(operationPath)
+	if err != nil {
+		return nil, err
+	}
+
+	if params != nil {
+		queryValues := queryURL.Query()
+
+		if params.Sql != nil {
+
+			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "sql", runtime.ParamLocationQuery, *params.Sql); err != nil {
+				return nil, err
+			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+				return nil, err
+			} else {
+				for k, v := range parsed {
+					for _, v2 := range v {
+						queryValues.Add(k, v2)
+					}
+				}
+			}
+
+		}
+
+		if params.IsoTimestampStart != nil {
+
+			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "iso_timestamp_start", runtime.ParamLocationQuery, *params.IsoTimestampStart); err != nil {
+				return nil, err
+			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+				return nil, err
+			} else {
+				for k, v := range parsed {
+					for _, v2 := range v {
+						queryValues.Add(k, v2)
+					}
+				}
+			}
+
+		}
+
+		if params.IsoTimestampEnd != nil {
+
+			if queryFrag, err := runtime.StyleParamWithLocation("form", true, "iso_timestamp_end", runtime.ParamLocationQuery, *params.IsoTimestampEnd); err != nil {
+				return nil, err
+			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+				return nil, err
+			} else {
+				for k, v := range parsed {
+					for _, v2 := range v {
+						queryValues.Add(k, v2)
+					}
+				}
+			}
+
+		}
+
+		queryURL.RawQuery = queryValues.Encode()
+	}
+
+	req, err := http.NewRequest("GET", queryURL.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, nil
+}
+
+// NewV1GetProjectLogsAllRequest generates requests for V1GetProjectLogsAll
+func NewV1GetProjectLogsAllRequest(server string, ref string, params *V1GetProjectLogsAllParams) (*http.Request, error) {
+	var err error
+
+	var pathParam0 string
+
+	pathParam0, err = runtime.StyleParamWithLocation("simple", false, "ref", runtime.ParamLocationPath, ref)
+	if err != nil {
+		return nil, err
+	}
+
+	serverURL, err := url.Parse(server)
+	if err != nil {
+		return nil, err
+	}
+
 	operationPath := fmt.Sprintf("/v1/projects/%s/analytics/endpoints/logs.all", pathParam0)
 	if operationPath[0] == '/' {
 		operationPath = "." + operationPath
@@ -11562,6 +11665,9 @@ type ClientWithResponsesInterface interface {
 	// V1GetProjectLogsWithResponse request
 	V1GetProjectLogsWithResponse(ctx context.Context, ref string, params *V1GetProjectLogsParams, reqEditors ...RequestEditorFn) (*V1GetProjectLogsResponse, error)
 
+	// V1GetProjectLogsAllWithResponse request
+	V1GetProjectLogsAllWithResponse(ctx context.Context, ref string, params *V1GetProjectLogsAllParams, reqEditors ...RequestEditorFn) (*V1GetProjectLogsAllResponse, error)
+
 	// V1GetProjectUsageApiCountWithResponse request
 	V1GetProjectUsageApiCountWithResponse(ctx context.Context, ref string, params *V1GetProjectUsageApiCountParams, reqEditors ...RequestEditorFn) (*V1GetProjectUsageApiCountResponse, error)
 
@@ -12844,6 +12950,28 @@ func (r V1GetProjectLogsResponse) StatusCode() int {
 	return 0
 }
 
+type V1GetProjectLogsAllResponse struct {
+	Body         []byte
+	HTTPResponse *http.Response
+	JSON200      *AnalyticsResponse
+}
+
+// Status returns HTTPResponse.Status
+func (r V1GetProjectLogsAllResponse) Status() string {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.Status
+	}
+	return http.StatusText(0)
+}
+
+// StatusCode returns HTTPResponse.StatusCode
+func (r V1GetProjectLogsAllResponse) StatusCode() int {
+	if r.HTTPResponse != nil {
+		return r.HTTPResponse.StatusCode
+	}
+	return 0
+}
+
 type V1GetProjectUsageApiCountResponse struct {
 	Body         []byte
 	HTTPResponse *http.Response
@@ -16119,6 +16247,15 @@ func (c *ClientWithResponses) V1GetProjectLogsWithResponse(ctx context.Context,
 	return ParseV1GetProjectLogsResponse(rsp)
 }
 
+// V1GetProjectLogsAllWithResponse request returning *V1GetProjectLogsAllResponse
+func (c *ClientWithResponses) V1GetProjectLogsAllWithResponse(ctx context.Context, ref string, params *V1GetProjectLogsAllParams, reqEditors ...RequestEditorFn) (*V1GetProjectLogsAllResponse, error) {
+	rsp, err := c.V1GetProjectLogsAll(ctx, ref, params, reqEditors...)
+	if err != nil {
+		return nil, err
+	}
+	return ParseV1GetProjectLogsAllResponse(rsp)
+}
+
 // V1GetProjectUsageApiCountWithResponse request returning *V1GetProjectUsageApiCountResponse
 func (c *ClientWithResponses) V1GetProjectUsageApiCountWithResponse(ctx context.Context, ref string, params *V1GetProjectUsageApiCountParams, reqEditors ...RequestEditorFn) (*V1GetProjectUsageApiCountResponse, error) {
 	rsp, err := c.V1GetProjectUsageApiCount(ctx, ref, params, reqEditors...)
@@ -18567,6 +18704,32 @@ func ParseV1GetProjectLogsResponse(rsp *http.Response) (*V1GetProjectLogsRespons
 	return response, nil
 }
 
+// ParseV1GetProjectLogsAllResponse parses an HTTP response from a V1GetProjectLogsAllWithResponse call
+func ParseV1GetProjectLogsAllResponse(rsp *http.Response) (*V1GetProjectLogsAllResponse, error) {
+	bodyBytes, err := io.ReadAll(rsp.Body)
+	defer func() { _ = rsp.Body.Close() }()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &V1GetProjectLogsAllResponse{
+		Body:         bodyBytes,
+		HTTPResponse: rsp,
+	}
+
+	switch {
+	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200:
+		var dest AnalyticsResponse
+		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
+			return nil, err
+		}
+		response.JSON200 = &dest
+
+	}
+
+	return response, nil
+}
+
 // ParseV1GetProjectUsageApiCountResponse parses an HTTP response from a V1GetProjectUsageApiCountWithResponse call
 func ParseV1GetProjectUsageApiCountResponse(rsp *http.Response) (*V1GetProjectUsageApiCountResponse, error) {
 	bodyBytes, err := io.ReadAll(rsp.Body)
diff --git a/apps/cli-go/pkg/api/types.gen.go b/apps/cli-go/pkg/api/types.gen.go
index 7f40e23798..16267c8dc4 100644
--- a/apps/cli-go/pkg/api/types.gen.go
+++ b/apps/cli-go/pkg/api/types.gen.go
@@ -5328,6 +5328,14 @@ type V1GetProjectLogsParams struct {
 	IsoTimestampEnd   *time.Time `form:"iso_timestamp_end,omitempty" json:"iso_timestamp_end,omitempty"`
 }
 
+// V1GetProjectLogsAllParams defines parameters for V1GetProjectLogsAll.
+type V1GetProjectLogsAllParams struct {
+	// Sql Custom SQL query to execute on the logs. See [querying logs](/docs/guides/telemetry/logs?queryGroups=product&product=postgres&queryGroups=source&source=edge_logs#querying-with-the-logs-explorer) for more details.
+	Sql               *string    `form:"sql,omitempty" json:"sql,omitempty"`
+	IsoTimestampStart *time.Time `form:"iso_timestamp_start,omitempty" json:"iso_timestamp_start,omitempty"`
+	IsoTimestampEnd   *time.Time `form:"iso_timestamp_end,omitempty" json:"iso_timestamp_end,omitempty"`
+}
+
 // V1GetProjectUsageApiCountParams defines parameters for V1GetProjectUsageApiCount.
 type V1GetProjectUsageApiCountParams struct {
 	Interval *V1GetProjectUsageApiCountParamsInterval `form:"interval,omitempty" json:"interval,omitempty"`

From 2997addba065d43cfa49e2024dbfcb653da79c41 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 00:12:05 +0000
Subject: [PATCH 05/29] fix(deps): bump github.com/posthog/posthog-go from
 1.15.0 to 1.15.1 in /apps/cli-go in the go-minor group across 1 directory
 (#5703)

Bumps the go-minor group with 1 update in the /apps/cli-go directory:
[github.com/posthog/posthog-go](https://github.com/posthog/posthog-go).

Updates `github.com/posthog/posthog-go` from 1.15.0 to 1.15.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/posthog/posthog-go/releases">github.com/posthog/posthog-go's
releases</a>.</em></p>
<blockquote>
<h2>1.15.1</h2>
<h2>Unreleased</h2>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/PostHog/posthog-go/blob/main/CHANGELOG.md">github.com/posthog/posthog-go's
changelog</a>.</em></p>
<blockquote>
<h2>1.15.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>52b7373: Stop sending ignored top-level capture fields and rely on
canonical event properties.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/PostHog/posthog-go/commit/bd516cccf9214b230b629869a2c20701952181de"><code>bd516cc</code></a>
chore: release v1.15.1 [version bump] [skip ci]</li>
<li><a
href="https://github.com/PostHog/posthog-go/commit/52b7373cdd14f01512e4cef33e0056c6da0243bd"><code>52b7373</code></a>
fix: Stop sending ignored capture fields (<a
href="https://redirect.github.com/posthog/posthog-go/issues/225">#225</a>)</li>
<li><a
href="https://github.com/PostHog/posthog-go/commit/c197513ca00b963b363dd63a3971e8b204293757"><code>c197513</code></a>
chore: add AI contribution policy (<a
href="https://redirect.github.com/posthog/posthog-go/issues/223">#223</a>)</li>
<li><a
href="https://github.com/PostHog/posthog-go/commit/b955cc8a0d8c6d1bcb2ec88af3ccd59a4806781e"><code>b955cc8</code></a>
ci: add public API snapshot check (<a
href="https://redirect.github.com/posthog/posthog-go/issues/220">#220</a>)</li>
<li><a
href="https://github.com/PostHog/posthog-go/commit/633e401857086b1394de6d0fc4eabded5b457339"><code>633e401</code></a>
docs: centralize SDK examples in official docs (<a
href="https://redirect.github.com/posthog/posthog-go/issues/219">#219</a>)</li>
<li><a
href="https://github.com/PostHog/posthog-go/commit/e910c15cb576fd76bcbd6f1f5fccc7d913785068"><code>e910c15</code></a>
chore: improve CI workflow coverage (<a
href="https://redirect.github.com/posthog/posthog-go/issues/218">#218</a>)</li>
<li><a
href="https://github.com/PostHog/posthog-go/commit/eda6f4b79a0371981dba1d2f5566de98eb08a830"><code>eda6f4b</code></a>
refactor: remove dry4go duplicate candidates (<a
href="https://redirect.github.com/posthog/posthog-go/issues/216">#216</a>)</li>
<li>See full diff in <a
href="https://github.com/posthog/posthog-go/compare/v1.15.0...v1.15.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/posthog/posthog-go&package-manager=go_modules&previous-version=1.15.0&new-version=1.15.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 apps/cli-go/go.mod | 2 +-
 apps/cli-go/go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/apps/cli-go/go.mod b/apps/cli-go/go.mod
index 7eba170c0a..3da2229523 100644
--- a/apps/cli-go/go.mod
+++ b/apps/cli-go/go.mod
@@ -42,7 +42,7 @@ require (
 	github.com/multigres/multigres v0.0.0-20260126223308-f5a52171bbc4
 	github.com/oapi-codegen/nullable v1.1.0
 	github.com/olekukonko/tablewriter v1.1.4
-	github.com/posthog/posthog-go v1.15.0
+	github.com/posthog/posthog-go v1.15.1
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
diff --git a/apps/cli-go/go.sum b/apps/cli-go/go.sum
index 15f5a0f2f2..043956a8ad 100644
--- a/apps/cli-go/go.sum
+++ b/apps/cli-go/go.sum
@@ -941,8 +941,8 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/polyfloyd/go-errorlint v1.8.0 h1:DL4RestQqRLr8U4LygLw8g2DX6RN1eBJOpa2mzsrl1Q=
 github.com/polyfloyd/go-errorlint v1.8.0/go.mod h1:G2W0Q5roxbLCt0ZQbdoxQxXktTjwNyDbEaj3n7jvl4s=
-github.com/posthog/posthog-go v1.15.0 h1:Fizkdct7zGg050hnYpxEiq/iD/OJO7tVaQE9Vyoh0q0=
-github.com/posthog/posthog-go v1.15.0/go.mod h1:xsVOW9YImilUcazwPNEq4PJDqEZf2KeCS758zXjwkPg=
+github.com/posthog/posthog-go v1.15.1 h1:9rwjaEzyp5mss/fp0vYjLOhIaXCikfgRHRSzMMHgwJ8=
+github.com/posthog/posthog-go v1.15.1/go.mod h1:xsVOW9YImilUcazwPNEq4PJDqEZf2KeCS758zXjwkPg=
 github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
 github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
 github.com/prometheus/client_golang v0.9.0-pre1.0.20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=

From bf6b315612806c86422cce225a2dfa82898f0655 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 00:12:14 +0000
Subject: [PATCH 06/29] fix(docker): bump supabase/storage-api from v1.61.3 to
 v1.61.4 in /apps/cli-go/pkg/config/templates in the docker-minor group
 (#5704)

Bumps the docker-minor group in /apps/cli-go/pkg/config/templates with 1
update: supabase/storage-api.

Updates `supabase/storage-api` from v1.61.3 to v1.61.4


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=supabase/storage-api&package-manager=docker&previous-version=v1.61.3&new-version=v1.61.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 apps/cli-go/pkg/config/templates/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/cli-go/pkg/config/templates/Dockerfile b/apps/cli-go/pkg/config/templates/Dockerfile
index ebbc983688..4bb926ee09 100644
--- a/apps/cli-go/pkg/config/templates/Dockerfile
+++ b/apps/cli-go/pkg/config/templates/Dockerfile
@@ -12,7 +12,7 @@ FROM timberio/vector:0.53.0-alpine AS vector
 FROM supabase/supavisor:2.9.7 AS supavisor
 FROM supabase/gotrue:v2.191.0 AS gotrue
 FROM supabase/realtime:v2.108.0 AS realtime
-FROM supabase/storage-api:v1.61.3 AS storage
+FROM supabase/storage-api:v1.61.4 AS storage
 FROM supabase/logflare:1.45.4 AS logflare
 # Append to JobImages when adding new dependencies below
 FROM supabase/pgadmin-schema-diff:cli-0.0.5 AS differ

From 1171646dd97a7d028d4d0a039c257d88c240e265 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 00:12:35 +0000
Subject: [PATCH 07/29] chore(ci): bump softprops/action-gh-release from 3.0.0
 to 3.0.1 in the actions-major group (#5705)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the actions-major group with 1 update:
[softprops/action-gh-release](https://github.com/softprops/action-gh-release).

Updates `softprops/action-gh-release` from 3.0.0 to 3.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/softprops/action-gh-release/releases">softprops/action-gh-release's
releases</a>.</em></p>
<blockquote>
<h2>v3.0.1</h2>
<h2>3.0.1</h2>
<ul>
<li>maintenance release with updated dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md">softprops/action-gh-release's
changelog</a>.</em></p>
<blockquote>
<h2>3.0.1</h2>
<ul>
<li>maintenance release with updated dependencies</li>
</ul>
<h2>3.0.0</h2>
<p><code>3.0.0</code> is a major release that moves the action runtime
from Node 20 to Node 24.
Use <code>v3</code> on GitHub-hosted runners and self-hosted fleets that
already support the
Node 24 Actions runtime. If you still need the last Node 20-compatible
line, stay on
<code>v2.6.2</code>.</p>
<h2>What's Changed</h2>
<h3>Other Changes 🔄</h3>
<ul>
<li>Move the action runtime and bundle target to Node 24</li>
<li>Update <code>@types/node</code> to the Node 24 line and allow future
Dependabot updates</li>
<li>Keep the floating major tag on <code>v3</code>; <code>v2</code>
remains pinned to the latest <code>2.x</code> release</li>
</ul>
<h2>2.6.2</h2>
<h2>What's Changed</h2>
<h3>Other Changes 🔄</h3>
<ul>
<li>chore(deps): bump picomatch from 4.0.3 to 4.0.4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/softprops/action-gh-release/pull/775">softprops/action-gh-release#775</a></li>
<li>chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/softprops/action-gh-release/pull/777">softprops/action-gh-release#777</a></li>
<li>chore(deps): bump vite from 8.0.0 to 8.0.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/softprops/action-gh-release/pull/781">softprops/action-gh-release#781</a></li>
</ul>
<h2>2.6.1</h2>
<p><code>2.6.1</code> is a patch release focused on restoring linked
discussion thread creation when
<code>discussion_category_name</code> is set. It fixes
<code>[#764](https://github.com/softprops/action-gh-release/issues/764)</code>,
where the draft-first publish flow
stopped carrying the discussion category through the final publish
step.</p>
<p>If you still hit an issue after upgrading, please open a report with
the bug template and include a minimal repro or sanitized workflow
snippet where possible.</p>
<h2>What's Changed</h2>
<h3>Bug fixes 🐛</h3>
<ul>
<li>fix: preserve discussion category on publish by <a
href="https://github.com/chenrui333"><code>@​chenrui333</code></a> in <a
href="https://redirect.github.com/softprops/action-gh-release/pull/765">softprops/action-gh-release#765</a></li>
</ul>
<h2>2.6.0</h2>
<p><code>2.6.0</code> is a minor release centered on
<code>previous_tag</code> support for
<code>generate_release_notes</code>,
which lets workflows pin GitHub's comparison base explicitly instead of
relying on the default range.
It also includes the recent concurrent asset upload recovery fix, a
<code>working_directory</code> docs sync,
a checked-bundle freshness guard for maintainers, and clearer
immutable-prerelease guidance where
GitHub platform behavior imposes constraints on how prerelease asset
uploads can be published.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/softprops/action-gh-release/commit/718ea10b132b3b2eba29c1007bb80653f286566b"><code>718ea10</code></a>
release 3.0.1</li>
<li><a
href="https://github.com/softprops/action-gh-release/commit/f1a938b9d84ca9b770d0d8dfeb3e7285fe261e63"><code>f1a938b</code></a>
chore(deps): bump esbuild from 0.28.0 to 0.28.1 (<a
href="https://redirect.github.com/softprops/action-gh-release/issues/802">#802</a>)</li>
<li><a
href="https://github.com/softprops/action-gh-release/commit/0066ead0de7252b4876b36b5357fc3974619d36a"><code>0066ead</code></a>
chore(deps): bump vite from 8.0.14 to 8.0.16 (<a
href="https://redirect.github.com/softprops/action-gh-release/issues/806">#806</a>)</li>
<li><a
href="https://github.com/softprops/action-gh-release/commit/dc643cac6252aaa00c9b0b6c940d489cd7bf6b23"><code>dc643ca</code></a>
chore(deps): bump the npm group with 3 updates (<a
href="https://redirect.github.com/softprops/action-gh-release/issues/805">#805</a>)</li>
<li><a
href="https://github.com/softprops/action-gh-release/commit/85ee99b6b20742a3823a8a289ee5e6ceab44e8aa"><code>85ee99b</code></a>
chore(deps): bump actions/checkout in the github-actions group (<a
href="https://redirect.github.com/softprops/action-gh-release/issues/804">#804</a>)</li>
<li><a
href="https://github.com/softprops/action-gh-release/commit/9ed3cf9a6863b31f005d951c8d19de20628cf4eb"><code>9ed3cf9</code></a>
chore(deps): bump the npm group with 2 updates (<a
href="https://redirect.github.com/softprops/action-gh-release/issues/800">#800</a>)</li>
<li><a
href="https://github.com/softprops/action-gh-release/commit/3efcac8951299998593f871640ea8059d6818655"><code>3efcac8</code></a>
chore(deps): bump the npm group with 3 updates (<a
href="https://redirect.github.com/softprops/action-gh-release/issues/798">#798</a>)</li>
<li><a
href="https://github.com/softprops/action-gh-release/commit/05d6b9164aa74958de40b0179d6a773112fcdc7f"><code>05d6b91</code></a>
chore(deps): bump brace-expansion from 5.0.5 to 5.0.6 (<a
href="https://redirect.github.com/softprops/action-gh-release/issues/797">#797</a>)</li>
<li><a
href="https://github.com/softprops/action-gh-release/commit/403a5240f3837fa857f642062e05aad6bb3391ca"><code>403a524</code></a>
chore(deps): bump <code>@​types/node</code> from 24.12.2 to 24.12.3 in
the npm group (<a
href="https://redirect.github.com/softprops/action-gh-release/issues/796">#796</a>)</li>
<li><a
href="https://github.com/softprops/action-gh-release/commit/437e073e786973c6b6af97d9e445c41ae43b1d29"><code>437e073</code></a>
chore(deps): bump the npm group with 4 updates (<a
href="https://redirect.github.com/softprops/action-gh-release/issues/792">#792</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=softprops/action-gh-release&package-manager=github_actions&previous-version=3.0.0&new-version=3.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/release-shared.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release-shared.yml b/.github/workflows/release-shared.yml
index 5a4577a695..79d6ba7387 100644
--- a/.github/workflows/release-shared.yml
+++ b/.github/workflows/release-shared.yml
@@ -382,7 +382,7 @@ jobs:
           done
 
       - name: Create draft GitHub Release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           tag_name: v${{ inputs.version }}
           name: v${{ inputs.version }}

From 28d20853c7046dffcbdd7f2a9f7dfa12dcffc640 Mon Sep 17 00:00:00 2001
From: "supabase-cli-releaser[bot]"
 <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 11:45:16 +0200
Subject: [PATCH 08/29] chore(api): sync Management API OpenAPI spec (#5707)

This PR was automatically created to sync the generated `@supabase/api`
package with the latest Management API OpenAPI document.

Changes were detected in the upstream OpenAPI document exposed by
`https://api.supabase.com/api/v1-json`.

Co-authored-by: jgoux <1443499+jgoux@users.noreply.github.com>
---
 packages/api/src/generated/contracts.ts     |  64 +++++++++---
 packages/api/src/generated/effect-client.ts |  18 ++++
 packages/api/src/generated/openapi.json     | 107 ++++++++++++++++++--
 3 files changed, 170 insertions(+), 19 deletions(-)

diff --git a/packages/api/src/generated/contracts.ts b/packages/api/src/generated/contracts.ts
index d43bc75d55..5a71e79a54 100644
--- a/packages/api/src/generated/contracts.ts
+++ b/packages/api/src/generated/contracts.ts
@@ -2421,11 +2421,7 @@ export const V1GetJitAccessConfigOutput = Schema.Union(
     }),
     Schema.Struct({
       state: Schema.Literal("unavailable"),
-      unavailableReason: Schema.Literals([
-        "manual_migration_required",
-        "postgres_upgrade_required",
-        "temporarily_unavailable",
-      ]),
+      unavailableReason: Schema.Literals(["postgres_upgrade_required", "temporarily_unavailable"]),
     }),
   ],
   { mode: "oneOf" },
@@ -3112,6 +3108,39 @@ export const V1GetProjectLogsOutput = Schema.Struct({
     ),
   ),
 });
+export const V1GetProjectLogsAllInput = Schema.Struct({
+  ref: Schema.String.check(Schema.isMinLength(20))
+    .check(Schema.isMaxLength(20))
+    .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
+  sql: Schema.optionalKey(Schema.String),
+  iso_timestamp_start: Schema.optionalKey(Schema.String.annotate({ format: "date-time" })),
+  iso_timestamp_end: Schema.optionalKey(Schema.String.annotate({ format: "date-time" })),
+});
+export const V1GetProjectLogsAllOutput = Schema.Struct({
+  result: Schema.optionalKey(Schema.Array(Schema.Unknown)),
+  error: Schema.optionalKey(
+    Schema.Union(
+      [
+        Schema.String,
+        Schema.Struct({
+          code: Schema.Number.check(Schema.isFinite()),
+          errors: Schema.Array(
+            Schema.Struct({
+              domain: Schema.String,
+              location: Schema.String,
+              locationType: Schema.String,
+              message: Schema.String,
+              reason: Schema.String,
+            }),
+          ),
+          message: Schema.String,
+          status: Schema.String,
+        }),
+      ],
+      { mode: "oneOf" },
+    ),
+  ),
+});
 export const V1GetProjectPgbouncerConfigInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
     .check(Schema.isMaxLength(20))
@@ -5510,11 +5539,7 @@ export const V1UpdateJitAccessConfigOutput = Schema.Union(
     }),
     Schema.Struct({
       state: Schema.Literal("unavailable"),
-      unavailableReason: Schema.Literals([
-        "manual_migration_required",
-        "postgres_upgrade_required",
-        "temporarily_unavailable",
-      ]),
+      unavailableReason: Schema.Literals(["postgres_upgrade_required", "temporarily_unavailable"]),
     }),
   ],
   { mode: "oneOf" },
@@ -6151,6 +6176,7 @@ export const openApiOperationIdMap = {
   "v1-get-project-function-combined-stats": "v1GetProjectFunctionCombinedStats",
   "v1-get-project-legacy-api-keys": "v1GetProjectLegacyApiKeys",
   "v1-get-project-logs": "v1GetProjectLogs",
+  "v1-get-project-logs-all": "v1GetProjectLogsAll",
   "v1-get-project-pgbouncer-config": "v1GetProjectPgbouncerConfig",
   "v1-get-project-signing-key": "v1GetProjectSigningKey",
   "v1-get-project-signing-keys": "v1GetProjectSigningKeys",
@@ -7456,9 +7482,9 @@ export const operationDefinitions = {
   v1GetProjectLogs: {
     id: "v1GetProjectLogs",
     description:
-      "Executes a SQL query on the project's logs.\n\nEither the `iso_timestamp_start` and `iso_timestamp_end` parameters must be provided.\nIf both are not provided, only the last 1 minute of logs will be queried.\nThe timestamp range must be no more than 24 hours and is rounded to the nearest minute. If the range is more than 24 hours, a validation error will be thrown.\n\nNote: Unless the `sql` parameter is provided, only edge_logs will be queried. See the [log query docs](/docs/guides/telemetry/logs?queryGroups=product&product=postgres&queryGroups=source&source=edge_logs#querying-with-the-logs-explorer:~:text=logs%20from%20the-,Sources,-drop%2Ddown%3A) for all available sources.",
+      "Executes an SQL or LQL query on the project's unified logs stream.\n\nEither the `iso_timestamp_start` and `iso_timestamp_end` parameters must be provided.\nIf both are not provided, only the last 1 minute of logs will be queried.\nThe timestamp range must be no more than 24 hours and is rounded to the nearest minute. If the range is more than 24 hours, a validation error will be thrown.\n\nFilter by the `source` column to specify specific log sources, such as edge_logs, postgres_logs, etc.\n\nNote: SQL must be written in **ClickHouse SQL dialect**.",
     method: "GET",
-    path: "/v1/projects/{ref}/analytics/endpoints/logs.all",
+    path: "/v1/projects/{ref}/analytics/endpoints/logs",
     pathParams: ["ref"],
     queryParams: ["sql", "iso_timestamp_start", "iso_timestamp_end"],
     headerParams: [],
@@ -7467,6 +7493,20 @@ export const operationDefinitions = {
     inputSchema: V1GetProjectLogsInput,
     outputSchema: V1GetProjectLogsOutput,
   },
+  v1GetProjectLogsAll: {
+    id: "v1GetProjectLogsAll",
+    description:
+      "Executes a SQL query on the project's logs.\n\nEither the `iso_timestamp_start` and `iso_timestamp_end` parameters must be provided.\nIf both are not provided, only the last 1 minute of logs will be queried.\nThe timestamp range must be no more than 24 hours and is rounded to the nearest minute. If the range is more than 24 hours, a validation error will be thrown.\n\nNote: Unless the `sql` parameter is provided, only edge_logs will be queried. See the [log query docs](/docs/guides/telemetry/logs?queryGroups=product&product=postgres&queryGroups=source&source=edge_logs#querying-with-the-logs-explorer:~:text=logs%20from%20the-,Sources,-drop%2Ddown%3A) for all available sources.",
+    method: "GET",
+    path: "/v1/projects/{ref}/analytics/endpoints/logs.all",
+    pathParams: ["ref"],
+    queryParams: ["sql", "iso_timestamp_start", "iso_timestamp_end"],
+    headerParams: [],
+    requestBody: { kind: "none" },
+    response: { kind: "json" },
+    inputSchema: V1GetProjectLogsAllInput,
+    outputSchema: V1GetProjectLogsAllOutput,
+  },
   v1GetProjectPgbouncerConfig: {
     id: "v1GetProjectPgbouncerConfig",
     description: "Get project's pgbouncer config",
diff --git a/packages/api/src/generated/effect-client.ts b/packages/api/src/generated/effect-client.ts
index 9517c63ec8..43648171dd 100644
--- a/packages/api/src/generated/effect-client.ts
+++ b/packages/api/src/generated/effect-client.ts
@@ -1199,6 +1199,20 @@ export const versionedEffectOperations = {
           input,
         );
       }),
+    getProjectLogsAll: (
+      input: typeof operationDefinitions.v1GetProjectLogsAll.inputSchema.Type,
+    ): Effect.Effect<
+      typeof operationDefinitions.v1GetProjectLogsAll.outputSchema.Type,
+      SupabaseApiError,
+      SupabaseApiClient
+    > =>
+      Effect.gen(function* () {
+        const client = yield* SupabaseApiClient;
+        return yield* client.execute<"v1GetProjectLogsAll">(
+          operationDefinitions.v1GetProjectLogsAll,
+          input,
+        );
+      }),
     getProjectPgbouncerConfig: (
       input: typeof operationDefinitions.v1GetProjectPgbouncerConfig.inputSchema.Type,
     ): Effect.Effect<
@@ -2671,6 +2685,10 @@ export function executeApiClientOperation(
       return Schema.decodeUnknownEffect(operationDefinitions.v1GetProjectLogs.inputSchema)(
         input,
       ).pipe(Effect.flatMap((decoded) => api.v1.getProjectLogs(decoded)));
+    case "v1GetProjectLogsAll":
+      return Schema.decodeUnknownEffect(operationDefinitions.v1GetProjectLogsAll.inputSchema)(
+        input,
+      ).pipe(Effect.flatMap((decoded) => api.v1.getProjectLogsAll(decoded)));
     case "v1GetProjectPgbouncerConfig":
       return Schema.decodeUnknownEffect(
         operationDefinitions.v1GetProjectPgbouncerConfig.inputSchema,
diff --git a/packages/api/src/generated/openapi.json b/packages/api/src/generated/openapi.json
index 0be9013f5f..46a45efcd9 100644
--- a/packages/api/src/generated/openapi.json
+++ b/packages/api/src/generated/openapi.json
@@ -6671,8 +6671,9 @@
     },
     "/v1/projects/{ref}/analytics/endpoints/logs.all": {
       "get": {
-        "description": "Executes a SQL query on the project's logs.\n\nEither the `iso_timestamp_start` and `iso_timestamp_end` parameters must be provided.\nIf both are not provided, only the last 1 minute of logs will be queried.\nThe timestamp range must be no more than 24 hours and is rounded to the nearest minute. If the range is more than 24 hours, a validation error will be thrown.\n\nNote: Unless the `sql` parameter is provided, only edge_logs will be queried. See the [log query docs](/docs/guides/telemetry/logs?queryGroups=product&product=postgres&queryGroups=source&source=edge_logs#querying-with-the-logs-explorer:~:text=logs%20from%20the-,Sources,-drop%2Ddown%3A) for all available sources. \n",
-        "operationId": "v1-get-project-logs",
+        "deprecated": true,
+        "description": "Executes a SQL query on the project's logs.\n\nEither the `iso_timestamp_start` and `iso_timestamp_end` parameters must be provided.\nIf both are not provided, only the last 1 minute of logs will be queried.\nThe timestamp range must be no more than 24 hours and is rounded to the nearest minute. If the range is more than 24 hours, a validation error will be thrown.\n\nNote: Unless the `sql` parameter is provided, only edge_logs will be queried. See the [log query docs](/docs/guides/telemetry/logs?queryGroups=product&product=postgres&queryGroups=source&source=edge_logs#querying-with-the-logs-explorer:~:text=logs%20from%20the-,Sources,-drop%2Ddown%3A) for all available sources.\n",
+        "operationId": "v1-get-project-logs-all",
         "parameters": [
           {
             "name": "ref",
@@ -6731,6 +6732,9 @@
           "401": {
             "description": "Unauthorized"
           },
+          "402": {
+            "description": "Usage exceeded. Enable additional usage to continue querying"
+          },
           "403": {
             "description": "Forbidden action"
           },
@@ -6758,6 +6762,99 @@
         "x-oauth-scope": "analytics:read"
       }
     },
+    "/v1/projects/{ref}/analytics/endpoints/logs": {
+      "get": {
+        "deprecated": false,
+        "description": "Executes an SQL or LQL query on the project's unified logs stream.\n\nEither the `iso_timestamp_start` and `iso_timestamp_end` parameters must be provided.\nIf both are not provided, only the last 1 minute of logs will be queried.\nThe timestamp range must be no more than 24 hours and is rounded to the nearest minute. If the range is more than 24 hours, a validation error will be thrown.\n\nFilter by the `source` column to specify specific log sources, such as edge_logs, postgres_logs, etc.\n\nNote: SQL must be written in **ClickHouse SQL dialect**.\n",
+        "operationId": "v1-get-project-logs",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          },
+          {
+            "name": "sql",
+            "required": false,
+            "in": "query",
+            "description": "Custom SQL query to execute on the logs. See [querying logs](/docs/guides/telemetry/logs?queryGroups=product&product=postgres&queryGroups=source&source=edge_logs#querying-with-the-logs-explorer) for more details.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "iso_timestamp_start",
+            "required": false,
+            "in": "query",
+            "schema": {
+              "format": "date-time",
+              "example": "2025-03-01T00:00:00Z",
+              "type": "string"
+            }
+          },
+          {
+            "name": "iso_timestamp_end",
+            "required": false,
+            "in": "query",
+            "schema": {
+              "format": "date-time",
+              "example": "2025-03-01T23:59:59Z",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AnalyticsResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "402": {
+            "description": "Usage exceeded. Enable additional usage to continue querying"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          },
+          {
+            "fga_permissions": ["analytics_logs_read"]
+          }
+        ],
+        "summary": "Gets all project's logs in a single log stream",
+        "tags": ["Analytics"],
+        "x-badges": [
+          {
+            "name": "OAuth scope: analytics:read",
+            "position": "after"
+          }
+        ],
+        "x-endpoint-owners": ["analytics"],
+        "x-oauth-scope": "analytics:read"
+      }
+    },
     "/v1/projects/{ref}/analytics/endpoints/usage.api-counts": {
       "get": {
         "operationId": "v1-get-project-usage-api-count",
@@ -12921,11 +13018,7 @@
               },
               "unavailableReason": {
                 "type": "string",
-                "enum": [
-                  "manual_migration_required",
-                  "postgres_upgrade_required",
-                  "temporarily_unavailable"
-                ]
+                "enum": ["postgres_upgrade_required", "temporarily_unavailable"]
               }
             },
             "required": ["state", "unavailableReason"]

From a4a253040bd5c168875537749d23f8d9baa0ecdc Mon Sep 17 00:00:00 2001
From: Andrew Valleteau <avallete@users.noreply.github.com>
Date: Fri, 26 Jun 2026 12:04:19 +0200
Subject: [PATCH 09/29] test(cli): supabox-backed live test suite + cli-e2e-ci
 dispatch (#5699)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a `live` test category that exercises the built CLI against a
**real Supabase platform** — a fulls supabox stack stood up in CI by
cli-e2e-ci — and the cli-side trigger that runs it for a PR.

## What changed
- **`live` Vitest project** (`*.live.test.ts`) + harness in
`apps/cli/tests/helpers/live.ts`:
- `runSupabaseLive` (drives the built binary via
`SUPABASE_PROFILE=supabase-local`), `describeLive` (gated on
`SUPABASE_ACCESS_TOKEN`), and `describeLiveProject` /
`requireLiveProjectRef` (gated on `SUPABASE_LIVE_PROJECT_REF` for
project-scoped suites).
  - `tests/live-global-setup.ts` fail-fast reachability probe.
- nx `test:live` target (auto-derived from the project) + `nx.json`
default; **removed** the recursive `test:live` package script (it
shadowed the nx target and looped).
- **8 live scenarios**: `orgs list` (+JSON, +invalid-token negative),
`projects list` (+JSON), `functions list` / `branches list`
(project-scoped), and a `functions list` unknown-project (404) negative.
- **`.github/workflows/dispatch-cli-e2e-ci.yml`**: on PRs labeled
`run-live-e2e-ci`, fires a `repository_dispatch` to cli-e2e-ci with the
PR head SHA; cli-e2e-ci builds that SHA, runs the suite, and reports a
`cli-e2e-ci / live` commit status back. Distinct from the staging
`live-e2e.yml`.

## Why
There was no backend-hitting live coverage — existing `*.e2e.test.ts`
use fake tokens. This validates real Management-API flows end-to-end
against supabox. Refs CLI-1825 / CLI-1834 / CLI-1831.

## Reviewer notes
- The `live` project is **inert by default** — it only runs when
`SUPABASE_ACCESS_TOKEN` is set (the cli-e2e-ci runner provides supabox's
seeded PAT), so it does not touch the normal unit/integration/e2e loop.
- Validated green in cli-e2e-ci on Blacksmith: **8 passed, 0 skipped**,
including the project-scoped suites (the runner provisions a project and
sets `SUPABASE_LIVE_PROJECT_REF`).
- The dispatch loop needs, on the infra side: a `run-live-e2e-ci` label
on this repo, the App's `contents: write` on cli-e2e-ci (to dispatch)
and `statuses: write` here (for the back-status). The build/test half is
proven without them.

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 .github/workflows/dispatch-cli-e2e-ci.yml     | 57 +++++++++++++++
 apps/cli/package.json                         |  3 +-
 .../commands/branches/list/list.live.test.ts  | 30 ++++++++
 .../commands/functions/list/list.live.test.ts | 52 +++++++++++++
 .../commands/orgs/list/list.live.test.ts      | 52 +++++++++++++
 .../commands/projects/list/list.live.test.ts  | 33 +++++++++
 apps/cli/tests/helpers/live-env.ts            | 73 +++++++++++++++++++
 apps/cli/tests/helpers/live.ts                | 66 +++++++++++++++++
 apps/cli/tests/live-global-setup.ts           | 39 ++++++++++
 apps/cli/vitest.config.ts                     | 16 ++++
 nx.json                                       | 11 +++
 11 files changed, 431 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/dispatch-cli-e2e-ci.yml
 create mode 100644 apps/cli/src/legacy/commands/branches/list/list.live.test.ts
 create mode 100644 apps/cli/src/legacy/commands/functions/list/list.live.test.ts
 create mode 100644 apps/cli/src/legacy/commands/orgs/list/list.live.test.ts
 create mode 100644 apps/cli/src/legacy/commands/projects/list/list.live.test.ts
 create mode 100644 apps/cli/tests/helpers/live-env.ts
 create mode 100644 apps/cli/tests/helpers/live.ts
 create mode 100644 apps/cli/tests/live-global-setup.ts

diff --git a/.github/workflows/dispatch-cli-e2e-ci.yml b/.github/workflows/dispatch-cli-e2e-ci.yml
new file mode 100644
index 0000000000..4dfecad569
--- /dev/null
+++ b/.github/workflows/dispatch-cli-e2e-ci.yml
@@ -0,0 +1,57 @@
+name: Dispatch cli-e2e-ci
+
+# Asks the supabase/cli-e2e-ci harness to run the cli `test:live` suite against
+# a full supabox stack, built from THIS PR's head commit (CLI-1825 / CLI-1831).
+#
+# This is distinct from `live-e2e.yml`, which runs the cli-e2e package against
+# real staging (api.supabase.green). Here the suite runs against a local supabox
+# stack stood up inside the private cli-e2e-ci repo; we only fire the trigger and
+# pass our head SHA — cli-e2e-ci checks that SHA out into its `cli` submodule.
+#
+# Opt-in by label to keep the expensive full-stack run off every PR: add the
+# `run-live-e2e-ci` label (re-dispatches on each subsequent push while labeled).
+# cli-e2e-ci reports a `cli-e2e-ci / live` commit status back onto the head SHA.
+#
+# Fork PRs cannot dispatch (no access to the App secret); run cli-e2e-ci's own
+# workflow_dispatch with `cli_ref` for those.
+on:
+  pull_request:
+    types: [labeled, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  dispatch:
+    # Same-repo PRs only: fork PRs don't receive secrets (GH_APP_PRIVATE_KEY), so
+    # the App-token step would fail and leave a red check. Skip them cleanly —
+    # fork PRs use cli-e2e-ci's workflow_dispatch with `cli_ref` instead.
+    if: >-
+      contains(github.event.pull_request.labels.*.name, 'run-live-e2e-ci')
+      && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+      # App token scoped to cli-e2e-ci with contents:write — the
+      # repository_dispatch REST endpoint requires write on the target repo.
+      - name: Create GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.GH_APP_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+          owner: supabase
+          repositories: cli-e2e-ci
+          permission-contents: write
+
+      - name: Dispatch live run to cli-e2e-ci
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          CLI_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          echo "Dispatching cli-e2e-ci live run for PR #${PR_NUMBER} @ ${CLI_SHA}"
+          # Build the nested client_payload with jq — `gh api -f` sends a flat
+          # body and would not nest `client_payload.*` correctly.
+          jq -n --arg sha "$CLI_SHA" --argjson pr "$PR_NUMBER" \
+            '{event_type: "cli-pr", client_payload: {cli_sha: $sha, pr_number: $pr}}' \
+            | gh api -X POST repos/supabase/cli-e2e-ci/dispatches --input -
diff --git a/apps/cli/package.json b/apps/cli/package.json
index ac72985d2d..019c783f62 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -112,7 +112,8 @@
     "entry": [
       "src/shared/cli/bin.ts",
       "src/**/*.test.ts",
-      "src/**/*.e2e.test.ts"
+      "src/**/*.e2e.test.ts",
+      "src/**/*.live.test.ts"
     ],
     "ignore": [
       "scripts/*.ts",
diff --git a/apps/cli/src/legacy/commands/branches/list/list.live.test.ts b/apps/cli/src/legacy/commands/branches/list/list.live.test.ts
new file mode 100644
index 0000000000..65422ad51b
--- /dev/null
+++ b/apps/cli/src/legacy/commands/branches/list/list.live.test.ts
@@ -0,0 +1,30 @@
+import { expect, test } from "vitest";
+
+import {
+  describeLiveProject,
+  requireLiveProjectRef,
+  runSupabaseLive,
+} from "../../../../../tests/helpers/live.ts";
+
+const LIVE_TIMEOUT_MS = 120_000;
+
+// Project-scoped read-only scenario. Skipped unless SUPABASE_LIVE_PROJECT_REF is
+// set — i.e. a project has been provisioned on the stack (the cli-e2e-ci runner
+// does this; a control-plane-only stack, like local macOS, skips it).
+//
+// Entry point for the branching lifecycle tracked in CLI-1834
+// (create / switch / delete) — extend here once a provisioned project is
+// available on the full stack.
+describeLiveProject("supabase branches list (live)", () => {
+  test("lists branches for the project", { timeout: LIVE_TIMEOUT_MS }, async () => {
+    const ref = requireLiveProjectRef();
+    const { exitCode, stdout, stderr } = await runSupabaseLive([
+      "branches",
+      "list",
+      "--project-ref",
+      ref,
+    ]);
+    expect(`${stdout}${stderr}`).not.toContain("Unauthorized");
+    expect(exitCode).toBe(0);
+  });
+});
diff --git a/apps/cli/src/legacy/commands/functions/list/list.live.test.ts b/apps/cli/src/legacy/commands/functions/list/list.live.test.ts
new file mode 100644
index 0000000000..2bfa93b86f
--- /dev/null
+++ b/apps/cli/src/legacy/commands/functions/list/list.live.test.ts
@@ -0,0 +1,52 @@
+import { expect, test } from "vitest";
+
+import {
+  describeLive,
+  describeLiveProject,
+  requireLiveProjectRef,
+  runSupabaseLive,
+} from "../../../../../tests/helpers/live.ts";
+
+const LIVE_TIMEOUT_MS = 120_000;
+
+// Project-scoped read-only scenario. Skipped unless SUPABASE_LIVE_PROJECT_REF is
+// set — i.e. a project has been provisioned on the stack (the cli-e2e-ci runner
+// does this; a control-plane-only stack, like local macOS, skips it).
+//
+// This is the entry point for the broader edge-functions coverage tracked in
+// CLI-1834 (deploy + invoke over :443 / {ref}.supabase.red), which needs the
+// project's gateway reachable from the host — author those here as they become
+// runnable on the full stack.
+describeLiveProject("supabase functions list (live)", () => {
+  test("lists edge functions for the project", { timeout: LIVE_TIMEOUT_MS }, async () => {
+    const ref = requireLiveProjectRef();
+    const { exitCode, stdout, stderr } = await runSupabaseLive([
+      "functions",
+      "list",
+      "--project-ref",
+      ref,
+    ]);
+    expect(`${stdout}${stderr}`).not.toContain("Unauthorized");
+    expect(exitCode).toBe(0);
+  });
+});
+
+// Project-scoped error path that needs NO provisioned project: a valid token
+// with an unknown `--project-ref` must reach the live Management API, come back
+// 404, and surface as a non-zero exit (not a crash, not "Unauthorized"). This
+// exercises the `--project-ref` request path + error mapping on a control-plane-
+// only stack, so it runs under `describeLive`, not `describeLiveProject`.
+describeLive("supabase functions list — unknown project (live)", () => {
+  test("fails with a 404 for an unknown project ref", { timeout: LIVE_TIMEOUT_MS }, async () => {
+    const { exitCode, stdout, stderr } = await runSupabaseLive([
+      "functions",
+      "list",
+      "--project-ref",
+      "a".repeat(20), // well-formed (20 lowercase chars) but nonexistent ref
+    ]);
+    const out = `${stdout}${stderr}`;
+    expect(exitCode).not.toBe(0);
+    expect(out).not.toContain("Unauthorized");
+    expect(out).toContain("404");
+  });
+});
diff --git a/apps/cli/src/legacy/commands/orgs/list/list.live.test.ts b/apps/cli/src/legacy/commands/orgs/list/list.live.test.ts
new file mode 100644
index 0000000000..515e8a855d
--- /dev/null
+++ b/apps/cli/src/legacy/commands/orgs/list/list.live.test.ts
@@ -0,0 +1,52 @@
+import { expect, test } from "vitest";
+import { describeLive, runSupabaseLive } from "../../../../../tests/helpers/live.ts";
+
+const LIVE_TIMEOUT_MS = 60_000;
+
+// Harness smoke for the `live` Vitest project: the canonical example of a live
+// test. It exercises the full path — built binary → SUPABASE_PROFILE resolution
+// → authenticated Management API request against the running platform — with a
+// read-only call, so it is safe to run repeatedly and creates no resources.
+//
+// Gated by `describeLive`: skipped unless SUPABASE_ACCESS_TOKEN is set (the
+// cli-e2e-ci runner provides supabox's seeded PAT). Broader lifecycle scenarios
+// (projects, functions, branching, db, storage) build on this same harness.
+describeLive("supabase orgs list (live)", () => {
+  test(
+    "lists organizations for the authenticated token",
+    { timeout: LIVE_TIMEOUT_MS },
+    async () => {
+      const { exitCode, stdout, stderr } = await runSupabaseLive(["orgs", "list"]);
+      expect(`${stdout}${stderr}`).not.toContain("Unauthorized");
+      expect(exitCode).toBe(0);
+    },
+  );
+
+  test(
+    "emits machine-readable JSON with --output-format json",
+    { timeout: LIVE_TIMEOUT_MS },
+    async () => {
+      const { exitCode, stdout } = await runSupabaseLive([
+        "orgs",
+        "list",
+        "--output-format",
+        "json",
+      ]);
+      expect(exitCode).toBe(0);
+      // stdout must be payload-only valid JSON in json mode (no spinner/log noise).
+      expect(() => JSON.parse(stdout)).not.toThrow();
+    },
+  );
+
+  // Negative path: a bad token must round-trip to the real Management API, come
+  // back 401, and surface as a non-zero exit with the upstream "Unauthorized"
+  // message — i.e. the cli's auth + error mapping work against the live stack,
+  // not just the golden path. Overrides only the token (profile stays set).
+  test("fails with Unauthorized for an invalid token", { timeout: LIVE_TIMEOUT_MS }, async () => {
+    const { exitCode, stdout, stderr } = await runSupabaseLive(["orgs", "list"], {
+      env: { SUPABASE_ACCESS_TOKEN: `sbp_${"0".repeat(40)}` },
+    });
+    expect(exitCode).not.toBe(0);
+    expect(`${stdout}${stderr}`).toContain("Unauthorized");
+  });
+});
diff --git a/apps/cli/src/legacy/commands/projects/list/list.live.test.ts b/apps/cli/src/legacy/commands/projects/list/list.live.test.ts
new file mode 100644
index 0000000000..8c4ca20f33
--- /dev/null
+++ b/apps/cli/src/legacy/commands/projects/list/list.live.test.ts
@@ -0,0 +1,33 @@
+import { expect, test } from "vitest";
+
+import { describeLive, runSupabaseLive } from "../../../../../tests/helpers/live.ts";
+
+const LIVE_TIMEOUT_MS = 60_000;
+
+// Account-level read-only live scenario, alongside `orgs list`. Lists every
+// project the authenticated token can access — no project ref required, so it
+// runs against just the control plane (no provisioned project instance needed).
+// Safe to run repeatedly; creates nothing.
+describeLive("supabase projects list (live)", () => {
+  test("lists projects for the authenticated token", { timeout: LIVE_TIMEOUT_MS }, async () => {
+    const { exitCode, stdout, stderr } = await runSupabaseLive(["projects", "list"]);
+    expect(`${stdout}${stderr}`).not.toContain("Unauthorized");
+    expect(exitCode).toBe(0);
+  });
+
+  test(
+    "emits machine-readable JSON with --output-format json",
+    { timeout: LIVE_TIMEOUT_MS },
+    async () => {
+      const { exitCode, stdout } = await runSupabaseLive([
+        "projects",
+        "list",
+        "--output-format",
+        "json",
+      ]);
+      expect(exitCode).toBe(0);
+      // stdout must be payload-only valid JSON in json mode (no spinner/log noise).
+      expect(() => JSON.parse(stdout)).not.toThrow();
+    },
+  );
+});
diff --git a/apps/cli/tests/helpers/live-env.ts b/apps/cli/tests/helpers/live-env.ts
new file mode 100644
index 0000000000..f6705d71e0
--- /dev/null
+++ b/apps/cli/tests/helpers/live-env.ts
@@ -0,0 +1,73 @@
+/**
+ * Environment-only helpers for the `live` Vitest project, with **no Vitest test
+ * APIs imported**. Vitest evaluates `globalSetup` (live-global-setup.ts) in a
+ * separate context before the test workers, where importing `describe`/`test`
+ * is not valid — so the global setup imports the env helpers from here, while
+ * the test-facing pieces (`describeLive`, `runSupabaseLive`, …) live in
+ * `live.ts` and re-export these.
+ *
+ * Environment contract (provided by the cli-e2e-ci runner):
+ * - `SUPABASE_ACCESS_TOKEN` — required; the platform PAT (supabox seeds a
+ *   deterministic `sbp_…` token into its mgmt-api database).
+ * - `SUPABASE_PROFILE` — selects the API base URL; defaults to `supabase-local`
+ *   (→ `http://localhost:8080`, `project_host: supabase.red`). Note the cli does
+ *   NOT honor `SUPABASE_API_URL` (Go parity) — the profile is the override.
+ * - `SUPABASE_LIVE_API_URL` — base URL the readiness check probes; defaults to
+ *   `http://localhost:8080`.
+ * - `SUPABASE_LIVE_PROJECT_REF` — a provisioned project; gates project-scoped
+ *   suites (functions, branches, db, storage).
+ * - `NODE_EXTRA_CA_CERTS` — trusts the supabox CA for `*.supabase.red` TLS;
+ *   inherited by the subprocess via the parent environment.
+ */
+
+/** Default profile for the host runner: api_url → localhost:8080, project_host → supabase.red. */
+export const LIVE_DEFAULT_PROFILE = "supabase-local";
+
+/**
+ * Default subprocess exit timeout for live runs. `runSupabase` otherwise caps at
+ * 60s, which would kill a slow-but-valid supabox call before the live tests'
+ * own (60–120s+) timeouts fire. Generous, but under the `live` project's 300s
+ * cap so the per-test timeout stays the real gate. Callers may override.
+ */
+export const LIVE_EXIT_TIMEOUT_MS = 240_000;
+
+/** Management API base URL probed by the live readiness check. */
+export function liveApiBaseUrl(): string {
+  return process.env["SUPABASE_LIVE_API_URL"] ?? "http://localhost:8080";
+}
+
+/**
+ * True when the environment carries a platform access token, i.e. the live
+ * suite is expected to run. Used to gate `describeLive` so live tests are inert
+ * in the default test loop.
+ */
+export function isLiveConfigured(): boolean {
+  return Boolean(process.env["SUPABASE_ACCESS_TOKEN"]);
+}
+
+/**
+ * Project ref for project-scoped live scenarios (functions, branches, db,
+ * storage, …). The cli-e2e-ci runner sets this once a project has been
+ * provisioned on the stack; absent → those suites skip. Returns `undefined`
+ * when unset so callers can branch; use `requireLiveProjectRef` inside a
+ * `describeLiveProject` block where presence is already guaranteed.
+ */
+export function liveProjectRef(): string | undefined {
+  return process.env["SUPABASE_LIVE_PROJECT_REF"];
+}
+
+/**
+ * The live project ref, or a thrown error if unset. Safe to call inside a
+ * `describeLiveProject` block (the gate guarantees it is present) and gives a
+ * typed `string` without a non-null assertion.
+ */
+export function requireLiveProjectRef(): string {
+  const ref = liveProjectRef();
+  if (!ref) {
+    throw new Error(
+      "SUPABASE_LIVE_PROJECT_REF must be set for project-scoped live tests " +
+        "(the cli-e2e-ci runner sets it after provisioning a project).",
+    );
+  }
+  return ref;
+}
diff --git a/apps/cli/tests/helpers/live.ts b/apps/cli/tests/helpers/live.ts
new file mode 100644
index 0000000000..78d2558190
--- /dev/null
+++ b/apps/cli/tests/helpers/live.ts
@@ -0,0 +1,66 @@
+import { describe } from "vitest";
+
+import { runSupabase } from "./cli.ts";
+import {
+  isLiveConfigured,
+  LIVE_DEFAULT_PROFILE,
+  LIVE_EXIT_TIMEOUT_MS,
+  liveProjectRef,
+} from "./live-env.ts";
+
+/**
+ * Test-facing helpers for the `live` Vitest project (`*.live.test.ts`):
+ * black-box CLI subprocess tests that run against a *real* Supabase platform —
+ * in CI a local supabox stack (see the `supabase/cli-e2e-ci` harness).
+ *
+ * This module imports Vitest test APIs (`describe`), so it must NOT be imported
+ * from `globalSetup` (Vitest evaluates that in a different context). The
+ * env-only helpers live in `./live-env.ts`; `globalSetup` imports from there.
+ * They are re-exported below so test files have a single import site.
+ */
+
+// Re-export the env-only helpers so `*.live.test.ts` files import everything
+// from `helpers/live.ts`.
+export {
+  isLiveConfigured,
+  LIVE_DEFAULT_PROFILE,
+  LIVE_EXIT_TIMEOUT_MS,
+  liveApiBaseUrl,
+  liveProjectRef,
+  requireLiveProjectRef,
+} from "./live-env.ts";
+
+/**
+ * `describe` that runs only when the live environment is configured. Use this
+ * for every live suite so the file is inert (skipped, not failed) outside the
+ * cli-e2e-ci runner.
+ */
+export const describeLive = describe.skipIf(!isLiveConfigured());
+
+/**
+ * `describe` for project-scoped live suites: runs only when the live env is
+ * configured AND a project ref is available. On a control-plane-only stack
+ * (e.g. local macOS where project instances can't be built) these skip rather
+ * than fail. See `requireLiveProjectRef`.
+ */
+export const describeLiveProject = describe.skipIf(!isLiveConfigured() || !liveProjectRef());
+
+/**
+ * Spawn the built CLI against the live platform, injecting the profile so the
+ * Management API base resolves to the stack. Defaults to the `legacy` shell,
+ * which hosts the platform commands (orgs, projects, branches, functions, …).
+ */
+export function runSupabaseLive(
+  args: string[],
+  options?: Parameters<typeof runSupabase>[1],
+): ReturnType<typeof runSupabase> {
+  return runSupabase(args, {
+    entrypoint: "legacy",
+    ...options,
+    exitTimeoutMs: options?.exitTimeoutMs ?? LIVE_EXIT_TIMEOUT_MS,
+    env: {
+      SUPABASE_PROFILE: process.env["SUPABASE_PROFILE"] ?? LIVE_DEFAULT_PROFILE,
+      ...options?.env,
+    },
+  });
+}
diff --git a/apps/cli/tests/live-global-setup.ts b/apps/cli/tests/live-global-setup.ts
new file mode 100644
index 0000000000..d7584e757a
--- /dev/null
+++ b/apps/cli/tests/live-global-setup.ts
@@ -0,0 +1,39 @@
+// Import from the Vitest-free env module — globalSetup runs in a context where
+// importing Vitest test APIs (which `helpers/live.ts` pulls in) is not valid.
+import { isLiveConfigured, liveApiBaseUrl } from "./helpers/live-env.ts";
+
+/**
+ * Global setup for the `live` Vitest project. When the live environment is not
+ * configured the suite is skipped (via `describeLive`) and this is a no-op.
+ *
+ * When it IS configured (the cli-e2e-ci runner sets `SUPABASE_ACCESS_TOKEN`),
+ * fail fast with a clear message if the platform is unreachable, so a
+ * misconfigured stack surfaces as a setup error rather than dozens of opaque
+ * per-test timeouts.
+ */
+export async function setup(): Promise<void> {
+  if (!isLiveConfigured()) {
+    return;
+  }
+
+  // Reachability gate only. Any HTTP response — including 401/404 — proves the
+  // Management API is up and routing, which is all this probe needs to assert.
+  // supabox's mgmt-api requires auth on every route and exposes no public health
+  // endpoint (`/v1/health` 404s; an unauthenticated request is rejected by the
+  // auth middleware with 401), so we deliberately do NOT require a 2xx here.
+  // Functional and auth coverage is the live tests' job (e.g. `orgs list`).
+  const probeUrl = `${liveApiBaseUrl()}/v1/organizations`;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 30_000);
+  try {
+    await fetch(probeUrl, { signal: controller.signal });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new Error(
+      `Live platform is not reachable at ${probeUrl}: ${reason}.\n` +
+        "Ensure the supabox stack is up and the host can reach mgmt-api (see cli-e2e-ci).",
+    );
+  } finally {
+    clearTimeout(timeout);
+  }
+}
diff --git a/apps/cli/vitest.config.ts b/apps/cli/vitest.config.ts
index 412bff1fc1..a8c53dd4e5 100644
--- a/apps/cli/vitest.config.ts
+++ b/apps/cli/vitest.config.ts
@@ -31,6 +31,7 @@ export default defineConfig({
         "**/*.unit.test.ts",
         "**/*.integration.test.ts",
         "**/*.e2e.test.ts",
+        "**/*.live.test.ts",
         "**/*.command.ts",
         "src/app.ts",
         "src/bin.ts",
@@ -66,6 +67,21 @@ export default defineConfig({
           hookTimeout: 120_000,
         },
       },
+      {
+        plugins: [dockerfileTextPlugin()],
+        test: {
+          // Live tests run against a real platform (a supabox stack in CI) and
+          // are gated by `describeLive`, so they are inert unless the live env
+          // is configured. Never part of the default unit/integration/e2e loop.
+          name: "live",
+          include: ["**/*.live.test.ts"],
+          fileParallelism: false,
+          maxWorkers: 1,
+          globalSetup: ["tests/live-global-setup.ts"],
+          testTimeout: 300_000,
+          hookTimeout: 300_000,
+        },
+      },
     ],
   },
 });
diff --git a/nx.json b/nx.json
index 7a0dabb5fe..128d1740b7 100644
--- a/nx.json
+++ b/nx.json
@@ -75,6 +75,17 @@
         "{projectRoot}/dist/**/*"
       ]
     },
+    "test:live": {
+      "parallelism": false,
+      "cache": false,
+      "dependsOn": [
+        "build"
+      ],
+      "inputs": [
+        "default",
+        "{projectRoot}/dist/**/*"
+      ]
+    },
     "dev": {
       "cache": false
     }

From 2abc6f00344570a34f90ace37d8eb797a874d557 Mon Sep 17 00:00:00 2001
From: Leandro Pereira <leandro@leandro.io>
Date: Fri, 26 Jun 2026 08:38:10 -0400
Subject: [PATCH 10/29] fix(realtime): unblock and bump realtime to v2.111.8
 (#5701)

## What kind of change does this PR introduce?

- Revert https://github.com/supabase/cli/pull/5628 fixed by
https://github.com/supabase/realtime/pull/1984
- Sync template/tests to latest Realtime version

## What is the current behavior?

Realtime update blocked.

Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>
---
 .github/dependabot.yml                               |  6 ------
 apps/cli-go/pkg/config/templates/Dockerfile          |  2 +-
 .../src/next/commands/list/list.integration.test.ts  |  2 +-
 .../next/commands/start/start.integration.test.ts    | 12 ++++++------
 .../next/commands/update/update.integration.test.ts  |  2 +-
 packages/stack/src/StackBuilder.unit.test.ts         |  4 ++--
 packages/stack/src/versions.ts                       |  2 +-
 7 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 255d864933..7aa08a043b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -65,12 +65,6 @@ updates:
       - dependency-name: "axllent/mailpit"
       - dependency-name: "darthsim/imgproxy"
       - dependency-name: "timberio/vector"
-      # Held back: v2.109.0+ adds a setup_supabase_realtime_admin migration
-      # that fails against the CLI's local Postgres and breaks `supabase start`.
-      # Remove once the CLI's local stack is compatible with the new migration.
-      - dependency-name: "supabase/realtime"
-        versions:
-          - ">= 2.109.0"
     cooldown:
       default-days: 7
       exclude:
diff --git a/apps/cli-go/pkg/config/templates/Dockerfile b/apps/cli-go/pkg/config/templates/Dockerfile
index 4bb926ee09..47c7f6a17e 100644
--- a/apps/cli-go/pkg/config/templates/Dockerfile
+++ b/apps/cli-go/pkg/config/templates/Dockerfile
@@ -11,7 +11,7 @@ FROM supabase/edge-runtime:v1.74.2 AS edgeruntime
 FROM timberio/vector:0.53.0-alpine AS vector
 FROM supabase/supavisor:2.9.7 AS supavisor
 FROM supabase/gotrue:v2.191.0 AS gotrue
-FROM supabase/realtime:v2.108.0 AS realtime
+FROM supabase/realtime:v2.111.8 AS realtime
 FROM supabase/storage-api:v1.61.4 AS storage
 FROM supabase/logflare:1.45.4 AS logflare
 # Append to JobImages when adding new dependencies below
diff --git a/apps/cli/src/next/commands/list/list.integration.test.ts b/apps/cli/src/next/commands/list/list.integration.test.ts
index 1e95fe5eb4..52819a17c9 100644
--- a/apps/cli/src/next/commands/list/list.integration.test.ts
+++ b/apps/cli/src/next/commands/list/list.integration.test.ts
@@ -39,7 +39,7 @@ function writeStackMetadata(stackDir: string, apiPort: number, dbPort: number) {
           postgrest: "14.5",
           auth: "2.188.0-rc.15",
           "edge-runtime": DEFAULT_VERSIONS["edge-runtime"],
-          realtime: "2.78.10",
+          realtime: "2.111.8",
           storage: "1.41.8",
           imgproxy: "v3.8.0",
           mailpit: "v1.30.2",
diff --git a/apps/cli/src/next/commands/start/start.integration.test.ts b/apps/cli/src/next/commands/start/start.integration.test.ts
index f0c7f83ed3..7179a25000 100644
--- a/apps/cli/src/next/commands/start/start.integration.test.ts
+++ b/apps/cli/src/next/commands/start/start.integration.test.ts
@@ -68,7 +68,7 @@ function mockStartVersionState(
             postgrest: "14.5",
             auth: "2.188.0-rc.15",
             "edge-runtime": DEFAULT_VERSIONS["edge-runtime"],
-            realtime: "2.78.10",
+            realtime: "2.111.8",
             storage: "1.41.8",
             imgproxy: "v3.8.0",
             mailpit: "v1.30.2",
@@ -86,7 +86,7 @@ function mockStartVersionState(
           postgrest: "14.5",
           auth: "2.188.0-rc.15",
           "edge-runtime": DEFAULT_VERSIONS["edge-runtime"],
-          realtime: "2.78.10",
+          realtime: "2.111.8",
           storage: "1.41.8",
           imgproxy: "v3.8.0",
           mailpit: "v1.30.2",
@@ -101,7 +101,7 @@ function mockStartVersionState(
           postgrest: "14.5",
           auth: "2.188.0-rc.15",
           "edge-runtime": DEFAULT_VERSIONS["edge-runtime"],
-          realtime: "2.78.10",
+          realtime: "2.111.8",
           storage: "1.41.8",
           imgproxy: "v3.8.0",
           mailpit: "v1.30.2",
@@ -116,7 +116,7 @@ function mockStartVersionState(
           postgrest: "14.5",
           auth: "2.188.0-rc.15",
           "edge-runtime": DEFAULT_VERSIONS["edge-runtime"],
-          realtime: "2.78.10",
+          realtime: "2.111.8",
           storage: "1.41.8",
           imgproxy: "v3.8.0",
           mailpit: "v1.30.2",
@@ -370,7 +370,7 @@ describe("start", () => {
             postgrest: "14.5",
             auth: "2.187.0",
             "edge-runtime": DEFAULT_VERSIONS["edge-runtime"],
-            realtime: "2.78.10",
+            realtime: "2.111.8",
             storage: "1.41.8",
             imgproxy: "v3.8.0",
             mailpit: "v1.30.2",
@@ -423,7 +423,7 @@ describe("start", () => {
                 postgrest: "14.5",
                 auth: "2.187.0",
                 "edge-runtime": DEFAULT_VERSIONS["edge-runtime"],
-                realtime: "2.78.10",
+                realtime: "2.111.8",
                 storage: "1.41.8",
                 imgproxy: "v3.8.0",
                 mailpit: "v1.30.2",
diff --git a/apps/cli/src/next/commands/update/update.integration.test.ts b/apps/cli/src/next/commands/update/update.integration.test.ts
index 316129e88d..8e23e1a4fe 100644
--- a/apps/cli/src/next/commands/update/update.integration.test.ts
+++ b/apps/cli/src/next/commands/update/update.integration.test.ts
@@ -184,7 +184,7 @@ describe("update handler", () => {
                   postgrest: "14.4",
                   auth: "2.180.0",
                   "edge-runtime": DEFAULT_VERSIONS["edge-runtime"],
-                  realtime: "2.78.10",
+                  realtime: "2.111.8",
                   storage: "1.39.1",
                   imgproxy: "v3.8.0",
                   mailpit: "v1.30.2",
diff --git a/packages/stack/src/StackBuilder.unit.test.ts b/packages/stack/src/StackBuilder.unit.test.ts
index 953fd7c01a..3d3c2c0039 100644
--- a/packages/stack/src/StackBuilder.unit.test.ts
+++ b/packages/stack/src/StackBuilder.unit.test.ts
@@ -456,8 +456,8 @@ describe("StackBuilder", () => {
       });
 
       const realtimeDef = graph.startOrder.find((service) => service.name === "realtime");
-      expect(realtimeDef?.args).toContain("supabase/realtime:v2.78.10");
-      expect(realtimeDef?.args).not.toContain("public.ecr.aws/supabase/realtime:v2.78.10");
+      expect(realtimeDef?.args).toContain("supabase/realtime:v2.111.8");
+      expect(realtimeDef?.args).not.toContain("public.ecr.aws/supabase/realtime:v2.111.8");
     }).pipe(Effect.provide(layer));
   });
 });
diff --git a/packages/stack/src/versions.ts b/packages/stack/src/versions.ts
index 1f5cbec4cb..273e47ffcc 100644
--- a/packages/stack/src/versions.ts
+++ b/packages/stack/src/versions.ts
@@ -50,7 +50,7 @@ export const DEFAULT_VERSIONS: VersionManifest = {
   postgrest: "14.5",
   auth: "2.188.0-rc.15",
   "edge-runtime": "1.73.13",
-  realtime: "2.78.10",
+  realtime: "2.111.8",
   storage: "1.41.8",
   imgproxy: "v3.8.0",
   mailpit: "v1.30.2",

From 81265b8a3c999367a45eebd3a55a1e44f0c48940 Mon Sep 17 00:00:00 2001
From: Vaibhav <117663341+7ttp@users.noreply.github.com>
Date: Fri, 26 Jun 2026 18:17:17 +0530
Subject: [PATCH 11/29] fix(cli): skip empty schema_paths globs in db diff
 (#5702)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## TL;DR

Fixes a regression in `supabase db diff` where declarative
`schema_paths` entries that currently match no files
would abort the command instead of being skipped

## What’s fixed?

loading path now ignores empty `schema_paths` glob matches while still
preserving existing behavior for valid matches, deterministic ordering,
deduping, and invalid glob errors

**Before:**

Projects using declarative schema config like:
would fail if one of those globs matched nothing, with an error like:

```text
no files matched pattern: supabase/schemas/materialized_views/*.sql
```

That turned a normal incremental-adoption setup into a fatal `db diff`
failure

**After:**

skips empty `schema_paths` glob entries and continues diffing with the
files that do exist,
matching the expected existing behavior

## Ref

- closes #5700
---
 apps/cli-go/internal/db/diff/diff.go      |  7 +++-
 apps/cli-go/internal/db/diff/diff_test.go | 49 +++++++++++++++++++++++
 apps/cli-go/pkg/config/config.go          | 39 +++++++++++++++++-
 apps/cli-go/pkg/config/config_test.go     | 28 +++++++++++++
 4 files changed, 121 insertions(+), 2 deletions(-)

diff --git a/apps/cli-go/internal/db/diff/diff.go b/apps/cli-go/internal/db/diff/diff.go
index aa286eea5b..5d2790e5b9 100644
--- a/apps/cli-go/internal/db/diff/diff.go
+++ b/apps/cli-go/internal/db/diff/diff.go
@@ -23,6 +23,7 @@ import (
 	"github.com/spf13/afero"
 	"github.com/supabase/cli/internal/db/start"
 	"github.com/supabase/cli/internal/utils"
+	configpkg "github.com/supabase/cli/pkg/config"
 	"github.com/supabase/cli/pkg/migration"
 	"github.com/supabase/cli/pkg/parser"
 )
@@ -70,7 +71,11 @@ func loadDeclaredSchemas(fsys afero.Fs) ([]string, error) {
 		}
 	}
 	if schemas := utils.Config.Db.Migrations.SchemaPaths; len(schemas) > 0 {
-		return schemas.Files(afero.NewIOFS(fsys))
+		return schemas.Files(
+			afero.NewIOFS(fsys),
+			configpkg.WithSkipEmptyGlobs(),
+			configpkg.WithErrorOnAllSkippedGlobs(),
+		)
 	}
 	if exists, err := afero.DirExists(fsys, utils.SchemasDir); err != nil {
 		return nil, errors.Errorf("failed to check schemas: %w", err)
diff --git a/apps/cli-go/internal/db/diff/diff_test.go b/apps/cli-go/internal/db/diff/diff_test.go
index e0df5b328a..2a6a2d4ca4 100644
--- a/apps/cli-go/internal/db/diff/diff_test.go
+++ b/apps/cli-go/internal/db/diff/diff_test.go
@@ -409,3 +409,52 @@ func TestLoadSchemas(t *testing.T) {
 	assert.NoError(t, err)
 	assert.ElementsMatch(t, expected, schemas)
 }
+
+func TestLoadSchemasSkipsEmptySchemaPathGlobs(t *testing.T) {
+	fsys := afero.NewMemMapFs()
+	matched := filepath.Join(utils.SupabaseDirPath, "schemas", "tables", "players.sql")
+	require.NoError(t, afero.WriteFile(fsys, matched, nil, 0644))
+	utils.Config.Db.Migrations.SchemaPaths = []string{
+		filepath.Join(utils.SupabaseDirPath, "schemas", "tables", "*.sql"),
+		filepath.Join(utils.SupabaseDirPath, "schemas", "materialized_views", "*.sql"),
+	}
+	t.Cleanup(func() {
+		utils.Config.Db.Migrations.SchemaPaths = nil
+	})
+
+	schemas, err := loadDeclaredSchemas(fsys)
+
+	assert.NoError(t, err)
+	assert.Equal(t, []string{filepath.ToSlash(matched)}, schemas)
+}
+
+func TestLoadSchemasErrorsOnMissingLiteralSchemaPath(t *testing.T) {
+	fsys := afero.NewMemMapFs()
+	utils.Config.Db.Migrations.SchemaPaths = []string{
+		filepath.Join(utils.SupabaseDirPath, "schemas", "tables", "players.sql"),
+	}
+	t.Cleanup(func() {
+		utils.Config.Db.Migrations.SchemaPaths = nil
+	})
+
+	schemas, err := loadDeclaredSchemas(fsys)
+
+	assert.ErrorContains(t, err, "no files matched pattern")
+	assert.Empty(t, schemas)
+}
+
+func TestLoadSchemasErrorsWhenAllSchemaPathGlobsAreEmpty(t *testing.T) {
+	fsys := afero.NewMemMapFs()
+	utils.Config.Db.Migrations.SchemaPaths = []string{
+		filepath.Join(utils.SupabaseDirPath, "schemas", "tables", "*.sql"),
+		filepath.Join(utils.SupabaseDirPath, "schemas", "views", "*.sql"),
+	}
+	t.Cleanup(func() {
+		utils.Config.Db.Migrations.SchemaPaths = nil
+	})
+
+	schemas, err := loadDeclaredSchemas(fsys)
+
+	assert.ErrorContains(t, err, "no files matched pattern")
+	assert.Empty(t, schemas)
+}
diff --git a/apps/cli-go/pkg/config/config.go b/apps/cli-go/pkg/config/config.go
index b2bf3f4a99..b9f253230a 100644
--- a/apps/cli-go/pkg/config/config.go
+++ b/apps/cli-go/pkg/config/config.go
@@ -97,11 +97,35 @@ func (p *RequestPolicy) UnmarshalText(text []byte) error {
 
 type Glob []string
 
+type globOptions struct {
+	skipEmptyGlobs    bool
+	errorOnAllSkipped bool
+}
+
+type GlobOption func(*globOptions)
+
+func WithSkipEmptyGlobs() GlobOption {
+	return func(o *globOptions) {
+		o.skipEmptyGlobs = true
+	}
+}
+
+func WithErrorOnAllSkippedGlobs() GlobOption {
+	return func(o *globOptions) {
+		o.errorOnAllSkipped = true
+	}
+}
+
 // Match the glob patterns in the given FS to get a deduplicated
 // array of all migrations files to apply in the declared order.
-func (g Glob) Files(fsys fs.FS) ([]string, error) {
+func (g Glob) Files(fsys fs.FS, options ...GlobOption) ([]string, error) {
+	opts := globOptions{}
+	for _, apply := range options {
+		apply(&opts)
+	}
 	var result []string
 	var allErrors []error
+	var skipped []string
 	set := make(map[string]struct{})
 	for _, pattern := range g {
 		// Glob expects / as path separator on windows
@@ -109,6 +133,10 @@ func (g Glob) Files(fsys fs.FS) ([]string, error) {
 		if err != nil {
 			allErrors = append(allErrors, errors.Errorf("failed to glob files: %w", err))
 		} else if len(matches) == 0 {
+			if opts.skipEmptyGlobs && hasGlobMeta(pattern) {
+				skipped = append(skipped, pattern)
+				continue
+			}
 			allErrors = append(allErrors, errors.Errorf("no files matched pattern: %s", pattern))
 		}
 		sort.Strings(matches)
@@ -121,9 +149,18 @@ func (g Glob) Files(fsys fs.FS) ([]string, error) {
 			}
 		}
 	}
+	if opts.errorOnAllSkipped && len(result) == 0 && len(skipped) > 0 {
+		for _, pattern := range skipped {
+			allErrors = append(allErrors, errors.Errorf("no files matched pattern: %s", pattern))
+		}
+	}
 	return result, errors.Join(allErrors...)
 }
 
+func hasGlobMeta(pattern string) bool {
+	return strings.ContainsAny(pattern, `*?[`)
+}
+
 // We follow these rules when adding new config:
 //  1. Update init_config.toml (and init_config.test.toml) with the new key, default value, and comments to explain usage.
 //  2. Update config struct with new field and toml tag (spelled in snake_case).
diff --git a/apps/cli-go/pkg/config/config_test.go b/apps/cli-go/pkg/config/config_test.go
index fa38005152..6c2697ca0e 100644
--- a/apps/cli-go/pkg/config/config_test.go
+++ b/apps/cli-go/pkg/config/config_test.go
@@ -676,6 +676,34 @@ func TestGlobFiles(t *testing.T) {
 		// Validate files
 		assert.Empty(t, files)
 	})
+
+	t.Run("skips empty globs when configured", func(t *testing.T) {
+		fsys := fs.MapFS{
+			"supabase/schemas/tables/players.sql": &fs.MapFile{},
+		}
+		g := Glob{
+			"supabase/schemas/tables/*.sql",
+			"supabase/schemas/materialized_views/*.sql",
+		}
+
+		files, err := g.Files(fsys, WithSkipEmptyGlobs())
+
+		assert.NoError(t, err)
+		assert.Equal(t, []string{"supabase/schemas/tables/players.sql"}, files)
+	})
+
+	t.Run("errors when all skipped globs are empty and configured to fail", func(t *testing.T) {
+		fsys := fs.MapFS{}
+		g := Glob{
+			"supabase/schemas/tables/*.sql",
+			"supabase/schemas/materialized_views/*.sql",
+		}
+
+		files, err := g.Files(fsys, WithSkipEmptyGlobs(), WithErrorOnAllSkippedGlobs())
+
+		assert.ErrorContains(t, err, "no files matched pattern")
+		assert.Empty(t, files)
+	})
 }
 
 func TestLoadFunctionImportMap(t *testing.T) {

From 5008dbb7e9fd211ec100cc09c58b26b430c803f8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 12:50:21 +0000
Subject: [PATCH 12/29] fix(docker): bump supabase/realtime from v2.111.8 to
 v2.111.10 in /apps/cli-go/pkg/config/templates in the docker-minor group
 (#5709)

Bumps the docker-minor group in /apps/cli-go/pkg/config/templates with 1
update: supabase/realtime.

Updates `supabase/realtime` from v2.111.8 to v2.111.10


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=supabase/realtime&package-manager=docker&previous-version=v2.111.8&new-version=v2.111.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 apps/cli-go/pkg/config/templates/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/cli-go/pkg/config/templates/Dockerfile b/apps/cli-go/pkg/config/templates/Dockerfile
index 47c7f6a17e..0e496091a5 100644
--- a/apps/cli-go/pkg/config/templates/Dockerfile
+++ b/apps/cli-go/pkg/config/templates/Dockerfile
@@ -11,7 +11,7 @@ FROM supabase/edge-runtime:v1.74.2 AS edgeruntime
 FROM timberio/vector:0.53.0-alpine AS vector
 FROM supabase/supavisor:2.9.7 AS supavisor
 FROM supabase/gotrue:v2.191.0 AS gotrue
-FROM supabase/realtime:v2.111.8 AS realtime
+FROM supabase/realtime:v2.111.10 AS realtime
 FROM supabase/storage-api:v1.61.4 AS storage
 FROM supabase/logflare:1.45.4 AS logflare
 # Append to JobImages when adding new dependencies below

From ce2120e5f4710c0753eec81189d07f7909abfcca Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 14:51:23 +0200
Subject: [PATCH 13/29] chore(deps): bump github.com/posthog/posthog-go from
 1.15.1 to 1.16.0 in /apps/cli-go in the go-minor group across 1 directory
 (#5710)

Bumps the go-minor group with 1 update in the /apps/cli-go directory:
[github.com/posthog/posthog-go](https://github.com/posthog/posthog-go).

Updates `github.com/posthog/posthog-go` from 1.15.1 to 1.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/posthog/posthog-go/releases">github.com/posthog/posthog-go's
releases</a>.</em></p>
<blockquote>
<h2>1.16.0</h2>
<h2>Unreleased</h2>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/PostHog/posthog-go/blob/main/CHANGELOG.md">github.com/posthog/posthog-go's
changelog</a>.</em></p>
<blockquote>
<h2>1.16.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>1068ec9: Add a BeforeSend hook for modifying or dropping messages
before they are sent.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/PostHog/posthog-go/commit/d91c948ae95f3a095c7717818e6b0635beb6e312"><code>d91c948</code></a>
chore: release v1.16.0 [version bump] [skip ci]</li>
<li><a
href="https://github.com/PostHog/posthog-go/commit/1068ec9006b371d517e5515972c0ea8f8d604e3e"><code>1068ec9</code></a>
feat: add before send hook (<a
href="https://redirect.github.com/posthog/posthog-go/issues/224">#224</a>)</li>
<li><a
href="https://github.com/PostHog/posthog-go/commit/36d1928b5732d99687c9c4a17daee937a5f3753c"><code>36d1928</code></a>
test: stabilize race-mode tests (<a
href="https://redirect.github.com/posthog/posthog-go/issues/227">#227</a>)</li>
<li><a
href="https://github.com/PostHog/posthog-go/commit/e1d47eabc4b4a722f629d037e4c434c6840dbc86"><code>e1d47ea</code></a>
chore: Template SDK version in API snapshot (<a
href="https://redirect.github.com/posthog/posthog-go/issues/226">#226</a>)</li>
<li>See full diff in <a
href="https://github.com/posthog/posthog-go/compare/v1.15.1...v1.16.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/posthog/posthog-go&package-manager=go_modules&previous-version=1.15.1&new-version=1.16.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 apps/cli-go/go.mod | 2 +-
 apps/cli-go/go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/apps/cli-go/go.mod b/apps/cli-go/go.mod
index 3da2229523..ad4638aa6a 100644
--- a/apps/cli-go/go.mod
+++ b/apps/cli-go/go.mod
@@ -42,7 +42,7 @@ require (
 	github.com/multigres/multigres v0.0.0-20260126223308-f5a52171bbc4
 	github.com/oapi-codegen/nullable v1.1.0
 	github.com/olekukonko/tablewriter v1.1.4
-	github.com/posthog/posthog-go v1.15.1
+	github.com/posthog/posthog-go v1.16.0
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
diff --git a/apps/cli-go/go.sum b/apps/cli-go/go.sum
index 043956a8ad..9fc5523b06 100644
--- a/apps/cli-go/go.sum
+++ b/apps/cli-go/go.sum
@@ -941,8 +941,8 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/polyfloyd/go-errorlint v1.8.0 h1:DL4RestQqRLr8U4LygLw8g2DX6RN1eBJOpa2mzsrl1Q=
 github.com/polyfloyd/go-errorlint v1.8.0/go.mod h1:G2W0Q5roxbLCt0ZQbdoxQxXktTjwNyDbEaj3n7jvl4s=
-github.com/posthog/posthog-go v1.15.1 h1:9rwjaEzyp5mss/fp0vYjLOhIaXCikfgRHRSzMMHgwJ8=
-github.com/posthog/posthog-go v1.15.1/go.mod h1:xsVOW9YImilUcazwPNEq4PJDqEZf2KeCS758zXjwkPg=
+github.com/posthog/posthog-go v1.16.0 h1:sU6ifnBcyjiqCGwz92b1A1uKnSALZIFeFn/YnPfTyF8=
+github.com/posthog/posthog-go v1.16.0/go.mod h1:xsVOW9YImilUcazwPNEq4PJDqEZf2KeCS758zXjwkPg=
 github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
 github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
 github.com/prometheus/client_golang v0.9.0-pre1.0.20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=

From 279d0c0484038f24dbf5e77024eaf00919edc2b6 Mon Sep 17 00:00:00 2001
From: Vaibhav <117663341+7ttp@users.noreply.github.com>
Date: Fri, 26 Jun 2026 21:24:54 +0530
Subject: [PATCH 14/29] fix(cli): shorten serve argv (#5712)

## TL;DR

fixes a regression in `supabase functions serve` by removing the bundled
Edge Runtime bootstrap script from the spawned `docker run ... sh -c
...` argv and mounting it into the container as `/root/index.ts` instead

This keeps the startup command small, preserves the runtime behavior,
and avoids the `ENAMETOOLONG: name too long, uv_spawn` failure...

## What's fixed?

`functions serve` ts path was embedding the full bundled runtime
template directly into the docker entrypoint command

on win, that made the final spawn argv large enough to fail before
docker even started,
which surfaced as `ENAMETOOLONG: name too long, uv_spawn`

**Before:**

the runtime template was embedded directly into the docker startup
command and hit spawn length limits

**After:**

the template is mounted from a temp file, so the startup command stays
short
## ref:

- closes https://github.com/supabase/cli/issues/5711
---
 .../functions/serve/serve.integration.test.ts | 17 ++++-
 apps/cli/src/shared/functions/serve.ts        | 64 +++++++++----------
 .../src/shared/functions/serve.unit.test.ts   | 32 ++++------
 3 files changed, 56 insertions(+), 57 deletions(-)

diff --git a/apps/cli/src/legacy/commands/functions/serve/serve.integration.test.ts b/apps/cli/src/legacy/commands/functions/serve/serve.integration.test.ts
index d234aa388f..be575f1409 100644
--- a/apps/cli/src/legacy/commands/functions/serve/serve.integration.test.ts
+++ b/apps/cli/src/legacy/commands/functions/serve/serve.integration.test.ts
@@ -477,6 +477,14 @@ describe("legacy functions serve integration", () => {
         expect(dockerRun.args).toContain("--add-host");
         expect(dockerRun.args).toContain("host.docker.internal:host-gateway");
         expect(dockerRun.args).toContain("public.ecr.aws/supabase/edge-runtime:v1.73.13");
+        expect(
+          extractFlagValues(dockerRun.args, "-v").some((value) =>
+            value.endsWith(":/root/index.ts:ro"),
+          ),
+        ).toBe(true);
+        expect(dockerRun.args[dockerRun.args.length - 1]).toBe(
+          "edge-runtime start --main-service=/root --port=8081 --policy=per_worker\n",
+        );
 
         const envs = yield* Effect.promise(() => extractDockerEnvEntries(dockerRun));
         expect(envs).toContain("HELLO=WORLD");
@@ -1147,7 +1155,14 @@ describe("legacy functions serve integration", () => {
       }
 
       const commandScript = dockerRun.args[dockerRun.args.length - 1] ?? "";
-      expect(commandScript).toContain("cat <<'EOF' > /root/index.ts");
+      expect(commandScript).toBe(
+        "edge-runtime start --main-service=/root --port=8081 --policy=per_worker\n",
+      );
+      expect(
+        extractFlagValues(dockerRun.args, "-v").some((value) =>
+          value.endsWith(":/root/index.ts:ro"),
+        ),
+      ).toBe(true);
       expect(commandScript).not.toContain("@ts-nocheck");
       expect(commandScript).not.toContain("declare const Deno");
       expect(commandScript).not.toContain("declare const EdgeRuntime");
diff --git a/apps/cli/src/shared/functions/serve.ts b/apps/cli/src/shared/functions/serve.ts
index 057f878e9a..91874fb603 100644
--- a/apps/cli/src/shared/functions/serve.ts
+++ b/apps/cli/src/shared/functions/serve.ts
@@ -85,6 +85,7 @@ const dockerLogDiagnosticTailLength = 4_096;
 const remoteJwksTimeoutMs = 10_000;
 const legacyDefaultEdgeRuntimeVersion = "v1.74.1";
 const defaultSupabaseEnv = "development";
+const serveMainContainerPath = "/root/index.ts";
 const clerkDomainPattern = /^(clerk([.][a-z0-9-]+){2,}|([a-z0-9-]+[.])+clerk[.]accounts[.]dev)$/;
 const shellVariableNamePattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
 let cachedLegacyFunctionsServeMainTemplate: string | undefined;
@@ -1229,30 +1230,26 @@ const writeStoppedServingMessage = Effect.fnUntraced(function* () {
   yield* output.raw(`Stopped serving ${styleText("bold", functionsDirName)}\n`, "stdout");
 });
 
-// The Go CLI writes the runtime template to /root/index.ts via a quoted `<<'EOF'`
-// heredoc; we keep the same terminator for byte-parity with its entrypoint. A line
-// equal to the terminator inside the template would close the heredoc early and
-// silently corrupt the script, so fail loudly instead. `serve.main.ts` (the only
-// template) is asserted to contain no such line by a unit test.
-const serveEntrypointHeredocTerminator = "EOF";
-
-export function buildServeEntrypointScript(
-  template: string,
+export function buildServeEntrypointCommand(
   command: ReadonlyArray<string>,
   multilineEnvScriptPath?: string,
 ) {
-  if (template.split("\n").includes(serveEntrypointHeredocTerminator)) {
-    throw new Error(
-      `functions serve runtime template contains a line equal to the heredoc terminator "${serveEntrypointHeredocTerminator}"`,
-    );
-  }
-  return `cat <<'${serveEntrypointHeredocTerminator}' > /root/index.ts
-${template}
-${serveEntrypointHeredocTerminator}
-${multilineEnvScriptPath === undefined ? "" : `. ${multilineEnvScriptPath}\n`}${command.join(" ")}
+  return `${multilineEnvScriptPath === undefined ? "" : `. ${multilineEnvScriptPath}\n`}${command.join(" ")}
 `;
 }
 
+async function writeServeMainTemplateFile(template: string) {
+  // Mount the bundled runtime template instead of embedding it in `sh -c` so
+  // Windows does not hit `uv_spawn` ENAMETOOLONG on path-heavy projects.
+  const dir = await mkdtemp(join(tmpdir(), "supabase-functions-serve-main-"));
+  const pathname = join(dir, "index.ts");
+  await writeFile(pathname, template);
+  return {
+    bind: `${pathname}:${serveMainContainerPath}:ro`,
+    cleanup: () => rm(dir, { recursive: true, force: true }),
+  } as const;
+}
+
 function edgeRuntimeImageTag(version: string) {
   return version.startsWith("v") ? version : `v${version}`;
 }
@@ -1420,6 +1417,9 @@ const startEdgeRuntime = Effect.fnUntraced(function* (input: {
       ...(input.debug ? ["--verbose"] : []),
     ];
     const serveMainTemplate = yield* Effect.promise(() => getLegacyFunctionsServeMainTemplate());
+    const serveMainTemplateFile = yield* Effect.tryPromise(() =>
+      writeServeMainTemplateFile(serveMainTemplate),
+    ).pipe(Effect.mapError((cause) => (cause instanceof Error ? cause : new Error(String(cause)))));
     const command = [
       "run",
       "-d",
@@ -1437,6 +1437,8 @@ const startEdgeRuntime = Effect.fnUntraced(function* (input: {
       `com.supabase.cli.project=${labels["com.supabase.cli.project"]}`,
       "--label",
       `com.docker.compose.project=${labels["com.docker.compose.project"]}`,
+      "-v",
+      serveMainTemplateFile.bind,
       ...([...binds] as ReadonlyArray<string>).flatMap((bind) => ["-v", bind]),
       ...(dockerMultilineEnvScript === undefined ? [] : ["-v", dockerMultilineEnvScript.bind]),
       ...(dockerEnvFile === undefined ? [] : ["--env-file", dockerEnvFile.path]),
@@ -1450,26 +1452,18 @@ const startEdgeRuntime = Effect.fnUntraced(function* (input: {
       "sh",
       legacyGetRegistryImageUrl(`supabase/edge-runtime:${edgeRuntimeImageTag(edgeRuntimeVersion)}`),
       "-c",
-      buildServeEntrypointScript(
-        serveMainTemplate,
-        runtimeCommand,
-        dockerMultilineEnvScript?.scriptPath,
-      ),
+      buildServeEntrypointCommand(runtimeCommand, dockerMultilineEnvScript?.scriptPath),
     ];
 
-    const cleanupRuntimeArtifacts =
+    const cleanupRuntimeArtifacts = Effect.all([
+      Effect.tryPromise(() => serveMainTemplateFile.cleanup()).pipe(Effect.orDie),
       dockerEnvFile === undefined
-        ? dockerMultilineEnvScript === undefined
-          ? Effect.void
-          : Effect.tryPromise(() => dockerMultilineEnvScript.cleanup()).pipe(Effect.orDie)
-        : Effect.tryPromise(() => dockerEnvFile.cleanup()).pipe(
-            Effect.andThen(
-              dockerMultilineEnvScript === undefined
-                ? Effect.void
-                : Effect.tryPromise(() => dockerMultilineEnvScript.cleanup()).pipe(Effect.orDie),
-            ),
-            Effect.orDie,
-          );
+        ? Effect.void
+        : Effect.tryPromise(() => dockerEnvFile.cleanup()).pipe(Effect.orDie),
+      dockerMultilineEnvScript === undefined
+        ? Effect.void
+        : Effect.tryPromise(() => dockerMultilineEnvScript.cleanup()).pipe(Effect.orDie),
+    ]).pipe(Effect.asVoid);
 
     return yield* Effect.gen(function* () {
       yield* output.raw("Setting up Edge Functions runtime...\n", "stderr");
diff --git a/apps/cli/src/shared/functions/serve.unit.test.ts b/apps/cli/src/shared/functions/serve.unit.test.ts
index f265c28412..a12ac1b9db 100644
--- a/apps/cli/src/shared/functions/serve.unit.test.ts
+++ b/apps/cli/src/shared/functions/serve.unit.test.ts
@@ -1,34 +1,24 @@
 import { describe, expect, it } from "vitest";
 
 import { bundleServeMainTemplate } from "./serve-main-bundler.ts";
-import { buildServeEntrypointScript } from "./serve.ts";
+import { buildServeEntrypointCommand } from "./serve.ts";
 
-describe("buildServeEntrypointScript", () => {
-  const template = ['import { x } from "y";', "Deno.serve(() => new Response());"].join("\n");
-
-  it("writes the template through the heredoc and appends the runtime command", () => {
-    const script = buildServeEntrypointScript(template, ["edge-runtime", "start"]);
-    expect(script).toContain("cat <<'EOF' > /root/index.ts");
-    expect(script).toContain(template);
-    expect(script).toContain("edge-runtime start");
-    expect(script).not.toContain(". /");
+describe("buildServeEntrypointCommand", () => {
+  it("returns the runtime command without embedding the template body", () => {
+    const script = buildServeEntrypointCommand(["edge-runtime", "start"]);
+    expect(script).toBe("edge-runtime start\n");
+    expect(script).not.toContain("Deno.serve");
   });
 
   it("sources the multiline env script before the runtime command when provided", () => {
-    const script = buildServeEntrypointScript(template, ["edge-runtime", "start"], "/root/env.sh");
+    const script = buildServeEntrypointCommand(["edge-runtime", "start"], "/root/env.sh");
     expect(script).toContain(". /root/env.sh\nedge-runtime start");
   });
 
-  it("fails loudly when the template contains a bare heredoc terminator line", () => {
-    const poisoned = ["line-1", "EOF", "line-3"].join("\n");
-    expect(() => buildServeEntrypointScript(poisoned, ["edge-runtime", "start"])).toThrow(
-      'heredoc terminator "EOF"',
-    );
-  });
-
-  it("does not let the real bundled serve.main.ts template close the heredoc early", async () => {
+  it("keeps the spawned command short even with the real bundled template", async () => {
     const bundled = await bundleServeMainTemplate();
-    expect(bundled.split("\n")).not.toContain("EOF");
-    expect(() => buildServeEntrypointScript(bundled, ["edge-runtime", "start"])).not.toThrow();
+    const script = buildServeEntrypointCommand(["edge-runtime", "start"]);
+    expect(bundled.length).toBeGreaterThan(20_000);
+    expect(script.length).toBeLessThan(128);
   });
 });

From 64df2ba83785d849fd230ef7aea7cf5a60de63c4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 27 Jun 2026 00:07:39 +0000
Subject: [PATCH 15/29] fix(docker): bump the docker-minor group in
 /apps/cli-go/pkg/config/templates with 2 updates (#5717)

Bumps the docker-minor group in /apps/cli-go/pkg/config/templates with 2
updates: supabase/realtime and supabase/storage-api.

Updates `supabase/realtime` from v2.111.10 to v2.112.0

Updates `supabase/storage-api` from v1.61.4 to v1.61.5


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 apps/cli-go/pkg/config/templates/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/cli-go/pkg/config/templates/Dockerfile b/apps/cli-go/pkg/config/templates/Dockerfile
index 0e496091a5..b6dbed42a8 100644
--- a/apps/cli-go/pkg/config/templates/Dockerfile
+++ b/apps/cli-go/pkg/config/templates/Dockerfile
@@ -11,8 +11,8 @@ FROM supabase/edge-runtime:v1.74.2 AS edgeruntime
 FROM timberio/vector:0.53.0-alpine AS vector
 FROM supabase/supavisor:2.9.7 AS supavisor
 FROM supabase/gotrue:v2.191.0 AS gotrue
-FROM supabase/realtime:v2.111.10 AS realtime
-FROM supabase/storage-api:v1.61.4 AS storage
+FROM supabase/realtime:v2.112.0 AS realtime
+FROM supabase/storage-api:v1.61.5 AS storage
 FROM supabase/logflare:1.45.4 AS logflare
 # Append to JobImages when adding new dependencies below
 FROM supabase/pgadmin-schema-diff:cli-0.0.5 AS differ

From 47ab46d6f95b5bae9bde6f9f9619392aaea3282a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 27 Jun 2026 00:08:33 +0000
Subject: [PATCH 16/29] chore(deps): bump github.com/posthog/posthog-go from
 1.16.0 to 1.16.1 in /apps/cli-go in the go-minor group across 1 directory
 (#5718)

Bumps the go-minor group with 1 update in the /apps/cli-go directory:
[github.com/posthog/posthog-go](https://github.com/posthog/posthog-go).

Updates `github.com/posthog/posthog-go` from 1.16.0 to 1.16.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/posthog/posthog-go/releases">github.com/posthog/posthog-go's
releases</a>.</em></p>
<blockquote>
<h2>1.16.1</h2>
<h2>Unreleased</h2>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/PostHog/posthog-go/blob/main/CHANGELOG.md">github.com/posthog/posthog-go's
changelog</a>.</em></p>
<blockquote>
<h2>1.16.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>922cfff: Validate user-supplied event UUIDs before sending and
generate a fallback UUID when invalid.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/PostHog/posthog-go/commit/4e2ddac87f0b580ace1d1dd79a94b481ae797315"><code>4e2ddac</code></a>
chore: release v1.16.1 [version bump] [skip ci]</li>
<li><a
href="https://github.com/PostHog/posthog-go/commit/922cfff977077a014a15b78a70cd8becadb17c71"><code>922cfff</code></a>
fix: validate supplied event UUIDs (<a
href="https://redirect.github.com/posthog/posthog-go/issues/233">#233</a>)</li>
<li>See full diff in <a
href="https://github.com/posthog/posthog-go/compare/v1.16.0...v1.16.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/posthog/posthog-go&package-manager=go_modules&previous-version=1.16.0&new-version=1.16.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 apps/cli-go/go.mod | 2 +-
 apps/cli-go/go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/apps/cli-go/go.mod b/apps/cli-go/go.mod
index ad4638aa6a..23a73ea8ad 100644
--- a/apps/cli-go/go.mod
+++ b/apps/cli-go/go.mod
@@ -42,7 +42,7 @@ require (
 	github.com/multigres/multigres v0.0.0-20260126223308-f5a52171bbc4
 	github.com/oapi-codegen/nullable v1.1.0
 	github.com/olekukonko/tablewriter v1.1.4
-	github.com/posthog/posthog-go v1.16.0
+	github.com/posthog/posthog-go v1.16.1
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
diff --git a/apps/cli-go/go.sum b/apps/cli-go/go.sum
index 9fc5523b06..66726ca0a8 100644
--- a/apps/cli-go/go.sum
+++ b/apps/cli-go/go.sum
@@ -941,8 +941,8 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/polyfloyd/go-errorlint v1.8.0 h1:DL4RestQqRLr8U4LygLw8g2DX6RN1eBJOpa2mzsrl1Q=
 github.com/polyfloyd/go-errorlint v1.8.0/go.mod h1:G2W0Q5roxbLCt0ZQbdoxQxXktTjwNyDbEaj3n7jvl4s=
-github.com/posthog/posthog-go v1.16.0 h1:sU6ifnBcyjiqCGwz92b1A1uKnSALZIFeFn/YnPfTyF8=
-github.com/posthog/posthog-go v1.16.0/go.mod h1:xsVOW9YImilUcazwPNEq4PJDqEZf2KeCS758zXjwkPg=
+github.com/posthog/posthog-go v1.16.1 h1:uEbaaYT361a3ImI0D1DYUyNLWN7Y9V9gLqCbQ/z5SxQ=
+github.com/posthog/posthog-go v1.16.1/go.mod h1:xsVOW9YImilUcazwPNEq4PJDqEZf2KeCS758zXjwkPg=
 github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
 github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
 github.com/prometheus/client_golang v0.9.0-pre1.0.20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=

From 0084d6e18cf32a2819c3272237f788a84fb70010 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 28 Jun 2026 00:08:51 +0000
Subject: [PATCH 17/29] chore(deps): bump github.com/oapi-codegen/runtime from
 1.4.1 to 1.4.2 in /apps/cli-go in the go-minor group across 1 directory
 (#5719)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the go-minor group with 1 update in the /apps/cli-go/pkg
directory:
[github.com/oapi-codegen/runtime](https://github.com/oapi-codegen/runtime).

Updates `github.com/oapi-codegen/runtime` from 1.4.1 to 1.4.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oapi-codegen/runtime/releases">github.com/oapi-codegen/runtime's
releases</a>.</em></p>
<blockquote>
<h2>Bug fix for required parameters</h2>
<p>This is a bug fix to address a regression introduced in oapi-codegen
v2.7.0</p>
<h2>🐛 Bug fixes</h2>
<ul>
<li>Add missing required parameter detection (<a
href="https://redirect.github.com/oapi-codegen/runtime/issues/135">#135</a>)
<a
href="https://github.com/mromaszewicz"><code>@​mromaszewicz</code></a></li>
</ul>
<h2>Sponsors</h2>
<p>We would like to thank our sponsors for their support during this
release.</p>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oapi-codegen/runtime/commit/7afeea85927be046b4a5c27cf9ae6b2cd754453c"><code>7afeea8</code></a>
Add missing required parameter detection (<a
href="https://redirect.github.com/oapi-codegen/runtime/issues/135">#135</a>)</li>
<li>See full diff in <a
href="https://github.com/oapi-codegen/runtime/compare/v1.4.1...v1.4.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/oapi-codegen/runtime&package-manager=go_modules&previous-version=1.4.1&new-version=1.4.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 apps/cli-go/go.mod     | 2 +-
 apps/cli-go/go.sum     | 4 ++--
 apps/cli-go/pkg/go.mod | 2 +-
 apps/cli-go/pkg/go.sum | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/apps/cli-go/go.mod b/apps/cli-go/go.mod
index 23a73ea8ad..4eae3aa6cb 100644
--- a/apps/cli-go/go.mod
+++ b/apps/cli-go/go.mod
@@ -334,7 +334,7 @@ require (
 	github.com/nishanths/predeclared v0.2.2 // indirect
 	github.com/nunnatsa/ginkgolinter v0.19.1 // indirect
 	github.com/oapi-codegen/oapi-codegen/v2 v2.4.1 // indirect
-	github.com/oapi-codegen/runtime v1.4.1 // indirect
+	github.com/oapi-codegen/runtime v1.4.2 // indirect
 	github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect
 	github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect
 	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
diff --git a/apps/cli-go/go.sum b/apps/cli-go/go.sum
index 66726ca0a8..ba611b836c 100644
--- a/apps/cli-go/go.sum
+++ b/apps/cli-go/go.sum
@@ -865,8 +865,8 @@ github.com/oapi-codegen/nullable v1.1.0 h1:eAh8JVc5430VtYVnq00Hrbpag9PFRGWLjxR1/
 github.com/oapi-codegen/nullable v1.1.0/go.mod h1:KUZ3vUzkmEKY90ksAmit2+5juDIhIZhfDl+0PwOQlFY=
 github.com/oapi-codegen/oapi-codegen/v2 v2.4.1 h1:ykgG34472DWey7TSjd8vIfNykXgjOgYJZoQbKfEeY/Q=
 github.com/oapi-codegen/oapi-codegen/v2 v2.4.1/go.mod h1:N5+lY1tiTDV3V1BeHtOxeWXHoPVeApvsvjJqegfoaz8=
-github.com/oapi-codegen/runtime v1.4.1 h1:9nwLoI+KrWxzbBcp0jO/R8uXqbik/HUyCvPeU68Y/qo=
-github.com/oapi-codegen/runtime v1.4.1/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
+github.com/oapi-codegen/runtime v1.4.2 h1:GMxFVYLzoYLua+/KvzgSphkyK1lLTReQI9Vf4hvATKE=
+github.com/oapi-codegen/runtime v1.4.2/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
 github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 h1:G7ERwszslrBzRxj//JalHPu/3yz+De2J+4aLtSRlHiY=
 github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037/go.mod h1:2bpvgLBZEtENV5scfDFEtB/5+1M4hkQhDQrccEJ/qGw=
 github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 h1:bQx3WeLcUWy+RletIKwUIt4x3t8n2SxavmoclizMb8c=
diff --git a/apps/cli-go/pkg/go.mod b/apps/cli-go/pkg/go.mod
index 1a3f84dd34..e1bb10f8ca 100644
--- a/apps/cli-go/pkg/go.mod
+++ b/apps/cli-go/pkg/go.mod
@@ -20,7 +20,7 @@ require (
 	github.com/jackc/pgx/v4 v4.18.3
 	github.com/joho/godotenv v1.5.1
 	github.com/oapi-codegen/nullable v1.1.0
-	github.com/oapi-codegen/runtime v1.4.1
+	github.com/oapi-codegen/runtime v1.4.2
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/viper v1.21.0
 	github.com/stretchr/testify v1.11.1
diff --git a/apps/cli-go/pkg/go.sum b/apps/cli-go/pkg/go.sum
index bed1b36aba..f34fbaeeef 100644
--- a/apps/cli-go/pkg/go.sum
+++ b/apps/cli-go/pkg/go.sum
@@ -132,8 +132,8 @@ github.com/nbio/st v0.0.0-20140626010706-e9e8d9816f32 h1:W6apQkHrMkS0Muv8G/TipAy
 github.com/nbio/st v0.0.0-20140626010706-e9e8d9816f32/go.mod h1:9wM+0iRr9ahx58uYLpLIr5fm8diHn0JbqRycJi6w0Ms=
 github.com/oapi-codegen/nullable v1.1.0 h1:eAh8JVc5430VtYVnq00Hrbpag9PFRGWLjxR1/3KntMs=
 github.com/oapi-codegen/nullable v1.1.0/go.mod h1:KUZ3vUzkmEKY90ksAmit2+5juDIhIZhfDl+0PwOQlFY=
-github.com/oapi-codegen/runtime v1.4.1 h1:9nwLoI+KrWxzbBcp0jO/R8uXqbik/HUyCvPeU68Y/qo=
-github.com/oapi-codegen/runtime v1.4.1/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
+github.com/oapi-codegen/runtime v1.4.2 h1:GMxFVYLzoYLua+/KvzgSphkyK1lLTReQI9Vf4hvATKE=
+github.com/oapi-codegen/runtime v1.4.2/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=

From 44705dfa204ab25908844385a82d9951df0a7943 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 00:19:17 +0000
Subject: [PATCH 18/29] chore(deps): bump the npm-major group with 26 updates
 (#5720)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the npm-major group with 26 updates:

| Package | From | To |
| --- | --- | --- |
| [verdaccio](https://github.com/verdaccio/verdaccio) | `6.7.2` |
`6.7.4` |
| [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.6.1` |
`1.7.0` |
|
[@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js)
| `2.108.1` | `2.108.2` |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.177` | `0.3.185` |
|
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript)
| `0.104.1` | `0.105.0` |
|
[@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts)
| `1.5.1` | `1.6.0` |
| [ink](https://github.com/vadimdemedes/ink) | `7.0.6` | `7.1.0` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) |
`8.21.0` | `8.22.0` |
|
[posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node)
| `5.37.0` | `5.38.2` |
| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.10.2` |
`16.10.5` |
| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.10.2` |
`16.10.5` |
|
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
| `25.9.3` | `26.0.0` |
|
[@effect/atom-react](https://github.com/Effect-TS/effect-smol/tree/HEAD/packages/atom/react)
| `4.0.0-beta.83` | `4.0.0-beta.85` |
|
[@effect/platform-bun](https://github.com/Effect-TS/effect/tree/HEAD/packages/platform-bun)
| `4.0.0-beta.83` | `4.0.0-beta.85` |
|
[@effect/platform-node](https://github.com/Effect-TS/effect/tree/HEAD/packages/platform-node)
| `4.0.0-beta.83` | `4.0.0-beta.85` |
|
[@effect/sql-pg](https://github.com/Effect-TS/effect/tree/HEAD/packages/sql-pg)
| `4.0.0-beta.83` | `4.0.0-beta.85` |
|
[@effect/vitest](https://github.com/Effect-TS/effect/tree/HEAD/packages/vitest)
| `4.0.0-beta.84` | `4.0.0-beta.85` |
| [@nx/devkit](https://github.com/nrwl/nx/tree/HEAD/packages/devkit) |
`22.7.5` | `23.0.0` |
|
[@typescript/native-preview](https://github.com/microsoft/typescript-go)
| `7.0.0-dev.20260614.1` | `7.0.0-dev.20260621.1` |
|
[@vitest/coverage-istanbul](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-istanbul)
| `4.1.8` | `4.1.9` |
|
[effect](https://github.com/Effect-TS/effect/tree/HEAD/packages/effect)
| `4.0.0-beta.83` | `4.0.0-beta.85` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) |
`6.16.1` | `6.17.1` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) |
`0.54.0` | `0.55.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) |
`1.69.0` | `1.70.0` |
| [tldts](https://github.com/remusao/tldts) | `6.1.86` | `7.4.3` |
|
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)
| `4.1.8` | `4.1.9` |

Updates `verdaccio` from 6.7.2 to 6.7.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/verdaccio/verdaccio/releases">verdaccio's
releases</a>.</em></p>
<blockquote>
<h2>v6.7.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>0205c78: fix: run jwt middleware before middleware plugins</p>
<p>Register the JWT middleware before middleware plugins are loaded so
that
<code>req.remote_user</code> (anonymous by default) is available inside
a plugin's
<code>register_middlewares</code>. The API router keeps its own JWT
middleware behind a
guard so it is not executed twice.</p>
<p>Backport of <a
href="https://redirect.github.com/verdaccio/verdaccio/pull/5697">verdaccio/verdaccio#5697</a></p>
<p>Closes <a
href="https://redirect.github.com/verdaccio/verdaccio/issues/5167">#5167</a></p>
</li>
</ul>
<h2>v6.7.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>f8fdfc2: fix: enforce generated npm token metadata</p>
<p>Generated npm tokens (<code>POST /-/npm/v1/tokens</code>) stored
their <code>readonly</code> and
<code>cidr_whitelist</code> restrictions but never enforced them, and
deleting a token did
not revoke it for the package APIs. A token marked read-only or pinned
to a CIDR
range could still publish packages and change dist-tags, and a deleted
token
remained usable.</p>
<p>Generated tokens now embed a server-issued key (in the JWT claim, or
in the
encrypted legacy AES payload) and a new
<code>enforceGeneratedTokenMetadata</code>
middleware looks that key up on each request, rejecting the token when
it is
missing/revoked, used outside its CIDR whitelist, or used for a write
while
read-only. Enforcement applies to both AES and JWT API-token modes.</p>
<p>Note: tokens issued before upgrading carry no key and are not
retroactively
constrained — regenerate them to apply the restrictions.</p>
</li>
<li>
<p>be80623: fix: allow npm token create without
readonly/cidr_whitelist</p>
<p><code>npm token create</code> in npm &gt;= 11 (and the npm 12
prereleases) rewrote the
request body: it no longer sends <code>readonly</code> and only sends
<code>cidr_whitelist</code>
when <code>--cidr</code> is passed. The <code>POST
/-/npm/v1/tokens</code> endpoint required both,
so modern npm clients failed with <code>422 the parameters are not
valid</code>.</p>
<p>The endpoint now defaults <code>readonly</code> to <code>false</code>
and <code>cidr_whitelist</code> to <code>[]</code>
when they are absent, while still rejecting values of the wrong
type.</p>
</li>
<li>
<p>75c85d5: Update verdaccio dependencies to the <code>latest</code> npm
dist-tag (<code>@verdaccio/ui-theme</code> tracks
<code>next-9</code>):</p>
<ul>
<li><code>@verdaccio/ui-theme</code>: <code>9.0.0-next-9.19</code> →
<code>9.0.0-next-9.20</code></li>
</ul>
</li>
<li>
<p>d5e5332: chore: update dependencies</p>
<p>Updates runtime dependencies <code>@verdaccio/ui-theme</code>
(<code>9.0.0-next-9.19</code>) and</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/verdaccio/verdaccio/blob/v6.7.4/CHANGELOG.md">verdaccio's
changelog</a>.</em></p>
<blockquote>
<h2>6.7.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>0205c78: fix: run jwt middleware before middleware plugins</p>
<p>Register the JWT middleware before middleware plugins are loaded so
that
<code>req.remote_user</code> (anonymous by default) is available inside
a plugin's
<code>register_middlewares</code>. The API router keeps its own JWT
middleware behind a
guard so it is not executed twice.</p>
<p>Backport of <a
href="https://redirect.github.com/verdaccio/verdaccio/pull/5697">verdaccio/verdaccio#5697</a></p>
<p>Closes <a
href="https://redirect.github.com/verdaccio/verdaccio/issues/5167">#5167</a></p>
</li>
</ul>
<h2>6.7.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>f8fdfc2: fix: enforce generated npm token metadata</p>
<p>Generated npm tokens (<code>POST /-/npm/v1/tokens</code>) stored
their <code>readonly</code> and
<code>cidr_whitelist</code> restrictions but never enforced them, and
deleting a token did
not revoke it for the package APIs. A token marked read-only or pinned
to a CIDR
range could still publish packages and change dist-tags, and a deleted
token
remained usable.</p>
<p>Generated tokens now embed a server-issued key (in the JWT claim, or
in the
encrypted legacy AES payload) and a new
<code>enforceGeneratedTokenMetadata</code>
middleware looks that key up on each request, rejecting the token when
it is
missing/revoked, used outside its CIDR whitelist, or used for a write
while
read-only. Enforcement applies to both AES and JWT API-token modes.</p>
<p>Note: tokens issued before upgrading carry no key and are not
retroactively
constrained — regenerate them to apply the restrictions.</p>
</li>
<li>
<p>be80623: fix: allow npm token create without
readonly/cidr_whitelist</p>
<p><code>npm token create</code> in npm &gt;= 11 (and the npm 12
prereleases) rewrote the
request body: it no longer sends <code>readonly</code> and only sends
<code>cidr_whitelist</code>
when <code>--cidr</code> is passed. The <code>POST
/-/npm/v1/tokens</code> endpoint required both,
so modern npm clients failed with <code>422 the parameters are not
valid</code>.</p>
<p>The endpoint now defaults <code>readonly</code> to <code>false</code>
and <code>cidr_whitelist</code> to <code>[]</code>
when they are absent, while still rejecting values of the wrong
type.</p>
</li>
<li>
<p>75c85d5: Update verdaccio dependencies to the <code>latest</code> npm
dist-tag (<code>@verdaccio/ui-theme</code> tracks
<code>next-9</code>):</p>
<ul>
<li><code>@verdaccio/ui-theme</code>: <code>9.0.0-next-9.19</code> →
<code>9.0.0-next-9.20</code></li>
</ul>
</li>
<li>
<p>d5e5332: chore: update dependencies</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/verdaccio/verdaccio/commit/9570db1b87dfe9534121533f2d7f7f8efc782cf4"><code>9570db1</code></a>
chore: release 6.x (<a
href="https://redirect.github.com/verdaccio/verdaccio/issues/5963">#5963</a>)</li>
<li><a
href="https://github.com/verdaccio/verdaccio/commit/0205c78c37dfa2e3d0722f7b96b3cecf51bf08f6"><code>0205c78</code></a>
fix: run jwt middleware before middleware plugins (<a
href="https://redirect.github.com/verdaccio/verdaccio/issues/5962">#5962</a>)</li>
<li><a
href="https://github.com/verdaccio/verdaccio/commit/9d924e7e8a6aaddc65fd265f3309e58edcf208bb"><code>9d924e7</code></a>
chore: release 6.x (<a
href="https://redirect.github.com/verdaccio/verdaccio/issues/5950">#5950</a>)</li>
<li><a
href="https://github.com/verdaccio/verdaccio/commit/75c85d561a2025b0f345be13b394225bbf512638"><code>75c85d5</code></a>
chore: update verdaccio 6.x dependencies (<a
href="https://redirect.github.com/verdaccio/verdaccio/issues/5961">#5961</a>)</li>
<li><a
href="https://github.com/verdaccio/verdaccio/commit/d5e5332841ea8747924ca0c5d06b62db8f0720b3"><code>d5e5332</code></a>
fix: update core dependencies (<a
href="https://redirect.github.com/verdaccio/verdaccio/issues/5952">#5952</a>)</li>
<li><a
href="https://github.com/verdaccio/verdaccio/commit/be8062350fab80cbbcd4de8c6d3c819e6f86cee7"><code>be80623</code></a>
fix: allow npm token create without readonly/cidr_whitelist (<a
href="https://redirect.github.com/verdaccio/verdaccio/issues/5951">#5951</a>)</li>
<li><a
href="https://github.com/verdaccio/verdaccio/commit/f8fdfc2d97f3abd7d328a67c7090a31124c42502"><code>f8fdfc2</code></a>
fix: enforce generated npm token metadata (<a
href="https://redirect.github.com/verdaccio/verdaccio/issues/5945">#5945</a>)</li>
<li><a
href="https://github.com/verdaccio/verdaccio/commit/b491e8425f10d303c5ecab5c509ffc830269f2a6"><code>b491e84</code></a>
chore: update ci settings</li>
<li><a
href="https://github.com/verdaccio/verdaccio/commit/3a6c39389ec4393458d30c3863acc1802406f7da"><code>3a6c393</code></a>
chore: update ci settings</li>
<li><a
href="https://github.com/verdaccio/verdaccio/commit/b319f7ef6ae5cc22349998ef44e904a187b1d02d"><code>b319f7e</code></a>
fix(deps): update dependency express to v4.22.2 (<a
href="https://redirect.github.com/verdaccio/verdaccio/issues/5902">#5902</a>)</li>
<li>See full diff in <a
href="https://github.com/verdaccio/verdaccio/compare/v6.7.2...v6.7.4">compare
view</a></li>
</ul>
</details>
<br />

Updates `smol-toml` from 1.6.1 to 1.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/squirrelchat/smol-toml/releases">smol-toml's
releases</a>.</em></p>
<blockquote>
<h2>v1.7.0</h2>
<p>This version slightly changes the behaviour of stringify: integers
beyond the safe range are always emitted as float numbers.</p>
<p>String decode logic has been rewritten, it is a bit faster now and
uses a single-pass approach instead of a dual-pass approach as it did
previously. The code should be a bit smaller too, though I didn't
actually measure that.</p>
<p>The package is now published with source-maps, declaration-maps, and
a copy of the original TypeScript source files. This will improve your
DX if you're like me and like Ctrl+Click'ing things a lot. ;)</p>
<h2>What's Changed</h2>
<ul>
<li>improve performance of the string decode logic by <a
href="https://github.com/cyyynthia"><code>@​cyyynthia</code></a></li>
<li>fix(stringify): emit integer-valued numbers beyond the safe-integer
range as floats by <a
href="https://github.com/spokodev"><code>@​spokodev</code></a> in <a
href="https://redirect.github.com/squirrelchat/smol-toml/pull/56">squirrelchat/smol-toml#56</a></li>
<li>publish source-maps, declaration-maps, and original source files by
<a href="https://github.com/cyyynthia"><code>@​cyyynthia</code></a></li>
<li>miscellaneous repository maintenance tasks by <a
href="https://github.com/cyyynthia"><code>@​cyyynthia</code></a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/spokodev"><code>@​spokodev</code></a>
made their first contribution in <a
href="https://redirect.github.com/squirrelchat/smol-toml/pull/56">squirrelchat/smol-toml#56</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/squirrelchat/smol-toml/compare/v1.6.1...v1.7.0">https://github.com/squirrelchat/smol-toml/compare/v1.6.1...v1.7.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/a62f06faf4e45ab0a581def86c116f9706edc9df"><code>a62f06f</code></a>
revert: keep using vite 7</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/89aa9a394ffc544dce77ab0ff24dfd8204e1f091"><code>89aa9a3</code></a>
chore: remove prepare script</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/17c797475f1516da6614e31a1be9f4958bf296c0"><code>17c7974</code></a>
chore: make devEngine more lax w/ node version</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/e5280a34630eb25086dca746bedda28ea21ec3d9"><code>e5280a3</code></a>
ci: checkout repo first</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/241c256ebda07b2d225c91b7468ed8c90d0e71df"><code>241c256</code></a>
chore: version bump</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/0bfe7f4667fa46122663b7b6114d9514dbd1a91f"><code>0bfe7f4</code></a>
chore: build cjs with rolldown instead of esbuild</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/e0620ab2ac89c40d291f33df41b110277b1acedf"><code>e0620ab</code></a>
chore: fmt</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/96114cb58312084286ae61470ba0f017b87b8023"><code>96114cb</code></a>
test: add tests for large integers</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/f4537b6b3763e761069efdd7d688711c8409645c"><code>f4537b6</code></a>
fix: handle missed edge-cases in string parse</li>
<li><a
href="https://github.com/squirrelchat/smol-toml/commit/7b39aed388cdc811189a6a3683fbee2f8d344244"><code>7b39aed</code></a>
chore: include source files in published package</li>
<li>Additional commits viewable in <a
href="https://github.com/squirrelchat/smol-toml/compare/v1.6.1...v1.7.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@supabase/supabase-js` from 2.108.1 to 2.108.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/supabase/supabase-js/releases">@​supabase/supabase-js's
releases</a>.</em></p>
<blockquote>
<h2>v2.108.2</h2>
<h2>2.108.2 (2026-06-15)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>auth:</strong> preserve valid session on refresh failure and
cooldown repeat failures (<a
href="https://redirect.github.com/supabase/supabase-js/pull/2436">#2436</a>)</li>
<li><strong>realtime:</strong> clarify httpSend() 404 error and server
migration note (<a
href="https://redirect.github.com/supabase/supabase-js/pull/2444">#2444</a>)</li>
<li><strong>release:</strong> pin Deno and bound JSR publish to survive
stranded-task hangs (<a
href="https://redirect.github.com/supabase/supabase-js/pull/2439">#2439</a>)</li>
<li><strong>release:</strong> restore JSR publish flags and enable for
beta (<a
href="https://redirect.github.com/supabase/supabase-js/pull/2440">#2440</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Katerina Skroumpelou <a
href="https://github.com/mandarini"><code>@​mandarini</code></a></li>
</ul>
<h2>v2.108.2-canary.5</h2>
<h2>2.108.2-canary.5 (2026-06-15)</h2>
<p>This was a version bump only, there were no code changes.</p>
<h2>v2.108.2-canary.4</h2>
<h2>2.108.2-canary.4 (2026-06-12)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>realtime:</strong> clarify httpSend() 404 error and server
migration note (<a
href="https://redirect.github.com/supabase/supabase-js/pull/2444">#2444</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Katerina Skroumpelou <a
href="https://github.com/mandarini"><code>@​mandarini</code></a></li>
</ul>
<h2>v2.108.2-canary.3</h2>
<h2>2.108.2-canary.3 (2026-06-11)</h2>
<p>This was a version bump only, there were no code changes.</p>
<h2>v2.108.2-canary.2</h2>
<h2>2.108.2-canary.2 (2026-06-11)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>release:</strong> restore JSR publish flags and enable for
beta (<a
href="https://redirect.github.com/supabase/supabase-js/pull/2440">#2440</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Katerina Skroumpelou <a
href="https://github.com/mandarini"><code>@​mandarini</code></a></li>
</ul>
<h2>v2.108.2-canary.1</h2>
<h2>2.108.2-canary.1 (2026-06-11)</h2>
<h3>🩹 Fixes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md">@​supabase/supabase-js's
changelog</a>.</em></p>
<blockquote>
<h2>2.108.2 (2026-06-15)</h2>
<p>This was a version bump only for <code>@​supabase/supabase-js</code>
to align it with other projects, there were no code changes.</p>
<h2>2.108.0 (2026-06-08)</h2>
<p>This was a version bump only for <code>@​supabase/supabase-js</code>
to align it with other projects, there were no code changes.</p>
<h2>2.107.0 (2026-06-02)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>auth:</strong> remove navigator.locks-based mutex; introduce
commit guard + dispose() (<a
href="https://redirect.github.com/supabase/supabase-js/pull/2392">#2392</a>)</li>
<li><strong>supabase:</strong> update X-Client-Info to structured
metadata format (<a
href="https://redirect.github.com/supabase/supabase-js/pull/2359">#2359</a>)</li>
<li><strong>realtime:</strong> allow httpSend to send binary payload (<a
href="https://redirect.github.com/supabase/supabase-js/pull/2400">#2400</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Claude Sonnet 4.6</li>
<li>Eduardo Gurgel</li>
<li>Guilherme Souza</li>
<li>Katerina Skroumpelou <a
href="https://github.com/mandarini"><code>@​mandarini</code></a></li>
<li>Omar Al Matar <a
href="https://github.com/Bewinxed"><code>@​Bewinxed</code></a></li>
</ul>
<h2>2.106.2 (2026-05-25)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>misc:</strong> add react-native export condition for
Hermes-safe resolution (<a
href="https://redirect.github.com/supabase/supabase-js/pull/2393">#2393</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Myroslav Hryhschenko <a
href="https://github.com/BLOCKMATERIAL"><code>@​BLOCKMATERIAL</code></a></li>
</ul>
<h2>2.106.1 (2026-05-20)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>misc:</strong> hide dynamic import from hermesc (<a
href="https://redirect.github.com/supabase/supabase-js/pull/2381">#2381</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Katerina Skroumpelou <a
href="https://github.com/mandarini"><code>@​mandarini</code></a></li>
</ul>
<h2>2.106.0 (2026-05-18)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>supabase:</strong> W3C/OpenTelemetry trace context
propagation (<a
href="https://redirect.github.com/supabase/supabase-js/pull/2163">#2163</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/supabase/supabase-js/commit/76f3f0290525c53aafedaf9fc94fcc09953c2189"><code>76f3f02</code></a>
test(auth): add passkey unit and e2e coverage (<a
href="https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js/issues/2442">#2442</a>)</li>
<li>See full diff in <a
href="https://github.com/supabase/supabase-js/commits/v2.108.2/packages/core/supabase-js">compare
view</a></li>
</ul>
</details>
<br />

Updates `@anthropic-ai/claude-agent-sdk` from 0.3.177 to 0.3.185
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@​anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.185</h2>
<h2>What's changed</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.185</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.185
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.185
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.185
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.185
</code></pre>
<h2>v0.3.183</h2>
<h2>What's changed</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.183</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.183
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.183
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.183
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.183
</code></pre>
<h2>v0.3.181</h2>
<h2>What's changed</h2>
<ul>
<li>Added <code>errorCode</code>, <code>canUserPurchaseCredits</code>,
and <code>hasChargeableSavedPaymentMethod</code> fields to
<code>SDKRateLimitInfo</code> for detecting credits-required rate
limits</li>
<li>Added <code>tool_use_meta.icon_url</code> to assistant messages,
populated from MCP server directory metadata</li>
<li>Fixed SDK-hosted Remote Control sessions dropping
<code>file_attachments</code> from inbound user messages</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.181
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.181
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.181
# or
&lt;/tr&gt;&lt;/table&gt;
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@​anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.185</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.185</li>
</ul>
<h2>0.3.184</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.184</li>
</ul>
<h2>0.3.183</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.183</li>
</ul>
<h2>0.3.182</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.182</li>
</ul>
<h2>0.3.181</h2>
<ul>
<li>Added <code>errorCode</code>, <code>canUserPurchaseCredits</code>,
and <code>hasChargeableSavedPaymentMethod</code> fields to
<code>SDKRateLimitInfo</code> for detecting credits-required rate
limits</li>
<li>Added <code>tool_use_meta.icon_url</code> to assistant messages,
populated from MCP server directory metadata</li>
<li>Fixed SDK-hosted Remote Control sessions dropping
<code>file_attachments</code> from inbound user messages</li>
</ul>
<h2>0.3.180</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.180</li>
</ul>
<h2>0.3.179</h2>
<ul>
<li>Added optional <code>tool_use_meta</code> sidecar to assistant
messages with display-friendly names for tool calls, so SDK consumers
can render human-readable labels instead of raw wire names</li>
<li>Fixed <code>-p</code> mode exiting before a completed background
agent's notification was delivered, causing interim text to ship as the
final result</li>
<li>Fixed remote (stream-json) sessions appearing busy for the entire
duration of a background workflow — the turn result is now emitted at
the turn boundary and the session reports idle while background tasks
continue</li>
</ul>
<h2>0.3.178</h2>
<ul>
<li>Spawn failures on an existing native binary now explain the likely
libc mismatch (musl binary on a glibc host) and suggest
<code>options.pathToClaudeCodeExecutable</code></li>
<li>Permission-denied advisory messages now carry typed denial reasons
(<code>safetyCheck</code>, <code>asyncAgent</code>), enabling SDK
consumers to programmatically match denial causes</li>
<li>Fixed <code>UserPromptSubmit</code> hook block feedback not being
emitted to the SDK event stream — consumers can now see why a prompt was
blocked by a hook instead of a silent hang</li>
<li>Remote Control workers now send a <code>worker_shutting_down</code>
system message on graceful exit so remote clients can show why the
session ended</li>
<li>Fixed MCP server-level specs (<code>mcp__server</code>,
<code>mcp__server__*</code>) in <code>disallowedTools</code> being
silently ignored — they now correctly remove all tools from the named
server</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/810e709450d3cd0444aa018501d2a5ab3477f439"><code>810e709</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/fc84d9383f5bf3a0cf65fd4f5379a82519fdb95f"><code>fc84d93</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/4d3840c936a4fda502e47e58a8bc7d014f363d24"><code>4d3840c</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/32753ee19ce670f6b320ad544d813854930bb02d"><code>32753ee</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/38722be05d4d21d6e438835c0a0177e81e2cffd2"><code>38722be</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.177...v0.3.185">compare
view</a></li>
</ul>
</details>
<br />

Updates `@anthropic-ai/sdk` from 0.104.1 to 0.105.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/releases">@​anthropic-ai/sdk's
releases</a>.</em></p>
<blockquote>
<h2>sdk: v0.105.0</h2>
<h2>0.105.0 (2026-06-18)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.104.2...sdk-v0.105.0">sdk-v0.104.2...sdk-v0.105.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for new code_execution_20260120
tool (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/8dc2b54ee9f19cfc0a8f5cb49d0e1b93f4a4cadd">8dc2b54</a>)</li>
<li><strong>stream:</strong> lazily parse partial tool json input (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/99">#99</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/e55ceee5e3053ada96a7fe008b1fd6ebc0e42544">e55ceee</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>internal/deps:</strong> bump swc to 1.15.40 (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/97">#97</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a1d4d7549251f88100f44b0350f6123c9cbea5ec">a1d4d75</a>)</li>
<li><strong>internal:</strong> use are the types wrong directly (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/94">#94</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/3d362afd0aade3d18f10e61a5e4809c0bd495768">3d362af</a>)</li>
<li><strong>tests:</strong> stop using deprecated models (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/98">#98</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/65ae1afee1bb76179c58e1758a48d668e3fcf7b3">65ae1af</a>)</li>
</ul>
<h2>sdk: v0.104.2</h2>
<h2>0.104.2 (2026-06-15)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.104.1...sdk-v0.104.2">sdk-v0.104.1...sdk-v0.104.2</a></p>
<h3>Chores</h3>
<ul>
<li><strong>api:</strong> remove retired models from API and SDKs (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a94287690a383ba34aa0d2ad9e0262eeb9241bd3">a942876</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md">@​anthropic-ai/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.105.0 (2026-06-18)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.104.2...sdk-v0.105.0">sdk-v0.104.2...sdk-v0.105.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for new code_execution_20260120
tool (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/8dc2b54ee9f19cfc0a8f5cb49d0e1b93f4a4cadd">8dc2b54</a>)</li>
<li><strong>stream:</strong> lazily parse partial tool json input (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/99">#99</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/e55ceee5e3053ada96a7fe008b1fd6ebc0e42544">e55ceee</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>internal/deps:</strong> bump swc to 1.15.40 (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/97">#97</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a1d4d7549251f88100f44b0350f6123c9cbea5ec">a1d4d75</a>)</li>
<li><strong>internal:</strong> use are the types wrong directly (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/94">#94</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/3d362afd0aade3d18f10e61a5e4809c0bd495768">3d362af</a>)</li>
<li><strong>tests:</strong> stop using deprecated models (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/98">#98</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/65ae1afee1bb76179c58e1758a48d668e3fcf7b3">65ae1af</a>)</li>
</ul>
<h2>0.104.2 (2026-06-15)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.104.1...sdk-v0.104.2">sdk-v0.104.1...sdk-v0.104.2</a></p>
<h3>Chores</h3>
<ul>
<li><strong>api:</strong> remove retired models from API and SDKs (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a94287690a383ba34aa0d2ad9e0262eeb9241bd3">a942876</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/ab700dc013e735b80dead115fcae52fba83f1aeb"><code>ab700dc</code></a>
chore: release main</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a3225175d067110fc0e9152ed2699540455aa4ce"><code>a322517</code></a>
feat(api): add support for new code_execution_20260120 tool</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/65a01068857f521d27d8963152cd3e66cbe232ad"><code>65a0106</code></a>
feat(stream): lazily parse partial tool json input (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/99">#99</a>)</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/384ab5179b6120fa6c3fdc37fabb1baba23a1d73"><code>384ab51</code></a>
chore(tests): stop using deprecated models (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/98">#98</a>)</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a49a19143ae0b13fc5312058c008c5a39250cd96"><code>a49a191</code></a>
chore(internal/deps): bump swc to 1.15.40 (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/97">#97</a>)</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/7ac63f3b566c898fa9ce3eaced546da5cf0e3014"><code>7ac63f3</code></a>
chore(internal): use are the types wrong directly (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/94">#94</a>)</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/fbee0d149ce08532885d766d9b1dc99133181d8e"><code>fbee0d1</code></a>
chore: release main</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/e984ba4942d0e9660690910c4a7c7325b1fe3607"><code>e984ba4</code></a>
chore(api): remove retired models from API and SDKs</li>
<li>See full diff in <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.104.1...sdk-v0.105.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@clack/prompts` from 1.5.1 to 1.6.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bombshell-dev/clack/releases">@​clack/prompts's
releases</a>.</em></p>
<blockquote>
<h2><code>@​clack/prompts</code><a
href="https://github.com/1"><code>@​1</code></a>.6.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/bombshell-dev/clack/pull/568">#568</a>
<a
href="https://github.com/bombshell-dev/clack/commit/f87933fb7b3f4c401b9e51a152b95cb8e7200fe5"><code>f87933f</code></a>
Thanks <a
href="https://github.com/florian-lefebvre"><code>@​florian-lefebvre</code></a>!
- Updates default formatter of <code>note()</code> to note dim lines
anymore</p>
<p>If you want the old behavior, provide a <code>format()</code>
function:</p>
<pre lang="diff"><code>import { note } from '@clack/prompts';
+import { styleText } from 'node:util';
<p>note(
'You can edit the file src/index.jsx',
'Next steps.'</p>
<ul>
<li>{ format: (text) =&gt; styleText('dim', text) }
);
</code></pre></li>
</ul>
</li>
<li>
<p><a
href="https://redirect.github.com/bombshell-dev/clack/pull/567">#567</a>
<a
href="https://github.com/bombshell-dev/clack/commit/cc6aab50186cff8a02dc98e9cfd3897c29a33b15"><code>cc6aab5</code></a>
Thanks <a
href="https://github.com/dreyfus92"><code>@​dreyfus92</code></a>! - Add
keyboard instruction footers to <code>select</code>,
<code>multiselect</code>, and <code>groupMultiselect</code> in the
active state, matching autocomplete. No option — always shown.</p>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/bombshell-dev/clack/commit/2f2b52f77cbfa9af618c6d929249ab8395fc37a1"><code>2f2b52f</code></a>,
<a
href="https://github.com/bombshell-dev/clack/commit/e1b6ee71a76e17a3c33ba7ee6e5fb34e886233bb"><code>e1b6ee7</code></a>]:
<ul>
<li><code>@​clack/core</code><a
href="https://github.com/1"><code>@​1</code></a>.4.2</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md">@​clack/prompts's
changelog</a>.</em></p>
<blockquote>
<h2>1.6.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/bombshell-dev/clack/pull/568">#568</a>
<a
href="https://github.com/bombshell-dev/clack/commit/f87933fb7b3f4c401b9e51a152b95cb8e7200fe5"><code>f87933f</code></a>
Thanks <a
href="https://github.com/florian-lefebvre"><code>@​florian-lefebvre</code></a>!
- Updates default formatter of <code>note()</code> to note dim lines
anymore</p>
<p>If you want the old behavior, provide a <code>format()</code>
function:</p>
<pre lang="diff"><code>import { note } from '@clack/prompts';
+import { styleText } from 'node:util';
<p>note(
'You can edit the file src/index.jsx',
'Next steps.'</p>
<ul>
<li>{ format: (text) =&gt; styleText('dim', text) }
);
</code></pre></li>
</ul>
</li>
<li>
<p><a
href="https://redirect.github.com/bombshell-dev/clack/pull/567">#567</a>
<a
href="https://github.com/bombshell-dev/clack/commit/cc6aab50186cff8a02dc98e9cfd3897c29a33b15"><code>cc6aab5</code></a>
Thanks <a
href="https://github.com/dreyfus92"><code>@​dreyfus92</code></a>! - Add
keyboard instruction footers to <code>select</code>,
<code>multiselect</code>, and <code>groupMultiselect</code> in the
active state, matching autocomplete. No option — always shown.</p>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/bombshell-dev/clack/commit/2f2b52f77cbfa9af618c6d929249ab8395fc37a1"><code>2f2b52f</code></a>,
<a
href="https://github.com/bombshell-dev/clack/commit/e1b6ee71a76e17a3c33ba7ee6e5fb34e886233bb"><code>e1b6ee7</code></a>]:
<ul>
<li><code>@​clack/core</code><a
href="https://github.com/1"><code>@​1</code></a>.4.2</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bombshell-dev/clack/commit/0e700562dfb54bd693d98c5b7e28d34213fcb226"><code>0e70056</code></a>
[ci] release (<a
href="https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts/issues/562">#562</a>)</li>
<li><a
href="https://github.com/bombshell-dev/clack/commit/f87933fb7b3f4c401b9e51a152b95cb8e7200fe5"><code>f87933f</code></a>
fix(prompts): do not dim note contents (<a
href="https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts/issues/568">#568</a>)</li>
<li><a
href="https://github.com/bombshell-dev/clack/commit/cc6aab50186cff8a02dc98e9cfd3897c29a33b15"><code>cc6aab5</code></a>
feat(prompts): add instructions footer for <code>select</code>,
<code>multi-select</code> &amp; `group-...</li>
<li>See full diff in <a
href="https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.6.0/packages/prompts">compare
view</a></li>
</ul>
</details>
<br />

Updates `ink` from 7.0.6 to 7.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vadimdemedes/ink/releases">ink's
releases</a>.</em></p>
<blockquote>
<h2>v7.1.0</h2>
<ul>
<li>Add <a
href="https://github.com/vadimdemedes/ink#suspendterminalcallback"><code>suspendTerminal()</code></a>
to hand the terminal to a child process (<a
href="https://redirect.github.com/vadimdemedes/ink/issues/972">#972</a>)
9e8ed1f</li>
</ul>
<hr />
<p><a
href="https://github.com/vadimdemedes/ink/compare/v7.0.6...v7.1.0">https://github.com/vadimdemedes/ink/compare/v7.0.6...v7.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vadimdemedes/ink/commit/25766aec618bd62030069f57dd081e5ebdd46add"><code>25766ae</code></a>
7.1.0</li>
<li><a
href="https://github.com/vadimdemedes/ink/commit/9e8ed1f005db0e975817983665f5c68884c6c232"><code>9e8ed1f</code></a>
Add <code>suspendTerminal()</code> to hand the terminal to a child
process (<a
href="https://redirect.github.com/vadimdemedes/ink/issues/972">#972</a>)</li>
<li>See full diff in <a
href="https://github.com/vadimdemedes/ink/compare/v7.0.6...v7.1.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `pg` from 8.21.0 to 8.22.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md">pg's
changelog</a>.</em></p>
<blockquote>
<h2>pg@8.22.0</h2>
<ul>
<li>Add support for <a
href="https://redirect.github.com/brianc/node-postgres/pull/3688">sslnegotiation=direct</a>
for PostgreSQL 17+.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/brianc/node-postgres/commit/b617619f9fb6fbd231731823e2732a2927ded4be"><code>b617619</code></a>
Publish</li>
<li><a
href="https://github.com/brianc/node-postgres/commit/d80b2612fbe83ed8234637f20b943d85e4331094"><code>d80b261</code></a>
Update docs &amp; changelog</li>
<li><a
href="https://github.com/brianc/node-postgres/commit/835fb83ab9e1cf30fa8367ba42bd633720d71832"><code>835fb83</code></a>
Fix error handling for exceptions on values parsing. (<a
href="https://github.com/brianc/node-postgres/tree/HEAD/packages/pg/issues/3574">#3574</a>)</li>
<li><a
href="https://github.com/brianc/node-postgres/commit/f49ab4a9795ae0866409f9bfe52a68b4f65ef024"><code>f49ab4a</code></a>
fix: correct spelling mistakes across codebase (<a
href="https://github.com/brianc/node-postgres/tree/HEAD/packages/pg/issues/3692">#3692</a>)</li>
<li><a
href="https://github.com/brianc/node-postgres/commit/d7175a4aa0347b7416109e9ecc61d4d235486d0e"><code>d7175a4</code></a>
Expand CI matrix of PG versions and add direct SSL test (<a
href="https://github.com/brianc/node-postgres/tree/HEAD/packages/pg/issues/3693">#3693</a>)</li>
<li><a
href="https://github.com/brianc/node-postgres/commit/882fc308cce7bf136cd1448e00395f760dad3e00"><code>882fc30</code></a>
Add support for sslnegotiation=direct (PostgreSQL 17) (<a
href="https://github.com/brianc/node-postgres/tree/HEAD/packages/pg/issues/3688">#3688</a>)</li>
<li>See full diff in <a
href="https://github.com/brianc/node-postgres/commits/pg@8.22.0/packages/pg">compare
view</a></li>
</ul>
</details>
<br />

Updates `posthog-node` from 5.37.0 to 5.38.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/PostHog/posthog-js/releases">posthog-node's
releases</a>.</em></p>
<blockquote>
<h2>posthog-node@5.38.2</h2>
<h2>5.38.2</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/PostHog/posthog-js/pull/3903">#3903</a>
<a
href="https://github.com/PostHog/posthog-js/commit/6b21f77291aeea64ce8229eb28196d1acacc20ce"><code>6b21f77</code></a>
Thanks <a
href="https://github.com/marandaneto"><code>@​marandaneto</code></a>! -
Validate custom event UUID overrides and generate new UUIDs when
invalid.
(2026-06-19)</li>
<li>Updated dependencies [<a
href="https://github.com/PostHog/posthog-js/commit/6b21f77291aeea64ce8229eb28196d1acacc20ce"><code>6b21f77</code></a>]:
<ul>
<li><code>@​posthog/core</code><a
href="https://github.com/1"><code>@​1</code></a>.35.3</li>
</ul>
</li>
</ul>
<h2>posthog-node@5.38.1</h2>
<h2>5.38.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/PostHog/posthog-js/pull/3886">#3886</a>
<a
href="https://github.com/PostHog/posthog-js/commit/e6d7fe2a5f10d29b3df69392f584970e7a7a4561"><code>e6d7fe2</code></a>
Thanks <a
href="https://github.com/marandaneto"><code>@​marandaneto</code></a>! -
Stop sending deprecated no-op top-level <code>type</code>,
<code>library</code>, and <code>library_version</code> fields in event
batch payloads. Use <code>properties.$lib</code> and
<code>properties.$lib_version</code> for SDK metadata; legacy queued
<code>library</code> and <code>library_version</code> values are used as
fallbacks when the official <code>$</code> properties are missing.
(2026-06-18)</li>
<li>Updated dependencies [<a
href="https://github.com/PostHog/posthog-js/commit/e6d7fe2a5f10d29b3df69392f584970e7a7a4561"><code>e6d7fe2</code></a>]:
<ul>
<li><code>@​posthog/core</code><a
href="https://github.com/1"><code>@​1</code></a>.35.2</li>
</ul>
</li>
</ul>
<h2>posthog-node@5.38.0</h2>
<h2>5.38.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/PostHog/posthog-js/pull/3845">#3845</a>
<a
href="https://github.com/PostHog/posthog-js/commit/a0553b305679f995e244cad7498c7521cb4c849d"><code>a0553b3</code></a>
Thanks <a
href="https://github.com/marandaneto"><code>@​marandaneto</code></a>! -
Add <code>setPersonProperties()</code> and
<code>unsetPersonProperties()</code> helpers to manage person properties
from the Node.js SDK.
(2026-06-16)</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/PostHog/posthog-js/commit/b3ec8453d3678bd7ab6737b25bae003e61117ef9"><code>b3ec845</code></a>,
<a
href="https://github.com/PostHog/posthog-js/commit/c6c163aefb093d5609977ae243b056f96a2d3b4e"><code>c6c163a</code></a>]:
<ul>
<li><code>@​posthog/core</code><a
href="https://github.com/1"><code>@​1</code></a>.33.0</li>
</ul>
</li>
</ul>
<h2>posthog-node@5.37.1</h2>
<h2>5.37.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/PostHog/posthog-js/pull/3837">#3837</a>
<a
href="https://github.com/PostHog/posthog-js/commit/29bf8e386a4050531e9cfd906c33b75945fcb6ad"><code>29bf8e3</code></a>
Thanks <a
href="https://github.com/marandaneto"><code>@​marandaneto</code></a>! -
Add missing bugs metadata to package manifests.
(2026-06-15)</li>
<li>Updated dependencies [<a
href="https://github.com/PostHog/posthog-js/commit/29bf8e386a4050531e9cfd906c33b75945fcb6ad"><code>29bf8e3</code></a>]:
<ul>
<li><code>@​posthog/core</code><a
href="https://github.com/1"><code>@​1</code></a>.32.4</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md">posthog-node's
changelog</a>.</em></p>
<blockquote>
<h2>5.38.2</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/PostHog/posthog-js/pull/3903">#3903</a>
<a
href="https://github.com/PostHog/posthog-js/commit/6b21f77291aeea64ce8229eb28196d1acacc20ce"><code>6b21f77</code></a>
Thanks <a
href="https://github.com/marandaneto"><code>@​marandaneto</code></a>! -
Validate custom event UUID overrides and generate new UUIDs when
invalid.
(2026-06-19)</li>
<li>Updated dependencies [<a
href="https://github.com/PostHog/posthog-js/commit/6b21f77291aeea64ce8229eb28196d1acacc20ce"><code>6b21f77</code></a>]:
<ul>
<li><code>@​posthog/core</code><a
href="https://github.com/1"><code>@​1</code></a>.35.3</li>
</ul>
</li>
</ul>
<h2>5.38.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/PostHog/posthog-js/pull/3886">#3886</a>
<a
href="https://github.com/PostHog/posthog-js/commit/e6d7fe2a5f10d29b3df69392f584970e7a7a4561"><code>e6d7fe2</code></a>
Thanks <a
href="https://github.com/marandaneto"><code>@​marandaneto</code></a>! -
Stop sending deprecated no-op top-level <code>type</code>,
<code>library</code>, and <code>library_version</code> fields in event
batch payloads. Use <code>properties.$lib</code> and
<code>properties.$lib_version</code> for SDK metadata; legacy queued
<code>library</code> and <code>library_version</code> values are used as
fallbacks when the official <code>$</code> properties are missing.
(2026-06-18)</li>
<li>Updated dependencies [<a
href="https://github.com/PostHog/posthog-js/commit/e6d7fe2a5f10d29b3df69392f584970e7a7a4561"><code>e6d7fe2</code></a>]:
<ul>
<li><code>@​posthog/core</code><a
href="https://github.com/1"><code>@​1</code></a>.35.2</li>
</ul>
</li>
</ul>
<h2>5.38.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/PostHog/posthog-js/pull/3845">#3845</a>
<a
href="https://github.com/PostHog/posthog-js/commit/a0553b305679f995e244cad7498c7521cb4c849d"><code>a0553b3</code></a>
Thanks <a
href="https://github.com/marandaneto"><code>@​marandaneto</code></a>! -
Add <code>setPersonProperties()</code> and
<code>unsetPersonProperties()</code> helpers to manage person properties
from the Node.js SDK.
(2026-06-16)</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/PostHog/posthog-js/commit/b3ec8453d3678bd7ab6737b25bae003e61117ef9"><code>b3ec845</code></a>,
<a
href="https://github.com/PostHog/posthog-js/commit/c6c163aefb093d5609977ae243b056f96a2d3b4e"><code>c6c163a</code></a>]:
<ul>
<li><code>@​posthog/core</code><a
href="https://github.com/1"><code>@​1</code></a>.33.0</li>
</ul>
</li>
</ul>
<h2>5.37.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/PostHog/posthog-js/pull/3837">#3837</a>
<a
href="https://github.com/PostHog/posthog-js/commit/29bf8e386a4050531e9cfd906c33b75945fcb6ad"><code>29bf8e3</code></a>
Thanks <a
href="https://github.com/marandaneto"><code>@​marandaneto</code></a>! -
Add missing bugs metadata to package manifests.
(2026-06-15)</li>
<li>Updated dependencies [<a
href="https://github.com/PostHog/posthog-js/commit/29bf8e386a4050531e9cfd906c33b75945fcb6ad"><code>29bf8e3</code></a>]:
<ul>
<li><code>@​posthog/core</code><a
href="https://github.com/1"><code>@​1</code></a>.32.4</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/PostHog/posthog-js/commit/b0bd00ff7279fdb3f3bc9c993e7fc2f24710c50e"><code>b0bd00f</code></a>
chore: update versions and lockfile [version bump]</li>
<li><a
href="https://github.com/PostHog/posthog-js/commit/6b21f77291aeea64ce8229eb28196d1acacc20ce"><code>6b21f77</code></a>
fix: validate custom event UUIDs (<a
href="https://github.com/PostHog/posthog-js/tree/HEAD/packages/node/issues/3903">#3903</a>)</li>
<li><a
href="https://github.com/PostHog/posthog-js/commit/229efffbe56e56d387db0ce5f8848093843ce73d"><code>229efff</code></a>
chore: update versions and lockfile [version bump]</li>
<li><a
href="https://github.com/PostHog/posthog-js/commit/e6d7fe2a5f10d29b3df69392f584970e7a7a4561"><code>e6d7fe2</code></a>
fix: remove ignored batch metadata fields (<a
href="https://github.com/PostHog/posthog-js/tree/HEAD/packages/node/issues/3886">#3886</a>)</li>
<li><a
href="https://github.com/PostHog/posthog-js/commit/f4955109eaaeaad43462acd5384b53a86dedbdcd"><code>f495510</code></a>
chore: update versions and lockfile [version bump]</li>
<li><a
href="https://github.com/PostHog/posthog-js/commit/bd07ec42968ada9099a31cf7d61b106af22267ca"><code>bd07ec4</code></a>
feat(flags): add disableRemoteFeatureFlags option and runtime
updateFlags (<a
href="https://github.com/PostHog/posthog-js/tree/HEAD/packages/node/issues/3">#3</a>...</li>
<li><a
href="https://github.com/PostHog/posthog-js/commit/4ff3bb3c3feac6c3c62213dacad20cee5073ed05"><code>4ff3bb3</code></a>
chore: update versions and lockfile [version bump]</li>
<li><a
href="https://github.com/PostHog/posthog-js/commit/a0553b305679f995e244cad7498c7521cb4c849d"><code>a0553b3</code></a>
feat(node): add person property helpers (<a
href="https://github.com/PostHog/posthog-js/tree/HEAD/packages/node/issues/3845">#3845</a>)</li>
<li><a
href="https://github.com/PostHog/posthog-js/commit/70d3ddedf9db17572fcdad276439809644607ccc"><code>70d3dde</code></a>
chore: Generate versioned references only on release (<a
href="https://github.com/PostHog/posthog-js/tree/HEAD/packages/node/issues/3858">#3858</a>)</li>
<li><a
href="https://github.com/PostHog/posthog-js/commit/47aea13be9b6a9c61f7ef16fb683adc7a669a37f"><code>47aea13</code></a>
chore: update versions and lockfile [version bump]</li>
<li>Additional commits viewable in <a
href="https://github.com/PostHog/posthog-js/commits/posthog-node@5.38.2/packages/node">compare
view</a></li>
</ul>
</details>
<br />

Updates `fumadocs-core` from 16.10.2 to 16.10.5
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/7365d6327cc7befad39fad085c14e71edad8546f"><code>7365d63</code></a>
Version Packages (<a
href="https://redirect.github.com/fuma-nama/fumadocs/issues/3366">#3366</a>)</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/23c00f221174ef8295778f86ad518604dcbb8185"><code>23c00f2</code></a>
fix(openapi): fix typescript definitions name</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/4fe2821cbbc612d2fad1647a94492afd46031822"><code>4fe2821</code></a>
fix(openapi): fix usage tabs</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/58c2574bf125ab05a9d11e9625393655be83637f"><code>58c2574</code></a>
fix custom script</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/1a323a6e988b4ca6f4cc93401934aad7d9f99745"><code>1a323a6</code></a>
dedupe deps</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/19955f37d7eee23b19ce3376474551c838cc582d"><code>19955f3</code></a>
fix(ui): use <code>prompt</code> query param for &quot;Open in
ChatGPT&quot; page action (<a
href="https://redirect.github.com/fuma-nama/fumadocs/issues/3365">#3365</a>)</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/c903a684d410d7d9e516a1ce0c723724be7b8022"><code>c903a68</code></a>
Version Packages (<a
href="https://redirect.github.com/fuma-nama/fumadocs/issues/3363">#3363</a>)</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/ae508485ab626667a4c76776451313fd1e46d868"><code>ae50848</code></a>
feat(core): support react router v8</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/bd9a9d001b57b79a346f5dcc8ea2b87802794c64"><code>bd9a9d0</code></a>
update tegami</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/88ce9d9614c2edc07307f4733e73cae7a2c863ca"><code>88ce9d9</code></a>
refactor: use Tegami</li>
<li>Additional commits viewable in <a
href="https://github.com/fuma-nama/fumadocs/compare/fumadocs-core@16.10.2...fumadocs@16.10.5">compare
view</a></li>
</ul>
</details>
<br />

Updates `fumadocs-ui` from 16.10.2 to 16.10.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fuma-nama/fumadocs/releases">fumadocs-ui's
releases</a>.</em></p>
<blockquote>
<h2>fumadocs-ui@16.10.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>5499f59: type-safe provider props
<ul>
<li>fumadocs-core@16.10.3</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/7365d6327cc7befad39fad085c14e71edad8546f"><code>7365d63</code></a>
Version Packages (<a
href="https://redirect.github.com/fuma-nama/fumadocs/issues/3366">#3366</a>)</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/23c00f221174ef8295778f86ad518604dcbb8185"><code>23c00f2</code></a>
fix(openapi): fix typescript definitions name</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/4fe2821cbbc612d2fad1647a94492afd46031822"><code>4fe2821</code></a>
fix(openapi): fix usage tabs</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/58c2574bf125ab05a9d11e9625393655be83637f"><code>58c2574</code></a>
fix custom script</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/1a323a6e988b4ca6f4cc93401934aad7d9f99745"><code>1a323a6</code></a>
dedupe deps</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/19955f37d7eee23b19ce3376474551c838cc582d"><code>19955f3</code></a>
fix(ui): use <code>prompt</code> query param for &quot;Open in
ChatGPT&quot; page action (<a
href="https://redirect.github.com/fuma-nama/fumadocs/issues/3365">#3365</a>)</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/c903a684d410d7d9e516a1ce0c723724be7b8022"><code>c903a68</code></a>
Version Packages (<a
href="https://redirect.github.com/fuma-nama/fumadocs/issues/3363">#3363</a>)</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/ae508485ab626667a4c76776451313fd1e46d868"><code>ae50848</code></a>
feat(core): support react router v8</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/bd9a9d001b57b79a346f5dcc8ea2b87802794c64"><code>bd9a9d0</code></a>
update tegami</li>
<li><a
href="https://github.com/fuma-nama/fumadocs/commit/88ce9d9614c2edc07307f4733e73cae7a2c863ca"><code>88ce9d9</code></a>
refactor: use Tegami</li>
<li>Additional commits viewable in <a
href="https://github.com/fuma-nama/fumadocs/compare/fumadocs-ui@16.10.2...fumadocs@16.10.5">compare
view</a></li>
</ul>
</details>
<br />

Updates `@types/node` from 25.9.3 to 26.0.0
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />

Updates `@effect/atom-react` from 4.0.0-beta.83 to 4.0.0-beta.85
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Effect-TS/effect-smol/blob/main/packages/atom/react/CHANGELOG.md">@​effect/atom-react's
changelog</a>.</em></p>
<blockquote>
<h2>4.0.0-beta.85</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/Effect-TS/effect-smol/commit/328d97cc53c0dcb89077a5623e35b095eaa59a8c"><code>328d97c</code></a>,
<a
href="https://github.com/Effect-TS/effect-smol/commit/8441836e6dde70e8ae2126be9cefe9b45798b134"><code>8441836</code></a>,
<a
href="https://github.com/Effect-TS/effect-smol/commit/074e4361091289104cb0ab6959dc3b0ea7794a6a"><code>074e436</code></a>,
<a
href="https://github.com/Effect-TS/effect-smol/commit/c1dfd60663eb13a58916f3712d877499943b628a"><code>c1dfd60</code></a>,
<a
href="https://github.com/Effect-TS/effect-smol/commit/2ba316bd15fcbf1c50626500d44a2c9b3bec19f5"><code>2ba316b</code></a>,
<a
href="https://github.com/Effect-TS/effect-smol/commit/7ce7344c41056c79e2ee19ee6a9346c0f1d227c1"><code>7ce7344</code></a>]:
<ul>
<li>effect@4.0.0-beta.85</li>
</ul>
</li>
</ul>
<h2>4.0.0-beta.84</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/Effect-TS/effect-smol/commit/87f52ba16c4370ffa3f84bf8e53038e1419c284e"><code>87f52ba</code></a>,
<a
href="https://github.com/Effect-TS/effect-smol/commit/b8ee07ffda8903b5ec2e45a786ddcba59f128fda"><code>b8ee07f</code></a>,
<a
href="https://github.com/Effect-TS/effect-smol/commit/867c0d70a09079b040260d45a1e92ff04dbfbf2f"><code>867c0d7</code></a>,
<a
href="https://github.com/Effect-TS/effect-smol/commit/b93bc6c9cb27b909a41d094c97c4f9d25bbc6d6b"><code>b93bc6c</code></a>,
<a
href="https://github.com/Effect-TS/effect-smol/commit/57d387f92c30ab63e15e3e641f0a903b65886610"><code>57d387f</code></a>,
<a
href="https://github.com/Effect-TS/effect-smol/commit/bacca4141c2400effae1eabfdb36c89a459cf246"><code>bacca41</code></a>,
<a
href="https://github.com/Effect-TS/effect-smol/commit/0f8ac7959d29ed68c68ce25aabd6bf0cb7e63ecc"><code>0f8ac79</code></a>,
<a
href="https://github.com/Effect-TS/effect-smol/commit/25b448270c01317703f25107e1480d4cd0246d9a"><code>25b4482</code></a>,
<a
href="https://github.com/Effect-TS/effect-smol/commit/9cf3a25c66b0c44a52be9829870c44517ea52db2"><code>9cf3a25</code></a>,
<a
href="https://github.com/Effect-TS/effect-smol/commit/8def7674b1787f91035298cda4d122937e87ef72"><code>8def767</code></a>]:
<ul>
<li>effect@4.0.0-beta.84</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Effect-TS/effect-smol/commit/a2fd7ef805f10babae275505873b4fa9a936bc6e"><code>a2fd7ef</code></a>
Version Packages (beta) (<a
href="https://github.com/Effect-TS/effect-smol/tree/HEAD/packages/atom/react/issues/2426">#2426</a>)</li>
<li><a
href="https://github.com/Effect-TS/effect-smol/commit/d11b2b5f2b4646983d4bb7b52bfc0de1a5ad17e2"><code>d11b2b5</code></a>
Version Packages (beta) (<a
href="https://github.com/Effect-TS/effect-smol/tree/HEAD/packages/atom/react/issues/2408">#2408</a>)</li>
<li>See full diff in <a
href="https://github.com/Effect-TS/effect-smol/commits/@effect/atom-react@4.0.0-beta.85/packages/atom/react">compare
view</a></li>
</ul>
</details>
<br />

Updates `@effect/platform-bun` from 4.0.0-beta.83 to 4.0.0-beta.85
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/Effect-TS/effect/commits/HEAD/packages/platform-bun">compare
view</a></li>
</ul>
</details>
<br />

Updates `@effect/platform-node` from 4.0.0-beta.83 to 4.0.0-beta.85
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/Effect-TS/effect/commits/HEAD/packages/platform-node">compare
view</a></li>
</ul>
</details>
<br />

Updates `@effect/sql-pg` from 4.0.0-beta.83 to 4.0.0-beta.85
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/Effect-TS/effect/commits/HEAD/packages/sql-pg">compare
view</a></li>
</ul>
</details>
<br />

Updates `@effect/vitest` from 4.0.0-beta.84 to 4.0.0-beta.85
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/Effect-TS/effect/commits/HEAD/packages/vitest">compare
view</a></li>
</ul>
</details>
<br />

Updates `@nx/devkit` from 22.7.5 to 23.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nrwl/nx/releases">@​nx/devkit's
releases</a>.</em></p>
<blockquote>
<h1>23.0.0 (2026-06-16)</h1>
<h3>🚀 Features</h3>
<ul>
<li>⚠️ <strong>angular:</strong> remove deprecated
<code>@​nx/angular/</code>module-federation entry point (<a
href="https://redirect.github.com/nrwl/nx/pull/35512">#35512</a>)</li>
<li>⚠️ <strong>angular:</strong> remove deprecated move generator (<a
href="https://redirect.github.com/nrwl/nx/pull/35513">#35513</a>)</li>
<li>⚠️ <strong>angular:</strong> remove deprecated ngrx generator (<a
href="https://redirect.github.com/nrwl/nx/pull/35567">#35567</a>)</li>
<li><strong>angular:</strong> deprecate convert-to-with-mf generator (<a
href="https://redirect.github.com/nrwl/nx/pull/35862">#35862</a>)</li>
<li><strong>angular:</strong> deprecate SCAM generators (<a
href="https://redirect.github.com/nrwl/nx/pull/35887">#35887</a>)</li>
<li>⚠️ <strong>bundling:</strong> drop legacy typescript plugin and
align rollup buildLibsFromSource default (<a
href="https://redirect.github.com/nrwl/nx/pull/35516">#35516</a>)</li>
<li>⚠️ <strong>bundling:</strong> remove SVGR option and provide
withSvgr migration (<a
href="https://redirect.github.com/nrwl/nx/pull/35611">#35611</a>)</li>
<li><strong>bundling:</strong> add Vite 7 -&gt; 8 migrations (<a
href="https://redirect.github.com/nrwl/nx/pull/35614">#35614</a>)</li>
<li><strong>core:</strong> add support for '...' as a spread token when
merging target config (<a
href="https://redirect.github.com/nrwl/nx/pull/34285">#34285</a>)</li>
<li><strong>core:</strong> show target uses task graph + filter broken
dependsOn during normalization (<a
href="https://redirect.github.com/nrwl/nx/pull/35367">#35367</a>)</li>
<li><strong>core:</strong> add --mode and --multi-major-mode flags to nx
migrate (<a
href="https://redirect.github.com/nrwl/nx/pull/35497">#35497</a>)</li>
<li><strong>core:</strong> support <code>prompt</code> field in
migration entries (<a
href="https://redirect.github.com/nrwl/nx/pull/35638">#35638</a>)</li>
<li><strong>core:</strong> rename nx watch --includeDependentProjects to
--includeDependencies (<a
href="https://redirect.github.com/nrwl/nx/pull/35699">#35699</a>)</li>
<li><strong>core:</strong> support filtered array-shape targetDefaults
with projects and source (<a
href="https://redirect.github.com/nrwl/nx/pull/35340">#35340</a>)</li>
<li><strong>core:</strong> enable native Node.js TypeScript stripping by
default (<a
href="https://redirect.github.com/nrwl/nx/pull/35608">#35608</a>)</li>
<li><strong>core:</strong> add shell tab-completion (bash, zsh, fish,
powershell) (<a
href="https://redirect.github.com/nrwl/nx/pull/34951">#34951</a>)</li>
<li><strong>core:</strong> add agentic mode to nx migrate
--run-migrations (<a
href="https://redirect.github.com/nrwl/nx/pull/35718">#35718</a>)</li>
<li><strong>core:</strong> add a migrate configuration section to
nx.json (<a
href="https://redirect.github.com/nrwl/nx/pull/35831">#35831</a>)</li>
<li><strong>core:</strong> feed migration docs to agents in nx migrate
(<a
href="https://redirect.github.com/nrwl/nx/pull/35835">#35835</a>)</li>
<li><strong>core:</strong> avoid redundant rematch in
findMatchingConfigFiles (<a
href="https://redirect.github.com/nrwl/nx/pull/35793">#35793</a>, <a
href="https://redirect.github.com/nrwl/nx/issues/35792">#35792</a>)</li>
<li>⚠️ <strong>core:</strong> rename CreateNodes V2 types to canonical
OG names (<a
href="https://redirect.github.com/nrwl/nx/pull/35386">#35386</a>, <a
href="https://redirect.github.com/nrwl/nx/issues/32951">#32951</a>)</li>
<li><strong>core:</strong> support prompt-only and hybrid migrations in
Nx Console UI (<a
href="https://redirect.github.com/nrwl/nx/pull/35822">#35822</a>, <a
href="https://redirect.github.com/nrwl/nx/issues/35718">#35718</a>, <a
href="https://redirect.github.com/nrwl/nx/issues/3153">#3153</a>)</li>
<li><strong>core:</strong> add JSON schema for migrations.json files (<a
href="https://redirect.github.com/nrwl/nx/pull/35888">#35888</a>)</li>
<li><strong>core:</strong> add migrations for createNodesV2 -&gt;
createNodes rename (<a
href="https://redirect.github.com/nrwl/nx/pull/35893">#35893</a>, <a
href="https://redirect.github.com/nrwl/nx/issues/35386">#35386</a>)</li>
<li><strong>core:</strong> extend <code>nx migrate --include</code> to
any package that supports optional updates (<a
href="https://redirect.github.com/nrwl/nx/pull/35905">#35905</a>)</li>
<li><strong>core:</strong> report analytics events for the nx migrate
flow (<a
href="https://redirect.github.com/nrwl/nx/pull/35937">#35937</a>)</li>
<li><strong>core:</strong> revert array-shape targetDefaults support
pending redesign and reapplication (<a
href="https://redirect.github.com/nrwl/nx/pull/36005">#36005</a>, <a
href="https://redirect.github.com/nrwl/nx/issues/35340">#35340</a>, <a
href="https://redirect.github.com/nrwl/nx/issues/35711">#35711</a>, <a
href="https://redirect.github.com/nrwl/nx/issues/35752">#35752</a>, <a
href="https://redirect.github.com/nrwl/nx/issues/35991">#35991</a>)</li>
<li>⚠️ <strong>detox:</strong> deprecate the <code>@​nx/detox</code>
build and test executors (<a
href="https://redirect.github.com/nrwl/nx/pull/35529">#35529</a>)</li>
<li><strong>devkit:</strong> migrate <code>@nx/devkit/src/...</code>
deep imports (<a
href="https://redirect.github.com/nrwl/nx/pull/35541">#35541</a>, <a
href="https://redirect.github.com/nrwl/nx/issues/34946">#34946</a>)</li>
<li>⚠️ <strong>devkit:</strong> deprecate the standalone parameter of
addProjectConfiguration (<a
href="https://redirect.github.com/nrwl/nx/pull/35883">#35883</a>)</li>
<li><strong>gradle:</strong> stream batch task results to nx as they
finish (<a
href="https://redirect.github.com/nrwl/nx/pull/35487">#35487</a>)</li>
<li><strong>js:</strong> support pnpm 11.2.2 (<a
href="https://redirect.github.com/nrwl/nx/pull/35772">#35772</a>)</li>
<li><strong>linter:</strong> allow prompt-only entries in migration
nx-plugin-checks (<a
href="https://redirect.github.com/nrwl/nx/pull/35700">#35700</a>, <a
href="https://redirect.github.com/nrwl/nx/issues/35638">#35638</a>)<...

_Description has been truncated_

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 apps/cli/package.json        |   14 +-
 apps/docs/package.json       |    6 +-
 package.json                 |    2 +-
 packages/config/package.json |    2 +-
 packages/stack/package.json  |    2 +-
 pnpm-lock.yaml               | 2223 +++++++++++++++++++++-------------
 pnpm-workspace.yaml          |   28 +-
 7 files changed, 1411 insertions(+), 866 deletions(-)

diff --git a/apps/cli/package.json b/apps/cli/package.json
index 019c783f62..f51449eba8 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -42,9 +42,9 @@
     "jose": "^6.2.3"
   },
   "devDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.177",
-    "@anthropic-ai/sdk": "^0.104.1",
-    "@clack/prompts": "^1.5.1",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.185",
+    "@anthropic-ai/sdk": "^0.105.0",
+    "@clack/prompts": "^1.6.0",
     "@effect/atom-react": "catalog:",
     "@effect/platform-bun": "catalog:",
     "@effect/sql-pg": "catalog:",
@@ -67,19 +67,19 @@
     "dotenv": "^17.4.2",
     "effect": "catalog:",
     "esbuild": "^0.28.1",
-    "ink": "^7.0.6",
+    "ink": "^7.1.0",
     "ink-spinner": "^5.0.0",
     "knip": "catalog:",
     "oxfmt": "catalog:",
     "oxlint": "catalog:",
     "oxlint-tsgolint": "catalog:",
-    "pg": "^8.21.0",
+    "pg": "^8.22.0",
     "pg-copy-streams": "^7.0.0",
-    "posthog-node": "^5.37.0",
+    "posthog-node": "^5.38.2",
     "react": "^19.2.7",
     "react-devtools-core": "^7.0.1",
     "semantic-release": "^25.0.5",
-    "smol-toml": "^1.6.1",
+    "smol-toml": "^1.7.0",
     "tldts": "catalog:",
     "vitest": "catalog:",
     "yaml": "^2.9.0"
diff --git a/apps/docs/package.json b/apps/docs/package.json
index af59a68b2f..c0a5f29ec5 100644
--- a/apps/docs/package.json
+++ b/apps/docs/package.json
@@ -8,16 +8,16 @@
     "build": "bun run generate && next build"
   },
   "dependencies": {
-    "fumadocs-core": "^16.10.2",
+    "fumadocs-core": "^16.10.5",
     "fumadocs-mdx": "^15.0.12",
-    "fumadocs-ui": "^16.10.2",
+    "fumadocs-ui": "^16.10.5",
     "next": "^16.2.9",
     "react": "^19.2.7",
     "react-dom": "^19.2.7"
   },
   "devDependencies": {
     "@types/mdx": "^2.0.14",
-    "@types/node": "^25.9.2",
+    "@types/node": "^26.0.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.1.6",
     "typescript": "^6.0.3"
diff --git a/package.json b/package.json
index 9f1662441e..0afc996a05 100644
--- a/package.json
+++ b/package.json
@@ -18,6 +18,6 @@
     "@swc/core": "catalog:",
     "nx": "catalog:",
     "pkg-pr-new": "0.0.75",
-    "verdaccio": "^6.7.2"
+    "verdaccio": "^6.7.4"
   }
 }
diff --git a/packages/config/package.json b/packages/config/package.json
index d19bdc3aa6..0d3e254116 100644
--- a/packages/config/package.json
+++ b/packages/config/package.json
@@ -21,7 +21,7 @@
     "@effect/platform-node": "catalog:",
     "dedent": "^1.7.2",
     "effect": "catalog:",
-    "smol-toml": "^1.6.1"
+    "smol-toml": "^1.7.0"
   },
   "devDependencies": {
     "@tsconfig/bun": "catalog:",
diff --git a/packages/stack/package.json b/packages/stack/package.json
index 1c97b1c98a..54aff19c81 100644
--- a/packages/stack/package.json
+++ b/packages/stack/package.json
@@ -27,7 +27,7 @@
   },
   "devDependencies": {
     "@effect/vitest": "catalog:",
-    "@supabase/supabase-js": "^2.108.1",
+    "@supabase/supabase-js": "^2.108.2",
     "@tsconfig/bun": "catalog:",
     "@types/bun": "catalog:",
     "@typescript/native-preview": "catalog:",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 32d8f2e8fb..1e7abb68bc 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -7,23 +7,23 @@ settings:
 catalogs:
   default:
     '@effect/atom-react':
-      specifier: 4.0.0-beta.83
-      version: 4.0.0-beta.83
+      specifier: 4.0.0-beta.85
+      version: 4.0.0-beta.85
     '@effect/platform-bun':
-      specifier: 4.0.0-beta.83
-      version: 4.0.0-beta.83
+      specifier: 4.0.0-beta.85
+      version: 4.0.0-beta.85
     '@effect/platform-node':
-      specifier: 4.0.0-beta.83
-      version: 4.0.0-beta.83
+      specifier: 4.0.0-beta.85
+      version: 4.0.0-beta.85
     '@effect/sql-pg':
-      specifier: 4.0.0-beta.83
-      version: 4.0.0-beta.83
+      specifier: 4.0.0-beta.85
+      version: 4.0.0-beta.85
     '@effect/vitest':
-      specifier: ^4.0.0-beta.80
-      version: 4.0.0-beta.84
+      specifier: ^4.0.0-beta.85
+      version: 4.0.0-beta.91
     '@nx/devkit':
-      specifier: ^22.7.5
-      version: 22.7.5
+      specifier: ^23.0.0
+      version: 23.0.1
     '@swc-node/register':
       specifier: ^1.10.9
       version: 1.11.1
@@ -37,35 +37,35 @@ catalogs:
       specifier: ^1.3.14
       version: 1.3.14
     '@typescript/native-preview':
-      specifier: 7.0.0-dev.20260614.1
-      version: 7.0.0-dev.20260614.1
+      specifier: 7.0.0-dev.20260621.1
+      version: 7.0.0-dev.20260621.1
     '@vitest/coverage-istanbul':
-      specifier: ^4.1.8
-      version: 4.1.8
+      specifier: ^4.1.9
+      version: 4.1.9
     effect:
-      specifier: 4.0.0-beta.83
-      version: 4.0.0-beta.83
+      specifier: 4.0.0-beta.85
+      version: 4.0.0-beta.85
     knip:
-      specifier: ^6.15.0
-      version: 6.16.1
+      specifier: ^6.17.1
+      version: 6.23.0
     nx:
       specifier: ^23.0.0
       version: 23.0.0
     oxfmt:
-      specifier: ^0.54.0
-      version: 0.54.0
+      specifier: ^0.55.0
+      version: 0.55.0
     oxlint:
-      specifier: ^1.68.0
-      version: 1.69.0
+      specifier: ^1.70.0
+      version: 1.71.0
     oxlint-tsgolint:
       specifier: ^0.23.0
       version: 0.23.0
     tldts:
-      specifier: ^7.4.2
-      version: 7.4.2
+      specifier: ^7.4.3
+      version: 7.4.5
     vitest:
-      specifier: ^4.1.8
-      version: 4.1.8
+      specifier: ^4.1.9
+      version: 4.1.9
 
 importers:
 
@@ -84,8 +84,8 @@ importers:
         specifier: 0.0.75
         version: 0.0.75
       verdaccio:
-        specifier: ^6.7.2
-        version: 6.7.2(typanion@3.14.0)
+        specifier: ^6.7.4
+        version: 6.7.4(typanion@3.14.0)
 
   apps/cli:
     dependencies:
@@ -94,26 +94,26 @@ importers:
         version: 6.2.3
     devDependencies:
       '@anthropic-ai/claude-agent-sdk':
-        specifier: ^0.3.177
-        version: 0.3.177(@anthropic-ai/sdk@0.104.1(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(zod@4.4.3)
+        specifier: ^0.3.185
+        version: 0.3.185(@anthropic-ai/sdk@0.105.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(zod@4.4.3)
       '@anthropic-ai/sdk':
-        specifier: ^0.104.1
-        version: 0.104.1(zod@4.4.3)
+        specifier: ^0.105.0
+        version: 0.105.0(zod@4.4.3)
       '@clack/prompts':
-        specifier: ^1.5.1
-        version: 1.5.1
+        specifier: ^1.6.0
+        version: 1.6.0
       '@effect/atom-react':
         specifier: 'catalog:'
-        version: 4.0.0-beta.83(effect@4.0.0-beta.83)(react@19.2.7)(scheduler@0.27.0)
+        version: 4.0.0-beta.85(effect@4.0.0-beta.85)(react@19.2.7)(scheduler@0.27.0)
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.0-beta.83(effect@4.0.0-beta.83)
+        version: 4.0.0-beta.85(effect@4.0.0-beta.85)
       '@effect/sql-pg':
         specifier: 'catalog:'
-        version: 4.0.0-beta.83(effect@4.0.0-beta.83)
+        version: 4.0.0-beta.85(effect@4.0.0-beta.85)
       '@effect/vitest':
         specifier: 'catalog:'
-        version: 4.0.0-beta.84(effect@4.0.0-beta.83)(vitest@4.1.8)
+        version: 4.0.0-beta.91(effect@4.0.0-beta.85)(vitest@4.1.9)
       '@modelcontextprotocol/sdk':
         specifier: ^1.29.0
         version: 1.29.0(zod@4.4.3)
@@ -152,49 +152,49 @@ importers:
         version: 19.2.17
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260614.1
+        version: 7.0.0-dev.20260621.1
       '@vercel/detect-agent':
         specifier: ^1.2.3
         version: 1.2.3
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.8(vitest@4.1.8)
+        version: 4.1.9(vitest@4.1.9)
       dotenv:
         specifier: ^17.4.2
         version: 17.4.2
       effect:
         specifier: 'catalog:'
-        version: 4.0.0-beta.83
+        version: 4.0.0-beta.85
       esbuild:
         specifier: ^0.28.1
         version: 0.28.1
       ink:
-        specifier: ^7.0.6
-        version: 7.0.6(@types/react@19.2.17)(react-devtools-core@7.0.1)(react@19.2.7)
+        specifier: ^7.1.0
+        version: 7.1.0(@types/react@19.2.17)(react-devtools-core@7.0.1)(react@19.2.7)
       ink-spinner:
         specifier: ^5.0.0
-        version: 5.0.0(ink@7.0.6(@types/react@19.2.17)(react-devtools-core@7.0.1)(react@19.2.7))(react@19.2.7)
+        version: 5.0.0(ink@7.1.0(@types/react@19.2.17)(react-devtools-core@7.0.1)(react@19.2.7))(react@19.2.7)
       knip:
         specifier: 'catalog:'
-        version: 6.16.1
+        version: 6.23.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.54.0
+        version: 0.55.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.69.0(oxlint-tsgolint@0.23.0)
+        version: 1.71.0(oxlint-tsgolint@0.23.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
         version: 0.23.0
       pg:
-        specifier: ^8.21.0
-        version: 8.21.0
+        specifier: ^8.22.0
+        version: 8.22.0
       pg-copy-streams:
         specifier: ^7.0.0
         version: 7.0.0
       posthog-node:
-        specifier: ^5.37.0
-        version: 5.37.0
+        specifier: ^5.38.2
+        version: 5.38.2
       react:
         specifier: ^19.2.7
         version: 19.2.7
@@ -205,14 +205,14 @@ importers:
         specifier: ^25.0.5
         version: 25.0.5(typescript@6.0.3)
       smol-toml:
-        specifier: ^1.6.1
-        version: 1.6.1
+        specifier: ^1.7.0
+        version: 1.7.0
       tldts:
         specifier: 'catalog:'
-        version: 7.4.2
+        version: 7.4.5
       vitest:
         specifier: 'catalog:'
-        version: 4.1.8(@types/node@25.9.3)(@vitest/coverage-istanbul@4.1.8)(vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
       yaml:
         specifier: ^2.9.0
         version: 2.9.0
@@ -256,37 +256,37 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260614.1
+        version: 7.0.0-dev.20260621.1
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.8(vitest@4.1.8)
+        version: 4.1.9(vitest@4.1.9)
       knip:
         specifier: 'catalog:'
-        version: 6.16.1
+        version: 6.23.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.54.0
+        version: 0.55.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.69.0(oxlint-tsgolint@0.23.0)
+        version: 1.71.0(oxlint-tsgolint@0.23.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
         version: 0.23.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.8(@types/node@25.9.3)(@vitest/coverage-istanbul@4.1.8)(vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
   apps/docs:
     dependencies:
       fumadocs-core:
-        specifier: ^16.10.2
-        version: 16.10.2(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.21.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3)
+        specifier: ^16.10.5
+        version: 16.10.5(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.22.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3)
       fumadocs-mdx:
         specifier: ^15.0.12
-        version: 15.0.12(@types/mdast@4.0.4)(@types/mdx@2.0.14)(@types/react@19.2.17)(fumadocs-core@16.10.2(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.21.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(rolldown@1.0.2)(vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 15.0.12(@types/mdast@4.0.4)(@types/mdx@2.0.14)(@types/react@19.2.17)(fumadocs-core@16.10.5(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.22.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(rolldown@1.0.2)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
       fumadocs-ui:
-        specifier: ^16.10.2
-        version: 16.10.2(@types/mdx@2.0.14)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(fumadocs-core@16.10.2(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.21.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        specifier: ^16.10.5
+        version: 16.10.5(@types/mdx@2.0.14)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(fumadocs-core@16.10.5(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.22.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       next:
         specifier: ^16.2.9
         version: 16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
@@ -301,8 +301,8 @@ importers:
         specifier: ^2.0.14
         version: 2.0.14
       '@types/node':
-        specifier: ^25.9.2
-        version: 25.9.3
+        specifier: ^26.0.0
+        version: 26.0.1
       '@types/react':
         specifier: ^19.2.17
         version: 19.2.17
@@ -317,13 +317,13 @@ importers:
     dependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.0-beta.83(effect@4.0.0-beta.83)
+        version: 4.0.0-beta.85(effect@4.0.0-beta.85)
       '@effect/platform-node':
         specifier: 'catalog:'
-        version: 4.0.0-beta.83(effect@4.0.0-beta.83)(ioredis@5.11.0)
+        version: 4.0.0-beta.85(effect@4.0.0-beta.85)(ioredis@5.11.0)
       effect:
         specifier: 'catalog:'
-        version: 4.0.0-beta.83
+        version: 4.0.0-beta.85
       undici:
         specifier: ^8.5.0
         version: 8.5.0
@@ -336,25 +336,25 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260614.1
+        version: 7.0.0-dev.20260621.1
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.8(vitest@4.1.8)
+        version: 4.1.9(vitest@4.1.9)
       knip:
         specifier: 'catalog:'
-        version: 6.16.1
+        version: 6.23.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.54.0
+        version: 0.55.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.69.0(oxlint-tsgolint@0.23.0)
+        version: 1.71.0(oxlint-tsgolint@0.23.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
         version: 0.23.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.8(@types/node@25.9.3)(@vitest/coverage-istanbul@4.1.8)(vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
   packages/cli-darwin-arm64: {}
 
@@ -378,25 +378,25 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260614.1
+        version: 7.0.0-dev.20260621.1
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.8(vitest@4.1.8)
+        version: 4.1.9(vitest@4.1.9)
       knip:
         specifier: 'catalog:'
-        version: 6.16.1
+        version: 6.23.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.54.0
+        version: 0.55.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.69.0(oxlint-tsgolint@0.23.0)
+        version: 1.71.0(oxlint-tsgolint@0.23.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
         version: 0.23.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.8(@types/node@25.9.3)(@vitest/coverage-istanbul@4.1.8)(vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
   packages/cli-windows-arm64: {}
 
@@ -406,19 +406,19 @@ importers:
     dependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.0-beta.83(effect@4.0.0-beta.83)
+        version: 4.0.0-beta.85(effect@4.0.0-beta.85)
       '@effect/platform-node':
         specifier: 'catalog:'
-        version: 4.0.0-beta.83(effect@4.0.0-beta.83)(ioredis@5.11.0)
+        version: 4.0.0-beta.85(effect@4.0.0-beta.85)(ioredis@5.11.0)
       dedent:
         specifier: ^1.7.2
         version: 1.7.2
       effect:
         specifier: 'catalog:'
-        version: 4.0.0-beta.83
+        version: 4.0.0-beta.85
       smol-toml:
-        specifier: ^1.6.1
-        version: 1.6.1
+        specifier: ^1.7.0
+        version: 1.7.0
     devDependencies:
       '@tsconfig/bun':
         specifier: 'catalog:'
@@ -428,38 +428,38 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260614.1
+        version: 7.0.0-dev.20260621.1
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.8(vitest@4.1.8)
+        version: 4.1.9(vitest@4.1.9)
       knip:
         specifier: 'catalog:'
-        version: 6.16.1
+        version: 6.23.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.54.0
+        version: 0.55.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.69.0(oxlint-tsgolint@0.23.0)
+        version: 1.71.0(oxlint-tsgolint@0.23.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
         version: 0.23.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.8(@types/node@25.9.3)(@vitest/coverage-istanbul@4.1.8)(vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
   packages/process-compose:
     dependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.0-beta.83(effect@4.0.0-beta.83)
+        version: 4.0.0-beta.85(effect@4.0.0-beta.85)
       effect:
         specifier: 'catalog:'
-        version: 4.0.0-beta.83
+        version: 4.0.0-beta.85
     devDependencies:
       '@effect/vitest':
         specifier: 'catalog:'
-        version: 4.0.0-beta.84(effect@4.0.0-beta.83)(vitest@4.1.8)
+        version: 4.0.0-beta.91(effect@4.0.0-beta.85)(vitest@4.1.9)
       '@tsconfig/bun':
         specifier: 'catalog:'
         version: 1.0.10
@@ -468,34 +468,34 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260614.1
+        version: 7.0.0-dev.20260621.1
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.8(vitest@4.1.8)
+        version: 4.1.9(vitest@4.1.9)
       knip:
         specifier: 'catalog:'
-        version: 6.16.1
+        version: 6.23.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.54.0
+        version: 0.55.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.69.0(oxlint-tsgolint@0.23.0)
+        version: 1.71.0(oxlint-tsgolint@0.23.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
         version: 0.23.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.8(@types/node@25.9.3)(@vitest/coverage-istanbul@4.1.8)(vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
   packages/stack:
     dependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.0-beta.83(effect@4.0.0-beta.83)
+        version: 4.0.0-beta.85(effect@4.0.0-beta.85)
       '@effect/platform-node':
         specifier: 'catalog:'
-        version: 4.0.0-beta.83(effect@4.0.0-beta.83)(ioredis@5.11.0)
+        version: 4.0.0-beta.85(effect@4.0.0-beta.85)(ioredis@5.11.0)
       '@supabase/config':
         specifier: workspace:*
         version: link:../config
@@ -504,14 +504,14 @@ importers:
         version: link:../process-compose
       effect:
         specifier: 'catalog:'
-        version: 4.0.0-beta.83
+        version: 4.0.0-beta.85
     devDependencies:
       '@effect/vitest':
         specifier: 'catalog:'
-        version: 4.0.0-beta.84(effect@4.0.0-beta.83)(vitest@4.1.8)
+        version: 4.0.0-beta.91(effect@4.0.0-beta.85)(vitest@4.1.9)
       '@supabase/supabase-js':
-        specifier: ^2.108.1
-        version: 2.108.1
+        specifier: ^2.108.2
+        version: 2.108.2
       '@tsconfig/bun':
         specifier: 'catalog:'
         version: 1.0.10
@@ -520,34 +520,34 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260614.1
+        version: 7.0.0-dev.20260621.1
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
-        version: 4.1.8(vitest@4.1.8)
+        version: 4.1.9(vitest@4.1.9)
       knip:
         specifier: 'catalog:'
-        version: 6.16.1
+        version: 6.23.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.54.0
+        version: 0.55.0
       oxlint:
         specifier: 'catalog:'
-        version: 1.69.0(oxlint-tsgolint@0.23.0)
+        version: 1.71.0(oxlint-tsgolint@0.23.0)
       oxlint-tsgolint:
         specifier: 'catalog:'
         version: 0.23.0
       vitest:
         specifier: 'catalog:'
-        version: 4.1.8(@types/node@25.9.3)(@vitest/coverage-istanbul@4.1.8)(vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
   tools/nx-plugins:
     dependencies:
       '@nx/devkit':
         specifier: 'catalog:'
-        version: 22.7.5(nx@23.0.0(@swc-node/register@1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.41))
+        version: 23.0.1(nx@23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.41))
       vitest:
         specifier: 'catalog:'
-        version: 4.1.8(@types/node@25.9.3)(@vitest/coverage-istanbul@4.1.8)(vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
 packages:
 
@@ -567,60 +567,60 @@ packages:
     resolution: {integrity: sha512-p+CMKJ93HFmLkjXKlXiVGlMQEuRb6H0MokBSwUsX+S6BRX8eV5naFZpQJFfJHjRZY0Hmnqy1/r6UWl3x+19zYA==}
     engines: {node: '>=18'}
 
-  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.177':
-    resolution: {integrity: sha512-u9Ty+KPllm2nw0RatdPF0zcPRquNZjVptmyLG0DqduGbgZDLQpfPFMF5hffFIRnVaXhx7+jkUmEdw0jrda0UcA==}
+  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.185':
+    resolution: {integrity: sha512-P2Svxx1IFrS9aw4ylJBtcoJrc/OAOVnDs+o05x4TV7HoHUQUcKZ9XhWOGnadyVT0KLyoktgjyjnaK7Zdtc0Ldg==}
     cpu: [arm64]
     os: [darwin]
 
-  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.177':
-    resolution: {integrity: sha512-ona6Jv54XFwBTqOj3MzLWfKtc2m7Rdh58wOAX9Hnue/6FcWfyeuz/UDcidVTXQ7Xytz//Tb0JJgFtiQjO7FbIA==}
+  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.185':
+    resolution: {integrity: sha512-H69m2hIJawzSkCDNO/CPLQCYvDGdlbZdzGTgGF8/IQuB4O81sv8WSAh6TBXwtFXOgEi4HtrUYlxiFDmTHt7hMA==}
     cpu: [x64]
     os: [darwin]
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.177':
-    resolution: {integrity: sha512-v6PMDD3h2erLuTK5S2ZvExqdL3v44OyC70XpKhyqIUnyPaGR9YAMjh//EKdWC+mNvt6mIbRZpaDcHtbASVW8Rw==}
+  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.185':
+    resolution: {integrity: sha512-1GRpKYrg5foomW+qLrxm/k2R/5PEU7RAuEdX65HV6lFMJR3HsGj8qfBq4KCJHTS3r4YdVrFLvPQ/mUqbY6klIA==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.177':
-    resolution: {integrity: sha512-wBCbklkaDb483Ab4DUFfmJjZJKXz58YXPv+CiGsyjq1St19mbKEma5KKz3Ya9mlV8aLyh4zmLK2mEHPnF//Ipg==}
+  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.185':
+    resolution: {integrity: sha512-KtXMCoprGYTSPb/A0/kjrO+PpDJAFbHhDd8rjqA4izU51OYjTDkahsGCcSTFM2jA8krOhPqzx/SNVuAVWmexwA==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.177':
-    resolution: {integrity: sha512-1cdEO06WoEsl1JnnLCPIlg/8x37GtBsTuj65gIpSjdrImNBjgIuMWVyceP4qaXhFjtQgYK1nx3TpaxEFVDOrDg==}
+  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.185':
+    resolution: {integrity: sha512-YAky0Oez+YYrlcas/xDiaCm9AUX0z1YwM+pnk+CFxEr/ICmc7MbiFsnEIXFLPHaox9bE5iOzw4LS4b/c1tIJRg==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.177':
-    resolution: {integrity: sha512-WDP6puwPHscggNAfvIxyUSHSAjfUEkGRfnMXEPBHOqO+qjX2KGxeE13/ih3EVioeBVOUIqPui6VB05vXLa6T9Q==}
+  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.185':
+    resolution: {integrity: sha512-8U5wu6dNcyzRkwoae0Gu5ZHs6lRSu8CXqd9yrilX3fHR9kKICrm76bLu5q2auuSc/8dx6VL5ZXqSzFKIMp//zw==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.177':
-    resolution: {integrity: sha512-xLgDWnZaYohtFrkgEIkGZdP+rp4sXxAMbbpEvEp0LK1vAYmJam/ztT2yoK6gfI58IbToJq1WGUEX2HVnE65yOg==}
+  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.185':
+    resolution: {integrity: sha512-pJEOaCLQQQWSyBeseR/GAn4eEp4WtMDP/o5yPMuuAsNWeoJXM7cY4j/N3KBE6GZofgnYdWEXILF2uw3SjbtINA==}
     cpu: [arm64]
     os: [win32]
 
-  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.177':
-    resolution: {integrity: sha512-SIdQLbtF//rYK4KDBNpUPyjyui7NwCFPZ2/3vyW3TR8R8xynkNq3cLis90FnPSgxaSshi38vkJYWh+9kGDB7zg==}
+  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.185':
+    resolution: {integrity: sha512-/Kf9XneSuIkSHNwrxOVY0XT7RovAEcx5nDASKzku4994cZz54otU5mT2jT6dwevDLEStfgts5x/A4z0AePwVTQ==}
     cpu: [x64]
     os: [win32]
 
-  '@anthropic-ai/claude-agent-sdk@0.3.177':
-    resolution: {integrity: sha512-CBzXnzR661q3AlfZzBjmIFQx0cxr36iJV3PExTYmPyGQX32qxtiFQgnxTcF8wB4hcSVf2hnoy/gprVJdkNx7cw==}
+  '@anthropic-ai/claude-agent-sdk@0.3.185':
+    resolution: {integrity: sha512-UDDd0cInvOufmR88btR/Ursnh71sb5scoutNlRS2L0LBdkt7JEqYJ0jt7DnOYHEVhMx8AAcg0eYgvXztcWUnFA==}
     engines: {node: '>=18.0.0'}
     peerDependencies:
       '@anthropic-ai/sdk': '>=0.93.0'
       '@modelcontextprotocol/sdk': ^1.29.0
       zod: ^4.0.0
 
-  '@anthropic-ai/sdk@0.104.1':
-    resolution: {integrity: sha512-gGACa/+IaiXzRRmF96aOhamoBgapKRBiFWbmmTFP8aMkpaEcuStF+Q61bjo4vPxBM7gqWJNZqsngslRdnLHv0Q==}
+  '@anthropic-ai/sdk@0.105.0':
+    resolution: {integrity: sha512-sDyu+aM9cE6uZE+HgRjjHRb+qqb87GHZOx+8bE0YlWetdL1YcVLxn8h9ltxGOflyChTe6PMEo50kMQV4cw0hfg==}
     hasBin: true
     peerDependencies:
       zod: ^3.25.0 || ^4.0.0
@@ -699,12 +699,12 @@ packages:
     resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==}
     engines: {node: '>=6.9.0'}
 
-  '@clack/core@1.4.1':
-    resolution: {integrity: sha512-FILJa1gGKEFTGZAJE9RpVhrjKz3c3h4ar60dSv6cGuDqufQ84YEIS3GAGvZiN+H6yaLbbvTFNejjCC4tXpZEuw==}
+  '@clack/core@1.4.2':
+    resolution: {integrity: sha512-0Ty/1Gfm+Kb07sXcuESjyKfwEhSy4Ns1AgeEisHb/bDY5fWme0tTeTkU14T1Gmcs17YIjB/teiDe4uaCghbYqQ==}
     engines: {node: '>= 20.12.0'}
 
-  '@clack/prompts@1.5.1':
-    resolution: {integrity: sha512-zccHj2z2oCCO4yrDiRSlFOxWerGqRiysP7a5jPK6uoI9URKAquwY42Dd/iUP8JWHxEzdRe4TlbvZCo8z1/mhrw==}
+  '@clack/prompts@1.6.0':
+    resolution: {integrity: sha512-EYlRokl8szrP9Z25qT5aepMdBjzBvHF9ZEhzIiUBc9guz/T31EqRgvD0QSgZcpE93xiwrr+OkB4nz0BZyF6fSA==}
     engines: {node: '>= 20.12.0'}
 
   '@colors/colors@1.5.0':
@@ -715,51 +715,60 @@ packages:
     resolution: {integrity: sha512-hauBrOdvu08vOsagkZ/Aju5XuiZx6ldsLfByg1htFeldhex+PeMrYauANzFsMJeAA0+dyPLbDoX2OYuvVoLDkQ==}
     engines: {node: '>= 6'}
 
-  '@effect/atom-react@4.0.0-beta.83':
-    resolution: {integrity: sha512-Vpk90KP32fKxTgDbQPwgI9o4DzPUwxRVVf1wzlHHq7p4GgxGKEKJNGkKcinH9Br2MJB2JItaIs6cluFnlszxBw==}
+  '@effect/atom-react@4.0.0-beta.85':
+    resolution: {integrity: sha512-DsBau/iXF8GN6lpbObhwTsP0HcqzoaSJWzbewIUHp/SY2YeQV2bvo0IfPa0dhfwACZHZmhgzdPUaD7SpFyukmg==}
     peerDependencies:
-      effect: ^4.0.0-beta.83
+      effect: ^4.0.0-beta.85
       react: ^19.2.4
       scheduler: '*'
 
-  '@effect/platform-bun@4.0.0-beta.83':
-    resolution: {integrity: sha512-Mop8U1Ad1FFyL6C4VWWCCYG3Mh7BHvGsfhYAIfBZffEDRjgUME1Ol8rno2CoHYzJ6qaUOL8D4djtPGkwS68/Qw==}
+  '@effect/platform-bun@4.0.0-beta.85':
+    resolution: {integrity: sha512-hSOCmUiIFQ6uWGlmfKF0ZS3dK2VQLLhrlTJU3I9rqQTfwDVGUUeoVR8I2wvmBZercYLClt/OsLTR6KQ1RbCZkA==}
     peerDependencies:
-      effect: ^4.0.0-beta.83
+      effect: ^4.0.0-beta.85
 
-  '@effect/platform-node-shared@4.0.0-beta.84':
-    resolution: {integrity: sha512-WQ6+gGMYgnuwL+rUHKlxFon1T/CfK1ezxRYSjbylqovWeA2lrO7OHDSBqdwPyXJFDt2KqkZEEtbl9HarlTF/eg==}
+  '@effect/platform-node-shared@4.0.0-beta.91':
+    resolution: {integrity: sha512-JX++yhomaOEpQmnTYuhn+pKAgKg5MQvycAf1rXGtyVKi202Nc5nK37xbywDcugfwrc1FrPxrxa3BY3lbSc74cw==}
     engines: {node: '>=18.0.0'}
     peerDependencies:
-      effect: ^4.0.0-beta.84
+      effect: ^4.0.0-beta.91
 
-  '@effect/platform-node@4.0.0-beta.83':
-    resolution: {integrity: sha512-RmpVGu/+X/Bif3/g1Rzj8oFzTOknoVB3yHCa0b179vytPpKe+Kj9ZwKNcAnKWqHUDkbSPBq1Ca60mvOHr2/+LQ==}
+  '@effect/platform-node@4.0.0-beta.85':
+    resolution: {integrity: sha512-tfZ/nUGB6gsw/b7ZQuhIv6w0iXNKOYj5m7dltd3SouY3y1BvIYrS/KxIUi4s3w8Qfx83i9l17q2Wa2b9Fzth5A==}
     engines: {node: '>=18.0.0'}
     peerDependencies:
-      effect: ^4.0.0-beta.83
+      effect: ^4.0.0-beta.85
       ioredis: ^5.7.0
 
-  '@effect/sql-pg@4.0.0-beta.83':
-    resolution: {integrity: sha512-IfcShHsnYLVQpXv9k/TFBJIKTJU6aNv5NnHZsG3qs/D3M3oxc4ntLyPyKyY+45IQNS5lI5pB1qsEAXPi0CC6WQ==}
+  '@effect/sql-pg@4.0.0-beta.85':
+    resolution: {integrity: sha512-EqyvyPf2AgOhQzr+c9Enupn3/byVBQB6W3GdHXLPx/UBMt/xPudpI/lMXnU+PFG9EajN1TAEuCCWW8hiiEgAvg==}
     peerDependencies:
-      effect: ^4.0.0-beta.83
+      effect: ^4.0.0-beta.85
 
-  '@effect/vitest@4.0.0-beta.84':
-    resolution: {integrity: sha512-TNeqfWnX34CSArTXcRPwUh7g7evQU8qEJniD7XKUj+Yv79qV9BfRC+SA2V2u2gUcZoaks9RC1K2Ha49UOUz52Q==}
+  '@effect/vitest@4.0.0-beta.91':
+    resolution: {integrity: sha512-RTowh92EawJWk+PewFrbqmPSOjbJ9xcq4BcWGV4t0aaYIvZj5g5dubXUvCioh6aq4lkOnTEJmC6seGZjDFO/MQ==}
     peerDependencies:
-      effect: ^4.0.0-beta.84
+      effect: ^4.0.0-beta.91
       vitest: ^3.0.0 || ^4.0.0
 
   '@emnapi/core@1.10.0':
     resolution: {integrity: sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==}
 
+  '@emnapi/core@1.11.0':
+    resolution: {integrity: sha512-l9Oo58x0HOP5znGzVhYW9U3e5wVuA4LAZU2AGezTmkhO1CgQRFDhDg4nneHsu/t3WniXg9QrG2nIXL/ZS8ln8Q==}
+
+  '@emnapi/core@1.11.1':
+    resolution: {integrity: sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==}
+
   '@emnapi/core@1.4.5':
     resolution: {integrity: sha512-XsLw1dEOpkSX/WucdqUhPWP7hDxSvZiY+fsUC14h+FtQ2Ifni4znbBt8punRX+Uj2JG/uDb8nEHVKvrVlvdZ5Q==}
 
   '@emnapi/runtime@1.10.0':
     resolution: {integrity: sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==}
 
+  '@emnapi/runtime@1.11.0':
+    resolution: {integrity: sha512-55coeOFKHv1ywEcUXJtWU5f+Jr/W5tZDvZig8DLKSwUN1JpROQ4rk/SNOQiFWmaR/VKF4zuFyW1B8JduOSv6Pg==}
+
   '@emnapi/runtime@1.11.1':
     resolution: {integrity: sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==}
 
@@ -772,6 +781,9 @@ packages:
   '@emnapi/wasi-threads@1.2.1':
     resolution: {integrity: sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==}
 
+  '@emnapi/wasi-threads@1.2.2':
+    resolution: {integrity: sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==}
+
   '@esbuild/aix-ppc64@0.28.1':
     resolution: {integrity: sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==}
     engines: {node: '>=18'}
@@ -1283,6 +1295,12 @@ packages:
       '@emnapi/core': ^1.7.1
       '@emnapi/runtime': ^1.7.1
 
+  '@napi-rs/wasm-runtime@1.1.6':
+    resolution: {integrity: sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg==}
+    peerDependencies:
+      '@emnapi/core': ^1.7.1
+      '@emnapi/runtime': ^1.7.1
+
   '@next/env@16.2.9':
     resolution: {integrity: sha512-ki5VxxXfzD/9TDe13wyeTKIjQTAwBVpnr8KhRDUr8ltMUq1/NBpWNT5tiPoxiGl+PHM4X2ahSOiPk6iAimIzPg==}
 
@@ -1350,65 +1368,119 @@ packages:
     resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
     engines: {node: '>= 8'}
 
-  '@nx/devkit@22.7.5':
-    resolution: {integrity: sha512-/63ziS7kdHXYTLLhwWBu9hFwoFFT8xf+PkcQjsNdPqc5JmkYkSew0cE/vp5ORgBpGLWWnFPJgmfqjbJoO2C7jA==}
+  '@nx/devkit@23.0.1':
+    resolution: {integrity: sha512-A/chuNS1RZwdbRe/Nf+w0qtPEFHLcZNPzo8Abw5mBxyXmy9yvHZpuZuqDbt/lASFU+TEb74xExL1AnKWwqpOIg==}
     peerDependencies:
-      nx: '>= 21 <= 23 || ^22.0.0-0'
+      nx: '>= 22 <= 24 || ^23.0.0-0'
 
   '@nx/nx-darwin-arm64@23.0.0':
     resolution: {integrity: sha512-c/rXP3LYXJLC1F+9KDrWE+n1nkDnTEfHnA1KAK3A/CSk8EfgY0RhekcdbGISrHqgbccdVTBRTNUeTdwD+w23Xw==}
     cpu: [arm64]
     os: [darwin]
 
+  '@nx/nx-darwin-arm64@23.0.1':
+    resolution: {integrity: sha512-gQJvgPnbI91DBe23Th2CqD9R/S54cPS3C1f0DhyQ8YEf9rR7EEc+sVGjhgVxlhfOk2W7I1Gy6EkXwpN4aDoW4w==}
+    cpu: [arm64]
+    os: [darwin]
+
   '@nx/nx-darwin-x64@23.0.0':
     resolution: {integrity: sha512-fb1+s0dASz/a+0Ex3Qdw6Y1NssMZ58f8SyQtnr+c7ITM8Yi5njWfNVZMk1tAnAv7CSFvUvltaYekS88GMQ/8lQ==}
     cpu: [x64]
     os: [darwin]
 
+  '@nx/nx-darwin-x64@23.0.1':
+    resolution: {integrity: sha512-e/lvzHKN6gpuD7MqEtfH1fOfnR75E55ytYNt8jaRxKI6EvpCq+Q3MunDuh9GQYAkqDrUqE7AhHrHc+eKATVEHw==}
+    cpu: [x64]
+    os: [darwin]
+
   '@nx/nx-freebsd-x64@23.0.0':
     resolution: {integrity: sha512-HYawS59K5IyNu28/0i0ectTAPlyBwPO0vhxw9UMGZ9ni6Yz3WvwPFTGZrWaEVAjGe3pQlQEVVBOr5/0Uw0Sw9A==}
     cpu: [x64]
     os: [freebsd]
 
+  '@nx/nx-freebsd-x64@23.0.1':
+    resolution: {integrity: sha512-f582OhSYN9qHpA9Ox9qnr3kZSZ7gQHs7crmBUutmbXmZQB2TDS/TlhvYSNnxudpwHR/tuWGi2IOQqa7zGOZj1Q==}
+    cpu: [x64]
+    os: [freebsd]
+
   '@nx/nx-linux-arm-gnueabihf@23.0.0':
     resolution: {integrity: sha512-GSPVEUKL/PUuKCubNcH+QtOJ+4+VFHSpKDMTFFjizTh//d4SunC+DE6vvwRt5bCervohCW2B7BicQc6IP2V51g==}
     cpu: [arm]
     os: [linux]
 
+  '@nx/nx-linux-arm-gnueabihf@23.0.1':
+    resolution: {integrity: sha512-VjhqPc6E7aiI0e+lowrkVbdyulsmP9fgMdcX1mCzXCEu/XZDcUbZ5qveR964cMhvm5qKn0ILJtJOUqZgmOT3Xg==}
+    cpu: [arm]
+    os: [linux]
+
   '@nx/nx-linux-arm64-gnu@23.0.0':
     resolution: {integrity: sha512-MkpI1SU+OxJ86SL5XcNJLKXsvnxzDwq4uh7Wbehcs62IWXtyGeuxHo1jYGrobYSV8v9f0Aafp3c2GxSxdZX/9Q==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
+  '@nx/nx-linux-arm64-gnu@23.0.1':
+    resolution: {integrity: sha512-zX2JdHQejZWB3DRgNsh77qOVYaSSjSLuBP2qIqc7EWVlCUnR7Aj3e65PTIps4LxMMmUp4twZA2ezS0rtyK2A4w==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
   '@nx/nx-linux-arm64-musl@23.0.0':
     resolution: {integrity: sha512-yASOY5MpsuzHKSF4xRyoVCIWv65GDlVs9VxZ+aZIfw5R9XbPgiaHaHRGlLBAm0j7WFw7wBCOB3WOxBK+wjC3dQ==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
+  '@nx/nx-linux-arm64-musl@23.0.1':
+    resolution: {integrity: sha512-9lyhxRNBgNYwHt6paq0OLzoKNoEGF5LnNW2YYrgFY8Cjtsg/Q4pcfZ1vB5o9FX9OmUgUQs3t2d4tU8YDukRUWg==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
   '@nx/nx-linux-x64-gnu@23.0.0':
     resolution: {integrity: sha512-HvDP11Ub00C7kAMC7NvX+sbV8wM5j+OjLQalys0wlyqZ+7SL9OulQv/cyMCEHZSKW8YPt4326G0+omulZDwIGg==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
+  '@nx/nx-linux-x64-gnu@23.0.1':
+    resolution: {integrity: sha512-kVszY2xRyyrCXgdCdM1qG1WUhDjNPZxtdWq86a0TyIRJjfJTP9NHqpyhmvj9c2RdZxKVWHotx6fBJzY6Vn2ZrA==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
   '@nx/nx-linux-x64-musl@23.0.0':
     resolution: {integrity: sha512-t1pSyBrxQ0Dly9VzB8WZXhVQMk044P8AyMRRiZ+NOs1pK4eRqVlmJmwJQw3ZfZZYUhA7B02PV8DHOjactctdag==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
+  '@nx/nx-linux-x64-musl@23.0.1':
+    resolution: {integrity: sha512-co71K2n4zcS1SYR8EBRlCvIko7M1YycO2tZL0nrCrga87AF5dzCwx+wEclpyCR/4tNOY3FrACk4gIkVskh3CdA==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
   '@nx/nx-win32-arm64-msvc@23.0.0':
     resolution: {integrity: sha512-IKTwZZgejzyUZChQjGss2cCSi2rR0J3FnpyQkjt9I4fFYTNd4YCNs5njovrBjQtVLpi/vv3e96fl3ccjbzIUpA==}
     cpu: [arm64]
     os: [win32]
 
+  '@nx/nx-win32-arm64-msvc@23.0.1':
+    resolution: {integrity: sha512-7oma7iy5fbnn+x5AP7SFGMuleAA2R5RZm26dn+faikyQ4PXjoRAikWJJNiOWAeCA0BaMAeVedI6fJeAsVeDUKg==}
+    cpu: [arm64]
+    os: [win32]
+
   '@nx/nx-win32-x64-msvc@23.0.0':
     resolution: {integrity: sha512-2LSdp8U5gDaXtXbGLiKRdQM0f4yNCaraCpQrz27yjlQbyrULyCiaB00NPBL2JlhH9eQahx/QRyizhkMQ0hzVBA==}
     cpu: [x64]
     os: [win32]
 
+  '@nx/nx-win32-x64-msvc@23.0.1':
+    resolution: {integrity: sha512-TE/wvBa2cpkVXmk/AXUQAneong4JReS2hyNpAUONKG1yXU7TDKe0wvn1xQXxAbyspudT9NuCnVtpVuEkRz8S+Q==}
+    cpu: [x64]
+    os: [win32]
+
   '@octokit/auth-token@6.0.0':
     resolution: {integrity: sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==}
     engines: {node: '>= 20'}
@@ -1461,129 +1533,129 @@ packages:
     resolution: {integrity: sha512-a61ljmRVVyG5MC/698C8/FfFDw5a8LOIvyOLW5fztgUXqUpc1jOfQzOitSCbge657OgXXThmY3Tk8fpiDb4UcA==}
     engines: {node: '>= 20.0.0'}
 
-  '@oxc-parser/binding-android-arm-eabi@0.133.0':
-    resolution: {integrity: sha512-l/44caGse+VpnY9gx0yvvc5QnnG3yG1FO3KZgYvNL1GZrfK86zIwAOgGEVlxDyRymzrU/KHiblPFpevKOmJmUA==}
+  '@oxc-parser/binding-android-arm-eabi@0.137.0':
+    resolution: {integrity: sha512-KDs+0VPdEmasOkpuJHW9V5WCF+cvYdMQv2Jd+aJXt+cxIx12NToRQRbXaRwUEDsZw+/jMk81Ve8ZFbjUkJTOwA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxc-parser/binding-android-arm64@0.133.0':
-    resolution: {integrity: sha512-KUHmPMziLBp4u+zbrLdB7iWS7KshuZe+RAp7ELnY9SI9nNXBZ+dp8fiBqWOxhXqn+FQg3a4UcQhwmsJOKV8Jjg==}
+  '@oxc-parser/binding-android-arm64@0.137.0':
+    resolution: {integrity: sha512-WhALNzfy3x/RfC6bsqX+csavuUY0yHHE7XfgPE5M542uhoBZUUoGTPG+nkMbGoG4+gcfss5s7urMyn5QBHu0sw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxc-parser/binding-darwin-arm64@0.133.0':
-    resolution: {integrity: sha512-q8dWmnU/8ea2tga9w2f1PinQ5rcMPDUGkF64T189b65YMjUomET4oy5oRldOr4AwOQkneOG/Zttnz1Dvrc62wg==}
+  '@oxc-parser/binding-darwin-arm64@0.137.0':
+    resolution: {integrity: sha512-bFPr5hgmNMOMoyPTGtdsK4Ug21RovIPojRMgDDhSp1LtCnc/DkLwGONKjgRjszg677RlGnkYSviQ8hHaUPOVYA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxc-parser/binding-darwin-x64@0.133.0':
-    resolution: {integrity: sha512-cOKeIELIB2bJnCKwqx4Rdj+1Lss/U6uCbLxRySZrhyOOQa1flKhwZFjEHRHxk8fU1NKmhK5OnTdPQ4CpjuFuVw==}
+  '@oxc-parser/binding-darwin-x64@0.137.0':
+    resolution: {integrity: sha512-CL5dMm1asqXIDZHg14FLxj3Mc36w8PI7xCWh1uA4is6z8g2XrIILoTcQYOxDbwzuk34RDPX5IAGUxZr6LA9KAg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxc-parser/binding-freebsd-x64@0.133.0':
-    resolution: {integrity: sha512-OpaSv4pW3KgFrMYQxTaS0aOE4T1DQF3qZE/4B6uqqv1KgPWWd4UQhJALi8PJPX1RRV5K7ThKXRfF7qGg2+3l1A==}
+  '@oxc-parser/binding-freebsd-x64@0.137.0':
+    resolution: {integrity: sha512-79h8rYGnSlKPGWo7mHr2ixO6ea7aW8B0CT965SZ8SLbNnCOH5aOYBTeVXUY6eMvEaiLyWr8Skuiugr5pDYgLGw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxc-parser/binding-linux-arm-gnueabihf@0.133.0':
-    resolution: {integrity: sha512-JGK1wlGrGwxBIlVSF7KWTX1/ru6BEtf28fRROztDRkLfiW+Kxa4onnriezMIiogfn9hVw2KzYcKiLjkLR2ns8A==}
+  '@oxc-parser/binding-linux-arm-gnueabihf@0.137.0':
+    resolution: {integrity: sha512-ASgmlSimhGyr0lksgVIo6hibz1obnDq4qJbiMX/AzltfgPnanRrzG1Q+23g8ljOHOjv6dsznkUuCYL3gg0sY1Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxc-parser/binding-linux-arm-musleabihf@0.133.0':
-    resolution: {integrity: sha512-yuZO533Ftonxn/iyoqQzURzLQHMspvsIyfiCSNi1t/ER4eIQaR0SsmUOUm5b/lmSig7IWIUa5/BrbEkAPwcilQ==}
+  '@oxc-parser/binding-linux-arm-musleabihf@0.137.0':
+    resolution: {integrity: sha512-AU2J9aa22Sx32wRGnDjybOU9TQXXQUud5sdUi+ZB0XxwM8aToWLweV+yA0wlQm0yIUVqljquqoHCYEq9II8gJQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxc-parser/binding-linux-arm64-gnu@0.133.0':
-    resolution: {integrity: sha512-hvpbqT5pN2rR+3+xtWeizwfR/aZ0vGceg6TqYMl+ToxMpk9/tmnX7kSvQnfEUkoua8mhogzvIKsAkn0wxgblBA==}
+  '@oxc-parser/binding-linux-arm64-gnu@0.137.0':
+    resolution: {integrity: sha512-GdEtiG89yMr7XkUGxifgodXEEm2f+xW2f9CpDjlgAnBOwhTmrpQMvhOGobLVKUyzf/qHBXW16smk5zbF3nZU6w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxc-parser/binding-linux-arm64-musl@0.133.0':
-    resolution: {integrity: sha512-wJQGamIosQBoJHW9+S5XxrtKRo3eyJxsnS1XCPrqN0LHi8uw1pTqqTfn3t/NVuvbBg7Pumn4ez9Eidgcn0xbEg==}
+  '@oxc-parser/binding-linux-arm64-musl@0.137.0':
+    resolution: {integrity: sha512-EGJ+Bs8iXx8KBH8DQ5BLoEm5lnHaYjlh4/8j8vFhrr/6z4tqONy5BZDzLpKmmNWlN6Hlc5r8YOuBVHqZ9vRFEQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxc-parser/binding-linux-ppc64-gnu@0.133.0':
-    resolution: {integrity: sha512-Koaz32/O5+abIfrNGdyndgRvdOZ9jEf5/z3Ep9h3h2QWpdDiUQpVwgH0OcMXCs+l9aXxPLtkupqyVig9W6FDKw==}
+  '@oxc-parser/binding-linux-ppc64-gnu@0.137.0':
+    resolution: {integrity: sha512-vzFUQENy/fnbSe5DZWovq6tIBc1uhuMztanSW6rz1e9WdQE4gHwYuD7ZII6JnrJifd1R3RSoqiZbgRFlVL2tYQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxc-parser/binding-linux-riscv64-gnu@0.133.0':
-    resolution: {integrity: sha512-R4vOjWzxhnNWHnVLeiB6jNuIifdy9vcMXZGPc7StXcxBovI+U2zg1QhZ9o8OjV80oGivs1lX5NfPLzk4IPqlRA==}
+  '@oxc-parser/binding-linux-riscv64-gnu@0.137.0':
+    resolution: {integrity: sha512-SfVI14HBQs9gtLcUD5hTt5hsNbdrqSUNg9S8muN+LhVQ5nf1WwH3hAoK6B9NKgdYgWAQSXFXGiiBedQ4r/BKuw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxc-parser/binding-linux-riscv64-musl@0.133.0':
-    resolution: {integrity: sha512-iwgBNUTHiMdxARLYuM0SBlnYeb19iw1Ea5M+4ERZupCsBMLArti6FyZ6UfFjJxIiTDr2oW2DGQFxlQVQ/dW9rA==}
+  '@oxc-parser/binding-linux-riscv64-musl@0.137.0':
+    resolution: {integrity: sha512-e7Ppy4FCIFNQxT/ikSeIWFoQ0l+N9vgtRBtLcyZXeolTzApyVoPqEXsYPrcdM/9i0Bwk8knvYd37vaEMxHyi6g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxc-parser/binding-linux-s390x-gnu@0.133.0':
-    resolution: {integrity: sha512-ZwZNo8FZmB/gVfboQl+wXilBigGl+6nQQs+nITOeAP/HcAOjiHl6XZJL9F/KXNEspODQcbjAiyjUbeCJd9a0fA==}
+  '@oxc-parser/binding-linux-s390x-gnu@0.137.0':
+    resolution: {integrity: sha512-Bho5qFwdhqsIFR7gipYEUlqvi3SRrY8sugxXig380MIaakBB1PyU9+7dBiBVScfImTNWhijUxdBwqrprGdq5WA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxc-parser/binding-linux-x64-gnu@0.133.0':
-    resolution: {integrity: sha512-govCvWx1dBlED3uu4qXctxpRcouu9I8Kn+DBktGCl760JtlGJzc9l/OmPJKlYWSbrRqKkMZehNeZ/4Wfma7uSA==}
+  '@oxc-parser/binding-linux-x64-gnu@0.137.0':
+    resolution: {integrity: sha512-36mGWtg7PyFzjJwGDkH6/F4o2nIDEoKXLPr/X/lwqklkomQwJJt1I5GJVmGhovUEmgPK5WAeAZMqlFCehwiy9Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxc-parser/binding-linux-x64-musl@0.133.0':
-    resolution: {integrity: sha512-ssTlpXD5Mq9uCssDJPzlRWqBt4Y7Zzd9i+XZhWmK/9Y6KUIuAxVYTYiI8lxcGWi0+3/Cz4A8q9UrD4NK9Y2j7g==}
+  '@oxc-parser/binding-linux-x64-musl@0.137.0':
+    resolution: {integrity: sha512-/Jqx6+N7A44n2BdvUr7pXhVr2vFjs6WGH3unZRczwrfiH0H1zY0QwKQMG/dtRiTlKGDKGukznPT8lx84/oEsZg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxc-parser/binding-openharmony-arm64@0.133.0':
-    resolution: {integrity: sha512-51aByfXhPtLEdWG4a2Ihdw6cPWV1ei1AarALpFdDP8MLWDLE2NuUMgbo3DERR2Kt8fT/ok1GUvBiLxVGke9uUQ==}
+  '@oxc-parser/binding-openharmony-arm64@0.137.0':
+    resolution: {integrity: sha512-9Uj0qHNNl+OgT1UTGwF7ixIXU6T1u2SbMidmgPy/h1h/fl2gRS6YpAxxY1gwHofcWjoTwkoMFd8xs5Vuj6GOFA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxc-parser/binding-wasm32-wasi@0.133.0':
-    resolution: {integrity: sha512-2e16tkKp+wDO2GTAmXfxbBcCmGEaFPIJEIRBBmVKNVXSc8/fJsSIaBGyFTPHM9ST5GNWgJcYIt94rDTks+PLwA==}
+  '@oxc-parser/binding-wasm32-wasi@0.137.0':
+    resolution: {integrity: sha512-gW2vfkytNGgMVADiuzdvOfw0mWG9za20F/1fCJsif5aBMAvWJTSbpIXbIe0XkOe0VENk+PadpQ7cZgUy2sUJcA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [wasm32]
 
-  '@oxc-parser/binding-win32-arm64-msvc@0.133.0':
-    resolution: {integrity: sha512-KPTNDKbxH1cglrqTyVeXHb4Pk4oksz8EcE1/v8zqU7N4UXbiHfA/IwtXZ2U77fnRAWBbgVkl/lZbL7o3hRdejg==}
+  '@oxc-parser/binding-win32-arm64-msvc@0.137.0':
+    resolution: {integrity: sha512-x+pFANF0yL5uK/6T7lu6SlR5qid6sp//eZXKLq5iNsIE+EQg6EaS8/wsW7E91nXXjpnPhSoMOHXShSVhGRdn8w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxc-parser/binding-win32-ia32-msvc@0.133.0':
-    resolution: {integrity: sha512-Una1bNYv9zCavQrfnDR9wuZVB3itLjCEH4Oz7i6CwAJN/Xq9b+zbbcxmvdkKvvJt4Ngc/MBmIYlbLo3zS4TQ0A==}
+  '@oxc-parser/binding-win32-ia32-msvc@0.137.0':
+    resolution: {integrity: sha512-sQUqym80PFi6McRsIqfJrSu2JrSClEZIXXD+/FjAFoULEKzOPsldIdFBG96xdX8aVMzCNQ9792FPx3MfkEIrFA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxc-parser/binding-win32-x64-msvc@0.133.0':
-    resolution: {integrity: sha512-kjBhCiOGSYTwDJQuuZa7a94JbP8htWu7J0X1KwH74kV2K5eYf6eyJRYmkpCDvr0XEL8tMxYI4WU1VekblFCLgg==}
+  '@oxc-parser/binding-win32-x64-msvc@0.137.0':
+    resolution: {integrity: sha512-2AsevxlvNN4WKxpEn3RtqD5zbqMaXF+T7JXblsP4gVuY+vC9dXS4ED/PwfRCliFqoeisYS3Iro4DHzxr0TEvVA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -1591,230 +1663,333 @@ packages:
   '@oxc-project/types@0.132.0':
     resolution: {integrity: sha512-FESMOxil5Se014ui/Eq8fT5uHJo6nIRwH0PfJrZJXs6Gek3ZVFOrpUv3YIZT20m+extU98Hg1Ym72U58rlsxUQ==}
 
-  '@oxc-project/types@0.133.0':
-    resolution: {integrity: sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==}
+  '@oxc-project/types@0.137.0':
+    resolution: {integrity: sha512-WT+Gb24i8hmvo85AIv2oEYouEXkRlKAlT9WaCa3TfLgNCN+GhrJOGZuIlMouAh38Qe4QOx26eUOVsq70qXrywA==}
 
   '@oxc-resolver/binding-android-arm-eabi@11.20.0':
     resolution: {integrity: sha512-IjfWOXRgJFNdORDl+Uf1aibNgZY2guOD3zmOhx1BGVb/MIiqlFTdmjpQNplSN58lhWehnX4UNqC3QwpUo8pjJg==}
     cpu: [arm]
     os: [android]
 
+  '@oxc-resolver/binding-android-arm-eabi@11.21.3':
+    resolution: {integrity: sha512-eNU11A2WNizh04v3uyaJCootrHIaS0B9aHYXvAvVnPNk4xYSjMUjHnhQ6dewPN2MRYDskV85d1N0Aw0WNWhcyg==}
+    cpu: [arm]
+    os: [android]
+
   '@oxc-resolver/binding-android-arm64@11.20.0':
     resolution: {integrity: sha512-QqslZAuFQG8Q9xm7JuIn8JUbvywhSBMVhuQHtYW+auirZJloS41oxUUaBXk7uUhZJgp44c5zQLeVvmFaDQB+2Q==}
     cpu: [arm64]
     os: [android]
 
+  '@oxc-resolver/binding-android-arm64@11.21.3':
+    resolution: {integrity: sha512-8Q+ZjTLvn2dIcWsrmhdrEihm7q+ag/k+mkry7Z+t0QbbHaVxXQfvH9AewyVMh/WrpEKhQ3DDgx9fYbqeCpeOEw==}
+    cpu: [arm64]
+    os: [android]
+
   '@oxc-resolver/binding-darwin-arm64@11.20.0':
     resolution: {integrity: sha512-MUcavykj2ewlR+kc5arpg4tC2RvzJkUxWtNv74pf7lcNk00GpIpN43vXMj+j6r4eMmfZhlb8hueKoIb8e9kAGQ==}
     cpu: [arm64]
     os: [darwin]
 
+  '@oxc-resolver/binding-darwin-arm64@11.21.3':
+    resolution: {integrity: sha512-wkh0qKZGHXVUDxFw3oA1TXnU2BDYY/r775oJflGeIr8uDPPoN2pk8gijQIzYRT6hoql/lg3+Tx/SaTn9e2/aGg==}
+    cpu: [arm64]
+    os: [darwin]
+
   '@oxc-resolver/binding-darwin-x64@11.20.0':
     resolution: {integrity: sha512-BGB16nRUK5Etiv//ihPyzj8Lj1px0mhh4YIfe0FDf045ywknfSm0GEbiRESpr6Q4K82AvnyaRIhhluHByvS4bg==}
     cpu: [x64]
     os: [darwin]
 
+  '@oxc-resolver/binding-darwin-x64@11.21.3':
+    resolution: {integrity: sha512-HbNc23FAQYbuyDV2vBWMez4u4mrsm5RAkniGZAWqr6lYZ3N4beeqIb776jzwRl8qL2zRhHVXpUj97X0QgogVzg==}
+    cpu: [x64]
+    os: [darwin]
+
   '@oxc-resolver/binding-freebsd-x64@11.20.0':
     resolution: {integrity: sha512-JZgtePaqj3qmD5XFHJaSLWzHRxQu0LaPkdoM1KJXYADvAaa83ijXHclV3ej3CueeW0wxfIAbGCZVP45J0CA7uQ==}
     cpu: [x64]
     os: [freebsd]
 
+  '@oxc-resolver/binding-freebsd-x64@11.21.3':
+    resolution: {integrity: sha512-K6xNsTUPEUdfrn0+kbMq5nOUB5w1C5pavPQngt4TM2FpN91lP0PBe2srSpamb4d69O7h86oAi/qWX/kZNRSjkw==}
+    cpu: [x64]
+    os: [freebsd]
+
   '@oxc-resolver/binding-linux-arm-gnueabihf@11.20.0':
     resolution: {integrity: sha512-hOQ/p3ry3v3SchUBXicrrnszaI/UmYzM4wtS4RGfwgVUX7a+HbyQSzJ5aOzu+o6XZkFkS3ZXN4PZAzhOb77OSg==}
     cpu: [arm]
     os: [linux]
 
+  '@oxc-resolver/binding-linux-arm-gnueabihf@11.21.3':
+    resolution: {integrity: sha512-VcFmOpcpWX1zoEy8M58tR2M9YxM+Z9RuQhqAx5q0CTmrruaP7Gveejg75hzd/5sg5nk9G3aLALEa3hE2FsmmTQ==}
+    cpu: [arm]
+    os: [linux]
+
   '@oxc-resolver/binding-linux-arm-musleabihf@11.20.0':
     resolution: {integrity: sha512-2ArPksaw0AqeuGBfoS715VF+JvJQAhD2niWgjE5hVO+L+nAfikVQopvngCMX9x4BD8itWoQ3dnikrQyl5Ho5Jg==}
     cpu: [arm]
     os: [linux]
 
+  '@oxc-resolver/binding-linux-arm-musleabihf@11.21.3':
+    resolution: {integrity: sha512-quVoxFLBy43hWaQbbDtQNRwAX5vX76mv7n64icAtQcJ3eNgVeblqmkupF/hAneNthdqSlnd1sTjb3aQSaDPaCQ==}
+    cpu: [arm]
+    os: [linux]
+
   '@oxc-resolver/binding-linux-arm64-gnu@11.20.0':
     resolution: {integrity: sha512-0bJnmYFp62JdZ4nVMDUZ/C58BCZOCcqgKtnUlp7L9Ojf/czIN+3j72YlLPeWLkzlr6SlYvIQA4SGV/HyO0d+qg==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
+  '@oxc-resolver/binding-linux-arm64-gnu@11.21.3':
+    resolution: {integrity: sha512-X0AqNZgcD07Q4V3RDK18/vYOj/HQT/FnmEFGYS2jTWqY7JO13ryE3TEs3eAIgUJhBnNkpEaiXqz3VK8M7qQhWQ==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
   '@oxc-resolver/binding-linux-arm64-musl@11.20.0':
     resolution: {integrity: sha512-wKHHzPKZo7Ufhv/Bt6yxT7FOgnIgW4gwXcJUipkShGp68W3wGVqvr1Sr0fY65lN0Oy6y41+g2kIDvkgZaMMUkw==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
+  '@oxc-resolver/binding-linux-arm64-musl@11.21.3':
+    resolution: {integrity: sha512-YkaQnaKYdbuaXvRt5Qd0GpbihzVnyfR6z1SpYfIUC6RTu4NF7lDKPjVkYb+jRI2gedVO2rVpN35Y6akG6ud4Lw==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
   '@oxc-resolver/binding-linux-ppc64-gnu@11.20.0':
     resolution: {integrity: sha512-RN8goF7Ie0B79L4i4G6OeBocTgSC56vJbQ65VJje+oXnldVpLnOU7j/AQ/dP94TcCS+Yh6WG8u3Qt4ETteXFNQ==}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
+  '@oxc-resolver/binding-linux-ppc64-gnu@11.21.3':
+    resolution: {integrity: sha512-gB9HwhrPiFqUzDeEq+y/CgAijz1YdI6BnXz5GaH2Pa9cWdutchlkGFAiAuGb/PjVQpiK6NFKzFuztxrweoit7A==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
   '@oxc-resolver/binding-linux-riscv64-gnu@11.20.0':
     resolution: {integrity: sha512-5l1yU6/xQEqLZRzxqmMxJfWPslpwCmBsdDGaBvABPehxquCXDC7dd7oraNdKSJUMDXSM7VvVj8H2D2FTjU7oWw==}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
+  '@oxc-resolver/binding-linux-riscv64-gnu@11.21.3':
+    resolution: {integrity: sha512-zjDWBlYk8QGv0H8dsPUWqkfjYIIjG2TvspGkzXL0eImbgxtZorA/klKeHyolevoT3Kvbi+1iMr9Lhrh7jf54Og==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
   '@oxc-resolver/binding-linux-riscv64-musl@11.20.0':
     resolution: {integrity: sha512-xHEvkbgz6UC+A3JOyDQy76LkUaxsNSfIr3/GV8slwZsnuooJiIB34gzJfsyvR4JdCYNUUPsRJc/w/oWkODu+hg==}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
+  '@oxc-resolver/binding-linux-riscv64-musl@11.21.3':
+    resolution: {integrity: sha512-4UfsQvacV388y1zpXL7C1x1FNYaV52JtuNRiuzrfQA2z1z6ElVrsidkGsrvQ5EgeSq1Pj7kaKqrgGkvFuxJ/tw==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [musl]
+
   '@oxc-resolver/binding-linux-s390x-gnu@11.20.0':
     resolution: {integrity: sha512-aWPDUUmSeyHvlW+SoEUd+JIJsQhVhu6a5tBpDRMu058naPAchTgAVGCFy35zjbnFlt0i8hLWziff6HX0D3LU4g==}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
+  '@oxc-resolver/binding-linux-s390x-gnu@11.21.3':
+    resolution: {integrity: sha512-b5uH+HKH0MP5mNBYaK75SKsJbw52URqrx2LavYdq6wb0l3ExAG5niYRP9DWUNHdKilpaBVM2bXk9HNWrH3ew7Q==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
   '@oxc-resolver/binding-linux-x64-gnu@11.20.0':
     resolution: {integrity: sha512-x2YeSimvhJjKLVD8KSu8f/rqU1potcdEMkApIPJqjZWN7c2Fpt4g2X32WDg1p+XDAmyT7nuQGe0vnhvXeLbH+g==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
+  '@oxc-resolver/binding-linux-x64-gnu@11.21.3':
+    resolution: {integrity: sha512-PjYlmilBpNRh2ntXNYAK3Am5w/nPfEpnU/96iNx7CI8EzAn12J4JRiec63wHJTH31nLoCNxBg/829pN+3CfG3Q==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
   '@oxc-resolver/binding-linux-x64-musl@11.20.0':
     resolution: {integrity: sha512-kcRLEIxpZefeYfLChjpgFf3ilBzRDZ+yobMrpRsQlSrxuFGtm3U6PMU7AaEpMqo3NfDGVyJJseAjnRLzMFHjwQ==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
+  '@oxc-resolver/binding-linux-x64-musl@11.21.3':
+    resolution: {integrity: sha512-QTBAb7JuHlZ7JUEyM8UiQi2f7m/L4swBhP2TNpYIDc9Wp/wRw1G/8sl6i13aIzQAXH7LKIm294LeOHd0lQR8zA==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
   '@oxc-resolver/binding-openharmony-arm64@11.20.0':
     resolution: {integrity: sha512-HHcfnApSZGtKhTiHqe8OZruOZe5XuFQH5/E0Yhj3u8fnFvzkM4/k6WjacUf4SvA0SPEAbfbgYmVPuo0VX/fIBQ==}
     cpu: [arm64]
     os: [openharmony]
 
+  '@oxc-resolver/binding-openharmony-arm64@11.21.3':
+    resolution: {integrity: sha512-4j1DFwjwv36ec9kds0jU/ucQ5Ha4ERO/H95BxR5JFf0kqUUAJ1kwII7XhTc1vZrkdJkvLGC9Q2MbpObpum8RBg==}
+    cpu: [arm64]
+    os: [openharmony]
+
   '@oxc-resolver/binding-wasm32-wasi@11.20.0':
     resolution: {integrity: sha512-Tn0y1XOFYHNfK1wp1Z5QK8Rcld/bsOwRISQXfqAZ5IBpv8Gz1IvV39fUWNprqNdRizgcvFhOzWwFun2zkJsyBg==}
     engines: {node: '>=14.0.0'}
     cpu: [wasm32]
 
+  '@oxc-resolver/binding-wasm32-wasi@11.21.3':
+    resolution: {integrity: sha512-i8oluoel5kru/j1WNrjmQSiA3GQ7wvIYVR1IwIoZtKogAhya2iub+ZKIeSIkcJOrnzQ18Tzl/F+kL3fYOxZLvA==}
+    engines: {node: '>=14.0.0'}
+    cpu: [wasm32]
+
   '@oxc-resolver/binding-win32-arm64-msvc@11.20.0':
     resolution: {integrity: sha512-qPi25YNPe4YenS8MgsQU2+bIFHxxpLx1LVna2444cEHqNPhNjvWf9zqj4aWE43H9LpAsTmkkAlA3eL5ElBU3mA==}
     cpu: [arm64]
     os: [win32]
 
+  '@oxc-resolver/binding-win32-arm64-msvc@11.21.3':
+    resolution: {integrity: sha512-M/8dw8dD6aOs+NlPJax401CZB9I7Aut84isQLgALGGwke4Afvw+/7yYhZb94yXf6t2sPLhQLmSmtSV+2FhsOWg==}
+    cpu: [arm64]
+    os: [win32]
+
   '@oxc-resolver/binding-win32-x64-msvc@11.20.0':
     resolution: {integrity: sha512-Wb14jWEW8huH6It9F6sXd9vrYmIS7pMrgkU6sxpLxkP+9z+wRgs71hUEhRpcn8FOXAFa27FVWfY2tRpbfTzfLw==}
     cpu: [x64]
     os: [win32]
 
-  '@oxfmt/binding-android-arm-eabi@0.54.0':
-    resolution: {integrity: sha512-NAtpl/SiaeU103e7/OmZw0MvUnsUUopW7hEm/ecegJg7YM0skQaA0IXEZoyTV6NUdiNPupdIUreRqUZTShbn/g==}
+  '@oxc-resolver/binding-win32-x64-msvc@11.21.3':
+    resolution: {integrity: sha512-H7BCt/VnS9hnmMp42eGhZ99izSCRvlnWwy/N71K1/J8QoExwY4262Z8QiEkMDtduRJrztayDxETTckmUuAVL9Q==}
+    cpu: [x64]
+    os: [win32]
+
+  '@oxfmt/binding-android-arm-eabi@0.55.0':
+    resolution: {integrity: sha512-+rFDOqQe5LOWgxrAJaZgLRudr6GQm0wGI6gtu7vVkrdLGjNMUSGbAlaCr8j7F2H2Er97vYQCU8WDb30onqMM1g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxfmt/binding-android-arm64@0.54.0':
-    resolution: {integrity: sha512-B4VZfBUlKK1rmMChsssNZbkZjE8+FzG3avMjGgMDwbGxXRoXkoeXiAZ+78Oa+eyDPHvDCiUb4zH/vmCOUSafLQ==}
+  '@oxfmt/binding-android-arm64@0.55.0':
+    resolution: {integrity: sha512-ctulLq8s3x8Zmvw6+iccB09TIKERAklRSmbJ10gk8mlAn05qZxoyo52dj3Hi9IJcmDSwF54fQaTVh2CbL6PInw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxfmt/binding-darwin-arm64@0.54.0':
-    resolution: {integrity: sha512-i02vF75b+ePsQP3tHqSxVYI5S6b8X/xqdPu7/mDHXtpgXLTYXi3jJmfHU0j+dnZZDKaYTx/ioCK7QYJmtiJR2g==}
+  '@oxfmt/binding-darwin-arm64@0.55.0':
+    resolution: {integrity: sha512-xDQczLH9pw/RBk1h/GH0qcGMm8hQtmtVHBNLSH3lk1gEIR09hZ4L+mJQl4VqiVAvPK9VG9PYrWWuSQLt7xTbiA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxfmt/binding-darwin-x64@0.54.0':
-    resolution: {integrity: sha512-8VMFvGvooXj7mswkbrhdVZ2/sgiDaBzWpkkbtO+qGDLV4EfJd67nQadHkQC0ZNbaWA9ajXfqI6i7PZLIeDzxEQ==}
+  '@oxfmt/binding-darwin-x64@0.55.0':
+    resolution: {integrity: sha512-JaNoFCkF2CJdGgpPSMbuO9HVyXyoNGIhMHPvp6NYAjeVKw9XEYc0HcUWJLPQa3Q69WV5wMa9m5jPMJPtbLtcRg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxfmt/binding-freebsd-x64@0.54.0':
-    resolution: {integrity: sha512-0cRHnp43WN1Jrc5s0BdbdKgR1XirdvHy7TAFi3JEsoEVQVJxTXMbpVd76sxXlgRswNMDhVFSJw+y7Eb8mEavFQ==}
+  '@oxfmt/binding-freebsd-x64@0.55.0':
+    resolution: {integrity: sha512-DNbszhpg6S2MIzax5azdHFTTBIVkR5xr8yyRZuA4yoDAwOkzIp3tmldgKZM2+VlT+hJIG0xUksA+elISzMEAfA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.54.0':
-    resolution: {integrity: sha512-JyQAk3hK/OEtup7Rw6kZwfdzbKqTVD5jXXb8Xpfay29suwZyfBDMVW/bj4RqEPySYWc6zCp198pOluf8n5uYzg==}
+  '@oxfmt/binding-linux-arm-gnueabihf@0.55.0':
+    resolution: {integrity: sha512-2snoaoRfFFyGnbOcKUK36rREBYxe/Xgz3uHbiA5zbCB/s6R4DQj4mHqYAaWWhgizCUSDxV8cE9zAZ0XleNpKGw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.54.0':
-    resolution: {integrity: sha512-qnvLatTpM8vtvjOfcckBOzJjk+n6ce/wwpP8OFeUrD5aNLYcKyWAitwj+Rk3PK9jGanbZvKsJnv14JGQ6XqFdw==}
+  '@oxfmt/binding-linux-arm-musleabihf@0.55.0':
+    resolution: {integrity: sha512-q1aktHF/WRpSK81BX1dE/9vWrS2jGw1Nax2kb4DBLGAewubCLcoNyp4Zl/NSMgbv3vUS46Z33wIQkBVYOP3PYg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm64-gnu@0.54.0':
-    resolution: {integrity: sha512-SMkhnCzIYZYDk9vw3W/80eeYKmrMpGF0Giuxt4HruFlCH7jEtnPeb3SdQKMfgYi/dgtaf+hZAb5XWPYnxqCQ3w==}
+  '@oxfmt/binding-linux-arm64-gnu@0.55.0':
+    resolution: {integrity: sha512-VD0y36aENezl/3tsclA/4G53Cc7iV+7Uoh7gz4yvcOTaEYBtJpQsE6PKDGTtUtOvGS4kv51ybfXY/nWZejO5IA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-arm64-musl@0.54.0':
-    resolution: {integrity: sha512-QrwJlBFFKnxOd95TAaszpMbZBLzMoYMpGaQTZF8oibacnF5rv8l12IhILhQRPmksWiBqg0YSe2Mnl7ayeJAHSA==}
+  '@oxfmt/binding-linux-arm64-musl@0.55.0':
+    resolution: {integrity: sha512-r8xlKJFcsRmn0H5jZrdORae6RX9jDBrZVvOoxF+bCQtampQJClv80aZEHsv+NsLsp2KCE5ql79O7DpPVzYWpXA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.54.0':
-    resolution: {integrity: sha512-WILatiol/TUHTlhod7R09+7Az/XlhKwmY1MHfLZNmewltPWNN/EwxP2rQSHahibZ/cB8gmckEBjBOByD+5bYsQ==}
+  '@oxfmt/binding-linux-ppc64-gnu@0.55.0':
+    resolution: {integrity: sha512-GRKv/HXHcwIVld/WU61rF0g0R16hl5EJ+ScKdpjevT57lnLnagj/U2YUbXf2mT+2Pg1uCzWC+mvGicPV3CDdLQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.54.0':
-    resolution: {integrity: sha512-f05YMG4BH4G8S4ME6UM6fi1MnJ9094mrnvO5Pa4SJlMfWlUM+1/ZWMEF4NnjM7shZAvbHsHRuVYpUo0PHC4P9Q==}
+  '@oxfmt/binding-linux-riscv64-gnu@0.55.0':
+    resolution: {integrity: sha512-rdv57enTiPtpSYRMKfAiEbQb0Puw5t9N7isVinDoo5qeLDScro2gznmZqSgSWbVZRzLisTeCTW8Qwgw0bOHv3A==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-musl@0.54.0':
-    resolution: {integrity: sha512-UfL+2hj1ClNqcCRT9s8vBU4axDpjxgVxX96G+9DYAYjoc5b0u15CJtn2jgsi9iM+EbGNc5CW1HVRgwVu76UsSA==}
+  '@oxfmt/binding-linux-riscv64-musl@0.55.0':
+    resolution: {integrity: sha512-7v1nNrlD43VY6+sYQ6efYyb3lE6QY182304PD/768ZxTjOmFd/3dQa3u/nGBUAXYdGSWOQc5N3PnS0QzUXyEIA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-s390x-gnu@0.54.0':
-    resolution: {integrity: sha512-3/XZe931Hka+J6NjnaqJzYpsWWxDTuRdUdwSQHnOuJEgbC+SehIMFJS8hsEjV7LBhVSL2OCnRLvbVW8O97XIyw==}
+  '@oxfmt/binding-linux-s390x-gnu@0.55.0':
+    resolution: {integrity: sha512-f4lJLUSPOgScjFl9LiflKCTocyNRwE25JmTMbN4XQdDjoZzEHjqf3wA3VESF1/csg7i8m7+EQLbrZyYDqe10UQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-gnu@0.54.0':
-    resolution: {integrity: sha512-Ik93RlObtu43GbxApafayFjwYE06L6Xr08cSwpBPYbDrLp2ReZx0Jm1DqwRyYRnukUJy+rK2WaEvUQOxdytU9Q==}
+  '@oxfmt/binding-linux-x64-gnu@0.55.0':
+    resolution: {integrity: sha512-MihqiPziJNoWy4MqNSV+jVA1g+07iQDjZiR0vaCaDoPgFEiJpCMsxamktzLV07cEeQsSJ04vQaU4CzCQwIvtDA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-musl@0.54.0':
-    resolution: {integrity: sha512-yZcakmPlD86CNymknd7KfW+FH+qfbqJH+i0h69CYfV1+KMoVeM9UED+8+TDVoU4haxI0NxY7RPCvRLy3Sqd2Qg==}
+  '@oxfmt/binding-linux-x64-musl@0.55.0':
+    resolution: {integrity: sha512-Yqghym7KYAVjP9MmSrNZiDeerMuoejNjo0r3ox5H3GDKk8eAfl8VyJm9i+pWCLDCTnAbcTUMMN2ZKjUYXH1v3g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-openharmony-arm64@0.54.0':
-    resolution: {integrity: sha512-GiVBZNnEZnKu00f1jTg49nomv187d0GQX+O+ocykoLeiaALuEO+swoTehHn9TehTfi7V8H0i0e/yvUjCqnwk1w==}
+  '@oxfmt/binding-openharmony-arm64@0.55.0':
+    resolution: {integrity: sha512-s5SDvVVSbyQl1V5UU3Yl12M+XLUQ3rl5SglNqgAA2K4PXUtQhyNSS00wivONPEnNo5W01rCou8WkDNyvI/RGHg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxfmt/binding-win32-arm64-msvc@0.54.0':
-    resolution: {integrity: sha512-J0SSB8Z1Fre2sxRolYcW6Rl1RQmKdQ2hnHyq4YJrfBRiXTObLw4DXnIVraM/UyqGqwOi7yTrQA4VT7DPxlHVKA==}
+  '@oxfmt/binding-win32-arm64-msvc@0.55.0':
+    resolution: {integrity: sha512-7p9FB5R32tw2KyyNX3wpQrR2WHwEHvMEiBlGXxeTCaRMCVNx3UtFMAUbaQ/pRNWIrEUZmYhJ6tcUH52uPTRYjQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxfmt/binding-win32-ia32-msvc@0.54.0':
-    resolution: {integrity: sha512-O61UDVj8zz6yXJjkHPf05VaMLOXmEF8P5kf/N0W7AQMmd6bcQogl+KJc7rMutKTL524oE9iH32JXZClBFmEQIg==}
+  '@oxfmt/binding-win32-ia32-msvc@0.55.0':
+    resolution: {integrity: sha512-ZYqj3fDnOT1IaVGMP5kpmkQl4F3tQIm2ZyAxvqkJYmI0xgWWak4ss4XYwv3VDfM+TWXeC9K4uQ/wW5jm/5XABA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxfmt/binding-win32-x64-msvc@0.54.0':
-    resolution: {integrity: sha512-1MDpqJPiFqxWtIHas8vkb1VZ7f7eKyTffAwmO8isxQYMaG1OFKsH666BWLeXQLO+IWNfiMssLD55hbR1lIPTqg==}
+  '@oxfmt/binding-win32-x64-msvc@0.55.0':
+    resolution: {integrity: sha512-eEYT5tivGnGbPHuOHuQpi6CGLObhh0re/5jcNQHihD2GRYkTM85dyi5a19zjP8Q00t1uqAx+/QGLUGdHeqzWyg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -1849,124 +2024,124 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@oxlint/binding-android-arm-eabi@1.69.0':
-    resolution: {integrity: sha512-DKQQbD5cZ/MYfDgDI7YGyGD9FSxABlsBsYFo5p26lloob543tP9+4N3guwdXIYJN+7HSZxLe8YJuwcOWw5qnHg==}
+  '@oxlint/binding-android-arm-eabi@1.71.0':
+    resolution: {integrity: sha512-ImGmd1njEg4FEJH03jhRnveEegtO3czCtfptvaHivKAZQIYATbVFBrrzbaYMYv0oJioTnxZAZVSyV+oL7W8S2g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxlint/binding-android-arm64@1.69.0':
-    resolution: {integrity: sha512-lEhb+I5pr4inux+JFwfCa1HRq3Os7NirEFQ0H1I35SVEHPm6byX0Ah47xmRha3qi6LAkxUcxViL8o/9PivjzBg==}
+  '@oxlint/binding-android-arm64@1.71.0':
+    resolution: {integrity: sha512-4A5BEexBrwY1YFF8Kiq/lp/wQPRG79G3BWIE1FuWaM5MvmpYSd+7ZySVcKkHdwo0UDzdQGddp6pD9mpctMqLnw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxlint/binding-darwin-arm64@1.69.0':
-    resolution: {integrity: sha512-GY2YE8lOZW59BW1Ia1y+1gR0XyjrZRvVWHAr8LGeGhYHE0OQJ/7cRKXTkx1P+E9/6awEc3SX8a68SFTjh/E//A==}
+  '@oxlint/binding-darwin-arm64@1.71.0':
+    resolution: {integrity: sha512-9wJA9GJulLwS2usU3CEisI/ESDO1n1z9eyTCvApMDrAkbJ1ve0mORgTMjcWWsKxkzkeZ2N/Gpra5IQE7x8tYgQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxlint/binding-darwin-x64@1.69.0':
-    resolution: {integrity: sha512-ax1oZnOjHX3LB7myQyHEaQkDwfLb6str3/nSP6O7EVUviQGNkEGzGV0EqcBJWK+Ufwx0l4xPgyYayurvhAdl2Q==}
+  '@oxlint/binding-darwin-x64@1.71.0':
+    resolution: {integrity: sha512-PlLCjS06V0PeJMAJwzjrExw1sYNW9Gch3JtNlcwwZDXGlTYDuwHNN89zYH8LTXFfgkVtsYvs2nv0FqrzyuFDzg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxlint/binding-freebsd-x64@1.69.0':
-    resolution: {integrity: sha512-kHWeHv4g2h8NY+mpCxzCtY4uerMJWTN/TSnNj1CPbakFpHEJ6cTya2wWV0pDSYWOJ2+0UiEbhn3AtXxHtsnKjg==}
+  '@oxlint/binding-freebsd-x64@1.71.0':
+    resolution: {integrity: sha512-Lhil7bWre0ncxbUoDoxfS0JzpTz17BRQKW7iwoAUY8GJ66+WwJEfYPCFJ1P0WgVZR5/O/b3Q2pENlHOjeXLOGQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.69.0':
-    resolution: {integrity: sha512-gq84vM1a1oEehXo27YCDzGVcxPsZDI1yswZwz2Da1/cbnWtrL16XZZnz0G/+gIU8edtHpfjxq5c+vWEHqJfWoQ==}
+  '@oxlint/binding-linux-arm-gnueabihf@1.71.0':
+    resolution: {integrity: sha512-Oo9/L58PYD3RC0x05d2upAPLllHytTjHQGsnC06P6Ynn7jKkp5mdImQxXdJ3+FnBaKspNpGogzgVsi6g872LiA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm-musleabihf@1.69.0':
-    resolution: {integrity: sha512-kIqEa98JQ0VRyrcncxA417m2AzasqTlD+FyVT1AksjvjkqQcvm7pBWYvoW3/mpyOP2XYvi5nSCCTIe6De1yu5g==}
+  '@oxlint/binding-linux-arm-musleabihf@1.71.0':
+    resolution: {integrity: sha512-mSHfyfgJrEbyIR29ejaeS50BdPk+GoNPlC1dckpDiUZbJAIel68sjSMdOt4WY0/gva+ECC7FNITQkxMJU+vSBw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm64-gnu@1.69.0':
-    resolution: {integrity: sha512-j+xYiXozxGWx2cpjCrwwGR4awTxPFsRv3JZrv23RCogEPMc4R7UqjHW47p/RG0aRlbWiROCJ8coUfCwy0dvzHA==}
+  '@oxlint/binding-linux-arm64-gnu@1.71.0':
+    resolution: {integrity: sha512-n9yY4M2tiy3aij4AqtlnspzpfdpeT5JQfK2/w2d8oyp5W0FRwOb1dIeX99nORNcxGr08iD9bH8N5XFz3I2iy8w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-arm64-musl@1.69.0':
-    resolution: {integrity: sha512-xEPpNppTfN1l/nM7gYSf9iocscu/as+p/7vxkLeLEKnYU+09Dm+5V6IhDYDh+Uz6FajEupWwCLt5SOG0y1PCKg==}
+  '@oxlint/binding-linux-arm64-musl@1.71.0':
+    resolution: {integrity: sha512-fJZrs5sDZtTaPIOiemRQQmo82Ezy+vOGXemPc4Ok7iVVsYsFa7SlW6Z5XN819VfsqBHRm3NJ3rTdnR8+bJYJdQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-ppc64-gnu@1.69.0':
-    resolution: {integrity: sha512-Ug0+eU7HJBlek+SjklYH62IlOMirEJsdxpihH0kSqX0XdrDD4NdHpQc10fK1JC35yn6KrrcN+uYzlHD38XAf8Q==}
+  '@oxlint/binding-linux-ppc64-gnu@1.71.0':
+    resolution: {integrity: sha512-cwl7VKGERIy9p+G+AvZdfy/06q0aHXaTt/mMRReC751iuNYJgqKjB7NydXSS30nBT9vtr2tunciOtrR4fD6FUA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-gnu@1.69.0':
-    resolution: {integrity: sha512-iEyI3GIg0l/s3G4qy2TlaaWKdzj4PJJStwtlocpDTC00PY9hZueotf6OKUj9+yfQh0lrpBW/pLMgTztbAHKJEg==}
+  '@oxlint/binding-linux-riscv64-gnu@1.71.0':
+    resolution: {integrity: sha512-eZ8ieVXvzGi8jr7+ybQGPK2STw3mldfxZlgA2738iflfB/rzA69sE6m5rDRpQaxC7dpm745Enlh1Tod0QAk9Gg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-musl@1.69.0':
-    resolution: {integrity: sha512-NjHjpiI4WIKSMwuoJSZi5VToPeoYOS1FR52HLIDG6lidMdqquusgtODb4iLk0+lb1q3Z0nv2/aPRcC/olmpQGg==}
+  '@oxlint/binding-linux-riscv64-musl@1.71.0':
+    resolution: {integrity: sha512-puMDbQYe6+NXwfMusojoA7CXGn2b3utukmd23PQqc1E3XhVCwyZ+FueSMzDYeNgDV2dUfIVXAAKZBcFDeCL6sA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-s390x-gnu@1.69.0':
-    resolution: {integrity: sha512-Ai/prDewoItkDXbp38gwGZi41DycZbUTZJ3UidwoHgQC0/DaqC2TGdtBTQLJ6hSD+SAxASzh8+/eSBPmxfOacA==}
+  '@oxlint/binding-linux-s390x-gnu@1.71.0':
+    resolution: {integrity: sha512-4NJLxBs1ujISCt3L/1FcywLs73PWtJuw+piD6feK2V6h6OS6P7xu9/sWt1DTRLibe6QCzmfZzmM/2HPORoV/Lg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-gnu@1.69.0':
-    resolution: {integrity: sha512-Gt3KHgp46mRKz4sJeaASmKvD8ayXookRw07RMf+NowhEztGGDZ7VrXpoW96XuKJLjFukWizOFVNjmYb/u7caNQ==}
+  '@oxlint/binding-linux-x64-gnu@1.71.0':
+    resolution: {integrity: sha512-cFDaiR8L3430qp88tfZnvFlt3KotFhR/DlbIL0nHOMMYiG/9Wy4l+6f7t8G8pTa9bd8Lt8+M0y/qjRQ/xcB74g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-musl@1.69.0':
-    resolution: {integrity: sha512-7tQhJ2+p/oHv1zcfnjYI7YVzC/7iBaVOfIvFYtxdJ5F45mWgEdrCyXZXZGfiLey5t/5JhOhsaMnnv1kAzckd7g==}
+  '@oxlint/binding-linux-x64-musl@1.71.0':
+    resolution: {integrity: sha512-orfixdt76KlpNly9z0PkWBBNfwjKz+JFVLP/7wnVchlKNU9Dpt9InU/ZggeSej6fC7qwHmHNOGlhLnQXcYoGuA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-openharmony-arm64@1.69.0':
-    resolution: {integrity: sha512-vmWz6TKp/3hfA4lksR0zHBv/6xuX1jhym6eqOjdH2DXsDDHZWcp2f0KG0VCAnlVbIrjk29G4wAWMXb/Hn1YobA==}
+  '@oxlint/binding-openharmony-arm64@1.71.0':
+    resolution: {integrity: sha512-9emQu2lAp6yhPB3XuI+++vR+l/o6JR1X+EpxwcumPdQXBWXEPAsquPGL7l158EqU8SebQMXTUa/S5zN98juyHw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxlint/binding-win32-arm64-msvc@1.69.0':
-    resolution: {integrity: sha512-9RExaLgmaw6IoIkU9cTpT71mLfI0xZ86iZH8x518LVsOkjquJMYqb9P7KpC8lgd1t0Dxs41p2pxynq4XR3Ttzw==}
+  '@oxlint/binding-win32-arm64-msvc@1.71.0':
+    resolution: {integrity: sha512-bd5kI8spYwTm3BILDtGhi73zoup5dw8MlPQNT8YB3BD5UIsjNe3K9/4ctrzQMX4SZMoK5HgzVLkLJzacEXB7fA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxlint/binding-win32-ia32-msvc@1.69.0':
-    resolution: {integrity: sha512-1907kRPF8/PrcIw1E7LMs9JbVrpgnt/MvFdss3an8oDkYNAACXzTntV3t3869ZZhMZxb2AzRGbz1pA/jdFatXA==}
+  '@oxlint/binding-win32-ia32-msvc@1.71.0':
+    resolution: {integrity: sha512-W4HvOHGzVLHcrmFu+bMrJlho+/yrlX5ZNdJZqGe8MEldkQG+RHYhxxad9P4jvWAYFmIqUA5i9DQ8QsJqSU9GIw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxlint/binding-win32-x64-msvc@1.69.0':
-    resolution: {integrity: sha512-w8SOXv3mT9Fi6jY8OXdXCfnvX/3KNLXGNr4HEz2TA7S4Mv/PYAOmpB8y/ge40mxvBMgGNaSaaDwZpAsQn7HtWA==}
+  '@oxlint/binding-win32-x64-msvc@1.71.0':
+    resolution: {integrity: sha512-D2kyEIPHk/G/wiZLnwTVC/sVst+T/lKldVOjAFpgTIBUAOlry72e5OiapDbDBF4LfJLkN5ypJb/8Eu6yJzkveQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -2074,11 +2249,11 @@ packages:
     resolution: {integrity: sha512-//0sR/cow/s4ICQaYoAobOl4aU8cjU6x/V24V7XkKotb9+O+3zySIYp146vpaobYHnxa4pZX8NkV54Z5AwbDKA==}
     engines: {node: '>=12'}
 
-  '@posthog/core@1.35.3':
-    resolution: {integrity: sha512-EsGPbSLl39Jgo2KZ+kI9UAxFnh5nddaN5bNm2rXvUwF+vGmam9eN1EXeNbxhRU7ulEeIiGdm7XjoU7pzavkgIQ==}
+  '@posthog/core@1.38.0':
+    resolution: {integrity: sha512-QLrJh0hMVpEJXHNyiJR9YhvIO5tzLDedw4UHdvB+ub4fXHMtHCA8H44qgl11HWR3ajpjxtJ8hs3HyOGVF3Zc1w==}
 
-  '@posthog/types@1.390.2':
-    resolution: {integrity: sha512-WcfKz2GNn2vfDX8vXmJYbKxegPxVWHuDQ/pHdAn0HoZDXDFnEp/+x3qBQA+fEvtbPjjtjgAt2wIgJMlM7asx7g==}
+  '@posthog/types@1.391.1':
+    resolution: {integrity: sha512-ASwd7Nf4pViqdYRYaNRyPYRVKWa1CcHUAUWR0XeQJLGdNnsWACBwe0sSieb/cHnKsRXjRwO/23KIY83lm/Ccpw==}
 
   '@radix-ui/number@1.1.2':
     resolution: {integrity: sha512-ceTwaxc4I5IOi97DgCotl3pqiyRGvffcc0oOsE2dQYaJOFIDsDt4VWG6xEbg1QePv9QWausCEIppud/tJ1wNig==}
@@ -2565,32 +2740,32 @@ packages:
     peerDependencies:
       semantic-release: '>=20.1.0'
 
-  '@shikijs/core@4.2.0':
-    resolution: {integrity: sha512-Hc87Ab1Ld/vEbZRCbwx344I5v+4RU8CVToUTRkqXL1+TjbuOp9U5Xa0M23V4GEWHxVn+yO5otb+HkQVm3ptWQQ==}
+  '@shikijs/core@4.3.0':
+    resolution: {integrity: sha512-EooU3i9F6IAE8kEu+AnGf9DFZWkQBZ+hJn3tLVbsH+61mtQiva5biai66fAA6nvFPXkLgvrh7BrR7YcJU83xQQ==}
     engines: {node: '>=20'}
 
-  '@shikijs/engine-javascript@4.2.0':
-    resolution: {integrity: sha512-fjETeq1k5ffyXqRgS6+3hpvqseLalp1kjNfRbXpUgWR8FpZ1CmQfiNHovc5lncYjt/Vg5JK/WJEmLahjwMa0og==}
+  '@shikijs/engine-javascript@4.3.0':
+    resolution: {integrity: sha512-hTv/KiFf2tpiqlACPiztGGurEARWIutB8YUhcrA1pUC7VzzwKO+g5crUocrLztrZ5ro5Z4hbXg7bYclETn3gSQ==}
     engines: {node: '>=20'}
 
-  '@shikijs/engine-oniguruma@4.2.0':
-    resolution: {integrity: sha512-hTorK1dffPkpbMUk6Z+828PgRo7d07HbnizoP0hNPFjhxMHctj0Px/qoHeGMYafc6ju+u9iMldN4JbVzNQM++g==}
+  '@shikijs/engine-oniguruma@4.3.0':
+    resolution: {integrity: sha512-1vMdN3gHfnKfLYwecUI2ITJI4RhHt96xEaJumVn7Heb0IlJ8WQMIH0Voak+2j22BpSNKdnOfB/pCTPnPm2gq7A==}
     engines: {node: '>=20'}
 
-  '@shikijs/langs@4.2.0':
-    resolution: {integrity: sha512-bwrVRlJ0wUhZxAbVdvBbv2TTC9yLsh4C/IO5Ofz0T8MQntgDvyVnkbjw9vi50r1kx7RCIJdnJnjZAwmAsXFLZQ==}
+  '@shikijs/langs@4.3.0':
+    resolution: {integrity: sha512-rnlqFbBRSys9bT4gl/5rw9RnS0W/I84ZldXPkO7cvlEMoV85TyF/aU01N7/NbSR776RNLjrJKjfFUXJR6wN1Cg==}
     engines: {node: '>=20'}
 
-  '@shikijs/primitive@4.2.0':
-    resolution: {integrity: sha512-NOq+DtUkVBJtZMVXL5A0vI0Xk8nvDYaXetFHSJFlOqjDZIVhIPRYFdGkSoElDqNuegikcc3A76SNUa8dTqtAYA==}
+  '@shikijs/primitive@4.3.0':
+    resolution: {integrity: sha512-CPkz64PTa5diRW1ggzMZH9VM/du4RNChYgVtgqrFcgruvIybmCvySv8GkiHSczUHXYuuR8TdKEwFx+UnZMpgdg==}
     engines: {node: '>=20'}
 
-  '@shikijs/themes@4.2.0':
-    resolution: {integrity: sha512-RX8IHYeLv8Cu2W6ruc3RxUqWn0IYCqSrMBzi/uRGAmfyDNOnNO5BF/Px7o97n4XTpmFTo5GbRaazuOWj+2ak2w==}
+  '@shikijs/themes@4.3.0':
+    resolution: {integrity: sha512-Avgt05YiT+Y3prjIc9lmQxhJzHBcCfR6cjiFW4OyaMBbt2A6trX5rfjUzx+Vj/mE9qpArYjatnqo9XPjQNW/AQ==}
     engines: {node: '>=20'}
 
-  '@shikijs/types@4.2.0':
-    resolution: {integrity: sha512-VT/MKtlpOhEPZloSH3Pb9WCZEBDoQVMa9jedp5UAwmJOar1DVc9DRODAxmYPW9M93IK4ryuqRejFfmlvlVDemw==}
+  '@shikijs/types@4.3.0':
+    resolution: {integrity: sha512-oc8b9U2SYvofKZk8e/737nIX0qwf6eV2vHFATeObAu7r+mUVpLs8Re0BmVkIjAWAYgkmG/CzLNo7rzuBzRu/wQ==}
     engines: {node: '>=20'}
 
   '@shikijs/vscode-textmate@10.0.2':
@@ -2614,31 +2789,31 @@ packages:
   '@standard-schema/spec@1.1.0':
     resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
 
-  '@supabase/auth-js@2.108.1':
-    resolution: {integrity: sha512-Lle5rKU8f9LF3K5dDd8Or8mkkG+ptzRZZWKPVMm9B9UuovH65Ss2+iFnQqRsCqaGouvJEcTWyl0cj2riNrrDLQ==}
+  '@supabase/auth-js@2.108.2':
+    resolution: {integrity: sha512-tNaQmBgodDZwgB40mRwVbxFy8IDYwjdpcZ0BYrWiwlULCSQoJj4QoG4zgJT7QRPXcqipefNOzvO/qAu4dF98ag==}
     engines: {node: '>=20.0.0'}
 
-  '@supabase/functions-js@2.108.1':
-    resolution: {integrity: sha512-fxBRW/A4IG7ADQztVt0NaEy5ysiO1WJ2pbldsnBchrkHuyepX0Krek9qA9T4gUQBVVTCE9Ea4pdsM5hfn3nc4A==}
+  '@supabase/functions-js@2.108.2':
+    resolution: {integrity: sha512-RNUX8EiBy3iLwAX19jtRzLyePnl11/fHcgwDHLnpKcDSXt/5qBnh3LUwAtIjT21Q66QsmNUR2esrHziLCpNubw==}
     engines: {node: '>=20.0.0'}
 
-  '@supabase/phoenix@0.4.3':
-    resolution: {integrity: sha512-jZL/2uPEiK58RFJ+7rctex60AHTdtVWwqw4cqu+5JGrXdu/ZM7ZwttO+yRsRN/E/Xik6s+tmbvH7XAQux4m9nQ==}
+  '@supabase/phoenix@0.4.4':
+    resolution: {integrity: sha512-Gt0pqoXuIqX/8dvG0OKp/wMCobXNH3klNbUPBNyOfN0YA1IswrM3HyWFMOPk1Jy+BRaIyDPcFx4jLBwHNmlyfQ==}
 
-  '@supabase/postgrest-js@2.108.1':
-    resolution: {integrity: sha512-9lj2MCPPMgSTaJ5y+amnhb3TWPtMFVlbDn2hmX/VV91xQU4j0AauwfMaBErHBJ+zzsSwjc0jLU+zLIZFLQzfig==}
+  '@supabase/postgrest-js@2.108.2':
+    resolution: {integrity: sha512-GQ28/Y8hk3CFmkb3kXH1h/AQx6JIYSQfO0CJMRVBcEKZoNy6C45cXAZ4fcJvRC5Id0cs6xnkUV0+c0rIocigsw==}
     engines: {node: '>=20.0.0'}
 
-  '@supabase/realtime-js@2.108.1':
-    resolution: {integrity: sha512-mHGGqOjwd1XTydcoffUqEMsbFQHUi6A3uhQ0EXr3iqzpLqItxKA9nbN6gIQxrZ7JRRnuUe/iOFPUkYV9Tdc5lg==}
+  '@supabase/realtime-js@2.108.2':
+    resolution: {integrity: sha512-aAGxCSUemZvQIibnCdvNvgaKib28I4rfrNjKbQ9cG1uBLwUsI7hVpGXgEbypCCDhLjQlDTAiJlu7rgljYUT73g==}
     engines: {node: '>=20.0.0'}
 
-  '@supabase/storage-js@2.108.1':
-    resolution: {integrity: sha512-Er0SGGt85iT6ye+SSh98Az6L2CesoZJuyzEZYH2oBOAnIxa9Nn4CtwUC3veGxYggoT56X+3tVuuQeDBP8kR8sg==}
+  '@supabase/storage-js@2.108.2':
+    resolution: {integrity: sha512-TVZPQxXGxY2+A6yTtm77zUHsh70lBhYUEaJL8RQC+BghcX/ygiMG/rmXrNVBce30/WAeNPa8FiG8HbqlGeV05g==}
     engines: {node: '>=20.0.0'}
 
-  '@supabase/supabase-js@2.108.1':
-    resolution: {integrity: sha512-V/1hRKLSCJ0zEL+9QFRBUtivvePfOsaAYQmC0HhFNSHC2F3xFs4jSF3YhkLmzex6E4V4FGvmBDOP72D/53NnZA==}
+  '@supabase/supabase-js@2.108.2':
+    resolution: {integrity: sha512-hFhnPveb5JQg4a0QYicM0swT253YHMdfeRAl2BKHOlI5VAzuHxUGSr8RbwNLYNPauWOgQMS1H8sz8bvYlgwUfQ==}
     engines: {node: '>=20.0.0'}
 
   '@swc-node/core@1.14.1':
@@ -2799,6 +2974,9 @@ packages:
   '@types/node@25.9.3':
     resolution: {integrity: sha512-603BddQMv3pUcr4U2dhujk83N2tTDVr/34wII2B6bJy6g+8WD6yUb11jszNs0gdi4PesVWl7ABt8nYMVpnLUcg==}
 
+  '@types/node@26.0.1':
+    resolution: {integrity: sha512-fc3KiUoBt6kie0N9bIW3E47vZsuaMf0PM2AaUpLCLT0s/LvX1nxAim6Fc049cNxODPpGm6qRAuUOB86SkRuPQw==}
+
   '@types/normalize-package-data@2.4.4':
     resolution: {integrity: sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA==}
 
@@ -2828,145 +3006,145 @@ packages:
   '@types/ws@8.18.1':
     resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==}
 
-  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260614.1':
-    resolution: {integrity: sha512-2JHbdJ00FKTKDR1+NL4zhQBDlFZfZHEXaAarV6kbEjV0P47qKnSrAzzKHuponG0B9FqkPEMHOgu7WGJTBW2rHw==}
+  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260621.1':
+    resolution: {integrity: sha512-E81mNlY2JqZlDqflCvRpt6WhU6ha1SOkRC85o+EmKZJCjBxaaJpBGdwGjIisv2jiEMcHy2OW4ZHcE9GTM1BL2A==}
     engines: {node: '>=16.20.0'}
     cpu: [arm64]
     os: [darwin]
 
-  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260614.1':
-    resolution: {integrity: sha512-/8enyEb1tDsVvUp4rDeA5DernrvWgD6cQ4rY6O6PH6BQK8fqwY+CcHEHmw2xgwfqoswHNYjznLvmQmHBOjHqLw==}
+  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260621.1':
+    resolution: {integrity: sha512-VS4VF8L0So56tC1jaJ57pMQOGd0Hc1wU0RIMkJi41/dKvcmc/WTRa7hiWJwzZLxXhZoVkdjesT36D9GahoAulg==}
     engines: {node: '>=16.20.0'}
     cpu: [x64]
     os: [darwin]
 
-  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260614.1':
-    resolution: {integrity: sha512-jqhqAXqyEUxJpno/wRfWGa72R3VTt7p2LRTOFJ0C1bx5dEKrVosQSOdr2m9+2VhjXFXNvorXsGZPIWqxLOo28Q==}
+  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260621.1':
+    resolution: {integrity: sha512-Ek1uLWN6VzqwwTQNu1vcnRW4F3ipqvediLEwJP6uR5P6vrXYE7XvcGLEJcXiw31SR40NhxZW/RhLcJrHQcehrA==}
     engines: {node: '>=16.20.0'}
     cpu: [arm64]
     os: [linux]
 
-  '@typescript/native-preview-linux-arm@7.0.0-dev.20260614.1':
-    resolution: {integrity: sha512-zYrUKq5oC6fUoHpOmT3B65hFMhbdIlLp7T9RW1/6a+wSYoq9xTRAeFufQ2XZ9cpTJ1tfIvlUmtgJJ5CGE/cOrg==}
+  '@typescript/native-preview-linux-arm@7.0.0-dev.20260621.1':
+    resolution: {integrity: sha512-2Xp+pu7Xu9EMKxYFiZuyIzd6KUkMn7SvElzgBRwbrhfsk54Jieg2sxyL3aAw9xfzRsEN4m1VrU3Z/iq2gL5OUw==}
     engines: {node: '>=16.20.0'}
     cpu: [arm]
     os: [linux]
 
-  '@typescript/native-preview-linux-x64@7.0.0-dev.20260614.1':
-    resolution: {integrity: sha512-K2c/DN7Q3a6Z+KIl7bq45xByuuGjacqWO/UPCa/iTBA/m6GDzoMJ/Q/DBLtLRHyROBRiy5kjgEZfyLy3Tp8ygw==}
+  '@typescript/native-preview-linux-x64@7.0.0-dev.20260621.1':
+    resolution: {integrity: sha512-VUhea6+Drw+PHRpsjsY7lNOZtXAlRXLHrpYynJU3jfnSflYgoqkrvlSzWVhcvhkjxGOZsqlIV+5ryy8ANZ6peg==}
     engines: {node: '>=16.20.0'}
     cpu: [x64]
     os: [linux]
 
-  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260614.1':
-    resolution: {integrity: sha512-C+C25Grr4sCbQIYPT5WfKYIL613ZIN9aGcUwDGMSTmIQ3azIR5MtdkSF4l4vsOC4lF8HwFV83MDa28JuQYhQFg==}
+  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260621.1':
+    resolution: {integrity: sha512-JyxxNWWs2X7WzK90zN8hgGKqP4zo2/y7Z2tlLLaHhSFtEh1AC+tsQun3NBlW9JvF1vHhGI/hPpnoZOxLO0CEWw==}
     engines: {node: '>=16.20.0'}
     cpu: [arm64]
     os: [win32]
 
-  '@typescript/native-preview-win32-x64@7.0.0-dev.20260614.1':
-    resolution: {integrity: sha512-nJBR61NGiCMBJOpdzJ4ZgA/HEd+fqIb99ur39UljSH9xvFKFlRwDosyAQFD8UEwrZsUbXN0VPLJY5MDknug3GA==}
+  '@typescript/native-preview-win32-x64@7.0.0-dev.20260621.1':
+    resolution: {integrity: sha512-2ijIynqyxK1LkWUpLlmsBKuH7XHk6K4TAwdnfZ7x7BQHF9Z3okIXtKMzOik8fajB3oooVrEvbfOe2Mf+uZ7maQ==}
     engines: {node: '>=16.20.0'}
     cpu: [x64]
     os: [win32]
 
-  '@typescript/native-preview@7.0.0-dev.20260614.1':
-    resolution: {integrity: sha512-4N1ZBHJUcsjKJQnUCxKUemV3jnm0PKZIZ4xh7dXN/3/AfmckE8Z1llyqOFfDwGOf8oQpdgkwQ6JUm7pqI3bGPg==}
+  '@typescript/native-preview@7.0.0-dev.20260621.1':
+    resolution: {integrity: sha512-2epYxi5NDRPOvAG8TPEFd43qDVGHhD4IbIHF0uhsy72OSUbVY2rjEAv1DkW1Q2p/YbszXd7ZL/Ulch8VuDDS1g==}
     engines: {node: '>=16.20.0'}
     hasBin: true
 
-  '@ungap/structured-clone@1.3.1':
-    resolution: {integrity: sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==}
+  '@ungap/structured-clone@1.3.2':
+    resolution: {integrity: sha512-5jsZFwgR5rTdKwidH9Qmat75RKwqfpKlWWB1frDkljN127mwqBu8K0PYo7/hFpF03IEJpfVPpCQDY/eDx3iHvA==}
 
   '@vercel/detect-agent@1.2.3':
     resolution: {integrity: sha512-VYNCgUc0nOmC4WJmWw9GkrKdfr8Zl4/rxhC5SvgacBgxiW9W/9NRttUoHHXV8xdII3MaRgkZZVX8Ikzc/Jmjag==}
     engines: {node: '>=14'}
 
-  '@verdaccio/auth@8.0.2':
-    resolution: {integrity: sha512-Qw5DhIIzNsM1ORbrnYDKQ2iA1ACWZkjWtxXrYFh577at9+H9QR45m3mMokcRVr3t2UBNFEmMb5cGTrReFa5Dzw==}
+  '@verdaccio/auth@8.0.4':
+    resolution: {integrity: sha512-hB7LU0Et6l3zkVmGV2SBEcMLCixUR26otiJVb7CpxnU1/j8BxWNVX9/HnwG16vLwXsSICUq4Ez+qROE/GdxLgQ==}
     engines: {node: '>=18'}
 
-  '@verdaccio/config@8.1.1':
-    resolution: {integrity: sha512-N9nS1AAME02iuhC2B3v67NnKQp2MkUoN5uUQ2JoS2seWQ6Bjs8dnkWfh4B9N5QTVjUQx4ETYOb3M+UqUJDJT8A==}
+  '@verdaccio/config@8.1.2':
+    resolution: {integrity: sha512-GX8TcEHcFaMxdGVRlkFZGJJvEgsQS2jkA5WjV4xKhK3B7z5UOhr75zEqoqATfVPuBPBT6kM/QkvyAGq4W5GTaA==}
     engines: {node: '>=18'}
 
-  '@verdaccio/core@8.1.1':
-    resolution: {integrity: sha512-IIgi8PucT67ymIwxwzc+5CGQF97xAPWlqb7M2nidfIpPtlghPjURDP6xHDcBLuE57adZKcklO24kr6zFSQa7cg==}
+  '@verdaccio/core@8.1.2':
+    resolution: {integrity: sha512-VtpBz9R61GTFUxPiQmBhCOffQZRJZMA2EXO/FzbaoNczm/Xt2KkDJq0PPwV5qmRGeouDRxEKUQ+caJGVN0W7Ww==}
     engines: {node: '>=18'}
 
   '@verdaccio/file-locking@13.0.1':
     resolution: {integrity: sha512-SZ9uxnQKppiM+/67xTaaBP4AZ/Q+weUB22ci1gF861icYWhWFu3njA3ofYig/4yNqkYRVEKVAIwnH97BaBEYbg==}
     engines: {node: '>=18'}
 
-  '@verdaccio/hooks@8.0.2':
-    resolution: {integrity: sha512-lneKTW6MDo28+hHqkIin08ruAafTvMake2TYUMdXWp+ah1YFI9XVzj6eo/rKHUB6sC4NxrBVajsGo1NX0OCE+A==}
+  '@verdaccio/hooks@8.0.3':
+    resolution: {integrity: sha512-5e71ArLhvcc/CFkDZW/gS3GWFkIAgIr0SCmEUXsTYHoqfyLV6VlXIpb6baGCnQ1EoQQ5ZkHtaWNFxSzM96ZlXA==}
     engines: {node: '>=18'}
 
-  '@verdaccio/loaders@8.0.2':
-    resolution: {integrity: sha512-Hm2xa47EXPI+Rnl3a0oTvEa1OIngze36YDHXNvHEhN35emID9iqJk1BoD5rA4Y2AdR9Jy34wRqzdqcwg9+ftSA==}
+  '@verdaccio/loaders@8.0.3':
+    resolution: {integrity: sha512-QG7zmQ9YuJgkC63zAMXP0IWafT9wvv/VWx97l0aaWLdXfJqK/l7+B7FgaEK0uZxq92Z+fU6tGaw5h2oe6XIFTg==}
     engines: {node: '>=18'}
 
-  '@verdaccio/local-storage-legacy@11.3.3':
-    resolution: {integrity: sha512-F+cXs0Hy8tQsA6aE0hy0FaimgPfhqmetKbepOOZkstNlzOAhCzhue414VQaswKBJ/ylrmSgXP45HZjst+JNyjA==}
+  '@verdaccio/local-storage-legacy@11.3.4':
+    resolution: {integrity: sha512-YdHF9hsn4OhZf1v0rQITtQt5qYn2zw8crHEhW54P0/OgxB5HPxxs93woUh/f0yqftIdB545o5Q38d7AuVgBWvg==}
     engines: {node: '>=18'}
 
-  '@verdaccio/logger-commons@8.0.2':
-    resolution: {integrity: sha512-PzR1+0tVWzDc6aQsPCi6LVywWTXD0bp61f97On8ia4Ihms6ahP9MZzF86Mub6laBw4mBsBo45EBFaqQfotvUoA==}
+  '@verdaccio/logger-commons@8.0.3':
+    resolution: {integrity: sha512-EpNnGYtzZd5ZPKOBTllu6cYn6oX2U67RGzI/390T2MRSsX+HBYVSw8JSaqzsgpg7khXL1U2iQvNI5SVfItLJ0w==}
     engines: {node: '>=18'}
 
   '@verdaccio/logger-prettify@8.0.1':
     resolution: {integrity: sha512-49a5LTi90TxjQPBk7rZUf0qCorAjOopq7uQzGRro6dOEFmyaZ/K2sNiOuRFJzVuC8C8jL/zPlJiln1vm5HsAMA==}
     engines: {node: '>=18'}
 
-  '@verdaccio/logger@8.0.2':
-    resolution: {integrity: sha512-yxCVJP9Inr6qfdsDaOUCWWj0g0SzLY6J+62QkBafZLqIqng8IfI1NRe/6n2O3AH+YPThbqxhgaAJQ5MJTvBxOw==}
+  '@verdaccio/logger@8.0.3':
+    resolution: {integrity: sha512-fngfyx6gUX416UYL0nqJy2yy0AxKFsfXppy6L4Dggvxu3A/auQucBtiHUj8J02jc4C1HAPTdvwIpt79Uxjr3qg==}
     engines: {node: '>=18'}
 
-  '@verdaccio/middleware@8.0.2':
-    resolution: {integrity: sha512-CmSoXI1/5lfH25NP3Q7ic9TEUSn6gENqauU00EhYZ/RAk/jYyPCkokSJBi9RhsAsOjOUry4yM4c3vgxLdO8Iwg==}
+  '@verdaccio/middleware@8.0.5':
+    resolution: {integrity: sha512-jhs7oE4KKuVRrudyk3mOF0yfWelBSi8s7moAHO+bJQwpXNpMNsGFuVRpF/8zBbqSEJshMukxcQYIeKusnsL24A==}
     engines: {node: '>=18'}
 
-  '@verdaccio/package-filter@13.0.2':
-    resolution: {integrity: sha512-y9X52mCpP9AKoAB6W/ymYS5XscBNOT7HdSfYIy3BMpNJxD4+rwMO/SwKn3uAY+2RaMAgU1N7NBUmPtQAYFGhww==}
+  '@verdaccio/package-filter@13.0.3':
+    resolution: {integrity: sha512-kfchn7GTxjfpcZqe1kwy9ZfYc2oCYVdzWHz2Nw5RLqpA+tIar5kS2GqlGpOLU7qYfPqDLQcHiv69PtxRstGtew==}
     engines: {node: '>=18'}
 
   '@verdaccio/search-indexer@8.0.2':
     resolution: {integrity: sha512-Pd2vGmb69pMuZj+WyiUMcbPU9H9Zfm0xHy0p2jDhb4PfT0rnoGgM0a7GxlmywsRuIM5obm4OCUZdhw0N8BnwYw==}
     engines: {node: '>=18'}
 
-  '@verdaccio/signature@8.0.2':
-    resolution: {integrity: sha512-0vmv3D2SmyJsLoN0e+O+wvjYdUxu/cxsCSRbchmK3m1dFxrGNyxEdQkdBAKDyOr2sQit5xM0XSwHRIqYrmr8Lw==}
+  '@verdaccio/signature@8.0.3':
+    resolution: {integrity: sha512-EBaBMI3aHHdGk+1gABPye/lo5ey7ilRJJtFFaqI7nIup4xC5U6N2Z1ULtKqk/ubzB1O82vDuE2ZFnK8qe6rImg==}
     engines: {node: '>=18'}
 
   '@verdaccio/streams@10.2.5':
     resolution: {integrity: sha512-nVnTYeMJ7h131Nkv2svqZCfL5aDkJbwUvQd4OGXssbJJR5BfB2PzNq8TD45lEXIBW3EMMMFs7mVY789ds9soIA==}
     engines: {node: '>=12', npm: '>=5'}
 
-  '@verdaccio/tarball@13.0.2':
-    resolution: {integrity: sha512-LQHoAlp7yk5Tlhv+uHWJKtExwbMDBvwTvoAsdWMq4sRjCrdJSz8KTfWEBrb0EayxEwPr0LmI0ce8mIriId9Zow==}
+  '@verdaccio/tarball@13.0.3':
+    resolution: {integrity: sha512-BKdksIRaqhrptP6JmVW71TeUTuA1hHWcGeEabSDzYgi1PXgLS9l8On3HWLs+TZ93PRtTjZiZJGCJPbqoy5itvg==}
     engines: {node: '>=18'}
 
-  '@verdaccio/ui-theme@9.0.0-next-9.14':
-    resolution: {integrity: sha512-0PQW6PV+sHsQdV3gnHQqAcDcVGfT75vHq1TfIeEN2QY5KuEkvli8e5vut+sTe89p+GOTahHKgTMOcL0O3BvsgA==}
+  '@verdaccio/ui-theme@9.0.0-next-9.20':
+    resolution: {integrity: sha512-eo4xqFzzUU382zKozJxipJGLp3HUNQvMZ81oTBa0SZ+Q/Bk2Fum82qAiE5ww4hTaVDV0Rjb7fqC4qJeBuLcGww==}
 
-  '@verdaccio/url@13.0.2':
-    resolution: {integrity: sha512-dXVBJETBV5Q/jz7R/fTQxnzsTjgnDBEh2v8aOKtngwBEf7YkgzU7LrtyzkGmyRzXUvS5ZSAXWrBAKQ4DEIZ/6w==}
+  '@verdaccio/url@13.0.3':
+    resolution: {integrity: sha512-BGH19Qc0pwoefyafJ100izQkgqKuuSF0EVdNjgipG8154yIluELxyliL8cqvTTDVZLVwz/CBuBq8IpUU9lhv9g==}
     engines: {node: '>=18'}
 
-  '@verdaccio/utils@8.1.2':
-    resolution: {integrity: sha512-LTV6/Kcr8pS//iDjDitfYi1bp0AlKBUuvNoHAbI8tMnj0PLOUtRWJxId5FwuE+z3oNBeDLeOWPoXVtqKjl277Q==}
+  '@verdaccio/utils@8.1.3':
+    resolution: {integrity: sha512-tJ3XO0MaFe8gx9oiLBu3Jim8JVyJRC08c2Y4dfx3wd1j9HlVkiWnW5qYOoTHA4NfdMzugsBsI8GlX3v/y/EtPg==}
     engines: {node: '>=18'}
 
-  '@vitest/coverage-istanbul@4.1.8':
-    resolution: {integrity: sha512-/h514nMZMKI6foh21mVgO1zlCH6pdDamwKMbla1uLU2GMxTlfp0PQMxovWozmzQdCIQYZ2XXEzg2zNZom2zAOg==}
+  '@vitest/coverage-istanbul@4.1.9':
+    resolution: {integrity: sha512-4a7DsIwycTf4eYwEDtnMfMV8H80KSKH9PuMHhqL5SwPZzDyUKq2X/TPCVZ7NqIuSz7UbZckmEmkip6iZBI/gEA==}
     peerDependencies:
-      vitest: 4.1.8
+      vitest: 4.1.9
 
-  '@vitest/expect@4.1.8':
-    resolution: {integrity: sha512-h3nDO677RDLEGlBxyQ5CW8RlMThSKSRLUePLOx09gNIWRL40edgA1GCZSZgf1W55MFAG6/Sw14KeaAnqv0NKdQ==}
+  '@vitest/expect@4.1.9':
+    resolution: {integrity: sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA==}
 
-  '@vitest/mocker@4.1.8':
-    resolution: {integrity: sha512-LEiN/xe4OSIbKe9HQIp5OC24agGD9J5CnmMgsLohVVoOPWL9a2sBoR6VBx43jQZb7Kr1l4RCuyCJzcAa0+dojw==}
+  '@vitest/mocker@4.1.9':
+    resolution: {integrity: sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw==}
     peerDependencies:
       msw: ^2.4.9
       vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -2976,20 +3154,20 @@ packages:
       vite:
         optional: true
 
-  '@vitest/pretty-format@4.1.8':
-    resolution: {integrity: sha512-9GasEBxpZ1VYIpqHf/0+YGg121uSNwCKOJqIrTwWP/TB7DmFCiaBpNl3aPZzoLWfWkuqhbH8vJIVobZkvdo2cA==}
+  '@vitest/pretty-format@4.1.9':
+    resolution: {integrity: sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A==}
 
-  '@vitest/runner@4.1.8':
-    resolution: {integrity: sha512-EmVxeBAfMJvycdjd6Hm+RbFBbA9fKvo0Kx37hNpBYoYeavH3RNsBXWDooR1mgD52dCrxIIuP7UotpfiwOikvcg==}
+  '@vitest/runner@4.1.9':
+    resolution: {integrity: sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg==}
 
-  '@vitest/snapshot@4.1.8':
-    resolution: {integrity: sha512-acfZboRmAIf05DEKcBQy33VXojFJjtUdLyo7oOmV9kebb2xdU01UknNiPuPZoJZQyO7DF0gZdTGTpeAzET9QPQ==}
+  '@vitest/snapshot@4.1.9':
+    resolution: {integrity: sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA==}
 
-  '@vitest/spy@4.1.8':
-    resolution: {integrity: sha512-6EevtBp6OZOPF7bmz36HrGMeP3txgVSrgebWxHOafDXGkhIzfXK14f8KF6MuFfgXXUeHxmpD3BQxkV00/3s5mA==}
+  '@vitest/spy@4.1.9':
+    resolution: {integrity: sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA==}
 
-  '@vitest/utils@4.1.8':
-    resolution: {integrity: sha512-uOJamYALNhfJ6iolExyQM40yIQwDqYnkKtQ5VCiSe17E33H0aQ/u+1GlRuz4LZBk6Mm3sg90G9hEbmEt37C1Zg==}
+  '@vitest/utils@4.1.9':
+    resolution: {integrity: sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA==}
 
   '@yarnpkg/lockfile@1.1.0':
     resolution: {integrity: sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ==}
@@ -3158,8 +3336,8 @@ packages:
     resolution: {integrity: sha512-1pHv8LX9CpKut1Zp4EXey7Z8OfH11ONNH6Dhi2WDUt31VVZFXZzKwXcysBgqSumFCmR+0dqjMK5v5JiFHzi0+g==}
     engines: {node: 20 || >=22}
 
-  bare-events@2.8.3:
-    resolution: {integrity: sha512-HdUm8EMQBLaJvGUdidNNbqpA1kYkwNcb+MYxkxCLAPJGQzlv9J0C24h8V65Z4c5GLd/JEALDvpFCQgpLJqc0zw==}
+  bare-events@2.9.1:
+    resolution: {integrity: sha512-Z0oHEHAFDZkffN8Qc39zNZjQlMDkPJRyyyZieU1VH7u8c5S+qHZ2S8ixdKIAxEjfHO7FJxXmJWgteOghVanIsg==}
     peerDependencies:
       bare-abort-controller: '*'
     peerDependenciesMeta:
@@ -3336,8 +3514,8 @@ packages:
     resolution: {integrity: sha512-+W/5efTR7y5HRD7gACw9yQjqMVvEMLBHmboM/kPWam+H+Hmyrgjh6YncVKK122YZkXrLudzTuAukUw9FnMf7IQ==}
     engines: {node: 10.* || >= 12.*}
 
-  cli-truncate@6.0.0:
-    resolution: {integrity: sha512-3+YKIUFsohD9MIoOFPFBldjAlnfCmCDcqe6aYGFqlDTRKg80p4wg35L+j83QQ63iOlKRccEkbn8IuM++HsgEjA==}
+  cli-truncate@6.1.0:
+    resolution: {integrity: sha512-ofWtXdvPO1WepoE9Gn4dPdZw+ADud1Yz9K+xm9FjK5vvrs/D60vrlKIQeSw1wJX4cphW2bnWi8GZSKvf9T6shw==}
     engines: {node: '>=22'}
 
   client-only@0.0.1:
@@ -3630,8 +3808,8 @@ packages:
   ee-first@1.1.1:
     resolution: {integrity: sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==}
 
-  effect@4.0.0-beta.83:
-    resolution: {integrity: sha512-0wsak8RtgGAr9UWSbVDgJHZcUqMSvicHcvaZv1MbMM7MCGgW4Rn/137J1MHQbwYPcwYGxT/IqehFd+UbYuj78w==}
+  effect@4.0.0-beta.85:
+    resolution: {integrity: sha512-Cjv9YQyv4CiIccmRAQIWAoeESCpCpiuHYY8zb5vqiYs3Ac2yE5RQAnKq7z4Ir/3VJYZb8kxh6rS8czDDnpTdkQ==}
 
   ejs@5.0.1:
     resolution: {integrity: sha512-COqBPFMxuPTPspXl2DkVYaDS3HtrD1GpzOGkNTJ1IYkifq/r9h8SVEFrjA3D9/VJGOEoMQcrlhpntcSUrM8k6A==}
@@ -3704,8 +3882,8 @@ packages:
     resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
     engines: {node: '>= 0.4'}
 
-  es-toolkit@1.48.1:
-    resolution: {integrity: sha512-wfnXlwd5I75eXRtdD2vuEs50xHHESECDsGD7yiQnfFVNoa5522NwXEbmgo98LfiukSQHs+mBM7/YG3qKJB9/mQ==}
+  es-toolkit@1.49.0:
+    resolution: {integrity: sha512-G5iZ6Pc/FNRY/soKZHC+TxGDD83rHUDXxzaWhGCX44vAv/tMs56WMusnm/KMNK+luUPsgA9U28cGr4RDlSzL2g==}
 
   esast-util-from-estree@2.0.0:
     resolution: {integrity: sha512-4CyanoAudUSBAn5K13H4JhsMH6L9ZP7XbLVe/dKybkxMO7eDyLsT8UHl9TRNrU2Gr9nz+FovfSIjuXWJ81uVwQ==}
@@ -3809,6 +3987,10 @@ packages:
     resolution: {integrity: sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==}
     engines: {node: '>= 0.10.0'}
 
+  express@4.22.2:
+    resolution: {integrity: sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==}
+    engines: {node: '>= 0.10.0'}
+
   express@5.2.1:
     resolution: {integrity: sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==}
     engines: {node: '>= 18'}
@@ -3939,8 +4121,8 @@ packages:
     resolution: {integrity: sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==}
     engines: {node: '>= 0.6'}
 
-  framer-motion@12.40.0:
-    resolution: {integrity: sha512-uaBd3qC1v3KQqBEjwTUd183K6PbS+j0yR9w9VmEOLWA/tnUcSn8Xa3uck7t4dgpDoUss8xQTcj8W2L07lrnLFg==}
+  framer-motion@12.42.0:
+    resolution: {integrity: sha512-wp7EJnfWaaEScVygKv3e20udoRz+LbtxScsuTkakAxfXmt+ReC6WyPW2nINRAGvd+hG9odwcjBLyOTPjH5pBRA==}
     peerDependencies:
       '@emotion/is-prop-valid': '*'
       react: ^18.0.0 || ^19.0.0
@@ -3973,8 +4155,8 @@ packages:
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
     os: [darwin]
 
-  fumadocs-core@16.10.2:
-    resolution: {integrity: sha512-7YMEkUYQYYey+8yzZW47jV3pbctCXsevFY6u4yN9PRwJi/q76QOFfefvzSkbYha3OIudr2C0RGzJxEhzV2a1/g==}
+  fumadocs-core@16.10.5:
+    resolution: {integrity: sha512-e/xrZnKvQo8bF/WYMwPuym8PR3OtjZzHy0S/EIOvGwjKRgVq9z6J58zaBpi4LvYtPVZxNGsxdZVlmZXCVWq4FQ==}
     peerDependencies:
       '@mdx-js/mdx': '*'
       '@mixedbread/sdk': 0.x.x
@@ -3991,7 +4173,7 @@ packages:
       next: 16.x.x
       react: ^19.2.0
       react-dom: ^19.2.0
-      react-router: 7.x.x
+      react-router: 7.x.x || 8.x.x
       waku: '*'
       zod: 4.x.x
     peerDependenciesMeta:
@@ -4063,13 +4245,13 @@ packages:
       vite:
         optional: true
 
-  fumadocs-ui@16.10.2:
-    resolution: {integrity: sha512-l8fYpahaLVA73XUktsjTdq6iwG6V0/UGAnN1uuCeVuV4ea/8RDduOo9CcMM62SCup0EnT1zEAk+FGFCdKQ4BhQ==}
+  fumadocs-ui@16.10.5:
+    resolution: {integrity: sha512-vd69ckYx/4a1aoJTCUJ5LBkqNeOFxm3r+8SK9bVYaeHJrY/n8+4W6b0soqxVqgj1UwNmgovoAg0vlsYmSxZBgQ==}
     peerDependencies:
       '@takumi-rs/image-response': '*'
       '@types/mdx': '*'
       '@types/react': '*'
-      fumadocs-core: 16.10.2
+      fumadocs-core: 16.10.5
       next: 16.x.x
       react: ^19.2.0
       react-dom: ^19.2.0
@@ -4350,8 +4532,8 @@ packages:
       ink: '>=4.0.0'
       react: '>=18.0.0'
 
-  ink@7.0.6:
-    resolution: {integrity: sha512-/KG651f+LHln9gumb5ltieFqzNGJdhX1b/WwsCUd2Py7Htuk9KUzyFrk25ugmzjXyDneXSoXD3cm4ql4dWFGsQ==}
+  ink@7.1.0:
+    resolution: {integrity: sha512-VWE6/yeLtFCJBNLflyI2OSylyXK1Rc24LuXup8Qt+icwkmmycFNdbn8IkSp6Frc0h1iA0NOvvi1ajW44U/w3Qg==}
     engines: {node: '>=22'}
     peerDependencies:
       '@types/react': '>=19.2.0'
@@ -4518,6 +4700,10 @@ packages:
     resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==}
     hasBin: true
 
+  js-yaml@4.3.0:
+    resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==}
+    hasBin: true
+
   jsbn@0.1.1:
     resolution: {integrity: sha512-UVU9dibq2JcFWxQPA6KCqj5O42VOmAY3zQUfEKxU0KpTGXwNoCjkX1e13eHNvw/xPynt6pU0rZ1htjWTNTSXsg==}
 
@@ -4586,8 +4772,8 @@ packages:
   keyv@4.5.4:
     resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
 
-  knip@6.16.1:
-    resolution: {integrity: sha512-TKMn1rxgH6h9vXR9Y0B+Cq7AdPTr9EI02IwoT65NzqYUkvoDQAaJ/aPybiFpAhZ1px6cNYYwXf86iHkBgzCo9w==}
+  knip@6.23.0:
+    resolution: {integrity: sha512-2DvAOX2pZWiG4SLvRRxOAU0aWGEn1ZoVblI541xIoXFdHqq2THMZXy66/qcY5WGuW3TXhb9T1x1zd/Hd1u+yqg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
 
@@ -4751,8 +4937,8 @@ packages:
     resolution: {integrity: sha512-jumlc0BIUrS3qJGgIkWZsyfAM7NCWiBcCDhnd+3NNM5KbBmLTgHVfWBcg6W+rLUsIpzpERPsvwUP7CckAQSOoA==}
     engines: {node: '>=12'}
 
-  lucide-react@1.21.0:
-    resolution: {integrity: sha512-reEZMXq8Qdd5jg5XYkQ5TR1fB/GiQ7ih4vcrthYDtgjSDwh0i6/YLiGjsWsIwgN49gpAnd4J2elSNzncMEEUUQ==}
+  lucide-react@1.22.0:
+    resolution: {integrity: sha512-c9o3l0PiNcgOQDW4F31BEYHudE7kgxVt3o30qMl36ZPwTxXlGB4QnLilhERvVM4uh/pl5MDyY1/gzZSYcHDtBg==}
     peerDependencies:
       react: ^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
@@ -5042,14 +5228,14 @@ packages:
     engines: {node: '>=10'}
     hasBin: true
 
-  motion-dom@12.40.0:
-    resolution: {integrity: sha512-HxU3ZaBwNPVQUBQf1xxgq+7JrPNZvjLVxgbpEZL7RrWJnsxOf0/OM+yrHG9ogLQ31Do/r57Oz2gQWPK+6q62mg==}
+  motion-dom@12.42.0:
+    resolution: {integrity: sha512-M63h4n8R+quJdNhBwuLlgxM+OLYa9+I/T2pzDRboB9fLXRdbou+Gw7Zury+SkpaCyACP1JHSjHgZ1EgTkBr30w==}
 
   motion-utils@12.39.0:
     resolution: {integrity: sha512-8nadJAJjTtqRkmRF36FoJTrywK9nnFmnPwnSMyxaOCU7GDjN9RTMJIxx9De8ErM+vpPhMccr/6fo5WciyQLnMQ==}
 
-  motion@12.40.0:
-    resolution: {integrity: sha512-yjrHUrBFW6kQvjJwRsoiPSAhC5tRwRqNGJWmiJ4CrGnbKp0V88AdzkhBmDoqIsIPfarOe0Uddd37Xq43/gIocA==}
+  motion@12.42.0:
+    resolution: {integrity: sha512-Qhwvu9sVl5/URSq5CNzwMCpSKK8Uhnrwb6VO977kZyj/wOCS7mWebJUnBoHx5cZU1Zv8a9BD5CSICWKAlrLJgA==}
     peerDependencies:
       '@emotion/is-prop-valid': '*'
       react: ^18.0.0 || ^19.0.0
@@ -5271,6 +5457,18 @@ packages:
       '@swc/core':
         optional: true
 
+  nx@23.0.1:
+    resolution: {integrity: sha512-HnK0Ke8FcPeVQffYm1oyzkLNn7khrI8SeDeC3iyLhw/UEMCB24hjI5JSs6Amlyeb0/GaeiuQuts8NkQKd/NpGA==}
+    hasBin: true
+    peerDependencies:
+      '@swc-node/register': ^1.11.1
+      '@swc/core': ^1.15.8
+    peerDependenciesMeta:
+      '@swc-node/register':
+        optional: true
+      '@swc/core':
+        optional: true
+
   object-assign@4.1.1:
     resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
     engines: {node: '>=0.10.0'}
@@ -5322,15 +5520,18 @@ packages:
     resolution: {integrity: sha512-5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==}
     engines: {node: '>=10'}
 
-  oxc-parser@0.133.0:
-    resolution: {integrity: sha512-661RSx+ZcjBmjBYid+Fpp/2F5EbtildpeoZh5HdgnGs+jZ03nqQEQW8yGkt4BGyOC3OMPDQQRl8M5kqD2/g6jw==}
+  oxc-parser@0.137.0:
+    resolution: {integrity: sha512-yFImD+WLElJpLKy8llG1qe4DCmMsL18peRp8XP1JKfig/gISbJkglnpDtX2aTmAn10kZF7164HbN2H8QPsXxGg==}
     engines: {node: ^20.19.0 || >=22.12.0}
 
   oxc-resolver@11.20.0:
     resolution: {integrity: sha512-CblytBiV/a/ZXY34dsVU2NxhIOxMXst8CvDCtyBelVITgd7PLrKzbEbA6oKLdPjvDKDzCiW48qzmzZ+mYaqn+g==}
 
-  oxfmt@0.54.0:
-    resolution: {integrity: sha512-DjnMwn7smSLF+Mc2+pRItnuPftm/dkUFpY/d4+33y9TfKrsHZo8GLhmUg9BrOIUEy94Rlom1Q11N6vuhE+e0oQ==}
+  oxc-resolver@11.21.3:
+    resolution: {integrity: sha512-2Mx3fKQz7+xgrBONjsxOgCGtMHOn38/HxMzW1I5efwXB5a4lRN0Vp40gYUJFBWJslcrvwoofTrqoTnLbwTd3pA==}
+
+  oxfmt@0.55.0:
+    resolution: {integrity: sha512-jSj2wCTakwgPMxkfiVZX0jf+nX+Nz6xlyAZjqNE0qXTFdCBPYlP6JAN+ODjmealw7DXBjOzYbdsqwBMAZnPZ6A==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -5346,8 +5547,8 @@ packages:
     resolution: {integrity: sha512-3mBv3CoPbh8dFbzfDGIWa2ytZjn2v+3EX4aKRXjIhsoGFzG8GCjfRirz3rwZf1wYbZzsNLTSgpw8VjQuWdp/jA==}
     hasBin: true
 
-  oxlint@1.69.0:
-    resolution: {integrity: sha512-ypZkK/aDc5NQV8zIR6s2H2Tl3aNW8FmJ1m9+2qsaYuRenl8vgnHNCGwTHviWJdUQzglOlHFchgopdtGhSy17Rw==}
+  oxlint@1.71.0:
+    resolution: {integrity: sha512-U1m1X+C0vDj7DC1e13IoZULzEcPczE7UOMTs8VlZGHUEIUaSTZKo5qkPsQEfzpgnQ29Pea/w3Xntk62UCecxZw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -5482,8 +5683,8 @@ packages:
   pg-connection-string@2.12.0:
     resolution: {integrity: sha512-U7qg+bpswf3Cs5xLzRqbXbQl85ng0mfSV/J0nnA31MCLgvEaAo7CIhmeyrmJpOr7o+zm0rXK+hNnT5l9RHkCkQ==}
 
-  pg-connection-string@2.13.0:
-    resolution: {integrity: sha512-EMnU9E2fSULdsbErBbMaXJvFeD9B4+nPcM3f+4lsiCR0BHLPrLVjv3DbyM2hgQQviKJaTWIRRTjKjWlHg3p2ig==}
+  pg-connection-string@2.14.0:
+    resolution: {integrity: sha512-XwWDGcLRGCXAR8F/AM5bG7Q+A3Wm2s6QeEjlOKZLlH3UYcguiqCWKyWXVag5TLTIjR7oOJUY8kcADaZgWPyLeg==}
 
   pg-copy-streams@7.0.0:
     resolution: {integrity: sha512-zBvnY6wtaBRE2ae2xXWOOGMaNVPkXh1vhypAkNSKgMdciJeTyIQAHZaEeRAxUjs/p1El5jgzYmwG5u871Zj3dQ==}
@@ -5509,6 +5710,9 @@ packages:
   pg-protocol@1.14.0:
     resolution: {integrity: sha512-n5taZ1kO3s9ngDTVxsEznOqCyToTgz0FLuPq0B33COy5pPpuWJpY3/2oRBVETuOgzdqRXfWpM9HIhp2LBBT1BA==}
 
+  pg-protocol@1.15.0:
+    resolution: {integrity: sha512-cq9sECI5s0+uPUXjbz8ioyPJni6RzsRib0US67i5IoTZKw8fNeYlVE7u8F4dG7vEJJtc5wdD1K189lCCUwqWTQ==}
+
   pg-types@2.2.0:
     resolution: {integrity: sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==}
     engines: {node: '>=4'}
@@ -5517,8 +5721,8 @@ packages:
     resolution: {integrity: sha512-o2XFanIMy/3+mThw69O8d4n1E5zsLhdO+OPqswezu7Z5ekP4hYDqlDjlmOpYMbzY2Br0ufCwJLdDIXeNVwcWFg==}
     engines: {node: '>=10'}
 
-  pg@8.21.0:
-    resolution: {integrity: sha512-AUP1EYJuHraQGsVoCQVIcM7TEJVGtDzxWtGFZd8rds9d+CCXlU5Js1rYgfLNvxy9iJrpHjGrRjoi/3BT9fRyiA==}
+  pg@8.22.0:
+    resolution: {integrity: sha512-8wih1vVIBMxoUM2oB4soJsD9tDnDpLv4OXBJ+EJzFsvycD+lfyIreC2gGHq78f8jbLLt+bvlPTFdFZfJkOuzAA==}
     engines: {node: '>= 16.0.0'}
     peerDependencies:
       pg-native: '>=3.0.1'
@@ -5577,8 +5781,8 @@ packages:
     resolution: {integrity: sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==}
     engines: {node: ^10 || ^12 || >=14}
 
-  postcss@8.5.15:
-    resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==}
+  postcss@8.5.16:
+    resolution: {integrity: sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==}
     engines: {node: ^10 || ^12 || >=14}
 
   postgres-array@2.0.0:
@@ -5616,8 +5820,8 @@ packages:
   postgres-range@1.1.4:
     resolution: {integrity: sha512-i/hbxIE9803Alj/6ytL7UHQxRvZkI9O4Sy+J3HGc4F4oo/2eQAjTSNJ0bfxyse3bH0nuVesCk+3IRLaMtG3H6w==}
 
-  posthog-node@5.37.0:
-    resolution: {integrity: sha512-wFwWGcqAqZ1WJRlNNYc92veV83d1lOQcP4Lq0q7Kar9GdZLPpiFYHeudyybYJnjZjkI9v06vLvY/Og5CZIfByg==}
+  posthog-node@5.38.2:
+    resolution: {integrity: sha512-eiKpU+vX4hVuHbO/EosvPHsmh2AVIdoVmWss/uUOs1t4b0ViCblw2o8OIFqHxKj3mYRnSOBlX0Dw3wBvcCaYpA==}
     engines: {node: ^20.20.0 || >=22.22.0}
     peerDependencies:
       rxjs: ^7.0.0
@@ -5681,8 +5885,8 @@ packages:
     resolution: {integrity: sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==}
     engines: {node: '>=0.6'}
 
-  qs@6.15.2:
-    resolution: {integrity: sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==}
+  qs@6.15.3:
+    resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==}
     engines: {node: '>=0.6'}
 
   queue-microtask@1.2.3:
@@ -5946,13 +6150,8 @@ packages:
     engines: {node: '>=10'}
     hasBin: true
 
-  semver@7.8.0:
-    resolution: {integrity: sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==}
-    engines: {node: '>=10'}
-    hasBin: true
-
-  semver@7.8.1:
-    resolution: {integrity: sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==}
+  semver@7.8.2:
+    resolution: {integrity: sha512-c8jsqUZm3omBOI66G90z1Dyw5z622G8oLG+omfsHBJf3CWQTlOcwOjvOG6wtiNfW6anKm/eA39LMwMtMez2TiQ==}
     engines: {node: '>=10'}
     hasBin: true
 
@@ -6001,8 +6200,8 @@ packages:
     resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==}
     engines: {node: '>= 0.4'}
 
-  shiki@4.2.0:
-    resolution: {integrity: sha512-hjNax6o/ylDy9lefQEaSDtzaT3iVNtZ3WmpQnbuQNoG4xvnSKf2kSKbihZVO4JRG1TTMejs7CmNRYlWgAL66pQ==}
+  shiki@4.3.0:
+    resolution: {integrity: sha512-NKKjWzR6LIGL3sXBrWDw9sDS9cxx42/DkysaNqJEeOWE8Kix5gpak0bc00OfDVEO4oyXSyz8+aRaqKoBD1yo7A==}
     engines: {node: '>=20'}
 
   side-channel-list@1.0.1:
@@ -6017,8 +6216,8 @@ packages:
     resolution: {integrity: sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==}
     engines: {node: '>= 0.4'}
 
-  side-channel@1.1.0:
-    resolution: {integrity: sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==}
+  side-channel@1.1.1:
+    resolution: {integrity: sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==}
     engines: {node: '>= 0.4'}
 
   siginfo@2.0.0:
@@ -6054,6 +6253,10 @@ packages:
     resolution: {integrity: sha512-dWUG8F5sIIARXih1DTaQAX4SsiTXhInKf1buxdY9DIg4ZYPZK5nGM1VRIYmEbDbsHt7USo99xSLFu5Q1IqTmsg==}
     engines: {node: '>= 18'}
 
+  smol-toml@1.7.0:
+    resolution: {integrity: sha512-aqVvWoyO21L23mb+drl4RmMXbf6N7FdHjAhTRA9ZBL7apWBgfWC16KjrASI+1p9GAroljyMHj6fK67i0UiTNvQ==}
+    engines: {node: '>= 18'}
+
   sonic-boom@3.8.1:
     resolution: {integrity: sha512-y4Z8LCDBuum+PBP3lSV7RHrXscqksve/bi0as7mhwVnBW+/wUqKT/2Kb7um8yqcFy0duYbbPxzt89Zy2nOCaxg==}
 
@@ -6134,8 +6337,8 @@ packages:
   stream-shift@1.0.3:
     resolution: {integrity: sha512-76ORR0DO1o1hlKwTbi/DM3EXWGf3ZJYO8cXX5RJwnul2DEg2oyoZyjLNoQM8WsvZiFKCRfC1O0J7iCvie3RZmQ==}
 
-  streamx@2.26.0:
-    resolution: {integrity: sha512-VvNG1K72Po/xwJzxZFnZ++Tbrv4lwSptsbkFuzXCJAYZvCK5nnxsvXU6ajqkv7chyiI1Y0YXq2Jh8Iy8Y7NF/A==}
+  streamx@2.28.0:
+    resolution: {integrity: sha512-1Yowhzjf0ivGMrTIkY9hav5TxobO9qIVqUE41fiCGMGgc3CLlf4MY+9AHmZqBWgDTue0fY9zWjYFVyf6Diuobw==}
 
   string-width@4.2.3:
     resolution: {integrity: sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==}
@@ -6257,8 +6460,8 @@ packages:
   thenify@3.3.1:
     resolution: {integrity: sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==}
 
-  thread-stream@3.1.0:
-    resolution: {integrity: sha512-OqyPZ9u96VohAyMfJykzmivOrY2wfMSf3C5TtFJVgN+Hm6aj+voFhlK+kZEIv2FBh1X6Xp3DlnCOfEQ3B2J86A==}
+  thread-stream@3.2.0:
+    resolution: {integrity: sha512-zLBvqpwr4Esa0kRjcrzGU6zL25lePWaCLMx0RQFrmteozIfeNdaMLpG5U7PeHzvlFkAWaRKA9/KVW4F60iB+qw==}
 
   through2@2.0.5:
     resolution: {integrity: sha512-/mrRod8xqpA+IHSLyGCQ2s8SPHiCDEeQJSep1jqLYeEUClOFG2Qsh+4FU6G9VeqpZnGW/Su8LQGc4YKni5rYSQ==}
@@ -6292,21 +6495,25 @@ packages:
   tldts-core@6.1.86:
     resolution: {integrity: sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==}
 
-  tldts-core@7.4.2:
-    resolution: {integrity: sha512-nwEyF4vl4RSJjwSjBUmOSxc3BFPoIFdlRthJ6e+5v9P3bHNsoD06UjuqMUspqp7vsEZ1beaHi1km+optiE17yA==}
+  tldts-core@7.4.5:
+    resolution: {integrity: sha512-pGrwzZDvPwKe+7NNUqAunb6rqTfynr0VOUhCMdqbu5xlvNiszsAJygRzwvpVycdzejlbpY+SWJOn+s75Og7FEA==}
 
   tldts@6.1.86:
     resolution: {integrity: sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==}
     hasBin: true
 
-  tldts@7.4.2:
-    resolution: {integrity: sha512-kCwffuaH8ntKtygnWe1b4BJKWiCUH30n5KfoTr6IchcXOwR7chAOFJxFrH3vjANafUYrIA4a7SDL+nn7SiR4Sw==}
+  tldts@7.4.5:
+    resolution: {integrity: sha512-RfEzKWcq5fHUOFq7J3rl3Oz6ylKGtcHqUznzj4EcXsxLSIjJcvpbXAQtWGeJQ0xKnimR5e0Cn+cn9TssfMzm+g==}
     hasBin: true
 
   tmp@0.2.6:
     resolution: {integrity: sha512-5sJPdPjfI5Kx+qbrDesxkglRBxW//g7hCsqspEjwkewGvBMGIKMOTKzLt1hFVJzyadba3lDUN20O9qhvbQUSTA==}
     engines: {node: '>=14.14'}
 
+  tmp@0.2.7:
+    resolution: {integrity: sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==}
+    engines: {node: '>=14.14'}
+
   to-regex-range@5.0.1:
     resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
     engines: {node: '>=8.0'}
@@ -6396,13 +6603,16 @@ packages:
     engines: {node: '>=0.8.0'}
     hasBin: true
 
-  unbash@3.0.0:
-    resolution: {integrity: sha512-FeFPZ/WFT0mbRCuydiZzpPFlrYN8ZUpphQKoq4EeElVIYjYyGzPMxQR/simUwCOJIyVhpFk4RbtyO7RuMpMnHA==}
+  unbash@4.0.2:
+    resolution: {integrity: sha512-8gwNZ29+0/3zmXw7ToIHZtg6wK37xnniRUdBt7B27xZxaxfgR5tGMaGHT0t0dLtBV9fXE7zurh0s6Z1DHVjfWg==}
     engines: {node: '>=14'}
 
   undici-types@7.24.6:
     resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}
 
+  undici-types@8.3.0:
+    resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==}
+
   undici@6.27.0:
     resolution: {integrity: sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==}
     engines: {node: '>=18.17'}
@@ -6533,16 +6743,16 @@ packages:
     resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
     engines: {node: '>= 0.8'}
 
-  verdaccio-audit@13.0.2:
-    resolution: {integrity: sha512-J2aq4b0Q6qj/3o+r8dBPCmKNj37x+8BjSZOEoH85zjR3kihiVYQgJ1+2UxKCJpLj4Z/04SekB1p+zTBiViyoMw==}
+  verdaccio-audit@13.0.3:
+    resolution: {integrity: sha512-n5VYOooGpXr3ZE2DjNx6lJPkCFd2sORDVMmbs0o7Mqx6g0kOHTkfkY5DygZAwOvGtFy0CecufRrl49RzAD9Jkg==}
     engines: {node: '>=18'}
 
-  verdaccio-htpasswd@13.0.2:
-    resolution: {integrity: sha512-ObyN409utfLKQ4QdGAYyXOprVaOYz0tDvhi0WpK7U71QvL/LOjeXWleDFRJHeaEMTNNdrzPhtC/9kcpfnztabg==}
+  verdaccio-htpasswd@13.0.3:
+    resolution: {integrity: sha512-xh0VO4zRfcbIR2bpH2SwW4kLHzCEKFYg9lykpuEENJ9OIcoc12mGXH5DTuOuJ9po8Y0mGTzFh3JUZIwXJlmOSw==}
     engines: {node: '>=18'}
 
-  verdaccio@6.7.2:
-    resolution: {integrity: sha512-o9YQonYX94RxVKQncxcUbsPtLTV26IgDSPQTbcw6rFrtQ6zb7Fx75vTNBps2O7xStMtwROblGwnLlHF7akm0jQ==}
+  verdaccio@6.7.4:
+    resolution: {integrity: sha512-C59DdKYtc1vayM3HiRFVRCRJMd4Hq4QCQnjTMM6CVanJvMpaqHlZ+DHE31/L8ScXkzUl1oS0HulizpxmMXW1LA==}
     engines: {node: '>=20'}
     hasBin: true
 
@@ -6602,20 +6812,20 @@ packages:
       yaml:
         optional: true
 
-  vitest@4.1.8:
-    resolution: {integrity: sha512-flY6ScbCIt9HThs+C5HS7jvGOB560DJtk/Z15IQROTA6zEy49Nh8T/dofWTQL+n3vswqn87sbJNiuqw1SDp5Ig==}
+  vitest@4.1.9:
+    resolution: {integrity: sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ==}
     engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
     hasBin: true
     peerDependencies:
       '@edge-runtime/vm': '*'
       '@opentelemetry/api': ^1.9.0
       '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
-      '@vitest/browser-playwright': 4.1.8
-      '@vitest/browser-preview': 4.1.8
-      '@vitest/browser-webdriverio': 4.1.8
-      '@vitest/coverage-istanbul': 4.1.8
-      '@vitest/coverage-v8': 4.1.8
-      '@vitest/ui': 4.1.8
+      '@vitest/browser-playwright': 4.1.9
+      '@vitest/browser-preview': 4.1.9
+      '@vitest/browser-webdriverio': 4.1.9
+      '@vitest/coverage-istanbul': 4.1.9
+      '@vitest/coverage-v8': 4.1.9
+      '@vitest/ui': 4.1.9
       happy-dom: '*'
       jsdom: '*'
       vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -6804,46 +7014,46 @@ snapshots:
       ansi-styles: 6.2.3
       is-fullwidth-code-point: 5.1.0
 
-  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.177':
+  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.185':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.177':
+  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.185':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.177':
+  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.185':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.177':
+  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.185':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.177':
+  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.185':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.177':
+  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.185':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.177':
+  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.185':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.177':
+  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.185':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk@0.3.177(@anthropic-ai/sdk@0.104.1(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(zod@4.4.3)':
+  '@anthropic-ai/claude-agent-sdk@0.3.185(@anthropic-ai/sdk@0.105.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(zod@4.4.3)':
     dependencies:
-      '@anthropic-ai/sdk': 0.104.1(zod@4.4.3)
+      '@anthropic-ai/sdk': 0.105.0(zod@4.4.3)
       '@modelcontextprotocol/sdk': 1.29.0(zod@4.4.3)
       zod: 4.4.3
     optionalDependencies:
-      '@anthropic-ai/claude-agent-sdk-darwin-arm64': 0.3.177
-      '@anthropic-ai/claude-agent-sdk-darwin-x64': 0.3.177
-      '@anthropic-ai/claude-agent-sdk-linux-arm64': 0.3.177
-      '@anthropic-ai/claude-agent-sdk-linux-arm64-musl': 0.3.177
-      '@anthropic-ai/claude-agent-sdk-linux-x64': 0.3.177
-      '@anthropic-ai/claude-agent-sdk-linux-x64-musl': 0.3.177
-      '@anthropic-ai/claude-agent-sdk-win32-arm64': 0.3.177
-      '@anthropic-ai/claude-agent-sdk-win32-x64': 0.3.177
+      '@anthropic-ai/claude-agent-sdk-darwin-arm64': 0.3.185
+      '@anthropic-ai/claude-agent-sdk-darwin-x64': 0.3.185
+      '@anthropic-ai/claude-agent-sdk-linux-arm64': 0.3.185
+      '@anthropic-ai/claude-agent-sdk-linux-arm64-musl': 0.3.185
+      '@anthropic-ai/claude-agent-sdk-linux-x64': 0.3.185
+      '@anthropic-ai/claude-agent-sdk-linux-x64-musl': 0.3.185
+      '@anthropic-ai/claude-agent-sdk-win32-arm64': 0.3.185
+      '@anthropic-ai/claude-agent-sdk-win32-x64': 0.3.185
 
-  '@anthropic-ai/sdk@0.104.1(zod@4.4.3)':
+  '@anthropic-ai/sdk@0.105.0(zod@4.4.3)':
     dependencies:
       json-schema-to-ts: 3.1.1
       standardwebhooks: 1.0.0
@@ -6952,14 +7162,14 @@ snapshots:
       '@babel/helper-string-parser': 7.29.7
       '@babel/helper-validator-identifier': 7.29.7
 
-  '@clack/core@1.4.1':
+  '@clack/core@1.4.2':
     dependencies:
       fast-wrap-ansi: 0.2.2
       sisteransi: 1.0.5
 
-  '@clack/prompts@1.5.1':
+  '@clack/prompts@1.6.0':
     dependencies:
-      '@clack/core': 1.4.1
+      '@clack/core': 1.4.2
       fast-string-width: 3.0.2
       fast-wrap-ansi: 0.2.2
       sisteransi: 1.0.5
@@ -6988,33 +7198,33 @@ snapshots:
       tunnel-agent: 0.6.0
       uuid: 8.3.2
 
-  '@effect/atom-react@4.0.0-beta.83(effect@4.0.0-beta.83)(react@19.2.7)(scheduler@0.27.0)':
+  '@effect/atom-react@4.0.0-beta.85(effect@4.0.0-beta.85)(react@19.2.7)(scheduler@0.27.0)':
     dependencies:
-      effect: 4.0.0-beta.83
+      effect: 4.0.0-beta.85
       react: 19.2.7
       scheduler: 0.27.0
 
-  '@effect/platform-bun@4.0.0-beta.83(effect@4.0.0-beta.83)':
+  '@effect/platform-bun@4.0.0-beta.85(effect@4.0.0-beta.85)':
     dependencies:
-      '@effect/platform-node-shared': 4.0.0-beta.84(effect@4.0.0-beta.83)
-      effect: 4.0.0-beta.83
+      '@effect/platform-node-shared': 4.0.0-beta.91(effect@4.0.0-beta.85)
+      effect: 4.0.0-beta.85
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
 
-  '@effect/platform-node-shared@4.0.0-beta.84(effect@4.0.0-beta.83)':
+  '@effect/platform-node-shared@4.0.0-beta.91(effect@4.0.0-beta.85)':
     dependencies:
       '@types/ws': 8.18.1
-      effect: 4.0.0-beta.83
+      effect: 4.0.0-beta.85
       ws: 8.21.0
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
 
-  '@effect/platform-node@4.0.0-beta.83(effect@4.0.0-beta.83)(ioredis@5.11.0)':
+  '@effect/platform-node@4.0.0-beta.85(effect@4.0.0-beta.85)(ioredis@5.11.0)':
     dependencies:
-      '@effect/platform-node-shared': 4.0.0-beta.84(effect@4.0.0-beta.83)
-      effect: 4.0.0-beta.83
+      '@effect/platform-node-shared': 4.0.0-beta.91(effect@4.0.0-beta.85)
+      effect: 4.0.0-beta.85
       ioredis: 5.11.0
       mime: 4.1.0
       undici: 8.5.0
@@ -7022,27 +7232,39 @@ snapshots:
       - bufferutil
       - utf-8-validate
 
-  '@effect/sql-pg@4.0.0-beta.83(effect@4.0.0-beta.83)':
+  '@effect/sql-pg@4.0.0-beta.85(effect@4.0.0-beta.85)':
     dependencies:
-      effect: 4.0.0-beta.83
-      pg: 8.21.0
+      effect: 4.0.0-beta.85
+      pg: 8.22.0
       pg-connection-string: 2.12.0
-      pg-cursor: 2.20.0(pg@8.21.0)
-      pg-pool: 3.14.0(pg@8.21.0)
+      pg-cursor: 2.20.0(pg@8.22.0)
+      pg-pool: 3.14.0(pg@8.22.0)
       pg-types: 4.1.0
     transitivePeerDependencies:
       - pg-native
 
-  '@effect/vitest@4.0.0-beta.84(effect@4.0.0-beta.83)(vitest@4.1.8)':
+  '@effect/vitest@4.0.0-beta.91(effect@4.0.0-beta.85)(vitest@4.1.9)':
     dependencies:
-      effect: 4.0.0-beta.83
-      vitest: 4.1.8(@types/node@25.9.3)(@vitest/coverage-istanbul@4.1.8)(vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+      effect: 4.0.0-beta.85
+      vitest: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
 
   '@emnapi/core@1.10.0':
     dependencies:
       '@emnapi/wasi-threads': 1.2.1
       tslib: 2.8.1
 
+  '@emnapi/core@1.11.0':
+    dependencies:
+      '@emnapi/wasi-threads': 1.2.2
+      tslib: 2.8.1
+    optional: true
+
+  '@emnapi/core@1.11.1':
+    dependencies:
+      '@emnapi/wasi-threads': 1.2.2
+      tslib: 2.8.1
+    optional: true
+
   '@emnapi/core@1.4.5':
     dependencies:
       '@emnapi/wasi-threads': 1.0.4
@@ -7053,6 +7275,11 @@ snapshots:
       tslib: 2.8.1
     optional: true
 
+  '@emnapi/runtime@1.11.0':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
+
   '@emnapi/runtime@1.11.1':
     dependencies:
       tslib: 2.8.1
@@ -7069,6 +7296,11 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
+  '@emnapi/wasi-threads@1.2.2':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
+
   '@esbuild/aix-ppc64@0.28.1':
     optional: true
 
@@ -7433,6 +7665,27 @@ snapshots:
       '@tybys/wasm-util': 0.10.3
     optional: true
 
+  '@napi-rs/wasm-runtime@1.1.6(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)':
+    dependencies:
+      '@emnapi/core': 1.10.0
+      '@emnapi/runtime': 1.10.0
+      '@tybys/wasm-util': 0.10.3
+    optional: true
+
+  '@napi-rs/wasm-runtime@1.1.6(@emnapi/core@1.11.0)(@emnapi/runtime@1.11.0)':
+    dependencies:
+      '@emnapi/core': 1.11.0
+      '@emnapi/runtime': 1.11.0
+      '@tybys/wasm-util': 0.10.3
+    optional: true
+
+  '@napi-rs/wasm-runtime@1.1.6(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)':
+    dependencies:
+      '@emnapi/core': 1.11.1
+      '@emnapi/runtime': 1.11.1
+      '@tybys/wasm-util': 0.10.3
+    optional: true
+
   '@next/env@16.2.9': {}
 
   '@next/swc-darwin-arm64@16.2.9':
@@ -7471,47 +7724,77 @@ snapshots:
       '@nodelib/fs.scandir': 2.1.5
       fastq: 1.20.1
 
-  '@nx/devkit@22.7.5(nx@23.0.0(@swc-node/register@1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.41))':
+  '@nx/devkit@23.0.1(nx@23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.41))':
     dependencies:
       '@zkochan/js-yaml': 0.0.7
       ejs: 5.0.1
       enquirer: 2.3.6
       minimatch: 10.2.5
-      nx: 23.0.0(@swc-node/register@1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.41)
-      semver: 7.8.1
+      nx: 23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.41)
+      semver: 7.8.5
       tslib: 2.8.1
       yargs-parser: 21.1.1
 
   '@nx/nx-darwin-arm64@23.0.0':
     optional: true
 
+  '@nx/nx-darwin-arm64@23.0.1':
+    optional: true
+
   '@nx/nx-darwin-x64@23.0.0':
     optional: true
 
+  '@nx/nx-darwin-x64@23.0.1':
+    optional: true
+
   '@nx/nx-freebsd-x64@23.0.0':
     optional: true
 
+  '@nx/nx-freebsd-x64@23.0.1':
+    optional: true
+
   '@nx/nx-linux-arm-gnueabihf@23.0.0':
     optional: true
 
+  '@nx/nx-linux-arm-gnueabihf@23.0.1':
+    optional: true
+
   '@nx/nx-linux-arm64-gnu@23.0.0':
     optional: true
 
+  '@nx/nx-linux-arm64-gnu@23.0.1':
+    optional: true
+
   '@nx/nx-linux-arm64-musl@23.0.0':
     optional: true
 
+  '@nx/nx-linux-arm64-musl@23.0.1':
+    optional: true
+
   '@nx/nx-linux-x64-gnu@23.0.0':
     optional: true
 
+  '@nx/nx-linux-x64-gnu@23.0.1':
+    optional: true
+
   '@nx/nx-linux-x64-musl@23.0.0':
     optional: true
 
+  '@nx/nx-linux-x64-musl@23.0.1':
+    optional: true
+
   '@nx/nx-win32-arm64-msvc@23.0.0':
     optional: true
 
+  '@nx/nx-win32-arm64-msvc@23.0.1':
+    optional: true
+
   '@nx/nx-win32-x64-msvc@23.0.0':
     optional: true
 
+  '@nx/nx-win32-x64-msvc@23.0.1':
+    optional: true
+
   '@octokit/auth-token@6.0.0': {}
 
   '@octokit/core@7.0.6':
@@ -7574,122 +7857,170 @@ snapshots:
 
   '@orama/orama@3.1.18': {}
 
-  '@oxc-parser/binding-android-arm-eabi@0.133.0':
+  '@oxc-parser/binding-android-arm-eabi@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-android-arm64@0.133.0':
+  '@oxc-parser/binding-android-arm64@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-darwin-arm64@0.133.0':
+  '@oxc-parser/binding-darwin-arm64@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-darwin-x64@0.133.0':
+  '@oxc-parser/binding-darwin-x64@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-freebsd-x64@0.133.0':
+  '@oxc-parser/binding-freebsd-x64@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-linux-arm-gnueabihf@0.133.0':
+  '@oxc-parser/binding-linux-arm-gnueabihf@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-linux-arm-musleabihf@0.133.0':
+  '@oxc-parser/binding-linux-arm-musleabihf@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-linux-arm64-gnu@0.133.0':
+  '@oxc-parser/binding-linux-arm64-gnu@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-linux-arm64-musl@0.133.0':
+  '@oxc-parser/binding-linux-arm64-musl@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-linux-ppc64-gnu@0.133.0':
+  '@oxc-parser/binding-linux-ppc64-gnu@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-linux-riscv64-gnu@0.133.0':
+  '@oxc-parser/binding-linux-riscv64-gnu@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-linux-riscv64-musl@0.133.0':
+  '@oxc-parser/binding-linux-riscv64-musl@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-linux-s390x-gnu@0.133.0':
+  '@oxc-parser/binding-linux-s390x-gnu@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-linux-x64-gnu@0.133.0':
+  '@oxc-parser/binding-linux-x64-gnu@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-linux-x64-musl@0.133.0':
+  '@oxc-parser/binding-linux-x64-musl@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-openharmony-arm64@0.133.0':
+  '@oxc-parser/binding-openharmony-arm64@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-wasm32-wasi@0.133.0':
+  '@oxc-parser/binding-wasm32-wasi@0.137.0':
     dependencies:
-      '@emnapi/core': 1.10.0
-      '@emnapi/runtime': 1.10.0
-      '@napi-rs/wasm-runtime': 1.1.5(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
+      '@emnapi/core': 1.11.1
+      '@emnapi/runtime': 1.11.1
+      '@napi-rs/wasm-runtime': 1.1.6(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)
     optional: true
 
-  '@oxc-parser/binding-win32-arm64-msvc@0.133.0':
+  '@oxc-parser/binding-win32-arm64-msvc@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-win32-ia32-msvc@0.133.0':
+  '@oxc-parser/binding-win32-ia32-msvc@0.137.0':
     optional: true
 
-  '@oxc-parser/binding-win32-x64-msvc@0.133.0':
+  '@oxc-parser/binding-win32-x64-msvc@0.137.0':
     optional: true
 
   '@oxc-project/types@0.132.0': {}
 
-  '@oxc-project/types@0.133.0': {}
+  '@oxc-project/types@0.137.0': {}
 
   '@oxc-resolver/binding-android-arm-eabi@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-android-arm-eabi@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-android-arm64@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-android-arm64@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-darwin-arm64@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-darwin-arm64@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-darwin-x64@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-darwin-x64@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-freebsd-x64@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-freebsd-x64@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-linux-arm-gnueabihf@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-linux-arm-gnueabihf@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-linux-arm-musleabihf@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-linux-arm-musleabihf@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-linux-arm64-gnu@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-linux-arm64-gnu@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-linux-arm64-musl@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-linux-arm64-musl@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-linux-ppc64-gnu@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-linux-ppc64-gnu@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-linux-riscv64-gnu@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-linux-riscv64-gnu@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-linux-riscv64-musl@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-linux-riscv64-musl@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-linux-s390x-gnu@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-linux-s390x-gnu@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-linux-x64-gnu@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-linux-x64-gnu@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-linux-x64-musl@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-linux-x64-musl@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-openharmony-arm64@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-openharmony-arm64@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-wasm32-wasi@11.20.0':
     dependencies:
       '@emnapi/core': 1.10.0
@@ -7697,67 +8028,80 @@ snapshots:
       '@napi-rs/wasm-runtime': 1.1.5(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
     optional: true
 
+  '@oxc-resolver/binding-wasm32-wasi@11.21.3':
+    dependencies:
+      '@emnapi/core': 1.11.0
+      '@emnapi/runtime': 1.11.0
+      '@napi-rs/wasm-runtime': 1.1.6(@emnapi/core@1.11.0)(@emnapi/runtime@1.11.0)
+    optional: true
+
   '@oxc-resolver/binding-win32-arm64-msvc@11.20.0':
     optional: true
 
+  '@oxc-resolver/binding-win32-arm64-msvc@11.21.3':
+    optional: true
+
   '@oxc-resolver/binding-win32-x64-msvc@11.20.0':
     optional: true
 
-  '@oxfmt/binding-android-arm-eabi@0.54.0':
+  '@oxc-resolver/binding-win32-x64-msvc@11.21.3':
     optional: true
 
-  '@oxfmt/binding-android-arm64@0.54.0':
+  '@oxfmt/binding-android-arm-eabi@0.55.0':
     optional: true
 
-  '@oxfmt/binding-darwin-arm64@0.54.0':
+  '@oxfmt/binding-android-arm64@0.55.0':
     optional: true
 
-  '@oxfmt/binding-darwin-x64@0.54.0':
+  '@oxfmt/binding-darwin-arm64@0.55.0':
     optional: true
 
-  '@oxfmt/binding-freebsd-x64@0.54.0':
+  '@oxfmt/binding-darwin-x64@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.54.0':
+  '@oxfmt/binding-freebsd-x64@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.54.0':
+  '@oxfmt/binding-linux-arm-gnueabihf@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-gnu@0.54.0':
+  '@oxfmt/binding-linux-arm-musleabihf@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-musl@0.54.0':
+  '@oxfmt/binding-linux-arm64-gnu@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.54.0':
+  '@oxfmt/binding-linux-arm64-musl@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.54.0':
+  '@oxfmt/binding-linux-ppc64-gnu@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-musl@0.54.0':
+  '@oxfmt/binding-linux-riscv64-gnu@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-s390x-gnu@0.54.0':
+  '@oxfmt/binding-linux-riscv64-musl@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-gnu@0.54.0':
+  '@oxfmt/binding-linux-s390x-gnu@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-musl@0.54.0':
+  '@oxfmt/binding-linux-x64-gnu@0.55.0':
     optional: true
 
-  '@oxfmt/binding-openharmony-arm64@0.54.0':
+  '@oxfmt/binding-linux-x64-musl@0.55.0':
     optional: true
 
-  '@oxfmt/binding-win32-arm64-msvc@0.54.0':
+  '@oxfmt/binding-openharmony-arm64@0.55.0':
     optional: true
 
-  '@oxfmt/binding-win32-ia32-msvc@0.54.0':
+  '@oxfmt/binding-win32-arm64-msvc@0.55.0':
     optional: true
 
-  '@oxfmt/binding-win32-x64-msvc@0.54.0':
+  '@oxfmt/binding-win32-ia32-msvc@0.55.0':
+    optional: true
+
+  '@oxfmt/binding-win32-x64-msvc@0.55.0':
     optional: true
 
   '@oxlint-tsgolint/darwin-arm64@0.23.0':
@@ -7778,61 +8122,61 @@ snapshots:
   '@oxlint-tsgolint/win32-x64@0.23.0':
     optional: true
 
-  '@oxlint/binding-android-arm-eabi@1.69.0':
+  '@oxlint/binding-android-arm-eabi@1.71.0':
     optional: true
 
-  '@oxlint/binding-android-arm64@1.69.0':
+  '@oxlint/binding-android-arm64@1.71.0':
     optional: true
 
-  '@oxlint/binding-darwin-arm64@1.69.0':
+  '@oxlint/binding-darwin-arm64@1.71.0':
     optional: true
 
-  '@oxlint/binding-darwin-x64@1.69.0':
+  '@oxlint/binding-darwin-x64@1.71.0':
     optional: true
 
-  '@oxlint/binding-freebsd-x64@1.69.0':
+  '@oxlint/binding-freebsd-x64@1.71.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.69.0':
+  '@oxlint/binding-linux-arm-gnueabihf@1.71.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-musleabihf@1.69.0':
+  '@oxlint/binding-linux-arm-musleabihf@1.71.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-gnu@1.69.0':
+  '@oxlint/binding-linux-arm64-gnu@1.71.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-musl@1.69.0':
+  '@oxlint/binding-linux-arm64-musl@1.71.0':
     optional: true
 
-  '@oxlint/binding-linux-ppc64-gnu@1.69.0':
+  '@oxlint/binding-linux-ppc64-gnu@1.71.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-gnu@1.69.0':
+  '@oxlint/binding-linux-riscv64-gnu@1.71.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-musl@1.69.0':
+  '@oxlint/binding-linux-riscv64-musl@1.71.0':
     optional: true
 
-  '@oxlint/binding-linux-s390x-gnu@1.69.0':
+  '@oxlint/binding-linux-s390x-gnu@1.71.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-gnu@1.69.0':
+  '@oxlint/binding-linux-x64-gnu@1.71.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-musl@1.69.0':
+  '@oxlint/binding-linux-x64-musl@1.71.0':
     optional: true
 
-  '@oxlint/binding-openharmony-arm64@1.69.0':
+  '@oxlint/binding-openharmony-arm64@1.71.0':
     optional: true
 
-  '@oxlint/binding-win32-arm64-msvc@1.69.0':
+  '@oxlint/binding-win32-arm64-msvc@1.71.0':
     optional: true
 
-  '@oxlint/binding-win32-ia32-msvc@1.69.0':
+  '@oxlint/binding-win32-ia32-msvc@1.71.0':
     optional: true
 
-  '@oxlint/binding-win32-x64-msvc@1.69.0':
+  '@oxlint/binding-win32-x64-msvc@1.71.0':
     optional: true
 
   '@parcel/watcher-android-arm64@2.5.6':
@@ -7909,11 +8253,11 @@ snapshots:
       '@pnpm/network.ca-file': 1.0.2
       config-chain: 1.1.13
 
-  '@posthog/core@1.35.3':
+  '@posthog/core@1.38.0':
     dependencies:
-      '@posthog/types': 1.390.2
+      '@posthog/types': 1.391.1
 
-  '@posthog/types@1.390.2': {}
+  '@posthog/types@1.391.1': {}
 
   '@radix-ui/number@1.1.2': {}
 
@@ -8303,7 +8647,7 @@ snapshots:
     dependencies:
       '@emnapi/core': 1.10.0
       '@emnapi/runtime': 1.10.0
-      '@napi-rs/wasm-runtime': 1.1.5(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
+      '@napi-rs/wasm-runtime': 1.1.6(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
     optional: true
 
   '@rolldown/binding-win32-arm64-msvc@1.0.2':
@@ -8389,40 +8733,40 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@shikijs/core@4.2.0':
+  '@shikijs/core@4.3.0':
     dependencies:
-      '@shikijs/primitive': 4.2.0
-      '@shikijs/types': 4.2.0
+      '@shikijs/primitive': 4.3.0
+      '@shikijs/types': 4.3.0
       '@shikijs/vscode-textmate': 10.0.2
       '@types/hast': 3.0.4
       hast-util-to-html: 9.0.5
 
-  '@shikijs/engine-javascript@4.2.0':
+  '@shikijs/engine-javascript@4.3.0':
     dependencies:
-      '@shikijs/types': 4.2.0
+      '@shikijs/types': 4.3.0
       '@shikijs/vscode-textmate': 10.0.2
       oniguruma-to-es: 4.3.6
 
-  '@shikijs/engine-oniguruma@4.2.0':
+  '@shikijs/engine-oniguruma@4.3.0':
     dependencies:
-      '@shikijs/types': 4.2.0
+      '@shikijs/types': 4.3.0
       '@shikijs/vscode-textmate': 10.0.2
 
-  '@shikijs/langs@4.2.0':
+  '@shikijs/langs@4.3.0':
     dependencies:
-      '@shikijs/types': 4.2.0
+      '@shikijs/types': 4.3.0
 
-  '@shikijs/primitive@4.2.0':
+  '@shikijs/primitive@4.3.0':
     dependencies:
-      '@shikijs/types': 4.2.0
+      '@shikijs/types': 4.3.0
       '@shikijs/vscode-textmate': 10.0.2
       '@types/hast': 3.0.4
 
-  '@shikijs/themes@4.2.0':
+  '@shikijs/themes@4.3.0':
     dependencies:
-      '@shikijs/types': 4.2.0
+      '@shikijs/types': 4.3.0
 
-  '@shikijs/types@4.2.0':
+  '@shikijs/types@4.3.0':
     dependencies:
       '@shikijs/vscode-textmate': 10.0.2
       '@types/hast': 3.0.4
@@ -8439,37 +8783,37 @@ snapshots:
 
   '@standard-schema/spec@1.1.0': {}
 
-  '@supabase/auth-js@2.108.1':
+  '@supabase/auth-js@2.108.2':
     dependencies:
       tslib: 2.8.1
 
-  '@supabase/functions-js@2.108.1':
+  '@supabase/functions-js@2.108.2':
     dependencies:
       tslib: 2.8.1
 
-  '@supabase/phoenix@0.4.3': {}
+  '@supabase/phoenix@0.4.4': {}
 
-  '@supabase/postgrest-js@2.108.1':
+  '@supabase/postgrest-js@2.108.2':
     dependencies:
       tslib: 2.8.1
 
-  '@supabase/realtime-js@2.108.1':
+  '@supabase/realtime-js@2.108.2':
     dependencies:
-      '@supabase/phoenix': 0.4.3
+      '@supabase/phoenix': 0.4.4
       tslib: 2.8.1
 
-  '@supabase/storage-js@2.108.1':
+  '@supabase/storage-js@2.108.2':
     dependencies:
       iceberg-js: 0.8.1
       tslib: 2.8.1
 
-  '@supabase/supabase-js@2.108.1':
+  '@supabase/supabase-js@2.108.2':
     dependencies:
-      '@supabase/auth-js': 2.108.1
-      '@supabase/functions-js': 2.108.1
-      '@supabase/postgrest-js': 2.108.1
-      '@supabase/realtime-js': 2.108.1
-      '@supabase/storage-js': 2.108.1
+      '@supabase/auth-js': 2.108.2
+      '@supabase/functions-js': 2.108.2
+      '@supabase/postgrest-js': 2.108.2
+      '@supabase/realtime-js': 2.108.2
+      '@supabase/storage-js': 2.108.2
 
   '@swc-node/core@1.14.1(@swc/core@1.15.41)(@swc/types@0.1.27)':
     dependencies:
@@ -8612,6 +8956,10 @@ snapshots:
     dependencies:
       undici-types: 7.24.6
 
+  '@types/node@26.0.1':
+    dependencies:
+      undici-types: 8.3.0
+
   '@types/normalize-package-data@2.4.4': {}
 
   '@types/pg-copy-streams@1.2.5':
@@ -8635,7 +8983,7 @@ snapshots:
 
   '@types/responselike@1.0.0':
     dependencies:
-      '@types/node': 25.9.3
+      '@types/node': 26.0.1
 
   '@types/unist@2.0.11': {}
 
@@ -8643,65 +8991,65 @@ snapshots:
 
   '@types/ws@8.18.1':
     dependencies:
-      '@types/node': 25.9.3
+      '@types/node': 26.0.1
 
-  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260614.1':
+  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260621.1':
     optional: true
 
-  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260614.1':
+  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260621.1':
     optional: true
 
-  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260614.1':
+  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260621.1':
     optional: true
 
-  '@typescript/native-preview-linux-arm@7.0.0-dev.20260614.1':
+  '@typescript/native-preview-linux-arm@7.0.0-dev.20260621.1':
     optional: true
 
-  '@typescript/native-preview-linux-x64@7.0.0-dev.20260614.1':
+  '@typescript/native-preview-linux-x64@7.0.0-dev.20260621.1':
     optional: true
 
-  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260614.1':
+  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260621.1':
     optional: true
 
-  '@typescript/native-preview-win32-x64@7.0.0-dev.20260614.1':
+  '@typescript/native-preview-win32-x64@7.0.0-dev.20260621.1':
     optional: true
 
-  '@typescript/native-preview@7.0.0-dev.20260614.1':
+  '@typescript/native-preview@7.0.0-dev.20260621.1':
     optionalDependencies:
-      '@typescript/native-preview-darwin-arm64': 7.0.0-dev.20260614.1
-      '@typescript/native-preview-darwin-x64': 7.0.0-dev.20260614.1
-      '@typescript/native-preview-linux-arm': 7.0.0-dev.20260614.1
-      '@typescript/native-preview-linux-arm64': 7.0.0-dev.20260614.1
-      '@typescript/native-preview-linux-x64': 7.0.0-dev.20260614.1
-      '@typescript/native-preview-win32-arm64': 7.0.0-dev.20260614.1
-      '@typescript/native-preview-win32-x64': 7.0.0-dev.20260614.1
+      '@typescript/native-preview-darwin-arm64': 7.0.0-dev.20260621.1
+      '@typescript/native-preview-darwin-x64': 7.0.0-dev.20260621.1
+      '@typescript/native-preview-linux-arm': 7.0.0-dev.20260621.1
+      '@typescript/native-preview-linux-arm64': 7.0.0-dev.20260621.1
+      '@typescript/native-preview-linux-x64': 7.0.0-dev.20260621.1
+      '@typescript/native-preview-win32-arm64': 7.0.0-dev.20260621.1
+      '@typescript/native-preview-win32-x64': 7.0.0-dev.20260621.1
 
-  '@ungap/structured-clone@1.3.1': {}
+  '@ungap/structured-clone@1.3.2': {}
 
   '@vercel/detect-agent@1.2.3': {}
 
-  '@verdaccio/auth@8.0.2':
+  '@verdaccio/auth@8.0.4':
     dependencies:
-      '@verdaccio/config': 8.1.1
-      '@verdaccio/core': 8.1.1
-      '@verdaccio/loaders': 8.0.2
-      '@verdaccio/signature': 8.0.2
+      '@verdaccio/config': 8.1.2
+      '@verdaccio/core': 8.1.2
+      '@verdaccio/loaders': 8.0.3
+      '@verdaccio/signature': 8.0.3
       debug: 4.4.3
       lodash: 4.18.1
-      verdaccio-htpasswd: 13.0.2
+      verdaccio-htpasswd: 13.0.3
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/config@8.1.1':
+  '@verdaccio/config@8.1.2':
     dependencies:
-      '@verdaccio/core': 8.1.1
+      '@verdaccio/core': 8.1.2
       debug: 4.4.3
       js-yaml: 4.1.1
       lodash: 4.18.1
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/core@8.1.1':
+  '@verdaccio/core@8.1.2':
     dependencies:
       ajv: 8.18.0
       http-errors: 2.0.1
@@ -8714,27 +9062,27 @@ snapshots:
     dependencies:
       lockfile: 1.0.4
 
-  '@verdaccio/hooks@8.0.2':
+  '@verdaccio/hooks@8.0.3':
     dependencies:
-      '@verdaccio/core': 8.1.1
-      '@verdaccio/logger': 8.0.2
+      '@verdaccio/core': 8.1.2
+      '@verdaccio/logger': 8.0.3
       debug: 4.4.3
       got-cjs: 12.5.4
       handlebars: 4.7.9
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/loaders@8.0.2':
+  '@verdaccio/loaders@8.0.3':
     dependencies:
-      '@verdaccio/core': 8.1.1
+      '@verdaccio/core': 8.1.2
       debug: 4.4.3
       lodash: 4.18.1
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/local-storage-legacy@11.3.3':
+  '@verdaccio/local-storage-legacy@11.3.4':
     dependencies:
-      '@verdaccio/core': 8.1.1
+      '@verdaccio/core': 8.1.2
       '@verdaccio/file-locking': 13.0.1
       '@verdaccio/streams': 10.2.5
       debug: 4.4.3
@@ -8746,9 +9094,9 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/logger-commons@8.0.2':
+  '@verdaccio/logger-commons@8.0.3':
     dependencies:
-      '@verdaccio/core': 8.1.1
+      '@verdaccio/core': 8.1.2
       '@verdaccio/logger-prettify': 8.0.1
       colorette: 2.0.20
       debug: 4.4.3
@@ -8764,18 +9112,18 @@ snapshots:
       pino-abstract-transport: 1.2.0
       sonic-boom: 3.8.1
 
-  '@verdaccio/logger@8.0.2':
+  '@verdaccio/logger@8.0.3':
     dependencies:
-      '@verdaccio/logger-commons': 8.0.2
+      '@verdaccio/logger-commons': 8.0.3
       pino: 9.14.0
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/middleware@8.0.2':
+  '@verdaccio/middleware@8.0.5':
     dependencies:
-      '@verdaccio/config': 8.1.1
-      '@verdaccio/core': 8.1.1
-      '@verdaccio/url': 13.0.2
+      '@verdaccio/config': 8.1.2
+      '@verdaccio/core': 8.1.2
+      '@verdaccio/url': 13.0.3
       debug: 4.4.3
       express: 4.22.1
       express-rate-limit: 5.5.1
@@ -8784,9 +9132,9 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/package-filter@13.0.2':
+  '@verdaccio/package-filter@13.0.3':
     dependencies:
-      '@verdaccio/core': 8.1.1
+      '@verdaccio/core': 8.1.2
       debug: 4.4.3
       semver: 7.7.4
     transitivePeerDependencies:
@@ -8799,10 +9147,10 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/signature@8.0.2':
+  '@verdaccio/signature@8.0.3':
     dependencies:
-      '@verdaccio/config': 8.1.1
-      '@verdaccio/core': 8.1.1
+      '@verdaccio/config': 8.1.2
+      '@verdaccio/core': 8.1.2
       debug: 4.4.3
       jsonwebtoken: 9.0.3
     transitivePeerDependencies:
@@ -8810,10 +9158,10 @@ snapshots:
 
   '@verdaccio/streams@10.2.5': {}
 
-  '@verdaccio/tarball@13.0.2':
+  '@verdaccio/tarball@13.0.3':
     dependencies:
-      '@verdaccio/core': 8.1.1
-      '@verdaccio/url': 13.0.2
+      '@verdaccio/core': 8.1.2
+      '@verdaccio/url': 13.0.3
       debug: 4.4.3
       gunzip-maybe: 1.4.2
       tar-stream: 3.1.7
@@ -8822,27 +9170,27 @@ snapshots:
       - react-native-b4a
       - supports-color
 
-  '@verdaccio/ui-theme@9.0.0-next-9.14':
+  '@verdaccio/ui-theme@9.0.0-next-9.20':
     dependencies:
       debug: 4.4.3
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/url@13.0.2':
+  '@verdaccio/url@13.0.3':
     dependencies:
-      '@verdaccio/core': 8.1.1
+      '@verdaccio/core': 8.1.2
       debug: 4.4.3
       validator: 13.15.26
     transitivePeerDependencies:
       - supports-color
 
-  '@verdaccio/utils@8.1.2':
+  '@verdaccio/utils@8.1.3':
     dependencies:
-      '@verdaccio/core': 8.1.1
+      '@verdaccio/core': 8.1.2
       lodash: 4.18.1
       minimatch: 7.4.9
 
-  '@vitest/coverage-istanbul@4.1.8(vitest@4.1.8)':
+  '@vitest/coverage-istanbul@4.1.9(vitest@4.1.9)':
     dependencies:
       '@babel/core': 7.29.7
       '@istanbuljs/schema': 0.1.6
@@ -8854,48 +9202,48 @@ snapshots:
       magicast: 0.5.3
       obug: 2.1.1
       tinyrainbow: 3.1.0
-      vitest: 4.1.8(@types/node@25.9.3)(@vitest/coverage-istanbul@4.1.8)(vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+      vitest: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/expect@4.1.8':
+  '@vitest/expect@4.1.9':
     dependencies:
       '@standard-schema/spec': 1.1.0
       '@types/chai': 5.2.3
-      '@vitest/spy': 4.1.8
-      '@vitest/utils': 4.1.8
+      '@vitest/spy': 4.1.9
+      '@vitest/utils': 4.1.9
       chai: 6.2.2
       tinyrainbow: 3.1.0
 
-  '@vitest/mocker@4.1.8(vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))':
+  '@vitest/mocker@4.1.9(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))':
     dependencies:
-      '@vitest/spy': 4.1.8
+      '@vitest/spy': 4.1.9
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)
+      vite: 8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)
 
-  '@vitest/pretty-format@4.1.8':
+  '@vitest/pretty-format@4.1.9':
     dependencies:
       tinyrainbow: 3.1.0
 
-  '@vitest/runner@4.1.8':
+  '@vitest/runner@4.1.9':
     dependencies:
-      '@vitest/utils': 4.1.8
+      '@vitest/utils': 4.1.9
       pathe: 2.0.3
 
-  '@vitest/snapshot@4.1.8':
+  '@vitest/snapshot@4.1.9':
     dependencies:
-      '@vitest/pretty-format': 4.1.8
-      '@vitest/utils': 4.1.8
+      '@vitest/pretty-format': 4.1.9
+      '@vitest/utils': 4.1.9
       magic-string: 0.30.21
       pathe: 2.0.3
 
-  '@vitest/spy@4.1.8': {}
+  '@vitest/spy@4.1.9': {}
 
-  '@vitest/utils@4.1.8':
+  '@vitest/utils@4.1.9':
     dependencies:
-      '@vitest/pretty-format': 4.1.8
+      '@vitest/pretty-format': 4.1.9
       convert-source-map: 2.0.0
       tinyrainbow: 3.1.0
 
@@ -9030,7 +9378,7 @@ snapshots:
 
   balanced-match@4.0.3: {}
 
-  bare-events@2.8.3: {}
+  bare-events@2.9.1: {}
 
   base64-js@1.5.1: {}
 
@@ -9060,7 +9408,7 @@ snapshots:
       http-errors: 2.0.1
       iconv-lite: 0.4.24
       on-finished: 2.4.1
-      qs: 6.15.2
+      qs: 6.15.3
       raw-body: 2.5.3
       type-is: 1.6.18
       unpipe: 1.0.0
@@ -9123,7 +9471,7 @@ snapshots:
 
   bun-types@1.3.14:
     dependencies:
-      '@types/node': 25.9.3
+      '@types/node': 26.0.1
 
   bytes@3.1.2: {}
 
@@ -9223,7 +9571,7 @@ snapshots:
     optionalDependencies:
       '@colors/colors': 1.5.0
 
-  cli-truncate@6.0.0:
+  cli-truncate@6.1.0:
     dependencies:
       slice-ansi: 9.0.0
       string-width: 8.2.1
@@ -9336,7 +9684,7 @@ snapshots:
       conventional-commits-filter: 5.0.0
       handlebars: 4.7.9
       meow: 13.2.0
-      semver: 7.8.4
+      semver: 7.8.5
 
   conventional-commits-filter@5.0.0: {}
 
@@ -9370,7 +9718,7 @@ snapshots:
     dependencies:
       env-paths: 2.2.1
       import-fresh: 3.3.1
-      js-yaml: 4.2.0
+      js-yaml: 4.3.0
       parse-json: 5.2.0
     optionalDependencies:
       typescript: 6.0.3
@@ -9483,7 +9831,7 @@ snapshots:
 
   ee-first@1.1.1: {}
 
-  effect@4.0.0-beta.83:
+  effect@4.0.0-beta.85:
     dependencies:
       '@standard-schema/spec': 1.1.0
       fast-check: 4.8.0
@@ -9550,7 +9898,7 @@ snapshots:
       has-tostringtag: 1.0.2
       hasown: 2.0.4
 
-  es-toolkit@1.48.1: {}
+  es-toolkit@1.49.0: {}
 
   esast-util-from-estree@2.0.0:
     dependencies:
@@ -9648,7 +9996,7 @@ snapshots:
 
   events-universal@1.0.1:
     dependencies:
-      bare-events: 2.8.3
+      bare-events: 2.9.1
     transitivePeerDependencies:
       - bare-abort-controller
 
@@ -9732,6 +10080,42 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  express@4.22.2:
+    dependencies:
+      accepts: 1.3.8
+      array-flatten: 1.1.1
+      body-parser: 1.20.5
+      content-disposition: 0.5.4
+      content-type: 1.0.5
+      cookie: 0.7.2
+      cookie-signature: 1.0.7
+      debug: 2.6.9
+      depd: 2.0.0
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      etag: 1.8.1
+      finalhandler: 1.3.2
+      fresh: 0.5.2
+      http-errors: 2.0.1
+      merge-descriptors: 1.0.3
+      methods: 1.1.2
+      on-finished: 2.4.1
+      parseurl: 1.3.3
+      path-to-regexp: 0.1.13
+      proxy-addr: 2.0.7
+      qs: 6.15.3
+      range-parser: 1.2.1
+      safe-buffer: 5.2.1
+      send: 0.19.2
+      serve-static: 1.16.3
+      setprototypeof: 1.2.0
+      statuses: 2.0.2
+      type-is: 1.6.18
+      utils-merge: 1.0.1
+      vary: 1.1.2
+    transitivePeerDependencies:
+      - supports-color
+
   express@5.2.1:
     dependencies:
       accepts: 2.0.0
@@ -9893,9 +10277,9 @@ snapshots:
 
   forwarded@0.2.0: {}
 
-  framer-motion@12.40.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  framer-motion@12.42.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
-      motion-dom: 12.40.0
+      motion-dom: 12.42.0
       motion-utils: 12.39.0
       tslib: 2.8.1
     optionalDependencies:
@@ -9917,22 +10301,21 @@ snapshots:
   fsevents@2.3.3:
     optional: true
 
-  fumadocs-core@16.10.2(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.21.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3):
+  fumadocs-core@16.10.5(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.22.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3):
     dependencies:
-      '@fuma-translate/react': 1.0.2(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@orama/orama': 3.1.18
       estree-util-value-to-estree: 3.5.0
       github-slugger: 2.0.0
       hast-util-to-estree: 3.1.3
       hast-util-to-jsx-runtime: 2.3.6
-      js-yaml: 4.2.0
+      js-yaml: 4.3.0
       mdast-util-mdx: 3.0.0
       mdast-util-to-markdown: 2.1.2
       remark: 15.0.1
       remark-gfm: 4.0.1
       remark-rehype: 11.1.2
       scroll-into-view-if-needed: 3.1.0
-      shiki: 4.2.0
+      shiki: 4.3.0
       tinyglobby: 0.2.17
       unified: 11.0.5
       unist-util-visit: 5.1.0
@@ -9943,7 +10326,7 @@ snapshots:
       '@types/hast': 3.0.4
       '@types/mdast': 4.0.4
       '@types/react': 19.2.17
-      lucide-react: 1.21.0(react@19.2.7)
+      lucide-react: 1.22.0(react@19.2.7)
       next: 16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       react: 19.2.7
       react-dom: 19.2.7(react@19.2.7)
@@ -9951,14 +10334,14 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  fumadocs-mdx@15.0.12(@types/mdast@4.0.4)(@types/mdx@2.0.14)(@types/react@19.2.17)(fumadocs-core@16.10.2(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.21.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(rolldown@1.0.2)(vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)):
+  fumadocs-mdx@15.0.12(@types/mdast@4.0.4)(@types/mdx@2.0.14)(@types/react@19.2.17)(fumadocs-core@16.10.5(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.22.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(rolldown@1.0.2)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)):
     dependencies:
       '@mdx-js/mdx': 3.1.1
       '@standard-schema/spec': 1.1.0
       chokidar: 5.0.0
       esbuild: 0.28.1
       estree-util-value-to-estree: 3.5.0
-      fumadocs-core: 16.10.2(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.21.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3)
+      fumadocs-core: 16.10.5(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.22.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3)
       js-yaml: 4.2.0
       mdast-util-mdx: 3.0.0
       picocolors: 1.1.1
@@ -9977,11 +10360,11 @@ snapshots:
       next: 16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       react: 19.2.7
       rolldown: 1.0.2
-      vite: 8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)
+      vite: 8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)
     transitivePeerDependencies:
       - supports-color
 
-  fumadocs-ui@16.10.2(@types/mdx@2.0.14)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(fumadocs-core@16.10.2(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.21.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  fumadocs-ui@16.10.5(@types/mdx@2.0.14)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(fumadocs-core@16.10.5(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.22.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
       '@fuma-translate/react': 1.0.2(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@fumadocs/tailwind': 0.0.5
@@ -9996,16 +10379,16 @@ snapshots:
       '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
       '@radix-ui/react-tabs': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       class-variance-authority: 0.7.1
-      fumadocs-core: 16.10.2(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.21.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3)
-      lucide-react: 1.21.0(react@19.2.7)
-      motion: 12.40.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      fumadocs-core: 16.10.5(@mdx-js/mdx@3.1.1)(@types/estree-jsx@1.0.5)(@types/hast@3.0.4)(@types/mdast@4.0.4)(@types/react@19.2.17)(lucide-react@1.22.0(react@19.2.7))(next@16.2.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.4.3)
+      lucide-react: 1.22.0(react@19.2.7)
+      motion: 12.42.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       next-themes: 0.4.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       react: 19.2.7
       react-dom: 19.2.7(react@19.2.7)
       react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
       rehype-raw: 7.0.0
       scroll-into-view-if-needed: 3.1.0
-      shiki: 4.2.0
+      shiki: 4.3.0
       tailwind-merge: 3.6.0
       unist-util-visit: 5.1.0
     optionalDependencies:
@@ -10171,7 +10554,7 @@ snapshots:
     dependencies:
       '@types/hast': 3.0.4
       '@types/unist': 3.0.3
-      '@ungap/structured-clone': 1.3.1
+      '@ungap/structured-clone': 1.3.2
       hast-util-from-parse5: 8.0.3
       hast-util-to-parse5: 8.0.1
       html-void-elements: 3.0.0
@@ -10370,13 +10753,13 @@ snapshots:
 
   ini@7.0.0: {}
 
-  ink-spinner@5.0.0(ink@7.0.6(@types/react@19.2.17)(react-devtools-core@7.0.1)(react@19.2.7))(react@19.2.7):
+  ink-spinner@5.0.0(ink@7.1.0(@types/react@19.2.17)(react-devtools-core@7.0.1)(react@19.2.7))(react@19.2.7):
     dependencies:
       cli-spinners: 2.9.2
-      ink: 7.0.6(@types/react@19.2.17)(react-devtools-core@7.0.1)(react@19.2.7)
+      ink: 7.1.0(@types/react@19.2.17)(react-devtools-core@7.0.1)(react@19.2.7)
       react: 19.2.7
 
-  ink@7.0.6(@types/react@19.2.17)(react-devtools-core@7.0.1)(react@19.2.7):
+  ink@7.1.0(@types/react@19.2.17)(react-devtools-core@7.0.1)(react@19.2.7):
     dependencies:
       '@alcalzone/ansi-tokenize': 0.3.0
       ansi-escapes: 7.3.0
@@ -10385,9 +10768,9 @@ snapshots:
       chalk: 5.6.2
       cli-boxes: 4.0.1
       cli-cursor: 4.0.0
-      cli-truncate: 6.0.0
+      cli-truncate: 6.1.0
       code-excerpt: 4.0.0
-      es-toolkit: 1.48.1
+      es-toolkit: 1.49.0
       indent-string: 5.0.0
       is-in-ci: 2.0.0
       patch-console: 2.0.0
@@ -10531,6 +10914,10 @@ snapshots:
     dependencies:
       argparse: 2.0.1
 
+  js-yaml@4.3.0:
+    dependencies:
+      argparse: 2.0.1
+
   jsbn@0.1.1: {}
 
   jsesc@3.1.0: {}
@@ -10579,7 +10966,7 @@ snapshots:
       lodash.isstring: 4.0.1
       lodash.once: 4.1.1
       ms: 2.1.3
-      semver: 7.8.0
+      semver: 7.8.2
 
   jsprim@2.0.2:
     dependencies:
@@ -10603,19 +10990,19 @@ snapshots:
     dependencies:
       json-buffer: 3.0.1
 
-  knip@6.16.1:
+  knip@6.23.0:
     dependencies:
       fdir: 6.5.0(picomatch@4.0.4)
       formatly: 0.3.0
       get-tsconfig: 4.14.0
       jiti: 2.7.0
-      oxc-parser: 0.133.0
-      oxc-resolver: 11.20.0
+      oxc-parser: 0.137.0
+      oxc-resolver: 11.21.3
       picomatch: 4.0.4
-      smol-toml: 1.6.1
+      smol-toml: 1.7.0
       strip-json-comments: 5.0.3
       tinyglobby: 0.2.17
-      unbash: 3.0.0
+      unbash: 4.0.2
       yaml: 2.9.0
       zod: 4.4.3
 
@@ -10741,7 +11128,7 @@ snapshots:
 
   lru-cache@7.18.3: {}
 
-  lucide-react@1.21.0(react@19.2.7):
+  lucide-react@1.22.0(react@19.2.7):
     dependencies:
       react: 19.2.7
 
@@ -10923,7 +11310,7 @@ snapshots:
     dependencies:
       '@types/hast': 3.0.4
       '@types/mdast': 4.0.4
-      '@ungap/structured-clone': 1.3.1
+      '@ungap/structured-clone': 1.3.2
       devlop: 1.1.0
       micromark-util-sanitize-uri: 2.0.1
       trim-lines: 3.0.1
@@ -11270,15 +11657,15 @@ snapshots:
 
   mkdirp@1.0.4: {}
 
-  motion-dom@12.40.0:
+  motion-dom@12.42.0:
     dependencies:
       motion-utils: 12.39.0
 
   motion-utils@12.39.0: {}
 
-  motion@12.40.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  motion@12.42.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
-      framer-motion: 12.40.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      framer-motion: 12.42.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       tslib: 2.8.1
     optionalDependencies:
       react: 19.2.7
@@ -11535,6 +11922,135 @@ snapshots:
     transitivePeerDependencies:
       - debug
 
+  nx@23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.41):
+    dependencies:
+      '@emnapi/core': 1.4.5
+      '@emnapi/runtime': 1.4.5
+      '@emnapi/wasi-threads': 1.0.4
+      '@jest/diff-sequences': 30.0.1
+      '@napi-rs/wasm-runtime': 0.2.4
+      '@tybys/wasm-util': 0.9.0
+      '@yarnpkg/lockfile': 1.1.0
+      '@zkochan/js-yaml': 0.0.7
+      ansi-colors: 4.1.3
+      ansi-regex: 5.0.1
+      ansi-styles: 4.3.0
+      argparse: 2.0.1
+      asynckit: 0.4.0
+      axios: 1.16.0
+      balanced-match: 4.0.3
+      base64-js: 1.5.1
+      bl: 4.1.0
+      brace-expansion: 5.0.6
+      buffer: 5.7.1
+      call-bind-apply-helpers: 1.0.2
+      chalk: 4.1.2
+      cli-cursor: 3.1.0
+      cli-spinners: 2.6.1
+      cliui: 8.0.1
+      clone: 1.0.4
+      color-convert: 2.0.1
+      color-name: 1.1.4
+      combined-stream: 1.0.8
+      defaults: 1.0.4
+      define-lazy-prop: 2.0.0
+      delayed-stream: 1.0.0
+      dotenv: 16.4.7
+      dotenv-expand: 12.0.3
+      dunder-proto: 1.0.1
+      ejs: 5.0.1
+      emoji-regex: 8.0.0
+      end-of-stream: 1.4.5
+      enquirer: 2.3.6
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.1
+      es-set-tostringtag: 2.1.0
+      escalade: 3.2.0
+      escape-string-regexp: 1.0.5
+      figures: 3.2.0
+      flat: 5.0.2
+      follow-redirects: 1.16.0
+      form-data: 4.0.6
+      fs-constants: 1.0.0
+      function-bind: 1.1.2
+      get-caller-file: 2.0.5
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-flag: 4.0.0
+      has-symbols: 1.1.0
+      has-tostringtag: 1.0.2
+      hasown: 2.0.4
+      ieee754: 1.2.1
+      ignore: 7.0.5
+      inherits: 2.0.4
+      is-docker: 2.2.1
+      is-fullwidth-code-point: 3.0.0
+      is-interactive: 1.0.0
+      is-unicode-supported: 0.1.0
+      is-wsl: 2.2.0
+      isexe: 2.0.0
+      json5: 2.2.3
+      jsonc-parser: 3.3.1
+      lines-and-columns: 2.0.3
+      log-symbols: 4.1.0
+      math-intrinsics: 1.1.0
+      mime-db: 1.52.0
+      mime-types: 2.1.35
+      mimic-fn: 2.1.0
+      minimatch: 10.2.5
+      minimist: 1.2.8
+      npm-run-path: 4.0.1
+      once: 1.4.0
+      onetime: 5.1.2
+      open: 8.4.2
+      ora: 5.4.1
+      path-key: 3.1.1
+      picocolors: 1.1.1
+      proxy-from-env: 2.1.0
+      readable-stream: 3.6.2
+      require-directory: 2.1.1
+      resolve.exports: 2.0.3
+      restore-cursor: 3.1.0
+      safe-buffer: 5.2.1
+      semver: 7.7.4
+      signal-exit: 3.0.7
+      smol-toml: 1.6.1
+      string-width: 4.2.3
+      string_decoder: 1.3.0
+      strip-ansi: 6.0.1
+      strip-bom: 3.0.0
+      supports-color: 7.2.0
+      tar-stream: 2.2.0
+      tmp: 0.2.7
+      tsconfig-paths: 4.2.0
+      tslib: 2.8.1
+      util-deprecate: 1.0.2
+      wcwidth: 1.0.1
+      which: 3.0.1
+      wrap-ansi: 7.0.0
+      wrappy: 1.0.2
+      y18n: 5.0.8
+      yaml: 2.9.0
+      yargs: 17.7.2
+      yargs-parser: 21.1.1
+    optionalDependencies:
+      '@nx/nx-darwin-arm64': 23.0.1
+      '@nx/nx-darwin-x64': 23.0.1
+      '@nx/nx-freebsd-x64': 23.0.1
+      '@nx/nx-linux-arm-gnueabihf': 23.0.1
+      '@nx/nx-linux-arm64-gnu': 23.0.1
+      '@nx/nx-linux-arm64-musl': 23.0.1
+      '@nx/nx-linux-x64-gnu': 23.0.1
+      '@nx/nx-linux-x64-musl': 23.0.1
+      '@nx/nx-win32-arm64-msvc': 23.0.1
+      '@nx/nx-win32-x64-msvc': 23.0.1
+      '@swc-node/register': 1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3)
+      '@swc/core': 1.15.41
+    transitivePeerDependencies:
+      - debug
+
   object-assign@4.1.1: {}
 
   object-inspect@1.13.4: {}
@@ -11589,30 +12105,30 @@ snapshots:
       strip-ansi: 6.0.1
       wcwidth: 1.0.1
 
-  oxc-parser@0.133.0:
+  oxc-parser@0.137.0:
     dependencies:
-      '@oxc-project/types': 0.133.0
+      '@oxc-project/types': 0.137.0
     optionalDependencies:
-      '@oxc-parser/binding-android-arm-eabi': 0.133.0
-      '@oxc-parser/binding-android-arm64': 0.133.0
-      '@oxc-parser/binding-darwin-arm64': 0.133.0
-      '@oxc-parser/binding-darwin-x64': 0.133.0
-      '@oxc-parser/binding-freebsd-x64': 0.133.0
-      '@oxc-parser/binding-linux-arm-gnueabihf': 0.133.0
-      '@oxc-parser/binding-linux-arm-musleabihf': 0.133.0
-      '@oxc-parser/binding-linux-arm64-gnu': 0.133.0
-      '@oxc-parser/binding-linux-arm64-musl': 0.133.0
-      '@oxc-parser/binding-linux-ppc64-gnu': 0.133.0
-      '@oxc-parser/binding-linux-riscv64-gnu': 0.133.0
-      '@oxc-parser/binding-linux-riscv64-musl': 0.133.0
-      '@oxc-parser/binding-linux-s390x-gnu': 0.133.0
-      '@oxc-parser/binding-linux-x64-gnu': 0.133.0
-      '@oxc-parser/binding-linux-x64-musl': 0.133.0
-      '@oxc-parser/binding-openharmony-arm64': 0.133.0
-      '@oxc-parser/binding-wasm32-wasi': 0.133.0
-      '@oxc-parser/binding-win32-arm64-msvc': 0.133.0
-      '@oxc-parser/binding-win32-ia32-msvc': 0.133.0
-      '@oxc-parser/binding-win32-x64-msvc': 0.133.0
+      '@oxc-parser/binding-android-arm-eabi': 0.137.0
+      '@oxc-parser/binding-android-arm64': 0.137.0
+      '@oxc-parser/binding-darwin-arm64': 0.137.0
+      '@oxc-parser/binding-darwin-x64': 0.137.0
+      '@oxc-parser/binding-freebsd-x64': 0.137.0
+      '@oxc-parser/binding-linux-arm-gnueabihf': 0.137.0
+      '@oxc-parser/binding-linux-arm-musleabihf': 0.137.0
+      '@oxc-parser/binding-linux-arm64-gnu': 0.137.0
+      '@oxc-parser/binding-linux-arm64-musl': 0.137.0
+      '@oxc-parser/binding-linux-ppc64-gnu': 0.137.0
+      '@oxc-parser/binding-linux-riscv64-gnu': 0.137.0
+      '@oxc-parser/binding-linux-riscv64-musl': 0.137.0
+      '@oxc-parser/binding-linux-s390x-gnu': 0.137.0
+      '@oxc-parser/binding-linux-x64-gnu': 0.137.0
+      '@oxc-parser/binding-linux-x64-musl': 0.137.0
+      '@oxc-parser/binding-openharmony-arm64': 0.137.0
+      '@oxc-parser/binding-wasm32-wasi': 0.137.0
+      '@oxc-parser/binding-win32-arm64-msvc': 0.137.0
+      '@oxc-parser/binding-win32-ia32-msvc': 0.137.0
+      '@oxc-parser/binding-win32-x64-msvc': 0.137.0
 
   oxc-resolver@11.20.0:
     optionalDependencies:
@@ -11636,29 +12152,51 @@ snapshots:
       '@oxc-resolver/binding-win32-arm64-msvc': 11.20.0
       '@oxc-resolver/binding-win32-x64-msvc': 11.20.0
 
-  oxfmt@0.54.0:
+  oxc-resolver@11.21.3:
+    optionalDependencies:
+      '@oxc-resolver/binding-android-arm-eabi': 11.21.3
+      '@oxc-resolver/binding-android-arm64': 11.21.3
+      '@oxc-resolver/binding-darwin-arm64': 11.21.3
+      '@oxc-resolver/binding-darwin-x64': 11.21.3
+      '@oxc-resolver/binding-freebsd-x64': 11.21.3
+      '@oxc-resolver/binding-linux-arm-gnueabihf': 11.21.3
+      '@oxc-resolver/binding-linux-arm-musleabihf': 11.21.3
+      '@oxc-resolver/binding-linux-arm64-gnu': 11.21.3
+      '@oxc-resolver/binding-linux-arm64-musl': 11.21.3
+      '@oxc-resolver/binding-linux-ppc64-gnu': 11.21.3
+      '@oxc-resolver/binding-linux-riscv64-gnu': 11.21.3
+      '@oxc-resolver/binding-linux-riscv64-musl': 11.21.3
+      '@oxc-resolver/binding-linux-s390x-gnu': 11.21.3
+      '@oxc-resolver/binding-linux-x64-gnu': 11.21.3
+      '@oxc-resolver/binding-linux-x64-musl': 11.21.3
+      '@oxc-resolver/binding-openharmony-arm64': 11.21.3
+      '@oxc-resolver/binding-wasm32-wasi': 11.21.3
+      '@oxc-resolver/binding-win32-arm64-msvc': 11.21.3
+      '@oxc-resolver/binding-win32-x64-msvc': 11.21.3
+
+  oxfmt@0.55.0:
     dependencies:
       tinypool: 2.1.0
     optionalDependencies:
-      '@oxfmt/binding-android-arm-eabi': 0.54.0
-      '@oxfmt/binding-android-arm64': 0.54.0
-      '@oxfmt/binding-darwin-arm64': 0.54.0
-      '@oxfmt/binding-darwin-x64': 0.54.0
-      '@oxfmt/binding-freebsd-x64': 0.54.0
-      '@oxfmt/binding-linux-arm-gnueabihf': 0.54.0
-      '@oxfmt/binding-linux-arm-musleabihf': 0.54.0
-      '@oxfmt/binding-linux-arm64-gnu': 0.54.0
-      '@oxfmt/binding-linux-arm64-musl': 0.54.0
-      '@oxfmt/binding-linux-ppc64-gnu': 0.54.0
-      '@oxfmt/binding-linux-riscv64-gnu': 0.54.0
-      '@oxfmt/binding-linux-riscv64-musl': 0.54.0
-      '@oxfmt/binding-linux-s390x-gnu': 0.54.0
-      '@oxfmt/binding-linux-x64-gnu': 0.54.0
-      '@oxfmt/binding-linux-x64-musl': 0.54.0
-      '@oxfmt/binding-openharmony-arm64': 0.54.0
-      '@oxfmt/binding-win32-arm64-msvc': 0.54.0
-      '@oxfmt/binding-win32-ia32-msvc': 0.54.0
-      '@oxfmt/binding-win32-x64-msvc': 0.54.0
+      '@oxfmt/binding-android-arm-eabi': 0.55.0
+      '@oxfmt/binding-android-arm64': 0.55.0
+      '@oxfmt/binding-darwin-arm64': 0.55.0
+      '@oxfmt/binding-darwin-x64': 0.55.0
+      '@oxfmt/binding-freebsd-x64': 0.55.0
+      '@oxfmt/binding-linux-arm-gnueabihf': 0.55.0
+      '@oxfmt/binding-linux-arm-musleabihf': 0.55.0
+      '@oxfmt/binding-linux-arm64-gnu': 0.55.0
+      '@oxfmt/binding-linux-arm64-musl': 0.55.0
+      '@oxfmt/binding-linux-ppc64-gnu': 0.55.0
+      '@oxfmt/binding-linux-riscv64-gnu': 0.55.0
+      '@oxfmt/binding-linux-riscv64-musl': 0.55.0
+      '@oxfmt/binding-linux-s390x-gnu': 0.55.0
+      '@oxfmt/binding-linux-x64-gnu': 0.55.0
+      '@oxfmt/binding-linux-x64-musl': 0.55.0
+      '@oxfmt/binding-openharmony-arm64': 0.55.0
+      '@oxfmt/binding-win32-arm64-msvc': 0.55.0
+      '@oxfmt/binding-win32-ia32-msvc': 0.55.0
+      '@oxfmt/binding-win32-x64-msvc': 0.55.0
 
   oxlint-tsgolint@0.23.0:
     optionalDependencies:
@@ -11669,27 +12207,27 @@ snapshots:
       '@oxlint-tsgolint/win32-arm64': 0.23.0
       '@oxlint-tsgolint/win32-x64': 0.23.0
 
-  oxlint@1.69.0(oxlint-tsgolint@0.23.0):
+  oxlint@1.71.0(oxlint-tsgolint@0.23.0):
     optionalDependencies:
-      '@oxlint/binding-android-arm-eabi': 1.69.0
-      '@oxlint/binding-android-arm64': 1.69.0
-      '@oxlint/binding-darwin-arm64': 1.69.0
-      '@oxlint/binding-darwin-x64': 1.69.0
-      '@oxlint/binding-freebsd-x64': 1.69.0
-      '@oxlint/binding-linux-arm-gnueabihf': 1.69.0
-      '@oxlint/binding-linux-arm-musleabihf': 1.69.0
-      '@oxlint/binding-linux-arm64-gnu': 1.69.0
-      '@oxlint/binding-linux-arm64-musl': 1.69.0
-      '@oxlint/binding-linux-ppc64-gnu': 1.69.0
-      '@oxlint/binding-linux-riscv64-gnu': 1.69.0
-      '@oxlint/binding-linux-riscv64-musl': 1.69.0
-      '@oxlint/binding-linux-s390x-gnu': 1.69.0
-      '@oxlint/binding-linux-x64-gnu': 1.69.0
-      '@oxlint/binding-linux-x64-musl': 1.69.0
-      '@oxlint/binding-openharmony-arm64': 1.69.0
-      '@oxlint/binding-win32-arm64-msvc': 1.69.0
-      '@oxlint/binding-win32-ia32-msvc': 1.69.0
-      '@oxlint/binding-win32-x64-msvc': 1.69.0
+      '@oxlint/binding-android-arm-eabi': 1.71.0
+      '@oxlint/binding-android-arm64': 1.71.0
+      '@oxlint/binding-darwin-arm64': 1.71.0
+      '@oxlint/binding-darwin-x64': 1.71.0
+      '@oxlint/binding-freebsd-x64': 1.71.0
+      '@oxlint/binding-linux-arm-gnueabihf': 1.71.0
+      '@oxlint/binding-linux-arm-musleabihf': 1.71.0
+      '@oxlint/binding-linux-arm64-gnu': 1.71.0
+      '@oxlint/binding-linux-arm64-musl': 1.71.0
+      '@oxlint/binding-linux-ppc64-gnu': 1.71.0
+      '@oxlint/binding-linux-riscv64-gnu': 1.71.0
+      '@oxlint/binding-linux-riscv64-musl': 1.71.0
+      '@oxlint/binding-linux-s390x-gnu': 1.71.0
+      '@oxlint/binding-linux-x64-gnu': 1.71.0
+      '@oxlint/binding-linux-x64-musl': 1.71.0
+      '@oxlint/binding-openharmony-arm64': 1.71.0
+      '@oxlint/binding-win32-arm64-msvc': 1.71.0
+      '@oxlint/binding-win32-ia32-msvc': 1.71.0
+      '@oxlint/binding-win32-x64-msvc': 1.71.0
       oxlint-tsgolint: 0.23.0
 
   p-cancelable@2.1.1: {}
@@ -11799,24 +12337,26 @@ snapshots:
 
   pg-connection-string@2.12.0: {}
 
-  pg-connection-string@2.13.0: {}
+  pg-connection-string@2.14.0: {}
 
   pg-copy-streams@7.0.0: {}
 
-  pg-cursor@2.20.0(pg@8.21.0):
+  pg-cursor@2.20.0(pg@8.22.0):
     dependencies:
-      pg: 8.21.0
+      pg: 8.22.0
 
   pg-int8@1.0.1: {}
 
   pg-numeric@1.0.2: {}
 
-  pg-pool@3.14.0(pg@8.21.0):
+  pg-pool@3.14.0(pg@8.22.0):
     dependencies:
-      pg: 8.21.0
+      pg: 8.22.0
 
   pg-protocol@1.14.0: {}
 
+  pg-protocol@1.15.0: {}
+
   pg-types@2.2.0:
     dependencies:
       pg-int8: 1.0.1
@@ -11835,11 +12375,11 @@ snapshots:
       postgres-interval: 3.0.0
       postgres-range: 1.1.4
 
-  pg@8.21.0:
+  pg@8.22.0:
     dependencies:
-      pg-connection-string: 2.13.0
-      pg-pool: 3.14.0(pg@8.21.0)
-      pg-protocol: 1.14.0
+      pg-connection-string: 2.14.0
+      pg-pool: 3.14.0(pg@8.22.0)
+      pg-protocol: 1.15.0
       pg-types: 2.2.0
       pgpass: 1.0.5
     optionalDependencies:
@@ -11880,7 +12420,7 @@ snapshots:
       real-require: 0.2.0
       safe-stable-stringify: 2.5.0
       sonic-boom: 4.2.1
-      thread-stream: 3.1.0
+      thread-stream: 3.2.0
 
   pirates@4.0.7: {}
 
@@ -11899,7 +12439,7 @@ snapshots:
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
-  postcss@8.5.15:
+  postcss@8.5.16:
     dependencies:
       nanoid: 3.3.15
       picocolors: 1.1.1
@@ -11927,9 +12467,9 @@ snapshots:
 
   postgres-range@1.1.4: {}
 
-  posthog-node@5.37.0:
+  posthog-node@5.38.2:
     dependencies:
-      '@posthog/core': 1.35.3
+      '@posthog/core': 1.38.0
 
   pretty-ms@9.3.0:
     dependencies:
@@ -11976,11 +12516,12 @@ snapshots:
 
   qs@6.14.2:
     dependencies:
-      side-channel: 1.1.0
+      side-channel: 1.1.1
 
-  qs@6.15.2:
+  qs@6.15.3:
     dependencies:
-      side-channel: 1.1.0
+      es-define-property: 1.0.1
+      side-channel: 1.1.1
 
   queue-microtask@1.2.3: {}
 
@@ -12351,9 +12892,7 @@ snapshots:
 
   semver@7.7.4: {}
 
-  semver@7.8.0: {}
-
-  semver@7.8.1: {}
+  semver@7.8.2: {}
 
   semver@7.8.4: {}
 
@@ -12453,14 +12992,14 @@ snapshots:
 
   shell-quote@1.8.4: {}
 
-  shiki@4.2.0:
+  shiki@4.3.0:
     dependencies:
-      '@shikijs/core': 4.2.0
-      '@shikijs/engine-javascript': 4.2.0
-      '@shikijs/engine-oniguruma': 4.2.0
-      '@shikijs/langs': 4.2.0
-      '@shikijs/themes': 4.2.0
-      '@shikijs/types': 4.2.0
+      '@shikijs/core': 4.3.0
+      '@shikijs/engine-javascript': 4.3.0
+      '@shikijs/engine-oniguruma': 4.3.0
+      '@shikijs/langs': 4.3.0
+      '@shikijs/themes': 4.3.0
+      '@shikijs/types': 4.3.0
       '@shikijs/vscode-textmate': 10.0.2
       '@types/hast': 3.0.4
 
@@ -12484,7 +13023,7 @@ snapshots:
       object-inspect: 1.13.4
       side-channel-map: 1.0.1
 
-  side-channel@1.1.0:
+  side-channel@1.1.1:
     dependencies:
       es-errors: 1.3.0
       object-inspect: 1.13.4
@@ -12519,6 +13058,8 @@ snapshots:
 
   smol-toml@1.6.1: {}
 
+  smol-toml@1.7.0: {}
+
   sonic-boom@3.8.1:
     dependencies:
       atomic-sleep: 1.0.0
@@ -12602,7 +13143,7 @@ snapshots:
 
   stream-shift@1.0.3: {}
 
-  streamx@2.26.0:
+  streamx@2.28.0:
     dependencies:
       events-universal: 1.0.1
       fast-fifo: 1.3.2
@@ -12707,7 +13248,7 @@ snapshots:
     dependencies:
       b4a: 1.8.1
       fast-fifo: 1.3.2
-      streamx: 2.26.0
+      streamx: 2.28.0
     transitivePeerDependencies:
       - bare-abort-controller
       - react-native-b4a
@@ -12737,7 +13278,7 @@ snapshots:
     dependencies:
       any-promise: 1.3.0
 
-  thread-stream@3.1.0:
+  thread-stream@3.2.0:
     dependencies:
       real-require: 0.2.0
 
@@ -12767,18 +13308,20 @@ snapshots:
 
   tldts-core@6.1.86: {}
 
-  tldts-core@7.4.2: {}
+  tldts-core@7.4.5: {}
 
   tldts@6.1.86:
     dependencies:
       tldts-core: 6.1.86
 
-  tldts@7.4.2:
+  tldts@7.4.5:
     dependencies:
-      tldts-core: 7.4.2
+      tldts-core: 7.4.5
 
   tmp@0.2.6: {}
 
+  tmp@0.2.7: {}
+
   to-regex-range@5.0.1:
     dependencies:
       is-number: 7.0.0
@@ -12849,10 +13392,12 @@ snapshots:
   uglify-js@3.19.3:
     optional: true
 
-  unbash@3.0.0: {}
+  unbash@4.0.2: {}
 
   undici-types@7.24.6: {}
 
+  undici-types@8.3.0: {}
+
   undici@6.27.0: {}
 
   undici@7.28.0: {}
@@ -12963,10 +13508,10 @@ snapshots:
 
   vary@1.1.2: {}
 
-  verdaccio-audit@13.0.2:
+  verdaccio-audit@13.0.3:
     dependencies:
-      '@verdaccio/config': 8.1.1
-      '@verdaccio/core': 8.1.1
+      '@verdaccio/config': 8.1.2
+      '@verdaccio/core': 8.1.2
       express: 4.22.1
       https-proxy-agent: 5.0.1
       node-fetch: 2.6.7
@@ -12974,9 +13519,9 @@ snapshots:
       - encoding
       - supports-color
 
-  verdaccio-htpasswd@13.0.2:
+  verdaccio-htpasswd@13.0.3:
     dependencies:
-      '@verdaccio/core': 8.1.1
+      '@verdaccio/core': 8.1.2
       '@verdaccio/file-locking': 13.0.1
       apache-md5: 1.1.8
       bcryptjs: 2.4.3
@@ -12986,25 +13531,25 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  verdaccio@6.7.2(typanion@3.14.0):
+  verdaccio@6.7.4(typanion@3.14.0):
     dependencies:
       '@cypress/request': 3.0.10
-      '@verdaccio/auth': 8.0.2
-      '@verdaccio/config': 8.1.1
-      '@verdaccio/core': 8.1.1
-      '@verdaccio/hooks': 8.0.2
-      '@verdaccio/loaders': 8.0.2
-      '@verdaccio/local-storage-legacy': 11.3.3
-      '@verdaccio/logger': 8.0.2
-      '@verdaccio/middleware': 8.0.2
-      '@verdaccio/package-filter': 13.0.2
+      '@verdaccio/auth': 8.0.4
+      '@verdaccio/config': 8.1.2
+      '@verdaccio/core': 8.1.2
+      '@verdaccio/hooks': 8.0.3
+      '@verdaccio/loaders': 8.0.3
+      '@verdaccio/local-storage-legacy': 11.3.4
+      '@verdaccio/logger': 8.0.3
+      '@verdaccio/middleware': 8.0.5
+      '@verdaccio/package-filter': 13.0.3
       '@verdaccio/search-indexer': 8.0.2
-      '@verdaccio/signature': 8.0.2
+      '@verdaccio/signature': 8.0.3
       '@verdaccio/streams': 10.2.5
-      '@verdaccio/tarball': 13.0.2
-      '@verdaccio/ui-theme': 9.0.0-next-9.14
-      '@verdaccio/url': 13.0.2
-      '@verdaccio/utils': 8.1.2
+      '@verdaccio/tarball': 13.0.3
+      '@verdaccio/ui-theme': 9.0.0-next-9.20
+      '@verdaccio/url': 13.0.3
+      '@verdaccio/utils': 8.1.3
       JSONStream: 1.3.5
       async: 3.2.6
       clipanion: 4.0.0-rc.4(typanion@3.14.0)
@@ -13012,13 +13557,13 @@ snapshots:
       cors: 2.8.6
       debug: 4.4.3
       envinfo: 7.21.0
-      express: 4.22.1
+      express: 4.22.2
       lodash: 4.18.1
       lru-cache: 7.18.3
       mime: 3.0.0
-      semver: 7.8.0
-      verdaccio-audit: 13.0.2
-      verdaccio-htpasswd: 13.0.2
+      semver: 7.8.2
+      verdaccio-audit: 13.0.3
+      verdaccio-htpasswd: 13.0.3
     transitivePeerDependencies:
       - bare-abort-controller
       - encoding
@@ -13047,29 +13592,29 @@ snapshots:
       '@types/unist': 3.0.3
       vfile-message: 4.0.3
 
-  vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0):
+  vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0):
     dependencies:
       lightningcss: 1.32.0
       picomatch: 4.0.4
-      postcss: 8.5.15
+      postcss: 8.5.16
       rolldown: 1.0.2
       tinyglobby: 0.2.17
     optionalDependencies:
-      '@types/node': 25.9.3
+      '@types/node': 26.0.1
       esbuild: 0.28.1
       fsevents: 2.3.3
       jiti: 2.7.0
       yaml: 2.9.0
 
-  vitest@4.1.8(@types/node@25.9.3)(@vitest/coverage-istanbul@4.1.8)(vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)):
+  vitest@4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)):
     dependencies:
-      '@vitest/expect': 4.1.8
-      '@vitest/mocker': 4.1.8(vite@8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
-      '@vitest/pretty-format': 4.1.8
-      '@vitest/runner': 4.1.8
-      '@vitest/snapshot': 4.1.8
-      '@vitest/spy': 4.1.8
-      '@vitest/utils': 4.1.8
+      '@vitest/expect': 4.1.9
+      '@vitest/mocker': 4.1.9(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+      '@vitest/pretty-format': 4.1.9
+      '@vitest/runner': 4.1.9
+      '@vitest/snapshot': 4.1.9
+      '@vitest/spy': 4.1.9
+      '@vitest/utils': 4.1.9
       es-module-lexer: 2.1.0
       expect-type: 1.3.0
       magic-string: 0.30.21
@@ -13081,11 +13626,11 @@ snapshots:
       tinyexec: 1.2.4
       tinyglobby: 0.2.17
       tinyrainbow: 3.1.0
-      vite: 8.0.14(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)
+      vite: 8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)
       why-is-node-running: 2.3.0
     optionalDependencies:
-      '@types/node': 25.9.3
-      '@vitest/coverage-istanbul': 4.1.8(vitest@4.1.8)
+      '@types/node': 26.0.1
+      '@vitest/coverage-istanbul': 4.1.9(vitest@4.1.9)
     transitivePeerDependencies:
       - msw
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index f43d867749..78c682c787 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -12,26 +12,26 @@ allowBuilds:
   sharp: true
 
 catalog:
-  "@effect/atom-react": "4.0.0-beta.83"
-  "@effect/platform-bun": "4.0.0-beta.83"
-  "@effect/platform-node": "4.0.0-beta.83"
-  "@effect/sql-pg": "4.0.0-beta.83"
-  "@effect/vitest": "^4.0.0-beta.80"
-  "@nx/devkit": "^22.7.5"
+  "@effect/atom-react": "4.0.0-beta.85"
+  "@effect/platform-bun": "4.0.0-beta.85"
+  "@effect/platform-node": "4.0.0-beta.85"
+  "@effect/sql-pg": "4.0.0-beta.85"
+  "@effect/vitest": "^4.0.0-beta.85"
+  "@nx/devkit": "^23.0.0"
   "@swc-node/register": "^1.10.9"
   "@swc/core": "^1.15.41"
   "@tsconfig/bun": "^1.0.10"
   "@types/bun": "^1.3.14"
-  "@typescript/native-preview": "7.0.0-dev.20260614.1"
-  "@vitest/coverage-istanbul": "^4.1.8"
-  "effect": "4.0.0-beta.83"
-  "knip": "^6.15.0"
+  "@typescript/native-preview": "7.0.0-dev.20260621.1"
+  "@vitest/coverage-istanbul": "^4.1.9"
+  "effect": "4.0.0-beta.85"
+  "knip": "^6.17.1"
   "nx": "^23.0.0"
-  "oxfmt": "^0.54.0"
-  "oxlint": "^1.68.0"
+  "oxfmt": "^0.55.0"
+  "oxlint": "^1.70.0"
   "oxlint-tsgolint": "^0.23.0"
-  "tldts": "^7.4.2"
-  "vitest": "^4.1.8"
+  "tldts": "^7.4.3"
+  "vitest": "^4.1.9"
 
 blockExoticSubdeps: true
 

From 778644f4e43c4fbce64722f2568af5e4653eceb5 Mon Sep 17 00:00:00 2001
From: "supabase-cli-releaser[bot]"
 <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 11:18:33 +0200
Subject: [PATCH 19/29] chore(api): sync Management API OpenAPI spec (#5721)

This PR was automatically created to sync the generated `@supabase/api`
package with the latest Management API OpenAPI document.

Changes were detected in the upstream OpenAPI document exposed by
`https://api.supabase.com/api/v1-json`.

Co-authored-by: jgoux <1443499+jgoux@users.noreply.github.com>
---
 packages/api/src/generated/contracts.ts | 84 ++++++++++++-------------
 1 file changed, 42 insertions(+), 42 deletions(-)

diff --git a/packages/api/src/generated/contracts.ts b/packages/api/src/generated/contracts.ts
index 5a71e79a54..64a9df5a1d 100644
--- a/packages/api/src/generated/contracts.ts
+++ b/packages/api/src/generated/contracts.ts
@@ -115,7 +115,7 @@ export const ApiKeyResponse = Schema.Struct({
   description: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   hash: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   secret_jwt_template: Schema.optionalKey(
-    Schema.Union([Schema.Record(Schema.String, Schema.Unknown), Schema.Null]),
+    Schema.Union([Schema.Record(Schema.String, Schema.Json), Schema.Null]),
   ),
   inserted_at: Schema.optionalKey(
     Schema.Union([Schema.String.annotate({ format: "date-time" }), Schema.Null]),
@@ -172,8 +172,8 @@ export const ThirdPartyAuth = Schema.Struct({
   type: Schema.String,
   oidc_issuer_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   jwks_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
-  custom_jwks: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
-  resolved_jwks: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
+  custom_jwks: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
+  resolved_jwks: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
   inserted_at: Schema.String,
   updated_at: Schema.String,
   resolved_at: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
@@ -278,8 +278,8 @@ export const V1ActivateCustomHostnameOutput = Schema.Struct({
   custom_hostname: Schema.optionalKey(Schema.String),
   data: Schema.Struct({
     success: Schema.Boolean,
-    errors: Schema.Array(Schema.Unknown.annotate({ description: "Any JSON-serializable value" })),
-    messages: Schema.Array(Schema.Unknown.annotate({ description: "Any JSON-serializable value" })),
+    errors: Schema.Array(Schema.Json.annotate({ description: "Any JSON-serializable value" })),
+    messages: Schema.Array(Schema.Json.annotate({ description: "Any JSON-serializable value" })),
     result: Schema.Struct({
       id: Schema.String,
       hostname: Schema.String,
@@ -901,7 +901,7 @@ export const V1CreateLegacySigningKeyOutput = Schema.Struct({
   ),
   algorithm: Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]),
   status: Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
-  public_jwk: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
+  public_jwk: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
   created_at: Schema.String.annotate({ format: "date-time" }),
   updated_at: Schema.String.annotate({ format: "date-time" }),
 });
@@ -929,7 +929,7 @@ export const V1CreateProjectApiKeyInput = Schema.Struct({
     .check(Schema.isPattern(new RegExp("^[a-z_][a-z0-9_]+$"))),
   description: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   secret_jwt_template: Schema.optionalKey(
-    Schema.Union([Schema.Record(Schema.String, Schema.Unknown), Schema.Null]),
+    Schema.Union([Schema.Record(Schema.String, Schema.Json), Schema.Null]),
   ),
 });
 export const V1CreateProjectApiKeyOutput = Schema.Struct({
@@ -946,7 +946,7 @@ export const V1CreateProjectApiKeyOutput = Schema.Struct({
   description: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   hash: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   secret_jwt_template: Schema.optionalKey(
-    Schema.Union([Schema.Record(Schema.String, Schema.Unknown), Schema.Null]),
+    Schema.Union([Schema.Record(Schema.String, Schema.Json), Schema.Null]),
   ),
   inserted_at: Schema.optionalKey(
     Schema.Union([Schema.String.annotate({ format: "date-time" }), Schema.Null]),
@@ -1089,7 +1089,7 @@ export const V1CreateProjectSigningKeyOutput = Schema.Struct({
   ),
   algorithm: Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]),
   status: Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
-  public_jwk: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
+  public_jwk: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
   created_at: Schema.String.annotate({ format: "date-time" }),
   updated_at: Schema.String.annotate({ format: "date-time" }),
 });
@@ -1099,7 +1099,7 @@ export const V1CreateProjectTpaIntegrationInput = Schema.Struct({
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
   oidc_issuer_url: Schema.optionalKey(Schema.String),
   jwks_url: Schema.optionalKey(Schema.String),
-  custom_jwks: Schema.optionalKey(Schema.Unknown),
+  custom_jwks: Schema.optionalKey(Schema.Json),
 });
 export const V1CreateProjectTpaIntegrationOutput = Schema.Struct({
   id: Schema.String.annotate({ format: "uuid" }).check(
@@ -1110,8 +1110,8 @@ export const V1CreateProjectTpaIntegrationOutput = Schema.Struct({
   type: Schema.String,
   oidc_issuer_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   jwks_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
-  custom_jwks: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
-  resolved_jwks: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
+  custom_jwks: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
+  resolved_jwks: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
   inserted_at: Schema.String,
   updated_at: Schema.String,
   resolved_at: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
@@ -1307,7 +1307,7 @@ export const V1DeleteProjectApiKeyOutput = Schema.Struct({
   description: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   hash: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   secret_jwt_template: Schema.optionalKey(
-    Schema.Union([Schema.Record(Schema.String, Schema.Unknown), Schema.Null]),
+    Schema.Union([Schema.Record(Schema.String, Schema.Json), Schema.Null]),
   ),
   inserted_at: Schema.optionalKey(
     Schema.Union([Schema.String.annotate({ format: "date-time" }), Schema.Null]),
@@ -1340,8 +1340,8 @@ export const V1DeleteProjectTpaIntegrationOutput = Schema.Struct({
   type: Schema.String,
   oidc_issuer_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   jwks_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
-  custom_jwks: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
-  resolved_jwks: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
+  custom_jwks: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
+  resolved_jwks: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
   inserted_at: Schema.String,
   updated_at: Schema.String,
   resolved_at: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
@@ -1741,7 +1741,7 @@ export const V1GetActionRunOutput = Schema.Struct({
       updated_at: Schema.String,
     }),
   ),
-  git_config: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
+  git_config: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
   workdir: Schema.Union([Schema.String, Schema.Null]),
   check_run_id: Schema.Union([Schema.Number.check(Schema.isFinite()), Schema.Null]),
   created_at: Schema.String,
@@ -2310,11 +2310,11 @@ export const V1GetDatabaseMetadataOutput = Schema.Struct({
         name: Schema.String,
         schemas: Schema.Array(
           Schema.StructWithRest(Schema.Struct({ name: Schema.String }), [
-            Schema.Record(Schema.String, Schema.Unknown),
+            Schema.Record(Schema.String, Schema.Json),
           ]),
         ),
       }),
-      [Schema.Record(Schema.String, Schema.Unknown)],
+      [Schema.Record(Schema.String, Schema.Json)],
     ),
   ),
 });
@@ -2356,8 +2356,8 @@ export const V1GetHostnameConfigOutput = Schema.Struct({
   custom_hostname: Schema.optionalKey(Schema.String),
   data: Schema.Struct({
     success: Schema.Boolean,
-    errors: Schema.Array(Schema.Unknown.annotate({ description: "Any JSON-serializable value" })),
-    messages: Schema.Array(Schema.Unknown.annotate({ description: "Any JSON-serializable value" })),
+    errors: Schema.Array(Schema.Json.annotate({ description: "Any JSON-serializable value" })),
+    messages: Schema.Array(Schema.Json.annotate({ description: "Any JSON-serializable value" })),
     result: Schema.Struct({
       id: Schema.String,
       hostname: Schema.String,
@@ -2439,7 +2439,7 @@ export const V1GetLegacySigningKeyOutput = Schema.Struct({
   ),
   algorithm: Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]),
   status: Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
-  public_jwk: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
+  public_jwk: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
   created_at: Schema.String.annotate({ format: "date-time" }),
   updated_at: Schema.String.annotate({ format: "date-time" }),
 });
@@ -2981,7 +2981,7 @@ export const V1GetProjectApiKeyOutput = Schema.Struct({
   description: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   hash: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   secret_jwt_template: Schema.optionalKey(
-    Schema.Union([Schema.Record(Schema.String, Schema.Unknown), Schema.Null]),
+    Schema.Union([Schema.Record(Schema.String, Schema.Json), Schema.Null]),
   ),
   inserted_at: Schema.optionalKey(
     Schema.Union([Schema.String.annotate({ format: "date-time" }), Schema.Null]),
@@ -3045,7 +3045,7 @@ export const V1GetProjectFunctionCombinedStatsInput = Schema.Struct({
   function_id: Schema.String,
 });
 export const V1GetProjectFunctionCombinedStatsOutput = Schema.Struct({
-  result: Schema.optionalKey(Schema.Array(Schema.Unknown)),
+  result: Schema.optionalKey(Schema.Array(Schema.Json)),
   error: Schema.optionalKey(
     Schema.Union(
       [
@@ -3084,7 +3084,7 @@ export const V1GetProjectLogsInput = Schema.Struct({
   iso_timestamp_end: Schema.optionalKey(Schema.String.annotate({ format: "date-time" })),
 });
 export const V1GetProjectLogsOutput = Schema.Struct({
-  result: Schema.optionalKey(Schema.Array(Schema.Unknown)),
+  result: Schema.optionalKey(Schema.Array(Schema.Json)),
   error: Schema.optionalKey(
     Schema.Union(
       [
@@ -3117,7 +3117,7 @@ export const V1GetProjectLogsAllInput = Schema.Struct({
   iso_timestamp_end: Schema.optionalKey(Schema.String.annotate({ format: "date-time" })),
 });
 export const V1GetProjectLogsAllOutput = Schema.Struct({
-  result: Schema.optionalKey(Schema.Array(Schema.Unknown)),
+  result: Schema.optionalKey(Schema.Array(Schema.Json)),
   error: Schema.optionalKey(
     Schema.Union(
       [
@@ -3175,7 +3175,7 @@ export const V1GetProjectSigningKeyOutput = Schema.Struct({
   ),
   algorithm: Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]),
   status: Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
-  public_jwk: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
+  public_jwk: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
   created_at: Schema.String.annotate({ format: "date-time" }),
   updated_at: Schema.String.annotate({ format: "date-time" }),
 });
@@ -3196,7 +3196,7 @@ export const V1GetProjectSigningKeysOutput = Schema.Struct({
       ),
       algorithm: Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]),
       status: Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
-      public_jwk: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
+      public_jwk: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
       created_at: Schema.String.annotate({ format: "date-time" }),
       updated_at: Schema.String.annotate({ format: "date-time" }),
     }),
@@ -3221,8 +3221,8 @@ export const V1GetProjectTpaIntegrationOutput = Schema.Struct({
   type: Schema.String,
   oidc_issuer_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   jwks_url: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
-  custom_jwks: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
-  resolved_jwks: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
+  custom_jwks: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
+  resolved_jwks: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
   inserted_at: Schema.String,
   updated_at: Schema.String,
   resolved_at: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
@@ -3618,7 +3618,7 @@ export const V1ListActionRunsOutput = Schema.Array(
         updated_at: Schema.String,
       }),
     ),
-    git_config: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
+    git_config: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
     workdir: Schema.Union([Schema.String, Schema.Null]),
     check_run_id: Schema.Union([Schema.Number.check(Schema.isFinite()), Schema.Null]),
     created_at: Schema.String,
@@ -3961,7 +3961,7 @@ export const V1ListProjectAddonsOutput = Schema.Struct({
           amount: Schema.Number.check(Schema.isFinite()),
         }),
         meta: Schema.optionalKey(
-          Schema.Unknown.annotate({ description: "Any JSON-serializable value" }),
+          Schema.Json.annotate({ description: "Any JSON-serializable value" }),
         ),
       }),
     }),
@@ -4021,7 +4021,7 @@ export const V1ListProjectAddonsOutput = Schema.Struct({
             amount: Schema.Number.check(Schema.isFinite()),
           }),
           meta: Schema.optionalKey(
-            Schema.Unknown.annotate({ description: "Any JSON-serializable value" }),
+            Schema.Json.annotate({ description: "Any JSON-serializable value" }),
           ),
         }),
       ),
@@ -4180,7 +4180,7 @@ export const V1ReadOnlyQueryInput = Schema.Struct({
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
   query: Schema.String.check(Schema.isMinLength(1)),
-  parameters: Schema.optionalKey(Schema.Array(Schema.Unknown)),
+  parameters: Schema.optionalKey(Schema.Array(Schema.Json)),
 });
 export const V1RemoveAReadReplicaInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
@@ -4239,7 +4239,7 @@ export const V1RemoveProjectSigningKeyOutput = Schema.Struct({
   ),
   algorithm: Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]),
   status: Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
-  public_jwk: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
+  public_jwk: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
   created_at: Schema.String.annotate({ format: "date-time" }),
   updated_at: Schema.String.annotate({ format: "date-time" }),
 });
@@ -4331,7 +4331,7 @@ export const V1RunAQueryInput = Schema.Struct({
     .check(Schema.isMaxLength(20))
     .check(Schema.isPattern(new RegExp("^[a-z]+$"))),
   query: Schema.String.check(Schema.isMinLength(1)),
-  parameters: Schema.optionalKey(Schema.Array(Schema.Unknown)),
+  parameters: Schema.optionalKey(Schema.Array(Schema.Json)),
   read_only: Schema.optionalKey(Schema.Boolean),
 });
 export const V1SetupAReadReplicaInput = Schema.Struct({
@@ -5451,8 +5451,8 @@ export const V1UpdateHostnameConfigOutput = Schema.Struct({
   custom_hostname: Schema.optionalKey(Schema.String),
   data: Schema.Struct({
     success: Schema.Boolean,
-    errors: Schema.Array(Schema.Unknown.annotate({ description: "Any JSON-serializable value" })),
-    messages: Schema.Array(Schema.Unknown.annotate({ description: "Any JSON-serializable value" })),
+    errors: Schema.Array(Schema.Json.annotate({ description: "Any JSON-serializable value" })),
+    messages: Schema.Array(Schema.Json.annotate({ description: "Any JSON-serializable value" })),
     result: Schema.Struct({
       id: Schema.String,
       hostname: Schema.String,
@@ -5815,7 +5815,7 @@ export const V1UpdateProjectApiKeyInput = Schema.Struct({
   ),
   description: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   secret_jwt_template: Schema.optionalKey(
-    Schema.Union([Schema.Record(Schema.String, Schema.Unknown), Schema.Null]),
+    Schema.Union([Schema.Record(Schema.String, Schema.Json), Schema.Null]),
   ),
 });
 export const V1UpdateProjectApiKeyOutput = Schema.Struct({
@@ -5832,7 +5832,7 @@ export const V1UpdateProjectApiKeyOutput = Schema.Struct({
   description: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   hash: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
   secret_jwt_template: Schema.optionalKey(
-    Schema.Union([Schema.Record(Schema.String, Schema.Unknown), Schema.Null]),
+    Schema.Union([Schema.Record(Schema.String, Schema.Json), Schema.Null]),
   ),
   inserted_at: Schema.optionalKey(
     Schema.Union([Schema.String.annotate({ format: "date-time" }), Schema.Null]),
@@ -5867,7 +5867,7 @@ export const V1UpdateProjectSigningKeyOutput = Schema.Struct({
   ),
   algorithm: Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]),
   status: Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
-  public_jwk: Schema.optionalKey(Schema.Union([Schema.Unknown, Schema.Null])),
+  public_jwk: Schema.optionalKey(Schema.Union([Schema.Json, Schema.Null])),
   created_at: Schema.String.annotate({ format: "date-time" }),
   updated_at: Schema.String.annotate({ format: "date-time" }),
 });
@@ -6026,8 +6026,8 @@ export const V1VerifyDnsConfigOutput = Schema.Struct({
   custom_hostname: Schema.optionalKey(Schema.String),
   data: Schema.Struct({
     success: Schema.Boolean,
-    errors: Schema.Array(Schema.Unknown.annotate({ description: "Any JSON-serializable value" })),
-    messages: Schema.Array(Schema.Unknown.annotate({ description: "Any JSON-serializable value" })),
+    errors: Schema.Array(Schema.Json.annotate({ description: "Any JSON-serializable value" })),
+    messages: Schema.Array(Schema.Json.annotate({ description: "Any JSON-serializable value" })),
     result: Schema.Struct({
       id: Schema.String,
       hostname: Schema.String,

From 8d2e6d67208867673bc7d76963902f05263e57bf Mon Sep 17 00:00:00 2001
From: Andrew Valleteau <avallete@users.noreply.github.com>
Date: Mon, 29 Jun 2026 12:37:21 +0200
Subject: [PATCH 20/29] fix(cli): handle AlreadyExists errors in directory
 creation (#5724)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extract directory creation logic into a new `legacyMakeDir` utility that
matches Go's `os.MkdirAll` behavior by treating an already-existing
directory as success.

The Effect/Bun `FileSystem.makeDirectory` API can surface an
`AlreadyExists` `SystemError` for existing directories on some platforms
(notably Windows with OneDrive reparse points — CLI-1849), even with
`recursive: true`. This differs from Go's `os.MkdirAll`, which returns
nil when the target is already a directory.

**Key changes:**
- Add `legacyMakeDir` utility in
`apps/cli/src/legacy/shared/legacy-make-dir.ts` that wraps
`FileSystem.makeDirectory` and recovers from `AlreadyExists` errors
- Add comprehensive unit tests covering success case, `AlreadyExists`
recovery, and error propagation
- Replace three inline `makeDirectory` calls in `db diff`, `db pull`,
and `db schema declarative sync` handlers with `legacyMakeDir`

This ensures the CLI's migration writers never fail on a pre-existing
`supabase/migrations` directory, matching the original Go
implementation's behavior.

https://claude.ai/code/session_01AWa8Hr8BS2pZucac9r3wb7

Co-authored-by: Claude <noreply@anthropic.com>
---
 .../legacy/commands/db/diff/diff.handler.ts   | 13 +--
 .../legacy/commands/db/pull/pull.handler.ts   |  7 +-
 .../schema/declarative/sync/sync.handler.ts   |  3 +-
 apps/cli/src/legacy/shared/legacy-make-dir.ts | 26 ++++++
 .../shared/legacy-make-dir.unit.test.ts       | 93 +++++++++++++++++++
 5 files changed, 132 insertions(+), 10 deletions(-)
 create mode 100644 apps/cli/src/legacy/shared/legacy-make-dir.ts
 create mode 100644 apps/cli/src/legacy/shared/legacy-make-dir.unit.test.ts

diff --git a/apps/cli/src/legacy/commands/db/diff/diff.handler.ts b/apps/cli/src/legacy/commands/db/diff/diff.handler.ts
index 577ff3f6c1..73c0f7b6d5 100644
--- a/apps/cli/src/legacy/commands/db/diff/diff.handler.ts
+++ b/apps/cli/src/legacy/commands/db/diff/diff.handler.ts
@@ -11,6 +11,7 @@ import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service
 import type { LegacyPgConnInput } from "../../../shared/legacy-db-connection.service.ts";
 import type { LegacyDbConnType } from "../../../shared/legacy-db-target-flags.ts";
 import { legacyGetHostname } from "../../../shared/legacy-hostname.ts";
+import { legacyMakeDir } from "../../../shared/legacy-make-dir.ts";
 import { legacyToPostgresURL } from "../../../shared/legacy-postgres-url.ts";
 import { legacySchemaToCsvField } from "../../../shared/legacy-schema-flags.ts";
 import { legacyFindDropStatements } from "../../../shared/legacy-sql-split.ts";
@@ -277,9 +278,9 @@ export const legacyDbDiff = Effect.fn("legacy.db.diff")(function* (flags: Legacy
         // Create parent dirs first, matching Go's `writeOutput` → `utils.WriteFile`
         // (`internal/db/diff/explicit.go`, `internal/utils/misc.go`), so a nested
         // `--output tmp/diff.sql` doesn't fail when `tmp/` doesn't exist yet.
-        yield* fs
-          .makeDirectory(path.dirname(target), { recursive: true })
-          .pipe(Effect.mapError((cause) => new LegacyDbDiffWriteError({ message: cause.message })));
+        yield* legacyMakeDir(fs, path.dirname(target)).pipe(
+          Effect.mapError((cause) => new LegacyDbDiffWriteError({ message: cause.message })),
+        );
         yield* fs
           .writeFileString(target, result.sql)
           .pipe(Effect.mapError((cause) => new LegacyDbDiffWriteError({ message: cause.message })));
@@ -457,9 +458,9 @@ export const legacyDbDiff = Effect.fn("legacy.db.diff")(function* (flags: Legacy
         timestamp,
         flags.file.value,
       );
-      yield* fs
-        .makeDirectory(path.dirname(migrationPath), { recursive: true })
-        .pipe(Effect.mapError((cause) => new LegacyDbDiffWriteError({ message: cause.message })));
+      yield* legacyMakeDir(fs, path.dirname(migrationPath)).pipe(
+        Effect.mapError((cause) => new LegacyDbDiffWriteError({ message: cause.message })),
+      );
       yield* fs
         .writeFileString(migrationPath, out)
         .pipe(Effect.mapError((cause) => new LegacyDbDiffWriteError({ message: cause.message })));
diff --git a/apps/cli/src/legacy/commands/db/pull/pull.handler.ts b/apps/cli/src/legacy/commands/db/pull/pull.handler.ts
index 6936a83c26..05721ac867 100644
--- a/apps/cli/src/legacy/commands/db/pull/pull.handler.ts
+++ b/apps/cli/src/legacy/commands/db/pull/pull.handler.ts
@@ -21,6 +21,7 @@ import {
   legacyResolveDeclarativeDir,
 } from "../../../shared/legacy-db-config.toml-read.ts";
 import type { LegacyDbConnType } from "../../../shared/legacy-db-target-flags.ts";
+import { legacyMakeDir } from "../../../shared/legacy-make-dir.ts";
 import { legacyToPostgresURL } from "../../../shared/legacy-postgres-url.ts";
 import { legacySchemaToCsvField } from "../../../shared/legacy-schema-flags.ts";
 import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
@@ -540,9 +541,9 @@ export const legacyDbPull = Effect.fn("legacy.db.pull")(function* (flags: Legacy
             new LegacyDbPullInSyncError({ message: "No schema changes found" }),
           );
         }
-        yield* fs
-          .makeDirectory(path.dirname(migrationPath), { recursive: true })
-          .pipe(Effect.mapError((cause) => new LegacyDbPullWriteError({ message: cause.message })));
+        yield* legacyMakeDir(fs, path.dirname(migrationPath)).pipe(
+          Effect.mapError((cause) => new LegacyDbPullWriteError({ message: cause.message })),
+        );
         yield* fs.writeFileString(migrationPath, out).pipe(
           Effect.mapError(
             (cause) =>
diff --git a/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.handler.ts b/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.handler.ts
index d70db8625c..61f276e4c0 100644
--- a/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.handler.ts
+++ b/apps/cli/src/legacy/commands/db/schema/declarative/sync/sync.handler.ts
@@ -16,6 +16,7 @@ import {
   legacyReadDbToml,
   legacyResolveDeclarativeDir,
 } from "../../../../../shared/legacy-db-config.toml-read.ts";
+import { legacyMakeDir } from "../../../../../shared/legacy-make-dir.ts";
 import { legacyApplyMigrationFile } from "../../../../../shared/legacy-migration-apply.ts";
 import { legacyReadProjectRefFile } from "../../../../../shared/legacy-temp-paths.ts";
 import { LegacyLinkedProjectCache } from "../../../../../telemetry/legacy-linked-project-cache.service.ts";
@@ -276,7 +277,7 @@ export const legacyDbSchemaDeclarativeSync = Effect.fn("legacy.db.schema.declara
       // Step 5: write the timestamped migration file.
       const timestamp = formatTimestamp(yield* Clock.currentTimeMillis);
       const migrationPath = path.join(migrationsDir, `${timestamp}_${migrationName}.sql`);
-      yield* fs.makeDirectory(migrationsDir, { recursive: true });
+      yield* legacyMakeDir(fs, migrationsDir);
       yield* fs.writeFileString(migrationPath, result.diffSQL);
       yield* output.raw(`Created new migration at ${legacyBold(migrationPath)}\n`, "stderr");
 
diff --git a/apps/cli/src/legacy/shared/legacy-make-dir.ts b/apps/cli/src/legacy/shared/legacy-make-dir.ts
new file mode 100644
index 0000000000..864c363150
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-make-dir.ts
@@ -0,0 +1,26 @@
+import { Effect, FileSystem } from "effect";
+import type { PlatformError } from "effect/PlatformError";
+
+/**
+ * `os.MkdirAll`-equivalent: create `dir` and any missing parents, treating an
+ * already-existing directory as success.
+ *
+ * Go's `os.MkdirAll` returns nil when the target is already a directory, so the
+ * Go CLI's migration writers never failed on a pre-existing `supabase/migrations`.
+ * Effect's Bun `FileSystem.makeDirectory` does not always match that: even with
+ * `recursive: true` it can surface an `AlreadyExists` `SystemError` for an
+ * existing directory on some platforms (notably Windows / OneDrive reparse
+ * points — see CLI-1849). Recover from that single reason so re-creating an
+ * existing directory is a no-op, and let every other failure propagate.
+ */
+export const legacyMakeDir = (
+  fs: FileSystem.FileSystem,
+  dir: string,
+): Effect.Effect<void, PlatformError> =>
+  fs
+    .makeDirectory(dir, { recursive: true })
+    .pipe(
+      Effect.catchTag("PlatformError", (error) =>
+        error.reason._tag === "AlreadyExists" ? Effect.void : Effect.fail(error),
+      ),
+    );
diff --git a/apps/cli/src/legacy/shared/legacy-make-dir.unit.test.ts b/apps/cli/src/legacy/shared/legacy-make-dir.unit.test.ts
new file mode 100644
index 0000000000..62fab1a4bd
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-make-dir.unit.test.ts
@@ -0,0 +1,93 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit, FileSystem, Layer, PlatformError } from "effect";
+
+import { legacyMakeDir } from "./legacy-make-dir.ts";
+
+const DIR = "/home/user/project/supabase/migrations";
+
+type SystemReason = Parameters<typeof PlatformError.systemError>[0]["_tag"];
+
+/** A FileSystem whose `makeDirectory` always fails with the given system reason. */
+function failingFs(reason: SystemReason) {
+  const calls: Array<{ readonly path: string; readonly recursive?: boolean }> = [];
+  return {
+    calls,
+    layer: Layer.succeed(
+      FileSystem.FileSystem,
+      FileSystem.makeNoop({
+        makeDirectory: (path, opts) =>
+          Effect.suspend(() => {
+            calls.push({ path, recursive: opts?.recursive });
+            return Effect.fail(
+              PlatformError.systemError({
+                _tag: reason,
+                module: "FileSystem",
+                method: "makeDirectory",
+                description: reason,
+                pathOrDescriptor: path,
+              }),
+            );
+          }),
+      }),
+    ),
+  };
+}
+
+const run = (dir: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    return yield* legacyMakeDir(fs, dir);
+  });
+
+describe("legacyMakeDir", () => {
+  it.effect("creates the directory recursively, matching os.MkdirAll", () => {
+    const calls: Array<{ readonly path: string; readonly recursive?: boolean }> = [];
+    const layer = Layer.succeed(
+      FileSystem.FileSystem,
+      FileSystem.makeNoop({
+        makeDirectory: (path, opts) =>
+          Effect.sync(() => {
+            calls.push({ path, recursive: opts?.recursive });
+          }),
+      }),
+    );
+    return run(DIR).pipe(
+      Effect.tap(() =>
+        Effect.sync(() => {
+          expect(calls).toEqual([{ path: DIR, recursive: true }]);
+        }),
+      ),
+      Effect.provide(layer),
+    );
+  });
+
+  it.effect("treats an already-existing directory as success (CLI-1849)", () => {
+    const fs = failingFs("AlreadyExists");
+    return run(DIR).pipe(
+      Effect.exit,
+      Effect.tap((exit) =>
+        Effect.sync(() => {
+          expect(Exit.isSuccess(exit)).toBe(true);
+          expect(fs.calls).toEqual([{ path: DIR, recursive: true }]);
+        }),
+      ),
+      Effect.provide(fs.layer),
+    );
+  });
+
+  it.effect("propagates every other filesystem error", () => {
+    const fs = failingFs("PermissionDenied");
+    return run(DIR).pipe(
+      Effect.exit,
+      Effect.tap((exit) =>
+        Effect.sync(() => {
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain("PermissionDenied");
+          }
+        }),
+      ),
+      Effect.provide(fs.layer),
+    );
+  });
+});

From f673e6e393c4b90fc682302bbd18c7d9fd58d1fd Mon Sep 17 00:00:00 2001
From: "supabase-cli-releaser[bot]"
 <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 15:41:16 +0200
Subject: [PATCH 21/29] chore(api): sync Management API OpenAPI spec (#5723)

This PR was automatically created to sync the generated `@supabase/api`
package with the latest Management API OpenAPI document.

Changes were detected in the upstream OpenAPI document exposed by
`https://api.supabase.com/api/v1-json`.

---------

Co-authored-by: jgoux <1443499+jgoux@users.noreply.github.com>
Co-authored-by: Julien Goux <hi@jgoux.dev>
---
 .../2.response.json                           |  3 ++
 .../3.response.json                           |  3 ++
 .../default.response.json                     |  3 ++
 .../interactions.json                         |  3 ++
 .../interactions.json                         |  3 ++
 .../interactions.json                         |  3 ++
 packages/api/src/generated/contracts.ts       |  4 +++
 packages/api/src/generated/openapi.json       | 30 +++++++++++++++++--
 8 files changed, 50 insertions(+), 2 deletions(-)

diff --git a/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___config_storage/2.response.json b/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___config_storage/2.response.json
index 374488d753..1fb4088bd8 100644
--- a/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___config_storage/2.response.json
+++ b/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___config_storage/2.response.json
@@ -16,6 +16,9 @@
       "s3Protocol": {
         "enabled": true
       },
+      "purgeCache": {
+        "enabled": true
+      },
       "icebergCatalog": {
         "enabled": true,
         "maxNamespaces": 10,
diff --git a/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___config_storage/3.response.json b/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___config_storage/3.response.json
index 153c80517e..289195ef7f 100644
--- a/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___config_storage/3.response.json
+++ b/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___config_storage/3.response.json
@@ -16,6 +16,9 @@
       "s3Protocol": {
         "enabled": true
       },
+      "purgeCache": {
+        "enabled": true
+      },
       "icebergCatalog": {
         "enabled": true,
         "maxNamespaces": 10,
diff --git a/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___config_storage/default.response.json b/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___config_storage/default.response.json
index 153c80517e..289195ef7f 100644
--- a/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___config_storage/default.response.json
+++ b/apps/cli-e2e/fixtures/recorded/GET_v1_projects___PROJECT_REF___config_storage/default.response.json
@@ -16,6 +16,9 @@
       "s3Protocol": {
         "enabled": true
       },
+      "purgeCache": {
+        "enabled": true
+      },
       "icebergCatalog": {
         "enabled": true,
         "maxNamespaces": 10,
diff --git a/apps/cli-e2e/fixtures/scenarios/config-push-emits-http-trace-with-debug/interactions.json b/apps/cli-e2e/fixtures/scenarios/config-push-emits-http-trace-with-debug/interactions.json
index d0bd511ff9..4341b8a12a 100644
--- a/apps/cli-e2e/fixtures/scenarios/config-push-emits-http-trace-with-debug/interactions.json
+++ b/apps/cli-e2e/fixtures/scenarios/config-push-emits-http-trace-with-debug/interactions.json
@@ -1084,6 +1084,9 @@
           "s3Protocol": {
             "enabled": true
           },
+          "purgeCache": {
+            "enabled": true
+          },
           "icebergCatalog": {
             "enabled": true,
             "maxNamespaces": 10,
diff --git a/apps/cli-e2e/fixtures/scenarios/config-push-reconciles-every-section-against-the-remote/interactions.json b/apps/cli-e2e/fixtures/scenarios/config-push-reconciles-every-section-against-the-remote/interactions.json
index ee925a30e0..b19751a226 100644
--- a/apps/cli-e2e/fixtures/scenarios/config-push-reconciles-every-section-against-the-remote/interactions.json
+++ b/apps/cli-e2e/fixtures/scenarios/config-push-reconciles-every-section-against-the-remote/interactions.json
@@ -1395,6 +1395,9 @@
           "s3Protocol": {
             "enabled": true
           },
+          "purgeCache": {
+            "enabled": true
+          },
           "icebergCatalog": {
             "enabled": true,
             "maxNamespaces": 10,
diff --git a/apps/cli-e2e/fixtures/scenarios/link-links-when-only-supabase-project-id-is-set-in-non-tty/interactions.json b/apps/cli-e2e/fixtures/scenarios/link-links-when-only-supabase-project-id-is-set-in-non-tty/interactions.json
index 4d64509c06..263250637c 100644
--- a/apps/cli-e2e/fixtures/scenarios/link-links-when-only-supabase-project-id-is-set-in-non-tty/interactions.json
+++ b/apps/cli-e2e/fixtures/scenarios/link-links-when-only-supabase-project-id-is-set-in-non-tty/interactions.json
@@ -271,6 +271,9 @@
           "s3Protocol": {
             "enabled": true
           },
+          "purgeCache": {
+            "enabled": true
+          },
           "icebergCatalog": {
             "enabled": true,
             "maxNamespaces": 10,
diff --git a/packages/api/src/generated/contracts.ts b/packages/api/src/generated/contracts.ts
index 64a9df5a1d..b4f6f9200d 100644
--- a/packages/api/src/generated/contracts.ts
+++ b/packages/api/src/generated/contracts.ts
@@ -2489,6 +2489,7 @@ export const V1GetOrganizationEntitlementsOutput = Schema.Struct({
           "storage.image_transformations",
           "storage.vector_buckets",
           "storage.iceberg_catalog",
+          "storage.purge_cache",
           "security.audit_logs_days",
           "security.questionnaire",
           "security.soc2_report",
@@ -2538,6 +2539,7 @@ export const V1GetOrganizationEntitlementsOutput = Schema.Struct({
           "integrations.github_connections",
           "dedicated_pooler",
           "observability.dashboard_advanced_metrics",
+          "api.members.roles",
         ]),
         type: Schema.Literals(["boolean", "numeric", "set"]),
       }),
@@ -3509,6 +3511,7 @@ export const V1GetStorageConfigOutput = Schema.Struct({
   features: Schema.Struct({
     imageTransformation: Schema.Struct({ enabled: Schema.Boolean }),
     s3Protocol: Schema.Struct({ enabled: Schema.Boolean }),
+    purgeCache: Schema.Struct({ enabled: Schema.Boolean }),
     icebergCatalog: Schema.Struct({
       enabled: Schema.Boolean,
       maxNamespaces: Schema.Number.check(Schema.isInt()).check(Schema.isGreaterThanOrEqualTo(0)),
@@ -5966,6 +5969,7 @@ export const V1UpdateStorageConfigInput = Schema.Struct({
     Schema.Struct({
       imageTransformation: Schema.optionalKey(Schema.Struct({ enabled: Schema.Boolean })),
       s3Protocol: Schema.optionalKey(Schema.Struct({ enabled: Schema.Boolean })),
+      purgeCache: Schema.optionalKey(Schema.Struct({ enabled: Schema.Boolean })),
       icebergCatalog: Schema.optionalKey(
         Schema.Struct({
           enabled: Schema.Boolean,
diff --git a/packages/api/src/generated/openapi.json b/packages/api/src/generated/openapi.json
index 46a45efcd9..38dbe20844 100644
--- a/packages/api/src/generated/openapi.json
+++ b/packages/api/src/generated/openapi.json
@@ -18613,6 +18613,15 @@
                 },
                 "required": ["enabled"]
               },
+              "purgeCache": {
+                "type": "object",
+                "properties": {
+                  "enabled": {
+                    "type": "boolean"
+                  }
+                },
+                "required": ["enabled"]
+              },
               "icebergCatalog": {
                 "type": "object",
                 "properties": {
@@ -18652,7 +18661,13 @@
                 "required": ["enabled", "maxBuckets", "maxIndexes"]
               }
             },
-            "required": ["imageTransformation", "s3Protocol", "icebergCatalog", "vectorBuckets"]
+            "required": [
+              "imageTransformation",
+              "s3Protocol",
+              "purgeCache",
+              "icebergCatalog",
+              "vectorBuckets"
+            ]
           },
           "capabilities": {
             "type": "object",
@@ -18722,6 +18737,15 @@
                 },
                 "required": ["enabled"]
               },
+              "purgeCache": {
+                "type": "object",
+                "properties": {
+                  "enabled": {
+                    "type": "boolean"
+                  }
+                },
+                "required": ["enabled"]
+              },
               "icebergCatalog": {
                 "type": "object",
                 "properties": {
@@ -20229,6 +20253,7 @@
                         "storage.image_transformations",
                         "storage.vector_buckets",
                         "storage.iceberg_catalog",
+                        "storage.purge_cache",
                         "security.audit_logs_days",
                         "security.questionnaire",
                         "security.soc2_report",
@@ -20277,7 +20302,8 @@
                         "assistant.advance_model",
                         "integrations.github_connections",
                         "dedicated_pooler",
-                        "observability.dashboard_advanced_metrics"
+                        "observability.dashboard_advanced_metrics",
+                        "api.members.roles"
                       ]
                     },
                     "type": {

From b2322de9f64e53fb6a81468e2b64ca7a0079d930 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 30 Jun 2026 00:10:53 +0000
Subject: [PATCH 22/29] chore(deps): bump the go-minor group across 2
 directories with 2 updates (#5730)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the go-minor group with 2 updates in the /apps/cli-go directory:
[github.com/andybalholm/brotli](https://github.com/andybalholm/brotli)
and
[github.com/oapi-codegen/nullable](https://github.com/oapi-codegen/nullable).
Bumps the go-minor group with 2 updates in the /apps/cli-go/pkg
directory:
[github.com/andybalholm/brotli](https://github.com/andybalholm/brotli)
and
[github.com/oapi-codegen/nullable](https://github.com/oapi-codegen/nullable).

Updates `github.com/andybalholm/brotli` from 1.2.1 to 1.2.2
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/andybalholm/brotli/commit/785aba538b2118979d2c573eccb287c4da157faf"><code>785aba5</code></a>
reuse hgroups</li>
<li><a
href="https://github.com/andybalholm/brotli/commit/b797a3535cbdd227ce3520cb0dfe01d83c2eeda9"><code>b797a35</code></a>
reuse block_type_trees</li>
<li>See full diff in <a
href="https://github.com/andybalholm/brotli/compare/v1.2.1...v1.2.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/oapi-codegen/nullable` from 1.1.0 to 1.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oapi-codegen/nullable/releases">github.com/oapi-codegen/nullable's
releases</a>.</em></p>
<blockquote>
<h2>New getter function</h2>
<h2>🚀 New features and improvements</h2>
<ul>
<li>feat: new method for fetching ignoring error (<a
href="https://redirect.github.com/oapi-codegen/nullable/issues/13">#13</a>)
<a href="https://github.com/lzap"><code>@​lzap</code></a></li>
</ul>
<p>There is now a <code>GetOrEmpty()</code> on <code>Nullable</code>
which will return the wrapped value if it's available, or it will create
a new zerovalue if <code>Nullable</code> is uninitialized, or
initialized to <code>nil</code>.</p>
<h2>📝 Documentation updates</h2>
<ul>
<li>docs(sponsors): add <code>FUNDING.yml</code> (<a
href="https://redirect.github.com/oapi-codegen/nullable/issues/9">#9</a>)
<a
href="https://github.com/jamietanna"><code>@​jamietanna</code></a></li>
</ul>
<h2>✍ Other changes</h2>
<ul>
<li>Update CI config (<a
href="https://redirect.github.com/oapi-codegen/nullable/issues/33">#33</a>)
<a
href="https://github.com/mromaszewicz"><code>@​mromaszewicz</code></a></li>
<li>chore: onboard to Renovate (<a
href="https://redirect.github.com/oapi-codegen/nullable/issues/5">#5</a>)
<a
href="https://github.com/jamietanna"><code>@​jamietanna</code></a></li>
</ul>
<h2>📦 Dependency updates</h2>
<ul>
<li>chore(deps): pin dependencies (<a
href="https://redirect.github.com/oapi-codegen/nullable/issues/16">#16</a>)
<a href="https://github.com/renovate"><code>@​renovate</code></a></li>
</ul>
<h2>Sponsors</h2>
<p>We would like to thank our sponsors for their support during this
release.</p>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oapi-codegen/nullable/commit/e4ef9c9376e8af534ae6fcc8b87f00a024cb645d"><code>e4ef9c9</code></a>
Merge pull request <a
href="https://redirect.github.com/oapi-codegen/nullable/issues/33">#33</a>
from oapi-codegen/chore/ci</li>
<li><a
href="https://github.com/oapi-codegen/nullable/commit/486afb97c1e3118fe099d133bdf5bc201c6bd4b9"><code>486afb9</code></a>
Update CI settings</li>
<li><a
href="https://github.com/oapi-codegen/nullable/commit/e5788251282d58f34bea50ecdb08c9469f4f15a2"><code>e578825</code></a>
Merge pull request <a
href="https://redirect.github.com/oapi-codegen/nullable/issues/13">#13</a>
from lzap/dig1</li>
<li><a
href="https://github.com/oapi-codegen/nullable/commit/6fde78b67c1bee57577b65b8a82f269d3221b261"><code>6fde78b</code></a>
feat: new method for fetching ignoring error</li>
<li><a
href="https://github.com/oapi-codegen/nullable/commit/55520a653f276b120fde6a9bc7bbaf5eeaa15134"><code>55520a6</code></a>
chore(deps): pin dependencies</li>
<li><a
href="https://github.com/oapi-codegen/nullable/commit/0d2a587518c93d9fda3b3d167d2d30bd07d4c207"><code>0d2a587</code></a>
docs(sponsors): add <code>FUNDING.yml</code></li>
<li><a
href="https://github.com/oapi-codegen/nullable/commit/07848389862fa8b98e3b5a6a4f119ad8a6042261"><code>0784838</code></a>
chore: onboard to Renovate</li>
<li>See full diff in <a
href="https://github.com/oapi-codegen/nullable/compare/v1.1.0...v1.2.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/andybalholm/brotli` from 1.2.1 to 1.2.2
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/andybalholm/brotli/commit/785aba538b2118979d2c573eccb287c4da157faf"><code>785aba5</code></a>
reuse hgroups</li>
<li><a
href="https://github.com/andybalholm/brotli/commit/b797a3535cbdd227ce3520cb0dfe01d83c2eeda9"><code>b797a35</code></a>
reuse block_type_trees</li>
<li>See full diff in <a
href="https://github.com/andybalholm/brotli/compare/v1.2.1...v1.2.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/oapi-codegen/nullable` from 1.1.0 to 1.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oapi-codegen/nullable/releases">github.com/oapi-codegen/nullable's
releases</a>.</em></p>
<blockquote>
<h2>New getter function</h2>
<h2>🚀 New features and improvements</h2>
<ul>
<li>feat: new method for fetching ignoring error (<a
href="https://redirect.github.com/oapi-codegen/nullable/issues/13">#13</a>)
<a href="https://github.com/lzap"><code>@​lzap</code></a></li>
</ul>
<p>There is now a <code>GetOrEmpty()</code> on <code>Nullable</code>
which will return the wrapped value if it's available, or it will create
a new zerovalue if <code>Nullable</code> is uninitialized, or
initialized to <code>nil</code>.</p>
<h2>📝 Documentation updates</h2>
<ul>
<li>docs(sponsors): add <code>FUNDING.yml</code> (<a
href="https://redirect.github.com/oapi-codegen/nullable/issues/9">#9</a>)
<a
href="https://github.com/jamietanna"><code>@​jamietanna</code></a></li>
</ul>
<h2>✍ Other changes</h2>
<ul>
<li>Update CI config (<a
href="https://redirect.github.com/oapi-codegen/nullable/issues/33">#33</a>)
<a
href="https://github.com/mromaszewicz"><code>@​mromaszewicz</code></a></li>
<li>chore: onboard to Renovate (<a
href="https://redirect.github.com/oapi-codegen/nullable/issues/5">#5</a>)
<a
href="https://github.com/jamietanna"><code>@​jamietanna</code></a></li>
</ul>
<h2>📦 Dependency updates</h2>
<ul>
<li>chore(deps): pin dependencies (<a
href="https://redirect.github.com/oapi-codegen/nullable/issues/16">#16</a>)
<a href="https://github.com/renovate"><code>@​renovate</code></a></li>
</ul>
<h2>Sponsors</h2>
<p>We would like to thank our sponsors for their support during this
release.</p>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oapi-codegen/nullable/commit/e4ef9c9376e8af534ae6fcc8b87f00a024cb645d"><code>e4ef9c9</code></a>
Merge pull request <a
href="https://redirect.github.com/oapi-codegen/nullable/issues/33">#33</a>
from oapi-codegen/chore/ci</li>
<li><a
href="https://github.com/oapi-codegen/nullable/commit/486afb97c1e3118fe099d133bdf5bc201c6bd4b9"><code>486afb9</code></a>
Update CI settings</li>
<li><a
href="https://github.com/oapi-codegen/nullable/commit/e5788251282d58f34bea50ecdb08c9469f4f15a2"><code>e578825</code></a>
Merge pull request <a
href="https://redirect.github.com/oapi-codegen/nullable/issues/13">#13</a>
from lzap/dig1</li>
<li><a
href="https://github.com/oapi-codegen/nullable/commit/6fde78b67c1bee57577b65b8a82f269d3221b261"><code>6fde78b</code></a>
feat: new method for fetching ignoring error</li>
<li><a
href="https://github.com/oapi-codegen/nullable/commit/55520a653f276b120fde6a9bc7bbaf5eeaa15134"><code>55520a6</code></a>
chore(deps): pin dependencies</li>
<li><a
href="https://github.com/oapi-codegen/nullable/commit/0d2a587518c93d9fda3b3d167d2d30bd07d4c207"><code>0d2a587</code></a>
docs(sponsors): add <code>FUNDING.yml</code></li>
<li><a
href="https://github.com/oapi-codegen/nullable/commit/07848389862fa8b98e3b5a6a4f119ad8a6042261"><code>0784838</code></a>
chore: onboard to Renovate</li>
<li>See full diff in <a
href="https://github.com/oapi-codegen/nullable/compare/v1.1.0...v1.2.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 apps/cli-go/go.mod     | 4 ++--
 apps/cli-go/go.sum     | 8 ++++----
 apps/cli-go/pkg/go.mod | 4 ++--
 apps/cli-go/pkg/go.sum | 8 ++++----
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/apps/cli-go/go.mod b/apps/cli-go/go.mod
index 4eae3aa6cb..4bc46b5d07 100644
--- a/apps/cli-go/go.mod
+++ b/apps/cli-go/go.mod
@@ -5,7 +5,7 @@ go 1.25.5
 require (
 	github.com/BurntSushi/toml v1.6.0
 	github.com/Netflix/go-env v0.1.2
-	github.com/andybalholm/brotli v1.2.1
+	github.com/andybalholm/brotli v1.2.2
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/charmbracelet/bubbles v1.0.0
 	github.com/charmbracelet/bubbletea v1.3.10
@@ -40,7 +40,7 @@ require (
 	github.com/mithrandie/csvq-driver v1.7.0
 	github.com/muesli/reflow v0.3.0
 	github.com/multigres/multigres v0.0.0-20260126223308-f5a52171bbc4
-	github.com/oapi-codegen/nullable v1.1.0
+	github.com/oapi-codegen/nullable v1.2.0
 	github.com/olekukonko/tablewriter v1.1.4
 	github.com/posthog/posthog-go v1.16.1
 	github.com/spf13/afero v1.15.0
diff --git a/apps/cli-go/go.sum b/apps/cli-go/go.sum
index ba611b836c..e8ed2f0f72 100644
--- a/apps/cli-go/go.sum
+++ b/apps/cli-go/go.sum
@@ -70,8 +70,8 @@ github.com/alingse/nilnesserr v0.2.0 h1:raLem5KG7EFVb4UIDAXgrv3N2JIaffeKNtcEXkEW
 github.com/alingse/nilnesserr v0.2.0/go.mod h1:1xJPrXonEtX7wyTq8Dytns5P2hNzoWymVUIaKm4HNFg=
 github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 h1:aM1rlcoLz8y5B2r4tTLMiVTrMtpfY0O8EScKJxaSaEc=
 github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092/go.mod h1:rYqSE9HbjzpHTI74vwPvae4ZVYZd1lue2ta6xHPdblA=
-github.com/andybalholm/brotli v1.2.1 h1:R+f5xP285VArJDRgowrfb9DqL18yVK0gKAW/F+eTWro=
-github.com/andybalholm/brotli v1.2.1/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
+github.com/andybalholm/brotli v1.2.2 h1:HzTuoo2ErYQqf5qvcJInB8uvqSVxRttzkFexPWtnceM=
+github.com/andybalholm/brotli v1.2.2/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/apapsch/go-jsonmerge/v2 v2.0.0 h1:axGnT1gRIfimI7gJifB699GoE/oq+F2MU7Dml6nw9rQ=
@@ -861,8 +861,8 @@ github.com/nunnatsa/ginkgolinter v0.19.1/go.mod h1:jkQ3naZDmxaZMXPWaS9rblH+i+GWX
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/oapi-codegen/nullable v1.1.0 h1:eAh8JVc5430VtYVnq00Hrbpag9PFRGWLjxR1/3KntMs=
-github.com/oapi-codegen/nullable v1.1.0/go.mod h1:KUZ3vUzkmEKY90ksAmit2+5juDIhIZhfDl+0PwOQlFY=
+github.com/oapi-codegen/nullable v1.2.0 h1:VflFkDW980KhBPiFF7nWSyjg+r4Obqj8lXipV0UkP5w=
+github.com/oapi-codegen/nullable v1.2.0/go.mod h1:KUZ3vUzkmEKY90ksAmit2+5juDIhIZhfDl+0PwOQlFY=
 github.com/oapi-codegen/oapi-codegen/v2 v2.4.1 h1:ykgG34472DWey7TSjd8vIfNykXgjOgYJZoQbKfEeY/Q=
 github.com/oapi-codegen/oapi-codegen/v2 v2.4.1/go.mod h1:N5+lY1tiTDV3V1BeHtOxeWXHoPVeApvsvjJqegfoaz8=
 github.com/oapi-codegen/runtime v1.4.2 h1:GMxFVYLzoYLua+/KvzgSphkyK1lLTReQI9Vf4hvATKE=
diff --git a/apps/cli-go/pkg/go.mod b/apps/cli-go/pkg/go.mod
index e1bb10f8ca..3de3c61ae8 100644
--- a/apps/cli-go/pkg/go.mod
+++ b/apps/cli-go/pkg/go.mod
@@ -4,7 +4,7 @@ go 1.25.0
 
 require (
 	github.com/BurntSushi/toml v1.6.0
-	github.com/andybalholm/brotli v1.2.1
+	github.com/andybalholm/brotli v1.2.2
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/docker/go-units v0.5.0
 	github.com/ecies/go/v2 v2.0.11
@@ -19,7 +19,7 @@ require (
 	github.com/jackc/pgtype v1.14.4
 	github.com/jackc/pgx/v4 v4.18.3
 	github.com/joho/godotenv v1.5.1
-	github.com/oapi-codegen/nullable v1.1.0
+	github.com/oapi-codegen/nullable v1.2.0
 	github.com/oapi-codegen/runtime v1.4.2
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/viper v1.21.0
diff --git a/apps/cli-go/pkg/go.sum b/apps/cli-go/pkg/go.sum
index f34fbaeeef..8394b09a98 100644
--- a/apps/cli-go/pkg/go.sum
+++ b/apps/cli-go/pkg/go.sum
@@ -3,8 +3,8 @@ github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk
 github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
 github.com/RaveNoX/go-jsoncommentstrip v1.0.0/go.mod h1:78ihd09MekBnJnxpICcwzCMzGrKSKYe4AqU6PDYYpjk=
-github.com/andybalholm/brotli v1.2.1 h1:R+f5xP285VArJDRgowrfb9DqL18yVK0gKAW/F+eTWro=
-github.com/andybalholm/brotli v1.2.1/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
+github.com/andybalholm/brotli v1.2.2 h1:HzTuoo2ErYQqf5qvcJInB8uvqSVxRttzkFexPWtnceM=
+github.com/andybalholm/brotli v1.2.2/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/apapsch/go-jsonmerge/v2 v2.0.0 h1:axGnT1gRIfimI7gJifB699GoE/oq+F2MU7Dml6nw9rQ=
 github.com/apapsch/go-jsonmerge/v2 v2.0.0/go.mod h1:lvDnEdqiQrp0O42VQGgmlKpxL1AP2+08jFMw88y4klk=
 github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w=
@@ -130,8 +130,8 @@ github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hd
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/nbio/st v0.0.0-20140626010706-e9e8d9816f32 h1:W6apQkHrMkS0Muv8G/TipAy/FJl/rCYT0+EuS8+Z0z4=
 github.com/nbio/st v0.0.0-20140626010706-e9e8d9816f32/go.mod h1:9wM+0iRr9ahx58uYLpLIr5fm8diHn0JbqRycJi6w0Ms=
-github.com/oapi-codegen/nullable v1.1.0 h1:eAh8JVc5430VtYVnq00Hrbpag9PFRGWLjxR1/3KntMs=
-github.com/oapi-codegen/nullable v1.1.0/go.mod h1:KUZ3vUzkmEKY90ksAmit2+5juDIhIZhfDl+0PwOQlFY=
+github.com/oapi-codegen/nullable v1.2.0 h1:VflFkDW980KhBPiFF7nWSyjg+r4Obqj8lXipV0UkP5w=
+github.com/oapi-codegen/nullable v1.2.0/go.mod h1:KUZ3vUzkmEKY90ksAmit2+5juDIhIZhfDl+0PwOQlFY=
 github.com/oapi-codegen/runtime v1.4.2 h1:GMxFVYLzoYLua+/KvzgSphkyK1lLTReQI9Vf4hvATKE=
 github.com/oapi-codegen/runtime v1.4.2/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=

From d879cf83ce1b9f074bcfa2380532a730b4387802 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 30 Jun 2026 00:11:34 +0000
Subject: [PATCH 23/29] chore(deps): bump the npm-major group with 4 updates
 (#5731)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the npm-major group with 4 updates:
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript),
[@swc/core](https://github.com/swc-project/swc/tree/HEAD/packages/core),
[@typescript/native-preview](https://github.com/microsoft/typescript-go)
and [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt).

Updates `@anthropic-ai/claude-agent-sdk` from 0.3.185 to 0.3.186
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@​anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.186</h2>
<h2>What's changed</h2>
<ul>
<li>Added <code>agent_id</code> field to <code>can_use_tool</code>
control requests — background agents now forward permission prompts to
<code>canUseTool</code> instead of auto-denying, and stdin stays open
while background tasks are running</li>
<li>Added <code>ReadMcpResourceDirTool</code> tool type to SDK schemas —
MCP resource directory listing is now a dedicated tool instead of a
fallback inside <code>ReadMcpResourceTool</code></li>
<li>Added <code>rewind_conversation</code> control request for rewinding
a conversation to a previous point with durable resume anchor
support</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.186
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.186
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.186
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.186
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@​anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.186</h2>
<ul>
<li>Added <code>agent_id</code> field to <code>can_use_tool</code>
control requests — background agents now forward permission prompts to
<code>canUseTool</code> instead of auto-denying, and stdin stays open
while background tasks are running</li>
<li>Added <code>ReadMcpResourceDirTool</code> tool type to SDK schemas —
MCP resource directory listing is now a dedicated tool instead of a
fallback inside <code>ReadMcpResourceTool</code></li>
<li>Added <code>rewind_conversation</code> control request for rewinding
a conversation to a previous point with durable resume anchor
support</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/42f6772cbaa694b27f78f8b435ef87cb95882f3f"><code>42f6772</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.185...v0.3.186">compare
view</a></li>
</ul>
</details>
<br />

Updates `@swc/core` from 1.15.41 to 1.15.43
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/swc-project/swc/blob/main/CHANGELOG.md">@​swc/core's
changelog</a>.</em></p>
<blockquote>
<h2>[1.15.43] - 2026-06-22</h2>
<h3>Bug Fixes</h3>
<ul>
<li>
<p><strong>(es/es2022)</strong> Correct scope for private property brand
checks (<a
href="https://redirect.github.com/swc-project/swc/issues/11953">#11953</a>)
(<a
href="https://github.com/swc-project/swc/commit/fb5afa22796439b41a0b261b6a4823cab0dcc8df">fb5afa2</a>)</p>
</li>
<li>
<p><strong>(es/minifier)</strong> Preserve <code>cooked</code> when
concatenating template literals (<a
href="https://redirect.github.com/swc-project/swc/issues/11939">#11939</a>)
(<a
href="https://github.com/swc-project/swc/commit/a7244a65e2dcb28f20ab6d747fd782d02a8eebf9">a7244a6</a>)</p>
</li>
<li>
<p><strong>(es/minifier)</strong> Gate Number(x) -&gt; +x on unsafe flag
(<a
href="https://redirect.github.com/swc-project/swc/issues/11944">#11944</a>)
(<a
href="https://redirect.github.com/swc-project/swc/issues/11949">#11949</a>)
(<a
href="https://github.com/swc-project/swc/commit/617601978a4090cde8c0dd900c079cc7eb64b642">6176019</a>)</p>
</li>
<li>
<p><strong>(es/parser)</strong> Parse Flow bare renders types (<a
href="https://redirect.github.com/swc-project/swc/issues/11929">#11929</a>)
(<a
href="https://github.com/swc-project/swc/commit/a71c8eba7b0ef4280b8866cd8e6eebc5be10f0dc">a71c8eb</a>)</p>
</li>
<li>
<p><strong>(es/parser)</strong> Allow no-default builds (<a
href="https://redirect.github.com/swc-project/swc/issues/11956">#11956</a>)
(<a
href="https://github.com/swc-project/swc/commit/baab240500b8d7329fabfb3ec936ba62b59742db">baab240</a>)</p>
</li>
<li>
<p><strong>(es/react-compiler)</strong> Skip TypeScript
<code>this</code> pseudo-params in scope collector (<a
href="https://redirect.github.com/swc-project/swc/issues/11940">#11940</a>)
(<a
href="https://github.com/swc-project/swc/commit/9066c4319a8c4e8bf9dc97885d2d7ff3a26cf79f">9066c43</a>)</p>
</li>
<li>
<p><strong>(es/react-compiler)</strong> Scope ClassStaticBlock and
TsModuleBlock as var boundaries (<a
href="https://redirect.github.com/swc-project/swc/issues/11943">#11943</a>)
(<a
href="https://github.com/swc-project/swc/commit/1ee74a0cc5938a720e106221374c0d894396a16d">1ee74a0</a>)</p>
</li>
<li>
<p><strong>(react-compiler)</strong> Avoid reporting non-fatal success
errors as diagnostics (<a
href="https://redirect.github.com/swc-project/swc/issues/11951">#11951</a>)
(<a
href="https://github.com/swc-project/swc/commit/cb4cb230ec473cb42ccd27dc8d20702ccb24e653">cb4cb23</a>)</p>
</li>
<li>
<p><strong>(react-compiler)</strong> React compiler AST conversion for
wrapped assignment targets (<a
href="https://redirect.github.com/swc-project/swc/issues/11952">#11952</a>)
(<a
href="https://github.com/swc-project/swc/commit/fc9b4537a0e4adf8bce0f8834b7805a75a448a5b">fc9b453</a>)</p>
</li>
<li>
<p><strong>(react-compiler)</strong> Disable parser default features (<a
href="https://redirect.github.com/swc-project/swc/issues/11957">#11957</a>)
(<a
href="https://github.com/swc-project/swc/commit/75ddb28bceb2c88ea5f0aaa21e19d4f83f4ae5c7">75ddb28</a>)</p>
</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document untrusted input security scope (<a
href="https://redirect.github.com/swc-project/swc/issues/11937">#11937</a>)
(<a
href="https://github.com/swc-project/swc/commit/677305b6fb204d5ffd391616f3e091c5c190893a">677305b</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>
<p><strong>(es/react-compiler)</strong> Add React Compiler (<a
href="https://redirect.github.com/swc-project/swc/issues/11917">#11917</a>)
(<a
href="https://github.com/swc-project/swc/commit/b182fbd5bc0336f33ac1dec4ca0027d5b25ce1e3">b182fbd</a>)</p>
</li>
<li>
<p><strong>(swc)</strong> Gate react compiler re-export (<a
href="https://redirect.github.com/swc-project/swc/issues/11941">#11941</a>)
(<a
href="https://github.com/swc-project/swc/commit/dcc0f2d0c5c5b68656065277b0b84572286693a5">dcc0f2d</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/swc-project/swc/commit/73f0f386da64fe432975183f9ccf28429b52638a"><code>73f0f38</code></a>
chore: Publish <code>1.15.43</code> with <code>swc_core</code>
<code>v71.0.3</code></li>
<li><a
href="https://github.com/swc-project/swc/commit/550e53919b7842d9d658e98c93bf7b3302a774c7"><code>550e539</code></a>
chore: Publish <code>1.15.43-nightly-20260622.1</code> with
<code>swc_core</code> <code>v71.0.3</code></li>
<li><a
href="https://github.com/swc-project/swc/commit/1523823214dfcbf266de67183ffbfd8bb2768bcb"><code>1523823</code></a>
chore: Publish <code>1.15.42-nightly-20260622.1</code> with
<code>swc_core</code> <code>v71.0.2</code></li>
<li><a
href="https://github.com/swc-project/swc/commit/0dffdc4998a5b8605de8f07fb0518bc60495a931"><code>0dffdc4</code></a>
refactor: Remove production tracing hooks (<a
href="https://github.com/swc-project/swc/tree/HEAD/packages/core/issues/11945">#11945</a>)</li>
<li><a
href="https://github.com/swc-project/swc/commit/b182fbd5bc0336f33ac1dec4ca0027d5b25ce1e3"><code>b182fbd</code></a>
feat(es/react-compiler): Add React Compiler (<a
href="https://github.com/swc-project/swc/tree/HEAD/packages/core/issues/11917">#11917</a>)</li>
<li>See full diff in <a
href="https://github.com/swc-project/swc/commits/v1.15.43/packages/core">compare
view</a></li>
</ul>
</details>
<br />

Updates `@typescript/native-preview` from 7.0.0-dev.20260621.1 to
7.0.0-dev.20260622.1
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/microsoft/typescript-go/commits">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxfmt` from 0.55.0 to 0.56.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md">oxfmt's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this package will be documented in this
file.</p>
<p>The format is based on <a
href="https://keepachangelog.com/en/1.0.0">Keep a Changelog</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/c4be770f24adc4026efa96fb82182f743c55e423"><code>c4be770</code></a>
release(apps): oxlint v1.71.0 &amp;&amp; oxfmt v0.56.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/23707">#23707</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/oxfmt_v0.56.0/npm/oxfmt">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 apps/cli/package.json |   2 +-
 pnpm-lock.yaml        | 470 +++++++++++++++++++++---------------------
 pnpm-workspace.yaml   |   6 +-
 3 files changed, 239 insertions(+), 239 deletions(-)

diff --git a/apps/cli/package.json b/apps/cli/package.json
index f51449eba8..876835b92b 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -42,7 +42,7 @@
     "jose": "^6.2.3"
   },
   "devDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.185",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.186",
     "@anthropic-ai/sdk": "^0.105.0",
     "@clack/prompts": "^1.6.0",
     "@effect/atom-react": "catalog:",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1e7abb68bc..346813dc25 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -28,8 +28,8 @@ catalogs:
       specifier: ^1.10.9
       version: 1.11.1
     '@swc/core':
-      specifier: ^1.15.41
-      version: 1.15.41
+      specifier: ^1.15.43
+      version: 1.15.43
     '@tsconfig/bun':
       specifier: ^1.0.10
       version: 1.0.10
@@ -37,8 +37,8 @@ catalogs:
       specifier: ^1.3.14
       version: 1.3.14
     '@typescript/native-preview':
-      specifier: 7.0.0-dev.20260621.1
-      version: 7.0.0-dev.20260621.1
+      specifier: 7.0.0-dev.20260622.1
+      version: 7.0.0-dev.20260622.1
     '@vitest/coverage-istanbul':
       specifier: ^4.1.9
       version: 4.1.9
@@ -52,8 +52,8 @@ catalogs:
       specifier: ^23.0.0
       version: 23.0.0
     oxfmt:
-      specifier: ^0.55.0
-      version: 0.55.0
+      specifier: ^0.56.0
+      version: 0.56.0
     oxlint:
       specifier: ^1.70.0
       version: 1.71.0
@@ -73,13 +73,13 @@ importers:
     devDependencies:
       '@swc-node/register':
         specifier: 'catalog:'
-        version: 1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3)
+        version: 1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3)
       '@swc/core':
         specifier: 'catalog:'
-        version: 1.15.41
+        version: 1.15.43
       nx:
         specifier: 'catalog:'
-        version: 23.0.0(@swc-node/register@1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.41)
+        version: 23.0.0(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.43)
       pkg-pr-new:
         specifier: 0.0.75
         version: 0.0.75
@@ -94,8 +94,8 @@ importers:
         version: 6.2.3
     devDependencies:
       '@anthropic-ai/claude-agent-sdk':
-        specifier: ^0.3.185
-        version: 0.3.185(@anthropic-ai/sdk@0.105.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(zod@4.4.3)
+        specifier: ^0.3.186
+        version: 0.3.186(@anthropic-ai/sdk@0.105.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(zod@4.4.3)
       '@anthropic-ai/sdk':
         specifier: ^0.105.0
         version: 0.105.0(zod@4.4.3)
@@ -152,7 +152,7 @@ importers:
         version: 19.2.17
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260621.1
+        version: 7.0.0-dev.20260622.1
       '@vercel/detect-agent':
         specifier: ^1.2.3
         version: 1.2.3
@@ -179,7 +179,7 @@ importers:
         version: 6.23.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.55.0
+        version: 0.56.0
       oxlint:
         specifier: 'catalog:'
         version: 1.71.0(oxlint-tsgolint@0.23.0)
@@ -256,7 +256,7 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260621.1
+        version: 7.0.0-dev.20260622.1
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
         version: 4.1.9(vitest@4.1.9)
@@ -265,7 +265,7 @@ importers:
         version: 6.23.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.55.0
+        version: 0.56.0
       oxlint:
         specifier: 'catalog:'
         version: 1.71.0(oxlint-tsgolint@0.23.0)
@@ -336,7 +336,7 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260621.1
+        version: 7.0.0-dev.20260622.1
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
         version: 4.1.9(vitest@4.1.9)
@@ -345,7 +345,7 @@ importers:
         version: 6.23.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.55.0
+        version: 0.56.0
       oxlint:
         specifier: 'catalog:'
         version: 1.71.0(oxlint-tsgolint@0.23.0)
@@ -378,7 +378,7 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260621.1
+        version: 7.0.0-dev.20260622.1
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
         version: 4.1.9(vitest@4.1.9)
@@ -387,7 +387,7 @@ importers:
         version: 6.23.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.55.0
+        version: 0.56.0
       oxlint:
         specifier: 'catalog:'
         version: 1.71.0(oxlint-tsgolint@0.23.0)
@@ -428,7 +428,7 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260621.1
+        version: 7.0.0-dev.20260622.1
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
         version: 4.1.9(vitest@4.1.9)
@@ -437,7 +437,7 @@ importers:
         version: 6.23.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.55.0
+        version: 0.56.0
       oxlint:
         specifier: 'catalog:'
         version: 1.71.0(oxlint-tsgolint@0.23.0)
@@ -468,7 +468,7 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260621.1
+        version: 7.0.0-dev.20260622.1
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
         version: 4.1.9(vitest@4.1.9)
@@ -477,7 +477,7 @@ importers:
         version: 6.23.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.55.0
+        version: 0.56.0
       oxlint:
         specifier: 'catalog:'
         version: 1.71.0(oxlint-tsgolint@0.23.0)
@@ -520,7 +520,7 @@ importers:
         version: 1.3.14
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260621.1
+        version: 7.0.0-dev.20260622.1
       '@vitest/coverage-istanbul':
         specifier: 'catalog:'
         version: 4.1.9(vitest@4.1.9)
@@ -529,7 +529,7 @@ importers:
         version: 6.23.0
       oxfmt:
         specifier: 'catalog:'
-        version: 0.55.0
+        version: 0.56.0
       oxlint:
         specifier: 'catalog:'
         version: 1.71.0(oxlint-tsgolint@0.23.0)
@@ -544,7 +544,7 @@ importers:
     dependencies:
       '@nx/devkit':
         specifier: 'catalog:'
-        version: 23.0.1(nx@23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.41))
+        version: 23.0.1(nx@23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.43))
       vitest:
         specifier: 'catalog:'
         version: 4.1.9(@types/node@26.0.1)(@vitest/coverage-istanbul@4.1.9)(vite@8.0.14(@types/node@26.0.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
@@ -567,52 +567,52 @@ packages:
     resolution: {integrity: sha512-p+CMKJ93HFmLkjXKlXiVGlMQEuRb6H0MokBSwUsX+S6BRX8eV5naFZpQJFfJHjRZY0Hmnqy1/r6UWl3x+19zYA==}
     engines: {node: '>=18'}
 
-  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.185':
-    resolution: {integrity: sha512-P2Svxx1IFrS9aw4ylJBtcoJrc/OAOVnDs+o05x4TV7HoHUQUcKZ9XhWOGnadyVT0KLyoktgjyjnaK7Zdtc0Ldg==}
+  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.186':
+    resolution: {integrity: sha512-xHlzB+61OJkLhrc5QJXVlpldwM9IXJAiQ7cCxWj9o0qu165eYtsGaAaWg9X9NAc9IWhtAdXXNpNSuiZNc+OzWw==}
     cpu: [arm64]
     os: [darwin]
 
-  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.185':
-    resolution: {integrity: sha512-H69m2hIJawzSkCDNO/CPLQCYvDGdlbZdzGTgGF8/IQuB4O81sv8WSAh6TBXwtFXOgEi4HtrUYlxiFDmTHt7hMA==}
+  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.186':
+    resolution: {integrity: sha512-+TJSWfoifLLW+7EEbvE4TIHbCj39PL8zEhL1gUudWQjLAgKxWeti+3h4FRDhPI1B/Uwz1eh/eY430od0iMXjfw==}
     cpu: [x64]
     os: [darwin]
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.185':
-    resolution: {integrity: sha512-1GRpKYrg5foomW+qLrxm/k2R/5PEU7RAuEdX65HV6lFMJR3HsGj8qfBq4KCJHTS3r4YdVrFLvPQ/mUqbY6klIA==}
+  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.186':
+    resolution: {integrity: sha512-pLEaVXulWqHHEgfTwK/5EILSlxXMN5tRA54Ff0tRmEP/FGye8WhLMYrUqg8TSsM2e1bJSszRbyyJSK10xr9Qtg==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.185':
-    resolution: {integrity: sha512-KtXMCoprGYTSPb/A0/kjrO+PpDJAFbHhDd8rjqA4izU51OYjTDkahsGCcSTFM2jA8krOhPqzx/SNVuAVWmexwA==}
+  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.186':
+    resolution: {integrity: sha512-bkWmXR3PWcBTrAWAhmJn7+7/ONq/5sIEDe30D6a76qx6Xn8sZICmy9GrbUJec0Mb+XVifcS8LnLjP/Z5GzMc/g==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.185':
-    resolution: {integrity: sha512-YAky0Oez+YYrlcas/xDiaCm9AUX0z1YwM+pnk+CFxEr/ICmc7MbiFsnEIXFLPHaox9bE5iOzw4LS4b/c1tIJRg==}
+  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.186':
+    resolution: {integrity: sha512-Zg7htykMkMdQC/00UOPn/gnRJRyDaoY0AeJnyXLUByKEUd0ARshpQEadoJoAS6D//6CscffWaSTsX2ePSvl+aw==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.185':
-    resolution: {integrity: sha512-8U5wu6dNcyzRkwoae0Gu5ZHs6lRSu8CXqd9yrilX3fHR9kKICrm76bLu5q2auuSc/8dx6VL5ZXqSzFKIMp//zw==}
+  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.186':
+    resolution: {integrity: sha512-ARPQwIliHwypU5FQcq4Epi5ahmbSJt89Use5BgzxyeDyrIM3NgK/0c1IKp8DAiKPNntVXNT5R01TwoHdNI3oBA==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.185':
-    resolution: {integrity: sha512-pJEOaCLQQQWSyBeseR/GAn4eEp4WtMDP/o5yPMuuAsNWeoJXM7cY4j/N3KBE6GZofgnYdWEXILF2uw3SjbtINA==}
+  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.186':
+    resolution: {integrity: sha512-P/OMuYtKYlgGYs0wMTGCSo8gQfCETfA+0+lGGMAcPMH1xxOn24gjtQ/fLQKdaVh+0DLaSxjYm9W3Ln5jN6ALlQ==}
     cpu: [arm64]
     os: [win32]
 
-  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.185':
-    resolution: {integrity: sha512-/Kf9XneSuIkSHNwrxOVY0XT7RovAEcx5nDASKzku4994cZz54otU5mT2jT6dwevDLEStfgts5x/A4z0AePwVTQ==}
+  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.186':
+    resolution: {integrity: sha512-aiBJu0rhlU/gvUsNtwxjIoj377Wj+g3HqoUe6eihcLGbvsR0SE5KpQaYT/B7wspRILegwIM+iUV9K7145SW6sA==}
     cpu: [x64]
     os: [win32]
 
-  '@anthropic-ai/claude-agent-sdk@0.3.185':
-    resolution: {integrity: sha512-UDDd0cInvOufmR88btR/Ursnh71sb5scoutNlRS2L0LBdkt7JEqYJ0jt7DnOYHEVhMx8AAcg0eYgvXztcWUnFA==}
+  '@anthropic-ai/claude-agent-sdk@0.3.186':
+    resolution: {integrity: sha512-TbxhqYPDNluWL5C50pyHbUy2wWtwJs4iR8qQOxeVkRRTUWn3rdchzpSA8fLWiU+iyiyLDgxfPs6E79OWqrJ8Pw==}
     engines: {node: '>=18.0.0'}
     peerDependencies:
       '@anthropic-ai/sdk': '>=0.93.0'
@@ -1872,124 +1872,124 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@oxfmt/binding-android-arm-eabi@0.55.0':
-    resolution: {integrity: sha512-+rFDOqQe5LOWgxrAJaZgLRudr6GQm0wGI6gtu7vVkrdLGjNMUSGbAlaCr8j7F2H2Er97vYQCU8WDb30onqMM1g==}
+  '@oxfmt/binding-android-arm-eabi@0.56.0':
+    resolution: {integrity: sha512-CSCxi7ovYojgfdPOdUb9T508HKeAdDIKeRGg7x8IZwVJrWz9gVgX7MbUnFqtQAE4QvoNo07mj2JlwnOzJw4qqA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxfmt/binding-android-arm64@0.55.0':
-    resolution: {integrity: sha512-ctulLq8s3x8Zmvw6+iccB09TIKERAklRSmbJ10gk8mlAn05qZxoyo52dj3Hi9IJcmDSwF54fQaTVh2CbL6PInw==}
+  '@oxfmt/binding-android-arm64@0.56.0':
+    resolution: {integrity: sha512-HYJFnd+PkDwf6S9ZPGzXXtjNqvRWFnnhdbWaouh4mi/SxU8wmDuzlMn3xo/wDTGnr4Q1VA7ZzOaE/D4biW0W6A==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxfmt/binding-darwin-arm64@0.55.0':
-    resolution: {integrity: sha512-xDQczLH9pw/RBk1h/GH0qcGMm8hQtmtVHBNLSH3lk1gEIR09hZ4L+mJQl4VqiVAvPK9VG9PYrWWuSQLt7xTbiA==}
+  '@oxfmt/binding-darwin-arm64@0.56.0':
+    resolution: {integrity: sha512-sftR/bEOr+t1gs+evwsHi/Xbq2FAPA2uU3VMr8n6ZU9PoK/IMSfnfu7+OEe/uy1+knhrFl4Wvy7Vkm3uo9mJ7g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxfmt/binding-darwin-x64@0.55.0':
-    resolution: {integrity: sha512-JaNoFCkF2CJdGgpPSMbuO9HVyXyoNGIhMHPvp6NYAjeVKw9XEYc0HcUWJLPQa3Q69WV5wMa9m5jPMJPtbLtcRg==}
+  '@oxfmt/binding-darwin-x64@0.56.0':
+    resolution: {integrity: sha512-z66SdjLqa3MUPKvTp3Mbb5nSjKSbnYxJGeB+Wx987s8T5hPcIRiBMfnJ6zcPgYtQn3x5xjvdzNVkXrSeYH6ZFg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxfmt/binding-freebsd-x64@0.55.0':
-    resolution: {integrity: sha512-DNbszhpg6S2MIzax5azdHFTTBIVkR5xr8yyRZuA4yoDAwOkzIp3tmldgKZM2+VlT+hJIG0xUksA+elISzMEAfA==}
+  '@oxfmt/binding-freebsd-x64@0.56.0':
+    resolution: {integrity: sha512-t2tkrV1vtZyaItSQ71dTi2ZVKZEI39b/LqLT12V5KMfIeXK6N32TUC1jhOXKVQmhECq9j2ZXMQV3JeT1kh9Vmg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.55.0':
-    resolution: {integrity: sha512-2snoaoRfFFyGnbOcKUK36rREBYxe/Xgz3uHbiA5zbCB/s6R4DQj4mHqYAaWWhgizCUSDxV8cE9zAZ0XleNpKGw==}
+  '@oxfmt/binding-linux-arm-gnueabihf@0.56.0':
+    resolution: {integrity: sha512-+gCy+Tp3RHeXQ9y/QrS76lXIpZkbziTyp6hIgjB2MssCwfMph3vG/GEfkhO34Rai1vhYIaUkvv8UT1BcDorJPw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.55.0':
-    resolution: {integrity: sha512-q1aktHF/WRpSK81BX1dE/9vWrS2jGw1Nax2kb4DBLGAewubCLcoNyp4Zl/NSMgbv3vUS46Z33wIQkBVYOP3PYg==}
+  '@oxfmt/binding-linux-arm-musleabihf@0.56.0':
+    resolution: {integrity: sha512-0kKkVvQ2I+FJ2sxQyUu1zJ0yWP5kcWse/yVFnGQSFCXMwSSkfEaUGu0dW774O7nyy3jrcBGap7OSc8dZmU/CdA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm64-gnu@0.55.0':
-    resolution: {integrity: sha512-VD0y36aENezl/3tsclA/4G53Cc7iV+7Uoh7gz4yvcOTaEYBtJpQsE6PKDGTtUtOvGS4kv51ybfXY/nWZejO5IA==}
+  '@oxfmt/binding-linux-arm64-gnu@0.56.0':
+    resolution: {integrity: sha512-npkA2siMbyWRh+wEhi1aTAx4RirukGcGNt8V4Ch86pG+xU9aurqS1MZOnKYMu03ISwat3rB6zkQx51SsB9obNw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-arm64-musl@0.55.0':
-    resolution: {integrity: sha512-r8xlKJFcsRmn0H5jZrdORae6RX9jDBrZVvOoxF+bCQtampQJClv80aZEHsv+NsLsp2KCE5ql79O7DpPVzYWpXA==}
+  '@oxfmt/binding-linux-arm64-musl@0.56.0':
+    resolution: {integrity: sha512-UekqOjGkV4/MkqreCV9SPIB2jlR3/HbXrmhV1rVXJZ9wfDXMyCMriLtq3tHqLY4PkbVWNtfcm1kMojJ26KLSJw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.55.0':
-    resolution: {integrity: sha512-GRKv/HXHcwIVld/WU61rF0g0R16hl5EJ+ScKdpjevT57lnLnagj/U2YUbXf2mT+2Pg1uCzWC+mvGicPV3CDdLQ==}
+  '@oxfmt/binding-linux-ppc64-gnu@0.56.0':
+    resolution: {integrity: sha512-XSzveSpeZMD5XJpew5lRFVtNnT04xd3rJxENXmk7wkZzN9oWzv2aFJyoNDhOtoz69BYaS/fg4SYl+CfEZRpB0Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.55.0':
-    resolution: {integrity: sha512-rdv57enTiPtpSYRMKfAiEbQb0Puw5t9N7isVinDoo5qeLDScro2gznmZqSgSWbVZRzLisTeCTW8Qwgw0bOHv3A==}
+  '@oxfmt/binding-linux-riscv64-gnu@0.56.0':
+    resolution: {integrity: sha512-EkQ0nJa7k7HDDIVuPF7WY+k4k+bzdclLYtyIXNt7/OqVghfNiMym6YGppFBgx1XRIHW6QylxBz5OogumPjPJbQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-musl@0.55.0':
-    resolution: {integrity: sha512-7v1nNrlD43VY6+sYQ6efYyb3lE6QY182304PD/768ZxTjOmFd/3dQa3u/nGBUAXYdGSWOQc5N3PnS0QzUXyEIA==}
+  '@oxfmt/binding-linux-riscv64-musl@0.56.0':
+    resolution: {integrity: sha512-dyjAGW8jKRge0ik6U/dgvQG0nVpA3iBlRskQTz5qJLvQWIrySxX5jpqzPetLBNIIZ231KA82fDdi1nLTk8ENCw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-s390x-gnu@0.55.0':
-    resolution: {integrity: sha512-f4lJLUSPOgScjFl9LiflKCTocyNRwE25JmTMbN4XQdDjoZzEHjqf3wA3VESF1/csg7i8m7+EQLbrZyYDqe10UQ==}
+  '@oxfmt/binding-linux-s390x-gnu@0.56.0':
+    resolution: {integrity: sha512-60ZGH3LtfqlW8X6vcLdSFY4lvCQYINurttYBKaALnHCDVAUCYJ1LsUgS6p1XOzVlzEDx3yNUZvDF1Lvt59zoZw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-gnu@0.55.0':
-    resolution: {integrity: sha512-MihqiPziJNoWy4MqNSV+jVA1g+07iQDjZiR0vaCaDoPgFEiJpCMsxamktzLV07cEeQsSJ04vQaU4CzCQwIvtDA==}
+  '@oxfmt/binding-linux-x64-gnu@0.56.0':
+    resolution: {integrity: sha512-u1suj1tgJHK4ZqB7buCtdbNef2n8+d0lXTPJwLHNmtyK6p+DTpsaoDvmqhQrA56fgKYv4LuRxNtL8YooebKOew==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-musl@0.55.0':
-    resolution: {integrity: sha512-Yqghym7KYAVjP9MmSrNZiDeerMuoejNjo0r3ox5H3GDKk8eAfl8VyJm9i+pWCLDCTnAbcTUMMN2ZKjUYXH1v3g==}
+  '@oxfmt/binding-linux-x64-musl@0.56.0':
+    resolution: {integrity: sha512-aYGLvlQHt80y+qKEtfJY/Nm27G0125Lv+qyh9SJ4Cjc6lXnXjD+ndfhqQnbV24POpMi7rNRi0jvx/0d70FRpCQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-openharmony-arm64@0.55.0':
-    resolution: {integrity: sha512-s5SDvVVSbyQl1V5UU3Yl12M+XLUQ3rl5SglNqgAA2K4PXUtQhyNSS00wivONPEnNo5W01rCou8WkDNyvI/RGHg==}
+  '@oxfmt/binding-openharmony-arm64@0.56.0':
+    resolution: {integrity: sha512-H/re/gO+7ysVc+kywHNuzY3C33EN9sQcZhg0kp1ZwOZl7y998ZE5mhnBiuGR/nYI0pqLL5xQfrHVUOJ/cIJsCA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxfmt/binding-win32-arm64-msvc@0.55.0':
-    resolution: {integrity: sha512-7p9FB5R32tw2KyyNX3wpQrR2WHwEHvMEiBlGXxeTCaRMCVNx3UtFMAUbaQ/pRNWIrEUZmYhJ6tcUH52uPTRYjQ==}
+  '@oxfmt/binding-win32-arm64-msvc@0.56.0':
+    resolution: {integrity: sha512-6qLNXfXmtAs8jXDvYMkxk6Wec5SUJoew+ZX1uOZmqaR7ks0EJFbAohuOCELDyJMWyVlxotVG8Xf8m74Bfq0O2w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxfmt/binding-win32-ia32-msvc@0.55.0':
-    resolution: {integrity: sha512-ZYqj3fDnOT1IaVGMP5kpmkQl4F3tQIm2ZyAxvqkJYmI0xgWWak4ss4XYwv3VDfM+TWXeC9K4uQ/wW5jm/5XABA==}
+  '@oxfmt/binding-win32-ia32-msvc@0.56.0':
+    resolution: {integrity: sha512-UXEXuKphAe15bsob4AswNMArCw38XSmUIs3wk1s6e6MX9OWGW/IRWU95s1hZDiVg09STy1jHgyN2qkqbu1FT0w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxfmt/binding-win32-x64-msvc@0.55.0':
-    resolution: {integrity: sha512-eEYT5tivGnGbPHuOHuQpi6CGLObhh0re/5jcNQHihD2GRYkTM85dyi5a19zjP8Q00t1uqAx+/QGLUGdHeqzWyg==}
+  '@oxfmt/binding-win32-x64-msvc@0.56.0':
+    resolution: {integrity: sha512-HPyNDjky+NIOuaMvHZflR+kst3YWdUOH2JUQYkf99grqZ5mEBTQM6h9iGy501Z8Xt5xMScrwHOuVCOlqDrktRw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -2832,86 +2832,86 @@ packages:
   '@swc-node/sourcemap-support@0.6.1':
     resolution: {integrity: sha512-ovltDVH5QpdHXZkW138vG4+dgcNsxfwxHVoV6BtmTbz2KKl1A8ZSlbdtxzzfNjCjbpayda8Us9eMtcHobm38dA==}
 
-  '@swc/core-darwin-arm64@1.15.41':
-    resolution: {integrity: sha512-kREh6J5paQFvP3i7f/4FbqRNOJREutVFVOkder4GVyCBQ39YmER55cW/y1NNjwrchzFqgYswFn0mMDCqbqKzrw==}
+  '@swc/core-darwin-arm64@1.15.43':
+    resolution: {integrity: sha512-v1aVuvXdo/BHxJzco9V2xpHrvwWmhfS8t6gziY5wJxd+Z2h8AeJRnAwPD8itCDaGXVBwJ/CaKfxEzTkG0Va0OA==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [darwin]
 
-  '@swc/core-darwin-x64@1.15.41':
-    resolution: {integrity: sha512-N8B56ESFazZAWZyIkecADSPCwlLEinW7QLMEeotCpv4J7VXwfH+OLkmRL8o96UZ+1355fwHxDTS6/wK7yucvkA==}
+  '@swc/core-darwin-x64@1.15.43':
+    resolution: {integrity: sha512-lp3d4Lamc8dt5huYdGLSR+9hLxmfr1jb0l+4XXG2zPqZwYWRN9R0U2qYoTrggiU2RWW0oV9VbWM3kBnqIc2kdQ==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [darwin]
 
-  '@swc/core-linux-arm-gnueabihf@1.15.41':
-    resolution: {integrity: sha512-6XrId2fyle0mS5xxON8rU84mPd2Cq1kDJRj+4BnQKTd7u+2kSA6Ww+JkOP0iTNqOqt9OXhPOEAjBHAuonWcdCg==}
+  '@swc/core-linux-arm-gnueabihf@1.15.43':
+    resolution: {integrity: sha512-JWTQQELtsG5GgphDrr/XqqmM2pDN3cZqbMS0Mrg+iTiXL3F74sn/S2IyYE/5u4h2KLkTf9qQ7dXyxsbx7YzkeA==}
     engines: {node: '>=10'}
     cpu: [arm]
     os: [linux]
 
-  '@swc/core-linux-arm64-gnu@1.15.41':
-    resolution: {integrity: sha512-ynLIarxlkVnqHn1D0fKOVht6mNU5ks6lrH+MY3kkS+XFaGGgDxFZVjWKJlkYTKm3RCvBTfA8Ng5fLufXheMRKQ==}
+  '@swc/core-linux-arm64-gnu@1.15.43':
+    resolution: {integrity: sha512-B4otJRdPWIsmiSBf0uG7Z/+vMWmkufjz5MmYxubwKuZazDW14Zd3symga1N62QR4RT+kEFeHEgsXfZGyn/w0hw==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@swc/core-linux-arm64-musl@1.15.41':
-    resolution: {integrity: sha512-dXu/5vd4gh8symyhRF+4G7gOPkjmb4pONhh7sl+6GSiW0LOKZlfu5kXmyFbTz9smOT7jgr002qY9b1nujjXt2A==}
+  '@swc/core-linux-arm64-musl@1.15.43':
+    resolution: {integrity: sha512-6zB6OnpViBxYy4tgY3v2i6AZY9fwkcHZ032UOwtwUuW1d19sdT07qF0kZe6/3UR1tUaK6jjg2rmVcUIBCEYVjQ==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@swc/core-linux-ppc64-gnu@1.15.41':
-    resolution: {integrity: sha512-XGO6zVPXoPE0gf/XnI4jBbafNT13AYgoh6ns0JCSdOetI/kqVf0vhpz7NuNgAzZrMVCsmieqjPoTwViDgh4mOQ==}
+  '@swc/core-linux-ppc64-gnu@1.15.43':
+    resolution: {integrity: sha512-coxE1ZWdB3uSDVNoEtYNrRi/1epvckZx9cTJ8ICUxTMTxGk+yvQ/Twacp3ruZSaMPGCriUjP86C37VhaT6nyRg==}
     engines: {node: '>=10'}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@swc/core-linux-s390x-gnu@1.15.41':
-    resolution: {integrity: sha512-0WUglRwyZtW+iMi7J3iFdrCxreZZIKf4egTwEQfIYRsqFax69A0OrFj+NIoFSE03xBT/IFRrg+S8K6f9Ky+4hA==}
+  '@swc/core-linux-s390x-gnu@1.15.43':
+    resolution: {integrity: sha512-lXfLhs+LpBsD5inuYx+YDH5WsPPBQ95KPUiy8P5wq9ob9xKDZFqwNfU2QW6bGO8NqRO/H9JQomTSt5Yyh+FGfA==}
     engines: {node: '>=10'}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@swc/core-linux-x64-gnu@1.15.41':
-    resolution: {integrity: sha512-VxkuQK59c0tHm6uJZCUrS3cyA2JhGGfdU6e41SZz0x/JS+4Sm7C1mIc97In14vkZJopEt7yXA2TouCqZDSygEA==}
+  '@swc/core-linux-x64-gnu@1.15.43':
+    resolution: {integrity: sha512-07XnKwTmKy8TGOZG3D9fRnLWGynxPjwQnZLVmBFbo6F+7vHYzBIOuwXEhemrChBWb6yDNZsVCcMWCPX6FDD2xg==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@swc/core-linux-x64-musl@1.15.41':
-    resolution: {integrity: sha512-/0qXIu1ZxggLuovLb22vFfKHq2AA4n6Whw5UwmVCHk4pkw7KWnPIQpMCEqUMPsNkFJig7PPp/TSYFu8ZEb2rtQ==}
+  '@swc/core-linux-x64-musl@1.15.43':
+    resolution: {integrity: sha512-TJc+bsSIaBh+hZvZ5GRtW/K1bw66TJ9vsUwvVIsZdiWxU5ObLwZvfcnZ3UpgVfMnFibRes9uriJrQNBHEEogRQ==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@swc/core-win32-arm64-msvc@1.15.41':
-    resolution: {integrity: sha512-Y481sMNZM6rECh9VO4+y26N1lWEDAyxnBZskUf37fl90uHE946VHfmiVQWT0uMFOhyJJFovGTRuF4W82dwewUg==}
+  '@swc/core-win32-arm64-msvc@1.15.43':
+    resolution: {integrity: sha512-jfd7s2/bUQYkOHLs+LWQNKZdmDa8+sufKLllhpWAhVQ2GDCwsHe3vR/j+OSiItZNtkzFuaawa3+SAKz9y5gYfw==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [win32]
 
-  '@swc/core-win32-ia32-msvc@1.15.41':
-    resolution: {integrity: sha512-BAchBD5qeUzy3hiPSLJtaaoSm4blCLyYffOF1bGE4ETcV+OisqjUAwDQMJj++4bTpvMCDzwC+Bj3PmQyBCtscw==}
+  '@swc/core-win32-ia32-msvc@1.15.43':
+    resolution: {integrity: sha512-rLAE8JvucqEW1ZGohxPQrQWPBQeJG4+ypKbWfdlU/qmKScvCkxf9/Jxnzki1dkUQCQ7P5Enp13RlvqOlvx/32g==}
     engines: {node: '>=10'}
     cpu: [ia32]
     os: [win32]
 
-  '@swc/core-win32-x64-msvc@1.15.41':
-    resolution: {integrity: sha512-WOkA+fJ/ViVBQDsSV9JC52NACTe5PhlurA6viASDZGb7HR3KS01ZG7RZ+Bg6SVQFIoq3gSbTsskQVe6EbHFAYw==}
+  '@swc/core-win32-x64-msvc@1.15.43':
+    resolution: {integrity: sha512-h8MLDHZcfIukwQWj03rIJZx1I0E81AYj2X7J/nGErG4nz+QAv6G1Z+peotvinL3lqpbo32tLYSMFo32/ySzxKg==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [win32]
 
-  '@swc/core@1.15.41':
-    resolution: {integrity: sha512-03nQq/082QRJJiOvp3FGbgxTGyyxMxohPTjhk/W9bD2J0tk4ukITI7goOhOO2WbaHn/lsPmo/zf8+DIXhwpgYQ==}
+  '@swc/core@1.15.43':
+    resolution: {integrity: sha512-1CuKjFkPxIgGdeHVuNbkxmBxkcbdc08u0aiI43pFq6yY1tTVKmXT9hFEooyyKs/sJ3xf1GPHyEwTtk9Xl8dvQw==}
     engines: {node: '>=10'}
     peerDependencies:
       '@swc/helpers': '>=0.5.17'
@@ -3006,50 +3006,50 @@ packages:
   '@types/ws@8.18.1':
     resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==}
 
-  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260621.1':
-    resolution: {integrity: sha512-E81mNlY2JqZlDqflCvRpt6WhU6ha1SOkRC85o+EmKZJCjBxaaJpBGdwGjIisv2jiEMcHy2OW4ZHcE9GTM1BL2A==}
+  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260622.1':
+    resolution: {integrity: sha512-g/fjmdh/i/ngSmUeWNHh98iuONzW+kUaqwZRaZCmGkssBJ6ZrJAsyg85cm1t4aK9ne5nNjbjNPzJFTZ+QNMSRw==}
     engines: {node: '>=16.20.0'}
     cpu: [arm64]
     os: [darwin]
 
-  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260621.1':
-    resolution: {integrity: sha512-VS4VF8L0So56tC1jaJ57pMQOGd0Hc1wU0RIMkJi41/dKvcmc/WTRa7hiWJwzZLxXhZoVkdjesT36D9GahoAulg==}
+  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260622.1':
+    resolution: {integrity: sha512-AqRrnPQCR+7j6u6uC6eQpacJ/btxZW6ktpWxPj7byoyk6kGSSgUb0YNcZ2Iao2brdbYw4LOxVcrVW4mP+K7sxg==}
     engines: {node: '>=16.20.0'}
     cpu: [x64]
     os: [darwin]
 
-  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260621.1':
-    resolution: {integrity: sha512-Ek1uLWN6VzqwwTQNu1vcnRW4F3ipqvediLEwJP6uR5P6vrXYE7XvcGLEJcXiw31SR40NhxZW/RhLcJrHQcehrA==}
+  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260622.1':
+    resolution: {integrity: sha512-sxo7AlhQiX5J5WYWBxSBjJ02nA2kiO8j+K51fuF24nmbQRtSLjTa8/BimpYbBywTAsSps8vgnJjsLONf243HYw==}
     engines: {node: '>=16.20.0'}
     cpu: [arm64]
     os: [linux]
 
-  '@typescript/native-preview-linux-arm@7.0.0-dev.20260621.1':
-    resolution: {integrity: sha512-2Xp+pu7Xu9EMKxYFiZuyIzd6KUkMn7SvElzgBRwbrhfsk54Jieg2sxyL3aAw9xfzRsEN4m1VrU3Z/iq2gL5OUw==}
+  '@typescript/native-preview-linux-arm@7.0.0-dev.20260622.1':
+    resolution: {integrity: sha512-XnDHJZWFY2M8DCzxXj598Ql9op+zYpk6k5X3FYB4KeOXpdzjAke2H9wKW7UKeYfvPJyAgvyS+IapcvogCwx13A==}
     engines: {node: '>=16.20.0'}
     cpu: [arm]
     os: [linux]
 
-  '@typescript/native-preview-linux-x64@7.0.0-dev.20260621.1':
-    resolution: {integrity: sha512-VUhea6+Drw+PHRpsjsY7lNOZtXAlRXLHrpYynJU3jfnSflYgoqkrvlSzWVhcvhkjxGOZsqlIV+5ryy8ANZ6peg==}
+  '@typescript/native-preview-linux-x64@7.0.0-dev.20260622.1':
+    resolution: {integrity: sha512-41TR69UuB1be2DmjcavcUMoFipIQNVpqsm1FvVCtGnscL41pDa/ijXHnSwzn7v8EbCgAI7hRUhRsPNPGY3OCKQ==}
     engines: {node: '>=16.20.0'}
     cpu: [x64]
     os: [linux]
 
-  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260621.1':
-    resolution: {integrity: sha512-JyxxNWWs2X7WzK90zN8hgGKqP4zo2/y7Z2tlLLaHhSFtEh1AC+tsQun3NBlW9JvF1vHhGI/hPpnoZOxLO0CEWw==}
+  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260622.1':
+    resolution: {integrity: sha512-TMdYylCqBvQOVz6x5dT1HQ/49eLBijNE/uMGD2CA3YR4Hp4NkG+Rqg46NZiaO48D2+sjZws2uoNtPhfefN9IdA==}
     engines: {node: '>=16.20.0'}
     cpu: [arm64]
     os: [win32]
 
-  '@typescript/native-preview-win32-x64@7.0.0-dev.20260621.1':
-    resolution: {integrity: sha512-2ijIynqyxK1LkWUpLlmsBKuH7XHk6K4TAwdnfZ7x7BQHF9Z3okIXtKMzOik8fajB3oooVrEvbfOe2Mf+uZ7maQ==}
+  '@typescript/native-preview-win32-x64@7.0.0-dev.20260622.1':
+    resolution: {integrity: sha512-ROz8ncFZsMC2nn8ClBZ3wLNXpea6BbdMYyNTWx8xYrikhOIgFlkmAdc10PA/MiOh78RraUbdWvwbXNe19He+iQ==}
     engines: {node: '>=16.20.0'}
     cpu: [x64]
     os: [win32]
 
-  '@typescript/native-preview@7.0.0-dev.20260621.1':
-    resolution: {integrity: sha512-2epYxi5NDRPOvAG8TPEFd43qDVGHhD4IbIHF0uhsy72OSUbVY2rjEAv1DkW1Q2p/YbszXd7ZL/Ulch8VuDDS1g==}
+  '@typescript/native-preview@7.0.0-dev.20260622.1':
+    resolution: {integrity: sha512-t4XoYz/Jr1Jt7wkaHwe4e/r3OcYgKxvL0dqfZsnBmqG8HsJ57VpOwd0PINU5b5umcb4g9akVto028L70lAJUpA==}
     engines: {node: '>=16.20.0'}
     hasBin: true
 
@@ -5530,8 +5530,8 @@ packages:
   oxc-resolver@11.21.3:
     resolution: {integrity: sha512-2Mx3fKQz7+xgrBONjsxOgCGtMHOn38/HxMzW1I5efwXB5a4lRN0Vp40gYUJFBWJslcrvwoofTrqoTnLbwTd3pA==}
 
-  oxfmt@0.55.0:
-    resolution: {integrity: sha512-jSj2wCTakwgPMxkfiVZX0jf+nX+Nz6xlyAZjqNE0qXTFdCBPYlP6JAN+ODjmealw7DXBjOzYbdsqwBMAZnPZ6A==}
+  oxfmt@0.56.0:
+    resolution: {integrity: sha512-9Dv0wV3zKiyvhjD7bRKaInKmHQ1sPx3RGOjQkGFJbbdQ16576yf8qhMSO9Q9cvHcs+1NpBsRTkuDDYFFPTJ6gw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -7014,44 +7014,44 @@ snapshots:
       ansi-styles: 6.2.3
       is-fullwidth-code-point: 5.1.0
 
-  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.185':
+  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.186':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.185':
+  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.186':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.185':
+  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.186':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.185':
+  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.186':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.185':
+  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.186':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.185':
+  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.186':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.185':
+  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.186':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.185':
+  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.186':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk@0.3.185(@anthropic-ai/sdk@0.105.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(zod@4.4.3)':
+  '@anthropic-ai/claude-agent-sdk@0.3.186(@anthropic-ai/sdk@0.105.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(zod@4.4.3)':
     dependencies:
       '@anthropic-ai/sdk': 0.105.0(zod@4.4.3)
       '@modelcontextprotocol/sdk': 1.29.0(zod@4.4.3)
       zod: 4.4.3
     optionalDependencies:
-      '@anthropic-ai/claude-agent-sdk-darwin-arm64': 0.3.185
-      '@anthropic-ai/claude-agent-sdk-darwin-x64': 0.3.185
-      '@anthropic-ai/claude-agent-sdk-linux-arm64': 0.3.185
-      '@anthropic-ai/claude-agent-sdk-linux-arm64-musl': 0.3.185
-      '@anthropic-ai/claude-agent-sdk-linux-x64': 0.3.185
-      '@anthropic-ai/claude-agent-sdk-linux-x64-musl': 0.3.185
-      '@anthropic-ai/claude-agent-sdk-win32-arm64': 0.3.185
-      '@anthropic-ai/claude-agent-sdk-win32-x64': 0.3.185
+      '@anthropic-ai/claude-agent-sdk-darwin-arm64': 0.3.186
+      '@anthropic-ai/claude-agent-sdk-darwin-x64': 0.3.186
+      '@anthropic-ai/claude-agent-sdk-linux-arm64': 0.3.186
+      '@anthropic-ai/claude-agent-sdk-linux-arm64-musl': 0.3.186
+      '@anthropic-ai/claude-agent-sdk-linux-x64': 0.3.186
+      '@anthropic-ai/claude-agent-sdk-linux-x64-musl': 0.3.186
+      '@anthropic-ai/claude-agent-sdk-win32-arm64': 0.3.186
+      '@anthropic-ai/claude-agent-sdk-win32-x64': 0.3.186
 
   '@anthropic-ai/sdk@0.105.0(zod@4.4.3)':
     dependencies:
@@ -7724,13 +7724,13 @@ snapshots:
       '@nodelib/fs.scandir': 2.1.5
       fastq: 1.20.1
 
-  '@nx/devkit@23.0.1(nx@23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.41))':
+  '@nx/devkit@23.0.1(nx@23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.43))':
     dependencies:
       '@zkochan/js-yaml': 0.0.7
       ejs: 5.0.1
       enquirer: 2.3.6
       minimatch: 10.2.5
-      nx: 23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.41)
+      nx: 23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.43)
       semver: 7.8.5
       tslib: 2.8.1
       yargs-parser: 21.1.1
@@ -8047,61 +8047,61 @@ snapshots:
   '@oxc-resolver/binding-win32-x64-msvc@11.21.3':
     optional: true
 
-  '@oxfmt/binding-android-arm-eabi@0.55.0':
+  '@oxfmt/binding-android-arm-eabi@0.56.0':
     optional: true
 
-  '@oxfmt/binding-android-arm64@0.55.0':
+  '@oxfmt/binding-android-arm64@0.56.0':
     optional: true
 
-  '@oxfmt/binding-darwin-arm64@0.55.0':
+  '@oxfmt/binding-darwin-arm64@0.56.0':
     optional: true
 
-  '@oxfmt/binding-darwin-x64@0.55.0':
+  '@oxfmt/binding-darwin-x64@0.56.0':
     optional: true
 
-  '@oxfmt/binding-freebsd-x64@0.55.0':
+  '@oxfmt/binding-freebsd-x64@0.56.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.55.0':
+  '@oxfmt/binding-linux-arm-gnueabihf@0.56.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.55.0':
+  '@oxfmt/binding-linux-arm-musleabihf@0.56.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-gnu@0.55.0':
+  '@oxfmt/binding-linux-arm64-gnu@0.56.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-musl@0.55.0':
+  '@oxfmt/binding-linux-arm64-musl@0.56.0':
     optional: true
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.55.0':
+  '@oxfmt/binding-linux-ppc64-gnu@0.56.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.55.0':
+  '@oxfmt/binding-linux-riscv64-gnu@0.56.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-musl@0.55.0':
+  '@oxfmt/binding-linux-riscv64-musl@0.56.0':
     optional: true
 
-  '@oxfmt/binding-linux-s390x-gnu@0.55.0':
+  '@oxfmt/binding-linux-s390x-gnu@0.56.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-gnu@0.55.0':
+  '@oxfmt/binding-linux-x64-gnu@0.56.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-musl@0.55.0':
+  '@oxfmt/binding-linux-x64-musl@0.56.0':
     optional: true
 
-  '@oxfmt/binding-openharmony-arm64@0.55.0':
+  '@oxfmt/binding-openharmony-arm64@0.56.0':
     optional: true
 
-  '@oxfmt/binding-win32-arm64-msvc@0.55.0':
+  '@oxfmt/binding-win32-arm64-msvc@0.56.0':
     optional: true
 
-  '@oxfmt/binding-win32-ia32-msvc@0.55.0':
+  '@oxfmt/binding-win32-ia32-msvc@0.56.0':
     optional: true
 
-  '@oxfmt/binding-win32-x64-msvc@0.55.0':
+  '@oxfmt/binding-win32-x64-msvc@0.56.0':
     optional: true
 
   '@oxlint-tsgolint/darwin-arm64@0.23.0':
@@ -8815,16 +8815,16 @@ snapshots:
       '@supabase/realtime-js': 2.108.2
       '@supabase/storage-js': 2.108.2
 
-  '@swc-node/core@1.14.1(@swc/core@1.15.41)(@swc/types@0.1.27)':
+  '@swc-node/core@1.14.1(@swc/core@1.15.43)(@swc/types@0.1.27)':
     dependencies:
-      '@swc/core': 1.15.41
+      '@swc/core': 1.15.43
       '@swc/types': 0.1.27
 
-  '@swc-node/register@1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3)':
+  '@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3)':
     dependencies:
-      '@swc-node/core': 1.14.1(@swc/core@1.15.41)(@swc/types@0.1.27)
+      '@swc-node/core': 1.14.1(@swc/core@1.15.43)(@swc/types@0.1.27)
       '@swc-node/sourcemap-support': 0.6.1
-      '@swc/core': 1.15.41
+      '@swc/core': 1.15.43
       colorette: 2.0.20
       debug: 4.4.3
       oxc-resolver: 11.20.0
@@ -8840,59 +8840,59 @@ snapshots:
       source-map-support: 0.5.21
       tslib: 2.8.1
 
-  '@swc/core-darwin-arm64@1.15.41':
+  '@swc/core-darwin-arm64@1.15.43':
     optional: true
 
-  '@swc/core-darwin-x64@1.15.41':
+  '@swc/core-darwin-x64@1.15.43':
     optional: true
 
-  '@swc/core-linux-arm-gnueabihf@1.15.41':
+  '@swc/core-linux-arm-gnueabihf@1.15.43':
     optional: true
 
-  '@swc/core-linux-arm64-gnu@1.15.41':
+  '@swc/core-linux-arm64-gnu@1.15.43':
     optional: true
 
-  '@swc/core-linux-arm64-musl@1.15.41':
+  '@swc/core-linux-arm64-musl@1.15.43':
     optional: true
 
-  '@swc/core-linux-ppc64-gnu@1.15.41':
+  '@swc/core-linux-ppc64-gnu@1.15.43':
     optional: true
 
-  '@swc/core-linux-s390x-gnu@1.15.41':
+  '@swc/core-linux-s390x-gnu@1.15.43':
     optional: true
 
-  '@swc/core-linux-x64-gnu@1.15.41':
+  '@swc/core-linux-x64-gnu@1.15.43':
     optional: true
 
-  '@swc/core-linux-x64-musl@1.15.41':
+  '@swc/core-linux-x64-musl@1.15.43':
     optional: true
 
-  '@swc/core-win32-arm64-msvc@1.15.41':
+  '@swc/core-win32-arm64-msvc@1.15.43':
     optional: true
 
-  '@swc/core-win32-ia32-msvc@1.15.41':
+  '@swc/core-win32-ia32-msvc@1.15.43':
     optional: true
 
-  '@swc/core-win32-x64-msvc@1.15.41':
+  '@swc/core-win32-x64-msvc@1.15.43':
     optional: true
 
-  '@swc/core@1.15.41':
+  '@swc/core@1.15.43':
     dependencies:
       '@swc/counter': 0.1.3
       '@swc/types': 0.1.27
     optionalDependencies:
-      '@swc/core-darwin-arm64': 1.15.41
-      '@swc/core-darwin-x64': 1.15.41
-      '@swc/core-linux-arm-gnueabihf': 1.15.41
-      '@swc/core-linux-arm64-gnu': 1.15.41
-      '@swc/core-linux-arm64-musl': 1.15.41
-      '@swc/core-linux-ppc64-gnu': 1.15.41
-      '@swc/core-linux-s390x-gnu': 1.15.41
-      '@swc/core-linux-x64-gnu': 1.15.41
-      '@swc/core-linux-x64-musl': 1.15.41
-      '@swc/core-win32-arm64-msvc': 1.15.41
-      '@swc/core-win32-ia32-msvc': 1.15.41
-      '@swc/core-win32-x64-msvc': 1.15.41
+      '@swc/core-darwin-arm64': 1.15.43
+      '@swc/core-darwin-x64': 1.15.43
+      '@swc/core-linux-arm-gnueabihf': 1.15.43
+      '@swc/core-linux-arm64-gnu': 1.15.43
+      '@swc/core-linux-arm64-musl': 1.15.43
+      '@swc/core-linux-ppc64-gnu': 1.15.43
+      '@swc/core-linux-s390x-gnu': 1.15.43
+      '@swc/core-linux-x64-gnu': 1.15.43
+      '@swc/core-linux-x64-musl': 1.15.43
+      '@swc/core-win32-arm64-msvc': 1.15.43
+      '@swc/core-win32-ia32-msvc': 1.15.43
+      '@swc/core-win32-x64-msvc': 1.15.43
 
   '@swc/counter@0.1.3': {}
 
@@ -8993,36 +8993,36 @@ snapshots:
     dependencies:
       '@types/node': 26.0.1
 
-  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260621.1':
+  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260622.1':
     optional: true
 
-  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260621.1':
+  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260622.1':
     optional: true
 
-  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260621.1':
+  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260622.1':
     optional: true
 
-  '@typescript/native-preview-linux-arm@7.0.0-dev.20260621.1':
+  '@typescript/native-preview-linux-arm@7.0.0-dev.20260622.1':
     optional: true
 
-  '@typescript/native-preview-linux-x64@7.0.0-dev.20260621.1':
+  '@typescript/native-preview-linux-x64@7.0.0-dev.20260622.1':
     optional: true
 
-  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260621.1':
+  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260622.1':
     optional: true
 
-  '@typescript/native-preview-win32-x64@7.0.0-dev.20260621.1':
+  '@typescript/native-preview-win32-x64@7.0.0-dev.20260622.1':
     optional: true
 
-  '@typescript/native-preview@7.0.0-dev.20260621.1':
+  '@typescript/native-preview@7.0.0-dev.20260622.1':
     optionalDependencies:
-      '@typescript/native-preview-darwin-arm64': 7.0.0-dev.20260621.1
-      '@typescript/native-preview-darwin-x64': 7.0.0-dev.20260621.1
-      '@typescript/native-preview-linux-arm': 7.0.0-dev.20260621.1
-      '@typescript/native-preview-linux-arm64': 7.0.0-dev.20260621.1
-      '@typescript/native-preview-linux-x64': 7.0.0-dev.20260621.1
-      '@typescript/native-preview-win32-arm64': 7.0.0-dev.20260621.1
-      '@typescript/native-preview-win32-x64': 7.0.0-dev.20260621.1
+      '@typescript/native-preview-darwin-arm64': 7.0.0-dev.20260622.1
+      '@typescript/native-preview-darwin-x64': 7.0.0-dev.20260622.1
+      '@typescript/native-preview-linux-arm': 7.0.0-dev.20260622.1
+      '@typescript/native-preview-linux-arm64': 7.0.0-dev.20260622.1
+      '@typescript/native-preview-linux-x64': 7.0.0-dev.20260622.1
+      '@typescript/native-preview-win32-arm64': 7.0.0-dev.20260622.1
+      '@typescript/native-preview-win32-x64': 7.0.0-dev.20260622.1
 
   '@ungap/structured-clone@1.3.2': {}
 
@@ -11793,7 +11793,7 @@ snapshots:
 
   npm@11.17.0: {}
 
-  nx@23.0.0(@swc-node/register@1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.41):
+  nx@23.0.0(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.43):
     dependencies:
       '@emnapi/core': 1.4.5
       '@emnapi/runtime': 1.4.5
@@ -11917,12 +11917,12 @@ snapshots:
       '@nx/nx-linux-x64-musl': 23.0.0
       '@nx/nx-win32-arm64-msvc': 23.0.0
       '@nx/nx-win32-x64-msvc': 23.0.0
-      '@swc-node/register': 1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3)
-      '@swc/core': 1.15.41
+      '@swc-node/register': 1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3)
+      '@swc/core': 1.15.43
     transitivePeerDependencies:
       - debug
 
-  nx@23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.41):
+  nx@23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.43):
     dependencies:
       '@emnapi/core': 1.4.5
       '@emnapi/runtime': 1.4.5
@@ -12046,8 +12046,8 @@ snapshots:
       '@nx/nx-linux-x64-musl': 23.0.1
       '@nx/nx-win32-arm64-msvc': 23.0.1
       '@nx/nx-win32-x64-msvc': 23.0.1
-      '@swc-node/register': 1.11.1(@swc/core@1.15.41)(@swc/types@0.1.27)(typescript@6.0.3)
-      '@swc/core': 1.15.41
+      '@swc-node/register': 1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3)
+      '@swc/core': 1.15.43
     transitivePeerDependencies:
       - debug
 
@@ -12174,29 +12174,29 @@ snapshots:
       '@oxc-resolver/binding-win32-arm64-msvc': 11.21.3
       '@oxc-resolver/binding-win32-x64-msvc': 11.21.3
 
-  oxfmt@0.55.0:
+  oxfmt@0.56.0:
     dependencies:
       tinypool: 2.1.0
     optionalDependencies:
-      '@oxfmt/binding-android-arm-eabi': 0.55.0
-      '@oxfmt/binding-android-arm64': 0.55.0
-      '@oxfmt/binding-darwin-arm64': 0.55.0
-      '@oxfmt/binding-darwin-x64': 0.55.0
-      '@oxfmt/binding-freebsd-x64': 0.55.0
-      '@oxfmt/binding-linux-arm-gnueabihf': 0.55.0
-      '@oxfmt/binding-linux-arm-musleabihf': 0.55.0
-      '@oxfmt/binding-linux-arm64-gnu': 0.55.0
-      '@oxfmt/binding-linux-arm64-musl': 0.55.0
-      '@oxfmt/binding-linux-ppc64-gnu': 0.55.0
-      '@oxfmt/binding-linux-riscv64-gnu': 0.55.0
-      '@oxfmt/binding-linux-riscv64-musl': 0.55.0
-      '@oxfmt/binding-linux-s390x-gnu': 0.55.0
-      '@oxfmt/binding-linux-x64-gnu': 0.55.0
-      '@oxfmt/binding-linux-x64-musl': 0.55.0
-      '@oxfmt/binding-openharmony-arm64': 0.55.0
-      '@oxfmt/binding-win32-arm64-msvc': 0.55.0
-      '@oxfmt/binding-win32-ia32-msvc': 0.55.0
-      '@oxfmt/binding-win32-x64-msvc': 0.55.0
+      '@oxfmt/binding-android-arm-eabi': 0.56.0
+      '@oxfmt/binding-android-arm64': 0.56.0
+      '@oxfmt/binding-darwin-arm64': 0.56.0
+      '@oxfmt/binding-darwin-x64': 0.56.0
+      '@oxfmt/binding-freebsd-x64': 0.56.0
+      '@oxfmt/binding-linux-arm-gnueabihf': 0.56.0
+      '@oxfmt/binding-linux-arm-musleabihf': 0.56.0
+      '@oxfmt/binding-linux-arm64-gnu': 0.56.0
+      '@oxfmt/binding-linux-arm64-musl': 0.56.0
+      '@oxfmt/binding-linux-ppc64-gnu': 0.56.0
+      '@oxfmt/binding-linux-riscv64-gnu': 0.56.0
+      '@oxfmt/binding-linux-riscv64-musl': 0.56.0
+      '@oxfmt/binding-linux-s390x-gnu': 0.56.0
+      '@oxfmt/binding-linux-x64-gnu': 0.56.0
+      '@oxfmt/binding-linux-x64-musl': 0.56.0
+      '@oxfmt/binding-openharmony-arm64': 0.56.0
+      '@oxfmt/binding-win32-arm64-msvc': 0.56.0
+      '@oxfmt/binding-win32-ia32-msvc': 0.56.0
+      '@oxfmt/binding-win32-x64-msvc': 0.56.0
 
   oxlint-tsgolint@0.23.0:
     optionalDependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 78c682c787..3c3edfd134 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -19,15 +19,15 @@ catalog:
   "@effect/vitest": "^4.0.0-beta.85"
   "@nx/devkit": "^23.0.0"
   "@swc-node/register": "^1.10.9"
-  "@swc/core": "^1.15.41"
+  "@swc/core": "^1.15.43"
   "@tsconfig/bun": "^1.0.10"
   "@types/bun": "^1.3.14"
-  "@typescript/native-preview": "7.0.0-dev.20260621.1"
+  "@typescript/native-preview": "7.0.0-dev.20260622.1"
   "@vitest/coverage-istanbul": "^4.1.9"
   "effect": "4.0.0-beta.85"
   "knip": "^6.17.1"
   "nx": "^23.0.0"
-  "oxfmt": "^0.55.0"
+  "oxfmt": "^0.56.0"
   "oxlint": "^1.70.0"
   "oxlint-tsgolint": "^0.23.0"
   "tldts": "^7.4.3"

From f26ae4e819671f5f0261c3258e01601f2f05052f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 30 Jun 2026 00:11:40 +0000
Subject: [PATCH 24/29] fix(docker): bump supabase/postgres from 17.6.1.139 to
 17.6.1.140 in /apps/cli-go/pkg/config/templates (#5733)

Bumps supabase/postgres from 17.6.1.139 to 17.6.1.140.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=supabase/postgres&package-manager=docker&previous-version=17.6.1.139&new-version=17.6.1.140)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 apps/cli-go/pkg/config/templates/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/cli-go/pkg/config/templates/Dockerfile b/apps/cli-go/pkg/config/templates/Dockerfile
index b6dbed42a8..89dcf67673 100644
--- a/apps/cli-go/pkg/config/templates/Dockerfile
+++ b/apps/cli-go/pkg/config/templates/Dockerfile
@@ -1,5 +1,5 @@
 # Exposed for updates by .github/dependabot.yml
-FROM supabase/postgres:17.6.1.139 AS pg
+FROM supabase/postgres:17.6.1.140 AS pg
 # Append to ServiceImages when adding new dependencies below
 FROM library/kong:2.8.1 AS kong
 FROM axllent/mailpit:v1.30.2 AS mailpit

From 9a2a51efa98899fc4f9fcc2ecbf6ab920ebeff3a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 30 Jun 2026 00:12:14 +0000
Subject: [PATCH 25/29] fix(docker): bump the docker-minor group in
 /apps/cli-go/pkg/config/templates with 6 updates (#5732)

Bumps the docker-minor group in /apps/cli-go/pkg/config/templates with 6
updates:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.13` | `v14.14` |
| supabase/studio | `2026.06.22-sha-2207d7f` | `2026.06.29-sha-20290c7`
|
| supabase/gotrue | `v2.191.0` | `v2.192.0` |
| supabase/realtime | `v2.112.0` | `v2.112.1` |
| supabase/storage-api | `v1.61.5` | `v1.61.7` |
| supabase/logflare | `1.45.4` | `1.45.6` |

Updates `postgrest/postgrest` from v14.13 to v14.14

Updates `supabase/studio` from 2026.06.22-sha-2207d7f to
2026.06.29-sha-20290c7

Updates `supabase/gotrue` from v2.191.0 to v2.192.0

Updates `supabase/realtime` from v2.112.0 to v2.112.1

Updates `supabase/storage-api` from v1.61.5 to v1.61.7

Updates `supabase/logflare` from 1.45.4 to 1.45.6


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 apps/cli-go/pkg/config/templates/Dockerfile | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/apps/cli-go/pkg/config/templates/Dockerfile b/apps/cli-go/pkg/config/templates/Dockerfile
index 89dcf67673..97dfc0dbea 100644
--- a/apps/cli-go/pkg/config/templates/Dockerfile
+++ b/apps/cli-go/pkg/config/templates/Dockerfile
@@ -3,17 +3,17 @@ FROM supabase/postgres:17.6.1.140 AS pg
 # Append to ServiceImages when adding new dependencies below
 FROM library/kong:2.8.1 AS kong
 FROM axllent/mailpit:v1.30.2 AS mailpit
-FROM postgrest/postgrest:v14.13 AS postgrest
+FROM postgrest/postgrest:v14.14 AS postgrest
 FROM supabase/postgres-meta:v0.96.6 AS pgmeta
-FROM supabase/studio:2026.06.22-sha-2207d7f AS studio
+FROM supabase/studio:2026.06.29-sha-20290c7 AS studio
 FROM darthsim/imgproxy:v3.8.0 AS imgproxy
 FROM supabase/edge-runtime:v1.74.2 AS edgeruntime
 FROM timberio/vector:0.53.0-alpine AS vector
 FROM supabase/supavisor:2.9.7 AS supavisor
-FROM supabase/gotrue:v2.191.0 AS gotrue
-FROM supabase/realtime:v2.112.0 AS realtime
-FROM supabase/storage-api:v1.61.5 AS storage
-FROM supabase/logflare:1.45.4 AS logflare
+FROM supabase/gotrue:v2.192.0 AS gotrue
+FROM supabase/realtime:v2.112.1 AS realtime
+FROM supabase/storage-api:v1.61.7 AS storage
+FROM supabase/logflare:1.45.6 AS logflare
 # Append to JobImages when adding new dependencies below
 FROM supabase/pgadmin-schema-diff:cli-0.0.5 AS differ
 FROM supabase/migra:3.0.1663481299 AS migra

From 1ff7cc3434931b8915904af1716f2e679474a097 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 30 Jun 2026 00:13:30 +0000
Subject: [PATCH 26/29] chore(ci): bump the actions-major group with 4 updates
 (#5734)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the actions-major group with 4 updates:
[actions/setup-go](https://github.com/actions/setup-go),
[actions/cache/restore](https://github.com/actions/cache),
[actions/cache/save](https://github.com/actions/cache) and
[actions/cache](https://github.com/actions/cache).

Updates `actions/setup-go` from 6.4.0 to 6.5.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-go/releases">actions/setup-go's
releases</a>.</em></p>
<blockquote>
<h2>v6.5.0</h2>
<h2>What's Changed</h2>
<h3>Dependency update</h3>
<ul>
<li>Upgrade actions dependencies by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in
<a
href="https://redirect.github.com/actions/setup-go/pull/744">actions/setup-go#744</a></li>
<li>Upgrade <code>@​types/node</code> and typescript-eslint dependencies
to resolve npm audit findings by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-go/pull/755">actions/setup-go#755</a></li>
<li>Upgrade <code>@​actions/cache</code> to 5.1.0, log cache write
denied by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/setup-go/pull/758">actions/setup-go#758</a></li>
<li>Upgrade version to 6.5.0 in package.json and package-lock.json by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-go/pull/762">actions/setup-go#762</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-go/pull/744">actions/setup-go#744</a></li>
<li><a href="https://github.com/jasongin"><code>@​jasongin</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-go/pull/758">actions/setup-go#758</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-go/compare/v6...v6.5.0">https://github.com/actions/setup-go/compare/v6...v6.5.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-go/commit/924ae3a1cded613372ab5595356fb5720e22ba16"><code>924ae3a</code></a>
chore: bump version to 6.5.0 in package.json and package-lock.json (<a
href="https://redirect.github.com/actions/setup-go/issues/762">#762</a>)</li>
<li><a
href="https://github.com/actions/setup-go/commit/e91cc3bfe0c3efd0b2d1dc3a51269c9038deb4f1"><code>e91cc3b</code></a>
Bump <code>@​actions/cache</code> to 5.1.0, log cache write denied (<a
href="https://redirect.github.com/actions/setup-go/issues/758">#758</a>)</li>
<li><a
href="https://github.com/actions/setup-go/commit/4a2405e6aebff6aabd8e43618539aa35cf90ac92"><code>4a2405e</code></a>
chore: update <code>@​types/node</code> and <a
href="https://github.com/typescript-eslint"><code>@​typescript-eslint</code></a>
dependencies to latest versi...</li>
<li><a
href="https://github.com/actions/setup-go/commit/78961f6f84d799cd858575bb931c3e51d3b13290"><code>78961f6</code></a>
chore: update <a
href="https://github.com/actions"><code>@​actions</code></a>
dependencies and refresh license cache (<a
href="https://redirect.github.com/actions/setup-go/issues/744">#744</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-go/compare/4a3601121dd01d1626a1e23e37211e3254c1c06c...924ae3a1cded613372ab5595356fb5720e22ba16">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/cache/restore` from 5.0.5 to 6.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases">actions/cache/restore's
releases</a>.</em></p>
<blockquote>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v6.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update packages, migrate to ESM by <a
href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p>
<h2>v5.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache/restore's
changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a
href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a
href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a>
with the new version and changes in the <code>## Changelog</code>
section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by
updating the <a
href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a>
file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed
and merged.</li>
<li>Draft a new release <a
href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a>
use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you
made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a
href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a>
<ol>
<li>There should be a workflow run queued with the same version
number.</li>
<li>Approve the run to publish the new version and update the major tags
for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>6.1.0</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a
href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435
Handle cache write error due to read-only token</a></li>
<li>Switch redundant &quot;Cache save failed&quot; warning to debug log
in save-only</li>
</ul>
<h3>6.0.0</h3>
<ul>
<li>Updated <code>@actions/cache</code> to ^6.0.1,
<code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to
^3.0.0, <code>@actions/io</code> to ^3.0.2</li>
<li>Migrated to ESM module system</li>
<li>Upgraded Jest to v30 and test infrastructure to be ESM
compatible</li>
</ul>
<h3>5.0.4</h3>
<ul>
<li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar
patterns)</li>
<li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb
protection, header validation fixes)</li>
<li>Bump <code>fast-xml-parser</code> to v5.5.6</li>
</ul>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1768">#1768</a>
from jasongin/readonly-cache</li>
<li><a
href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a>
Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error
due to RO token</li>
<li><a
href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1760">#1760</a>
from actions/samirat/esm_migration_and_package_update</li>
<li><a
href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a>
Prettier fixes</li>
<li><a
href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a>
Rebuild dist</li>
<li><a
href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a>
Fixed licenses</li>
<li><a
href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a>
Fix test mock return order</li>
<li><a
href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a>
PR feedback</li>
<li><a
href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a>
Rebuild dist bundles as ESM to match type:module</li>
<li><a
href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a>
Fix lint and jest issues</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/cache/save` from 5.0.5 to 6.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases">actions/cache/save's
releases</a>.</em></p>
<blockquote>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v6.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update packages, migrate to ESM by <a
href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p>
<h2>v5.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache/save's
changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a
href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a
href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a>
with the new version and changes in the <code>## Changelog</code>
section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by
updating the <a
href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a>
file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed
and merged.</li>
<li>Draft a new release <a
href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a>
use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you
made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a
href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a>
<ol>
<li>There should be a workflow run queued with the same version
number.</li>
<li>Approve the run to publish the new version and update the major tags
for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>6.1.0</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a
href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435
Handle cache write error due to read-only token</a></li>
<li>Switch redundant &quot;Cache save failed&quot; warning to debug log
in save-only</li>
</ul>
<h3>6.0.0</h3>
<ul>
<li>Updated <code>@actions/cache</code> to ^6.0.1,
<code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to
^3.0.0, <code>@actions/io</code> to ^3.0.2</li>
<li>Migrated to ESM module system</li>
<li>Upgraded Jest to v30 and test infrastructure to be ESM
compatible</li>
</ul>
<h3>5.0.4</h3>
<ul>
<li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar
patterns)</li>
<li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb
protection, header validation fixes)</li>
<li>Bump <code>fast-xml-parser</code> to v5.5.6</li>
</ul>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1768">#1768</a>
from jasongin/readonly-cache</li>
<li><a
href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a>
Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error
due to RO token</li>
<li><a
href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1760">#1760</a>
from actions/samirat/esm_migration_and_package_update</li>
<li><a
href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a>
Prettier fixes</li>
<li><a
href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a>
Rebuild dist</li>
<li><a
href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a>
Fixed licenses</li>
<li><a
href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a>
Fix test mock return order</li>
<li><a
href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a>
PR feedback</li>
<li><a
href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a>
Rebuild dist bundles as ESM to match type:module</li>
<li><a
href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a>
Fix lint and jest issues</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/cache` from 5.0.5 to 6.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases">actions/cache's
releases</a>.</em></p>
<blockquote>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v6.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update packages, migrate to ESM by <a
href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p>
<h2>v5.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's
changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a
href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a
href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a>
with the new version and changes in the <code>## Changelog</code>
section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by
updating the <a
href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a>
file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed
and merged.</li>
<li>Draft a new release <a
href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a>
use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you
made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a
href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a>
<ol>
<li>There should be a workflow run queued with the same version
number.</li>
<li>Approve the run to publish the new version and update the major tags
for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>6.1.0</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a
href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435
Handle cache write error due to read-only token</a></li>
<li>Switch redundant &quot;Cache save failed&quot; warning to debug log
in save-only</li>
</ul>
<h3>6.0.0</h3>
<ul>
<li>Updated <code>@actions/cache</code> to ^6.0.1,
<code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to
^3.0.0, <code>@actions/io</code> to ^3.0.2</li>
<li>Migrated to ESM module system</li>
<li>Upgraded Jest to v30 and test infrastructure to be ESM
compatible</li>
</ul>
<h3>5.0.4</h3>
<ul>
<li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar
patterns)</li>
<li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb
protection, header validation fixes)</li>
<li>Bump <code>fast-xml-parser</code> to v5.5.6</li>
</ul>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1768">#1768</a>
from jasongin/readonly-cache</li>
<li><a
href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a>
Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error
due to RO token</li>
<li><a
href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1760">#1760</a>
from actions/samirat/esm_migration_and_package_update</li>
<li><a
href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a>
Prettier fixes</li>
<li><a
href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a>
Rebuild dist</li>
<li><a
href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a>
Fixed licenses</li>
<li><a
href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a>
Fix test mock return order</li>
<li><a
href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a>
PR feedback</li>
<li><a
href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a>
Rebuild dist bundles as ESM to match type:module</li>
<li><a
href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a>
Fix lint and jest issues</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build-cli-artifacts.yml        |  6 +++---
 .github/workflows/cli-go-api-sync.yml            |  2 +-
 .github/workflows/cli-go-ci.yml                  | 16 ++++++++--------
 .github/workflows/cli-go-mirror.yml              |  2 +-
 .github/workflows/live-e2e.yml                   |  6 +++---
 .../workflows/publish-preview-cli-packages.yml   |  2 +-
 .github/workflows/release-shared.yml             | 12 ++++++------
 .github/workflows/test.yml                       |  8 ++++----
 8 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/build-cli-artifacts.yml b/.github/workflows/build-cli-artifacts.yml
index 96db893c98..ff97ce69ec 100644
--- a/.github/workflows/build-cli-artifacts.yml
+++ b/.github/workflows/build-cli-artifacts.yml
@@ -77,7 +77,7 @@ jobs:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: apps/cli-go/go.mod
           cache: true
@@ -126,7 +126,7 @@ jobs:
 
       - name: Check existing build artifacts cache
         id: build-artifacts-cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             packages/cli-*/bin/
@@ -137,7 +137,7 @@ jobs:
 
       - name: Save build artifacts cache
         if: steps.build-artifacts-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             packages/cli-*/bin/
diff --git a/.github/workflows/cli-go-api-sync.yml b/.github/workflows/cli-go-api-sync.yml
index 2ae59ca5a0..f65a73c6e2 100644
--- a/.github/workflows/cli-go-api-sync.yml
+++ b/.github/workflows/cli-go-api-sync.yml
@@ -18,7 +18,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: apps/cli-go/go.mod
           cache: true
diff --git a/.github/workflows/cli-go-ci.yml b/.github/workflows/cli-go-ci.yml
index 1353d5b9e9..0fc58f8c37 100644
--- a/.github/workflows/cli-go-ci.yml
+++ b/.github/workflows/cli-go-ci.yml
@@ -23,7 +23,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: apps/cli-go/go.mod
           cache: true
@@ -37,7 +37,7 @@ jobs:
 
       - name: Check existing coverage cache
         id: coverage-cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: apps/cli-go/coverage.out
           key: cli-go-coverage-${{ github.run_id }}-v1
@@ -45,7 +45,7 @@ jobs:
 
       - name: Save coverage cache
         if: steps.coverage-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: apps/cli-go/coverage.out
           key: cli-go-coverage-${{ github.run_id }}-v1
@@ -57,7 +57,7 @@ jobs:
     runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
       - name: Restore coverage cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: apps/cli-go/coverage.out
           key: cli-go-coverage-${{ github.run_id }}-v1
@@ -78,7 +78,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: apps/cli-go/go.mod
           # Linter requires no cache
@@ -98,7 +98,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: apps/cli-go/go.mod
           cache: true
@@ -124,7 +124,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: apps/cli-go/go.mod
           cache: true
@@ -142,7 +142,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: apps/cli-go/go.mod
           cache: true
diff --git a/.github/workflows/cli-go-mirror.yml b/.github/workflows/cli-go-mirror.yml
index 3d1c8dfa84..8999547a2e 100644
--- a/.github/workflows/cli-go-mirror.yml
+++ b/.github/workflows/cli-go-mirror.yml
@@ -28,7 +28,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: apps/cli-go/go.mod
           cache: true
diff --git a/.github/workflows/live-e2e.yml b/.github/workflows/live-e2e.yml
index 0aef0459ec..8b2d94e10f 100644
--- a/.github/workflows/live-e2e.yml
+++ b/.github/workflows/live-e2e.yml
@@ -56,7 +56,7 @@ jobs:
       - name: Check tested marker
         id: cache
         if: github.event_name == 'schedule'
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .beta-marker
           key: live-e2e-beta-${{ steps.ver.outputs.version }}
@@ -114,7 +114,7 @@ jobs:
         uses: ./.github/actions/setup
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: apps/cli-go/go.mod
           cache-dependency-path: apps/cli-go/go.sum
@@ -181,7 +181,7 @@ jobs:
           echo "${{ needs.gate.outputs.version }}" > .beta-marker/version
 
       - name: Save tested marker
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .beta-marker
           key: live-e2e-beta-${{ needs.gate.outputs.version }}
diff --git a/.github/workflows/publish-preview-cli-packages.yml b/.github/workflows/publish-preview-cli-packages.yml
index 4c3a95c28e..e7486fc5f7 100644
--- a/.github/workflows/publish-preview-cli-packages.yml
+++ b/.github/workflows/publish-preview-cli-packages.yml
@@ -58,7 +58,7 @@ jobs:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
 
       - name: Restore preview build artifacts cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             packages/cli-*/bin/
diff --git a/.github/workflows/release-shared.yml b/.github/workflows/release-shared.yml
index 79d6ba7387..3e917b971e 100644
--- a/.github/workflows/release-shared.yml
+++ b/.github/workflows/release-shared.yml
@@ -110,7 +110,7 @@ jobs:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
 
       - name: Restore build artifacts cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             packages/cli-*/bin/
@@ -175,7 +175,7 @@ jobs:
       - name: Cache smoke-test docker images
         if: runner.os == 'Linux'
         id: smoke-docker-cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/smoke-docker-images.tar
           key: smoke-docker-images-debian-bookworm-slim-amazonlinux-2023-alpine-3.21-v1
@@ -246,7 +246,7 @@ jobs:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
 
       - name: Restore build artifacts cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             packages/cli-*/bin/
@@ -305,7 +305,7 @@ jobs:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
 
       - name: Restore build artifacts cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             packages/cli-*/bin/
@@ -475,7 +475,7 @@ jobs:
       # tarballs. Reading it here produced a formula whose sha256 rejected the
       # downloaded archive ("Formula reports different checksum").
       - name: Restore build artifacts cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             packages/cli-*/bin/
@@ -538,7 +538,7 @@ jobs:
       # tarballs. Reading it here would produce a manifest whose hash rejects the
       # downloaded archive.
       - name: Restore build artifacts cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             packages/cli-*/bin/
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2e584a8075..e5da5adca0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -44,7 +44,7 @@ jobs:
         with:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: apps/cli-go/go.mod
           cache-dependency-path: apps/cli-go/go.sum
@@ -75,7 +75,7 @@ jobs:
         with:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: apps/cli-go/go.mod
           cache-dependency-path: apps/cli-go/go.sum
@@ -138,7 +138,7 @@ jobs:
       - name: Cache Go CLI binary
         if: steps.detect.outputs.cli_e2e == 'true'
         id: cache-go-binary
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: apps/cli-go/supabase-go
           key: go-cli-${{ runner.os }}-${{ hashFiles('apps/cli-go/**/*.go',
@@ -147,7 +147,7 @@ jobs:
       - name: Setup Go
         if: steps.detect.outputs.cli_e2e == 'true' &&
           steps.cache-go-binary.outputs.cache-hit != 'true'
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: apps/cli-go/go.mod
           cache-dependency-path: apps/cli-go/go.sum

From e3ed7d4a44234bfabf1db43faaae17d9170e1022 Mon Sep 17 00:00:00 2001
From: Vaibhav <117663341+7ttp@users.noreply.github.com>
Date: Tue, 30 Jun 2026 13:28:31 +0530
Subject: [PATCH 27/29] fix(cli): storage config (#5729)

## TL;DR
Fixes `config push` failing when the remote Storage config omits
`databasePoolMode`

## ref:
- closes https://github.com/supabase/cli/issues/5728
- closes https://github.com/supabase/cli/issues/5726
---
 .../config/push/push.integration.test.ts      | 48 +++++++++++++++++++
 packages/api/scripts/openapi-overrides.json   | 17 +++++++
 packages/api/src/generated/contracts.ts       |  2 +-
 packages/api/src/generated/openapi.json       |  9 +---
 4 files changed, 67 insertions(+), 9 deletions(-)

diff --git a/apps/cli/src/legacy/commands/config/push/push.integration.test.ts b/apps/cli/src/legacy/commands/config/push/push.integration.test.ts
index 2955c46a24..0cc0ffe678 100644
--- a/apps/cli/src/legacy/commands/config/push/push.integration.test.ts
+++ b/apps/cli/src/legacy/commands/config/push/push.integration.test.ts
@@ -46,6 +46,8 @@ interface RouteOpts {
   readonly postgrestPatch?: { status: number; body: unknown } | "fail";
   readonly postgresGet?: { status: number; body: unknown };
   readonly postgresPut?: { status: number; body: unknown };
+  readonly storageGet?: { status: number; body: unknown };
+  readonly storagePatch?: { status: number; body: unknown };
 }
 
 function setup(opts: {
@@ -89,6 +91,14 @@ function setup(opts: {
         const p = routes.postgresPut ?? { status: 200, body: {} };
         return Effect.succeed(legacyJsonResponse(request, p.status, p.body));
       }
+      if (url.includes("/config/storage")) {
+        if (request.method === "GET") {
+          const g = routes.storageGet ?? { status: 200, body: {} };
+          return Effect.succeed(legacyJsonResponse(request, g.status, g.body));
+        }
+        const p = routes.storagePatch ?? { status: 200, body: {} };
+        return Effect.succeed(legacyJsonResponse(request, p.status, p.body));
+      }
       // Anything else (auth/storage/etc.) — succeed with empty so unconfigured
       // gated services don't hang if a test enables them.
       return Effect.succeed(legacyJsonResponse(request, 200, {}));
@@ -119,6 +129,20 @@ enabled = false
 enabled = false
 `;
 
+const STORAGE_CONFIG_WITHOUT_POOL_MODE = {
+  fileSizeLimit: 52428800,
+  features: {
+    imageTransformation: { enabled: false },
+    s3Protocol: { enabled: false },
+    purgeCache: { enabled: false },
+    icebergCatalog: { enabled: false, maxNamespaces: 0, maxTables: 0, maxCatalogs: 0 },
+    vectorBuckets: { enabled: false, maxBuckets: 0, maxIndexes: 0 },
+  },
+  capabilities: { list_v2: true, iceberg_catalog: false },
+  external: { upstreamTarget: "main" },
+  migrationVersion: "20240701",
+};
+
 describe("legacy config push integration", () => {
   it.live("pushes local config (text, Go parity) and surfaces a PATCH failure", () => {
     const { layer, out } = setup({
@@ -307,6 +331,30 @@ project_id = "abcdefghijklmnopqrst"
     }).pipe(Effect.provide(layer));
   });
 
+  it.live("pushes storage when the remote response omits databasePoolMode", () => {
+    const { layer, api } = setup({
+      toml: `project_id = "test"
+[auth]
+enabled = false
+[storage]
+enabled = true
+file_size_limit = "50MiB"
+`,
+      yes: true,
+      routes: {
+        postgrestGet: { status: 200, body: POSTGREST_DISABLED },
+        postgresGet: { status: 200, body: {} },
+        storageGet: { status: 200, body: STORAGE_CONFIG_WITHOUT_POOL_MODE },
+      },
+    });
+    return Effect.gen(function* () {
+      yield* legacyConfigPush({ projectRef: Option.none() });
+      expect(
+        api.requests.some((r) => r.method === "GET" && r.url.includes("/config/storage")),
+      ).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
   it.live("flushes telemetry + linked-project cache on failure", () => {
     const { layer, telemetry, linkedProjectCache } = setup({
       toml: API_ONLY_TOML,
diff --git a/packages/api/scripts/openapi-overrides.json b/packages/api/scripts/openapi-overrides.json
index 38eabab930..8cdf59f4ae 100644
--- a/packages/api/scripts/openapi-overrides.json
+++ b/packages/api/scripts/openapi-overrides.json
@@ -615,5 +615,22 @@
       "type": "string",
       "nullable": true
     }
+  },
+  {
+    "op": "test",
+    "path": "/components/schemas/StorageConfigResponse/required",
+    "value": [
+      "fileSizeLimit",
+      "features",
+      "capabilities",
+      "external",
+      "migrationVersion",
+      "databasePoolMode"
+    ]
+  },
+  {
+    "op": "replace",
+    "path": "/components/schemas/StorageConfigResponse/required",
+    "value": ["fileSizeLimit", "features", "capabilities", "external", "migrationVersion"]
   }
 ]
diff --git a/packages/api/src/generated/contracts.ts b/packages/api/src/generated/contracts.ts
index b4f6f9200d..48a0fa2a9c 100644
--- a/packages/api/src/generated/contracts.ts
+++ b/packages/api/src/generated/contracts.ts
@@ -3527,7 +3527,7 @@ export const V1GetStorageConfigOutput = Schema.Struct({
   capabilities: Schema.Struct({ list_v2: Schema.Boolean, iceberg_catalog: Schema.Boolean }),
   external: Schema.Struct({ upstreamTarget: Schema.Literals(["main", "canary"]) }),
   migrationVersion: Schema.String,
-  databasePoolMode: Schema.String,
+  databasePoolMode: Schema.optionalKey(Schema.String),
 });
 export const V1GetVanitySubdomainConfigInput = Schema.Struct({
   ref: Schema.String.check(Schema.isMinLength(20))
diff --git a/packages/api/src/generated/openapi.json b/packages/api/src/generated/openapi.json
index 38dbe20844..758084cf9b 100644
--- a/packages/api/src/generated/openapi.json
+++ b/packages/api/src/generated/openapi.json
@@ -18698,14 +18698,7 @@
             "type": "string"
           }
         },
-        "required": [
-          "fileSizeLimit",
-          "features",
-          "capabilities",
-          "external",
-          "migrationVersion",
-          "databasePoolMode"
-        ]
+        "required": ["fileSizeLimit", "features", "capabilities", "external", "migrationVersion"]
       },
       "UpdateStorageConfigBody": {
         "type": "object",

From fc6dd9c87b9c0b6fdd27aa0203dab096d564d307 Mon Sep 17 00:00:00 2001
From: "supabase-cli-releaser[bot]"
 <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>
Date: Tue, 30 Jun 2026 08:32:09 +0000
Subject: [PATCH 28/29] chore: sync API types from infrastructure (#5713)

This PR was automatically created to sync API types from the
infrastructure repository.

Changes were detected in the generated API code after syncing with the
latest spec from infrastructure.

---------

Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
---
 apps/cli-go/pkg/api/types.gen.go  | 37 ++++++++++++++++++++++---------
 apps/cli-go/pkg/config/storage.go |  3 +++
 2 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/apps/cli-go/pkg/api/types.gen.go b/apps/cli-go/pkg/api/types.gen.go
index 16267c8dc4..838e1e776a 100644
--- a/apps/cli-go/pkg/api/types.gen.go
+++ b/apps/cli-go/pkg/api/types.gen.go
@@ -1427,6 +1427,7 @@ const (
 
 // Defines values for V1ListEntitlementsResponseEntitlementsFeatureKey.
 const (
+	V1ListEntitlementsResponseEntitlementsFeatureKeyApiMembersRoles                       V1ListEntitlementsResponseEntitlementsFeatureKey = "api.members.roles"
 	V1ListEntitlementsResponseEntitlementsFeatureKeyAssistantAdvanceModel                 V1ListEntitlementsResponseEntitlementsFeatureKey = "assistant.advance_model"
 	V1ListEntitlementsResponseEntitlementsFeatureKeyAuditLogDrains                        V1ListEntitlementsResponseEntitlementsFeatureKey = "audit_log_drains"
 	V1ListEntitlementsResponseEntitlementsFeatureKeyAuthAdvancedAuthSettings              V1ListEntitlementsResponseEntitlementsFeatureKey = "auth.advanced_auth_settings"
@@ -1485,6 +1486,7 @@ const (
 	V1ListEntitlementsResponseEntitlementsFeatureKeyStorageImageTransformations           V1ListEntitlementsResponseEntitlementsFeatureKey = "storage.image_transformations"
 	V1ListEntitlementsResponseEntitlementsFeatureKeyStorageMaxFileSize                    V1ListEntitlementsResponseEntitlementsFeatureKey = "storage.max_file_size"
 	V1ListEntitlementsResponseEntitlementsFeatureKeyStorageMaxFileSizeConfigurable        V1ListEntitlementsResponseEntitlementsFeatureKey = "storage.max_file_size.configurable"
+	V1ListEntitlementsResponseEntitlementsFeatureKeyStoragePurgeCache                     V1ListEntitlementsResponseEntitlementsFeatureKey = "storage.purge_cache"
 	V1ListEntitlementsResponseEntitlementsFeatureKeyStorageVectorBuckets                  V1ListEntitlementsResponseEntitlementsFeatureKey = "storage.vector_buckets"
 	V1ListEntitlementsResponseEntitlementsFeatureKeyVanitySubdomain                       V1ListEntitlementsResponseEntitlementsFeatureKey = "vanity_subdomain"
 )
@@ -3488,10 +3490,13 @@ type PostgrestConfigWithJWTSecretResponse struct {
 	DbExtraSearchPath string `json:"db_extra_search_path"`
 
 	// DbPool If `null`, the value is automatically configured based on compute size.
-	DbPool    nullable.Nullable[int] `json:"db_pool"`
-	DbSchema  string                 `json:"db_schema"`
-	JwtSecret *string                `json:"jwt_secret,omitempty"`
-	MaxRows   int                    `json:"max_rows"`
+	DbPool nullable.Nullable[int] `json:"db_pool"`
+
+	// DbPoolAcquisitionTimeout If `null`, the value is automatically configured to 10.
+	DbPoolAcquisitionTimeout nullable.Nullable[int] `json:"db_pool_acquisition_timeout"`
+	DbSchema                 string                 `json:"db_schema"`
+	JwtSecret                *string                `json:"jwt_secret,omitempty"`
+	MaxRows                  int                    `json:"max_rows"`
 }
 
 // ProjectClaimTokenResponse defines model for ProjectClaimTokenResponse.
@@ -3961,6 +3966,9 @@ type StorageConfigResponse struct {
 		ImageTransformation struct {
 			Enabled bool `json:"enabled"`
 		} `json:"imageTransformation"`
+		PurgeCache struct {
+			Enabled bool `json:"enabled"`
+		} `json:"purgeCache"`
 		S3Protocol struct {
 			Enabled bool `json:"enabled"`
 		} `json:"s3Protocol"`
@@ -4563,6 +4571,9 @@ type UpdateStorageConfigBody struct {
 		ImageTransformation *struct {
 			Enabled bool `json:"enabled"`
 		} `json:"imageTransformation,omitempty"`
+		PurgeCache *struct {
+			Enabled bool `json:"enabled"`
+		} `json:"purgeCache,omitempty"`
 		S3Protocol *struct {
 			Enabled bool `json:"enabled"`
 		} `json:"s3Protocol,omitempty"`
@@ -4909,9 +4920,12 @@ type V1PostgrestConfigResponse struct {
 	DbExtraSearchPath string `json:"db_extra_search_path"`
 
 	// DbPool If `null`, the value is automatically configured based on compute size.
-	DbPool   nullable.Nullable[int] `json:"db_pool"`
-	DbSchema string                 `json:"db_schema"`
-	MaxRows  int                    `json:"max_rows"`
+	DbPool nullable.Nullable[int] `json:"db_pool"`
+
+	// DbPoolAcquisitionTimeout If `null`, the value is automatically configured to 10.
+	DbPoolAcquisitionTimeout nullable.Nullable[int] `json:"db_pool_acquisition_timeout"`
+	DbSchema                 string                 `json:"db_schema"`
+	MaxRows                  int                    `json:"max_rows"`
 }
 
 // V1ProfileResponse defines model for V1ProfileResponse.
@@ -5166,10 +5180,11 @@ type V1UpdatePasswordResponse struct {
 
 // V1UpdatePostgrestConfigBody defines model for V1UpdatePostgrestConfigBody.
 type V1UpdatePostgrestConfigBody struct {
-	DbExtraSearchPath *string `json:"db_extra_search_path,omitempty"`
-	DbPool            *int    `json:"db_pool,omitempty"`
-	DbSchema          *string `json:"db_schema,omitempty"`
-	MaxRows           *int    `json:"max_rows,omitempty"`
+	DbExtraSearchPath        *string `json:"db_extra_search_path,omitempty"`
+	DbPool                   *int    `json:"db_pool,omitempty"`
+	DbPoolAcquisitionTimeout *int    `json:"db_pool_acquisition_timeout,omitempty"`
+	DbSchema                 *string `json:"db_schema,omitempty"`
+	MaxRows                  *int    `json:"max_rows,omitempty"`
 }
 
 // V1UpdateProjectBody defines model for V1UpdateProjectBody.
diff --git a/apps/cli-go/pkg/config/storage.go b/apps/cli-go/pkg/config/storage.go
index 740c525f43..14bf5ff082 100644
--- a/apps/cli-go/pkg/config/storage.go
+++ b/apps/cli-go/pkg/config/storage.go
@@ -73,6 +73,9 @@ func (s *storage) ToUpdateStorageConfigBody() v1API.UpdateStorageConfigBody {
 			ImageTransformation *struct {
 				Enabled bool `json:"enabled"`
 			} `json:"imageTransformation,omitempty"`
+			PurgeCache *struct {
+				Enabled bool `json:"enabled"`
+			} `json:"purgeCache,omitempty"`
 			S3Protocol *struct {
 				Enabled bool `json:"enabled"`
 			} `json:"s3Protocol,omitempty"`

From b48fad60ad441a111dde7f98762e969da366a709 Mon Sep 17 00:00:00 2001
From: Colum Ferry <cferry09@gmail.com>
Date: Tue, 30 Jun 2026 12:40:43 +0100
Subject: [PATCH 29/29] feat(cli): port migration commands to native TypeScript
 (CLI-1312) (#5671)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What changed

Ports 6 of 7 `supabase migration` subcommands from Go-proxy delegates to
native Effect/TypeScript in the legacy shell:

- `migration new` — writes `supabase/migrations/<ts>_<name>.sql` from
piped stdin
- `migration list` — merged Local / Remote / Time-UTC Glamour table;
defaults to `--linked`
- `migration fetch` — writes history rows to `supabase/migrations/`;
overwrite prompt
- `migration repair` — transactional create-table +
TRUNCATE/UPSERT/DELETE; repair-all prompt
- `migration up` — pending compute, `[db.vault]` upsert, per-file apply;
`--include-all`
- `migration down` — revert prompt → drop user schemas → vault →
migrate&seed to target version

Shared infra: consolidated `legacy-migration-history.ts` (SQL +
reconcile/pending/read helpers), hoisted `legacy-migration-file.ts` out
of `db/shared`, new `legacy-drop-objects.ts` / `legacy-vault.ts` /
`legacy-seed.ts` (with an `fs.Glob` port) /
`legacy-migrate-and-seed.ts`, and a `legacyReadDbToml` extension for
`[db.seed]` / `[db.vault]` / `[db.migrations]`. `db diff` / `db pull` /
declarative call sites were re-pointed to the consolidated module.

## Why

Replaces the last `migration` Go-proxy handlers with native
implementations (M5: Database & Migrations, CLI-1312), removing the
Go-binary dependency for these commands while preserving Go output /
flag / exit-code parity.

## Reviewer notes

- **`migration squash` is intentionally still a Go-proxy delegate.** A
native squash would emit pg-delta diff format instead of Go's `pg_dump`
bytes — a documented divergence (CLI-1597) that is *not* byte parity —
and needs a bare-baseline-shadow seam mode that does not exist yet. Kept
on the proxy (byte-identical to Go) until CLI-1597's rewrite, similar to
`db diff --use-pgadmin`.
- **`migration up` does not seed** — matches Go (`up.Run` only applies
migrations + upserts vault; seeding is `down`-only via
`MigrateAndSeed`).
- **Transaction shape:** Go runs repair/baseline/vault/seed DML via
`pgx.Batch` (no explicit transaction). `LegacyDbSession` has no batch
primitive, so the port wraps these in explicit
`BEGIN`/`COMMIT`/`ROLLBACK` — atomic, a deliberate safer divergence on
partial-failure paths; the success path is identical. The one exception
is pipeline-incompatible statements (see next note), which must run
outside any transaction.
- **Pipeline-incompatible statements run outside the transaction (adopts
supabase/cli#5156).** `migration up`/`down` (and declarative `sync`)
apply each file inside a `BEGIN`/`COMMIT`, but `CREATE INDEX
CONCURRENTLY`, `VACUUM`, `REINDEX … CONCURRENTLY`, `ALTER SYSTEM`, and
`CLUSTER` cannot run in a transaction block (SQLSTATE 25001).
`legacyApplyMigrationFile` now detects them
(`legacyIsPipelineIncompatible`), flushes the open batch, runs the
statement standalone, then resumes batching; the history insert lands in
the final batch so the migration is recorded only after every statement
succeeds. Files without such statements stay a single `BEGIN`/`COMMIT`
(behaviour unchanged). This ports the Go fix from supabase/cli#5156
directly into the native TS apply — that Go PR is being closed in favour
of this implementation, since these commands are now native TS. Fixes
supabase/cli#5139.
- **`migration down`** skips Go's best-effort
`pgcache.TryCacheMigrationsCatalog` (a guaranteed no-op there, since
`down` always passes a concrete version).
- Dotenvx-`encrypted:` `[db.vault]` values are not decrypted; they are
treated as unresolved/skipped, matching Go's outcome when no
`DOTENV_PRIVATE_KEY` is present.
- **Migration `--local` connect-error parity tests canonicalize
stderr.** The `migration … --local` e2e parity cases exercise the
connection-refused path, where the TS connect-error stderr does not yet
byte-match Go (Go: `Connecting to local database…` + pgconn dial error +
`SetConnectSuggestion`; TS: `@effect/sql-pg` `SqlError` + `--debug`
hint). Exit code, stdout, request log, and filesystem stay under strict
parity; the known stderr divergence is normalized to the shared `failed
to connect to postgres:` prefix, and the behaviour tests still assert
the meaningful substring + non-zero exit. Porting the connect-error
shaping to Go's wording is tracked separately.

Per-subcommand `SIDE_EFFECTS.md` and `docs/go-cli-porting-status.md` are
updated.

CLOSES CLI-1312
---
 apps/cli-e2e/src/tests/migrations.e2e.test.ts |   42 +-
 apps/cli/docs/go-cli-porting-status.md        |   28 +-
 apps/cli/package.json                         |    1 +
 .../legacy/commands/db/diff/diff.handler.ts   |    2 +-
 .../legacy/commands/db/pull/pull.handler.ts   |    6 +-
 .../src/legacy/commands/db/pull/pull.sync.ts  |  177 +--
 .../db/query/query.integration.test.ts        |   12 +-
 .../shared/legacy-debug-bundle.unit.test.ts   |    7 +-
 .../db/shared/legacy-pgdelta.cache.ts         |   26 +-
 .../shared/legacy-pgdelta.cache.unit.test.ts  |   48 +-
 .../db/shared/legacy-pgdelta.errors.ts        |   11 -
 .../commands/migration/down/SIDE_EFFECTS.md   |   30 +-
 .../commands/migration/down/down.command.ts   |   35 +-
 .../commands/migration/down/down.errors.ts    |   18 +
 .../commands/migration/down/down.handler.ts   |  176 ++-
 .../migration/down/down.integration.test.ts   |  409 +++++++
 .../commands/migration/fetch/SIDE_EFFECTS.md  |   28 +-
 .../commands/migration/fetch/fetch.command.ts |   20 +-
 .../migration/fetch/fetch.e2e.test.ts         |   52 +
 .../commands/migration/fetch/fetch.errors.ts  |   11 +
 .../commands/migration/fetch/fetch.handler.ts |  177 ++-
 .../migration/fetch/fetch.integration.test.ts |  365 ++++++
 .../migration/fetch/fetch.live.test.ts        |   91 ++
 .../commands/migration/list/SIDE_EFFECTS.md   |   10 +-
 .../commands/migration/list/list.command.ts   |   23 +-
 .../commands/migration/list/list.format.ts    |   76 ++
 .../migration/list/list.format.unit.test.ts   |   64 ++
 .../commands/migration/list/list.handler.ts   |  119 +-
 .../migration/list/list.integration.test.ts   |  268 +++++
 .../commands/migration/list/list.live.test.ts |   53 +
 .../commands/migration/migration.errors.ts    |   53 +
 .../migration/migration.integration.test.ts   |   12 +-
 .../commands/migration/migration.layers.ts    |   60 +
 .../commands/migration/migration.prompt.ts    |   53 +
 .../commands/migration/new/SIDE_EFFECTS.md    |   30 +-
 .../commands/migration/new/new.command.ts     |    9 +-
 .../commands/migration/new/new.e2e.test.ts    |   46 +
 .../commands/migration/new/new.errors.ts      |   10 +
 .../commands/migration/new/new.handler.ts     |  108 +-
 .../migration/new/new.integration.test.ts     |  197 ++++
 .../commands/migration/repair/SIDE_EFFECTS.md |   36 +-
 .../migration/repair/repair.command.ts        |   24 +-
 .../migration/repair/repair.errors.ts         |   12 +
 .../migration/repair/repair.handler.ts        |  262 ++++-
 .../repair/repair.integration.test.ts         |  473 ++++++++
 .../commands/migration/up/SIDE_EFFECTS.md     |   16 +-
 .../commands/migration/up/up.command.ts       |   21 +-
 .../legacy/commands/migration/up/up.errors.ts |   26 +
 .../commands/migration/up/up.handler.ts       |  159 ++-
 .../migration/up/up.integration.test.ts       |  296 +++++
 .../shared/legacy-db-config.toml-read.ts      |  984 +++++++++++++++-
 .../legacy-db-config.toml-read.unit.test.ts   | 1024 ++++++++++++++++-
 .../legacy/shared/legacy-db-target-flags.ts   |    7 +-
 .../legacy-db-target-flags.unit.test.ts       |   27 +
 .../src/legacy/shared/legacy-drop-objects.ts  |  162 +++
 .../legacy/shared/legacy-migrate-and-seed.ts  |   50 +
 .../legacy/shared/legacy-migration-apply.ts   |  188 ++-
 .../legacy-migration-apply.unit.test.ts       |  142 ++-
 .../db => }/shared/legacy-migration-file.ts   |    0
 .../shared/legacy-migration-file.unit.test.ts |    0
 .../legacy/shared/legacy-migration-history.ts |  436 +++++++
 .../legacy-migration-history.unit.test.ts}    |   47 +-
 .../legacy-migration-timestamp.format.ts      |   70 ++
 ...cy-migration-timestamp.format.unit.test.ts |   69 ++
 .../legacy/shared/legacy-migration.errors.ts  |   16 +
 .../src/legacy/shared/legacy-path-match.ts    |  211 ++++
 .../shared/legacy-path-match.unit.test.ts     |   87 ++
 apps/cli/src/legacy/shared/legacy-seed.ts     |  230 ++++
 .../legacy/shared/legacy-seed.unit.test.ts    |   81 ++
 .../src/legacy/shared/legacy-vault-decrypt.ts |  101 ++
 .../shared/legacy-vault-decrypt.unit.test.ts  |   91 ++
 apps/cli/src/legacy/shared/legacy-vault.ts    |   71 ++
 apps/cli/src/shared/legacy/global-flags.ts    |   19 +-
 .../cli/src/shared/legacy/legacy-viper-env.ts |   10 +-
 apps/cli/src/shared/runtime/stdin.layer.ts    |   26 +-
 apps/cli/src/shared/runtime/stdin.service.ts  |   22 +-
 apps/cli/tests/helpers/live-env.ts            |   52 +
 apps/cli/tests/helpers/live.ts                |   13 +
 apps/cli/tests/helpers/mocks.ts               |   22 +-
 pnpm-lock.yaml                                |  513 +--------
 80 files changed, 8162 insertions(+), 897 deletions(-)
 create mode 100644 apps/cli/src/legacy/commands/migration/down/down.errors.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/down/down.integration.test.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/fetch/fetch.e2e.test.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/fetch/fetch.errors.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/fetch/fetch.integration.test.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/fetch/fetch.live.test.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/list/list.format.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/list/list.format.unit.test.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/list/list.integration.test.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/list/list.live.test.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/migration.errors.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/migration.layers.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/migration.prompt.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/new/new.e2e.test.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/new/new.errors.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/new/new.integration.test.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/repair/repair.errors.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/repair/repair.integration.test.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/up/up.errors.ts
 create mode 100644 apps/cli/src/legacy/commands/migration/up/up.integration.test.ts
 create mode 100644 apps/cli/src/legacy/shared/legacy-drop-objects.ts
 create mode 100644 apps/cli/src/legacy/shared/legacy-migrate-and-seed.ts
 rename apps/cli/src/legacy/{commands/db => }/shared/legacy-migration-file.ts (100%)
 rename apps/cli/src/legacy/{commands/db => }/shared/legacy-migration-file.unit.test.ts (100%)
 create mode 100644 apps/cli/src/legacy/shared/legacy-migration-history.ts
 rename apps/cli/src/legacy/{commands/db/pull/pull.sync.unit.test.ts => shared/legacy-migration-history.unit.test.ts} (71%)
 create mode 100644 apps/cli/src/legacy/shared/legacy-migration-timestamp.format.ts
 create mode 100644 apps/cli/src/legacy/shared/legacy-migration-timestamp.format.unit.test.ts
 create mode 100644 apps/cli/src/legacy/shared/legacy-migration.errors.ts
 create mode 100644 apps/cli/src/legacy/shared/legacy-path-match.ts
 create mode 100644 apps/cli/src/legacy/shared/legacy-path-match.unit.test.ts
 create mode 100644 apps/cli/src/legacy/shared/legacy-seed.ts
 create mode 100644 apps/cli/src/legacy/shared/legacy-seed.unit.test.ts
 create mode 100644 apps/cli/src/legacy/shared/legacy-vault-decrypt.ts
 create mode 100644 apps/cli/src/legacy/shared/legacy-vault-decrypt.unit.test.ts
 create mode 100644 apps/cli/src/legacy/shared/legacy-vault.ts

diff --git a/apps/cli-e2e/src/tests/migrations.e2e.test.ts b/apps/cli-e2e/src/tests/migrations.e2e.test.ts
index df82ea5be1..0e3dbc932f 100644
--- a/apps/cli-e2e/src/tests/migrations.e2e.test.ts
+++ b/apps/cli-e2e/src/tests/migrations.e2e.test.ts
@@ -5,6 +5,33 @@ import { testBehaviour, testParity } from "./test-context.ts";
 
 const MIGRATION_NAME = "my_change";
 
+// The `migration … --local` parity cases deliberately exercise the
+// connection-refused path (no local stack), and on that path the TS port's stderr
+// does not yet byte-match the Go CLI: Go prints `Connecting to local database...`,
+// the pgconn dial error, and `SetConnectSuggestion`'s Network-Restrictions hint,
+// whereas the TS layer surfaces the `@effect/sql-pg` SqlError and the generic
+// `--debug` suggestion. Porting that connect-error shaping is tracked separately
+// (see the PR's local-connect parity note). Until then we keep exit code, stdout,
+// request log, and filesystem under strict parity and canonicalize the known stderr
+// divergence down to the shared `failed to connect to postgres:` prefix. The
+// `exits non-zero on connection refused` behaviour tests below still assert the
+// meaningful stderr substring and non-zero exit, so the contract stays covered.
+const CONNECT_REFUSED_STDERR_STRIP: readonly RegExp[] = [
+  // Go-only "Connecting to local database..." preamble (the TS port omits it).
+  /^Connecting to local database\.\.\.\n/m,
+  // Driver-specific detail after the shared "failed to connect to postgres:" prefix
+  // (Go: pgconn dial error; TS: effect/sql SqlError).
+  /(?<=failed to connect to postgres:).*/g,
+  // Go's SetConnectSuggestion: Network-Restrictions hint + dashboard URL line.
+  /\nMake sure your local IP is allowed in Network Restrictions and Network Bans\.\n[^\n]*/g,
+  // TS's generic --debug suggestion.
+  /\nTry rerunning the command with --debug to troubleshoot the error\./g,
+];
+
+const connectRefusedParity = {
+  normalize: { stderr: { stripPatterns: CONNECT_REFUSED_STDERR_STRIP } },
+};
+
 describe("migrations", () => {
   describe("migration:new", () => {
     testBehaviour("creates timestamped sql file", async ({ run, workspace }) => {
@@ -29,7 +56,7 @@ describe("migrations", () => {
       expect(result.stderr).toContain("failed to connect");
     });
 
-    testParity(["migration", "list", "--local"]);
+    testParity(["migration", "list", "--local"], connectRefusedParity);
   });
 
   describe("migration:up", () => {
@@ -39,7 +66,7 @@ describe("migrations", () => {
       expect(result.stderr).toContain("failed to connect");
     });
 
-    testParity(["migration", "up", "--local"]);
+    testParity(["migration", "up", "--local"], connectRefusedParity);
   });
 
   describe("migration:down", () => {
@@ -55,8 +82,8 @@ describe("migrations", () => {
       expect(result.stderr).toContain("failed to connect");
     });
 
-    testParity(["migration", "down", "--local"]);
-    testParity(["migration", "down", "--last", "2", "--local"]);
+    testParity(["migration", "down", "--local"], connectRefusedParity);
+    testParity(["migration", "down", "--last", "2", "--local"], connectRefusedParity);
   });
 
   describe("migration:repair", () => {
@@ -79,7 +106,10 @@ describe("migrations", () => {
       expect(result.stderr).toContain("failed to connect");
     });
 
-    testParity(["migration", "repair", "--status", "applied", "--local", "20230101000000"]);
+    testParity(
+      ["migration", "repair", "--status", "applied", "--local", "20230101000000"],
+      connectRefusedParity,
+    );
   });
 
   describe("migration:squash", () => {
@@ -99,6 +129,6 @@ describe("migrations", () => {
       expect(result.stderr).toContain("failed to connect");
     });
 
-    testParity(["migration", "fetch", "--local"]);
+    testParity(["migration", "fetch", "--local"], connectRefusedParity);
   });
 });
diff --git a/apps/cli/docs/go-cli-porting-status.md b/apps/cli/docs/go-cli-porting-status.md
index 9b22759d95..f5969bd199 100644
--- a/apps/cli/docs/go-cli-porting-status.md
+++ b/apps/cli/docs/go-cli-porting-status.md
@@ -115,13 +115,13 @@ These commands exist in the TS CLI today but have no direct top-level equivalent
 | `inspect db seq-scans`            | `ported`  | `legacy/commands/inspect/db/seq-scans/`            | `n/a`                | `n/a`                 | Native TS port. Deprecated (use index-stats); routes to the active query.                                                                                                                                                                                                                                                                                |
 | `inspect db role-configs`         | `ported`  | `legacy/commands/inspect/db/role-configs/`         | `n/a`                | `n/a`                 | Native TS port. Deprecated (use role-stats); routes to the active query.                                                                                                                                                                                                                                                                                 |
 | `inspect db role-connections`     | `ported`  | `legacy/commands/inspect/db/role-connections/`     | `n/a`                | `n/a`                 | Native TS port. Deprecated (use role-stats); routes to the active query.                                                                                                                                                                                                                                                                                 |
-| `migration down`                  | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                                                                                                                |
-| `migration fetch`                 | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                                                                                                                |
-| `migration list`                  | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                                                                                                                |
-| `migration new`                   | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                                                                                                                |
-| `migration repair`                | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                                                                                                                |
-| `migration squash`                | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                                                                                                                |
-| `migration up`                    | `missing` | `missing`                                          | `n/a`                | `n/a`                 | No native TS implementation yet. Wrapped in legacy shell.                                                                                                                                                                                                                                                                                                |
+| `migration down`                  | `ported`  | `legacy/commands/migration/down/`                  | `n/a`                | `n/a`                 | Native TS port. Revert prompt → drop user schemas → vault upsert → migrate&seed to the target version; defaults to `--local`. Skips Go's pgcache catalog write.                                                                                                                                                                                          |
+| `migration fetch`                 | `ported`  | `legacy/commands/migration/fetch/`                 | `n/a`                | `n/a`                 | Native TS port. Reads `schema_migrations` and writes `supabase/migrations/<version>_<name>.sql`; overwrite prompt for a non-empty dir.                                                                                                                                                                                                                   |
+| `migration list`                  | `ported`  | `legacy/commands/migration/list/`                  | `n/a`                | `n/a`                 | Native TS port. Merges remote `schema_migrations` with local files into a Glamour ASCII table (Local / Remote / Time-UTC columns); defaults to `--linked`.                                                                                                                                                                                               |
+| `migration new`                   | `ported`  | `legacy/commands/migration/new/`                   | `n/a`                | `n/a`                 | Native TS port. Writes `supabase/migrations/<timestamp>_<name>.sql` (mode 0644) from piped stdin; no DB/API.                                                                                                                                                                                                                                             |
+| `migration repair`                | `ported`  | `legacy/commands/migration/repair/`                | `n/a`                | `n/a`                 | Native TS port. Transactional create-table + TRUNCATE/UPSERT/DELETE; applied mode reads local files; repair-all prompt; defaults to `--linked`.                                                                                                                                                                                                          |
+| `migration squash`                | `missing` | `missing`                                          | `n/a`                | `n/a`                 | Deliberate Go-proxy delegate (parity-preserving). A native port would emit pg-delta diff format instead of Go's `pg_dump` bytes (an accepted divergence, CLI-1597) and needs a bare-baseline shadow the seam does not yet expose; kept on the proxy for byte parity until CLI-1597's squash rewrite lands.                                               |
+| `migration up`                    | `ported`  | `legacy/commands/migration/up/`                    | `n/a`                | `n/a`                 | Native TS port. Computes pending migrations, upserts `[db.vault]`, applies each transactionally; `--include-all` for out-of-order; defaults to `--local`. Does not seed (matches Go).                                                                                                                                                                    |
 | `seed buckets`                    | `ported`  | `legacy/commands/seed/buckets/`                    | `n/a`                | `n/a`                 | Native TS port. Local-only (Go's `seed` defines no `--project-ref`, so the ref is always empty): seeds `[storage.buckets]` + `[storage.vector]` against the local Storage service gateway; remote/analytics paths are unreachable and omitted. `--linked`/`--local` accepted for surface parity (both seed local). Vector graceful-skip WARNINGs ported. |
 | `test db`                         | `ported`  | `legacy/commands/test/db/`                         | `n/a`                | `n/a`                 | Native TS port. `--db-url`/`--local`/`--linked` + variadic paths; runs `supabase/pg_prove:3.36` via `docker run`; pgTAP enable/disable via `@effect/sql-pg`. `--network-id` override and `[images]` config override not modeled (documented divergences).                                                                                                |
 | `test new`                        | `ported`  | `legacy/commands/test/new/`                        | `n/a`                | `n/a`                 | Native TS port. Writes `supabase/tests/<name>_test.sql` from the embedded pgtap template; `--template` (pgtap).                                                                                                                                                                                                                                          |
@@ -274,13 +274,13 @@ Legend:
 | `telemetry enable`                     | `ported`      | [`../src/legacy/commands/telemetry/enable/enable.command.ts`](../src/legacy/commands/telemetry/enable/enable.command.ts)                                                                                                                                                   |
 | `telemetry disable`                    | `ported`      | [`../src/legacy/commands/telemetry/disable/disable.command.ts`](../src/legacy/commands/telemetry/disable/disable.command.ts)                                                                                                                                               |
 | `telemetry status`                     | `ported`      | [`../src/legacy/commands/telemetry/status/status.command.ts`](../src/legacy/commands/telemetry/status/status.command.ts)                                                                                                                                                   |
-| `migration list`                       | `wrapped`     | [`../src/legacy/commands/migration/list/list.command.ts`](../src/legacy/commands/migration/list/list.command.ts)                                                                                                                                                           |
-| `migration new`                        | `wrapped`     | [`../src/legacy/commands/migration/new/new.command.ts`](../src/legacy/commands/migration/new/new.command.ts)                                                                                                                                                               |
-| `migration repair`                     | `wrapped`     | [`../src/legacy/commands/migration/repair/repair.command.ts`](../src/legacy/commands/migration/repair/repair.command.ts)                                                                                                                                                   |
-| `migration squash`                     | `wrapped`     | [`../src/legacy/commands/migration/squash/squash.command.ts`](../src/legacy/commands/migration/squash/squash.command.ts)                                                                                                                                                   |
-| `migration up`                         | `wrapped`     | [`../src/legacy/commands/migration/up/up.command.ts`](../src/legacy/commands/migration/up/up.command.ts)                                                                                                                                                                   |
-| `migration down`                       | `wrapped`     | [`../src/legacy/commands/migration/down/down.command.ts`](../src/legacy/commands/migration/down/down.command.ts)                                                                                                                                                           |
-| `migration fetch`                      | `wrapped`     | [`../src/legacy/commands/migration/fetch/fetch.command.ts`](../src/legacy/commands/migration/fetch/fetch.command.ts)                                                                                                                                                       |
+| `migration list`                       | `ported`      | [`../src/legacy/commands/migration/list/list.command.ts`](../src/legacy/commands/migration/list/list.command.ts) — native; merged Local/Remote/Time-UTC Glamour table                                                                                                      |
+| `migration new`                        | `ported`      | [`../src/legacy/commands/migration/new/new.command.ts`](../src/legacy/commands/migration/new/new.command.ts) — native; writes `supabase/migrations/<timestamp>_<name>.sql` from piped stdin                                                                                |
+| `migration repair`                     | `ported`      | [`../src/legacy/commands/migration/repair/repair.command.ts`](../src/legacy/commands/migration/repair/repair.command.ts) — native; transactional TRUNCATE/UPSERT/DELETE, repair-all prompt                                                                                 |
+| `migration squash`                     | `wrapped`     | [`../src/legacy/commands/migration/squash/squash.command.ts`](../src/legacy/commands/migration/squash/squash.command.ts) — deliberate Go delegate for byte parity (native pg-delta squash deferred to CLI-1597)                                                            |
+| `migration up`                         | `ported`      | [`../src/legacy/commands/migration/up/up.command.ts`](../src/legacy/commands/migration/up/up.command.ts) — native; pending compute + vault upsert + per-file apply                                                                                                         |
+| `migration down`                       | `ported`      | [`../src/legacy/commands/migration/down/down.command.ts`](../src/legacy/commands/migration/down/down.command.ts) — native; drop + vault + migrate&seed to target version                                                                                                   |
+| `migration fetch`                      | `ported`      | [`../src/legacy/commands/migration/fetch/fetch.command.ts`](../src/legacy/commands/migration/fetch/fetch.command.ts) — native; writes history rows to `supabase/migrations/`                                                                                               |
 | `gen types`                            | `ported`      | [`../src/legacy/commands/gen/types/types.command.ts`](../src/legacy/commands/gen/types/types.command.ts)                                                                                                                                                                   |
 | `gen signing-key`                      | `ported`      | [`../src/legacy/commands/gen/signing-key/signing-key.command.ts`](../src/legacy/commands/gen/signing-key/signing-key.command.ts)                                                                                                                                           |
 | `gen bearer-jwt`                       | `wrapped`     | [`../src/legacy/commands/gen/bearer-jwt/bearer-jwt.command.ts`](../src/legacy/commands/gen/bearer-jwt/bearer-jwt.command.ts)                                                                                                                                               |
diff --git a/apps/cli/package.json b/apps/cli/package.json
index 876835b92b..03f695883a 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -39,6 +39,7 @@
     "fix:all": "nx run-many -t lint:fix fmt:fix knip:fix --projects=$npm_package_name"
   },
   "dependencies": {
+    "eciesjs": "^0.5.0",
     "jose": "^6.2.3"
   },
   "devDependencies": {
diff --git a/apps/cli/src/legacy/commands/db/diff/diff.handler.ts b/apps/cli/src/legacy/commands/db/diff/diff.handler.ts
index 73c0f7b6d5..c7dcdb5fad 100644
--- a/apps/cli/src/legacy/commands/db/diff/diff.handler.ts
+++ b/apps/cli/src/legacy/commands/db/diff/diff.handler.ts
@@ -25,7 +25,7 @@ import {
 import {
   legacyFormatMigrationTimestamp,
   legacyGetMigrationPath,
-} from "../shared/legacy-migration-file.ts";
+} from "../../../shared/legacy-migration-file.ts";
 import { legacyDiffMigra } from "../shared/legacy-migra.ts";
 import { type LegacyPgDeltaContext, legacyDiffPgDelta } from "../shared/legacy-pgdelta.ts";
 import { LegacyDeclarativeSeam } from "../shared/legacy-pgdelta.seam.service.ts";
diff --git a/apps/cli/src/legacy/commands/db/pull/pull.handler.ts b/apps/cli/src/legacy/commands/db/pull/pull.handler.ts
index 05721ac867..aa7a44fc27 100644
--- a/apps/cli/src/legacy/commands/db/pull/pull.handler.ts
+++ b/apps/cli/src/legacy/commands/db/pull/pull.handler.ts
@@ -40,7 +40,7 @@ import { legacyDiffMigra } from "../shared/legacy-migra.ts";
 import {
   legacyFormatMigrationTimestamp,
   legacyGetMigrationPath,
-} from "../shared/legacy-migration-file.ts";
+} from "../../../shared/legacy-migration-file.ts";
 import { legacyFormatDebugId } from "../shared/legacy-debug-bundle.ts";
 import {
   type LegacyPgDeltaContext,
@@ -63,8 +63,8 @@ import {
   legacyListRemoteMigrations,
   legacyLoadLocalVersions,
   legacyReconcileMigrations,
-  legacyUpdateMigrationHistory,
-} from "./pull.sync.ts";
+} from "../../../shared/legacy-migration-history.ts";
+import { legacyUpdateMigrationHistory } from "./pull.sync.ts";
 
 // pflag's `MarkDeprecated` emits `"Flag --%s has been deprecated, %s\n"` with the
 // registration message verbatim (`apps/cli-go/cmd/db.go:466`), which ends with a `.`.
diff --git a/apps/cli/src/legacy/commands/db/pull/pull.sync.ts b/apps/cli/src/legacy/commands/db/pull/pull.sync.ts
index 66da65778c..3e251e4c1b 100644
--- a/apps/cli/src/legacy/commands/db/pull/pull.sync.ts
+++ b/apps/cli/src/legacy/commands/db/pull/pull.sync.ts
@@ -1,176 +1,15 @@
 import { Effect, type FileSystem, type Path } from "effect";
 
 import { Output } from "../../../../shared/output/output.service.ts";
-import { legacyBold } from "../../../shared/legacy-colors.ts";
-import type { LegacyDbExecError } from "../../../shared/legacy-db-connection.errors.ts";
 import type { LegacyDbSession } from "../../../shared/legacy-db-connection.service.ts";
+import {
+  MIGRATE_FILE_PATTERN,
+  UPSERT_MIGRATION_VERSION,
+  legacyCreateMigrationTable,
+} from "../../../shared/legacy-migration-history.ts";
 import { legacySplitAndTrim } from "../../../shared/legacy-sql-split.ts";
-import { LegacyMigrationsReadError } from "../shared/legacy-pgdelta.errors.ts";
-import { legacyListLocalMigrations } from "../shared/legacy-pgdelta.cache.ts";
 import { LegacyDbPullWriteError } from "./pull.errors.ts";
 
-/** `SELECT version FROM supabase_migrations.schema_migrations ORDER BY version`. */
-const LIST_MIGRATION_VERSION =
-  "SELECT version FROM supabase_migrations.schema_migrations ORDER BY version";
-
-// Migration-history DDL/DML, verbatim from Go's `pkg/migration/history.go`.
-const SET_LOCK_TIMEOUT = "SET lock_timeout = '4s'";
-const CREATE_VERSION_SCHEMA = "CREATE SCHEMA IF NOT EXISTS supabase_migrations";
-const CREATE_VERSION_TABLE =
-  "CREATE TABLE IF NOT EXISTS supabase_migrations.schema_migrations (version text NOT NULL PRIMARY KEY)";
-const ADD_STATEMENTS_COLUMN =
-  "ALTER TABLE supabase_migrations.schema_migrations ADD COLUMN IF NOT EXISTS statements text[]";
-const ADD_NAME_COLUMN =
-  "ALTER TABLE supabase_migrations.schema_migrations ADD COLUMN IF NOT EXISTS name text";
-const UPSERT_MIGRATION_VERSION =
-  "INSERT INTO supabase_migrations.schema_migrations(version, name, statements) VALUES($1, $2, $3) ON CONFLICT (version) DO UPDATE SET name = EXCLUDED.name, statements = EXCLUDED.statements";
-
-// `pkg/migration/file.go` — `<digits>_<name>.sql`.
-const MIGRATE_FILE_PATTERN = /^([0-9]+)_(.*)\.sql$/u;
-
-/** The outcome of comparing remote vs local migration histories. */
-export type LegacyMigrationSync =
-  | { readonly kind: "in-sync" }
-  | { readonly kind: "missing" }
-  | { readonly kind: "conflict"; readonly suggestion: string };
-
-/**
- * Reconciles the remote and local migration version lists. Pure port of Go's
- * `assertRemoteInSync` two-pointer comparison (`internal/db/pull/pull.go:212-258`):
- * versions that fail to parse as integers are skipped (Go's `Atoi` error →
- * `continue`); any extra remote/local version is a conflict; an empty local set
- * is `missing`; otherwise in-sync.
- */
-export function legacyReconcileMigrations(
-  remote: ReadonlyArray<string>,
-  local: ReadonlyArray<string>,
-): LegacyMigrationSync {
-  // Go's `math.MaxInt` on a 64-bit build == math.MaxInt64; the exhausted side pins
-  // here. Use BigInt so the full int64 range compares EXACTLY — `Number` loses
-  // precision above `Number.MAX_SAFE_INTEGER` (e.g. `Number("9999999999999999")`
-  // rounds to 1e16), which would mis-order versions Go accepts.
-  const MAX = 9223372036854775807n;
-  const extraRemote: Array<string> = [];
-  const extraLocal: Array<string> = [];
-  let i = 0;
-  let j = 0;
-  // Matches Go's `strconv.Atoi`: digits only, no empty/whitespace/sign/float. A
-  // non-parseable version is skipped (Go's `Atoi` error → `continue`). On 64-bit
-  // builds `Atoi` parses the full int64 range and returns a range error ONLY for
-  // values above int64 max; reject only those (so e.g. `9999999999999999`, which Go
-  // accepts and surfaces as a conflict, is NOT skipped) while still rejecting
-  // 19+-digit values above the sentinel so they can never exceed the exhausted-side
-  // pin and stall the two-pointer scan.
-  const parseVersion = (v: string): bigint | undefined => {
-    if (!/^\d+$/u.test(v)) return undefined;
-    const parsed = BigInt(v);
-    return parsed > MAX ? undefined : parsed;
-  };
-  while (i < remote.length || j < local.length) {
-    let remoteTs = MAX;
-    if (i < remote.length) {
-      const parsed = parseVersion(remote[i]!);
-      if (parsed === undefined) {
-        i++;
-        continue;
-      }
-      remoteTs = parsed;
-    }
-    let localTs = MAX;
-    if (j < local.length) {
-      const parsed = parseVersion(local[j]!);
-      if (parsed === undefined) {
-        j++;
-        continue;
-      }
-      localTs = parsed;
-    }
-    if (localTs < remoteTs) {
-      extraLocal.push(local[j]!);
-      j++;
-    } else if (remoteTs < localTs) {
-      extraRemote.push(remote[i]!);
-      i++;
-    } else {
-      i++;
-      j++;
-    }
-  }
-  if (extraRemote.length + extraLocal.length > 0) {
-    return { kind: "conflict", suggestion: legacySuggestMigrationRepair(extraRemote, extraLocal) };
-  }
-  if (local.length === 0) {
-    return { kind: "missing" };
-  }
-  return { kind: "in-sync" };
-}
-
-/** Go's `suggestMigrationRepair` (`internal/db/pull/pull.go:280-289`). */
-export function legacySuggestMigrationRepair(
-  extraRemote: ReadonlyArray<string>,
-  extraLocal: ReadonlyArray<string>,
-): string {
-  let result =
-    "\nMake sure your local git repo is up-to-date. If the error persists, try repairing the migration history table:\n";
-  for (const version of extraRemote) {
-    result += `${legacyBold(`supabase migration repair --status reverted ${version}`)}\n`;
-  }
-  for (const version of extraLocal) {
-    result += `${legacyBold(`supabase migration repair --status applied ${version}`)}\n`;
-  }
-  return result;
-}
-
-/**
- * Lists the remote project's applied migration versions. Mirrors Go's
- * `migration.ListRemoteMigrations` (`pkg/migration/list.go:18-31`): ONLY a missing
- * history table (`pgerrcode.UndefinedTable` = `42P01`) means the remote has no
- * migrations and returns `[]`; any other error (e.g. a malformed table missing the
- * `version` column, `42703`) propagates rather than being silently treated as an
- * initial pull. We match the SQLSTATE like Go; if the driver didn't surface a code,
- * fall back to a message check that matches a missing relation but NOT a missing
- * column.
- */
-export const legacyListRemoteMigrations = (session: LegacyDbSession) =>
-  session.query(LIST_MIGRATION_VERSION).pipe(
-    Effect.map((rows) => rows.map((row) => String(row["version"]))),
-    Effect.catch((error) =>
-      legacyIsUndefinedTableError(error)
-        ? Effect.succeed<ReadonlyArray<string>>([])
-        : Effect.fail(new LegacyMigrationsReadError({ message: error.message })),
-    ),
-  );
-
-/** Whether a query error is Postgres `undefined_table` (42P01), matching Go's `pgerrcode.UndefinedTable`. */
-const legacyIsUndefinedTableError = (error: LegacyDbExecError): boolean => {
-  if (error.code !== undefined) return error.code === "42P01";
-  // No SQLSTATE surfaced: a relation-not-exist message counts, a column-not-exist
-  // one does not (Postgres phrases an undefined column as `column "x" does not exist`).
-  return (
-    /relation .* does not exist/iu.test(error.message) &&
-    !/column .* does not exist/iu.test(error.message)
-  );
-};
-
-/**
- * Loads the local migration versions (the `<timestamp>` prefixes). Mirrors Go's
- * `LoadLocalVersions` (`internal/migration/list/list.go:72`) → `ListLocalMigrations`
- * with a version-collecting filter.
- */
-export const legacyLoadLocalVersions = (
-  fs: FileSystem.FileSystem,
-  path: Path.Path,
-  migrationsDir: string,
-) =>
-  legacyListLocalMigrations(fs, path, migrationsDir).pipe(
-    Effect.map((paths) =>
-      paths.flatMap((p) => {
-        const match = MIGRATE_FILE_PATTERN.exec(path.basename(p));
-        return match?.[1] !== undefined ? [match[1]] : [];
-      }),
-    ),
-  );
-
 /**
  * Records the pulled migration as applied in `supabase_migrations.schema_migrations`
  * WITHOUT re-executing it (the schema already exists on the remote). Mirrors Go's
@@ -213,11 +52,7 @@ export const legacyUpdateMigrationHistory = (
     yield* Effect.gen(function* () {
       const content = yield* fs.readFileString(migrationPath);
       const statements = legacySplitAndTrim(content);
-      yield* session.exec(SET_LOCK_TIMEOUT);
-      yield* session.exec(CREATE_VERSION_SCHEMA);
-      yield* session.exec(CREATE_VERSION_TABLE);
-      yield* session.exec(ADD_STATEMENTS_COLUMN);
-      yield* session.exec(ADD_NAME_COLUMN);
+      yield* legacyCreateMigrationTable(session);
       yield* session.query(UPSERT_MIGRATION_VERSION, [version, name, statements]);
     }).pipe(
       Effect.mapError(
diff --git a/apps/cli/src/legacy/commands/db/query/query.integration.test.ts b/apps/cli/src/legacy/commands/db/query/query.integration.test.ts
index 524d5786f1..8779891687 100644
--- a/apps/cli/src/legacy/commands/db/query/query.integration.test.ts
+++ b/apps/cli/src/legacy/commands/db/query/query.integration.test.ts
@@ -3,7 +3,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Cause, Effect, Exit, Layer, Option, Redacted } from "effect";
+import { Cause, Effect, Exit, Layer, Option, Redacted, Stream } from "effect";
 import * as HttpClient from "effect/unstable/http/HttpClient";
 import * as HttpClientError from "effect/unstable/http/HttpClientError";
 import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
@@ -147,11 +147,21 @@ function mockStdin(opts: { isTTY?: boolean; piped?: string }) {
     readPipedBytes: Effect.succeed(
       opts.piped === undefined ? Option.none() : Option.some(new TextEncoder().encode(opts.piped)),
     ),
+    pipedBytesStream:
+      opts.piped === undefined
+        ? Stream.empty
+        : Stream.fromIterable([new TextEncoder().encode(opts.piped)]),
     readPipedText: Effect.succeed(
       opts.piped === undefined || opts.piped.trim() === ""
         ? Option.none()
         : Option.some(opts.piped.trim()),
     ),
+    readLine: () =>
+      Effect.succeed(
+        opts.piped === undefined || opts.piped.split(/\r?\n/u)[0]!.trim() === ""
+          ? Option.none()
+          : Option.some(opts.piped.split(/\r?\n/u)[0]!.trim()),
+      ),
   });
 }
 
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-debug-bundle.unit.test.ts b/apps/cli/src/legacy/commands/db/shared/legacy-debug-bundle.unit.test.ts
index af023ed36a..b15c6612d2 100644
--- a/apps/cli/src/legacy/commands/db/shared/legacy-debug-bundle.unit.test.ts
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-debug-bundle.unit.test.ts
@@ -3,8 +3,9 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Exit, FileSystem, Path } from "effect";
+import { Effect, Exit, FileSystem, Layer, Path } from "effect";
 
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
 import { legacyCollectMigrationsList, legacySaveDebugBundle } from "./legacy-debug-bundle.ts";
 
 const save = (workdir: string, tempDir: string, migrationsDir: string, id: string) =>
@@ -16,7 +17,7 @@ const save = (workdir: string, tempDir: string, migrationsDir: string, id: strin
       error: "boom",
       migrationSql: "create table t();",
     });
-  }).pipe(Effect.provide(BunServices.layer));
+  }).pipe(Effect.provide(Layer.mergeAll(BunServices.layer, mockOutput().layer)));
 
 describe("legacySaveDebugBundle", () => {
   it.effect("writes artifacts and returns the debug directory", () => {
@@ -58,7 +59,7 @@ const collect = (migrationsDir: string) =>
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
     return yield* legacyCollectMigrationsList(fs, path, migrationsDir);
-  }).pipe(Effect.provide(BunServices.layer));
+  }).pipe(Effect.provide(Layer.mergeAll(BunServices.layer, mockOutput().layer)));
 
 describe("legacyCollectMigrationsList", () => {
   it.effect("returns migration filenames when the dir is readable", () => {
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.ts b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.ts
index 280bd67510..a15f683d02 100644
--- a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.ts
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.ts
@@ -1,7 +1,8 @@
 import { createHash } from "node:crypto";
 import { Effect, type FileSystem, Option, type Path } from "effect";
 
-import { LegacyMigrationsReadError } from "./legacy-pgdelta.errors.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { LegacyMigrationsReadError } from "../../../shared/legacy-migration.errors.ts";
 
 /**
  * Declarative catalog-cache key builders + on-disk catalog resolution, ported
@@ -106,12 +107,19 @@ export function legacyPgDeltaTempPath(path: Path.Path, workdir: string): string
  * `migration.ListLocalMigrations` (`pkg/migration/list.go:33`): entries are
  * sorted by name, directories skipped, a deprecated `<14-digit>_init.sql` first
  * migration (pre-2021-12-09) is skipped, and names must match `<digits>_*.sql`.
+ *
+ * Each skipped file emits a byte-exact stderr warning matching Go's
+ * `fmt.Fprintf(os.Stderr, …)` (`list.go:45-53`) — same wording for both the
+ * deprecated-init and misnamed-file cases. Because this is the shared lister,
+ * the warning fires for the `db diff/pull/schema declarative` and pgcache paths
+ * too, not only the `migration` commands, exactly as in Go.
  */
 export const legacyListLocalMigrations = Effect.fnUntraced(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   migrationsDir: string,
 ) {
+  const output = yield* Output;
   // Mirror Go's single `fs.ReadDir` (`pkg/migration/list.go:34-37`): only a
   // not-exist directory is "no migrations"; every other read error (the path is a
   // file → `ENOTDIR`, permission denied, …) aborts rather than silently letting
@@ -137,9 +145,21 @@ export const legacyListLocalMigrations = Effect.fnUntraced(function* (
     if (Option.isSome(stat) && stat.value.type === "Directory") continue;
     if (index === 0) {
       const init = INIT_SCHEMA_PATTERN.exec(name);
-      if (init !== null && Number(init[1]) < INIT_SCHEMA_CUTOFF) continue;
+      if (init !== null && Number(init[1]) < INIT_SCHEMA_CUTOFF) {
+        yield* output.raw(
+          `Skipping migration ${name}... (replace "init" with a different file name to apply this migration)\n`,
+          "stderr",
+        );
+        continue;
+      }
+    }
+    if (!MIGRATE_FILE_PATTERN.test(name)) {
+      yield* output.raw(
+        `Skipping migration ${name}... (file name must match pattern "<timestamp>_name.sql")\n`,
+        "stderr",
+      );
+      continue;
     }
-    if (!MIGRATE_FILE_PATTERN.test(name)) continue;
     result.push(path.join(migrationsDir, name));
   }
   return result as ReadonlyArray<string>;
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.unit.test.ts b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.unit.test.ts
index 6262d5970d..9f2e57e3aa 100644
--- a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.unit.test.ts
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.cache.unit.test.ts
@@ -4,8 +4,10 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, FileSystem, Option, Path } from "effect";
+import { Effect, FileSystem, Layer, Option, Path } from "effect";
 
+import { Output } from "../../../../shared/output/output.service.ts";
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
 import {
   type LegacySetupInputs,
   legacyBaselineCatalogFileName,
@@ -110,11 +112,13 @@ describe("catalog keys + file names", () => {
 
 const withTemp = () => mkdtempSync(join(tmpdir(), "legacy-decl-cache-"));
 
-const run = <A>(effect: Effect.Effect<A, unknown, FileSystem.FileSystem | Path.Path>) =>
-  effect.pipe(Effect.provide(BunServices.layer)) as Effect.Effect<A>;
+const run = <A>(effect: Effect.Effect<A, unknown, FileSystem.FileSystem | Path.Path | Output>) =>
+  effect.pipe(
+    Effect.provide(Layer.mergeAll(BunServices.layer, mockOutput().layer)),
+  ) as Effect.Effect<A>;
 
 const withServices = <A>(
-  body: (fs: FileSystem.FileSystem, path: Path.Path) => Effect.Effect<A, unknown, never>,
+  body: (fs: FileSystem.FileSystem, path: Path.Path) => Effect.Effect<A, unknown, Output>,
 ) =>
   run(
     Effect.gen(function* () {
@@ -142,6 +146,42 @@ describe("legacyListLocalMigrations", () => {
     );
   });
 
+  it.effect(
+    "warns (byte-exact, on stderr) when skipping a deprecated init and a misnamed file",
+    () => {
+      // Mirrors Go's `ListLocalMigrations` warnings (`pkg/migration/list.go:45-53`):
+      // a `fmt.Fprintf(os.Stderr, …)` for the deprecated `_init.sql` first file and
+      // for any name that does not match `<timestamp>_name.sql`.
+      const dir = withTemp();
+      const migrationsDir = join(dir, "supabase", "migrations");
+      mkdirSync(migrationsDir, { recursive: true });
+      writeFileSync(join(migrationsDir, "20200101000000_init.sql"), "-- old init");
+      writeFileSync(join(migrationsDir, "20240101120000_create.sql"), "create table x();");
+      writeFileSync(join(migrationsDir, "notes.txt"), "ignore me");
+      const out = mockOutput();
+      return Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        return yield* legacyListLocalMigrations(fs, path, migrationsDir);
+      }).pipe(
+        Effect.provide(Layer.mergeAll(BunServices.layer, out.layer)),
+        Effect.tap((paths) =>
+          Effect.sync(() => {
+            expect(paths.map((p) => p.split("/").pop())).toEqual(["20240101120000_create.sql"]);
+            const stderr = out.rawChunks.filter((c) => c.stream === "stderr").map((c) => c.text);
+            expect(stderr).toContain(
+              'Skipping migration 20200101000000_init.sql... (replace "init" with a different file name to apply this migration)\n',
+            );
+            expect(stderr).toContain(
+              'Skipping migration notes.txt... (file name must match pattern "<timestamp>_name.sql")\n',
+            );
+            rmSync(dir, { recursive: true, force: true });
+          }),
+        ),
+      ) as Effect.Effect<unknown>;
+    },
+  );
+
   it.effect("returns [] when the migrations dir is absent", () => {
     const dir = withTemp();
     return withServices((fs, path) => legacyListLocalMigrations(fs, path, join(dir, "nope"))).pipe(
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.errors.ts b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.errors.ts
index 40c7f75ed4..b52d173fbe 100644
--- a/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.errors.ts
+++ b/apps/cli/src/legacy/commands/db/shared/legacy-pgdelta.errors.ts
@@ -48,17 +48,6 @@ export class LegacyDeclarativeParseOutputError extends Data.TaggedError(
   readonly message: string;
 }> {}
 
-/**
- * Listing local migrations failed for a reason other than the directory being
- * absent. Byte-matches Go's `migration.ListLocalMigrations`
- * (`apps/cli-go/pkg/migration/list.go:34-37`), which returns
- * `"failed to read directory: " + err` for anything but `os.ErrNotExist` rather
- * than treating an unreadable `supabase/migrations` as "no migrations".
- */
-export class LegacyMigrationsReadError extends Data.TaggedError("LegacyMigrationsReadError")<{
-  readonly message: string;
-}> {}
-
 /**
  * Materializing the declarative export on disk failed. Byte-matches Go's
  * `WriteDeclarativeSchemas` errors (`declarative.go:239`):
diff --git a/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md
index acd5efd4b0..cdb4c5f903 100644
--- a/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/migration/down/SIDE_EFFECTS.md
@@ -21,9 +21,10 @@
 
 ## Environment Variables
 
-| Variable                | Purpose                        | Required?                                               |
-| ----------------------- | ------------------------------ | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) |
+| Variable                 | Purpose                                                                           | Required?                                               |
+| ------------------------ | --------------------------------------------------------------------------------- | ------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN`  | auth token for `--linked` mode                                                    | no (falls back to keyring → `~/.supabase/access-token`) |
+| `DOTENV_PRIVATE_KEY[_*]` | dotenvx private key(s) to decrypt `encrypted:` `[db.vault]` secrets before upsert | no (required only if a `[db.vault]` value is encrypted) |
 
 ## Exit Codes
 
@@ -37,18 +38,33 @@
 
 ### `--output-format text` (Go CLI compatible)
 
-Prints progress as migrations are reverted.
+Prints `Resetting database to version: <version>` to stderr, then drops every
+user schema/object (the bundled `drop.sql` DO-block), upserts `[db.vault]`
+secrets, and re-applies local migrations `<= version` plus seed files (each gated
+on `db.migrations.enabled` / `db.seed.enabled`). Nothing is written to stdout.
 
 ### `--output-format json`
 
-Not applicable.
+Emits `output.success("Migrations reverted", { version, last })`.
 
 ### `--output-format stream-json`
 
-Not applicable.
+Same structured result delivered as an NDJSON `result` event.
+
+## Prompts
+
+- Prompts `Do you want to revert the following migrations?` with the bulleted
+  versions + a yellow `WARNING:` line (default **NO**). Declining exits non-zero
+  (`context canceled`). `--yes` auto-confirms; a non-interactive / machine-output
+  run takes the default (NO → cancel).
 
 ## Notes
 
-- `--last` (default 1) resets up to the last n migration versions.
+- `--last` (default 1) resets up to the last n migration versions; must be `> 0`
+  and `<` the number of applied migrations.
 - `--local` (default true), `--linked`, and `--db-url` are mutually exclusive.
 - Takes no positional arguments.
+- Skips Go's best-effort `pgcache.TryCacheMigrationsCatalog` (documented divergence).
+- Dotenvx-encrypted (`encrypted:`) `[db.vault]` values are decrypted during config
+  load using `DOTENV_PRIVATE_KEY[_*]`; an `encrypted:` value with no working key
+  aborts the command with `failed to parse config: …`, matching Go.
diff --git a/apps/cli/src/legacy/commands/migration/down/down.command.ts b/apps/cli/src/legacy/commands/migration/down/down.command.ts
index 421015a3e8..dd6be72039 100644
--- a/apps/cli/src/legacy/commands/migration/down/down.command.ts
+++ b/apps/cli/src/legacy/commands/migration/down/down.command.ts
@@ -1,11 +1,27 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
+import { legacyMigrationDbRuntimeLayer } from "../migration.layers.ts";
 import { legacyMigrationDown } from "./down.handler.ts";
 
 const config = {
+  // Go's `--last` is a `uint` (`down.go`), default 1. Effect has no uint, so reject
+  // negatives explicitly to reproduce cobra's `ParseUint` rejection (the message
+  // differs slightly — an accepted small divergence).
   last: Flag.integer("last").pipe(
     Flag.withDescription("Reset up to the last n migration versions."),
-    Flag.optional,
+    Flag.withDefault(1),
+    Flag.mapTryCatch(
+      (value) => {
+        if (value < 0) {
+          throw new Error(`invalid argument "${value}" for "--last" flag: must be greater than 0`);
+        }
+        return value;
+      },
+      (err) => (err instanceof Error ? err.message : String(err)),
+    ),
   ),
   dbUrl: Flag.string("db-url").pipe(
     Flag.withDescription(
@@ -18,6 +34,8 @@ const config = {
   ),
   local: Flag.boolean("local").pipe(
     Flag.withDescription("Resets applied migrations on the local database."),
+    // Go: `downFlags.Bool("local", true, …)`.
+    Flag.withDefault(true),
   ),
 } as const;
 
@@ -26,5 +44,18 @@ export type LegacyMigrationDownFlags = CliCommand.Command.Config.Infer<typeof co
 export const legacyMigrationDownCommand = Command.make("down", config).pipe(
   Command.withDescription("Resets applied migrations up to the last n versions."),
   Command.withShortDescription("Resets applied migrations up to the last n versions"),
-  Command.withHandler((flags) => legacyMigrationDown(flags)),
+  Command.withHandler((flags) =>
+    legacyMigrationDown(flags).pipe(
+      withLegacyCommandInstrumentation({
+        flags: {
+          last: flags.last,
+          "db-url": flags.dbUrl,
+          linked: flags.linked,
+          local: flags.local,
+        },
+      }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyMigrationDbRuntimeLayer(["migration", "down"])),
 );
diff --git a/apps/cli/src/legacy/commands/migration/down/down.errors.ts b/apps/cli/src/legacy/commands/migration/down/down.errors.ts
new file mode 100644
index 0000000000..a243205914
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/down/down.errors.ts
@@ -0,0 +1,18 @@
+import { Data } from "effect";
+
+/** `--last 0`. Byte-matches Go's `--last must be greater than 0` (`down.go:21`). */
+export class LegacyMigrationLastZeroError extends Data.TaggedError("LegacyMigrationLastZeroError")<{
+  readonly message: string;
+}> {}
+
+/**
+ * `--last` >= the number of applied migrations. Byte-matches Go's
+ * `--last must be smaller than total applied migrations: <total>` (`down.go:35`);
+ * the `supabase db reset` suggestion is attached separately.
+ */
+export class LegacyMigrationLastTooLargeError extends Data.TaggedError(
+  "LegacyMigrationLastTooLargeError",
+)<{
+  readonly message: string;
+  readonly suggestion: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/migration/down/down.handler.ts b/apps/cli/src/legacy/commands/migration/down/down.handler.ts
index f90221f117..d646db1782 100644
--- a/apps/cli/src/legacy/commands/migration/down/down.handler.ts
+++ b/apps/cli/src/legacy/commands/migration/down/down.handler.ts
@@ -1,15 +1,173 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { Effect, FileSystem, Option, Path } from "effect";
+
+import {
+  LegacyDnsResolverFlag,
+  legacyResolveYesWithProjectEnv,
+} from "../../../../shared/legacy/global-flags.ts";
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { legacyAqua, legacyBold, legacyYellow } from "../../../shared/legacy-colors.ts";
+import {
+  legacyLoadProjectEnv,
+  legacyReadDbToml,
+} from "../../../shared/legacy-db-config.toml-read.ts";
+import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
+import { LegacyDbConnection } from "../../../shared/legacy-db-connection.service.ts";
+import { resolveLegacyDbTargetFlags } from "../../../shared/legacy-db-target-flags.ts";
+import { legacyDropUserSchemas } from "../../../shared/legacy-drop-objects.ts";
+import { legacyMigrateAndSeed } from "../../../shared/legacy-migrate-and-seed.ts";
+import { legacyListRemoteMigrations } from "../../../shared/legacy-migration-history.ts";
+import { legacyUpsertVaultSecrets } from "../../../shared/legacy-vault.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import {
+  LegacyMigrationTargetFlagsError,
+  LegacyOperationCanceledError,
+} from "../migration.errors.ts";
+import { legacyMigrationConfirm } from "../migration.prompt.ts";
 import type { LegacyMigrationDownFlags } from "./down.command.ts";
+import { LegacyMigrationLastTooLargeError, LegacyMigrationLastZeroError } from "./down.errors.ts";
+
+/** Go's `confirmResetAll` (`internal/migration/down/down.go:64`). */
+const confirmResetAll = (pending: ReadonlyArray<string>): string => {
+  let title = "Do you want to revert the following migrations?\n";
+  for (const version of pending) title += ` • ${legacyBold(version)}\n`;
+  title += `${legacyYellow("WARNING:")} you will lose all data in this database.`;
+  return title;
+};
+
+const runDown = Effect.fnUntraced(function* (
+  flags: LegacyMigrationDownFlags,
+  target: ReturnType<typeof resolveLegacyDbTargetFlags>,
+) {
+  const output = yield* Output;
+  const resolver = yield* LegacyDbConfigResolver;
+  const connection = yield* LegacyDbConnection;
+  const cliConfig = yield* LegacyCliConfig;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const dnsResolver = yield* LegacyDnsResolverFlag;
+
+  // Flag-group mutual-exclusion first: cobra's `MarkFlagsMutuallyExclusive` validates at
+  // parse time, ahead of the root `PersistentPreRunE` (`cmd/migration.go:156`).
+  if (target.setFlags.length > 1) {
+    return yield* Effect.fail(
+      new LegacyMigrationTargetFlagsError({
+        message: `if any flags in the group [db-url linked local] are set none of the others can be; [${target.setFlags.join(" ")}] were all set`,
+      }),
+    );
+  }
+
+  const connType = target.connType ?? "local"; // down defaults to `--local` (Go: `Bool("local", true)`).
+
+  // Resolve the DB config BEFORE the `--last` validation — Go's root `PersistentPreRunE`
+  // runs `ParseDatabaseConfig` (`cmd/root.go:118`) before `down.Run`'s `last == 0` check
+  // (`internal/migration/down/down.go:20-23`), so an unlinked/invalid target surfaces
+  // before the `--last must be greater than 0` error.
+  const cfg = yield* resolver.resolve({
+    dbUrl: flags.dbUrl,
+    connType,
+    dnsResolver,
+  });
+
+  // Go loads the project .env via loadNestedEnv INSIDE ParseDatabaseConfig (config.go:701),
+  // i.e. after the parse-time flag-group validation above — so a SUPABASE_YES set only in
+  // supabase/.env auto-confirms, but a flag conflict still surfaces before any .env read.
+  // Resolve --yes against the project env here, not just process.env (root.go:318-334).
+  const projectEnv = yield* legacyLoadProjectEnv(fs, path, cliConfig.workdir);
+  const yes = yield* legacyResolveYesWithProjectEnv(projectEnv);
+
+  // Linked down caches the project ref (Go's `ensureProjectGroupsCached` from `Execute()`,
+  // gated on the ref loaded in pre-run, NOT on the RunE error). Load it now and attach the
+  // cache to the whole flow via `Effect.ensuring`, so it runs even on the `--last`/cancel
+  // failure paths.
+  const cacheLinkedRef =
+    connType === "linked"
+      ? yield* Effect.gen(function* () {
+          const projectRef = yield* LegacyProjectRefResolver;
+          const linkedProjectCache = yield* LegacyLinkedProjectCache;
+          const linkedRef = yield* projectRef.loadProjectRef(Option.none());
+          return linkedProjectCache.cache(linkedRef);
+        })
+      : undefined;
+
+  const downFlow = Effect.gen(function* () {
+    // `--last` zero-value validation runs after DB-config resolution (Go's check is inside
+    // `down.Run`, after `PersistentPreRunE`).
+    if (flags.last === 0) {
+      return yield* Effect.fail(
+        new LegacyMigrationLastZeroError({ message: "--last must be greater than 0" }),
+      );
+    }
+
+    const ref = Option.getOrUndefined(cfg.ref ?? Option.none());
+    const toml = yield* legacyReadDbToml(fs, path, cliConfig.workdir, ref);
+
+    yield* Effect.scoped(
+      Effect.gen(function* () {
+        // Go's `utils.ConnectByConfig` prints this to stderr before dialing
+        // (`internal/utils/connect.go:343-348`), local/remote per `IsLocalDatabase`.
+        yield* output.raw(
+          `Connecting to ${cfg.isLocal ? "local" : "remote"} database...\n`,
+          "stderr",
+        );
+        const session = yield* connection.connect(cfg.conn, {
+          isLocal: cfg.isLocal,
+          dnsResolver,
+        });
+
+        const remote = yield* legacyListRemoteMigrations(session);
+        const total = remote.length;
+        if (total <= flags.last) {
+          return yield* Effect.fail(
+            new LegacyMigrationLastTooLargeError({
+              message: `--last must be smaller than total applied migrations: ${total}`,
+              suggestion: `Try ${legacyAqua("supabase db reset")} if you want to revert all migrations.`,
+            }),
+          );
+        }
+
+        const confirmed = yield* legacyMigrationConfirm(
+          confirmResetAll(remote.slice(total - flags.last)),
+          {
+            defaultValue: false,
+            yes,
+          },
+        );
+        if (!confirmed) {
+          return yield* Effect.fail(
+            new LegacyOperationCanceledError({ message: "context canceled" }),
+          );
+        }
+
+        const version = remote[total - flags.last - 1]!;
+        yield* output.raw(`Resetting database to version: ${version}\n`, "stderr");
+        yield* legacyDropUserSchemas(session);
+        yield* legacyUpsertVaultSecrets(session, toml.vault);
+        yield* legacyMigrateAndSeed(session, fs, path, cliConfig.workdir, version, {
+          migrationsEnabled: toml.migrationsEnabled,
+          seed: toml.seed,
+        });
+
+        if (output.format !== "text") {
+          yield* output.success("Migrations reverted", { version, last: flags.last });
+        }
+      }),
+    );
+  });
+
+  return yield* cacheLinkedRef === undefined
+    ? downFlow
+    : downFlow.pipe(Effect.ensuring(cacheLinkedRef));
+});
 
 export const legacyMigrationDown = Effect.fn("legacy.migration.down")(function* (
   flags: LegacyMigrationDownFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["migration", "down"];
-  if (Option.isSome(flags.last)) args.push("--last", String(flags.last.value));
-  if (Option.isSome(flags.dbUrl)) args.push("--db-url", flags.dbUrl.value);
-  if (flags.linked) args.push("--linked");
-  if (flags.local) args.push("--local");
-  yield* proxy.exec(args);
+  const telemetryState = yield* LegacyTelemetryState;
+  const cliArgs = yield* CliArgs;
+  const target = resolveLegacyDbTargetFlags(cliArgs.args);
+  yield* runDown(flags, target).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/migration/down/down.integration.test.ts b/apps/cli/src/legacy/commands/migration/down/down.integration.test.ts
new file mode 100644
index 0000000000..57c15c999e
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/down/down.integration.test.ts
@@ -0,0 +1,409 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Cause, Effect, Exit, Layer, Option } from "effect";
+
+import {
+  LEGACY_VALID_REF,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { mockOutput, mockStdin, mockTty } from "../../../../../tests/helpers/mocks.ts";
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import { LegacyDnsResolverFlag, LegacyYesFlag } from "../../../../shared/legacy/global-flags.ts";
+import type { OutputFormat } from "../../../../shared/output/types.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyProjectNotLinkedError } from "../../../config/legacy-project-ref.errors.ts";
+import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
+import type {
+  LegacyDbConfigFlags,
+  LegacyResolvedDbConfig,
+} from "../../../shared/legacy-db-config.types.ts";
+import { LegacyDbExecError } from "../../../shared/legacy-db-connection.errors.ts";
+import { LegacyDbConnection } from "../../../shared/legacy-db-connection.service.ts";
+import { LegacyMigrationDropError } from "../../../shared/legacy-drop-objects.ts";
+import { LegacyMigrationSeedError } from "../../../shared/legacy-seed.ts";
+import { legacyMigrationDown } from "./down.handler.ts";
+import type { LegacyMigrationDownFlags } from "./down.command.ts";
+
+const LIST_SQL = "SELECT version FROM supabase_migrations.schema_migrations ORDER BY version";
+
+interface SetupOpts {
+  readonly format?: OutputFormat;
+  readonly isTTY?: boolean;
+  readonly pipedInput?: string;
+  readonly args?: ReadonlyArray<string>;
+  readonly yes?: boolean;
+  readonly confirm?: boolean;
+  readonly remote?: ReadonlyArray<string>;
+  readonly failResolve?: boolean;
+  readonly failDrop?: boolean;
+  readonly failSeed?: boolean;
+  readonly config?: string;
+  readonly seedTable?: ReadonlyArray<{ path: string; hash: string }>;
+}
+
+const SELECT_SEED = "SELECT path, hash FROM supabase_migrations.seed_files";
+
+function setup(workdir: string, opts: SetupOpts = {}) {
+  if (opts.config !== undefined) {
+    mkdirSync(join(workdir, "supabase"), { recursive: true });
+    writeFileSync(join(workdir, "supabase", "config.toml"), opts.config);
+  }
+  const out = mockOutput({
+    format: opts.format ?? "text",
+    promptConfirmResponses: opts.confirm === undefined ? undefined : [opts.confirm],
+  });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+  const execs: Array<string> = [];
+  const queries: Array<{ sql: string; params?: ReadonlyArray<unknown> }> = [];
+
+  const resolver = Layer.succeed(LegacyDbConfigResolver, {
+    resolve: (_flags: LegacyDbConfigFlags) =>
+      opts.failResolve === true
+        ? Effect.fail(
+            new LegacyProjectNotLinkedError({
+              message: "Cannot find project ref. Have you run link?",
+            }),
+          )
+        : Effect.succeed({
+            conn: {
+              host: "127.0.0.1",
+              port: 54322,
+              user: "postgres",
+              password: "x",
+              database: "postgres",
+            },
+            isLocal: true,
+            ref: Option.none(),
+          } satisfies LegacyResolvedDbConfig),
+    resolvePoolerFallback: () => Effect.succeed(Option.none()),
+  });
+
+  const connection = Layer.succeed(LegacyDbConnection, {
+    connect: () =>
+      Effect.succeed({
+        exec: (sql: string) =>
+          Effect.suspend(() => {
+            execs.push(sql);
+            if (opts.failDrop === true && sql.startsWith("do $$")) {
+              return Effect.fail(new LegacyDbExecError({ message: "permission denied" }));
+            }
+            if (opts.failSeed === true && sql.startsWith("insert into")) {
+              return Effect.fail(new LegacyDbExecError({ message: "boom" }));
+            }
+            return Effect.void;
+          }),
+        query: (sql: string, params?: ReadonlyArray<unknown>) =>
+          Effect.suspend(() => {
+            queries.push({ sql, params });
+            if (sql === LIST_SQL)
+              return Effect.succeed((opts.remote ?? []).map((version) => ({ version })));
+            if (sql === SELECT_SEED) return Effect.succeed([...(opts.seedTable ?? [])]);
+            return Effect.succeed<ReadonlyArray<Record<string, unknown>>>([]);
+          }),
+        extensionExists: () => Effect.succeed(false),
+        copyToCsv: () => Effect.succeed(new Uint8Array()),
+        queryRaw: () => Effect.succeed({ fields: [], rows: [], commandTag: "" }),
+      }),
+  });
+
+  const projectRef = Layer.succeed(LegacyProjectRefResolver, {
+    resolve: () => Effect.succeed(LEGACY_VALID_REF),
+    resolveForLink: () => Effect.succeed(LEGACY_VALID_REF),
+    resolveOptional: () => Effect.succeed(Option.some(LEGACY_VALID_REF)),
+    loadProjectRef: () => Effect.succeed(LEGACY_VALID_REF),
+    promptProjectRef: () => Effect.succeed(LEGACY_VALID_REF),
+  });
+
+  const layer = Layer.mergeAll(
+    out.layer,
+    telemetry.layer,
+    cache.layer,
+    resolver,
+    connection,
+    projectRef,
+    mockLegacyCliConfig({ workdir }),
+    Layer.succeed(LegacyDnsResolverFlag, "native"),
+    Layer.succeed(LegacyYesFlag, opts.yes ?? false),
+    Layer.succeed(CliArgs, { args: opts.args ?? [] }),
+    mockTty({ stdinIsTty: opts.isTTY ?? true }),
+    mockStdin(
+      opts.isTTY ?? true,
+      // Migration prompts read stdin directly (Go's PromptYesNo), so a confirm answer is
+      // supplied via piped stdin rather than the Output prompt mock.
+      opts.pipedInput ?? (opts.confirm === undefined ? undefined : opts.confirm ? "y\n" : "n\n"),
+    ),
+    BunServices.layer,
+  );
+  return { layer, out, telemetry, execs, queries };
+}
+
+const flags = (over: Partial<LegacyMigrationDownFlags> = {}): LegacyMigrationDownFlags => ({
+  last: over.last ?? 1,
+  dbUrl: over.dbUrl ?? Option.none(),
+  linked: over.linked ?? false,
+  local: over.local ?? true,
+});
+
+// eslint-disable-next-line no-control-regex
+const stripAnsi = (text: string) => text.replace(/\x1b\[[0-9;]*m/gu, "");
+const seed = (workdir: string, name: string, body = "create table a;\n") => {
+  const dir = join(workdir, "supabase", "migrations");
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, name), body);
+};
+
+const tmp = useLegacyTempWorkdir();
+
+describe("legacy migration down", () => {
+  it.live("rejects --last 0", () => {
+    const { layer } = setup(tmp.current);
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationDown(flags({ last: 0 })).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyMigrationLastZeroError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("resolves the DB target before rejecting --last 0", () => {
+    // Go runs ParseDatabaseConfig (PersistentPreRunE, root.go:118) before down.Run's
+    // last==0 check, so an unlinked/invalid target error wins over --last 0.
+    const { layer } = setup(tmp.current, { failResolve: true });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationDown(flags({ last: 0 })).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        // The target/config error surfaces first, NOT the --last 0 error.
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyProjectNotLinkedError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects --last >= total applied migrations", () => {
+    const { layer } = setup(tmp.current, { remote: ["20240101000000"] });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationDown(flags({ last: 1 })).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe(
+          "LegacyMigrationLastTooLargeError",
+        );
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reverts to the target version on confirm (drop + migrate&seed)", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    const { layer, out, execs, queries } = setup(tmp.current, {
+      confirm: true,
+      remote: ["20240101000000", "20240102000000"],
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationDown(flags({ last: 1 }));
+      // Go prints the connection banner to stderr before dialing (connect.go:343-348).
+      expect(stripAnsi(out.stderrText)).toContain("Connecting to local database...");
+      expect(stripAnsi(out.stderrText)).toContain("Resetting database to version: 20240101000000");
+      // dropped user schemas, then re-applied the migration <= target version.
+      expect(execs.some((sql) => sql.startsWith("do $$"))).toBe(true);
+      expect(
+        queries.some(
+          (q) =>
+            q.sql.includes("INSERT INTO supabase_migrations") && q.params?.[0] === "20240101000000",
+        ),
+      ).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("cancels on a declined prompt", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    const { layer, execs } = setup(tmp.current, {
+      confirm: false,
+      remote: ["20240101000000", "20240102000000"],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationDown(flags({ last: 1 })).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyOperationCanceledError");
+      }
+      expect(execs.some((sql) => sql.startsWith("do $$"))).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("falls back to NO (cancels) without a TTY and no piped answer", () => {
+    // Go reads stdin regardless of TTY (IsTTY only changes the timeout); with no piped
+    // answer the empty read falls back to the default (NO) → cancel.
+    const { layer, out } = setup(tmp.current, {
+      isTTY: false,
+      remote: ["20240101000000", "20240102000000"],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationDown(flags({ last: 1 })).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyOperationCanceledError");
+      }
+      expect(out.promptConfirmCalls.length).toBe(0);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a structured result in json with --yes", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    const { layer, out } = setup(tmp.current, {
+      format: "json",
+      yes: true,
+      remote: ["20240101000000", "20240102000000"],
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationDown(flags({ last: 1 }));
+      expect(out.messages).toContainEqual(
+        expect.objectContaining({
+          type: "success",
+          message: "Migrations reverted",
+          data: { version: "20240101000000", last: 1 },
+        }),
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("auto-confirms from SUPABASE_YES in the project .env (Go loadNestedEnv)", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    // SUPABASE_YES lives only in supabase/.env, not the shell — Go's loadNestedEnv loads it
+    // before the prompt, so the revert auto-confirms with no --yes flag and no stdin answer.
+    writeFileSync(join(tmp.current, "supabase", ".env"), "SUPABASE_YES=true\n");
+    const { layer, out } = setup(tmp.current, {
+      format: "json",
+      remote: ["20240101000000", "20240102000000"],
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationDown(flags({ last: 1 }));
+      expect(out.messages).toContainEqual(
+        expect.objectContaining({
+          type: "success",
+          message: "Migrations reverted",
+          data: { version: "20240101000000", last: 1 },
+        }),
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports a drop-schema failure", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    const { layer } = setup(tmp.current, {
+      confirm: true,
+      remote: ["20240101000000", "20240102000000"],
+      failDrop: true,
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationDown(flags({ last: 1 })).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value instanceof LegacyMigrationDropError).toBe(
+          true,
+        );
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("seeds data from a new seed file and records its hash", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    writeFileSync(join(tmp.current, "supabase", "seed.sql"), "insert into a values (1);\n");
+    const { layer, out, queries } = setup(tmp.current, {
+      confirm: true,
+      remote: ["20240101000000", "20240102000000"],
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationDown(flags({ last: 1 }));
+      expect(stripAnsi(out.stderrText)).toContain("Seeding data from supabase/seed.sql...");
+      expect(
+        queries.some((q) => q.sql.includes("INSERT INTO supabase_migrations.seed_files")),
+      ).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports a seed-apply failure", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    writeFileSync(join(tmp.current, "supabase", "seed.sql"), "insert into a values (1);\n");
+    const { layer } = setup(tmp.current, {
+      confirm: true,
+      remote: ["20240101000000", "20240102000000"],
+      failSeed: true,
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationDown(flags({ last: 1 })).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value instanceof LegacyMigrationSeedError).toBe(
+          true,
+        );
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("skips an unchanged seed file", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    const body = "insert into a values (1);\n";
+    writeFileSync(join(tmp.current, "supabase", "seed.sql"), body);
+    const hash = createHash("sha256").update(body).digest("hex");
+    const { layer, out, queries } = setup(tmp.current, {
+      confirm: true,
+      remote: ["20240101000000", "20240102000000"],
+      seedTable: [{ path: "supabase/seed.sql", hash }],
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationDown(flags({ last: 1 }));
+      expect(stripAnsi(out.stderrText)).not.toContain("Seeding data from");
+      expect(
+        queries.some((q) => q.sql.includes("INSERT INTO supabase_migrations.seed_files")),
+      ).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("updates the recorded hash (without re-running) for a changed seed file", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    writeFileSync(join(tmp.current, "supabase", "seed.sql"), "insert into a values (2);\n");
+    const { layer, out, execs, queries } = setup(tmp.current, {
+      confirm: true,
+      remote: ["20240101000000", "20240102000000"],
+      seedTable: [{ path: "supabase/seed.sql", hash: "stale-hash-does-not-match" }],
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationDown(flags({ last: 1 }));
+      // Dirty seed → "Updating seed hash" + hash UPSERT, but the seed SQL is NOT re-run.
+      expect(stripAnsi(out.stderrText)).toContain("Updating seed hash to supabase/seed.sql...");
+      expect(
+        queries.some((q) => q.sql.includes("INSERT INTO supabase_migrations.seed_files")),
+      ).toBe(true);
+      expect(execs).not.toContain("insert into a values (2)");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("skips migration apply when db.migrations.enabled = false", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    const { layer, queries } = setup(tmp.current, {
+      confirm: true,
+      remote: ["20240101000000", "20240102000000"],
+      config: "[db.migrations]\nenabled = false\n",
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationDown(flags({ last: 1 }));
+      // No migration re-applied when migrations are disabled.
+      expect(queries.some((q) => q.sql.includes("INSERT INTO supabase_migrations"))).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md
index 5b7da97b12..7da5a26931 100644
--- a/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/migration/fetch/SIDE_EFFECTS.md
@@ -36,17 +36,39 @@
 
 ### `--output-format text` (Go CLI compatible)
 
-Prints the names of migration files fetched from the history table.
+Silent on success (Go prints nothing). Reads
+`SELECT version, coalesce(name, '') as name, statements FROM
+supabase_migrations.schema_migrations` and writes each row to
+`<workdir>/supabase/migrations/<version>_<name>.sql` (statements joined with
+`;\n` plus a trailing `;\n`, mode 0644).
 
 ### `--output-format json`
 
-Not applicable.
+Emits `output.success("Migration history fetched", { files: [<absolute path>] })`.
 
 ### `--output-format stream-json`
 
-Not applicable.
+Same structured `files` result delivered as an NDJSON `result` event.
+
+## Prompts
+
+- When the migrations directory is non-empty, prompts
+  `Do you want to overwrite existing files in supabase/migrations directory?`
+  (default **YES**). Declining exits non-zero (`context canceled`). `--yes`
+  auto-confirms; a non-interactive / machine-output run takes the default (YES).
 
 ## Notes
 
 - `--linked` (default true), `--local`, and `--db-url` are mutually exclusive.
 - Fetches migration file contents from the `supabase_migrations.schema_migrations` history table.
+- **Empty-statements rows (Go parity):** a row whose `statements` array is empty
+  (NULL/`{}` — possible on older projects or manually-inserted rows) is written as
+  exactly `;\n`, because Go does `strings.Join(statements, ";\n") + ";\n"`. The port
+  reproduces these bytes verbatim rather than emitting an empty file; changing this
+  would be a deliberate divergence from the Go CLI.
+- **Path-traversal hardening (TS-only):** before writing, each row's `version`/`name`
+  is validated (`version` is all digits; `name` has no `/`, `\`, or `..` segment).
+  A tampered/hostile remote could otherwise supply separators to escape the
+  migrations directory (CWE-22). Go has no such check; the guard is parity-neutral
+  for legitimate rows (real versions are digits and names are sanitized file stems)
+  and fails with `failed to write migration: invalid version/name in history table`.
diff --git a/apps/cli/src/legacy/commands/migration/fetch/fetch.command.ts b/apps/cli/src/legacy/commands/migration/fetch/fetch.command.ts
index 91d9cd8e1b..7f80918625 100644
--- a/apps/cli/src/legacy/commands/migration/fetch/fetch.command.ts
+++ b/apps/cli/src/legacy/commands/migration/fetch/fetch.command.ts
@@ -1,5 +1,9 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
+import { legacyMigrationDbRuntimeLayer } from "../migration.layers.ts";
 import { legacyMigrationFetch } from "./fetch.handler.ts";
 
 const config = {
@@ -11,6 +15,8 @@ const config = {
   ),
   linked: Flag.boolean("linked").pipe(
     Flag.withDescription("Fetches migration history from the linked project."),
+    // Go: `fetchFlags.Bool("linked", true, …)`.
+    Flag.withDefault(true),
   ),
   local: Flag.boolean("local").pipe(
     Flag.withDescription("Fetches migration history from the local database."),
@@ -22,5 +28,17 @@ export type LegacyMigrationFetchFlags = CliCommand.Command.Config.Infer<typeof c
 export const legacyMigrationFetchCommand = Command.make("fetch", config).pipe(
   Command.withDescription("Fetch migration files from history table."),
   Command.withShortDescription("Fetch migration files from history table"),
-  Command.withHandler((flags) => legacyMigrationFetch(flags)),
+  Command.withHandler((flags) =>
+    legacyMigrationFetch(flags).pipe(
+      withLegacyCommandInstrumentation({
+        flags: {
+          "db-url": flags.dbUrl,
+          linked: flags.linked,
+          local: flags.local,
+        },
+      }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyMigrationDbRuntimeLayer(["migration", "fetch"])),
 );
diff --git a/apps/cli/src/legacy/commands/migration/fetch/fetch.e2e.test.ts b/apps/cli/src/legacy/commands/migration/fetch/fetch.e2e.test.ts
new file mode 100644
index 0000000000..ec8c28b274
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/fetch/fetch.e2e.test.ts
@@ -0,0 +1,52 @@
+import { mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+
+import { runSupabase } from "../../../../../tests/helpers/cli.ts";
+
+const E2E_TIMEOUT_MS = 30_000;
+
+// eslint-disable-next-line no-control-regex
+const stripAnsi = (text: string) => text.replace(/\x1b\[[0-9;]*m/gu, "");
+
+describe("supabase migration fetch (legacy)", () => {
+  let workdir: string;
+  beforeEach(() => {
+    workdir = mkdtempSync(join(tmpdir(), "sb-mig-fetch-e2e-"));
+    mkdirSync(join(workdir, "supabase", "migrations"), { recursive: true });
+    writeFileSync(join(workdir, "supabase", "config.toml"), "[db]\nport = 54322\n");
+    writeFileSync(
+      join(workdir, "supabase", "migrations", "20240101000000_existing.sql"),
+      "select 1;\n",
+    );
+  });
+  afterEach(() => {
+    rmSync(workdir, { recursive: true, force: true });
+  });
+
+  // Real-subprocess guard for the production Stdin wiring + Go-style prompt: a piped
+  // answer to the overwrite prompt must actually be read, not auto-defaulted. A declined
+  // `n` cancels before connecting, so no DB is required. This is the boundary in-process
+  // tests cannot cover — they inject a mock Stdin, which masked a missing-service bug
+  // where the migration DB runtime never provided the real stdin layer.
+  test(
+    "reads a piped 'n' answer to the overwrite prompt and cancels",
+    { timeout: E2E_TIMEOUT_MS },
+    async () => {
+      const { exitCode, stderr } = await runSupabase(["migration", "fetch", "--local"], {
+        entrypoint: "legacy",
+        cwd: workdir,
+        stdin: "n\n",
+      });
+
+      // Declined → cancelled (non-zero), and the Go-style prompt label reached stderr.
+      expect(exitCode).not.toBe(0);
+      expect(stripAnsi(stderr)).toContain("[Y/n]");
+      // The existing file was NOT overwritten — the piped answer was honored.
+      expect(readdirSync(join(workdir, "supabase", "migrations"))).toEqual([
+        "20240101000000_existing.sql",
+      ]);
+    },
+  );
+});
diff --git a/apps/cli/src/legacy/commands/migration/fetch/fetch.errors.ts b/apps/cli/src/legacy/commands/migration/fetch/fetch.errors.ts
new file mode 100644
index 0000000000..3cc8289327
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/fetch/fetch.errors.ts
@@ -0,0 +1,11 @@
+import { Data } from "effect";
+
+/**
+ * Writing a fetched migration file failed. Byte-matches Go's
+ * `failed to write migration: %w` (`internal/migration/fetch/fetch.go:38`).
+ */
+export class LegacyMigrationFetchWriteError extends Data.TaggedError(
+  "LegacyMigrationFetchWriteError",
+)<{
+  readonly message: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/migration/fetch/fetch.handler.ts b/apps/cli/src/legacy/commands/migration/fetch/fetch.handler.ts
index 846293186e..ccc5b69f43 100644
--- a/apps/cli/src/legacy/commands/migration/fetch/fetch.handler.ts
+++ b/apps/cli/src/legacy/commands/migration/fetch/fetch.handler.ts
@@ -1,14 +1,175 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { Effect, FileSystem, Option, Path } from "effect";
+
+import { LegacyDnsResolverFlag, legacyResolveYes } from "../../../../shared/legacy/global-flags.ts";
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { legacyBold } from "../../../shared/legacy-colors.ts";
+import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
+import { LegacyDbConnection } from "../../../shared/legacy-db-connection.service.ts";
+import { resolveLegacyDbTargetFlags } from "../../../shared/legacy-db-target-flags.ts";
+import { legacyReadMigrationTable } from "../../../shared/legacy-migration-history.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import {
+  LegacyMigrationTargetFlagsError,
+  LegacyOperationCanceledError,
+} from "../migration.errors.ts";
+import { legacyMigrationConfirm } from "../migration.prompt.ts";
 import type { LegacyMigrationFetchFlags } from "./fetch.command.ts";
+import { LegacyMigrationFetchWriteError } from "./fetch.errors.ts";
+
+const runFetch = Effect.fnUntraced(function* (
+  flags: LegacyMigrationFetchFlags,
+  target: ReturnType<typeof resolveLegacyDbTargetFlags>,
+) {
+  const output = yield* Output;
+  const resolver = yield* LegacyDbConfigResolver;
+  const connection = yield* LegacyDbConnection;
+  const cliConfig = yield* LegacyCliConfig;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const dnsResolver = yield* LegacyDnsResolverFlag;
+  const yes = yield* legacyResolveYes; // --yes OR SUPABASE_YES (Go viper AutomaticEnv, root.go:318-334).
+
+  if (target.setFlags.length > 1) {
+    return yield* Effect.fail(
+      new LegacyMigrationTargetFlagsError({
+        message: `if any flags in the group [db-url linked local] are set none of the others can be; [${target.setFlags.join(" ")}] were all set`,
+      }),
+    );
+  }
+
+  const connType = target.connType ?? "linked"; // fetch defaults to `--linked` (Go: `Bool("linked", true)`).
+
+  // Resolve the DB config BEFORE any filesystem/prompt side effects — mirroring Go's
+  // root `PersistentPreRunE` (`apps/cli-go/cmd/root.go:118`), which parses the DB config
+  // before `migrationFetchCmd.RunE` calls `fetch.Run`. An invalid `--db-url`/`config.toml`
+  // then fails immediately, instead of first creating `supabase/migrations` or letting a
+  // declined overwrite prompt mask the real error with `context canceled`. Same fix as
+  // `migration repair`.
+  const cfg = yield* resolver.resolve({
+    dbUrl: flags.dbUrl,
+    connType,
+    dnsResolver,
+  });
+
+  // Linked fetch caches the project ref on success (Go's `PersistentPostRun`). The ref is
+  // loaded now (pre-run), but the cache write is attached to the body via `Effect.ensuring`,
+  // so a declined prompt returns before it runs — matching Go (PostRun is skipped on a
+  // non-nil RunE error).
+  const cacheLinkedRef =
+    connType === "linked"
+      ? yield* Effect.gen(function* () {
+          const projectRef = yield* LegacyProjectRefResolver;
+          const linkedProjectCache = yield* LegacyLinkedProjectCache;
+          const ref = yield* projectRef.loadProjectRef(Option.none());
+          return linkedProjectCache.cache(ref);
+        })
+      : undefined;
+
+  const fetchBody = Effect.gen(function* () {
+    const migrationsDir = path.join(cliConfig.workdir, "supabase", "migrations");
+
+    // Go: `MkdirIfNotExistFS` then `afero.IsEmpty`; prompt before overwriting a
+    // non-empty migrations dir (default YES). Cancel → `context.Canceled`.
+    yield* fs
+      .makeDirectory(migrationsDir, { recursive: true })
+      .pipe(
+        Effect.mapError((cause) => new LegacyMigrationFetchWriteError({ message: cause.message })),
+      );
+    // Go's `fetch.Run` gates the overwrite prompt on `afero.IsEmpty`, which aborts on
+    // ANY read failure before fetching/writing (`internal/migration/fetch/fetch.go:21-22`).
+    // Only a missing directory counts as "empty"; a read error (e.g. an unreadable dir)
+    // must propagate — collapsing it to empty would skip the confirmation and clobber
+    // existing migrations.
+    const existing = yield* fs.readDirectory(migrationsDir).pipe(
+      Effect.catchTag("PlatformError", (cause) =>
+        cause.reason._tag === "NotFound"
+          ? Effect.succeed<ReadonlyArray<string>>([])
+          : Effect.fail(
+              new LegacyMigrationFetchWriteError({
+                message: `failed to read migrations: ${cause.message}`,
+              }),
+            ),
+      ),
+    );
+    if (existing.length > 0) {
+      const title = `Do you want to overwrite existing files in ${legacyBold("supabase/migrations")} directory?`;
+      const overwrite = yield* legacyMigrationConfirm(title, { defaultValue: true, yes });
+      if (!overwrite) {
+        return yield* Effect.fail(
+          new LegacyOperationCanceledError({ message: "context canceled" }),
+        );
+      }
+    }
+
+    const migrations = yield* Effect.scoped(
+      Effect.gen(function* () {
+        // Go's `utils.ConnectByConfig` prints this to stderr before dialing
+        // (`internal/utils/connect.go:343-348`), local/remote per `IsLocalDatabase`.
+        yield* output.raw(
+          `Connecting to ${cfg.isLocal ? "local" : "remote"} database...\n`,
+          "stderr",
+        );
+        const session = yield* connection.connect(cfg.conn, {
+          isLocal: cfg.isLocal,
+          dnsResolver,
+        });
+        return yield* legacyReadMigrationTable(session);
+      }),
+    );
+
+    const written: Array<string> = [];
+    for (const file of migrations) {
+      // The version/name come from the remote `schema_migrations` table. A
+      // tampered/hostile remote could supply path separators or `..` in EITHER field to
+      // escape the migrations dir on write (CWE-22). Go writes the raw column values
+      // verbatim (`fmt.Sprintf("%s_%s.sql", r.Version, r.Name)`,
+      // `internal/migration/fetch/fetch.go:36`) with no digit check, so reject only the
+      // actual traversal vectors — separators and `..` segments — in both fields. This
+      // keeps a Go-valid signed version like `-1` writable while closing the vector.
+      const escapes = (segment: string) =>
+        /[/\\]/u.test(segment) || segment.split(/[/\\]/u).includes("..");
+      if (escapes(file.version) || escapes(file.name)) {
+        return yield* Effect.fail(
+          new LegacyMigrationFetchWriteError({
+            message: `failed to write migration: invalid version/name in history table: ${file.version}_${file.name}`,
+          }),
+        );
+      }
+      const name = `${file.version}_${file.name}.sql`;
+      const filePath = path.join(migrationsDir, name);
+      // Go: `strings.Join(statements, ";\n") + ";\n"`.
+      const contents = `${file.statements.join(";\n")};\n`;
+      yield* fs.writeFileString(filePath, contents, { mode: 0o644 }).pipe(
+        Effect.mapError(
+          (cause) =>
+            new LegacyMigrationFetchWriteError({
+              message: `failed to write migration: ${cause.message}`,
+            }),
+        ),
+      );
+      written.push(filePath);
+    }
+
+    // Go is silent on success in text mode.
+    if (output.format !== "text") {
+      yield* output.success("Migration history fetched", { files: written });
+    }
+  });
+
+  return yield* cacheLinkedRef === undefined
+    ? fetchBody
+    : fetchBody.pipe(Effect.ensuring(cacheLinkedRef));
+});
 
 export const legacyMigrationFetch = Effect.fn("legacy.migration.fetch")(function* (
   flags: LegacyMigrationFetchFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["migration", "fetch"];
-  if (Option.isSome(flags.dbUrl)) args.push("--db-url", flags.dbUrl.value);
-  if (flags.linked) args.push("--linked");
-  if (flags.local) args.push("--local");
-  yield* proxy.exec(args);
+  const telemetryState = yield* LegacyTelemetryState;
+  const cliArgs = yield* CliArgs;
+  const target = resolveLegacyDbTargetFlags(cliArgs.args);
+  yield* runFetch(flags, target).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/migration/fetch/fetch.integration.test.ts b/apps/cli/src/legacy/commands/migration/fetch/fetch.integration.test.ts
new file mode 100644
index 0000000000..f0fcd50ccf
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/fetch/fetch.integration.test.ts
@@ -0,0 +1,365 @@
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Cause, Effect, Exit, Layer, Option } from "effect";
+
+import {
+  LEGACY_VALID_REF,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { mockOutput, mockStdin, mockTty } from "../../../../../tests/helpers/mocks.ts";
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import { LegacyDnsResolverFlag, LegacyYesFlag } from "../../../../shared/legacy/global-flags.ts";
+import type { OutputFormat } from "../../../../shared/output/types.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyDbConfigLoadError } from "../../../shared/legacy-db-config.errors.ts";
+import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
+import type {
+  LegacyDbConfigFlags,
+  LegacyResolvedDbConfig,
+} from "../../../shared/legacy-db-config.types.ts";
+import { LegacyDbConnection } from "../../../shared/legacy-db-connection.service.ts";
+import { legacyMigrationFetch } from "./fetch.handler.ts";
+import type { LegacyMigrationFetchFlags } from "./fetch.command.ts";
+
+const SELECT_SQL =
+  "SELECT version, coalesce(name, '') as name, statements FROM supabase_migrations.schema_migrations";
+
+interface MigrationRow {
+  readonly version: string;
+  readonly name: string;
+  readonly statements: ReadonlyArray<string>;
+}
+
+interface SetupOpts {
+  readonly format?: OutputFormat;
+  readonly isTTY?: boolean;
+  readonly pipedInput?: string;
+  readonly yes?: boolean;
+  readonly confirm?: boolean;
+  readonly rows?: ReadonlyArray<MigrationRow>;
+  readonly resolveFails?: boolean;
+}
+
+function setup(workdir: string, opts: SetupOpts = {}) {
+  const out = mockOutput({
+    format: opts.format ?? "text",
+    promptConfirmResponses: opts.confirm === undefined ? undefined : [opts.confirm],
+  });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+
+  const resolver = Layer.succeed(LegacyDbConfigResolver, {
+    resolve: (_flags: LegacyDbConfigFlags) =>
+      opts.resolveFails === true
+        ? Effect.fail(
+            new LegacyDbConfigLoadError({
+              message: "failed to parse config: invalid connection string",
+            }),
+          )
+        : Effect.succeed({
+            conn: {
+              host: "127.0.0.1",
+              port: 54322,
+              user: "postgres",
+              password: "x",
+              database: "postgres",
+            },
+            isLocal: false,
+            ref: Option.some(LEGACY_VALID_REF),
+          } satisfies LegacyResolvedDbConfig),
+    resolvePoolerFallback: () => Effect.succeed(Option.none()),
+  });
+
+  const connection = Layer.succeed(LegacyDbConnection, {
+    connect: () =>
+      Effect.succeed({
+        exec: () => Effect.void,
+        query: (sql: string) =>
+          Effect.suspend(() =>
+            sql === SELECT_SQL
+              ? Effect.succeed((opts.rows ?? []).map((r) => ({ ...r })))
+              : Effect.succeed([]),
+          ),
+        extensionExists: () => Effect.succeed(false),
+        copyToCsv: () => Effect.succeed(new Uint8Array()),
+        queryRaw: () => Effect.succeed({ fields: [], rows: [], commandTag: "" }),
+      }),
+  });
+
+  const projectRef = Layer.succeed(LegacyProjectRefResolver, {
+    resolve: () => Effect.succeed(LEGACY_VALID_REF),
+    resolveForLink: () => Effect.succeed(LEGACY_VALID_REF),
+    resolveOptional: () => Effect.succeed(Option.some(LEGACY_VALID_REF)),
+    loadProjectRef: () => Effect.succeed(LEGACY_VALID_REF),
+    promptProjectRef: () => Effect.succeed(LEGACY_VALID_REF),
+  });
+
+  const layer = Layer.mergeAll(
+    out.layer,
+    telemetry.layer,
+    cache.layer,
+    resolver,
+    connection,
+    projectRef,
+    mockLegacyCliConfig({ workdir }),
+    Layer.succeed(LegacyDnsResolverFlag, "native"),
+    Layer.succeed(LegacyYesFlag, opts.yes ?? false),
+    Layer.succeed(CliArgs, { args: [] }),
+    mockTty({ stdinIsTty: opts.isTTY ?? true }),
+    mockStdin(
+      opts.isTTY ?? true,
+      // Migration prompts read stdin directly (Go's PromptYesNo), so a confirm answer is
+      // supplied via piped stdin rather than the Output prompt mock.
+      opts.pipedInput ?? (opts.confirm === undefined ? undefined : opts.confirm ? "y\n" : "n\n"),
+    ),
+    BunServices.layer,
+  );
+  return { layer, out, telemetry };
+}
+
+const flags = (over: Partial<LegacyMigrationFetchFlags> = {}): LegacyMigrationFetchFlags => ({
+  dbUrl: over.dbUrl ?? Option.none(),
+  linked: over.linked ?? true,
+  local: over.local ?? false,
+});
+
+const migrationsDir = (workdir: string) => join(workdir, "supabase", "migrations");
+const tmp = useLegacyTempWorkdir();
+
+describe("legacy migration fetch", () => {
+  it.live("writes migration files joined with the Go separator when the dir is empty", () => {
+    const { layer, out } = setup(tmp.current, {
+      rows: [
+        {
+          version: "20240101000000",
+          name: "init",
+          statements: ["create table a", "create index b"],
+        },
+      ],
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationFetch(flags());
+      // Go prints the connection banner to stderr before dialing (connect.go:343-348).
+      expect(out.stderrText).toContain("Connecting to remote database...");
+      const dir = migrationsDir(tmp.current);
+      const files = readdirSync(dir);
+      expect(files).toEqual(["20240101000000_init.sql"]);
+      expect(readFileSync(join(dir, files[0]!), "utf8")).toBe("create table a;\ncreate index b;\n");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes a lone separator for a row with no statements (Go parity)", () => {
+    // A `schema_migrations` row can legally have a NULL/empty `statements` array
+    // (older projects, manually-inserted rows). Go does `strings.Join(stmts, ";\n")
+    // + ";\n"`, so an empty array yields exactly ";\n" — a file with a stray
+    // semicolon, not an empty file. The strict-1:1 port keeps these bytes; lock it
+    // so a future "emit an empty file instead" refactor is a conscious divergence.
+    const { layer } = setup(tmp.current, {
+      rows: [{ version: "20240101000000", name: "empty", statements: [] }],
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationFetch(flags());
+      const dir = migrationsDir(tmp.current);
+      expect(readFileSync(join(dir, "20240101000000_empty.sql"), "utf8")).toBe(";\n");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("prompts before overwriting a non-empty directory and proceeds on yes", () => {
+    mkdirSync(migrationsDir(tmp.current), { recursive: true });
+    writeFileSync(join(migrationsDir(tmp.current), "existing.sql"), "select 1;\n");
+    const { layer } = setup(tmp.current, {
+      confirm: true,
+      rows: [{ version: "20240101000000", name: "init", statements: ["create table a"] }],
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationFetch(flags());
+      expect(readdirSync(migrationsDir(tmp.current))).toContain("20240101000000_init.sql");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("cancels with context canceled when the overwrite prompt is declined", () => {
+    mkdirSync(migrationsDir(tmp.current), { recursive: true });
+    writeFileSync(join(migrationsDir(tmp.current), "existing.sql"), "select 1;\n");
+    const { layer } = setup(tmp.current, {
+      confirm: false,
+      rows: [{ version: "20240101000000", name: "init", statements: ["create table a"] }],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationFetch(flags()).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyOperationCanceledError");
+      }
+      // No new file written on cancel.
+      expect(readdirSync(migrationsDir(tmp.current))).toEqual(["existing.sql"]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("honors a piped 'n' answer without a TTY (cancels the overwrite)", () => {
+    // The overwrite prompt defaults to YES; Go reads piped stdin even when non-interactive,
+    // so a piped `n` overrides the default and cancels (console.go:64-82). Proves the
+    // non-TTY path reads the answer instead of blindly taking the default.
+    mkdirSync(migrationsDir(tmp.current), { recursive: true });
+    writeFileSync(join(migrationsDir(tmp.current), "existing.sql"), "select 1;\n");
+    const { layer } = setup(tmp.current, {
+      isTTY: false,
+      pipedInput: "n\n",
+      rows: [{ version: "20240101000000", name: "init", statements: ["create table a"] }],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationFetch(flags()).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyOperationCanceledError");
+      }
+      expect(readdirSync(migrationsDir(tmp.current))).toEqual(["existing.sql"]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("bypasses the overwrite prompt with --yes (echoes the auto-answer)", () => {
+    mkdirSync(migrationsDir(tmp.current), { recursive: true });
+    writeFileSync(join(migrationsDir(tmp.current), "existing.sql"), "select 1;\n");
+    const { layer, out } = setup(tmp.current, {
+      yes: true,
+      rows: [{ version: "20240101000000", name: "init", statements: ["create table a"] }],
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationFetch(flags());
+      expect(out.stderrText).toContain("[Y/n] y");
+      expect(readdirSync(migrationsDir(tmp.current))).toContain("20240101000000_init.sql");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("still prompts on stderr in json mode and proceeds on a piped yes", () => {
+    // Go writes the prompt to stderr and reads stdin regardless of --output (console.go),
+    // so --output-format json must NOT silently auto-accept: the overwrite prompt fires on
+    // stderr and a piped `y` proceeds, while the json result still goes to stdout.
+    mkdirSync(migrationsDir(tmp.current), { recursive: true });
+    writeFileSync(join(migrationsDir(tmp.current), "existing.sql"), "select 1;\n");
+    const { layer, out } = setup(tmp.current, {
+      format: "json",
+      pipedInput: "y\n",
+      rows: [{ version: "20240101000000", name: "init", statements: ["create table a"] }],
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationFetch(flags());
+      // The prompt label reached stderr (it was NOT format-gated into a silent default).
+      expect(out.stderrText).toContain("[Y/n]");
+      expect(out.messages).toContainEqual(
+        expect.objectContaining({
+          type: "success",
+          message: "Migration history fetched",
+          data: { files: [join(migrationsDir(tmp.current), "20240101000000_init.sql")] },
+        }),
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("honors a piped no in json mode (cancels the overwrite, no auto-accept)", () => {
+    // Regression guard: before the fix, json mode routed through the non-interactive Output
+    // prompt and auto-accepted (default YES), overwriting. Now a piped `n` is honored.
+    mkdirSync(migrationsDir(tmp.current), { recursive: true });
+    writeFileSync(join(migrationsDir(tmp.current), "existing.sql"), "select 1;\n");
+    const { layer } = setup(tmp.current, {
+      format: "json",
+      pipedInput: "n\n",
+      rows: [{ version: "20240101000000", name: "init", statements: ["create table a"] }],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationFetch(flags()).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyOperationCanceledError");
+      }
+      expect(readdirSync(migrationsDir(tmp.current))).toEqual(["existing.sql"]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects a hostile version/name from the history table (path traversal guard)", () => {
+    // A tampered remote `schema_migrations` row could use `..`/separators to
+    // escape the migrations dir (CWE-22). The guard rejects it before writing.
+    const { layer } = setup(tmp.current, {
+      rows: [{ version: "20240101000000", name: "../../../etc/passwd", statements: [] }],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationFetch(flags()).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyMigrationFetchWriteError");
+      }
+      // Nothing is written when the guard fires.
+      expect(readdirSync(migrationsDir(tmp.current))).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes a Go-valid signed version verbatim (no all-digits requirement)", () => {
+    // Go writes the raw `version` column into `<version>_<name>.sql` with no digit check
+    // (`internal/migration/fetch/fetch.go:36`), so a malformed-but-safe value like `-1`
+    // (listable/repairable in Go) must fetch, not abort the whole run.
+    const { layer } = setup(tmp.current, {
+      rows: [{ version: "-1", name: "legacy", statements: ["select 1"] }],
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationFetch(flags());
+      expect(readdirSync(migrationsDir(tmp.current))).toEqual(["-1_legacy.sql"]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects a hostile version from the history table (traversal guard on version)", () => {
+    // The traversal hardening covers the `version` field too: a separator/`..` there is
+    // rejected even though it is no longer required to be all-digits.
+    const { layer } = setup(tmp.current, {
+      rows: [{ version: "../../etc", name: "x", statements: [] }],
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationFetch(flags()).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyMigrationFetchWriteError");
+      }
+      expect(readdirSync(migrationsDir(tmp.current))).toEqual([]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports a write failure", () => {
+    // A file at <workdir>/supabase makes `makeDirectory(supabase/migrations)` fail.
+    writeFileSync(join(tmp.current, "supabase"), "not a directory");
+    const { layer } = setup(tmp.current, { rows: [] });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationFetch(flags()).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyMigrationFetchWriteError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("resolves DB config before creating the migrations dir or prompting", () => {
+    // Go's root PersistentPreRunE parses the DB config before fetch.Run (cmd/root.go:118),
+    // so an invalid target fails before any filesystem/prompt side effect. With the resolver
+    // failing, the supabase/migrations dir must NOT be created and no prompt is shown.
+    const { layer, out } = setup(tmp.current, { resolveFails: true });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationFetch(flags()).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyDbConfigLoadError");
+      }
+      // The config failed before any side effect: no migrations dir, no overwrite prompt.
+      expect(existsSync(migrationsDir(tmp.current))).toBe(false);
+      expect(out.promptConfirmCalls.length).toBe(0);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/migration/fetch/fetch.live.test.ts b/apps/cli/src/legacy/commands/migration/fetch/fetch.live.test.ts
new file mode 100644
index 0000000000..c84a16ea75
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/fetch/fetch.live.test.ts
@@ -0,0 +1,91 @@
+import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { expect, test } from "vitest";
+
+import {
+  describeLiveDataPlane,
+  requireLiveProjectRef,
+  runSupabaseLive,
+} from "../../../../../tests/helpers/live.ts";
+
+const LIVE_TIMEOUT_MS = 120_000;
+
+// A deterministic migration to seed into the remote history and fetch back.
+const VERSION = "20240101000000";
+const NAME = "cli_live_roundtrip";
+const MIGRATION_FILE = `${VERSION}_${NAME}.sql`;
+
+// Data-plane scenario (Postgres over the pooler) — see the note in
+// `../list/list.live.test.ts`. `describeLiveDataPlane` runs this only when the
+// project instance is ACTIVE_HEALTHY (the full stack with supabase-postgres-17);
+// it SKIPS on the control-plane-only CI that omits it (CLI-1825).
+//
+// Round-trip: `migration fetch` reads the remote `schema_migrations` history and
+// writes each row to `supabase/migrations/<version>_<name>.sql`; `migration list`
+// then reads those files back as the Local column.
+//
+// Unlike `migration list`, `migration fetch` does NOT tolerate a missing history
+// table: Go's `ReadMigrationTable` has no `pgerrcode.UndefinedTable` fallback (only
+// the list path does — `pkg/migration/list.go`), so against a freshly provisioned
+// project with no `supabase_migrations.schema_migrations` table it exits non-zero
+// (`relation … does not exist`). So we first SEED one migration into the remote
+// history via `migration repair --status applied` (Go's `repair` runs
+// `CreateMigrationTable` then upserts the version from the local file), establishing
+// the table + a row for `fetch` to read back. The ref is supplied via
+// SUPABASE_PROJECT_ID. The seed is idempotent (upsert) and the supabox stack is torn
+// down per run, so it leaves no shared state behind.
+describeLiveDataPlane("supabase migration fetch (live)", () => {
+  test(
+    "seeds remote history, fetches it back, and lists it (round-trip)",
+    { timeout: LIVE_TIMEOUT_MS },
+    async () => {
+      const ref = requireLiveProjectRef();
+      const seedDir = await mkdtemp(path.join(tmpdir(), "sb-migration-seed-live-"));
+      const fetchDir = await mkdtemp(path.join(tmpdir(), "sb-migration-fetch-live-"));
+      try {
+        // Seed: record one migration in the remote history. `repair --status applied`
+        // reads the local file for the version's name/statements, so write it first.
+        await mkdir(path.join(seedDir, "supabase", "migrations"), { recursive: true });
+        await writeFile(
+          path.join(seedDir, "supabase", "migrations", MIGRATION_FILE),
+          "create table if not exists public.cli_live_roundtrip (id int);\n",
+        );
+        const repaired = await runSupabaseLive(
+          ["migration", "repair", VERSION, "--status", "applied"],
+          { cwd: seedDir, env: { SUPABASE_PROJECT_ID: ref } },
+        );
+        expect(`${repaired.stdout}${repaired.stderr}`).not.toContain("Unauthorized");
+        expect(repaired.exitCode, `stdout:\n${repaired.stdout}\nstderr:\n${repaired.stderr}`).toBe(
+          0,
+        );
+
+        // Fetch into a fresh (empty) dir so no overwrite prompt fires; it reads the
+        // remote history and writes <version>_<name>.sql.
+        const fetched = await runSupabaseLive(["migration", "fetch"], {
+          cwd: fetchDir,
+          env: { SUPABASE_PROJECT_ID: ref },
+        });
+        expect(`${fetched.stdout}${fetched.stderr}`).not.toContain("Unauthorized");
+        expect(fetched.exitCode, `stdout:\n${fetched.stdout}\nstderr:\n${fetched.stderr}`).toBe(0);
+
+        // fetch wrote the seeded migration back, under its Go-compatible filename.
+        const files = await readdir(path.join(fetchDir, "supabase", "migrations"));
+        expect(files).toContain(MIGRATION_FILE);
+
+        // The same dir feeds `migration list` as the Local column — exit 0 and the
+        // fetched version is reflected back.
+        const listed = await runSupabaseLive(["migration", "list"], {
+          cwd: fetchDir,
+          env: { SUPABASE_PROJECT_ID: ref },
+        });
+        expect(`${listed.stdout}${listed.stderr}`).not.toContain("Unauthorized");
+        expect(listed.exitCode, `stdout:\n${listed.stdout}\nstderr:\n${listed.stderr}`).toBe(0);
+        expect(listed.stdout).toContain(VERSION);
+      } finally {
+        await rm(seedDir, { recursive: true, force: true });
+        await rm(fetchDir, { recursive: true, force: true });
+      }
+    },
+  );
+});
diff --git a/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md
index f4489b05f6..dd463ab3a5 100644
--- a/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/migration/list/SIDE_EFFECTS.md
@@ -38,15 +38,19 @@
 
 ### `--output-format text` (Go CLI compatible)
 
-Prints a table of local and remote migration versions with a status column.
+Prints a Glamour ASCII table `|Local|Remote|Time (UTC)|` to stdout (byte-matching
+Go's `glamour.RenderTable` with `AsciiStyle`; cells are backtick-wrapped inline
+code). Queries `SELECT version FROM supabase_migrations.schema_migrations ORDER BY
+version` (a missing table → empty Remote column).
 
 ### `--output-format json`
 
-Not applicable.
+Emits `output.success("Migrations listed", { migrations: [{ local, remote, time }] })`.
+`local`/`remote` are empty strings when a version exists only on the other side.
 
 ### `--output-format stream-json`
 
-Not applicable.
+Same structured `migrations` result delivered as an NDJSON `result` event.
 
 ## Notes
 
diff --git a/apps/cli/src/legacy/commands/migration/list/list.command.ts b/apps/cli/src/legacy/commands/migration/list/list.command.ts
index 0c055ae9ef..1fb1bbc919 100644
--- a/apps/cli/src/legacy/commands/migration/list/list.command.ts
+++ b/apps/cli/src/legacy/commands/migration/list/list.command.ts
@@ -1,5 +1,9 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
+import { legacyMigrationDbRuntimeLayer } from "../migration.layers.ts";
 import { legacyMigrationList } from "./list.handler.ts";
 
 const config = {
@@ -11,6 +15,8 @@ const config = {
   ),
   linked: Flag.boolean("linked").pipe(
     Flag.withDescription("Lists migrations applied to the linked project."),
+    // Go: `listFlags.Bool("linked", true, …)`.
+    Flag.withDefault(true),
   ),
   local: Flag.boolean("local").pipe(
     Flag.withDescription("Lists migrations applied to the local database."),
@@ -27,5 +33,20 @@ export type LegacyMigrationListFlags = CliCommand.Command.Config.Infer<typeof co
 export const legacyMigrationListCommand = Command.make("list", config).pipe(
   Command.withDescription("List local and remote migrations."),
   Command.withShortDescription("List local and remote migrations"),
-  Command.withHandler((flags) => legacyMigrationList(flags)),
+  Command.withHandler((flags) =>
+    legacyMigrationList(flags).pipe(
+      withLegacyCommandInstrumentation({
+        flags: {
+          "db-url": flags.dbUrl,
+          linked: flags.linked,
+          local: flags.local,
+          // `password` is a credential — always reaches telemetry as `<redacted>`.
+          password: flags.password,
+        },
+        aliases: { p: "password" },
+      }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyMigrationDbRuntimeLayer(["migration", "list"])),
 );
diff --git a/apps/cli/src/legacy/commands/migration/list/list.format.ts b/apps/cli/src/legacy/commands/migration/list/list.format.ts
new file mode 100644
index 0000000000..172e7387d4
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/list/list.format.ts
@@ -0,0 +1,76 @@
+import {
+  LEGACY_MIGRATION_VERSION_MAX,
+  legacyFormatTimestampVersion,
+  legacyParseMigrationVersion,
+} from "../../../shared/legacy-migration-timestamp.format.ts";
+
+/** A merged local/remote migration row. `local`/`remote` are empty when absent. */
+export interface LegacyMigrationListRow {
+  readonly local: string;
+  readonly remote: string;
+  readonly time: string;
+}
+
+/**
+ * Two-pointer merge of remote + local migration versions into chronological
+ * rows. Pure port of Go's `makeTable` (`internal/migration/list/list.go:38-79`)
+ * minus the markdown framing: non-numeric versions are skipped, and the time
+ * column uses `FormatTimestampVersion`.
+ */
+export function legacyMakeMigrationListRows(
+  remote: ReadonlyArray<string>,
+  local: ReadonlyArray<string>,
+): ReadonlyArray<LegacyMigrationListRow> {
+  const rows: Array<LegacyMigrationListRow> = [];
+  let i = 0;
+  let j = 0;
+  while (i < remote.length || j < local.length) {
+    let remoteTs = LEGACY_MIGRATION_VERSION_MAX;
+    if (i < remote.length) {
+      const parsed = legacyParseMigrationVersion(remote[i]!);
+      if (parsed === undefined) {
+        i++;
+        continue;
+      }
+      remoteTs = parsed;
+    }
+    let localTs = LEGACY_MIGRATION_VERSION_MAX;
+    if (j < local.length) {
+      const parsed = legacyParseMigrationVersion(local[j]!);
+      if (parsed === undefined) {
+        j++;
+        continue;
+      }
+      localTs = parsed;
+    }
+    if (localTs < remoteTs) {
+      rows.push({ local: local[j]!, remote: "", time: legacyFormatTimestampVersion(local[j]!) });
+      j++;
+    } else if (remoteTs < localTs) {
+      rows.push({ local: "", remote: remote[i]!, time: legacyFormatTimestampVersion(remote[i]!) });
+      i++;
+    } else {
+      rows.push({
+        local: local[j]!,
+        remote: remote[i]!,
+        time: legacyFormatTimestampVersion(remote[i]!),
+      });
+      i++;
+      j++;
+    }
+  }
+  return rows;
+}
+
+/**
+ * Renders the merged rows as the backtick-wrapped Glamour markdown cells Go
+ * emits (`|`<v>`|` `|`<time>`|`): present cells are inline code spans, absent
+ * cells are a single space inside backticks. AsciiStyle preserves the backticks
+ * (`code.block_prefix`/`block_suffix` = "`"), so the rendered table includes them.
+ */
+export function legacyMigrationListTableCells(
+  rows: ReadonlyArray<LegacyMigrationListRow>,
+): ReadonlyArray<readonly [string, string, string]> {
+  const cell = (value: string): string => (value.length > 0 ? `\`${value}\`` : "` `");
+  return rows.map((row) => [cell(row.local), cell(row.remote), `\`${row.time}\``] as const);
+}
diff --git a/apps/cli/src/legacy/commands/migration/list/list.format.unit.test.ts b/apps/cli/src/legacy/commands/migration/list/list.format.unit.test.ts
new file mode 100644
index 0000000000..29815d647a
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/list/list.format.unit.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it } from "vitest";
+
+import { renderGlamourTable } from "../../../output/legacy-glamour-table.ts";
+import { legacyMakeMigrationListRows, legacyMigrationListTableCells } from "./list.format.ts";
+
+describe("legacyMakeMigrationListRows", () => {
+  it("tabulates short numeric versions in chronological order (Go TestMakeTable)", () => {
+    // makeTable(["0","2"], ["0","1"]) — passthrough time for non-timestamp versions.
+    expect(legacyMakeMigrationListRows(["0", "2"], ["0", "1"])).toEqual([
+      { local: "0", remote: "0", time: "0" },
+      { local: "1", remote: "", time: "1" },
+      { local: "", remote: "2", time: "2" },
+    ]);
+  });
+
+  it("tabulates real timestamps with a humanised time column", () => {
+    expect(
+      legacyMakeMigrationListRows(
+        ["20220727064246", "20220727064248"],
+        ["20220727064246", "20220727064247"],
+      ),
+    ).toEqual([
+      { local: "20220727064246", remote: "20220727064246", time: "2022-07-27 06:42:46" },
+      { local: "20220727064247", remote: "", time: "2022-07-27 06:42:47" },
+      { local: "", remote: "20220727064248", time: "2022-07-27 06:42:48" },
+    ]);
+  });
+
+  it("skips non-numeric versions on both sides", () => {
+    expect(legacyMakeMigrationListRows(["a", "c"], ["a", "b"])).toEqual([]);
+  });
+
+  it("renders local-only and remote-only rows when one side is empty", () => {
+    expect(legacyMakeMigrationListRows([], ["20240101000000"])).toEqual([
+      { local: "20240101000000", remote: "", time: "2024-01-01 00:00:00" },
+    ]);
+    expect(legacyMakeMigrationListRows(["20240101000000"], [])).toEqual([
+      { local: "", remote: "20240101000000", time: "2024-01-01 00:00:00" },
+    ]);
+  });
+});
+
+describe("legacyMigrationListTableCells", () => {
+  it("wraps present cells in backticks and absent cells in a backtick-space-backtick", () => {
+    const cells = legacyMigrationListTableCells([
+      { local: "20240101000000", remote: "", time: "2024-01-01 00:00:00" },
+    ]);
+    expect(cells).toEqual([["`20240101000000`", "` `", "`2024-01-01 00:00:00`"]]);
+  });
+
+  it("produces a Glamour table whose body matches Go's `migration list` rendering", () => {
+    const rows = legacyMakeMigrationListRows(["20220727064248"], ["20220727064247"]);
+    const out = renderGlamourTable(
+      ["Local", "Remote", "Time (UTC)"],
+      legacyMigrationListTableCells(rows),
+    );
+    // Backtick-wrapped inline code is preserved by AsciiStyle.
+    expect(out).toContain("` `");
+    expect(out).toContain("`20220727064247`");
+    expect(out).toContain("`20220727064248`");
+    expect(out).toContain("Local");
+    expect(out).toContain("Time (UTC)");
+  });
+});
diff --git a/apps/cli/src/legacy/commands/migration/list/list.handler.ts b/apps/cli/src/legacy/commands/migration/list/list.handler.ts
index 3c4205386e..b6758179ba 100644
--- a/apps/cli/src/legacy/commands/migration/list/list.handler.ts
+++ b/apps/cli/src/legacy/commands/migration/list/list.handler.ts
@@ -1,15 +1,116 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { Effect, FileSystem, Option, Path } from "effect";
+
+import { LegacyDnsResolverFlag } from "../../../../shared/legacy/global-flags.ts";
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { renderGlamourTable } from "../../../output/legacy-glamour-table.ts";
+import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
+import { LegacyDbConnection } from "../../../shared/legacy-db-connection.service.ts";
+import { resolveLegacyDbTargetFlags } from "../../../shared/legacy-db-target-flags.ts";
+import {
+  legacyListRemoteMigrations,
+  legacyLoadLocalVersions,
+} from "../../../shared/legacy-migration-history.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import {
+  LegacyMigrationPasswordFlagsError,
+  LegacyMigrationTargetFlagsError,
+} from "../migration.errors.ts";
 import type { LegacyMigrationListFlags } from "./list.command.ts";
+import { legacyMakeMigrationListRows, legacyMigrationListTableCells } from "./list.format.ts";
+
+const LIST_HEADERS = ["Local", "Remote", "Time (UTC)"] as const;
+
+const runList = Effect.fnUntraced(function* (
+  flags: LegacyMigrationListFlags,
+  target: ReturnType<typeof resolveLegacyDbTargetFlags>,
+) {
+  const output = yield* Output;
+  const resolver = yield* LegacyDbConfigResolver;
+  const connection = yield* LegacyDbConnection;
+  const cliConfig = yield* LegacyCliConfig;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const dnsResolver = yield* LegacyDnsResolverFlag;
+
+  // cobra `MarkFlagsMutuallyExclusive`, in registration order: the target group
+  // first, then {db-url, password} (`cmd/migration.go`). `setFlags` is already
+  // alphabetically sorted, matching cobra's group-error formatting.
+  if (target.setFlags.length > 1) {
+    return yield* Effect.fail(
+      new LegacyMigrationTargetFlagsError({
+        message: `if any flags in the group [db-url linked local] are set none of the others can be; [${target.setFlags.join(" ")}] were all set`,
+      }),
+    );
+  }
+  if (Option.isSome(flags.dbUrl) && Option.isSome(flags.password)) {
+    return yield* Effect.fail(
+      new LegacyMigrationPasswordFlagsError({
+        message:
+          "if any flags in the group [db-url password] are set none of the others can be; [db-url password] were all set",
+      }),
+    );
+  }
+
+  const listBody = Effect.gen(function* () {
+    // list defaults to `--linked` (Go: `Bool("linked", true)`).
+    const cfg = yield* resolver.resolve({
+      dbUrl: flags.dbUrl,
+      connType: target.connType ?? "linked",
+      dnsResolver,
+      password: flags.password,
+    });
+
+    const remote = yield* Effect.scoped(
+      Effect.gen(function* () {
+        // Go's `utils.ConnectByConfig` prints this to stderr before dialing
+        // (`internal/utils/connect.go:343-348`), local/remote per `IsLocalDatabase`.
+        yield* output.raw(
+          `Connecting to ${cfg.isLocal ? "local" : "remote"} database...\n`,
+          "stderr",
+        );
+        const session = yield* connection.connect(cfg.conn, {
+          isLocal: cfg.isLocal,
+          dnsResolver,
+        });
+        return yield* legacyListRemoteMigrations(session);
+      }),
+    );
+
+    const local = yield* legacyLoadLocalVersions(
+      fs,
+      path,
+      path.join(cliConfig.workdir, "supabase", "migrations"),
+    );
+
+    const rows = legacyMakeMigrationListRows(remote, local);
+    if (output.format === "text") {
+      yield* output.raw(renderGlamourTable([...LIST_HEADERS], legacyMigrationListTableCells(rows)));
+    } else {
+      yield* output.success("Migrations listed", { migrations: rows });
+    }
+  });
+
+  // `--linked` resolves the project ref and writes the linked-project cache so
+  // telemetry carries the org/project grouping (Go's PersistentPostRun
+  // `ensureProjectGroupsCached`). `--local` / `--db-url` leave the ref empty.
+  if ((target.connType ?? "linked") === "linked") {
+    const projectRef = yield* LegacyProjectRefResolver;
+    const linkedProjectCache = yield* LegacyLinkedProjectCache;
+    const ref = yield* projectRef.loadProjectRef(Option.none());
+    return yield* listBody.pipe(Effect.ensuring(linkedProjectCache.cache(ref)));
+  }
+  return yield* listBody;
+});
 
 export const legacyMigrationList = Effect.fn("legacy.migration.list")(function* (
   flags: LegacyMigrationListFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["migration", "list"];
-  if (Option.isSome(flags.dbUrl)) args.push("--db-url", flags.dbUrl.value);
-  if (flags.linked) args.push("--linked");
-  if (flags.local) args.push("--local");
-  if (Option.isSome(flags.password)) args.push("--password", flags.password.value);
-  yield* proxy.exec(args);
+  const telemetryState = yield* LegacyTelemetryState;
+  const cliArgs = yield* CliArgs;
+  const target = resolveLegacyDbTargetFlags(cliArgs.args);
+  yield* runList(flags, target).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/migration/list/list.integration.test.ts b/apps/cli/src/legacy/commands/migration/list/list.integration.test.ts
new file mode 100644
index 0000000000..549dfad5e4
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/list/list.integration.test.ts
@@ -0,0 +1,268 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Cause, Effect, Exit, Layer, Option } from "effect";
+
+import {
+  LEGACY_VALID_REF,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import { LegacyDnsResolverFlag } from "../../../../shared/legacy/global-flags.ts";
+import type { OutputFormat } from "../../../../shared/output/types.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
+import { LegacyMigrationsReadError } from "../../../shared/legacy-migration.errors.ts";
+import type {
+  LegacyDbConfigFlags,
+  LegacyResolvedDbConfig,
+} from "../../../shared/legacy-db-config.types.ts";
+import { LegacyDbExecError } from "../../../shared/legacy-db-connection.errors.ts";
+import { LegacyDbConnection } from "../../../shared/legacy-db-connection.service.ts";
+import { legacyMigrationList } from "./list.handler.ts";
+import type { LegacyMigrationListFlags } from "./list.command.ts";
+
+const LIST_SQL = "SELECT version FROM supabase_migrations.schema_migrations ORDER BY version";
+
+interface SetupOpts {
+  readonly format?: OutputFormat;
+  readonly args?: ReadonlyArray<string>;
+  readonly isLocal?: boolean;
+  readonly remote?: ReadonlyArray<string>;
+  readonly remoteError?: LegacyDbExecError;
+}
+
+function setup(workdir: string, opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+
+  const resolverCalls: Array<LegacyDbConfigFlags> = [];
+  const resolver = Layer.succeed(LegacyDbConfigResolver, {
+    resolve: (flags: LegacyDbConfigFlags) => {
+      resolverCalls.push(flags);
+      return Effect.succeed({
+        conn: {
+          host: "127.0.0.1",
+          port: 54322,
+          user: "postgres",
+          password: "x",
+          database: "postgres",
+        },
+        isLocal: opts.isLocal ?? false,
+        ref: Option.some(LEGACY_VALID_REF),
+      } satisfies LegacyResolvedDbConfig);
+    },
+    resolvePoolerFallback: () => Effect.succeed(Option.none()),
+  });
+
+  const connection = Layer.succeed(LegacyDbConnection, {
+    connect: () =>
+      Effect.succeed({
+        exec: () => Effect.void,
+        query: (sql: string) =>
+          Effect.suspend(() => {
+            if (sql === LIST_SQL) {
+              if (opts.remoteError !== undefined) return Effect.fail(opts.remoteError);
+              return Effect.succeed((opts.remote ?? []).map((version) => ({ version })));
+            }
+            return Effect.succeed([]);
+          }),
+        extensionExists: () => Effect.succeed(false),
+        copyToCsv: () => Effect.succeed(new Uint8Array()),
+        queryRaw: () => Effect.succeed({ fields: [], rows: [], commandTag: "" }),
+      }),
+  });
+
+  const projectRef = Layer.succeed(LegacyProjectRefResolver, {
+    resolve: () => Effect.succeed(LEGACY_VALID_REF),
+    resolveForLink: () => Effect.succeed(LEGACY_VALID_REF),
+    resolveOptional: () => Effect.succeed(Option.some(LEGACY_VALID_REF)),
+    loadProjectRef: () => Effect.succeed(LEGACY_VALID_REF),
+    promptProjectRef: () => Effect.succeed(LEGACY_VALID_REF),
+  });
+
+  const layer = Layer.mergeAll(
+    out.layer,
+    telemetry.layer,
+    cache.layer,
+    resolver,
+    connection,
+    projectRef,
+    mockLegacyCliConfig({ workdir }),
+    Layer.succeed(LegacyDnsResolverFlag, "native"),
+    Layer.succeed(CliArgs, { args: opts.args ?? [] }),
+    BunServices.layer,
+  );
+  return {
+    layer,
+    out,
+    telemetry,
+    cache,
+    resolverCalls,
+  };
+}
+
+// eslint-disable-next-line no-control-regex
+const stripAnsi = (text: string) => text.replace(/\x1b\[[0-9;]*m/gu, "");
+
+const flags = (over: Partial<LegacyMigrationListFlags> = {}): LegacyMigrationListFlags => ({
+  dbUrl: over.dbUrl ?? Option.none(),
+  linked: over.linked ?? true,
+  local: over.local ?? false,
+  password: over.password ?? Option.none(),
+});
+
+const seedMigrations = (workdir: string, names: ReadonlyArray<string>) => {
+  const dir = join(workdir, "supabase", "migrations");
+  mkdirSync(dir, { recursive: true });
+  for (const name of names) writeFileSync(join(dir, name), "select 1;\n");
+};
+
+const tmp = useLegacyTempWorkdir();
+
+describe("legacy migration list", () => {
+  it.live("lists merged local + remote migrations for the linked project by default", () => {
+    seedMigrations(tmp.current, ["20240101000000_a.sql", "20240103000000_c.sql"]);
+    const ctx = setup(tmp.current, {
+      remote: ["20240101000000", "20240102000000"],
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationList(flags());
+      // Go prints the connection banner to stderr before dialing (connect.go:343-348).
+      expect(stripAnsi(ctx.out.stderrText)).toContain("Connecting to remote database...");
+      const stdout = stripAnsi(ctx.out.stdoutText);
+      expect(stdout).toContain("Local");
+      expect(stdout).toContain("Time (UTC)");
+      expect(stdout).toContain("`20240101000000`"); // in sync (both)
+      expect(stdout).toContain("`20240102000000`"); // remote only
+      expect(stdout).toContain("`20240103000000`"); // local only
+      // linked by default → resolver receives connType "linked" + cache written.
+      expect(ctx.resolverCalls[0]?.connType).toBe("linked");
+      expect(ctx.cache.cachedRef).toBe(LEGACY_VALID_REF);
+    }).pipe(Effect.provide(ctx.layer));
+  });
+
+  it.live("shows an empty Remote column when the history table is absent (42P01)", () => {
+    seedMigrations(tmp.current, ["20240101000000_a.sql"]);
+    const { layer, out } = setup(tmp.current, {
+      remoteError: new LegacyDbExecError({
+        message: 'relation "supabase_migrations.schema_migrations" does not exist',
+        code: "42P01",
+      }),
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationList(flags());
+      const stdout = stripAnsi(out.stdoutText);
+      expect(stdout).toContain("`20240101000000`");
+      expect(stdout).toContain("` `"); // empty Remote cell
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("skips init-schema and non-migration files when loading local versions", () => {
+    seedMigrations(tmp.current, [
+      "20211208000000_init.sql", // pre-cutoff init → skipped
+      "not-a-migration.txt", // non-matching → skipped
+      "20240105000000_keep.sql",
+    ]);
+    const { layer, out } = setup(tmp.current, { remote: [] });
+    return Effect.gen(function* () {
+      yield* legacyMigrationList(flags());
+      const stdout = stripAnsi(out.stdoutText);
+      expect(stdout).toContain("`20240105000000`");
+      expect(stdout).not.toContain("20211208000000");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("targets the local database with --local and skips the linked cache", () => {
+    seedMigrations(tmp.current, ["20240101000000_a.sql"]);
+    const ctx = setup(tmp.current, {
+      args: ["--local"],
+      isLocal: true,
+      remote: [],
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationList(flags({ linked: false, local: true }));
+      expect(ctx.resolverCalls[0]?.connType).toBe("local");
+      expect(ctx.cache.cachedRef).toBeUndefined();
+    }).pipe(Effect.provide(ctx.layer));
+  });
+
+  it.live("rejects --db-url combined with --linked", () => {
+    const { layer } = setup(tmp.current, { args: ["--db-url", "postgresql://x", "--linked"] });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationList(
+        flags({ dbUrl: Option.some("postgresql://x"), linked: true }),
+      ).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe(
+          "LegacyMigrationTargetFlagsError",
+        );
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects --db-url combined with --password", () => {
+    const { layer } = setup(tmp.current, { args: ["--db-url", "postgresql://x"] });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationList(
+        flags({ dbUrl: Option.some("postgresql://x"), password: Option.some("pw") }),
+      ).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe(
+          "LegacyMigrationPasswordFlagsError",
+        );
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits structured migrations in json", () => {
+    seedMigrations(tmp.current, ["20240103000000_c.sql"]);
+    const { layer, out } = setup(tmp.current, { format: "json", remote: ["20240102000000"] });
+    return Effect.gen(function* () {
+      yield* legacyMigrationList(flags());
+      expect(out.stdoutText).toBe(""); // no glamour table on stdout in json mode
+      expect(out.messages).toContainEqual(
+        expect.objectContaining({
+          type: "success",
+          message: "Migrations listed",
+          data: {
+            migrations: [
+              { local: "", remote: "20240102000000", time: "2024-01-02 00:00:00" },
+              { local: "20240103000000", remote: "", time: "2024-01-03 00:00:00" },
+            ],
+          },
+        }),
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("propagates a non-undefined-table remote read failure", () => {
+    seedMigrations(tmp.current, ["20240101000000_a.sql"]);
+    const { layer } = setup(tmp.current, {
+      remoteError: new LegacyDbExecError({
+        message: "permission denied for schema",
+        code: "42501",
+      }),
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationList(flags()).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value instanceof LegacyMigrationsReadError).toBe(
+          true,
+        );
+      }
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/migration/list/list.live.test.ts b/apps/cli/src/legacy/commands/migration/list/list.live.test.ts
new file mode 100644
index 0000000000..fadd3df371
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/list/list.live.test.ts
@@ -0,0 +1,53 @@
+import { expect, test } from "vitest";
+
+import {
+  describeLiveDataPlane,
+  requireLiveProjectRef,
+  runSupabaseLive,
+} from "../../../../../tests/helpers/live.ts";
+
+const LIVE_TIMEOUT_MS = 120_000;
+
+// Data-plane scenario: unlike `functions`/`branches` list (Management-API
+// reads), `migration list` connects to the project's *Postgres* over the pooler.
+// `describeLiveDataPlane` runs this only when the project instance is
+// ACTIVE_HEALTHY — i.e. the full stack with supabase-postgres-17. The current
+// cli-e2e-ci CI omits it (CLI-1825), so the project record exists but its DB is
+// unreachable, and this suite SKIPS there rather than failing (see the gate's
+// note). It activates automatically once the data-plane is provisioned.
+//
+// The `--linked` default mints a temp login role via the Management API, then
+// reads `supabase_migrations.schema_migrations`. On a freshly provisioned
+// project the history table is absent, which the handler maps to an empty list
+// (Go's `pgerrcode.UndefinedTable`), so the command still exits 0. The ref is
+// supplied via SUPABASE_PROJECT_ID (migration commands resolve the linked ref
+// from env / config.toml / ref-file, not a `--project-ref` flag).
+describeLiveDataPlane("supabase migration list (live)", () => {
+  test(
+    "lists migrations on the linked project's database",
+    { timeout: LIVE_TIMEOUT_MS },
+    async () => {
+      const ref = requireLiveProjectRef();
+      const { exitCode, stdout, stderr } = await runSupabaseLive(["migration", "list"], {
+        env: { SUPABASE_PROJECT_ID: ref },
+      });
+      expect(`${stdout}${stderr}`).not.toContain("Unauthorized");
+      expect(exitCode, `stdout:\n${stdout}\nstderr:\n${stderr}`).toBe(0);
+    },
+  );
+
+  test(
+    "emits machine-readable JSON with --output-format json",
+    { timeout: LIVE_TIMEOUT_MS },
+    async () => {
+      const ref = requireLiveProjectRef();
+      const { exitCode, stdout, stderr } = await runSupabaseLive(
+        ["migration", "list", "--output-format", "json"],
+        { env: { SUPABASE_PROJECT_ID: ref } },
+      );
+      expect(exitCode, `stdout:\n${stdout}\nstderr:\n${stderr}`).toBe(0);
+      // stdout must be payload-only valid JSON in json mode (no spinner/log noise).
+      expect(() => JSON.parse(stdout)).not.toThrow();
+    },
+  );
+});
diff --git a/apps/cli/src/legacy/commands/migration/migration.errors.ts b/apps/cli/src/legacy/commands/migration/migration.errors.ts
new file mode 100644
index 0000000000..09d3f96bb8
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/migration.errors.ts
@@ -0,0 +1,53 @@
+import { Data } from "effect";
+
+/**
+ * Conflicting database-target flags. Reproduces cobra's
+ * `MarkFlagsMutuallyExclusive("db-url", "linked", "local")` error byte-for-byte
+ * (`apps/cli-go/cmd/migration.go`). Shared by list / fetch / repair / up / down /
+ * squash.
+ */
+export class LegacyMigrationTargetFlagsError extends Data.TaggedError(
+  "LegacyMigrationTargetFlagsError",
+)<{
+  readonly message: string;
+}> {}
+
+/**
+ * `--db-url` combined with `--password`/`-p`. Reproduces cobra's
+ * `MarkFlagsMutuallyExclusive("db-url", "password")` (list / repair / squash).
+ */
+export class LegacyMigrationPasswordFlagsError extends Data.TaggedError(
+  "LegacyMigrationPasswordFlagsError",
+)<{
+  readonly message: string;
+}> {}
+
+/**
+ * A positional version argument is not a valid integer. Byte-matches Go's
+ * `failed to parse <v>: invalid version number` (`repair.go:27`, `ErrInvalidVersion`).
+ */
+export class LegacyMigrationInvalidVersionError extends Data.TaggedError(
+  "LegacyMigrationInvalidVersionError",
+)<{
+  readonly message: string;
+}> {}
+
+/**
+ * No local migration file matched the requested version glob. Byte-matches Go's
+ * `glob supabase/migrations/<version>_*.sql: file does not exist`
+ * (`repair.GetMigrationFile`). Shared by repair (applied) and squash.
+ */
+export class LegacyMigrationFileNotFoundError extends Data.TaggedError(
+  "LegacyMigrationFileNotFoundError",
+)<{
+  readonly message: string;
+}> {}
+
+/**
+ * The user declined a confirmation prompt (overwrite / repair-all / revert).
+ * Mirrors Go returning `context.Canceled`, which the root maps to a non-zero exit
+ * with no extra output.
+ */
+export class LegacyOperationCanceledError extends Data.TaggedError("LegacyOperationCanceledError")<{
+  readonly message: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/migration/migration.integration.test.ts b/apps/cli/src/legacy/commands/migration/migration.integration.test.ts
index e777838119..886224c0c2 100644
--- a/apps/cli/src/legacy/commands/migration/migration.integration.test.ts
+++ b/apps/cli/src/legacy/commands/migration/migration.integration.test.ts
@@ -25,15 +25,15 @@ const legacyTestRoot = Command.make("supabase").pipe(
 
 describe("legacy migration command integration", () => {
   it.live("accepts the Go-compatible plural migrations alias", () => {
+    // Routes through `squash`, which stays a deliberate Go-proxy delegate (a
+    // native pg-delta squash would diverge from Go's pg_dump output — see the
+    // porting-status doc), so this also asserts the proxy path still works while
+    // the other six subcommands are now native.
     const proxy = mockLegacyGoProxy();
     const run = Effect.gen(function* () {
-      yield* Command.runWith(legacyTestRoot, { version: "0.0.0-test" })([
-        "migrations",
-        "new",
-        "create_widgets",
-      ]);
+      yield* Command.runWith(legacyTestRoot, { version: "0.0.0-test" })(["migrations", "squash"]);
 
-      expect(proxy.calls).toEqual([["migration", "new", "create_widgets"]]);
+      expect(proxy.calls).toEqual([["migration", "squash"]]);
     }).pipe(Effect.provide(Layer.mergeAll(proxy.layer, CliOutput.layer(textCliOutputFormatter()))));
 
     // Command.runWith's Environment type is retained even though this path only needs CliOutput
diff --git a/apps/cli/src/legacy/commands/migration/migration.layers.ts b/apps/cli/src/legacy/commands/migration/migration.layers.ts
new file mode 100644
index 0000000000..906d8e3477
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/migration.layers.ts
@@ -0,0 +1,60 @@
+import { Layer } from "effect";
+
+import { commandRuntimeLayer } from "../../../shared/runtime/command-runtime.layer.ts";
+import { stdinLayer } from "../../../shared/runtime/stdin.layer.ts";
+import { legacyCliConfigLayer } from "../../config/legacy-cli-config.layer.ts";
+import { legacyDbConfigLayer } from "../../shared/legacy-db-config.layer.ts";
+import { legacyDbConnectionLayer } from "../../shared/legacy-db-connection.layer.ts";
+import { legacyDebugLoggerLayer } from "../../shared/legacy-debug-logger.layer.ts";
+import { legacyIdentityStitchLayer } from "../../shared/legacy-identity-stitch.ts";
+import { legacyLinkedDbResolverRuntimeLayer } from "../../shared/legacy-management-api-runtime.layer.ts";
+import { legacyTelemetryStateLayer } from "../../telemetry/legacy-telemetry-state.layer.ts";
+
+const cliConfig = legacyCliConfigLayer.pipe(Layer.provide(legacyDebugLoggerLayer));
+
+/**
+ * Runtime layer for `supabase migration new`. The leanest of the migration
+ * runtimes: no DB connection, no Management API, no Docker. Just the resolved CLI
+ * config (for `--workdir`), telemetry-state flush, piped stdin, and the command
+ * runtime span. `Output`, `Analytics`, `Stdio`, `FileSystem`, `Path`, `Clock`,
+ * and `Tty` come from the root layer.
+ */
+export const legacyMigrationNewRuntimeLayer = Layer.mergeAll(
+  cliConfig,
+  legacyTelemetryStateLayer,
+  stdinLayer,
+  commandRuntimeLayer(["migration", "new"]),
+);
+
+const dbConfig = legacyDbConfigLayer.pipe(
+  Layer.provide(cliConfig),
+  Layer.provide(legacyDbConnectionLayer),
+  Layer.provide(legacyDebugLoggerLayer),
+  Layer.provide(legacyIdentityStitchLayer),
+);
+
+/**
+ * Runtime layer for the DB-touching migration subcommands (`list` / `fetch` /
+ * `repair` / `up` / `down`). Mirrors `pull.layers.ts` minus the
+ * pg-delta / migra stack (no Docker, edge-runtime, SSL probe, or shadow seam):
+ * the db-config resolver + connection, the lazy linked-resolver auth stack
+ * (project-ref + linked-project cache), the shared identity stitcher, telemetry
+ * flush, piped stdin (for the migration confirm prompt — Go's `PromptYesNo` reads
+ * stdin), and the command runtime span. `Output`, `Analytics`, `Stdio`,
+ * `FileSystem`, `Path`, `Clock`, `Tty`, and `LegacyYesFlag` come from the root.
+ *
+ * `legacyIdentityStitchLayer` is provided by the SAME reference to `dbConfig` and
+ * the linked resolver so Effect memoises one shared `sync.Once` (legacy CLAUDE.md
+ * rule 5).
+ */
+export const legacyMigrationDbRuntimeLayer = (commandPath: ReadonlyArray<string>) =>
+  Layer.mergeAll(
+    dbConfig,
+    legacyDbConnectionLayer,
+    cliConfig,
+    legacyIdentityStitchLayer,
+    legacyTelemetryStateLayer,
+    stdinLayer,
+    legacyLinkedDbResolverRuntimeLayer(commandPath).pipe(Layer.provide(legacyIdentityStitchLayer)),
+    commandRuntimeLayer(commandPath),
+  );
diff --git a/apps/cli/src/legacy/commands/migration/migration.prompt.ts b/apps/cli/src/legacy/commands/migration/migration.prompt.ts
new file mode 100644
index 0000000000..3bef8af5fc
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/migration.prompt.ts
@@ -0,0 +1,53 @@
+import { Effect, Option } from "effect";
+
+import { Output } from "../../../shared/output/output.service.ts";
+import { Stdin } from "../../../shared/runtime/stdin.service.ts";
+
+/** Go's `Console.ReadLine` timeouts (`internal/utils/console.go:35-36`). */
+const TTY_TIMEOUT_MILLIS = 10 * 60 * 1000;
+const NON_TTY_TIMEOUT_MILLIS = 100;
+
+/** Go's `parseYesNo` (`internal/utils/console.go:84-93`): case-insensitive y/yes/n/no. */
+const parseYesNo = (value: string): boolean | undefined => {
+  const lower = value.toLowerCase();
+  if (lower === "y" || lower === "yes") return true;
+  if (lower === "n" || lower === "no") return false;
+  return undefined;
+};
+
+/**
+ * Port of Go's `utils.NewConsole().PromptYesNo(ctx, label, def)`
+ * (`internal/utils/console.go:64-107`), shared by the prompting migration subcommands
+ * (fetch / repair / down / squash).
+ *
+ * Go writes the label to STDERR and reads one line of STDIN regardless of the `--output`
+ * format (which only shapes stdout); `IsTTY` changes only the read timeout (10 min vs
+ * 100 ms) and whether the input is echoed. So this prompts independently of
+ * `output.format` and does NOT route through `output.promptConfirm` — the json/stream-json
+ * Output layers make that non-interactive, which would silently auto-default a real TTY run
+ * under `--output-format json` (fetch auto-overwriting, down/repair-all auto-cancelling).
+ * `--yes` short-circuits to `true`, echoing `<label> y` like Go's `viper.GetBool("YES")`.
+ */
+export const legacyMigrationConfirm = (
+  title: string,
+  options: { readonly defaultValue: boolean; readonly yes: boolean },
+) =>
+  Effect.gen(function* () {
+    const output = yield* Output;
+    const stdin = yield* Stdin;
+    const choices = options.defaultValue ? "Y/n" : "y/N";
+    const label = `${title} [${choices}] `;
+    if (options.yes) {
+      yield* output.raw(`${label}y\n`, "stderr");
+      return true;
+    }
+
+    // Go's `PromptText`: print the label to stderr, read one line of stdin (TTY 10 min /
+    // non-TTY 100 ms). A non-TTY run echoes the input back to stderr (`console.go:104`); a
+    // TTY echoes via the terminal. An empty / unparseable answer falls back to the default.
+    yield* output.raw(label, "stderr");
+    const line = yield* stdin.readLine(stdin.isTTY ? TTY_TIMEOUT_MILLIS : NON_TTY_TIMEOUT_MILLIS);
+    const input = Option.getOrElse(line, () => "");
+    if (!stdin.isTTY) yield* output.raw(`${input}\n`, "stderr");
+    return parseYesNo(input) ?? options.defaultValue;
+  });
diff --git a/apps/cli/src/legacy/commands/migration/new/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/new/SIDE_EFFECTS.md
index d5a198b552..ca40e16d5e 100644
--- a/apps/cli/src/legacy/commands/migration/new/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/migration/new/SIDE_EFFECTS.md
@@ -26,28 +26,40 @@
 
 ## Exit Codes
 
-| Code | Condition                             |
-| ---- | ------------------------------------- |
-| `0`  | success — migration file created      |
-| `1`  | failed to create migrations directory |
-| `1`  | failed to write migration file        |
+| Code | Condition                                                       |
+| ---- | --------------------------------------------------------------- |
+| `0`  | success — migration file created                                |
+| `1`  | invalid migration name (resolves outside `supabase/migrations`) |
+| `1`  | failed to create migrations directory                           |
+| `1`  | failed to write migration file                                  |
 
 ## Output
 
 ### `--output-format text` (Go CLI compatible)
 
-Prints the path of the created migration file.
+Prints `Created new migration at <bold supabase/migrations/<timestamp>_<name>.sql>` to
+stdout. The path is **workdir-relative** (Go chdir's into `--workdir`, so the printed
+path is independent of the resolved project root).
 
 ### `--output-format json`
 
-Not applicable.
+Emits `output.success("Migration created", { path })` where `path` is the absolute
+path of the created file. No human-readable line is written.
 
 ### `--output-format stream-json`
 
-Not applicable.
+Same structured result as `json`, delivered as an NDJSON `result` event.
 
 ## Notes
 
 - Requires exactly one positional argument: the migration name.
 - The file timestamp uses the current UTC time in `YYYYMMDDHHMMSS` format.
-- If stdin is piped, the content is streamed into the new migration file.
+- If stdin is piped (non-TTY), the raw bytes are written verbatim into the new
+  migration file, including any trailing newline. A TTY (or an empty pipe) writes an
+  empty file.
+- The file is written with mode `0644`.
+- **Path-traversal hardening (TS-only):** the name is rejected before any write if
+  `<workdir>/supabase/migrations/<timestamp>_<name>.sql` resolves outside the
+  migrations directory (e.g. a `..`-laden name). Go has no such check; the guard is
+  parity-neutral for legitimate names (simple identifiers) and only closes the
+  arbitrary-write vector (CWE-22) when the name is attacker/template-controlled.
diff --git a/apps/cli/src/legacy/commands/migration/new/new.command.ts b/apps/cli/src/legacy/commands/migration/new/new.command.ts
index 4a24b05eb4..b80344b892 100644
--- a/apps/cli/src/legacy/commands/migration/new/new.command.ts
+++ b/apps/cli/src/legacy/commands/migration/new/new.command.ts
@@ -1,5 +1,9 @@
 import { Argument, Command } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
+import { legacyMigrationNewRuntimeLayer } from "../migration.layers.ts";
 import { legacyMigrationNew } from "./new.handler.ts";
 
 const config = {
@@ -13,5 +17,8 @@ export type LegacyMigrationNewFlags = CliCommand.Command.Config.Infer<typeof con
 export const legacyMigrationNewCommand = Command.make("new", config).pipe(
   Command.withDescription("Create an empty migration script."),
   Command.withShortDescription("Create an empty migration script"),
-  Command.withHandler((flags) => legacyMigrationNew(flags)),
+  Command.withHandler((flags) =>
+    legacyMigrationNew(flags).pipe(withLegacyCommandInstrumentation(), withJsonErrorHandling),
+  ),
+  Command.provide(legacyMigrationNewRuntimeLayer),
 );
diff --git a/apps/cli/src/legacy/commands/migration/new/new.e2e.test.ts b/apps/cli/src/legacy/commands/migration/new/new.e2e.test.ts
new file mode 100644
index 0000000000..1c2f012fbd
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/new/new.e2e.test.ts
@@ -0,0 +1,46 @@
+import { mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+
+import { runSupabase } from "../../../../../tests/helpers/cli.ts";
+
+const E2E_TIMEOUT_MS = 30_000;
+
+// Strip ANSI so the assertion is colour-independent: the handler prints the path
+// via `legacyBold`, which emits bold escapes under CI's `FORCE_COLOR` even on a
+// piped stdout. The text content is the parity contract, not the colour. Mirrors
+// `new.integration.test.ts`.
+// eslint-disable-next-line no-control-regex
+const stripAnsi = (text: string) => text.replace(/\x1b\[[0-9;]*m/gu, "");
+
+describe("supabase migration new (legacy)", () => {
+  let workdir: string;
+  beforeEach(() => {
+    workdir = mkdtempSync(join(tmpdir(), "sb-mig-new-e2e-"));
+  });
+  afterEach(() => {
+    rmSync(workdir, { recursive: true, force: true });
+  });
+
+  // Primary golden path: a real subprocess creates the migration file under the
+  // working directory and prints the workdir-relative path. No infra required.
+  test(
+    "creates a timestamped migration file and prints its path",
+    { timeout: E2E_TIMEOUT_MS },
+    async () => {
+      const { exitCode, stdout } = await runSupabase(["migration", "new", "create_widgets"], {
+        entrypoint: "legacy",
+        cwd: workdir,
+      });
+
+      expect(exitCode).toBe(0);
+      const files = readdirSync(join(workdir, "supabase", "migrations"));
+      expect(files).toHaveLength(1);
+      expect(files[0]).toMatch(/^\d{14}_create_widgets\.sql$/u);
+      expect(stripAnsi(stdout)).toContain(
+        `Created new migration at supabase/migrations/${files[0]}`,
+      );
+    },
+  );
+});
diff --git a/apps/cli/src/legacy/commands/migration/new/new.errors.ts b/apps/cli/src/legacy/commands/migration/new/new.errors.ts
new file mode 100644
index 0000000000..a6f8d07cc1
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/new/new.errors.ts
@@ -0,0 +1,10 @@
+import { Data } from "effect";
+
+/**
+ * Creating the migrations directory or writing the new migration file failed.
+ * Wraps Go's `failed to open migration file` / `MkdirIfNotExistFS` errors
+ * (`internal/migration/new/new.go:15-22`).
+ */
+export class LegacyMigrationNewWriteError extends Data.TaggedError("LegacyMigrationNewWriteError")<{
+  readonly message: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/migration/new/new.handler.ts b/apps/cli/src/legacy/commands/migration/new/new.handler.ts
index eee694c918..de50e1d0d9 100644
--- a/apps/cli/src/legacy/commands/migration/new/new.handler.ts
+++ b/apps/cli/src/legacy/commands/migration/new/new.handler.ts
@@ -1,11 +1,109 @@
-import { Effect } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { Clock, Effect, FileSystem, Path, Stream } from "effect";
+
+import { Output } from "../../../../shared/output/output.service.ts";
+import { Stdin } from "../../../../shared/runtime/stdin.service.ts";
+import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
+import { legacyBold } from "../../../shared/legacy-colors.ts";
+import {
+  legacyFormatMigrationTimestamp,
+  legacyGetMigrationPath,
+} from "../../../shared/legacy-migration-file.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
 import type { LegacyMigrationNewFlags } from "./new.command.ts";
+import { LegacyMigrationNewWriteError } from "./new.errors.ts";
 
+/**
+ * Native port of `supabase migration new` (`internal/migration/new/new.go`):
+ * write `supabase/migrations/<UTC timestamp>_<name>.sql` (mode 0644), seeding it
+ * from piped stdin when present, then print the created path. No DB / API / prompt.
+ */
 export const legacyMigrationNew = Effect.fn("legacy.migration.new")(function* (
   flags: LegacyMigrationNewFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["migration", "new", flags.migrationName];
-  yield* proxy.exec(args);
+  const output = yield* Output;
+  const cliConfig = yield* LegacyCliConfig;
+  const stdin = yield* Stdin;
+  const telemetryState = yield* LegacyTelemetryState;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+
+  yield* Effect.gen(function* () {
+    const timestamp = legacyFormatMigrationTimestamp(yield* Clock.currentTimeMillis);
+    const migrationPath = legacyGetMigrationPath(
+      path,
+      cliConfig.workdir,
+      timestamp,
+      flags.migrationName,
+    );
+
+    // The name is a positional CLI arg; `path.join` collapses `..` segments, so a
+    // name like `../../../foo` resolves OUTSIDE the migrations directory and lets
+    // `migration new` write an arbitrary file (CWE-22) — reachable when the name
+    // comes from an agent/CI template rather than a human. Real names are simple
+    // identifiers, so containing the write to `supabase/migrations` is
+    // parity-neutral for legitimate input while closing the arbitrary-write
+    // vector — the same TS-only hardening `migration fetch` applies to remote rows.
+    const migrationsDir = path.join(cliConfig.workdir, "supabase", "migrations");
+    if (!migrationPath.startsWith(migrationsDir + path.sep)) {
+      return yield* Effect.fail(
+        new LegacyMigrationNewWriteError({
+          message: `invalid migration name: "${flags.migrationName}" must not escape the ${path.join("supabase", "migrations")} directory`,
+        }),
+      );
+    }
+
+    yield* fs
+      .makeDirectory(path.dirname(migrationPath), { recursive: true })
+      .pipe(
+        Effect.mapError((cause) => new LegacyMigrationNewWriteError({ message: cause.message })),
+      );
+
+    // Go's `CopyStdinIfExists` opens the migration file first, then streams stdin into it
+    // with `io.Copy` (`internal/migration/new/new.go:19,28,41`) — a fixed-size buffer, so a
+    // large `pg_dump | supabase migration new` runs in constant memory. Mirror that: create
+    // the file (mode 0644, like Go's O_CREATE|O_TRUNC), then stream piped stdin into the open
+    // handle rather than buffering the whole pipe. A TTY (char device) writes nothing → empty
+    // file; an empty pipe streams nothing → empty file, both matching Go.
+    yield* Effect.scoped(
+      Effect.gen(function* () {
+        // Go fails with "failed to open migration file" if the open fails (`new.go:21`)...
+        const handle = yield* fs.open(migrationPath, { flag: "w", mode: 0o644 }).pipe(
+          Effect.mapError(
+            (cause) =>
+              new LegacyMigrationNewWriteError({
+                message: `failed to open migration file: ${cause.message}`,
+              }),
+          ),
+        );
+        // ...and with "failed to copy from stdin" if the copy fails (`new.go:42`). A piped
+        // stdin read error must abort here, not silently leave a truncated/empty file.
+        if (!stdin.isTTY) {
+          yield* stdin.pipedBytesStream.pipe(
+            Stream.runForEach((chunk) => handle.writeAll(chunk)),
+            Effect.mapError(
+              (cause) =>
+                new LegacyMigrationNewWriteError({
+                  message: `failed to copy from stdin: ${cause.message}`,
+                }),
+            ),
+          );
+        }
+      }),
+    );
+
+    // Go prints the RELATIVE path: `utils.MigrationsDir` is `supabase/migrations`
+    // and Go chdir's into `--workdir` in its persistent pre-run, so the printed
+    // path is workdir-independent. Reproduce that exactly while still writing to
+    // the absolute `migrationPath`.
+    const relativePath = path.join(
+      "supabase",
+      "migrations",
+      `${timestamp}_${flags.migrationName}.sql`,
+    );
+    if (output.format === "text") {
+      yield* output.raw(`Created new migration at ${legacyBold(relativePath)}\n`);
+    } else {
+      yield* output.success("Migration created", { path: migrationPath });
+    }
+  }).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/migration/new/new.integration.test.ts b/apps/cli/src/legacy/commands/migration/new/new.integration.test.ts
new file mode 100644
index 0000000000..caa3c051d4
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/new/new.integration.test.ts
@@ -0,0 +1,197 @@
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Cause, Effect, Exit, Layer, Option, Stream } from "effect";
+import { badArgument } from "effect/PlatformError";
+
+import {
+  mockLegacyCliConfig,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { mockOutput, mockStdin } from "../../../../../tests/helpers/mocks.ts";
+import { Stdin } from "../../../../shared/runtime/stdin.service.ts";
+import type { OutputFormat } from "../../../../shared/output/types.ts";
+import { LegacyMigrationNewWriteError } from "./new.errors.ts";
+import { legacyMigrationNew } from "./new.handler.ts";
+
+interface SetupOpts {
+  readonly format?: OutputFormat;
+  readonly isTTY?: boolean;
+  readonly piped?: string;
+}
+
+function setup(workdir: string, opts: SetupOpts = {}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const layer = Layer.mergeAll(
+    out.layer,
+    telemetry.layer,
+    mockStdin(opts.isTTY ?? true, opts.piped),
+    mockLegacyCliConfig({ workdir }),
+    BunServices.layer,
+  );
+  return { layer, out, telemetry };
+}
+
+// Strip ANSI so assertions are colour-independent (`legacyBold` emits colour on a TTY).
+// eslint-disable-next-line no-control-regex
+const stripAnsi = (text: string) => text.replace(/\x1b\[[0-9;]*m/gu, "");
+
+const tmp = useLegacyTempWorkdir();
+
+const migrationsDir = (workdir: string) => join(workdir, "supabase", "migrations");
+const onlyMigration = (workdir: string) => {
+  const files = readdirSync(migrationsDir(workdir));
+  expect(files).toHaveLength(1);
+  return files[0]!;
+};
+
+describe("legacy migration new", () => {
+  it.live("creates a timestamped migration file and prints its relative path", () => {
+    const { layer, out, telemetry } = setup(tmp.current);
+    return Effect.gen(function* () {
+      yield* legacyMigrationNew({ migrationName: "create_widgets" });
+
+      const file = onlyMigration(tmp.current);
+      expect(file).toMatch(/^\d{14}_create_widgets\.sql$/u);
+      // Empty file when stdin is a TTY (Go writes nothing).
+      expect(readFileSync(join(migrationsDir(tmp.current), file), "utf8")).toBe("");
+      // Go prints the workdir-relative path, not the absolute write path.
+      expect(stripAnsi(out.stdoutText)).toBe(
+        `Created new migration at supabase/migrations/${file}\n`,
+      );
+      expect(telemetry.flushed).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("writes piped stdin into the new migration verbatim", () => {
+    const script = "create table pet;\ndrop table pet;\n";
+    const { layer, out } = setup(tmp.current, { isTTY: false, piped: script });
+    return Effect.gen(function* () {
+      yield* legacyMigrationNew({ migrationName: "from_stdin" });
+
+      const file = onlyMigration(tmp.current);
+      // Byte-exact: the trailing newline is preserved (Go copies raw stdin bytes).
+      expect(readFileSync(join(migrationsDir(tmp.current), file), "utf8")).toBe(script);
+      expect(stripAnsi(out.stdoutText)).toContain(`Created new migration at supabase/migrations/`);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("creates an empty migration when stdin is piped but empty", () => {
+    const { layer } = setup(tmp.current, { isTTY: false });
+    return Effect.gen(function* () {
+      yield* legacyMigrationNew({ migrationName: "empty_pipe" });
+      const file = onlyMigration(tmp.current);
+      expect(readFileSync(join(migrationsDir(tmp.current), file), "utf8")).toBe("");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a structured result with the absolute path in json", () => {
+    const { layer, out } = setup(tmp.current, { format: "json" });
+    return Effect.gen(function* () {
+      yield* legacyMigrationNew({ migrationName: "as_json" });
+
+      const file = onlyMigration(tmp.current);
+      // No human text line in machine mode.
+      expect(out.stdoutText).toBe("");
+      expect(out.messages).toContainEqual(
+        expect.objectContaining({
+          type: "success",
+          message: "Migration created",
+          data: { path: join(migrationsDir(tmp.current), file) },
+        }),
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a structured result in stream-json", () => {
+    const { layer, out } = setup(tmp.current, { format: "stream-json" });
+    return Effect.gen(function* () {
+      yield* legacyMigrationNew({ migrationName: "as_stream" });
+      expect(out.messages).toContainEqual(
+        expect.objectContaining({ type: "success", message: "Migration created" }),
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports a write failure and still flushes telemetry", () => {
+    // A file at <workdir>/supabase makes `makeDirectory(supabase/migrations)` fail.
+    writeFileSync(join(tmp.current, "supabase"), "not a directory");
+    const { layer, telemetry } = setup(tmp.current);
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationNew({ migrationName: "doomed" }).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure)).toBe(true);
+        if (Option.isSome(failure)) {
+          expect(failure.value).toBeInstanceOf(LegacyMigrationNewWriteError);
+        }
+      }
+      expect(existsSync(migrationsDir(tmp.current))).toBe(false);
+      expect(telemetry.flushed).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects a name that escapes the migrations directory and writes nothing", () => {
+    const { layer, telemetry } = setup(tmp.current, { isTTY: false, piped: "DROP DATABASE;\n" });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationNew({
+        migrationName: "../../../escapes",
+      }).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure)).toBe(true);
+        if (Option.isSome(failure)) {
+          expect(failure.value).toBeInstanceOf(LegacyMigrationNewWriteError);
+        }
+      }
+      // The guard fires before any directory/file is touched: nothing is created
+      // under the workdir (not the migrations dir, not the escaped target).
+      expect(existsSync(join(tmp.current, "supabase"))).toBe(false);
+      expect(telemetry.flushed).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "fails the command when piped stdin errors mid-copy (Go: failed to copy from stdin)",
+    () => {
+      // Go's io.Copy returns "failed to copy from stdin" and exits non-zero on a stdin read
+      // error (new.go:42); the streaming copy must surface that, not leave a truncated file.
+      const failingStdin = Layer.succeed(Stdin, {
+        isTTY: false,
+        readPipedBytes: Effect.succeed(Option.none()),
+        pipedBytesStream: Stream.fail(badArgument({ module: "Stdin", method: "read" })),
+        readPipedText: Effect.succeed(Option.none()),
+        readLine: () => Effect.succeed(Option.none()),
+      });
+      const out = mockOutput();
+      const telemetry = mockLegacyTelemetryStateTracked();
+      const layer = Layer.mergeAll(
+        out.layer,
+        telemetry.layer,
+        failingStdin,
+        mockLegacyCliConfig({ workdir: tmp.current }),
+        BunServices.layer,
+      );
+      return Effect.gen(function* () {
+        const exit = yield* legacyMigrationNew({ migrationName: "stdin_boom" }).pipe(Effect.exit);
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const failure = Cause.findErrorOption(exit.cause);
+          expect(Option.isSome(failure)).toBe(true);
+          if (Option.isSome(failure)) {
+            expect(failure.value).toBeInstanceOf(LegacyMigrationNewWriteError);
+            if (failure.value instanceof LegacyMigrationNewWriteError) {
+              expect(failure.value.message).toContain("failed to copy from stdin");
+            }
+          }
+        }
+        expect(telemetry.flushed).toBe(true);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+});
diff --git a/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md
index 3972fbd0d5..3dd87b7f81 100644
--- a/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/migration/repair/SIDE_EFFECTS.md
@@ -37,19 +37,43 @@
 
 ### `--output-format text` (Go CLI compatible)
 
-Prints "Finished `supabase migration repair`." on success.
+When repairing specific versions, prints `Repaired migration history: [<versions>]
+=> <status>` to stderr, then `Finished supabase migration repair.` to stdout and
+the suggestion `Run supabase migration list to show the updated migration history.`
+to stderr. The DB mutation is one transaction: create the history table, then (for
+repair-all) `TRUNCATE`, plus `applied` → per-version `UPSERT` from the local file,
+`reverted` → `DELETE ... WHERE version = ANY($1)`.
+
+> **Atomicity note:** Go runs the TRUNCATE/UPSERT/DELETE via `pgx.Batch` (a
+> pipeline, not an explicit transaction), so a partial failure mid-batch (e.g.
+> TRUNCATE commits but a later UPSERT fails) can leave the history table in a
+> half-updated state. The TS port wraps the same statements in an explicit
+> `BEGIN`/`COMMIT` with `ROLLBACK` on error, so a partial failure leaves the table
+> unchanged. This is a deliberate, safer divergence (`LegacyDbSession` has no batch
+> primitive); the success path is byte-identical to Go.
 
 ### `--output-format json`
 
-Not applicable.
+Emits `output.success("Migration history repaired", { versions, status, repairAll })`.
 
 ### `--output-format stream-json`
 
-Not applicable.
+Same structured result delivered as an NDJSON `result` event.
+
+## Prompts
+
+- With no version arguments (repair-all), prompts `Do you want to repair the entire
+migration history table to match local migration files?` (default **NO**).
+  Declining exits non-zero (`context canceled`). `--yes` auto-confirms; a
+  non-interactive / machine-output run takes the default (NO → cancel).
 
 ## Notes
 
 - `--status` flag is required and accepts `applied` or `reverted`.
-- Accepts one or more migration version arguments.
-- `--linked` (default true), `--local`, and `--db-url` are mutually exclusive.
-- `--password` / `-p` sets the DB password.
+- Accepts zero or more migration version arguments; each must be numeric
+  (`failed to parse <v>: invalid version number` otherwise). Zero versions enables
+  repair-all.
+- In `applied` mode, reads the matching `supabase/migrations/<version>_*.sql` file
+  for the name + statements; a missing file exits non-zero.
+- `--linked` (default true), `--local`, and `--db-url` are mutually exclusive, as
+  are `--db-url` and `--password`/`-p`.
diff --git a/apps/cli/src/legacy/commands/migration/repair/repair.command.ts b/apps/cli/src/legacy/commands/migration/repair/repair.command.ts
index a31ece5051..d00659ed76 100644
--- a/apps/cli/src/legacy/commands/migration/repair/repair.command.ts
+++ b/apps/cli/src/legacy/commands/migration/repair/repair.command.ts
@@ -1,4 +1,8 @@
 import { Argument, Command, Flag } from "effect/unstable/cli";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
+import { legacyMigrationDbRuntimeLayer } from "../migration.layers.ts";
 import { legacyMigrationRepair } from "./repair.handler.ts";
 
 const config = {
@@ -17,6 +21,8 @@ const config = {
   ),
   linked: Flag.boolean("linked").pipe(
     Flag.withDescription("Repairs the migration history of the linked project."),
+    // Go: `repairFlags.Bool("linked", true, …)`.
+    Flag.withDefault(true),
   ),
   local: Flag.boolean("local").pipe(
     Flag.withDescription("Repairs the migration history of the local database."),
@@ -39,6 +45,22 @@ export const legacyMigrationRepairCommand = Command.make("repair", config).pipe(
       linked: flags.linked,
       local: flags.local,
       password: flags.password,
-    }),
+    }).pipe(
+      withLegacyCommandInstrumentation({
+        flags: {
+          status: flags.status,
+          "db-url": flags.dbUrl,
+          linked: flags.linked,
+          local: flags.local,
+          // `password` is a credential — always reaches telemetry as `<redacted>`.
+          password: flags.password,
+        },
+        // Go records `utils.EnumFlag` values verbatim (`--status`); password stays redacted.
+        safeFlags: ["status"],
+        aliases: { p: "password" },
+      }),
+      withJsonErrorHandling,
+    ),
   ),
+  Command.provide(legacyMigrationDbRuntimeLayer(["migration", "repair"])),
 );
diff --git a/apps/cli/src/legacy/commands/migration/repair/repair.errors.ts b/apps/cli/src/legacy/commands/migration/repair/repair.errors.ts
new file mode 100644
index 0000000000..7b85614e33
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/repair/repair.errors.ts
@@ -0,0 +1,12 @@
+import { Data } from "effect";
+
+/**
+ * Applying the repair batch (TRUNCATE / UPSERT / DELETE) failed. Byte-matches
+ * Go's `failed to update migration table: %w`
+ * (`internal/migration/repair/repair.go:80`).
+ */
+export class LegacyMigrationRepairUpdateError extends Data.TaggedError(
+  "LegacyMigrationRepairUpdateError",
+)<{
+  readonly message: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/migration/repair/repair.handler.ts b/apps/cli/src/legacy/commands/migration/repair/repair.handler.ts
index 926434647f..ea6727d68d 100644
--- a/apps/cli/src/legacy/commands/migration/repair/repair.handler.ts
+++ b/apps/cli/src/legacy/commands/migration/repair/repair.handler.ts
@@ -1,7 +1,45 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { Effect, FileSystem, Option, Path } from "effect";
 
-interface LegacyMigrationRepairInput {
+import {
+  LegacyDnsResolverFlag,
+  legacyResolveYesWithProjectEnv,
+} from "../../../../shared/legacy/global-flags.ts";
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { legacyAqua } from "../../../shared/legacy-colors.ts";
+import { legacyLoadProjectEnv } from "../../../shared/legacy-db-config.toml-read.ts";
+import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
+import {
+  LegacyDbConnection,
+  type LegacyDbSession,
+} from "../../../shared/legacy-db-connection.service.ts";
+import { resolveLegacyDbTargetFlags } from "../../../shared/legacy-db-target-flags.ts";
+import {
+  DELETE_MIGRATION_VERSION,
+  type LegacyMigrationFile,
+  legacyCreateMigrationTable,
+  legacyLoadLocalVersions,
+  legacyReadMigrationFile,
+  legacyResolveMigrationFile,
+  TRUNCATE_VERSION_TABLE,
+  UPSERT_MIGRATION_VERSION,
+} from "../../../shared/legacy-migration-history.ts";
+import { legacyParseMigrationVersion } from "../../../shared/legacy-migration-timestamp.format.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import {
+  LegacyMigrationFileNotFoundError,
+  LegacyMigrationInvalidVersionError,
+  LegacyMigrationPasswordFlagsError,
+  LegacyMigrationTargetFlagsError,
+  LegacyOperationCanceledError,
+} from "../migration.errors.ts";
+import { legacyMigrationConfirm } from "../migration.prompt.ts";
+import { LegacyMigrationRepairUpdateError } from "./repair.errors.ts";
+
+export interface LegacyMigrationRepairInput {
   readonly versions: ReadonlyArray<string>;
   readonly status: "applied" | "reverted";
   readonly dbUrl: Option.Option<string>;
@@ -10,16 +48,214 @@ interface LegacyMigrationRepairInput {
   readonly password: Option.Option<string>;
 }
 
+/** Go's `repair.UpdateMigrationTable` — create the table, then run one batch txn. */
+const updateMigrationTable = Effect.fnUntraced(function* (
+  session: LegacyDbSession,
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  migrationsDir: string,
+  versions: ReadonlyArray<string>,
+  status: "applied" | "reverted",
+  repairAll: boolean,
+) {
+  const output = yield* Output;
+  yield* legacyCreateMigrationTable(session);
+
+  // Resolve the applied rows up front (Go reads each file while queueing the
+  // batch, before sending it — a missing file aborts with no DB mutation).
+  const appliedFiles: Array<LegacyMigrationFile> = [];
+  if (status === "applied") {
+    for (const version of versions) {
+      const resolved = yield* legacyResolveMigrationFile(fs, path, migrationsDir, version);
+      if (Option.isNone(resolved)) {
+        return yield* Effect.fail(
+          new LegacyMigrationFileNotFoundError({
+            message: `glob supabase/migrations/${version}_*.sql: file does not exist`,
+          }),
+        );
+      }
+      appliedFiles.push(yield* legacyReadMigrationFile(fs, path, resolved.value));
+    }
+  }
+
+  const txn = Effect.gen(function* () {
+    yield* session.exec("BEGIN");
+    if (repairAll) yield* session.exec(TRUNCATE_VERSION_TABLE);
+    if (status === "applied") {
+      for (const file of appliedFiles) {
+        yield* session.query(UPSERT_MIGRATION_VERSION, [file.version, file.name, file.statements]);
+      }
+    } else if (!repairAll) {
+      yield* session.query(DELETE_MIGRATION_VERSION, [versions]);
+    }
+    yield* session.exec("COMMIT");
+  });
+  yield* txn.pipe(
+    Effect.tapError(() => session.exec("ROLLBACK").pipe(Effect.ignore)),
+    Effect.mapError(
+      (cause) =>
+        new LegacyMigrationRepairUpdateError({
+          message: `failed to update migration table: ${cause.message}`,
+        }),
+    ),
+  );
+
+  // Go prints this only when NOT repairing the whole table (`repair.go:82`).
+  if (!repairAll) {
+    yield* output.raw(
+      `Repaired migration history: [${versions.join(" ")}] => ${status}\n`,
+      "stderr",
+    );
+  }
+});
+
+const runRepair = Effect.fnUntraced(function* (
+  input: LegacyMigrationRepairInput,
+  target: ReturnType<typeof resolveLegacyDbTargetFlags>,
+) {
+  const output = yield* Output;
+  const resolver = yield* LegacyDbConfigResolver;
+  const connection = yield* LegacyDbConnection;
+  const cliConfig = yield* LegacyCliConfig;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const dnsResolver = yield* LegacyDnsResolverFlag;
+
+  if (target.setFlags.length > 1) {
+    return yield* Effect.fail(
+      new LegacyMigrationTargetFlagsError({
+        message: `if any flags in the group [db-url linked local] are set none of the others can be; [${target.setFlags.join(" ")}] were all set`,
+      }),
+    );
+  }
+  if (Option.isSome(input.dbUrl) && Option.isSome(input.password)) {
+    return yield* Effect.fail(
+      new LegacyMigrationPasswordFlagsError({
+        message:
+          "if any flags in the group [db-url password] are set none of the others can be; [db-url password] were all set",
+      }),
+    );
+  }
+
+  const migrationsDir = path.join(cliConfig.workdir, "supabase", "migrations");
+  const repairAll = input.versions.length === 0;
+  const connType = target.connType ?? "linked"; // repair defaults to `--linked` (Go: `Bool("linked", true)`).
+
+  // Resolve the DB config (and, for the linked default, the project ref) BEFORE the
+  // version parse and any prompt — mirroring Go's cobra order: root `PersistentPreRunE`
+  // runs `ParseDatabaseConfig` (`apps/cli-go/cmd/root.go:118`) before `repair.Run`'s
+  // `strconv.Atoi` version loop (`internal/migration/repair/repair.go:27-31`). So an
+  // unlinked / invalid-config / malformed-`--db-url` run surfaces that error before an
+  // invalid positional version or a prompt.
+  const cfg = yield* resolver.resolve({
+    dbUrl: input.dbUrl,
+    connType,
+    dnsResolver,
+    password: input.password,
+  });
+
+  // Go loads the project .env via loadNestedEnv INSIDE ParseDatabaseConfig (config.go:701),
+  // after the parse-time flag-group validation above — so a SUPABASE_YES set only in
+  // supabase/.env auto-confirms the repair-all prompt, but a flag conflict still surfaces
+  // before any .env read. Resolve --yes against the project env here, not just process.env.
+  const projectEnv = yield* legacyLoadProjectEnv(fs, path, cliConfig.workdir);
+  const yes = yield* legacyResolveYesWithProjectEnv(projectEnv);
+
+  // Linked repair caches the project ref + identifies project groups — Go's
+  // `ensureProjectGroupsCached`, called from `Execute()` (`apps/cli-go/cmd/root.go:174`)
+  // gated on `executedCmd != nil`, NOT on the RunE error. The ref is loaded now (pre-run,
+  // via `ParseDatabaseConfig`'s `LoadProjectRef`), and the cache is attached to the whole
+  // repair flow via `Effect.ensuring` below — so it runs even when the version parse fails
+  // or the repair-all prompt is declined (Go caches on `context.Canceled` too).
+  const cacheLinkedRef =
+    connType === "linked"
+      ? yield* Effect.gen(function* () {
+          const projectRef = yield* LegacyProjectRefResolver;
+          const linkedProjectCache = yield* LegacyLinkedProjectCache;
+          const ref = yield* projectRef.loadProjectRef(Option.none());
+          return linkedProjectCache.cache(ref);
+        })
+      : undefined;
+
+  const repairFlow = Effect.gen(function* () {
+    // Version validation runs after DB-config resolution (Go's `strconv.Atoi` loop lives
+    // inside `repair.Run`, after `PersistentPreRunE`). Rejects non-numeric AND
+    // out-of-int64-range values; `legacyParseMigrationVersion` mirrors that exactly.
+    for (const version of input.versions) {
+      if (legacyParseMigrationVersion(version) === undefined) {
+        return yield* Effect.fail(
+          new LegacyMigrationInvalidVersionError({
+            message: `failed to parse ${version}: invalid version number`,
+          }),
+        );
+      }
+    }
+
+    // repair-all confirmation (default NO). Then load every local version.
+    let versions = input.versions;
+    if (repairAll) {
+      const confirmed = yield* legacyMigrationConfirm(
+        "Do you want to repair the entire migration history table to match local migration files?",
+        { defaultValue: false, yes },
+      );
+      if (!confirmed) {
+        return yield* Effect.fail(
+          new LegacyOperationCanceledError({ message: "context canceled" }),
+        );
+      }
+      versions = yield* legacyLoadLocalVersions(fs, path, migrationsDir);
+    }
+
+    yield* Effect.scoped(
+      Effect.gen(function* () {
+        // Go's `utils.ConnectByConfig` prints this to stderr before dialing
+        // (`internal/utils/connect.go:343-348`), local/remote per `IsLocalDatabase`.
+        yield* output.raw(
+          `Connecting to ${cfg.isLocal ? "local" : "remote"} database...\n`,
+          "stderr",
+        );
+        const session = yield* connection.connect(cfg.conn, {
+          isLocal: cfg.isLocal,
+          dnsResolver,
+        });
+        yield* updateMigrationTable(
+          session,
+          fs,
+          path,
+          migrationsDir,
+          versions,
+          input.status,
+          repairAll,
+        );
+      }),
+    );
+
+    if (output.format === "text") {
+      // Go's group PostRun (stdout) + root CmdSuggestion (stderr), both on success.
+      yield* output.raw(`Finished ${legacyAqua("supabase migration repair")}.\n`);
+      yield* output.raw(
+        `Run ${legacyAqua("supabase migration list")} to show the updated migration history.\n`,
+        "stderr",
+      );
+    } else {
+      yield* output.success("Migration history repaired", {
+        versions,
+        status: input.status,
+        repairAll,
+      });
+    }
+  });
+
+  return yield* cacheLinkedRef === undefined
+    ? repairFlow
+    : repairFlow.pipe(Effect.ensuring(cacheLinkedRef));
+});
+
 export const legacyMigrationRepair = Effect.fn("legacy.migration.repair")(function* (
-  flags: LegacyMigrationRepairInput,
+  input: LegacyMigrationRepairInput,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["migration", "repair"];
-  args.push(...flags.versions);
-  args.push("--status", flags.status);
-  if (Option.isSome(flags.dbUrl)) args.push("--db-url", flags.dbUrl.value);
-  if (flags.linked) args.push("--linked");
-  if (flags.local) args.push("--local");
-  if (Option.isSome(flags.password)) args.push("--password", flags.password.value);
-  yield* proxy.exec(args);
+  const telemetryState = yield* LegacyTelemetryState;
+  const cliArgs = yield* CliArgs;
+  const target = resolveLegacyDbTargetFlags(cliArgs.args);
+  yield* runRepair(input, target).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/migration/repair/repair.integration.test.ts b/apps/cli/src/legacy/commands/migration/repair/repair.integration.test.ts
new file mode 100644
index 0000000000..b6737c053b
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/repair/repair.integration.test.ts
@@ -0,0 +1,473 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Cause, Effect, Exit, Layer, Option } from "effect";
+
+import {
+  LEGACY_VALID_REF,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { mockOutput, mockStdin, mockTty } from "../../../../../tests/helpers/mocks.ts";
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import { LegacyDnsResolverFlag, LegacyYesFlag } from "../../../../shared/legacy/global-flags.ts";
+import type { OutputFormat } from "../../../../shared/output/types.ts";
+import { LegacyProjectNotLinkedError } from "../../../config/legacy-project-ref.errors.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
+import type {
+  LegacyDbConfigFlags,
+  LegacyResolvedDbConfig,
+} from "../../../shared/legacy-db-config.types.ts";
+import { LegacyDbExecError } from "../../../shared/legacy-db-connection.errors.ts";
+import { LegacyDbConnection } from "../../../shared/legacy-db-connection.service.ts";
+import { legacyMigrationRepair, type LegacyMigrationRepairInput } from "./repair.handler.ts";
+
+interface SetupOpts {
+  readonly format?: OutputFormat;
+  readonly isTTY?: boolean;
+  readonly pipedInput?: string;
+  readonly yes?: boolean;
+  readonly confirm?: boolean;
+  readonly args?: ReadonlyArray<string>;
+  readonly failSql?: string;
+  readonly failResolve?: boolean;
+}
+
+function setup(workdir: string, opts: SetupOpts = {}) {
+  const out = mockOutput({
+    format: opts.format ?? "text",
+    promptConfirmResponses: opts.confirm === undefined ? undefined : [opts.confirm],
+  });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+
+  const execs: Array<string> = [];
+  const queries: Array<{ sql: string; params?: ReadonlyArray<unknown> }> = [];
+
+  const resolver = Layer.succeed(LegacyDbConfigResolver, {
+    resolve: (_flags: LegacyDbConfigFlags) =>
+      opts.failResolve === true
+        ? Effect.fail(
+            new LegacyProjectNotLinkedError({
+              message: "Cannot find project ref. Have you run link?",
+            }),
+          )
+        : Effect.succeed({
+            conn: {
+              host: "127.0.0.1",
+              port: 54322,
+              user: "postgres",
+              password: "x",
+              database: "postgres",
+            },
+            isLocal: false,
+            ref: Option.some(LEGACY_VALID_REF),
+          } satisfies LegacyResolvedDbConfig),
+    resolvePoolerFallback: () => Effect.succeed(Option.none()),
+  });
+
+  const connection = Layer.succeed(LegacyDbConnection, {
+    connect: () =>
+      Effect.succeed({
+        exec: (sql: string) =>
+          Effect.suspend(() => {
+            execs.push(sql);
+            return opts.failSql !== undefined && sql.includes(opts.failSql)
+              ? Effect.fail(new LegacyDbExecError({ message: "boom" }))
+              : Effect.void;
+          }),
+        query: (sql: string, params?: ReadonlyArray<unknown>) =>
+          Effect.suspend(() => {
+            queries.push({ sql, params });
+            return opts.failSql !== undefined && sql.includes(opts.failSql)
+              ? Effect.fail(new LegacyDbExecError({ message: "boom" }))
+              : Effect.succeed<ReadonlyArray<Record<string, unknown>>>([]);
+          }),
+        extensionExists: () => Effect.succeed(false),
+        copyToCsv: () => Effect.succeed(new Uint8Array()),
+        queryRaw: () => Effect.succeed({ fields: [], rows: [], commandTag: "" }),
+      }),
+  });
+
+  const projectRef = Layer.succeed(LegacyProjectRefResolver, {
+    resolve: () => Effect.succeed(LEGACY_VALID_REF),
+    resolveForLink: () => Effect.succeed(LEGACY_VALID_REF),
+    resolveOptional: () => Effect.succeed(Option.some(LEGACY_VALID_REF)),
+    loadProjectRef: () => Effect.succeed(LEGACY_VALID_REF),
+    promptProjectRef: () => Effect.succeed(LEGACY_VALID_REF),
+  });
+
+  const layer = Layer.mergeAll(
+    out.layer,
+    telemetry.layer,
+    cache.layer,
+    resolver,
+    connection,
+    projectRef,
+    mockLegacyCliConfig({ workdir }),
+    Layer.succeed(LegacyDnsResolverFlag, "native"),
+    Layer.succeed(LegacyYesFlag, opts.yes ?? false),
+    Layer.succeed(CliArgs, { args: opts.args ?? [] }),
+    mockTty({ stdinIsTty: opts.isTTY ?? true }),
+    mockStdin(
+      opts.isTTY ?? true,
+      // Migration prompts read stdin directly (Go's PromptYesNo), so a confirm answer is
+      // supplied via piped stdin rather than the Output prompt mock.
+      opts.pipedInput ?? (opts.confirm === undefined ? undefined : opts.confirm ? "y\n" : "n\n"),
+    ),
+    BunServices.layer,
+  );
+  return { layer, out, telemetry, execs, queries, cache };
+}
+
+const input = (over: Partial<LegacyMigrationRepairInput> = {}): LegacyMigrationRepairInput => ({
+  versions: over.versions ?? [],
+  status: over.status ?? "applied",
+  dbUrl: over.dbUrl ?? Option.none(),
+  linked: over.linked ?? true,
+  local: over.local ?? false,
+  password: over.password ?? Option.none(),
+});
+
+// eslint-disable-next-line no-control-regex
+const stripAnsi = (text: string) => text.replace(/\x1b\[[0-9;]*m/gu, "");
+const seedMigration = (workdir: string, name: string, body: string) => {
+  const dir = join(workdir, "supabase", "migrations");
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, name), body);
+};
+
+const tmp = useLegacyTempWorkdir();
+
+describe("legacy migration repair", () => {
+  it.live("marks a version as applied by upserting from its local file", () => {
+    seedMigration(tmp.current, "20240101000000_init.sql", "create table a;\n");
+    const { layer, execs, queries, out } = setup(tmp.current);
+    return Effect.gen(function* () {
+      yield* legacyMigrationRepair(input({ versions: ["20240101000000"], status: "applied" }));
+      // Go prints the connection banner to stderr before dialing (connect.go:343-348).
+      expect(stripAnsi(out.stderrText)).toContain("Connecting to remote database...");
+      // One transaction: BEGIN ... COMMIT, no ROLLBACK.
+      expect(execs).toContain("BEGIN");
+      expect(execs).toContain("COMMIT");
+      expect(execs).not.toContain("ROLLBACK");
+      const upsert = queries.find((q) => q.sql.includes("ON CONFLICT"));
+      expect(upsert?.params).toEqual(["20240101000000", "init", ["create table a"]]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("resolves the DB target before parsing positional versions", () => {
+    // Go's cobra order runs ParseDatabaseConfig (PersistentPreRunE, root.go:118) before
+    // repair.Run's strconv.Atoi loop, so an unlinked target error wins over a bad version.
+    const { layer } = setup(tmp.current, { failResolve: true });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationRepair(
+        input({ versions: ["not-a-number"], status: "applied" }),
+      ).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        // The config/target error surfaces first, NOT the invalid-version error.
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyProjectNotLinkedError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("caches the linked project even when the repair-all prompt is declined", () => {
+    // Go calls ensureProjectGroupsCached from Execute() (root.go:174) regardless of the
+    // RunE error, so a declined repair-all (context.Canceled) still caches the ref.
+    const { layer, cache } = setup(tmp.current, { confirm: false });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationRepair(input({ versions: [], status: "applied" })).pipe(
+        Effect.exit,
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyOperationCanceledError");
+      }
+      expect(cache.cached).toBe(true);
+      expect(cache.cachedRef).toBe(LEGACY_VALID_REF);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("marks versions as reverted by deleting them", () => {
+    const { layer, queries } = setup(tmp.current);
+    return Effect.gen(function* () {
+      yield* legacyMigrationRepair(
+        input({ versions: ["20240101000000", "20240102000000"], status: "reverted" }),
+      );
+      const del = queries.find((q) => q.sql.includes("WHERE version = ANY"));
+      expect(del?.params).toEqual([["20240101000000", "20240102000000"]]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects a non-numeric version", () => {
+    const { layer } = setup(tmp.current);
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationRepair(
+        input({ versions: ["not-a-number"], status: "applied" }),
+      ).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe(
+          "LegacyMigrationInvalidVersionError",
+        );
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects a version outside Go's int range before any DB mutation", () => {
+    const { layer, execs, queries } = setup(tmp.current);
+    return Effect.gen(function* () {
+      // Go validates explicit versions with strconv.Atoi (repair.go:27-31), which
+      // rejects values above the int64 range; a 20-digit version must fail
+      // `invalid version number` before any glob/upsert/delete.
+      const exit = yield* legacyMigrationRepair(
+        input({ versions: ["99999999999999999999"], status: "applied" }),
+      ).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe(
+          "LegacyMigrationInvalidVersionError",
+        );
+      }
+      // Validation runs before connecting, so no transaction or upsert occurred.
+      expect(execs).not.toContain("BEGIN");
+      expect(queries.some((q) => q.sql.includes("ON CONFLICT"))).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("repair-all truncates and reapplies local files on confirm", () => {
+    seedMigration(tmp.current, "20240101000000_init.sql", "create table a;\n");
+    const { layer, execs, queries } = setup(tmp.current, { confirm: true });
+    return Effect.gen(function* () {
+      yield* legacyMigrationRepair(input({ versions: [], status: "applied" }));
+      expect(execs).toContain("TRUNCATE supabase_migrations.schema_migrations");
+      expect(queries.some((q) => q.sql.includes("ON CONFLICT"))).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live(
+    "repair-all with --status reverted wipes the whole history (no upserts, no deletes)",
+    () => {
+      // Go's repair-all + reverted queues ONLY TRUNCATE: the per-version DELETE is
+      // the non-repair-all path and the UPSERT is the applied path, so the net
+      // effect is wiping the entire history table (`repair.go:64-79`).
+      seedMigration(tmp.current, "20240101000000_init.sql", "create table a;\n");
+      const { layer, execs, queries } = setup(tmp.current, { confirm: true });
+      return Effect.gen(function* () {
+        yield* legacyMigrationRepair(input({ versions: [], status: "reverted" }));
+        expect(execs).toContain("TRUNCATE supabase_migrations.schema_migrations");
+        expect(queries.some((q) => q.sql.includes("ON CONFLICT"))).toBe(false);
+        expect(queries.some((q) => q.sql.includes("WHERE version = ANY"))).toBe(false);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("repair-all cancels on a declined prompt", () => {
+    seedMigration(tmp.current, "20240101000000_init.sql", "create table a;\n");
+    const { layer, execs } = setup(tmp.current, { confirm: false });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationRepair(input({ versions: [], status: "applied" })).pipe(
+        Effect.exit,
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyOperationCanceledError");
+      }
+      expect(execs).not.toContain("TRUNCATE supabase_migrations.schema_migrations");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("repair-all without a TTY and no piped answer falls back to NO (cancel)", () => {
+    // Go reads stdin regardless of TTY (IsTTY only changes the timeout, console.go:38-61);
+    // with no piped answer the empty read falls back to the default (NO) → cancel.
+    const { layer, out } = setup(tmp.current, { isTTY: false });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationRepair(input({ versions: [], status: "applied" })).pipe(
+        Effect.exit,
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyOperationCanceledError");
+      }
+      expect(out.promptConfirmCalls.length).toBe(0);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("repair-all honors a piped 'y' answer without a TTY (proceeds)", () => {
+    // Go's PromptYesNo reads piped stdin even when non-interactive; a piped `y` overrides
+    // the default NO, so repair-all truncates and reapplies (console.go:64-82).
+    seedMigration(tmp.current, "20240101000000_init.sql", "create table a;\n");
+    const { layer, execs, queries } = setup(tmp.current, { isTTY: false, pipedInput: "y\n" });
+    return Effect.gen(function* () {
+      yield* legacyMigrationRepair(input({ versions: [], status: "applied" }));
+      // Proceeded: repair-all truncates then upserts the local file.
+      expect(execs).toContain("TRUNCATE supabase_migrations.schema_migrations");
+      expect(queries.some((q) => q.sql.includes("ON CONFLICT"))).toBe(true);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("auto-confirms repair-all via SUPABASE_YES (no --yes flag)", () => {
+    // Go binds --yes to viper AutomaticEnv, so SUPABASE_YES=1 auto-confirms without --yes
+    // (root.go:318-334 → console.go PromptYesNo viper.GetBool("YES")).
+    const previous = process.env["SUPABASE_YES"];
+    process.env["SUPABASE_YES"] = "1";
+    seedMigration(tmp.current, "20240101000000_init.sql", "create table a;\n");
+    const { layer, execs, queries } = setup(tmp.current);
+    return Effect.gen(function* () {
+      yield* legacyMigrationRepair(input({ versions: [], status: "applied" }));
+      expect(execs).toContain("TRUNCATE supabase_migrations.schema_migrations");
+      expect(queries.some((q) => q.sql.includes("ON CONFLICT"))).toBe(true);
+    }).pipe(
+      Effect.provide(layer),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_YES"];
+          else process.env["SUPABASE_YES"] = previous;
+        }),
+      ),
+    );
+  });
+
+  it.live(
+    "auto-confirms repair-all via SUPABASE_YES in the project .env (Go loadNestedEnv)",
+    () => {
+      // SUPABASE_YES set only in supabase/.env (not the shell) — Go's loadNestedEnv loads it
+      // before the repair-all prompt, so it auto-confirms with no --yes flag and no stdin answer.
+      seedMigration(tmp.current, "20240101000000_init.sql", "create table a;\n");
+      writeFileSync(join(tmp.current, "supabase", ".env"), "SUPABASE_YES=true\n");
+      const { layer, execs, queries } = setup(tmp.current);
+      return Effect.gen(function* () {
+        yield* legacyMigrationRepair(input({ versions: [], status: "applied" }));
+        expect(execs).toContain("TRUNCATE supabase_migrations.schema_migrations");
+        expect(queries.some((q) => q.sql.includes("ON CONFLICT"))).toBe(true);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
+  it.live("surfaces a DB-config error before prompting (repair-all, unlinked)", () => {
+    const { layer, out } = setup(tmp.current, { failResolve: true });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationRepair(input({ versions: [], status: "applied" })).pipe(
+        Effect.exit,
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyProjectNotLinkedError");
+      }
+      // Go resolves the DB config in PersistentPreRunE before repair.Run prompts, so the
+      // config error surfaces immediately and the repair-all confirmation is never shown.
+      expect(out.promptConfirmCalls.length).toBe(0);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("prints the repaired, finished, and suggestion lines on success", () => {
+    seedMigration(tmp.current, "20240101000000_init.sql", "create table a;\n");
+    const { layer, out } = setup(tmp.current);
+    return Effect.gen(function* () {
+      yield* legacyMigrationRepair(input({ versions: ["20240101000000"], status: "applied" }));
+      const stderr = stripAnsi(out.stderrText);
+      const stdout = stripAnsi(out.stdoutText);
+      expect(stderr).toContain("Repaired migration history: [20240101000000] => applied");
+      expect(stdout).toContain("Finished supabase migration repair.");
+      expect(stderr).toContain(
+        "Run supabase migration list to show the updated migration history.",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("prints multiple repaired versions using Go's %v slice format", () => {
+    // Go prints the []string via `fmt.Fprintf(..., "%v", version)` (`repair.go:85`):
+    // space-separated, bracketed, NO commas. A `.join(", ")` "cleanup" reads more
+    // natural in TS but would silently break byte parity, so lock the format here.
+    seedMigration(tmp.current, "20240101000000_init.sql", "create table a;\n");
+    seedMigration(tmp.current, "20240102000000_more.sql", "create table b;\n");
+    const { layer, out } = setup(tmp.current);
+    return Effect.gen(function* () {
+      yield* legacyMigrationRepair(
+        input({ versions: ["20240101000000", "20240102000000"], status: "applied" }),
+      );
+      expect(stripAnsi(out.stderrText)).toContain(
+        "Repaired migration history: [20240101000000 20240102000000] => applied",
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports a missing local file in applied mode", () => {
+    const { layer } = setup(tmp.current); // no seeded file
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationRepair(
+        input({ versions: ["20240101000000"], status: "applied" }),
+      ).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe(
+          "LegacyMigrationFileNotFoundError",
+        );
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rolls back and reports an update failure", () => {
+    const { layer, execs } = setup(tmp.current, { failSql: "WHERE version = ANY" });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationRepair(
+        input({ versions: ["20240101000000"], status: "reverted" }),
+      ).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe(
+          "LegacyMigrationRepairUpdateError",
+        );
+      }
+      expect(execs).toContain("ROLLBACK");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects --db-url combined with --linked", () => {
+    const { layer } = setup(tmp.current, { args: ["--db-url", "postgresql://x", "--linked"] });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationRepair(
+        input({
+          versions: ["20240101000000"],
+          status: "applied",
+          dbUrl: Option.some("postgresql://x"),
+        }),
+      ).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe(
+          "LegacyMigrationTargetFlagsError",
+        );
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a structured result in json mode", () => {
+    const { layer, out } = setup(tmp.current, { format: "json" });
+    return Effect.gen(function* () {
+      yield* legacyMigrationRepair(input({ versions: ["20240101000000"], status: "reverted" }));
+      expect(out.messages).toContainEqual(
+        expect.objectContaining({
+          type: "success",
+          message: "Migration history repaired",
+          data: { versions: ["20240101000000"], status: "reverted", repairAll: false },
+        }),
+      );
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md b/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md
index f8c090e88c..e2a5f6fe4e 100644
--- a/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md
+++ b/apps/cli/src/legacy/commands/migration/up/SIDE_EFFECTS.md
@@ -21,9 +21,10 @@
 
 ## Environment Variables
 
-| Variable                | Purpose                        | Required?                                               |
-| ----------------------- | ------------------------------ | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token for `--linked` mode | no (falls back to keyring → `~/.supabase/access-token`) |
+| Variable                 | Purpose                                                                           | Required?                                               |
+| ------------------------ | --------------------------------------------------------------------------------- | ------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN`  | auth token for `--linked` mode                                                    | no (falls back to keyring → `~/.supabase/access-token`) |
+| `DOTENV_PRIVATE_KEY[_*]` | dotenvx private key(s) to decrypt `encrypted:` `[db.vault]` secrets before upsert | no (required only if a `[db.vault]` value is encrypted) |
 
 ## Exit Codes
 
@@ -37,15 +38,18 @@
 
 ### `--output-format text` (Go CLI compatible)
 
-Prints "Local database is up to date." on success (no pending migrations) or the applied migration filenames.
+Prints `Applying migration <file>...` to stderr per pending migration, then
+`Local database is up to date.` to stdout. Connects, lists remote + local
+migrations, computes the pending set, upserts `[db.vault]` secrets, and applies
+each pending migration transactionally. Does **not** seed (matches Go `up`).
 
 ### `--output-format json`
 
-Not applicable.
+Emits `output.success("Migrations applied", { applied: [<path>] })`.
 
 ### `--output-format stream-json`
 
-Not applicable.
+Same structured `applied` result delivered as an NDJSON `result` event.
 
 ## Notes
 
diff --git a/apps/cli/src/legacy/commands/migration/up/up.command.ts b/apps/cli/src/legacy/commands/migration/up/up.command.ts
index f4ecc55dd7..806c29ceb5 100644
--- a/apps/cli/src/legacy/commands/migration/up/up.command.ts
+++ b/apps/cli/src/legacy/commands/migration/up/up.command.ts
@@ -1,5 +1,9 @@
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
+import { legacyMigrationDbRuntimeLayer } from "../migration.layers.ts";
 import { legacyMigrationUp } from "./up.handler.ts";
 
 const config = {
@@ -17,6 +21,8 @@ const config = {
   ),
   local: Flag.boolean("local").pipe(
     Flag.withDescription("Applies pending migrations to the local database."),
+    // Go: `upFlags.Bool("local", true, …)`.
+    Flag.withDefault(true),
   ),
 } as const;
 
@@ -25,5 +31,18 @@ export type LegacyMigrationUpFlags = CliCommand.Command.Config.Infer<typeof conf
 export const legacyMigrationUpCommand = Command.make("up", config).pipe(
   Command.withDescription("Apply pending migrations to local database."),
   Command.withShortDescription("Apply pending migrations to local database"),
-  Command.withHandler((flags) => legacyMigrationUp(flags)),
+  Command.withHandler((flags) =>
+    legacyMigrationUp(flags).pipe(
+      withLegacyCommandInstrumentation({
+        flags: {
+          "include-all": flags.includeAll,
+          "db-url": flags.dbUrl,
+          linked: flags.linked,
+          local: flags.local,
+        },
+      }),
+      withJsonErrorHandling,
+    ),
+  ),
+  Command.provide(legacyMigrationDbRuntimeLayer(["migration", "up"])),
 );
diff --git a/apps/cli/src/legacy/commands/migration/up/up.errors.ts b/apps/cli/src/legacy/commands/migration/up/up.errors.ts
new file mode 100644
index 0000000000..683c2c8c25
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/up/up.errors.ts
@@ -0,0 +1,26 @@
+import { Data } from "effect";
+
+/**
+ * A remote migration version is not present in the local migrations directory.
+ * Byte-matches Go's `ErrMissingLocal` (`pkg/migration/apply.go:16`); the
+ * `migration repair --status reverted ...` suggestion is attached separately.
+ */
+export class LegacyMigrationMissingLocalError extends Data.TaggedError(
+  "LegacyMigrationMissingLocalError",
+)<{
+  readonly message: string;
+  readonly suggestion: string;
+}> {}
+
+/**
+ * Out-of-order local migrations exist before the last remote migration, and
+ * `--include-all` was not set. Byte-matches Go's `ErrMissingRemote`
+ * (`pkg/migration/apply.go:15`); the `--include-all` suggestion is attached
+ * separately.
+ */
+export class LegacyMigrationMissingRemoteError extends Data.TaggedError(
+  "LegacyMigrationMissingRemoteError",
+)<{
+  readonly message: string;
+  readonly suggestion: string;
+}> {}
diff --git a/apps/cli/src/legacy/commands/migration/up/up.handler.ts b/apps/cli/src/legacy/commands/migration/up/up.handler.ts
index 033bea8c8a..9a6327235f 100644
--- a/apps/cli/src/legacy/commands/migration/up/up.handler.ts
+++ b/apps/cli/src/legacy/commands/migration/up/up.handler.ts
@@ -1,15 +1,156 @@
-import { Effect, Option } from "effect";
-import { LegacyGoProxy } from "../../../../shared/legacy/go-proxy.service.ts";
+import { Effect, FileSystem, Option, Path } from "effect";
+
+import { LegacyDnsResolverFlag } from "../../../../shared/legacy/global-flags.ts";
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import { Output } from "../../../../shared/output/output.service.ts";
+import { LegacyCliConfig } from "../../../config/legacy-cli-config.service.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { legacyBold } from "../../../shared/legacy-colors.ts";
+import { legacyReadDbToml } from "../../../shared/legacy-db-config.toml-read.ts";
+import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
+import { LegacyDbConnection } from "../../../shared/legacy-db-connection.service.ts";
+import { resolveLegacyDbTargetFlags } from "../../../shared/legacy-db-target-flags.ts";
+import {
+  LegacyMigrationApplyError,
+  legacyApplyMigrationFile,
+} from "../../../shared/legacy-migration-apply.ts";
+import {
+  legacyFindPendingMigrations,
+  legacyListLocalMigrationPaths,
+  legacyListRemoteMigrations,
+} from "../../../shared/legacy-migration-history.ts";
+import { legacyUpsertVaultSecrets } from "../../../shared/legacy-vault.ts";
+import { LegacyLinkedProjectCache } from "../../../telemetry/legacy-linked-project-cache.service.ts";
+import { LegacyTelemetryState } from "../../../telemetry/legacy-telemetry-state.service.ts";
+import { LegacyMigrationTargetFlagsError } from "../migration.errors.ts";
 import type { LegacyMigrationUpFlags } from "./up.command.ts";
+import {
+  LegacyMigrationMissingLocalError,
+  LegacyMigrationMissingRemoteError,
+} from "./up.errors.ts";
+
+/** Go's `suggestRevertHistory` (`internal/migration/up/up.go:55`). */
+const suggestRevertHistory = (versions: ReadonlyArray<string>): string =>
+  "\nMake sure your local git repo is up-to-date. If the error persists, try repairing the migration history table:\n" +
+  `${legacyBold(`supabase migration repair --status reverted ${versions.join(" ")}`)}\n` +
+  "\nAnd update local migrations to match remote database:\n" +
+  `${legacyBold("supabase db pull")}\n`;
+
+/** Go's `suggestIgnoreFlag` (`internal/migration/up/up.go:63`). */
+const suggestIgnoreFlag = (paths: ReadonlyArray<string>): string =>
+  "\nRerun the command with --include-all flag to apply these migrations:\n" +
+  `${legacyBold(paths.join("\n"))}\n`;
+
+const runUp = Effect.fnUntraced(function* (
+  flags: LegacyMigrationUpFlags,
+  target: ReturnType<typeof resolveLegacyDbTargetFlags>,
+) {
+  const output = yield* Output;
+  const resolver = yield* LegacyDbConfigResolver;
+  const connection = yield* LegacyDbConnection;
+  const cliConfig = yield* LegacyCliConfig;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const dnsResolver = yield* LegacyDnsResolverFlag;
+
+  if (target.setFlags.length > 1) {
+    return yield* Effect.fail(
+      new LegacyMigrationTargetFlagsError({
+        message: `if any flags in the group [db-url linked local] are set none of the others can be; [${target.setFlags.join(" ")}] were all set`,
+      }),
+    );
+  }
+
+  const migrationsDir = path.join(cliConfig.workdir, "supabase", "migrations");
+
+  const upBody = Effect.gen(function* () {
+    // up defaults to `--local` (Go: `Bool("local", true)`).
+    const cfg = yield* resolver.resolve({
+      dbUrl: flags.dbUrl,
+      connType: target.connType ?? "local",
+      dnsResolver,
+    });
+    const ref = Option.getOrUndefined(cfg.ref ?? Option.none());
+    const toml = yield* legacyReadDbToml(fs, path, cliConfig.workdir, ref);
+
+    yield* Effect.scoped(
+      Effect.gen(function* () {
+        // Go's `utils.ConnectByConfig` prints this to stderr before dialing
+        // (`internal/utils/connect.go:343-348`), local/remote per `IsLocalDatabase`.
+        yield* output.raw(
+          `Connecting to ${cfg.isLocal ? "local" : "remote"} database...\n`,
+          "stderr",
+        );
+        const session = yield* connection.connect(cfg.conn, {
+          isLocal: cfg.isLocal,
+          dnsResolver,
+        });
+
+        const remote = yield* legacyListRemoteMigrations(session);
+        const local = yield* legacyListLocalMigrationPaths(fs, path, migrationsDir);
+        const result = legacyFindPendingMigrations(local, remote);
+
+        let pending: ReadonlyArray<string>;
+        if (result.kind === "missing-local") {
+          return yield* Effect.fail(
+            new LegacyMigrationMissingLocalError({
+              message: "Remote migration versions not found in local migrations directory.",
+              suggestion: suggestRevertHistory(result.versions),
+            }),
+          );
+        } else if (result.kind === "missing-remote") {
+          if (!flags.includeAll) {
+            return yield* Effect.fail(
+              new LegacyMigrationMissingRemoteError({
+                message:
+                  "Found local migration files to be inserted before the last migration on remote database.",
+                suggestion: suggestIgnoreFlag(result.paths),
+              }),
+            );
+          }
+          // Go's `--include-all`: the out-of-order set + everything after the
+          // applied prefix (`up.go:47`).
+          pending = [...result.paths, ...local.slice(remote.length + result.paths.length)];
+        } else {
+          pending = result.paths;
+        }
+
+        yield* legacyUpsertVaultSecrets(session, toml.vault);
+
+        for (const migrationPath of pending) {
+          yield* output.raw(`Applying migration ${path.basename(migrationPath)}...\n`, "stderr");
+          yield* legacyApplyMigrationFile(
+            session,
+            fs,
+            path,
+            migrationPath,
+            (message) => new LegacyMigrationApplyError({ message }),
+          );
+        }
+
+        if (output.format === "text") {
+          yield* output.raw("Local database is up to date.\n");
+        } else {
+          yield* output.success("Migrations applied", { applied: pending });
+        }
+      }),
+    );
+  });
+
+  if ((target.connType ?? "local") === "linked") {
+    const projectRef = yield* LegacyProjectRefResolver;
+    const linkedProjectCache = yield* LegacyLinkedProjectCache;
+    const linkedRef = yield* projectRef.loadProjectRef(Option.none());
+    return yield* upBody.pipe(Effect.ensuring(linkedProjectCache.cache(linkedRef)));
+  }
+  return yield* upBody;
+});
 
 export const legacyMigrationUp = Effect.fn("legacy.migration.up")(function* (
   flags: LegacyMigrationUpFlags,
 ) {
-  const proxy = yield* LegacyGoProxy;
-  const args: string[] = ["migration", "up"];
-  if (flags.includeAll) args.push("--include-all");
-  if (Option.isSome(flags.dbUrl)) args.push("--db-url", flags.dbUrl.value);
-  if (flags.linked) args.push("--linked");
-  if (flags.local) args.push("--local");
-  yield* proxy.exec(args);
+  const telemetryState = yield* LegacyTelemetryState;
+  const cliArgs = yield* CliArgs;
+  const target = resolveLegacyDbTargetFlags(cliArgs.args);
+  yield* runUp(flags, target).pipe(Effect.ensuring(telemetryState.flush));
 });
diff --git a/apps/cli/src/legacy/commands/migration/up/up.integration.test.ts b/apps/cli/src/legacy/commands/migration/up/up.integration.test.ts
new file mode 100644
index 0000000000..733b83cdf1
--- /dev/null
+++ b/apps/cli/src/legacy/commands/migration/up/up.integration.test.ts
@@ -0,0 +1,296 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Cause, Effect, Exit, Layer, Option } from "effect";
+
+import {
+  LEGACY_VALID_REF,
+  mockLegacyCliConfig,
+  mockLegacyLinkedProjectCacheTracked,
+  mockLegacyTelemetryStateTracked,
+  useLegacyTempWorkdir,
+} from "../../../../../tests/helpers/legacy-mocks.ts";
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import { LegacyDnsResolverFlag } from "../../../../shared/legacy/global-flags.ts";
+import type { OutputFormat } from "../../../../shared/output/types.ts";
+import { LegacyProjectRefResolver } from "../../../config/legacy-project-ref.service.ts";
+import { LegacyDbConfigResolver } from "../../../shared/legacy-db-config.service.ts";
+import type {
+  LegacyDbConfigFlags,
+  LegacyResolvedDbConfig,
+} from "../../../shared/legacy-db-config.types.ts";
+import { LegacyDbExecError } from "../../../shared/legacy-db-connection.errors.ts";
+import { LegacyDbConnection } from "../../../shared/legacy-db-connection.service.ts";
+import { LegacyMigrationVaultError } from "../../../shared/legacy-vault.ts";
+import { legacyMigrationUp } from "./up.handler.ts";
+import type { LegacyMigrationUpFlags } from "./up.command.ts";
+
+const LIST_SQL = "SELECT version FROM supabase_migrations.schema_migrations ORDER BY version";
+const READ_VAULT = "SELECT id, name FROM vault.secrets WHERE name = ANY($1)";
+
+interface SetupOpts {
+  readonly format?: OutputFormat;
+  readonly args?: ReadonlyArray<string>;
+  readonly remote?: ReadonlyArray<string>;
+  readonly failApply?: boolean;
+  readonly failVault?: boolean;
+  readonly config?: string;
+  readonly existingVault?: ReadonlyArray<{ id: string; name: string }>;
+}
+
+function setup(workdir: string, opts: SetupOpts = {}) {
+  if (opts.config !== undefined) {
+    mkdirSync(join(workdir, "supabase"), { recursive: true });
+    writeFileSync(join(workdir, "supabase", "config.toml"), opts.config);
+  }
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const telemetry = mockLegacyTelemetryStateTracked();
+  const cache = mockLegacyLinkedProjectCacheTracked();
+  const execs: Array<string> = [];
+  const queries: Array<{ sql: string; params?: ReadonlyArray<unknown> }> = [];
+
+  const resolver = Layer.succeed(LegacyDbConfigResolver, {
+    resolve: (_flags: LegacyDbConfigFlags) =>
+      Effect.succeed({
+        conn: {
+          host: "127.0.0.1",
+          port: 54322,
+          user: "postgres",
+          password: "x",
+          database: "postgres",
+        },
+        isLocal: true,
+        ref: Option.none(),
+      } satisfies LegacyResolvedDbConfig),
+    resolvePoolerFallback: () => Effect.succeed(Option.none()),
+  });
+
+  const connection = Layer.succeed(LegacyDbConnection, {
+    connect: () =>
+      Effect.succeed({
+        exec: (sql: string) =>
+          Effect.suspend(() => {
+            execs.push(sql);
+            return opts.failApply === true && sql.startsWith("create table boom")
+              ? Effect.fail(new LegacyDbExecError({ message: "syntax error" }))
+              : Effect.void;
+          }),
+        query: (sql: string, params?: ReadonlyArray<unknown>) =>
+          Effect.suspend(() => {
+            queries.push({ sql, params });
+            if (opts.failVault === true && sql === READ_VAULT)
+              return Effect.fail(new LegacyDbExecError({ message: "boom" }));
+            if (sql === LIST_SQL)
+              return Effect.succeed((opts.remote ?? []).map((version) => ({ version })));
+            if (sql === READ_VAULT)
+              return Effect.succeed<ReadonlyArray<Record<string, unknown>>>([
+                ...(opts.existingVault ?? []),
+              ]);
+            return Effect.succeed<ReadonlyArray<Record<string, unknown>>>([]);
+          }),
+        extensionExists: () => Effect.succeed(false),
+        copyToCsv: () => Effect.succeed(new Uint8Array()),
+        queryRaw: () => Effect.succeed({ fields: [], rows: [], commandTag: "" }),
+      }),
+  });
+
+  const projectRef = Layer.succeed(LegacyProjectRefResolver, {
+    resolve: () => Effect.succeed(LEGACY_VALID_REF),
+    resolveForLink: () => Effect.succeed(LEGACY_VALID_REF),
+    resolveOptional: () => Effect.succeed(Option.some(LEGACY_VALID_REF)),
+    loadProjectRef: () => Effect.succeed(LEGACY_VALID_REF),
+    promptProjectRef: () => Effect.succeed(LEGACY_VALID_REF),
+  });
+
+  const layer = Layer.mergeAll(
+    out.layer,
+    telemetry.layer,
+    cache.layer,
+    resolver,
+    connection,
+    projectRef,
+    mockLegacyCliConfig({ workdir }),
+    Layer.succeed(LegacyDnsResolverFlag, "native"),
+    Layer.succeed(CliArgs, { args: opts.args ?? [] }),
+    BunServices.layer,
+  );
+  return { layer, out, telemetry, execs, queries };
+}
+
+const flags = (over: Partial<LegacyMigrationUpFlags> = {}): LegacyMigrationUpFlags => ({
+  includeAll: over.includeAll ?? false,
+  dbUrl: over.dbUrl ?? Option.none(),
+  linked: over.linked ?? false,
+  local: over.local ?? true,
+});
+
+// eslint-disable-next-line no-control-regex
+const stripAnsi = (text: string) => text.replace(/\x1b\[[0-9;]*m/gu, "");
+const seed = (workdir: string, name: string, body = "create table a;\n") => {
+  const dir = join(workdir, "supabase", "migrations");
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, name), body);
+};
+const insertedVersions = (queries: Array<{ sql: string; params?: ReadonlyArray<unknown> }>) =>
+  queries
+    .filter((q) => q.sql.includes("INSERT INTO supabase_migrations"))
+    .map((q) => q.params?.[0]);
+
+const tmp = useLegacyTempWorkdir();
+
+describe("legacy migration up", () => {
+  it.live("applies pending migrations in order and prints progress", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    seed(tmp.current, "20240102000000_b.sql");
+    seed(tmp.current, "20240103000000_c.sql");
+    const { layer, out, queries } = setup(tmp.current, { remote: ["20240101000000"] });
+    return Effect.gen(function* () {
+      yield* legacyMigrationUp(flags());
+      const stderr = stripAnsi(out.stderrText);
+      const stdout = stripAnsi(out.stdoutText);
+      // Go prints the connection banner to stderr before dialing (connect.go:343-348).
+      expect(stderr).toContain("Connecting to local database...");
+      expect(stderr).toContain("Applying migration 20240102000000_b.sql...");
+      expect(stderr).toContain("Applying migration 20240103000000_c.sql...");
+      expect(stdout).toContain("Local database is up to date.");
+      // Lock Go's channel split: "Applying ..." is stderr (`fmt.Fprintf(os.Stderr, ...)`)
+      // and the final "up to date" is stdout (`fmt.Println`) — neither bleeds across.
+      expect(stdout).not.toContain("Applying migration");
+      expect(stderr).not.toContain("Local database is up to date.");
+      expect(insertedVersions(queries)).toEqual(["20240102000000", "20240103000000"]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("errors with a revert suggestion when a remote version is missing locally", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    const { layer } = setup(tmp.current, { remote: ["20240101000000", "20240199000000"] });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationUp(flags()).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe(
+          "LegacyMigrationMissingLocalError",
+        );
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("errors with an --include-all suggestion on an out-of-order local migration", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    seed(tmp.current, "20240102000000_b.sql");
+    const { layer } = setup(tmp.current, { remote: ["20240102000000"] });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationUp(flags()).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe(
+          "LegacyMigrationMissingRemoteError",
+        );
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("applies out-of-order migrations with --include-all in the right order", () => {
+    seed(tmp.current, "20240101000000_a.sql"); // out-of-order (before applied 02)
+    seed(tmp.current, "20240102000000_b.sql"); // already applied on remote
+    seed(tmp.current, "20240103000000_c.sql"); // trailing pending
+    const { layer, queries } = setup(tmp.current, { remote: ["20240102000000"] });
+    return Effect.gen(function* () {
+      yield* legacyMigrationUp(flags({ includeAll: true }));
+      // Go appends the trailing pending set after the out-of-order set.
+      expect(insertedVersions(queries)).toEqual(["20240101000000", "20240103000000"]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("creates a new [db.vault] secret before applying migrations", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    const { layer, out, queries } = setup(tmp.current, {
+      remote: [],
+      config: '[db.vault]\nmy_secret = "shhh"\n',
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationUp(flags());
+      expect(stripAnsi(out.stderrText)).toContain("Updating vault secrets...");
+      const create = queries.find((q) => q.sql.includes("create_secret"));
+      expect(create?.params).toEqual(["shhh", "my_secret"]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("reports a vault upsert failure", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    const { layer } = setup(tmp.current, {
+      remote: [],
+      config: '[db.vault]\nmy_secret = "shhh"\n',
+      failVault: true,
+    });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationUp(flags()).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value instanceof LegacyMigrationVaultError).toBe(
+          true,
+        );
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("updates an existing [db.vault] secret by id", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    const { layer, queries } = setup(tmp.current, {
+      remote: [],
+      config: '[db.vault]\nmy_secret = "shhh"\n',
+      existingVault: [{ id: "vault-id-1", name: "my_secret" }],
+    });
+    return Effect.gen(function* () {
+      yield* legacyMigrationUp(flags());
+      const update = queries.find((q) => q.sql.includes("update_secret"));
+      expect(update?.params).toEqual(["vault-id-1", "shhh"]);
+      expect(queries.some((q) => q.sql.includes("create_secret"))).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("rejects --db-url combined with --linked", () => {
+    const { layer } = setup(tmp.current, { args: ["--db-url", "postgresql://x", "--linked"] });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationUp(
+        flags({ dbUrl: Option.some("postgresql://x"), linked: true, local: false }),
+      ).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe(
+          "LegacyMigrationTargetFlagsError",
+        );
+      }
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("emits a structured result in json", () => {
+    seed(tmp.current, "20240101000000_a.sql");
+    const { layer, out } = setup(tmp.current, { format: "json", remote: [] });
+    return Effect.gen(function* () {
+      yield* legacyMigrationUp(flags());
+      expect(out.messages).toContainEqual(
+        expect.objectContaining({ type: "success", message: "Migrations applied" }),
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("surfaces an apply failure", () => {
+    seed(tmp.current, "20240101000000_a.sql", "create table boom;\n");
+    const { layer } = setup(tmp.current, { remote: [], failApply: true });
+    return Effect.gen(function* () {
+      const exit = yield* legacyMigrationUp(flags()).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure) && failure.value._tag).toBe("LegacyMigrationApplyError");
+      }
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-db-config.toml-read.ts b/apps/cli/src/legacy/shared/legacy-db-config.toml-read.ts
index ed0e1fe7f7..ac8e8e573a 100644
--- a/apps/cli/src/legacy/shared/legacy-db-config.toml-read.ts
+++ b/apps/cli/src/legacy/shared/legacy-db-config.toml-read.ts
@@ -2,6 +2,11 @@ import { Effect, type FileSystem, Option, type Path } from "effect";
 import * as SmolToml from "smol-toml";
 import { LegacyDbConfigLoadError } from "./legacy-db-config.errors.ts";
 import { parseDotEnv } from "./legacy-dotenv.ts";
+import {
+  legacyCollectDotenvPrivateKeys,
+  legacyDecryptSecret,
+  legacyIsEncryptedSecret,
+} from "./legacy-vault-decrypt.ts";
 
 /** Resolves a config `env(VAR)` reference: shell env first, then project `.env`. */
 type EnvLookup = (name: string) => string | undefined;
@@ -66,6 +71,33 @@ interface LegacyDbTomlValues {
    * these must self-invalidate cached catalogs.
    */
   readonly baseline: LegacyBaselineTomlConfig;
+  /** `[db.migrations] enabled` (default true) — gates `up`/`down` migration apply. */
+  readonly migrationsEnabled: boolean;
+  /** `[db.seed]` enabled + supabase-prefixed `sql_paths` globs — used by `down`. */
+  readonly seed: LegacyDbSeedTomlConfig;
+  /** `[db.vault]` secrets (name → resolved value) — upserted by `up`/`down`. */
+  readonly vault: ReadonlyArray<LegacyDbVaultSecretToml>;
+}
+
+/** `[db.seed]` config surfaced for `migration down`'s seed step. */
+interface LegacyDbSeedTomlConfig {
+  readonly enabled: boolean;
+  /** Glob patterns, each supabase-prefixed when relative (Go's `config.resolve`). */
+  readonly sqlPaths: ReadonlyArray<string>;
+}
+
+/**
+ * A `[db.vault]` secret. `value` is the resolved plaintext: env-expanded and, for
+ * a dotenvx `encrypted:` ciphertext, decrypted. `resolved` mirrors Go's
+ * `len(SHA256) > 0` gate (true once the value resolved to a non-empty, non-`env(...)`
+ * string — including a successful decrypt). The HMAC itself is not reproduced;
+ * `UpsertVaultSecrets` only uses it as a resolved/unresolved flag, and `resolved`
+ * stands in for it.
+ */
+interface LegacyDbVaultSecretToml {
+  readonly name: string;
+  readonly value: string;
+  readonly resolved: boolean;
 }
 
 /** Cache-key inputs from `[auth]`/`[storage]`/`[realtime]`/`[api]`/`[db.vault]`. */
@@ -146,27 +178,137 @@ function deepMergeDoc(base: RawDoc, override: RawDoc): RawDoc {
  * config (Go's `config.Load`, `config.go:503-518` + `mergeRemoteConfig`). The block
  * key name is only used for diagnostics in Go; the match is on `project_id`.
  */
+interface LegacyRemoteOverride {
+  readonly doc: RawDoc | undefined;
+  /**
+   * The config keys the matched remote block contributed at viper's OVERRIDE tier. Go's
+   * `mergeRemoteConfig` applies every block key via `v.Set(...)` after `AutomaticEnv`
+   * (`config.go:635-640`), and `v.Set` sits ABOVE `AutomaticEnv` (`viper.go:1167-1174` vs
+   * `:1226-1237`), so each explicitly-set remote key — plus the forced `db.seed.enabled`
+   * default Go injects when the block omits it — must outrank the matching `SUPABASE_*`
+   * env override (a plain TOML value elsewhere is still env-overridable). Holds every key in
+   * `LEGACY_ENV_OVERRIDABLE_KEYS` the matched block supplies, plus `db.seed.enabled` (always).
+   */
+  readonly remoteOverrideKeys: ReadonlySet<string>;
+}
+
+/**
+ * The `project_id` of a `[remotes.<name>]` block as Go's in-load matching/dedup loop sees
+ * it: `v.GetString("remotes.<name>.project_id")` (`config.go:510`). Viper's `AutomaticEnv`
+ * binds that key to `SUPABASE_REMOTES_<NAME>_PROJECT_ID` (`SetEnvPrefix("SUPABASE")` +
+ * `EnvKeyReplacer(".","_")`, `config.go:494-498`), so a non-empty env value wins OUTRIGHT;
+ * an empty env value is dropped (`AllowEmptyEnv=false`; godotenv never overrides an empty
+ * shell var), falling back to the RAW TOML literal. `GetString` does NOT run mapstructure's
+ * `LoadEnvHook`, so a TOML `env(...)` form is NOT expanded for block selection or duplicate
+ * detection — that hook only fires during `UnmarshalExact` (`config.go:661-666`), after this
+ * loop. Validation reads the decoded (expanded) field instead — see
+ * `legacyResolveValidatedRemoteProjectId`.
+ */
+function legacyResolveRemoteProjectId(
+  name: string,
+  block: RawDoc | undefined,
+  lookup: EnvLookup,
+): string | undefined {
+  const fromEnv = lookup(`SUPABASE_REMOTES_${name.toUpperCase()}_PROJECT_ID`);
+  if (fromEnv !== undefined && fromEnv.length > 0) return fromEnv;
+  const literal = block?.["project_id"];
+  return typeof literal === "string" ? literal : undefined;
+}
+
+/**
+ * The `project_id` of a `[remotes.<name>]` block as Go's `config.Validate` sees it: the
+ * DECODED struct field `remote.ProjectId` (`config.go:909-913`), which has already passed
+ * through `LoadEnvHook` — so a TOML `env(...)` literal IS expanded here (an unset `env(...)`
+ * stays literal and fails the ref pattern). The `SUPABASE_REMOTES_<NAME>_PROJECT_ID` env
+ * override still wins when non-empty, matching viper precedence in both `GetString` and
+ * `UnmarshalExact`.
+ */
+function legacyResolveValidatedRemoteProjectId(
+  name: string,
+  block: RawDoc | undefined,
+  lookup: EnvLookup,
+): string | undefined {
+  const fromEnv = lookup(`SUPABASE_REMOTES_${name.toUpperCase()}_PROJECT_ID`);
+  if (fromEnv !== undefined && fromEnv.length > 0) return fromEnv;
+  const literal = block?.["project_id"];
+  return typeof literal === "string" ? legacyExpandEnv(literal, lookup) : undefined;
+}
+
+/**
+ * Every dotted config key this reader resolves with a `SUPABASE_*` AutomaticEnv override.
+ * When a matched `[remotes.*]` block supplies any of these, Go's `mergeRemoteConfig` flattens
+ * the whole block via `u.AllKeys()` and applies each leaf with `v.Set` (override tier, above
+ * `AutomaticEnv` — `config.go:635-637`), so the block value must beat the env override.
+ */
+const LEGACY_ENV_OVERRIDABLE_KEYS: ReadonlyArray<string> = [
+  "db.port",
+  "db.shadow_port",
+  "db.major_version",
+  "db.migrations.enabled",
+  "db.seed.enabled",
+  "db.seed.sql_paths",
+  "edge_runtime.deno_version",
+  "experimental.pgdelta.enabled",
+  "experimental.pgdelta.declarative_schema_path",
+  "experimental.pgdelta.format_options",
+  "api.auto_expose_new_tables",
+  "analytics.enabled",
+  "analytics.backend",
+  "analytics.gcp_project_id",
+  "analytics.gcp_project_number",
+  "analytics.gcp_jwt_path",
+];
+
+/** Whether `block` provides a value at the dotted `key` path (scalar, array, or sub-table). */
+function legacyBlockProvidesKey(block: RawDoc, key: string): boolean {
+  let current: unknown = block;
+  for (const segment of key.split(".")) {
+    const record = asRecord(current);
+    if (record === undefined) return false;
+    current = record[segment];
+  }
+  return current !== undefined;
+}
+
 function applyRemoteOverride(
   doc: RawDoc | undefined,
   ref: string,
   lookup: EnvLookup,
-): RawDoc | undefined {
+): LegacyRemoteOverride {
   const remotes = asRecord(doc?.["remotes"]);
-  if (doc === undefined || remotes === undefined) return doc;
+  if (doc === undefined || remotes === undefined) return { doc, remoteOverrideKeys: new Set() };
   for (const name of Object.keys(remotes)) {
     const block = asRecord(remotes[name]);
     if (block === undefined) continue;
-    // Go decodes the remote `project_id` through `LoadEnvHook` before matching it
-    // against the resolved ref (`config.go:503-518`), so an `env(VAR)` block id is
-    // compared by its expanded value.
-    if (
-      typeof block["project_id"] === "string" &&
-      legacyExpandEnv(block["project_id"], lookup) === ref
-    ) {
-      return deepMergeDoc(doc, block);
+    // Match on the project_id Go's `v.GetString` returns (env override > RAW TOML literal,
+    // no `env(...)` expansion — `config.go:510`), so a block whose id comes from
+    // `SUPABASE_REMOTES_<NAME>_PROJECT_ID` still merges while a TOML `env(...)` literal does
+    // not (Go selects blocks before the decode hook expands it).
+    if (legacyResolveRemoteProjectId(name, block, lookup) === ref) {
+      const merged = deepMergeDoc(doc, block);
+      const blockSeed = asRecord(asRecord(block["db"])?.["seed"]);
+      // Go's `mergeRemoteConfig` flattens the WHOLE matched block via `u.AllKeys()` and applies
+      // every leaf with `v.Set` (override tier, above `AutomaticEnv` — `config.go:635-637`).
+      // Record every env-overridable key the block supplies — not just migrations/seed — so the
+      // resolution below suppresses their `SUPABASE_*` value.
+      const remoteOverrideKeys = new Set<string>();
+      for (const key of LEGACY_ENV_OVERRIDABLE_KEYS) {
+        if (legacyBlockProvidesKey(block, key)) remoteOverrideKeys.add(key);
+      }
+      // `db.seed.enabled` is ALWAYS override-tier for a matched block: either the block set
+      // it, or Go's `mergeRemoteConfig` forces it `false` when omitted (`config.go:638-640`)
+      // — so env never overrides it on a matched-remote linked run.
+      remoteOverrideKeys.add("db.seed.enabled");
+      if (blockSeed?.["enabled"] === undefined) {
+        return {
+          doc: deepMergeDoc(merged, { db: { seed: { enabled: false } } }),
+          remoteOverrideKeys,
+        };
+      }
+      return { doc: merged, remoteOverrideKeys };
     }
   }
-  return doc;
+  return { doc, remoteOverrideKeys: new Set() };
 }
 
 /**
@@ -183,12 +325,9 @@ function findDuplicateRemoteProjectId(
   const seen = new Map<string, string>();
   for (const name of Object.keys(remotes)) {
     const block = asRecord(remotes[name]);
-    // Go decodes each remote `project_id` through `LoadEnvHook` before the
-    // duplicate check (`config.go:506-511`), so dedupe on the expanded value.
-    const projectId =
-      block !== undefined && typeof block["project_id"] === "string"
-        ? legacyExpandEnv(block["project_id"], lookup)
-        : undefined;
+    // Dedupe on the project_id Go's `v.GetString` returns (env override > RAW TOML literal,
+    // no `env(...)` expansion), matching Go's duplicate check (`config.go:506-511`).
+    const projectId = legacyResolveRemoteProjectId(name, block, lookup);
     if (projectId === undefined) continue;
     const prior = seen.get(projectId);
     if (prior !== undefined) return { name, other: prior };
@@ -228,13 +367,11 @@ function findInvalidRemoteProjectId(
   if (remotes === undefined) return undefined;
   for (const name of Object.keys(remotes)) {
     const block = asRecord(remotes[name]);
-    const rawProjectId = block !== undefined ? block["project_id"] : undefined;
-    // Go expands `env(VAR)` via `LoadEnvHook` before `Validate` checks the ref
-    // pattern (`config.go:832-836`), so an env-backed `project_id` is validated by
-    // its resolved value. An unset/empty expansion still fails (Go's `refPattern`
-    // rejects the literal `env(...)` / empty string).
-    const projectId =
-      typeof rawProjectId === "string" ? legacyExpandEnv(rawProjectId, lookup) : rawProjectId;
+    // Validate the DECODED project_id (env override > env-expanded TOML literal), matching
+    // Go's `Validate` over the decoded `remote.ProjectId` field (`config.go:909-913`), which
+    // passed through `LoadEnvHook`. An unset `env(...)` stays literal and still fails Go's
+    // ref pattern. (Block matching/dedup above use the RAW literal — Go's `v.GetString`.)
+    const projectId = legacyResolveValidatedRemoteProjectId(name, block, lookup);
     if (typeof projectId !== "string" || !LEGACY_PROJECT_REF_PATTERN.test(projectId)) {
       return name;
     }
@@ -316,6 +453,29 @@ function resolveConfigInt(value: unknown, lookup: EnvLookup): number | "absent"
   return "invalid";
 }
 
+/**
+ * Replicates Go's `path.Join("supabase", pattern)` for a relative seed `sql_paths`
+ * entry (`pkg/config/config.go:881-886`). Go's `path.Join` runs `path.Clean`, which
+ * collapses `.`/`..` segments (`../seed.sql` → `seed.sql`, `sub/../seed.sql` →
+ * `supabase/seed.sql`, `../../x.sql` → `../x.sql`). The cleaned path is the
+ * `seed_files` hash key, so a non-collapsed key would miss Go's record and re-run/
+ * re-record the seed on a cross-CLI switch. Forward-slash only (Go uses `path.Join`,
+ * not the platform `filepath.Join`).
+ */
+function legacyJoinSupabaseSeedPath(pattern: string): string {
+  const out: Array<string> = [];
+  for (const segment of `supabase/${pattern}`.split("/")) {
+    if (segment === "" || segment === ".") continue;
+    if (segment === "..") {
+      if (out.length > 0 && out[out.length - 1] !== "..") out.pop();
+      else out.push("..");
+    } else {
+      out.push(segment);
+    }
+  }
+  return out.length === 0 ? "." : out.join("/");
+}
+
 /** `[db]` ports default through the development env unless `SUPABASE_ENV` overrides. */
 const DEFAULT_SUPABASE_ENV = "development";
 
@@ -423,16 +583,39 @@ function resolveBool(value: unknown, fallback: boolean, lookup: EnvLookup): bool
     const parsed = legacyParseGoBool(legacyExpandEnv(value, lookup));
     return parsed ?? "invalid";
   }
+  // Go decodes a numeric config value into a bool via mapstructure's weakly-typed input:
+  // `value != 0` (mapstructure `decodeBool`; `getKind` collapses every int/uint/float
+  // width). A TOML number (`enabled = 0`) is therefore an explicit false, NOT absent — it
+  // must not fall through to the schema default.
+  if (typeof value === "number") return value !== 0;
   return fallback;
 }
 
-/** `resolveBool` that fails the config load on a malformed bool (Go's parse error). */
+/**
+ * `resolveBool` that fails the config load on a malformed bool (Go's parse error).
+ * `envValue` is the `SUPABASE_*` AutomaticEnv override (`pkg/config/config.go:494-498`):
+ * when set it wins over the TOML value/default, matching viper's env > config-file
+ * precedence (`envOverride` already drops empty values, like `AllowEmptyEnv=false`).
+ * The override is still a string-kind value decoded through `LoadEnvHook`, so an
+ * `env(VAR)` indirection (`SUPABASE_DB_SEED_ENABLED=env(SEED_ON)`) is expanded before
+ * the bool parse (`decode_hooks.go:15-26` runs ahead of the weak `ParseBool` decode).
+ */
 const resolveBoolOrFail = Effect.fnUntraced(function* (
   field: string,
   value: unknown,
   fallback: boolean,
   lookup: EnvLookup,
+  envValue?: string,
 ) {
+  if (envValue !== undefined) {
+    const parsed = legacyParseGoBool(legacyExpandEnv(envValue, lookup));
+    if (parsed === undefined) {
+      return yield* Effect.fail(
+        new LegacyDbConfigLoadError({ message: `failed to parse config: invalid ${field}.` }),
+      );
+    }
+    return parsed;
+  }
   const resolved = resolveBool(value, fallback, lookup);
   if (resolved === "invalid") {
     return yield* Effect.fail(
@@ -458,7 +641,7 @@ const resolveOptionalBoolOrFail = Effect.fnUntraced(function* (
   lookup: EnvLookup,
 ) {
   if (envValue !== undefined) {
-    const parsed = legacyParseGoBool(envValue);
+    const parsed = legacyParseGoBool(legacyExpandEnv(envValue, lookup));
     if (parsed === undefined) {
       return yield* Effect.fail(
         new LegacyDbConfigLoadError({ message: `failed to parse config: invalid ${field}.` }),
@@ -467,6 +650,8 @@ const resolveOptionalBoolOrFail = Effect.fnUntraced(function* (
     return Option.some(parsed);
   }
   if (typeof value === "boolean") return Option.some(value);
+  // Numeric `*bool` value decodes the same way under weak typing: `value != 0`.
+  if (typeof value === "number") return Option.some(value !== 0);
   if (typeof value === "string") {
     const parsed = legacyParseGoBool(legacyExpandEnv(value, lookup));
     if (parsed === undefined) {
@@ -479,6 +664,451 @@ const resolveOptionalBoolOrFail = Effect.fnUntraced(function* (
   return Option.none<boolean>();
 });
 
+/**
+ * Recursively asserts every `encrypted:` secret in the (merged) config can be decrypted,
+ * mirroring Go's global `DecryptSecretHookFunc` (`pkg/config/secret.go:77-109`,
+ * `config.go:730`), which decrypts every `config.Secret` field during `UnmarshalExact` and
+ * aborts the load with `failed to parse config: <error>` when one cannot be decrypted (e.g.
+ * no `DOTENV_PRIVATE_KEY`). The reader's `[db.vault]` walk only covered vault secrets, so
+ * non-vault `Secret` fields (`db.root_key`, `auth.external.<p>.secret`, smtp `pass`, …) were
+ * silently passed through. A recursive string scan tracks Go's "decode the entire config"
+ * behaviour and stays robust as new `Secret` fields are added. The unset-`env(...)` and
+ * plain-string forms are returned verbatim by Go's hook (no error), so they are no-ops here.
+ * Returns the failure (or `undefined`); the caller surfaces it via `Effect.fail`.
+ */
+const legacyAssertDecryptableSecrets = (
+  value: unknown,
+  lookup: EnvLookup,
+  dotenvPrivateKeys: ReadonlyArray<string>,
+): LegacyDbConfigLoadError | undefined => {
+  if (typeof value === "string") {
+    const expanded = legacyExpandEnv(value, lookup);
+    if (ENV_PATTERN.test(expanded) || !legacyIsEncryptedSecret(expanded)) return undefined;
+    const decrypted = legacyDecryptSecret(expanded, dotenvPrivateKeys);
+    return decrypted.ok
+      ? undefined
+      : new LegacyDbConfigLoadError({ message: `failed to parse config: ${decrypted.error}` });
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      const error = legacyAssertDecryptableSecrets(item, lookup, dotenvPrivateKeys);
+      if (error !== undefined) return error;
+    }
+    return undefined;
+  }
+  const record = asRecord(value);
+  if (record !== undefined) {
+    for (const key of Object.keys(record)) {
+      const error = legacyAssertDecryptableSecrets(record[key], lookup, dotenvPrivateKeys);
+      if (error !== undefined) return error;
+    }
+  }
+  return undefined;
+};
+
+// Go merges the template default before Validate (`templates/config.toml`), so an absent
+// `auth.site_url` is non-empty; only an explicit empty string fails A1 (`config.go:1037`).
+const DEFAULT_AUTH_SITE_URL = "http://127.0.0.1:3000";
+// Go's `hookSecretPattern` (`pkg/config/config.go:1436`).
+const LEGACY_HOOK_SECRET_PATTERN = /^v1,whsec_[A-Za-z0-9+/=]{32,88}$/u;
+// Go's `clerkDomainPattern` (`pkg/config/config.go:1553`).
+const LEGACY_CLERK_DOMAIN_PATTERN =
+  /^(clerk([.][a-z0-9-]+){2,}|([a-z0-9-]+[.])+clerk[.]accounts[.]dev)$/u;
+
+/**
+ * Ports the FATAL validations Go runs inside `if c.Auth.Enabled { … }` during
+ * `config.Validate` (`apps/cli-go/pkg/config/config.go:1036-1102` + the nested
+ * `.validate()` methods at 1242-1632), in Go's first-failure-wins order, so a db/migration
+ * command aborts on an invalid auth config exactly like the Go CLI (the reviewer's case:
+ * `migration down --local` must stop before any destructive work). Every check below mirrors
+ * a Go `return errors.New(...)` site with the byte-exact message.
+ *
+ * Deliberately NOT ported: the `assertEnvLoaded` WARN lines (Go's `config.go:1143-1148` only
+ * prints a stderr warning and always returns nil — never fatal), and the non-fatal mutations
+ * (the SMS "no provider → disable phone login" WARN, the linkedin/slack deprecation WARN);
+ * those affect neither the exit code nor any value this subset reader exposes. The
+ * linkedin/slack providers are still skipped (Go deletes them before validating).
+ */
+const legacyValidateAuthConfig = Effect.fnUntraced(function* (
+  authRaw: RawDoc,
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  workdir: string,
+  lookup: EnvLookup,
+) {
+  const fail = (message: string) => Effect.fail(new LegacyDbConfigLoadError({ message }));
+  const supabaseDir = path.join(workdir, "supabase");
+  // Env-expanded string of `rec[key]` ("" when absent/non-string). An unresolved `env(VAR)`
+  // stays literal (non-empty), matching Go's LoadEnvHook + the Secret decode hook.
+  const str = (rec: RawDoc | undefined, key: string): string => {
+    const value = rec?.[key];
+    return typeof value === "string" ? legacyExpandEnv(value, lookup) : "";
+  };
+  // Weak-bool decode (Go mapstructure): boolean | nonzero number | strconv.ParseBool string.
+  // A malformed string ABORTS the load like Go's decode (it does NOT coerce to false), using
+  // the reader's `failed to parse config: invalid <field>.` shape (the same simplification the
+  // db.* bools use; Go's verbose mapstructure string is not reproduced byte-for-byte there
+  // either). Absent / non-string → false (the default for every auth enable-flag).
+  const gate = (rec: RawDoc | undefined, key: string, field: string) =>
+    Effect.gen(function* () {
+      const value = rec?.[key];
+      if (typeof value === "boolean") return value;
+      if (typeof value === "number") return value !== 0;
+      if (typeof value !== "string") return false;
+      const parsed = legacyParseGoBool(legacyExpandEnv(value, lookup));
+      if (parsed === undefined) return yield* fail(`failed to parse config: invalid ${field}.`);
+      return parsed;
+    });
+  // Resolve a config file path: absolute → verbatim (Go opens it from the OS root after chdir);
+  // relative → joined under `base` (`filepath.IsAbs` guards, `config.go:854-878`).
+  const resolvePath = (p: string, base: string): string =>
+    path.isAbsolute(p) ? p : path.join(base, p);
+
+  // A1: site_url required (`config.go:1037-1039`).
+  const siteUrl =
+    authRaw["site_url"] === undefined ? DEFAULT_AUTH_SITE_URL : str(authRaw, "site_url");
+  if (siteUrl.length === 0) return yield* fail("Missing required field in config: auth.site_url");
+
+  // A4: [auth.captcha]. The provider enum is a decode-time check (`CaptchaProvider.UnmarshalText`,
+  // `auth.go:58-71`) that fires whenever `provider` is set, regardless of `enabled`; the
+  // required-field checks run only when enabled (`config.go:1048-1058`).
+  const captcha = asRecord(authRaw["captcha"]);
+  if (captcha !== undefined) {
+    const provider = str(captcha, "provider");
+    if (provider.length > 0 && provider !== "hcaptcha" && provider !== "turnstile")
+      return yield* fail(
+        "failed to parse config: decoding failed due to the following error(s):\n\n'auth.captcha.provider' must be one of [hcaptcha turnstile]",
+      );
+    if (yield* gate(captcha, "enabled", "auth.captcha.enabled")) {
+      if (provider.length === 0)
+        return yield* fail("Missing required field in config: auth.captcha.provider");
+      if (str(captcha, "secret").length === 0)
+        return yield* fail("Missing required field in config: auth.captcha.secret");
+    }
+  }
+
+  // A5: signing keys file load (`config.go:1059-1065`) — read + parse as a JSON array. A
+  // relative path resolves under the supabase dir (`config.go:877-878`); absolute is verbatim.
+  const signingKeysPath = str(authRaw, "signing_keys_path");
+  if (signingKeysPath.length > 0) {
+    const keysJson = yield* fs.readFileString(resolvePath(signingKeysPath, supabaseDir)).pipe(
+      Effect.mapError(
+        (cause) =>
+          new LegacyDbConfigLoadError({
+            message: `failed to read signing keys: ${cause.message}`,
+          }),
+      ),
+    );
+    yield* Effect.try({
+      try: () => {
+        const parsed: unknown = JSON.parse(keysJson);
+        if (!Array.isArray(parsed)) throw new Error("signing keys must be a JSON array of JWKs");
+        return parsed;
+      },
+      catch: (cause) =>
+        new LegacyDbConfigLoadError({
+          message: `failed to decode signing keys: ${cause instanceof Error ? cause.message : String(cause)}`,
+        }),
+    });
+  }
+
+  // A6: passkey/webauthn when passkey enabled (`config.go:1066-1084`).
+  const passkey = asRecord(authRaw["passkey"]);
+  if (passkey !== undefined && (yield* gate(passkey, "enabled", "auth.passkey.enabled"))) {
+    const webauthn = asRecord(authRaw["webauthn"]);
+    if (webauthn === undefined)
+      return yield* fail(
+        "Missing required config section: auth.webauthn (required when auth.passkey.enabled is true)",
+      );
+    if (str(webauthn, "rp_id").length === 0)
+      return yield* fail("Missing required field in config: auth.webauthn.rp_id");
+    const rpOrigins = webauthn["rp_origins"];
+    if (!Array.isArray(rpOrigins) || rpOrigins.length === 0)
+      return yield* fail("Missing required field in config: auth.webauthn.rp_origins");
+  }
+
+  // B1: hooks — each enabled hook (`config.go:1402-1470`).
+  const hook = asRecord(authRaw["hook"]);
+  if (hook !== undefined) {
+    const hookTypes = [
+      "mfa_verification_attempt",
+      "password_verification_attempt",
+      "custom_access_token",
+      "send_sms",
+      "send_email",
+      "before_user_created",
+    ] as const;
+    for (const hookType of hookTypes) {
+      const h = asRecord(hook[hookType]);
+      if (h === undefined) continue;
+      if (!(yield* gate(h, "enabled", `auth.hook.${hookType}.enabled`))) continue;
+      const uri = str(h, "uri");
+      if (uri.length === 0)
+        return yield* fail(`Missing required field in config: auth.hook.${hookType}.uri`);
+      // Go uses net/url.Parse, which (unlike `new URL`) does not throw on a missing scheme;
+      // extract the scheme the same lenient way so a no-scheme/other URI hits the default
+      // branch rather than erroring (the rare url.Parse error case is not separately ported).
+      const scheme = (/^([a-zA-Z][a-zA-Z0-9+.-]*):/u.exec(uri)?.[1] ?? "").toLowerCase();
+      const secrets = str(h, "secrets");
+      if (scheme === "http" || scheme === "https") {
+        if (secrets.length === 0)
+          return yield* fail(`Missing required field in config: auth.hook.${hookType}.secrets`);
+        for (const secret of secrets.split("|")) {
+          if (!LEGACY_HOOK_SECRET_PATTERN.test(secret))
+            return yield* fail(
+              `Invalid hook config: auth.hook.${hookType}.secrets must be formatted as "v1,whsec_<base64_encoded_secret>" with a minimum length of 32 characters.`,
+            );
+        }
+      } else if (scheme === "pg-functions") {
+        if (secrets.length > 0)
+          return yield* fail(
+            `Invalid hook config: auth.hook.${hookType}.secrets is unsupported for pg-functions URI`,
+          );
+      } else {
+        return yield* fail(
+          `Invalid hook config: auth.hook.${hookType}.uri should be a HTTP, HTTPS, or pg-functions URI`,
+        );
+      }
+    }
+  }
+
+  // B2: mfa — enroll requires verify (`config.go:1472-1483`).
+  const mfa = asRecord(authRaw["mfa"]);
+  if (mfa !== undefined) {
+    for (const [key, label] of [
+      ["totp", "totp"],
+      ["phone", "phone"],
+      ["web_authn", "web_authn"],
+    ] as const) {
+      const factor = asRecord(mfa[key]);
+      if (factor === undefined) continue;
+      const enroll = yield* gate(factor, "enroll_enabled", `auth.mfa.${label}.enroll_enabled`);
+      const verify = yield* gate(factor, "verify_enabled", `auth.mfa.${label}.verify_enabled`);
+      if (enroll && !verify)
+        return yield* fail(
+          `Invalid MFA config: auth.mfa.${label}.enroll_enabled requires verify_enabled`,
+        );
+    }
+  }
+
+  // B3: email (`config.go:1242-1295`).
+  const email = asRecord(authRaw["email"]);
+  if (email !== undefined) {
+    // Go resolves a relative `content_path` differently per section: email TEMPLATE paths are
+    // relative to the PROJECT ROOT (`config.go:854-856`, the `// FIXME` there), while
+    // NOTIFICATION paths are relative to the supabase dir (`config.go:861-862`); absolute → as-is.
+    const validateTemplate = (
+      section: "template" | "notification",
+      name: string,
+      tmpl: RawDoc,
+      base: string,
+    ) =>
+      Effect.gen(function* () {
+        const contentPath = str(tmpl, "content_path");
+        if (contentPath.length === 0) {
+          if (tmpl["content"] !== undefined)
+            return yield* fail(
+              `Invalid config for auth.email.${section}.${name}.content: please use content_path instead`,
+            );
+          return;
+        }
+        yield* fs.readFileString(resolvePath(contentPath, base)).pipe(
+          Effect.mapError(
+            (cause) =>
+              new LegacyDbConfigLoadError({
+                message: `Invalid config for auth.email.${section}.${name}.content_path: ${cause.message}`,
+              }),
+          ),
+        );
+      });
+    const templates = asRecord(email["template"]);
+    if (templates !== undefined) {
+      for (const name of Object.keys(templates)) {
+        const tmpl = asRecord(templates[name]);
+        if (tmpl !== undefined) yield* validateTemplate("template", name, tmpl, workdir);
+      }
+    }
+    const notifications = asRecord(email["notification"]);
+    if (notifications !== undefined) {
+      for (const name of Object.keys(notifications)) {
+        const tmpl = asRecord(notifications[name]);
+        if (
+          tmpl !== undefined &&
+          (yield* gate(tmpl, "enabled", `auth.email.notification.${name}.enabled`))
+        )
+          yield* validateTemplate("notification", name, tmpl, supabaseDir);
+      }
+    }
+    // Go defaults `auth.email.smtp.enabled = true` when the `[auth.email.smtp]` table is present
+    // but omits `enabled` (`config.go:692-696`), so a present table validates unless explicitly
+    // disabled.
+    const smtp = asRecord(email["smtp"]);
+    const smtpEnabled =
+      smtp !== undefined &&
+      (smtp["enabled"] === undefined
+        ? true
+        : yield* gate(smtp, "enabled", "auth.email.smtp.enabled"));
+    if (smtp !== undefined && smtpEnabled) {
+      if (str(smtp, "host").length === 0)
+        return yield* fail("Missing required field in config: auth.email.smtp.host");
+      const portRaw = smtp["port"];
+      const port =
+        typeof portRaw === "number"
+          ? portRaw
+          : typeof portRaw === "string"
+            ? Number(legacyExpandEnv(portRaw, lookup))
+            : 0;
+      if (!port) return yield* fail("Missing required field in config: auth.email.smtp.port");
+      if (str(smtp, "user").length === 0)
+        return yield* fail("Missing required field in config: auth.email.smtp.user");
+      if (str(smtp, "pass").length === 0)
+        return yield* fail("Missing required field in config: auth.email.smtp.pass");
+      if (str(smtp, "admin_email").length === 0)
+        return yield* fail("Missing required field in config: auth.email.smtp.admin_email");
+    }
+  }
+
+  // B4: sms — only the FIRST enabled provider is validated (Go's switch, `config.go:1297-1364`).
+  const sms = asRecord(authRaw["sms"]);
+  if (sms !== undefined) {
+    const twilio = asRecord(sms["twilio"]);
+    const twilioVerify = asRecord(sms["twilio_verify"]);
+    const messagebird = asRecord(sms["messagebird"]);
+    const textlocal = asRecord(sms["textlocal"]);
+    const vonage = asRecord(sms["vonage"]);
+    // Resolve every provider's enable-flag (a malformed bool aborts like Go's decode); Go's
+    // switch then validates only the FIRST enabled provider.
+    const twilioEnabled = yield* gate(twilio, "enabled", "auth.sms.twilio.enabled");
+    const twilioVerifyEnabled = yield* gate(
+      twilioVerify,
+      "enabled",
+      "auth.sms.twilio_verify.enabled",
+    );
+    const messagebirdEnabled = yield* gate(messagebird, "enabled", "auth.sms.messagebird.enabled");
+    const textlocalEnabled = yield* gate(textlocal, "enabled", "auth.sms.textlocal.enabled");
+    const vonageEnabled = yield* gate(vonage, "enabled", "auth.sms.vonage.enabled");
+    if (twilioEnabled) {
+      if (str(twilio, "account_sid").length === 0)
+        return yield* fail("Missing required field in config: auth.sms.twilio.account_sid");
+      if (str(twilio, "message_service_sid").length === 0)
+        return yield* fail("Missing required field in config: auth.sms.twilio.message_service_sid");
+      if (str(twilio, "auth_token").length === 0)
+        return yield* fail("Missing required field in config: auth.sms.twilio.auth_token");
+    } else if (twilioVerifyEnabled) {
+      if (str(twilioVerify, "account_sid").length === 0)
+        return yield* fail("Missing required field in config: auth.sms.twilio_verify.account_sid");
+      if (str(twilioVerify, "message_service_sid").length === 0)
+        return yield* fail(
+          "Missing required field in config: auth.sms.twilio_verify.message_service_sid",
+        );
+      if (str(twilioVerify, "auth_token").length === 0)
+        return yield* fail("Missing required field in config: auth.sms.twilio_verify.auth_token");
+    } else if (messagebirdEnabled) {
+      if (str(messagebird, "originator").length === 0)
+        return yield* fail("Missing required field in config: auth.sms.messagebird.originator");
+      if (str(messagebird, "access_key").length === 0)
+        return yield* fail("Missing required field in config: auth.sms.messagebird.access_key");
+    } else if (textlocalEnabled) {
+      if (str(textlocal, "sender").length === 0)
+        return yield* fail("Missing required field in config: auth.sms.textlocal.sender");
+      if (str(textlocal, "api_key").length === 0)
+        return yield* fail("Missing required field in config: auth.sms.textlocal.api_key");
+    } else if (vonageEnabled) {
+      if (str(vonage, "from").length === 0)
+        return yield* fail("Missing required field in config: auth.sms.vonage.from");
+      if (str(vonage, "api_key").length === 0)
+        return yield* fail("Missing required field in config: auth.sms.vonage.api_key");
+      if (str(vonage, "api_secret").length === 0)
+        return yield* fail("Missing required field in config: auth.sms.vonage.api_secret");
+    }
+  }
+
+  // B5: external providers (`config.go:1368-1398`). linkedin/slack are deprecated and deleted
+  // before validation, so they are never validated here.
+  const external = asRecord(authRaw["external"]);
+  if (external !== undefined) {
+    for (const name of Object.keys(external)) {
+      if (name === "linkedin" || name === "slack") continue;
+      const provider = asRecord(external[name]);
+      if (provider === undefined) continue;
+      if (!(yield* gate(provider, "enabled", `auth.external.${name}.enabled`))) continue;
+      if (str(provider, "client_id").length === 0)
+        return yield* fail(`Missing required field in config: auth.external.${name}.client_id`);
+      if (name !== "apple" && name !== "google" && str(provider, "secret").length === 0)
+        return yield* fail(`Missing required field in config: auth.external.${name}.secret`);
+    }
+  }
+
+  // B6: third_party — validate each enabled provider in order, then mutual exclusivity
+  // (`config.go:1584-1632`). Note `aws_cognito`'s messages say `cognito` (Go's wording).
+  const thirdParty = asRecord(authRaw["third_party"]);
+  if (thirdParty !== undefined) {
+    let enabledCount = 0;
+    const firebase = asRecord(thirdParty["firebase"]);
+    if (
+      firebase !== undefined &&
+      (yield* gate(firebase, "enabled", "auth.third_party.firebase.enabled"))
+    ) {
+      enabledCount += 1;
+      if (str(firebase, "project_id").length === 0)
+        return yield* fail(
+          "Invalid config: auth.third_party.firebase is enabled but without a project_id.",
+        );
+    }
+    const auth0 = asRecord(thirdParty["auth0"]);
+    if (auth0 !== undefined && (yield* gate(auth0, "enabled", "auth.third_party.auth0.enabled"))) {
+      enabledCount += 1;
+      if (str(auth0, "tenant").length === 0)
+        return yield* fail(
+          "Invalid config: auth.third_party.auth0 is enabled but without a tenant.",
+        );
+    }
+    const cognito = asRecord(thirdParty["aws_cognito"]);
+    if (
+      cognito !== undefined &&
+      (yield* gate(cognito, "enabled", "auth.third_party.aws_cognito.enabled"))
+    ) {
+      enabledCount += 1;
+      if (str(cognito, "user_pool_id").length === 0)
+        return yield* fail(
+          "Invalid config: auth.third_party.cognito is enabled but without a user_pool_id.",
+        );
+      if (str(cognito, "user_pool_region").length === 0)
+        return yield* fail(
+          "Invalid config: auth.third_party.cognito is enabled but without a user_pool_region.",
+        );
+    }
+    const clerk = asRecord(thirdParty["clerk"]);
+    if (clerk !== undefined && (yield* gate(clerk, "enabled", "auth.third_party.clerk.enabled"))) {
+      enabledCount += 1;
+      const domain = str(clerk, "domain");
+      if (domain.length === 0)
+        return yield* fail(
+          "Invalid config: auth.third_party.clerk is enabled but without a domain.",
+        );
+      if (!LEGACY_CLERK_DOMAIN_PATTERN.test(domain))
+        return yield* fail(
+          "Invalid config: auth.third_party.clerk has invalid domain, it usually is like clerk.example.com or example.clerk.accounts.dev. Check https://clerk.com/setup/supabase on how to find the correct value.",
+        );
+    }
+    const workos = asRecord(thirdParty["workos"]);
+    if (
+      workos !== undefined &&
+      (yield* gate(workos, "enabled", "auth.third_party.workos.enabled"))
+    ) {
+      enabledCount += 1;
+      if (str(workos, "issuer_url").length === 0)
+        return yield* fail(
+          "Invalid config: auth.third_party.workos is enabled but without a issuer_url.",
+        );
+    }
+    if (enabledCount > 1)
+      return yield* fail(
+        "Invalid config: Only one third_party provider allowed to be enabled at a time.",
+      );
+  }
+});
+
 /**
  * Reads `<workdir>/supabase/config.toml` (db subtree + project id) and the linked
  * `<workdir>/supabase/.temp/pooler-url`. `fs`/`path` are passed in so the resolver
@@ -526,6 +1156,10 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
   // used to derive Docker IDs, matching Go's decode-then-validate ordering.
   const projectEnv = yield* legacyLoadProjectEnv(fs, path, workdir);
   const lookup: EnvLookup = (name) => process.env[name] ?? projectEnv[name];
+  // dotenvx private keys for decrypting `encrypted:` secrets (Go's DecryptSecretHookFunc),
+  // from the shell + project env. Used by the global secret-decryptability assertion below
+  // and the `[db.vault]` resolution.
+  const dotenvPrivateKeys = legacyCollectDotenvPrivateKeys({ ...projectEnv, ...process.env });
 
   let db: RawDoc | undefined;
   let pgDeltaRaw: RawDoc | undefined;
@@ -536,7 +1170,11 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
   let edgeRuntimeRaw: RawDoc | undefined;
   let experimentalRaw: RawDoc | undefined;
   let functionsRaw: RawDoc | undefined;
+  let analyticsRaw: RawDoc | undefined;
   let projectId = Option.none<string>();
+  // Config keys a matched remote block contributed at viper's override tier (Go's
+  // `v.Set`), so they must beat the matching `SUPABASE_*` env overrides below.
+  let remoteOverrideKeys: ReadonlySet<string> = new Set();
   if (Option.isSome(maybeContent)) {
     let doc: RawDoc | undefined;
     try {
@@ -571,7 +1209,12 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
     }
     // Apply a matching `[remotes.<name>]` override (Go merges the block whose
     // `project_id` equals the resolved ref over the base, config.go:503-562).
-    const effectiveDoc = ref === undefined ? doc : applyRemoteOverride(doc, ref, lookup);
+    const remoteOverride =
+      ref === undefined
+        ? { doc, remoteOverrideKeys: new Set<string>() }
+        : applyRemoteOverride(doc, ref, lookup);
+    const effectiveDoc = remoteOverride.doc;
+    remoteOverrideKeys = remoteOverride.remoteOverrideKeys;
     db = asRecord(effectiveDoc?.["db"]);
     experimentalRaw = asRecord(effectiveDoc?.["experimental"]);
     pgDeltaRaw = asRecord(experimentalRaw?.["pgdelta"]);
@@ -581,6 +1224,7 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
     apiRaw = asRecord(effectiveDoc?.["api"]);
     edgeRuntimeRaw = asRecord(effectiveDoc?.["edge_runtime"]);
     functionsRaw = asRecord(effectiveDoc?.["functions"]);
+    analyticsRaw = asRecord(effectiveDoc?.["analytics"]);
     // Go expands `env(VAR)` for the top-level `project_id` during `config.Load`
     // (`config.go:584-588`) before `UpdateDockerIds` derives container names from
     // it, so expand here too — otherwise a `project_id = "env(PROJECT_ID)"` would
@@ -589,6 +1233,16 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
     projectId = nonEmptyString(
       typeof rawProjectId === "string" ? legacyExpandEnv(rawProjectId, lookup) : rawProjectId,
     );
+
+    // Go's `DecryptSecretHookFunc` is a global decode hook (config.go:730) that decrypts
+    // EVERY `config.Secret` field during `UnmarshalExact`, so an `encrypted:` secret anywhere
+    // in the merged config that cannot be decrypted (e.g. no DOTENV_PRIVATE_KEY) aborts the
+    // load with `failed to parse config: <error>` (secret.go:34,103; config.go:704) — before
+    // Validate and before connecting. The reader otherwise only decrypts `[db.vault]`, so
+    // assert decryptability across the whole document to match Go (a recursive scan tracks
+    // Go's "decode the entire config" better than a hand-listed set of Secret paths).
+    const secretError = legacyAssertDecryptableSecrets(effectiveDoc, lookup, dotenvPrivateKeys);
+    if (secretError !== undefined) return yield* Effect.fail(secretError);
   }
 
   // Go: `config.go:626` — read the linked pooler URL from `.temp/pooler-url` and
@@ -620,12 +1274,33 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
     return fromFile !== undefined && fromFile.length > 0 ? fromFile : undefined;
   };
 
+  // Go's viper AutomaticEnv binds the top-level `project_id` to `SUPABASE_PROJECT_ID`
+  // (`config.go:529-535`), so the env value overrides the TOML `project_id` before
+  // `UpdateDockerIds` derives the local-stack container/network names from it
+  // (`internal/utils/config.go:57-63` — `NetId = supabase_network_<project_id>`). The
+  // reader's `projectId` is exactly that Docker-naming id, so apply the override here
+  // (env-expanded like the TOML value, then sanitized at the consumer) — otherwise
+  // `test db --local` joins `supabase_network_<toml-or-basename>` while Go honors the
+  // env id. This is independent of the linked-ref resolver, which reads the env var on
+  // its own chain; the env value is bound regardless of whether a config file exists.
+  const projectIdEnv = envOverride("SUPABASE_PROJECT_ID");
+  if (projectIdEnv !== undefined) {
+    projectId = nonEmptyString(legacyExpandEnv(projectIdEnv, lookup));
+  }
+
   // A present-but-unmarshalable port aborts in Go rather than defaulting; mirror
   // that so `test db --local` never silently targets the default local database
   // while hiding a broken `[db]` config.
-  const port = resolvePort(envOverride("SUPABASE_DB_PORT") ?? db?.["port"], DEFAULT_PORT, lookup);
+  const port = resolvePort(
+    (remoteOverrideKeys.has("db.port") ? undefined : envOverride("SUPABASE_DB_PORT")) ??
+      db?.["port"],
+    DEFAULT_PORT,
+    lookup,
+  );
   const shadowPort = resolvePort(
-    envOverride("SUPABASE_DB_SHADOW_PORT") ?? db?.["shadow_port"],
+    (remoteOverrideKeys.has("db.shadow_port")
+      ? undefined
+      : envOverride("SUPABASE_DB_SHADOW_PORT")) ?? db?.["shadow_port"],
     DEFAULT_SHADOW_PORT,
     lookup,
   );
@@ -636,6 +1311,15 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
       }),
     );
   }
+  // Go's `config.Validate` rejects an explicit `db.port = 0` (`config.go:980-981`); an
+  // absent port is defaulted before Validate, so only a present 0 fails. `resolvePort`
+  // accepts 0 as a syntactically valid uint16, so the zero check lives here. No equivalent
+  // for `shadow_port` — Go has no `ShadowPort == 0` validation (`pkg/config/db.go:85`).
+  if (port === 0) {
+    return yield* Effect.fail(
+      new LegacyDbConfigLoadError({ message: "Missing required field in config: db.port" }),
+    );
+  }
 
   // Go's `db.Password` is tagged `json:"-"` (`apps/cli-go/pkg/config/db.go:88`), so
   // it is NOT bound from `SUPABASE_DB_PASSWORD` — the local password is the fixed
@@ -649,7 +1333,10 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
   // truncated to 17) and resolving `env(PG_MAJOR)` before validation
   // (`apps/cli-go/pkg/config/config.go` viper + mapstructure). `resolveConfigInt`
   // mirrors that; `SUPABASE_DB_MAJOR_VERSION` overrides the TOML via AutomaticEnv.
-  const majorVersionRaw = envOverride("SUPABASE_DB_MAJOR_VERSION") ?? db?.["major_version"];
+  const majorVersionRaw =
+    (remoteOverrideKeys.has("db.major_version")
+      ? undefined
+      : envOverride("SUPABASE_DB_MAJOR_VERSION")) ?? db?.["major_version"];
   const majorVersionResolved = resolveConfigInt(majorVersionRaw, lookup);
   if (majorVersionResolved === "invalid") {
     // Present but not a whole integer (`17foo`, or an `env(VAR)` that does not
@@ -713,7 +1400,9 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
   // validation (same generic prefix+replacer binding as the pg-delta env vars below),
   // so a CI env override decides which edge-runtime image pg-delta runs under.
   const denoVersionRaw =
-    envOverride("SUPABASE_EDGE_RUNTIME_DENO_VERSION") ?? edgeRuntimeRaw?.["deno_version"];
+    (remoteOverrideKeys.has("edge_runtime.deno_version")
+      ? undefined
+      : envOverride("SUPABASE_EDGE_RUNTIME_DENO_VERSION")) ?? edgeRuntimeRaw?.["deno_version"];
   // Go decodes `deno_version` into a `uint` before validation, so a present non-integer
   // string (`2foo`) or an unresolved `env(MISSING)` aborts the load rather than falling
   // through to the default Deno 2 image. `resolveConfigInt` expands `env()` then requires
@@ -760,24 +1449,33 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
   // CI env override decides the gate / paths. `envOverride` is the shell→project-.env
   // lookup that ignores empty values, matching viper.
   const enabledRaw = pgDeltaRaw?.["enabled"];
-  const enabledEnv = envOverride("SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED");
+  const enabledEnv = remoteOverrideKeys.has("experimental.pgdelta.enabled")
+    ? undefined
+    : envOverride("SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED");
   // Go decodes this bool via `strconv.ParseBool` (mapstructure weakly typed), so `"1"`
   // counts as true and a malformed value (`SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED=maybe`)
   // aborts the load. The env override wins (viper AutomaticEnv), then the TOML bool, then
   // an `env(VAR)` string, defaulting to false when absent.
   let enabled: boolean;
   if (enabledEnv !== undefined) {
-    const parsed = legacyParseGoBool(enabledEnv);
+    // The AutomaticEnv override is decoded through `LoadEnvHook`, so an `env(VAR)`
+    // indirection is expanded before the weak `ParseBool` decode (`decode_hooks.go:15-26`).
+    const expandedEnabledEnv = legacyExpandEnv(enabledEnv, lookup);
+    const parsed = legacyParseGoBool(expandedEnabledEnv);
     if (parsed === undefined) {
       return yield* Effect.fail(
         new LegacyDbConfigLoadError({
-          message: `failed to parse config: invalid experimental.pgdelta.enabled: ${enabledEnv}.`,
+          message: `failed to parse config: invalid experimental.pgdelta.enabled: ${expandedEnabledEnv}.`,
         }),
       );
     }
     enabled = parsed;
   } else if (typeof enabledRaw === "boolean") {
     enabled = enabledRaw;
+  } else if (typeof enabledRaw === "number") {
+    // Go decodes the whole config under mapstructure's weak typing, so a numeric
+    // `enabled = 1` is true (`value != 0`) — same rule as the generic `resolveBool`.
+    enabled = enabledRaw !== 0;
   } else if (typeof enabledRaw === "string") {
     const parsed = legacyParseGoBool(legacyExpandEnv(enabledRaw, lookup));
     if (parsed === undefined) {
@@ -793,11 +1491,17 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
   }
 
   const declarativeSchemaPathRaw = pgDeltaRaw?.["declarative_schema_path"];
-  const declarativeSchemaPathValue =
-    envOverride("SUPABASE_EXPERIMENTAL_PGDELTA_DECLARATIVE_SCHEMA_PATH") ??
-    (typeof declarativeSchemaPathRaw === "string"
-      ? legacyExpandEnv(declarativeSchemaPathRaw, lookup)
-      : "");
+  // The AutomaticEnv override and the TOML literal both flow through Go's `LoadEnvHook`
+  // (`decode_hooks.go:15-26`) under `UnmarshalExact`, so an `env(VAR)` indirection is expanded
+  // before the path is used — whichever source wins. Expand once over the resolved value
+  // (`legacyExpandEnv` is a no-op on a non-`env()` string).
+  const declarativeSchemaPathValue = legacyExpandEnv(
+    (remoteOverrideKeys.has("experimental.pgdelta.declarative_schema_path")
+      ? undefined
+      : envOverride("SUPABASE_EXPERIMENTAL_PGDELTA_DECLARATIVE_SCHEMA_PATH")) ??
+      (typeof declarativeSchemaPathRaw === "string" ? declarativeSchemaPathRaw : ""),
+    lookup,
+  );
   let declarativeSchemaPath = Option.none<string>();
   if (declarativeSchemaPathValue.length > 0) {
     declarativeSchemaPath = Option.some(
@@ -808,9 +1512,15 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
   }
 
   const formatOptionsRaw = pgDeltaRaw?.["format_options"];
-  const formatOptionsExpanded =
-    envOverride("SUPABASE_EXPERIMENTAL_PGDELTA_FORMAT_OPTIONS") ??
-    (typeof formatOptionsRaw === "string" ? legacyExpandEnv(formatOptionsRaw, lookup) : "");
+  // Same `LoadEnvHook` path: expand the resolved value (env override or TOML literal) before
+  // the JSON validation below runs.
+  const formatOptionsExpanded = legacyExpandEnv(
+    (remoteOverrideKeys.has("experimental.pgdelta.format_options")
+      ? undefined
+      : envOverride("SUPABASE_EXPERIMENTAL_PGDELTA_FORMAT_OPTIONS")) ??
+      (typeof formatOptionsRaw === "string" ? formatOptionsRaw : ""),
+    lookup,
+  );
   // Go's config.Validate aborts config load when a non-empty format_options is not
   // valid JSON (`apps/cli-go/pkg/config/config.go:1685-1686`), before any shadow /
   // catalog container runs. Fail here with Go's exact message so the user gets the
@@ -859,10 +1569,191 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
     }
   }
 
+  // Go's config.Validate runs the full `if c.Auth.Enabled` block (`config.go:1036-1102`)
+  // after the bucket/function checks — port its fatal validations so db/migration commands
+  // abort on an invalid auth config exactly like Go (e.g. an enabled passkey without a valid
+  // [auth.webauthn], or two third_party providers). Gated on `auth.enabled` (default true).
+  // Go's viper AutomaticEnv binds `auth.enabled` to `SUPABASE_AUTH_ENABLED` before Validate
+  // (`config.go:529-535`), so the env override decides whether the auth block is validated.
+  const authEnabled = yield* resolveBoolOrFail(
+    "auth.enabled",
+    authRaw?.["enabled"],
+    true,
+    lookup,
+    envOverride("SUPABASE_AUTH_ENABLED"),
+  );
+  if (authEnabled) {
+    yield* legacyValidateAuthConfig(authRaw ?? {}, fs, path, workdir, lookup);
+  }
+
+  // Go's config.Validate validates `[analytics]` after the auth block (`config.go:1123-1135`).
+  // Two fatal checks run on the db/migration path:
+  //   1. `LogflareBackend.UnmarshalText` (`config.go:60-66`) is a decode-time enum that rejects
+  //      any `backend` other than `postgres`/`bigquery` — regardless of `enabled` (it fires
+  //      during UnmarshalExact, like the captcha provider enum), so it gates here too.
+  //   2. When analytics is enabled with the BigQuery backend, the three GCP fields are required
+  //      (`config.go:1124-1134`), in order, with byte-exact messages.
+  // Go merges the template defaults `enabled = true`, `backend = "postgres"` before Validate
+  // (`templates/config.toml:388-392`), so an absent `[analytics]` section is enabled+postgres and
+  // passes (an empty backend never equals `bigquery`, so the GCP block is skipped). viper
+  // AutomaticEnv binds `SUPABASE_ANALYTICS_*`; a matched remote block makes those keys env-immune,
+  // same as every other `LEGACY_ENV_OVERRIDABLE_KEYS` field above.
+  const analyticsString = (key: string, envName: string): string => {
+    const fromEnv = remoteOverrideKeys.has(`analytics.${key}`) ? undefined : envOverride(envName);
+    const raw = fromEnv ?? analyticsRaw?.[key];
+    return typeof raw === "string" ? legacyExpandEnv(raw, lookup) : "";
+  };
+  const analyticsBackend = analyticsString("backend", "SUPABASE_ANALYTICS_BACKEND");
+  if (
+    analyticsBackend.length > 0 &&
+    analyticsBackend !== "postgres" &&
+    analyticsBackend !== "bigquery"
+  ) {
+    // Mirror the captcha enum's mapstructure envelope (`%v` of the allowed `[]LogflareBackend`).
+    return yield* Effect.fail(
+      new LegacyDbConfigLoadError({
+        message:
+          "failed to parse config: decoding failed due to the following error(s):\n\n'analytics.backend' must be one of [postgres bigquery]",
+      }),
+    );
+  }
+  const analyticsEnabled = yield* resolveBoolOrFail(
+    "analytics.enabled",
+    analyticsRaw?.["enabled"],
+    true,
+    lookup,
+    remoteOverrideKeys.has("analytics.enabled")
+      ? undefined
+      : envOverride("SUPABASE_ANALYTICS_ENABLED"),
+  );
+  if (analyticsEnabled && analyticsBackend === "bigquery") {
+    // Each GCP value is env-expanded (Go's LoadEnvHook), so an unresolved `env(VAR)` stays
+    // non-empty and passes the `len(...) == 0` check, exactly like Go.
+    if (analyticsString("gcp_project_id", "SUPABASE_ANALYTICS_GCP_PROJECT_ID").length === 0) {
+      return yield* Effect.fail(
+        new LegacyDbConfigLoadError({
+          message: "Missing required field in config: analytics.gcp_project_id",
+        }),
+      );
+    }
+    if (
+      analyticsString("gcp_project_number", "SUPABASE_ANALYTICS_GCP_PROJECT_NUMBER").length === 0
+    ) {
+      return yield* Effect.fail(
+        new LegacyDbConfigLoadError({
+          message: "Missing required field in config: analytics.gcp_project_number",
+        }),
+      );
+    }
+    if (analyticsString("gcp_jwt_path", "SUPABASE_ANALYTICS_GCP_JWT_PATH").length === 0) {
+      return yield* Effect.fail(
+        new LegacyDbConfigLoadError({
+          message:
+            "Path to GCP Service Account Key must be provided in config, relative to config.toml: analytics.gcp_jwt_path",
+        }),
+      );
+    }
+  }
+
   // `[db.vault]` secret names, sorted (Go's `setupInputsToken` sorts before hashing).
   const vaultRaw = asRecord(db?.["vault"]);
   const vaultNames = vaultRaw === undefined ? [] : Object.keys(vaultRaw).sort();
 
+  // `[db.migrations] enabled` — Go default true (`config.go:384`); overridable by
+  // `SUPABASE_DB_MIGRATIONS_ENABLED` via viper AutomaticEnv (`config.go:494-498`) — EXCEPT
+  // when the matched remote block explicitly set it (then the remote override-tier value
+  // wins, `config.go:635-637`).
+  const migrationsRaw = asRecord(db?.["migrations"]);
+  const migrationsEnabled = yield* resolveBoolOrFail(
+    "db.migrations.enabled",
+    migrationsRaw?.["enabled"],
+    true,
+    lookup,
+    remoteOverrideKeys.has("db.migrations.enabled")
+      ? undefined
+      : envOverride("SUPABASE_DB_MIGRATIONS_ENABLED"),
+  );
+
+  // `[db.seed]` — Go defaults enabled true, sql_paths ["seed.sql"]; relative
+  // patterns are supabase-prefixed (`config.go:801-806`). `db.seed.enabled` is
+  // overridable by `SUPABASE_DB_SEED_ENABLED` via viper AutomaticEnv — EXCEPT when a
+  // matched remote block supplied it at the override tier (set or forced false).
+  const seedRaw = asRecord(db?.["seed"]);
+  const seedEnabled = yield* resolveBoolOrFail(
+    "db.seed.enabled",
+    seedRaw?.["enabled"],
+    true,
+    lookup,
+    remoteOverrideKeys.has("db.seed.enabled") ? undefined : envOverride("SUPABASE_DB_SEED_ENABLED"),
+  );
+  // Go decodes `db.seed.sql_paths` through the mapstructure hook chain in order:
+  // `LoadEnvHook` (expands `env(VAR)`) runs BEFORE `StringToSliceHookFunc(",")`
+  // (`config.go:687-695`; `decode_hooks.go`). So a STRING value — the
+  // `SUPABASE_DB_SEED_SQL_PATHS` env override (viper AutomaticEnv) or a TOML string — is
+  // env-expanded FIRST, then comma-split (no trimming; empty → `[]`). A TOML ARRAY is
+  // decoded element-by-element: each element is env-expanded but NOT re-split
+  // (`StringToSliceHookFunc` only fires string→[]string), so `["env(SEEDS)"]` stays one
+  // pattern. The env override (non-empty; `envOverride` drops empties to match
+  // `AllowEmptyEnv=false`) wins over the TOML value; an absent (or non-string/non-array)
+  // value falls back to the `["seed.sql"]` default.
+  const splitGoSeedPaths = (value: string): ReadonlyArray<string> => {
+    const expanded = legacyExpandEnv(value, lookup);
+    return expanded.length === 0 ? [] : expanded.split(",");
+  };
+  const rawSqlPaths = seedRaw?.["sql_paths"];
+  const sqlPathsOverride = remoteOverrideKeys.has("db.seed.sql_paths")
+    ? undefined
+    : envOverride("SUPABASE_DB_SEED_SQL_PATHS");
+  const sqlPathPatterns =
+    sqlPathsOverride !== undefined
+      ? splitGoSeedPaths(sqlPathsOverride)
+      : Array.isArray(rawSqlPaths)
+        ? rawSqlPaths
+            .filter((pattern): pattern is string => typeof pattern === "string")
+            .map((pattern) => legacyExpandEnv(pattern, lookup))
+        : typeof rawSqlPaths === "string"
+          ? splitGoSeedPaths(rawSqlPaths)
+          : ["seed.sql"];
+  const seedSqlPaths = sqlPathPatterns.map((pattern) => {
+    // Patterns are already env-expanded above (Go's LoadEnvHook runs before the split), so
+    // an absolute path is used verbatim and a relative one is supabase-prefixed via Go's
+    // `path.Join("supabase", pattern)` → `path.Clean` (collapses `.`/`..`).
+    if (pattern.length === 0 || path.isAbsolute(pattern)) return pattern;
+    return legacyJoinSupabaseSeedPath(pattern);
+  });
+
+  // `[db.vault]` secrets: env-expand each value, then decrypt dotenvx `encrypted:`
+  // ciphertext. `resolved` mirrors Go's `len(SHA256) > 0` gate (Go sets SHA256 only
+  // after a successful decrypt-or-passthrough; `UpsertVaultSecrets` upserts only
+  // resolved secrets). Go's `DecryptSecretHookFunc` runs inside `config.Load`, so an
+  // `encrypted:` value that cannot be decrypted aborts the command with
+  // `failed to parse config: <error>` (`secret.go:30-73`, `config.go:661-667`) — it
+  // is never silently skipped, which an earlier port did and which diverged from Go.
+  const vault: Array<LegacyDbVaultSecretToml> = [];
+  if (vaultRaw !== undefined) {
+    for (const name of Object.keys(vaultRaw).sort()) {
+      const raw = vaultRaw[name];
+      const value = typeof raw === "string" ? legacyExpandEnv(raw, lookup) : "";
+      // Empty or an unexpanded `env(...)` reference → unresolved (Go returns these
+      // verbatim from the hook without hashing, so SHA256 stays empty).
+      if (value.length === 0 || ENV_PATTERN.test(value)) {
+        vault.push({ name, value, resolved: false });
+        continue;
+      }
+      if (legacyIsEncryptedSecret(value)) {
+        const decrypted = legacyDecryptSecret(value, dotenvPrivateKeys);
+        if (!decrypted.ok) {
+          return yield* Effect.fail(
+            new LegacyDbConfigLoadError({ message: `failed to parse config: ${decrypted.error}` }),
+          );
+        }
+        vault.push({ name, value: decrypted.value, resolved: true });
+        continue;
+      }
+      vault.push({ name, value, resolved: true });
+    }
+  }
+
   // `[api] auto_expose_new_tables` is a tri-state `*bool` (`pkg/config/api.go:25`):
   // present → Some(bool), absent → None (never false). Go applies the
   // `SUPABASE_API_AUTO_EXPOSE_NEW_TABLES` AutomaticEnv override and decodes the value
@@ -870,7 +1761,9 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
   // `env(...)` parse correctly and `maybe` aborts rather than silently coercing to false.
   const apiAutoExposeNewTables = yield* resolveOptionalBoolOrFail(
     "api.auto_expose_new_tables",
-    envOverride("SUPABASE_API_AUTO_EXPOSE_NEW_TABLES"),
+    remoteOverrideKeys.has("api.auto_expose_new_tables")
+      ? undefined
+      : envOverride("SUPABASE_API_AUTO_EXPOSE_NEW_TABLES"),
     apiRaw?.["auto_expose_new_tables"],
     lookup,
   );
@@ -892,7 +1785,7 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
       npmVersion: pgDeltaNpmVersion,
     },
     baseline: {
-      authEnabled: yield* resolveBoolOrFail("auth.enabled", authRaw?.["enabled"], true, lookup),
+      authEnabled,
       storageEnabled: yield* resolveBoolOrFail(
         "storage.enabled",
         storageRaw?.["enabled"],
@@ -908,6 +1801,9 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
       apiAutoExposeNewTables,
       vaultNames,
     },
+    migrationsEnabled,
+    seed: { enabled: seedEnabled, sqlPaths: seedSqlPaths },
+    vault,
   };
   return values;
 });
diff --git a/apps/cli/src/legacy/shared/legacy-db-config.toml-read.unit.test.ts b/apps/cli/src/legacy/shared/legacy-db-config.toml-read.unit.test.ts
index 44575f324d..ade3dc5918 100644
--- a/apps/cli/src/legacy/shared/legacy-db-config.toml-read.unit.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-db-config.toml-read.unit.test.ts
@@ -63,6 +63,423 @@ describe("legacyReadDbToml", () => {
     );
   });
 
+  // Go's test vector (`apps/cli-go/pkg/config/secret_test.go`): this ciphertext
+  // decrypts to "value" under the keypair below.
+  const VAULT_PRIVATE_KEY = "7fd7210cef8f331ee8c55897996aaaafd853a2b20a4dc73d6d75759f65d2a7eb";
+  const VAULT_ENCRYPTED =
+    "encrypted:BKiXH15AyRzeohGyUrmB6cGjSklCrrBjdesQlX1VcXo/Xp20Bi2gGZ3AlIqxPQDmjVAALnhZamKnuY73l8Dz1P+BYiZUgxTSLzdCvdYUyVbNekj2UudbdUizBViERtZkuQwZHIv/";
+
+  it.effect("decrypts an encrypted: [db.vault] secret when DOTENV_PRIVATE_KEY is set", () => {
+    const previous = process.env["DOTENV_PRIVATE_KEY"];
+    process.env["DOTENV_PRIVATE_KEY"] = VAULT_PRIVATE_KEY;
+    const dir = withConfig(["[db.vault]", `my_secret = "${VAULT_ENCRYPTED}"`, ""].join("\n"));
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.vault).toEqual([{ name: "my_secret", value: "value", resolved: true }]);
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["DOTENV_PRIVATE_KEY"];
+          else process.env["DOTENV_PRIVATE_KEY"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("fails the load for an encrypted: [db.vault] secret with no private key", () => {
+    // Go aborts the whole command (`failed to parse config: missing private key`)
+    // rather than silently skipping the secret (`secret.go`, `config.go:661-667`).
+    const previous = process.env["DOTENV_PRIVATE_KEY"];
+    delete process.env["DOTENV_PRIVATE_KEY"];
+    const dir = withConfig(["[db.vault]", `my_secret = "${VAULT_ENCRYPTED}"`, ""].join("\n"));
+    return read(dir).pipe(
+      Effect.exit,
+      Effect.tap((exit) =>
+        Effect.sync(() => {
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain(
+              "failed to parse config: missing private key",
+            );
+          }
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous !== undefined) process.env["DOTENV_PRIVATE_KEY"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("collapses . and .. in relative seed sql_paths like Go's path.Join", () => {
+    // Go prefixes each relative pattern with `path.Join("supabase", pattern)`, which
+    // runs `path.Clean` (`config.go:881-886`). The cleaned path is the seed_files key.
+    const dir = withConfig(
+      ["[db.seed]", 'sql_paths = ["../seed.sql", "sub/../other.sql", "./plain.sql"]', ""].join(
+        "\n",
+      ),
+    );
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.seed.sqlPaths).toEqual(["seed.sql", "supabase/other.sql", "supabase/plain.sql"]);
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("honors SUPABASE_DB_SEED_SQL_PATHS over the TOML array (comma split, no trim)", () => {
+    // Go's StringToSliceHookFunc(",") splits without trimming, so " b.sql" keeps its space.
+    const previous = process.env["SUPABASE_DB_SEED_SQL_PATHS"];
+    process.env["SUPABASE_DB_SEED_SQL_PATHS"] = "a.sql, b.sql";
+    const dir = withConfig(["[db.seed]", 'sql_paths = ["ignored.sql"]', ""].join("\n"));
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.seed.sqlPaths).toEqual(["supabase/a.sql", "supabase/ b.sql"]);
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_DB_SEED_SQL_PATHS"];
+          else process.env["SUPABASE_DB_SEED_SQL_PATHS"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("decodes a STRING db.seed.sql_paths via StringToSliceHookFunc (comma, no trim)", () => {
+    // Go decodes a non-array sql_paths string into a slice (config.go:691), not just the
+    // env override; `"a.sql,b.sql"` → two supabase-prefixed paths, no trimming.
+    const dir = withConfig(["[db.seed]", 'sql_paths = "a.sql,b.sql"', ""].join("\n"));
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.seed.sqlPaths).toEqual(["supabase/a.sql", "supabase/b.sql"]);
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("treats an empty-string db.seed.sql_paths as no patterns (Go []string{})", () => {
+    const dir = withConfig(["[db.seed]", 'sql_paths = ""', ""].join("\n"));
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.seed.sqlPaths).toEqual([]);
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect(
+    "expands env() before splitting a string sql_paths (LoadEnv before StringToSlice)",
+    () => {
+      // Go runs LoadEnvHook before StringToSliceHookFunc(","), so env(SEEDS)=a.sql,b.sql
+      // expands first and then splits into two patterns.
+      const previous = process.env["SEEDS"];
+      process.env["SEEDS"] = "a.sql,b.sql";
+      const dir = withConfig(["[db.seed]", 'sql_paths = "env(SEEDS)"', ""].join("\n"));
+      return read(dir).pipe(
+        Effect.tap((v) =>
+          Effect.sync(() => {
+            expect(v.seed.sqlPaths).toEqual(["supabase/a.sql", "supabase/b.sql"]);
+          }),
+        ),
+        Effect.ensuring(
+          Effect.sync(() => {
+            if (previous === undefined) delete process.env["SEEDS"];
+            else process.env["SEEDS"] = previous;
+            rmSync(dir, { recursive: true, force: true });
+          }),
+        ),
+      );
+    },
+  );
+
+  it.effect("expands an env() array element but does NOT split it (Go array asymmetry)", () => {
+    // A TOML array element is decoded string→string: LoadEnvHook expands it, but
+    // StringToSliceHookFunc does not fire, so it stays one (comma-containing) pattern.
+    const previous = process.env["SEEDS"];
+    process.env["SEEDS"] = "a.sql,b.sql";
+    const dir = withConfig(["[db.seed]", 'sql_paths = ["env(SEEDS)"]', ""].join("\n"));
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.seed.sqlPaths).toEqual(["supabase/a.sql,b.sql"]);
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SEEDS"];
+          else process.env["SEEDS"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("decodes a numeric db.seed.enabled = 0 as false (Go weak-bool decode)", () => {
+    const dir = withConfig(["[db.seed]", "enabled = 0", ""].join("\n"));
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.seed.enabled).toBe(false);
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("decodes a numeric db.migrations.enabled = 0 as false", () => {
+    const dir = withConfig(["[db.migrations]", "enabled = 0", ""].join("\n"));
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.migrationsEnabled).toBe(false);
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect(
+    "decodes a numeric experimental.pgdelta.enabled = 1 as true (Go weak-bool decode)",
+    () => {
+      const dir = withConfig(["[experimental.pgdelta]", "enabled = 1", ""].join("\n"));
+      return read(dir).pipe(
+        Effect.tap((v) =>
+          Effect.sync(() => {
+            expect(v.pgDelta.enabled).toBe(true);
+            rmSync(dir, { recursive: true, force: true });
+          }),
+        ),
+      );
+    },
+  );
+
+  it.effect("rejects an explicit db.port = 0 (Go's Missing required field)", () => {
+    const dir = withConfig(["[db]", "port = 0", ""].join("\n"));
+    return read(dir).pipe(
+      Effect.exit,
+      Effect.tap((exit) =>
+        Effect.sync(() => {
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause)).toContain(
+              "Missing required field in config: db.port",
+            );
+          }
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("an explicit remote db.migrations.enabled beats SUPABASE_DB_MIGRATIONS_ENABLED", () => {
+    // Go applies each matched-remote key via v.Set (override tier) above AutomaticEnv
+    // (config.go:635-637), so an explicit remote value wins over the env var.
+    const ref = "abcdefghijklmnopqrst";
+    const previous = process.env["SUPABASE_DB_MIGRATIONS_ENABLED"];
+    process.env["SUPABASE_DB_MIGRATIONS_ENABLED"] = "false";
+    const dir = withConfig(
+      ["[remotes.prod]", `project_id = "${ref}"`, "db.migrations.enabled = true", ""].join("\n"),
+    );
+    return readRef(dir, ref).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.migrationsEnabled).toBe(true);
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_DB_MIGRATIONS_ENABLED"];
+          else process.env["SUPABASE_DB_MIGRATIONS_ENABLED"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("SUPABASE_DB_MIGRATIONS_ENABLED still wins when the remote block omits it", () => {
+    // Control: the env override is suppressed only for keys the matched block explicitly
+    // set; a block that omits db.migrations.enabled leaves the env override in force.
+    const ref = "abcdefghijklmnopqrst";
+    const previous = process.env["SUPABASE_DB_MIGRATIONS_ENABLED"];
+    process.env["SUPABASE_DB_MIGRATIONS_ENABLED"] = "false";
+    const dir = withConfig(["[remotes.prod]", `project_id = "${ref}"`, ""].join("\n"));
+    return readRef(dir, ref).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.migrationsEnabled).toBe(false);
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_DB_MIGRATIONS_ENABLED"];
+          else process.env["SUPABASE_DB_MIGRATIONS_ENABLED"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("an explicit remote experimental.pgdelta.enabled beats its SUPABASE_* env var", () => {
+    // Go's mergeRemoteConfig applies EVERY matched-block key via v.Set (above AutomaticEnv,
+    // config.go:635-637), not just db/seed — so a remote experimental.pgdelta.enabled wins
+    // over SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED.
+    const ref = "abcdefghijklmnopqrst";
+    const previous = process.env["SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED"];
+    process.env["SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED"] = "false";
+    const dir = withConfig(
+      [
+        "[remotes.prod]",
+        `project_id = "${ref}"`,
+        "[remotes.prod.experimental.pgdelta]",
+        "enabled = true",
+        "",
+      ].join("\n"),
+    );
+    return readRef(dir, ref).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.pgDelta.enabled).toBe(true);
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED"];
+          else process.env["SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED still wins when the block omits pgdelta", () => {
+    // Control: the env override is suppressed only for keys the matched block explicitly set;
+    // a block that omits experimental.pgdelta.enabled leaves the env override in force.
+    const ref = "abcdefghijklmnopqrst";
+    const previous = process.env["SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED"];
+    process.env["SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED"] = "true";
+    const dir = withConfig(["[remotes.prod]", `project_id = "${ref}"`, ""].join("\n"));
+    return readRef(dir, ref).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.pgDelta.enabled).toBe(true);
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED"];
+          else process.env["SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("matches a remote block by a SUPABASE_REMOTES_<NAME>_PROJECT_ID env override", () => {
+    // Viper AutomaticEnv supplies/overrides remotes.prod.project_id, so the block merges
+    // even with no TOML project_id (here it lifts major_version 15 over the base default).
+    const ref = "abcdefghijklmnopqrst";
+    const previous = process.env["SUPABASE_REMOTES_PROD_PROJECT_ID"];
+    process.env["SUPABASE_REMOTES_PROD_PROJECT_ID"] = ref;
+    const dir = withConfig(["[remotes.prod]", "db.major_version = 15", ""].join("\n"));
+    return readRef(dir, ref).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.majorVersion).toBe(15);
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_REMOTES_PROD_PROJECT_ID"];
+          else process.env["SUPABASE_REMOTES_PROD_PROJECT_ID"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("validates a remote project_id supplied only via env (no TOML literal)", () => {
+    // Without the env value the block (no TOML project_id) would fail Validate; the env
+    // override supplies a valid ref, so the load succeeds.
+    const ref = "abcdefghijklmnopqrst";
+    const previous = process.env["SUPABASE_REMOTES_PROD_PROJECT_ID"];
+    process.env["SUPABASE_REMOTES_PROD_PROJECT_ID"] = ref;
+    const dir = withConfig(["[remotes.prod]", "db.major_version = 15", ""].join("\n"));
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          // Load succeeded (no invalid-remote error); read() without a ref leaves the base
+          // major_version default (17) since the block is not merged.
+          expect(v.majorVersion).toBe(17);
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_REMOTES_PROD_PROJECT_ID"];
+          else process.env["SUPABASE_REMOTES_PROD_PROJECT_ID"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("a remote block forcing db.seed.enabled=false beats SUPABASE_DB_SEED_ENABLED", () => {
+    // Go's mergeRemoteConfig v.Set(false) is an override-tier value above AutomaticEnv,
+    // so a remote that omits db.seed.enabled stays unseeded even with the env var set.
+    const ref = "abcdefghijklmnopqrst";
+    const previous = process.env["SUPABASE_DB_SEED_ENABLED"];
+    process.env["SUPABASE_DB_SEED_ENABLED"] = "true";
+    const dir = withConfig(["[remotes.prod]", `project_id = "${ref}"`, ""].join("\n"));
+    return readRef(dir, ref).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.seed.enabled).toBe(false);
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_DB_SEED_ENABLED"];
+          else process.env["SUPABASE_DB_SEED_ENABLED"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("SUPABASE_DB_SEED_ENABLED still wins on the local path (no remote force)", () => {
+    // Negative control: with no matched remote block, the env override applies normally.
+    const previous = process.env["SUPABASE_DB_SEED_ENABLED"];
+    process.env["SUPABASE_DB_SEED_ENABLED"] = "false";
+    const dir = withConfig(["[db.seed]", "enabled = true", ""].join("\n"));
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.seed.enabled).toBe(false);
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_DB_SEED_ENABLED"];
+          else process.env["SUPABASE_DB_SEED_ENABLED"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
   it.effect("reads [edge_runtime] deno_version = 1 (selects the deno1 image)", () => {
     const dir = withConfig(["[edge_runtime]", "deno_version = 1", ""].join("\n"));
     return read(dir).pipe(
@@ -156,6 +573,54 @@ describe("legacyReadDbToml", () => {
       );
     });
 
+    it.effect("forces db.seed.enabled false when the matched remote block omits it", () => {
+      // Go's mergeRemoteConfig (config.go:638-640) forces db.seed.enabled=false when the
+      // matched remote block itself doesn't set it — even if the base config enables it.
+      const dir = withConfig(
+        [
+          'project_id = "base"',
+          "[db.seed]",
+          "enabled = true",
+          "[remotes.production]",
+          'project_id = "prodprodprodprodprod"',
+          "[remotes.production.db]",
+          "major_version = 17",
+          "",
+        ].join("\n"),
+      );
+      return readRef(dir, "prodprodprodprodprod").pipe(
+        Effect.tap((v) =>
+          Effect.sync(() => {
+            expect(v.seed.enabled).toBe(false);
+            rmSync(dir, { recursive: true, force: true });
+          }),
+        ),
+      );
+    });
+
+    it.effect("keeps db.seed.enabled true when the matched remote block sets it explicitly", () => {
+      const dir = withConfig(
+        [
+          'project_id = "base"',
+          "[db.seed]",
+          "enabled = false",
+          "[remotes.production]",
+          'project_id = "prodprodprodprodprod"',
+          "[remotes.production.db.seed]",
+          "enabled = true",
+          "",
+        ].join("\n"),
+      );
+      return readRef(dir, "prodprodprodprodprod").pipe(
+        Effect.tap((v) =>
+          Effect.sync(() => {
+            expect(v.seed.enabled).toBe(true);
+            rmSync(dir, { recursive: true, force: true });
+          }),
+        ),
+      );
+    });
+
     it.effect("rejects two remote blocks with the same project_id (any command)", () => {
       // Go's config.Load aborts on duplicate project_id regardless of ref (config.go:506).
       const dir = withConfig(
@@ -424,6 +889,38 @@ describe("legacyReadDbToml", () => {
     );
   });
 
+  it.effect("expands an env() indirection in the PGDELTA_DECLARATIVE_SCHEMA_PATH override", () => {
+    // Go decodes the AutomaticEnv override through LoadEnvHook (decode_hooks.go:15-26), so an
+    // env(VAR) indirection resolves before the supabase/ join — not stored literally.
+    const dir = withConfig(undefined);
+    const savedEnabled = process.env["SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED"];
+    const savedPath = process.env["SUPABASE_EXPERIMENTAL_PGDELTA_DECLARATIVE_SCHEMA_PATH"];
+    const savedDir = process.env["SCHEMA_DIR"];
+    process.env["SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED"] = "true";
+    process.env["SUPABASE_EXPERIMENTAL_PGDELTA_DECLARATIVE_SCHEMA_PATH"] = "env(SCHEMA_DIR)";
+    process.env["SCHEMA_DIR"] = "schemas";
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(Option.getOrNull(v.pgDelta.declarativeSchemaPath)).toBe("supabase/schemas");
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (savedEnabled === undefined)
+            delete process.env["SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED"];
+          else process.env["SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED"] = savedEnabled;
+          if (savedPath === undefined)
+            delete process.env["SUPABASE_EXPERIMENTAL_PGDELTA_DECLARATIVE_SCHEMA_PATH"];
+          else process.env["SUPABASE_EXPERIMENTAL_PGDELTA_DECLARATIVE_SCHEMA_PATH"] = savedPath;
+          if (savedDir === undefined) delete process.env["SCHEMA_DIR"];
+          else process.env["SCHEMA_DIR"] = savedDir;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
   it.effect("treats SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED=1 as true (Go strconv.ParseBool)", () => {
     const dir = withConfig(undefined);
     const saved = process.env["SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED"];
@@ -564,6 +1061,85 @@ describe("legacyReadDbToml", () => {
     );
   });
 
+  it.effect("expands env(VAR) in db.seed.sql_paths entries before supabase-prefixing", () => {
+    // Go's LoadEnvHook expands env(VAR) on every string element of db.seed.sql_paths
+    // during unmarshal, before resolve() prefixes relative patterns — so the glob is
+    // the expanded value, not the literal `supabase/env(...)`.
+    process.env["LEGACY_SEED_SQL"] = "custom/data.sql";
+    const dir = withConfig(["[db.seed]", 'sql_paths = ["env(LEGACY_SEED_SQL)"]', ""].join("\n"));
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.seed.sqlPaths).toEqual(["supabase/custom/data.sql"]);
+          delete process.env["LEGACY_SEED_SQL"];
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("honors SUPABASE_DB_SEED_ENABLED over the TOML value (Go AutomaticEnv)", () => {
+    process.env["SUPABASE_DB_SEED_ENABLED"] = "false";
+    const dir = withConfig(["[db.seed]", "enabled = true", ""].join("\n"));
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.seed.enabled).toBe(false);
+          delete process.env["SUPABASE_DB_SEED_ENABLED"];
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("expands an env() indirection in SUPABASE_DB_SEED_ENABLED (Go LoadEnvHook)", () => {
+    // Go decodes the AutomaticEnv override through LoadEnvHook before the bool parse
+    // (decode_hooks.go:15-26), so `env(SEED_ON)` resolves to SEED_ON's value rather
+    // than failing the load on a literal `env(...)` bool.
+    process.env["SUPABASE_DB_SEED_ENABLED"] = "env(SEED_ON)";
+    process.env["SEED_ON"] = "false";
+    const dir = withConfig(["[db.seed]", "enabled = true", ""].join("\n"));
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.seed.enabled).toBe(false);
+          delete process.env["SUPABASE_DB_SEED_ENABLED"];
+          delete process.env["SEED_ON"];
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("honors SUPABASE_DB_MIGRATIONS_ENABLED over the default (Go AutomaticEnv)", () => {
+    process.env["SUPABASE_DB_MIGRATIONS_ENABLED"] = "false";
+    const dir = withConfig(undefined);
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.migrationsEnabled).toBe(false);
+          delete process.env["SUPABASE_DB_MIGRATIONS_ENABLED"];
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("fails the load on a malformed SUPABASE_DB_SEED_ENABLED override", () => {
+    process.env["SUPABASE_DB_SEED_ENABLED"] = "notabool";
+    const dir = withConfig(undefined);
+    return read(dir).pipe(
+      Effect.exit,
+      Effect.tap((exit) =>
+        Effect.sync(() => {
+          expect(Exit.isFailure(exit)).toBe(true);
+          delete process.env["SUPABASE_DB_SEED_ENABLED"];
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
   it.effect(
     "expands env(VAR) for the top-level project_id (Go config.Load before Docker IDs)",
     () => {
@@ -583,10 +1159,12 @@ describe("legacyReadDbToml", () => {
     },
   );
 
-  it.effect("accepts an env-backed remote project_id that expands to a valid ref", () => {
-    // Go expands env(VAR) via LoadEnvHook before Validate checks the ref pattern
-    // (config.go:832-836), so an env-backed remote project_id is validated and
-    // merged by its resolved value.
+  it.effect("does not merge a remote block whose project_id is a TOML env() literal", () => {
+    // Go's in-load matching reads remotes.<name>.project_id via v.GetString (config.go:510),
+    // which returns the RAW literal `env(LEGACY_STAGING_REF)` — LoadEnvHook only expands it
+    // during the later UnmarshalExact. So the block is NOT selected by its expanded ref and
+    // does not merge (major_version stays the base 15), while Validate over the decoded,
+    // expanded field (config.go:909-913) still passes the load.
     process.env["LEGACY_STAGING_REF"] = "stagingrefstagingref";
     const dir = withConfig(
       [
@@ -603,7 +1181,7 @@ describe("legacyReadDbToml", () => {
     return readRef(dir, "stagingrefstagingref").pipe(
       Effect.tap((v) =>
         Effect.sync(() => {
-          expect(v.majorVersion).toBe(17); // remote block merged via the expanded ref
+          expect(v.majorVersion).toBe(15); // block not merged: matched on the raw env() literal
           delete process.env["LEGACY_STAGING_REF"];
           rmSync(dir, { recursive: true, force: true });
         }),
@@ -1239,3 +1817,439 @@ describe("legacyResolveDeclarativeDir", () => {
     }).pipe(Effect.provide(BunServices.layer)),
   );
 });
+
+describe("legacyReadDbToml auth.Enabled validation (Go config.Validate parity)", () => {
+  // Fails the config load with `message` contained in the surfaced error.
+  const failsWith = (
+    lines: ReadonlyArray<string>,
+    message: string,
+    extra?: (dir: string) => void,
+  ) =>
+    Effect.gen(function* () {
+      const dir = withConfig(lines.join("\n"));
+      if (extra) extra(dir);
+      const exit = yield* read(dir).pipe(Effect.exit);
+      expect(Exit.isFailure(exit), `expected failure containing: ${message}`).toBe(true);
+      if (Exit.isFailure(exit)) expect(JSON.stringify(exit.cause)).toContain(message);
+      rmSync(dir, { recursive: true, force: true });
+    });
+  // Loads cleanly — no validation error (the read resolves to a value).
+  const succeeds = (lines: ReadonlyArray<string>) =>
+    Effect.gen(function* () {
+      const dir = withConfig(lines.join("\n"));
+      const v = yield* read(dir);
+      expect(v.baseline).toBeDefined();
+      rmSync(dir, { recursive: true, force: true });
+    });
+
+  it.effect("rejects an explicit empty auth.site_url", () =>
+    failsWith(["[auth]", 'site_url = ""'], "Missing required field in config: auth.site_url"),
+  );
+  it.effect("defaults an absent auth.site_url (Go template default) — no error", () =>
+    succeeds(["[auth]", "enabled = true"]),
+  );
+  it.effect("skips all auth validation when auth.enabled = false", () =>
+    succeeds(["[auth]", "enabled = false", 'site_url = ""', "[auth.passkey]", "enabled = true"]),
+  );
+
+  it.effect("rejects an enabled captcha without a provider", () =>
+    failsWith(
+      ["[auth.captcha]", "enabled = true", 'secret = "x"'],
+      "Missing required field in config: auth.captcha.provider",
+    ),
+  );
+
+  // The reviewer's case: passkey enabled requires a valid [auth.webauthn].
+  it.effect("rejects passkey enabled without [auth.webauthn]", () =>
+    failsWith(
+      ["[auth.passkey]", "enabled = true"],
+      "Missing required config section: auth.webauthn (required when auth.passkey.enabled is true)",
+    ),
+  );
+  it.effect("rejects passkey enabled with webauthn missing rp_id", () =>
+    failsWith(
+      ["[auth.passkey]", "enabled = true", "[auth.webauthn]", 'rp_origins = ["http://x"]'],
+      "Missing required field in config: auth.webauthn.rp_id",
+    ),
+  );
+  it.effect("rejects passkey enabled with webauthn missing rp_origins", () =>
+    failsWith(
+      ["[auth.passkey]", "enabled = true", "[auth.webauthn]", 'rp_id = "localhost"'],
+      "Missing required field in config: auth.webauthn.rp_origins",
+    ),
+  );
+  it.effect("accepts passkey enabled with a complete [auth.webauthn]", () =>
+    succeeds([
+      "[auth.passkey]",
+      "enabled = true",
+      "[auth.webauthn]",
+      'rp_id = "localhost"',
+      'rp_origins = ["http://localhost:3000"]',
+    ]),
+  );
+
+  it.effect("rejects an http hook missing secrets", () =>
+    failsWith(
+      ["[auth.hook.send_email]", "enabled = true", 'uri = "https://example.com/hook"'],
+      "Missing required field in config: auth.hook.send_email.secrets",
+    ),
+  );
+  it.effect("rejects an http hook with a badly-formatted secret", () =>
+    failsWith(
+      [
+        "[auth.hook.send_email]",
+        "enabled = true",
+        'uri = "https://example.com/hook"',
+        'secrets = "not-a-valid-secret"',
+      ],
+      "auth.hook.send_email.secrets must be formatted as",
+    ),
+  );
+  it.effect("rejects a pg-functions hook that sets secrets", () =>
+    failsWith(
+      [
+        "[auth.hook.custom_access_token]",
+        "enabled = true",
+        'uri = "pg-functions://postgres/public/f"',
+        'secrets = "x"',
+      ],
+      "auth.hook.custom_access_token.secrets is unsupported for pg-functions URI",
+    ),
+  );
+  it.effect("rejects a hook with an unsupported URI scheme", () =>
+    failsWith(
+      ["[auth.hook.send_sms]", "enabled = true", 'uri = "ftp://example.com"'],
+      "auth.hook.send_sms.uri should be a HTTP, HTTPS, or pg-functions URI",
+    ),
+  );
+  it.effect("accepts an http hook with a valid v1,whsec_ secret", () =>
+    succeeds([
+      "[auth.hook.send_email]",
+      "enabled = true",
+      'uri = "https://example.com/hook"',
+      `secrets = "v1,whsec_${"a".repeat(40)}"`,
+    ]),
+  );
+
+  it.effect("rejects mfa totp enroll_enabled without verify_enabled", () =>
+    failsWith(
+      ["[auth.mfa.totp]", "enroll_enabled = true", "verify_enabled = false"],
+      "Invalid MFA config: auth.mfa.totp.enroll_enabled requires verify_enabled",
+    ),
+  );
+
+  it.effect("rejects an enabled smtp without a host", () =>
+    failsWith(
+      ["[auth.email.smtp]", "enabled = true", "port = 587", 'user = "u"'],
+      "Missing required field in config: auth.email.smtp.host",
+    ),
+  );
+  it.effect("rejects an email template with content but no content_path", () =>
+    failsWith(
+      ["[auth.email.template.invite]", 'content = "<h1>hi</h1>"'],
+      "Invalid config for auth.email.template.invite.content: please use content_path instead",
+    ),
+  );
+  it.effect("rejects an email template whose content_path file is missing", () =>
+    failsWith(
+      ["[auth.email.template.invite]", 'content_path = "./missing.html"'],
+      "Invalid config for auth.email.template.invite.content_path",
+    ),
+  );
+
+  it.effect("rejects an enabled twilio sms provider without account_sid", () =>
+    failsWith(
+      ["[auth.sms.twilio]", "enabled = true"],
+      "Missing required field in config: auth.sms.twilio.account_sid",
+    ),
+  );
+
+  it.effect("rejects an enabled external provider without a client_id", () =>
+    failsWith(
+      ["[auth.external.github]", "enabled = true"],
+      "Missing required field in config: auth.external.github.client_id",
+    ),
+  );
+  it.effect("exempts apple/google from the external secret requirement", () =>
+    succeeds(["[auth.external.apple]", "enabled = true", 'client_id = "a"']),
+  );
+  it.effect("never validates the deprecated linkedin/slack providers", () =>
+    succeeds(["[auth.external.linkedin]", "enabled = true"]),
+  );
+
+  it.effect("rejects an enabled firebase third_party without project_id", () =>
+    failsWith(
+      ["[auth.third_party.firebase]", "enabled = true"],
+      "auth.third_party.firebase is enabled but without a project_id.",
+    ),
+  );
+  it.effect("rejects a clerk third_party with an invalid domain", () =>
+    failsWith(
+      ["[auth.third_party.clerk]", "enabled = true", 'domain = "not-a-clerk-domain"'],
+      "auth.third_party.clerk has invalid domain",
+    ),
+  );
+  it.effect("rejects two enabled third_party providers (mutual exclusivity)", () =>
+    failsWith(
+      [
+        "[auth.third_party.firebase]",
+        "enabled = true",
+        'project_id = "p"',
+        "[auth.third_party.auth0]",
+        "enabled = true",
+        'tenant = "t"',
+      ],
+      "Only one third_party provider allowed to be enabled at a time.",
+    ),
+  );
+
+  it.effect("rejects a signing_keys_path that cannot be read", () =>
+    failsWith(["[auth]", 'signing_keys_path = "./missing.json"'], "failed to read signing keys"),
+  );
+  it.effect("rejects a signing keys file that is not valid JSON", () =>
+    failsWith(
+      ["[auth]", 'signing_keys_path = "./keys.json"'],
+      "failed to decode signing keys",
+      // A relative signing_keys_path resolves under supabase/ (Go's config.go:877-878).
+      (dir) => writeFileSync(join(dir, "supabase", "keys.json"), "{ not json"),
+    ),
+  );
+
+  // --- Follow-up parity fixes (Codex re-review) ---
+
+  it.effect("defaults [auth.email.smtp] enabled=true when the table omits enabled (Go merge)", () =>
+    failsWith(
+      ["[auth.email.smtp]", 'user = "u"'],
+      "Missing required field in config: auth.email.smtp.host",
+    ),
+  );
+  it.effect("respects an explicit [auth.email.smtp] enabled=false (no validation)", () =>
+    succeeds(["[auth.email.smtp]", "enabled = false", 'user = "u"']),
+  );
+
+  it.effect("skips auth validation when SUPABASE_AUTH_ENABLED=false (env override)", () => {
+    const previous = process.env["SUPABASE_AUTH_ENABLED"];
+    process.env["SUPABASE_AUTH_ENABLED"] = "false";
+    const dir = withConfig(
+      ["[auth]", 'site_url = ""', "[auth.passkey]", "enabled = true"].join("\n"),
+    );
+    return read(dir).pipe(
+      Effect.tap((v) => Effect.sync(() => expect(v.baseline).toBeDefined())),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_AUTH_ENABLED"];
+          else process.env["SUPABASE_AUTH_ENABLED"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("fails on a malformed auth boolean string instead of coercing to false", () =>
+    failsWith(
+      ["[auth.passkey]", 'enabled = "maybe"'],
+      "failed to parse config: invalid auth.passkey.enabled.",
+    ),
+  );
+
+  it.effect("rejects an unknown captcha provider (Go enum, regardless of enabled)", () =>
+    failsWith(
+      ["[auth.captcha]", "enabled = false", 'provider = "cloudflare"'],
+      "'auth.captcha.provider' must be one of [hcaptcha turnstile]",
+    ),
+  );
+});
+
+describe("legacyReadDbToml encrypted secret decryption (Go DecryptSecretHookFunc parity)", () => {
+  // Go decrypts every config.Secret during decode; an undecryptable `encrypted:` value
+  // anywhere in config.toml aborts `config.Load` with `failed to parse config: <error>`.
+  const expectFails = (lines: ReadonlyArray<string>, message: string) =>
+    Effect.gen(function* () {
+      const dir = withConfig(lines.join("\n"));
+      const exit = yield* read(dir).pipe(Effect.exit);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) expect(JSON.stringify(exit.cause)).toContain(message);
+      rmSync(dir, { recursive: true, force: true });
+    });
+  const expectLoads = (lines: ReadonlyArray<string>) =>
+    Effect.gen(function* () {
+      const dir = withConfig(lines.join("\n"));
+      const v = yield* read(dir);
+      expect(v.baseline).toBeDefined();
+      rmSync(dir, { recursive: true, force: true });
+    });
+
+  it.effect("fails on an undecryptable encrypted db.root_key (no private key)", () =>
+    expectFails(
+      ["[db]", 'root_key = "encrypted:anything"'],
+      "failed to parse config: missing private key",
+    ),
+  );
+  it.effect("fails on an undecryptable encrypted secret outside db.vault (auth.external)", () =>
+    expectFails(
+      [
+        "[auth.external.github]",
+        "enabled = true",
+        'client_id = "x"',
+        'secret = "encrypted:anything"',
+      ],
+      "failed to parse config: missing private key",
+    ),
+  );
+  it.effect("accepts a plain (non-encrypted) secret value", () =>
+    expectLoads(["[db]", 'root_key = "plaintext-not-encrypted"']),
+  );
+  it.effect("treats an unset env() secret as a no-op (verbatim, like Go's hook)", () =>
+    expectLoads(["[db]", 'root_key = "env(SOME_UNSET_ROOT_KEY)"']),
+  );
+});
+
+describe("legacyReadDbToml [analytics] validation (Go config.Validate parity)", () => {
+  const failsWith = (lines: ReadonlyArray<string>, message: string) =>
+    Effect.gen(function* () {
+      const dir = withConfig(lines.join("\n"));
+      const exit = yield* read(dir).pipe(Effect.exit);
+      expect(Exit.isFailure(exit), `expected failure containing: ${message}`).toBe(true);
+      if (Exit.isFailure(exit)) expect(JSON.stringify(exit.cause)).toContain(message);
+      rmSync(dir, { recursive: true, force: true });
+    });
+  const succeeds = (lines: ReadonlyArray<string>) =>
+    Effect.gen(function* () {
+      const dir = withConfig(lines.join("\n"));
+      const v = yield* read(dir);
+      expect(v.baseline).toBeDefined();
+      rmSync(dir, { recursive: true, force: true });
+    });
+
+  // `LogflareBackend.UnmarshalText` is a decode-time enum (`config.go:60-66`): it fires whenever
+  // `backend` is set, even when analytics is disabled.
+  it.effect("rejects an unknown analytics.backend regardless of enabled", () =>
+    failsWith(
+      ["[analytics]", "enabled = false", 'backend = "clickhouse"'],
+      "'analytics.backend' must be one of [postgres bigquery]",
+    ),
+  );
+  it.effect("rejects bigquery analytics missing gcp_project_id", () =>
+    failsWith(
+      ["[analytics]", "enabled = true", 'backend = "bigquery"'],
+      "Missing required field in config: analytics.gcp_project_id",
+    ),
+  );
+  it.effect("rejects bigquery analytics missing gcp_project_number", () =>
+    failsWith(
+      ["[analytics]", "enabled = true", 'backend = "bigquery"', 'gcp_project_id = "p"'],
+      "Missing required field in config: analytics.gcp_project_number",
+    ),
+  );
+  it.effect("rejects bigquery analytics missing gcp_jwt_path", () =>
+    failsWith(
+      [
+        "[analytics]",
+        "enabled = true",
+        'backend = "bigquery"',
+        'gcp_project_id = "p"',
+        'gcp_project_number = "123"',
+      ],
+      "Path to GCP Service Account Key must be provided in config, relative to config.toml: analytics.gcp_jwt_path",
+    ),
+  );
+  it.effect("accepts bigquery analytics with all three gcp fields", () =>
+    succeeds([
+      "[analytics]",
+      "enabled = true",
+      'backend = "bigquery"',
+      'gcp_project_id = "p"',
+      'gcp_project_number = "123"',
+      'gcp_jwt_path = "creds.json"',
+    ]),
+  );
+  it.effect("accepts the postgres backend without gcp fields", () =>
+    succeeds(["[analytics]", "enabled = true", 'backend = "postgres"']),
+  );
+  it.effect("accepts an absent [analytics] section (template default enabled+postgres)", () =>
+    succeeds(["[db]", "major_version = 17"]),
+  );
+  it.effect("skips the bigquery gcp checks when analytics is disabled", () =>
+    succeeds(["[analytics]", "enabled = false", 'backend = "bigquery"']),
+  );
+  it.effect("honors SUPABASE_ANALYTICS_BACKEND when validating the bigquery gcp fields", () => {
+    const previous = process.env["SUPABASE_ANALYTICS_BACKEND"];
+    process.env["SUPABASE_ANALYTICS_BACKEND"] = "bigquery";
+    return failsWith(
+      ["[analytics]", "enabled = true"],
+      "Missing required field in config: analytics.gcp_project_id",
+    ).pipe(
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_ANALYTICS_BACKEND"];
+          else process.env["SUPABASE_ANALYTICS_BACKEND"] = previous;
+        }),
+      ),
+    );
+  });
+});
+
+describe("legacyReadDbToml SUPABASE_PROJECT_ID override (Go AutomaticEnv parity)", () => {
+  const restore = (previous: string | undefined) =>
+    Effect.sync(() => {
+      if (previous === undefined) delete process.env["SUPABASE_PROJECT_ID"];
+      else process.env["SUPABASE_PROJECT_ID"] = previous;
+    });
+
+  it.effect("overrides the TOML project_id with SUPABASE_PROJECT_ID", () => {
+    const previous = process.env["SUPABASE_PROJECT_ID"];
+    process.env["SUPABASE_PROJECT_ID"] = "env-project";
+    const dir = withConfig(['project_id = "toml-project"', ""].join("\n"));
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(Option.getOrNull(v.projectId)).toBe("env-project");
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+      Effect.ensuring(restore(previous)),
+    );
+  });
+
+  it.effect("applies SUPABASE_PROJECT_ID even when config.toml is absent", () => {
+    const previous = process.env["SUPABASE_PROJECT_ID"];
+    process.env["SUPABASE_PROJECT_ID"] = "env-project";
+    const dir = withConfig(undefined);
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(Option.getOrNull(v.projectId)).toBe("env-project");
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+      Effect.ensuring(restore(previous)),
+    );
+  });
+
+  it.effect("ignores an empty SUPABASE_PROJECT_ID (viper AllowEmptyEnv=false)", () => {
+    const previous = process.env["SUPABASE_PROJECT_ID"];
+    process.env["SUPABASE_PROJECT_ID"] = "";
+    const dir = withConfig(['project_id = "toml-project"', ""].join("\n"));
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(Option.getOrNull(v.projectId)).toBe("toml-project");
+        }),
+      ),
+      Effect.ensuring(
+        Effect.sync(() => {
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+      Effect.ensuring(restore(previous)),
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-db-target-flags.ts b/apps/cli/src/legacy/shared/legacy-db-target-flags.ts
index 6bffda2a45..2f47d3c84e 100644
--- a/apps/cli/src/legacy/shared/legacy-db-target-flags.ts
+++ b/apps/cli/src/legacy/shared/legacy-db-target-flags.ts
@@ -39,7 +39,8 @@ export interface LegacyDbTargetSelection {
  * scan.
  *
  * Sources: every legacy command that calls `resolveLegacyDbTargetFlags`
- * (`db lint`, `db advisors`, `test db`) or `legacyChangedLinkedLocalFlags`
+ * (`db lint`, `db advisors`, `test db`, and the `migration` commands `list`/
+ * `repair`/`fetch`/`up`/`down`) or `legacyChangedLinkedLocalFlags`
  * (`seed buckets`, `storage cp/ls/mv/rm`), plus the shared global flags
  * (`src/shared/legacy/global-flags.ts`, `src/shared/cli/global-flags.ts`).
  * `Flag.string` / `Flag.choice` / `Flag.integer` → value-consuming;
@@ -52,6 +53,9 @@ export const VALUE_CONSUMING_LONG_FLAGS = new Set([
   "level",
   "fail-on",
   "type",
+  // migration/db credential flag — Go's `StringVarP(&dbPassword, "password", "p", …)`
+  // consumes the next token as the value (`apps/cli-go/cmd/migration.go:115,127`).
+  "password",
   // inspect report flag (StringVar, no short alias)
   "output-dir",
   // storage cp command flags (Flag.string / Flag.integer)
@@ -75,6 +79,7 @@ export const VALUE_CONSUMING_LONG_FLAGS = new Set([
 export const VALUE_CONSUMING_SHORT_FLAGS = new Set([
   "s", // --schema / -s
   "o", // --output / -o
+  "p", // --password / -p
   "j", // --jobs / -j (storage cp)
 ]);
 
diff --git a/apps/cli/src/legacy/shared/legacy-db-target-flags.unit.test.ts b/apps/cli/src/legacy/shared/legacy-db-target-flags.unit.test.ts
index 4c7b125c1e..2b32ca5ca5 100644
--- a/apps/cli/src/legacy/shared/legacy-db-target-flags.unit.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-db-target-flags.unit.test.ts
@@ -157,4 +157,31 @@ describe("resolveLegacyDbTargetFlags", () => {
     expect(result.connType).toBe("linked");
     expect(result.setFlags).toEqual(["linked"]);
   });
+
+  it("skips value token after bare -p so --local is the password value, not a target", () => {
+    // Go: `StringVarP(&dbPassword, "password", "p", …)` — `-p --local` means the
+    // password is `--local`, so `local` is not Changed (linked default applies).
+    const result = resolveLegacyDbTargetFlags(["migration", "list", "-p", "--local"]);
+    expect(result.connType).toBeUndefined();
+    expect(result.setFlags).toEqual([]);
+  });
+
+  it("skips value token after bare --password so --linked is its value, not a flag", () => {
+    const result = resolveLegacyDbTargetFlags(["--password", "--linked"]);
+    expect(result.connType).toBeUndefined();
+    expect(result.setFlags).toEqual([]);
+  });
+
+  it("-ppwd (attached short password) does NOT consume the next token", () => {
+    // Attached value: `--local` is a real selector.
+    const result = resolveLegacyDbTargetFlags(["-ppwd", "--local"]);
+    expect(result.connType).toBe("local");
+    expect(result.setFlags).toEqual(["local"]);
+  });
+
+  it("--password=pwd (attached long form) does NOT consume the next token", () => {
+    const result = resolveLegacyDbTargetFlags(["--password=pwd", "--local"]);
+    expect(result.connType).toBe("local");
+    expect(result.setFlags).toEqual(["local"]);
+  });
 });
diff --git a/apps/cli/src/legacy/shared/legacy-drop-objects.ts b/apps/cli/src/legacy/shared/legacy-drop-objects.ts
new file mode 100644
index 0000000000..523c193a12
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-drop-objects.ts
@@ -0,0 +1,162 @@
+import { Data, Effect } from "effect";
+
+import type { LegacyDbSession } from "./legacy-db-connection.service.ts";
+
+/** Dropping the user schemas failed (Go's `DropUserSchemas` error). */
+export class LegacyMigrationDropError extends Data.TaggedError("LegacyMigrationDropError")<{
+  readonly message: string;
+}> {}
+
+/**
+ * The embedded `DO $$ ... $$` block from Go's `pkg/migration/queries/drop.sql`,
+ * bundled verbatim. `migration.DropUserSchemas` runs this single statement to
+ * drop every user-created schema/extension/object in `public` and truncate the
+ * managed `auth` / `supabase_functions` / `supabase_migrations` tables.
+ */
+const LEGACY_DROP_OBJECTS_SQL = `do $$ declare
+  rec record;
+begin
+  -- schemas
+  for rec in
+    select pn.*
+    from pg_namespace pn
+    left join pg_depend pd on pd.objid = pn.oid
+    where pd.deptype is null
+      and not pn.nspname like any(array['information\\_schema', 'pg\\_%', '\\_analytics', '\\_realtime', '\\_supavisor', 'pgbouncer', 'pgmq', 'pgsodium', 'pgtle', 'supabase\\_migrations', 'vault', 'extensions', 'public'])
+      and pn.nspowner::regrole::text != 'supabase_admin'
+  loop
+    -- If an extension uses a schema it doesn't create, dropping the schema will cascade to also
+    -- drop the extension. But if an extension creates its own schema, dropping the schema will
+    -- throw an error. Hence, we drop schemas first while excluding those created by extensions.
+    raise notice 'dropping schema: %', rec.nspname;
+    execute format('drop schema if exists %I cascade', rec.nspname);
+  end loop;
+
+  -- extensions
+  for rec in
+    select *
+    from pg_extension p
+    where p.extname not in ('pg_graphql', 'pg_net', 'pg_stat_statements', 'pgcrypto', 'pgjwt', 'pgsodium', 'plpgsql', 'supabase_vault', 'uuid-ossp')
+  loop
+    raise notice 'dropping extension: %', rec.extname;
+    execute format('drop extension if exists %I cascade', rec.extname);
+  end loop;
+
+  -- functions
+  for rec in
+    select *
+    from pg_proc p
+    where p.pronamespace::regnamespace::name = 'public'
+  loop
+    -- supports aggregate, function, and procedure
+    raise notice 'dropping function: %.%', rec.pronamespace::regnamespace::name, rec.proname;
+    execute format('drop routine if exists %I.%I(%s) cascade', rec.pronamespace::regnamespace::name, rec.proname, pg_catalog.pg_get_function_identity_arguments(rec.oid));
+  end loop;
+
+  -- views (necessary for views referencing objects in Supabase-managed schemas)
+  for rec in
+    select *
+    from pg_class c
+    where
+      c.relnamespace::regnamespace::name = 'public'
+      and c.relkind = 'v'
+  loop
+    raise notice 'dropping view: %.%', rec.relnamespace::regnamespace::name, rec.relname;
+    execute format('drop view if exists %I.%I cascade', rec.relnamespace::regnamespace::name, rec.relname);
+  end loop;
+
+  -- materialized views (necessary for materialized views referencing objects in Supabase-managed schemas)
+  for rec in
+    select *
+    from pg_class c
+    where
+      c.relnamespace::regnamespace::name = 'public'
+      and c.relkind = 'm'
+  loop
+    raise notice 'dropping materialized view: %.%', rec.relnamespace::regnamespace::name, rec.relname;
+    execute format('drop materialized view if exists %I.%I cascade', rec.relnamespace::regnamespace::name, rec.relname);
+  end loop;
+
+  -- tables (cascade to dependent objects)
+  for rec in
+    select *
+    from pg_class c
+    where
+      c.relnamespace::regnamespace::name = 'public'
+      and c.relkind not in ('c', 'S', 'v', 'm')
+    order by c.relkind desc
+  loop
+    -- supports all table like relations, except views, complex types, and sequences
+    raise notice 'dropping table: %.%', rec.relnamespace::regnamespace::name, rec.relname;
+    execute format('drop table if exists %I.%I cascade', rec.relnamespace::regnamespace::name, rec.relname);
+  end loop;
+
+  -- truncate tables in auth, webhooks, and migrations schema
+  for rec in
+    select *
+    from pg_class c
+    where
+      (c.relnamespace::regnamespace::name = 'auth' and c.relname != 'schema_migrations'
+      or c.relnamespace::regnamespace::name = 'supabase_functions' and c.relname != 'migrations'
+      or c.relnamespace::regnamespace::name = 'supabase_migrations')
+      and c.relkind = 'r'
+  loop
+    raise notice 'truncating table: %.%', rec.relnamespace::regnamespace::name, rec.relname;
+    execute format('truncate %I.%I cascade', rec.relnamespace::regnamespace::name, rec.relname);
+  end loop;
+
+  -- sequences
+  for rec in
+    select *
+    from pg_class c
+    where
+      c.relnamespace::regnamespace::name = 'public'
+      and c.relkind = 's'
+  loop
+    raise notice 'dropping sequence: %.%', rec.relnamespace::regnamespace::name, rec.relname;
+    execute format('drop sequence if exists %I.%I cascade', rec.relnamespace::regnamespace::name, rec.relname);
+  end loop;
+
+  -- types
+  for rec in
+    select *
+    from pg_type t
+    where
+      t.typnamespace::regnamespace::name = 'public'
+      and typtype != 'b'
+  loop
+    raise notice 'dropping type: %.%', rec.typnamespace::regnamespace::name, rec.typname;
+    execute format('drop type if exists %I.%I cascade', rec.typnamespace::regnamespace::name, rec.typname);
+  end loop;
+
+  -- policies
+  for rec in
+    select *
+    from pg_policies p
+  loop
+    raise notice 'dropping policy: %', rec.policyname;
+    execute format('drop policy if exists %I on %I.%I cascade', rec.policyname, rec.schemaname, rec.tablename);
+  end loop;
+
+  -- publications
+  for rec in
+    select *
+    from pg_publication p
+    where
+      not p.pubname like any(array['supabase\\_realtime%', 'realtime\\_messages%'])
+  loop
+    raise notice 'dropping publication: %', rec.pubname;
+    execute format('drop publication if exists %I', rec.pubname);
+  end loop;
+end $$;
+`;
+
+/**
+ * Drops every user-created object, matching Go's `migration.DropUserSchemas`
+ * (`pkg/migration/drop.go:34`): one batched DO-block statement (a single
+ * statement is atomic in Postgres, so no explicit transaction is needed).
+ */
+export const legacyDropUserSchemas = (session: LegacyDbSession) =>
+  session
+    .exec(LEGACY_DROP_OBJECTS_SQL)
+    .pipe(Effect.mapError((cause) => new LegacyMigrationDropError({ message: cause.message })));
diff --git a/apps/cli/src/legacy/shared/legacy-migrate-and-seed.ts b/apps/cli/src/legacy/shared/legacy-migrate-and-seed.ts
new file mode 100644
index 0000000000..809af32b95
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-migrate-and-seed.ts
@@ -0,0 +1,50 @@
+import { Effect, type FileSystem, type Path } from "effect";
+
+import { Output } from "../../shared/output/output.service.ts";
+import type { LegacyDbSession } from "./legacy-db-connection.service.ts";
+import { LegacyMigrationApplyError, legacyApplyMigrationFile } from "./legacy-migration-apply.ts";
+import { legacyLoadPartialMigrations } from "./legacy-migration-history.ts";
+import { legacyApplySeedFiles, type LegacySeedConfig } from "./legacy-seed.ts";
+
+/** Config consumed by `legacyMigrateAndSeed`. */
+export interface LegacyMigrateAndSeedConfig {
+  readonly migrationsEnabled: boolean;
+  readonly seed: LegacySeedConfig;
+}
+
+/**
+ * Reapplies local migrations up to `version`, then runs seed files. Port of Go's
+ * `apply.MigrateAndSeed` (`internal/migration/apply/apply.go:16`) for the
+ * `version`-set path (the EXPERIMENTAL declarative `applySchemaFiles` branch is
+ * unreachable from `migration down`, which always passes a concrete version, so
+ * it is intentionally not ported). Migration apply is gated on
+ * `db.migrations.enabled`; seeding on `db.seed.enabled` (inside the seed helper).
+ */
+export const legacyMigrateAndSeed = (
+  session: LegacyDbSession,
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  workdir: string,
+  version: string,
+  config: LegacyMigrateAndSeedConfig,
+) =>
+  Effect.gen(function* () {
+    const output = yield* Output;
+    if (config.migrationsEnabled) {
+      const migrationsDir = path.join(workdir, "supabase", "migrations");
+      const pending = yield* legacyLoadPartialMigrations(fs, path, migrationsDir, version).pipe(
+        Effect.mapError((cause) => new LegacyMigrationApplyError({ message: cause.message })),
+      );
+      for (const migrationPath of pending) {
+        yield* output.raw(`Applying migration ${path.basename(migrationPath)}...\n`, "stderr");
+        yield* legacyApplyMigrationFile(
+          session,
+          fs,
+          path,
+          migrationPath,
+          (message) => new LegacyMigrationApplyError({ message }),
+        );
+      }
+    }
+    yield* legacyApplySeedFiles(session, fs, path, workdir, config.seed);
+  });
diff --git a/apps/cli/src/legacy/shared/legacy-migration-apply.ts b/apps/cli/src/legacy/shared/legacy-migration-apply.ts
index 2b584eb1d3..b9b376bea5 100644
--- a/apps/cli/src/legacy/shared/legacy-migration-apply.ts
+++ b/apps/cli/src/legacy/shared/legacy-migration-apply.ts
@@ -1,42 +1,98 @@
-import { Effect, type FileSystem, type Path } from "effect";
+import { Data, Effect, type FileSystem, type Path } from "effect";
 
 import type { LegacyDbSession } from "./legacy-db-connection.service.ts";
+import {
+  INSERT_MIGRATION_VERSION,
+  MIGRATE_FILE_PATTERN,
+  legacyCreateMigrationTable,
+} from "./legacy-migration-history.ts";
 import { legacySplitAndTrim } from "./legacy-sql-split.ts";
 
 /**
- * Migration-history DDL/DML, verbatim from Go's `pkg/migration/history.go`.
+ * Applying a migration file failed (Go's `ApplyMigrations` / `ExecBatch` error).
+ * Used by `migration up` and `migration down`'s migrate-and-seed step. The
+ * declarative sync handler maps its own error type instead.
  */
-const SET_LOCK_TIMEOUT = "SET lock_timeout = '4s'";
-const CREATE_VERSION_SCHEMA = "CREATE SCHEMA IF NOT EXISTS supabase_migrations";
-const CREATE_VERSION_TABLE =
-  "CREATE TABLE IF NOT EXISTS supabase_migrations.schema_migrations (version text NOT NULL PRIMARY KEY)";
-const ADD_STATEMENTS_COLUMN =
-  "ALTER TABLE supabase_migrations.schema_migrations ADD COLUMN IF NOT EXISTS statements text[]";
-const ADD_NAME_COLUMN =
-  "ALTER TABLE supabase_migrations.schema_migrations ADD COLUMN IF NOT EXISTS name text";
-const INSERT_MIGRATION_VERSION =
-  "INSERT INTO supabase_migrations.schema_migrations(version, name, statements) VALUES($1, $2, $3)";
+export class LegacyMigrationApplyError extends Data.TaggedError("LegacyMigrationApplyError")<{
+  readonly message: string;
+}> {}
 
-// `pkg/migration/file.go` — `<digits>_<name>.sql`.
-const MIGRATE_FILE_PATTERN = /^([0-9]+)_(.*)\.sql$/;
+// Byte order mark (U+FEFF) — stripped from the head of a statement like Go does.
+const BOM_CODE_POINT = 0xfeff;
 
-/** Creates the migration-history schema/table (idempotent). Go's `CreateMigrationTable`. */
-const createMigrationTable = (session: LegacyDbSession) =>
-  Effect.gen(function* () {
-    yield* session.exec(SET_LOCK_TIMEOUT);
-    yield* session.exec(CREATE_VERSION_SCHEMA);
-    yield* session.exec(CREATE_VERSION_TABLE);
-    yield* session.exec(ADD_STATEMENTS_COLUMN);
-    yield* session.exec(ADD_NAME_COLUMN);
-  });
+// Statements that PostgreSQL refuses to run inside a transaction block / extended-query
+// pipeline (SQLSTATE 25001). Ports of Go's pattern set in `pkg/migration/file.go`
+// (supabase/cli#5156). Matched against the upper-cased, comment-stripped statement.
+const CREATE_INDEX_CONCURRENTLY_PATTERN = /^CREATE\s+(?:UNIQUE\s+)?INDEX\s+CONCURRENTLY(?:\s|$)/u;
+const REINDEX_CONCURRENTLY_PATTERN = /^REINDEX(?:\s|\().*\sCONCURRENTLY(?:\s|$)/u;
+const VACUUM_PATTERN = /^VACUUM(?:\s|\(|$)/u;
+const ALTER_SYSTEM_PATTERN = /^ALTER\s+SYSTEM(?:\s|$)/u;
+const CLUSTER_PATTERN = /^CLUSTER(?:\s|$)/u;
+
+/**
+ * Strips a leading BOM, whitespace, and SQL line (`--`) and block comments from the
+ * front of a statement so the keyword check below sees the real first token.
+ * Port of Go's `trimLeadingSQLComments` (`pkg/migration/file.go`, supabase/cli#5156).
+ */
+const legacyTrimLeadingSqlComments = (sql: string): string => {
+  // Go's `TrimLeftFunc` drops a leading BOM together with whitespace; strip the BOM
+  // via its code point so no irregular whitespace lands in the source.
+  let trimmed = sql.replace(/^[ \t\n\r]+/u, "");
+  while (trimmed.charCodeAt(0) === BOM_CODE_POINT) {
+    trimmed = trimmed.slice(1).replace(/^[ \t\n\r]+/u, "");
+  }
+  for (;;) {
+    if (trimmed.startsWith("--")) {
+      const idx = trimmed.indexOf("\n");
+      if (idx < 0) return "";
+      trimmed = trimmed.slice(idx + 1).replace(/^[ \t\n\r]+/u, "");
+    } else if (trimmed.startsWith("/*")) {
+      const idx = trimmed.indexOf("*/");
+      if (idx < 0) return trimmed;
+      trimmed = trimmed.slice(idx + 2).replace(/^[ \t\n\r]+/u, "");
+    } else {
+      return trimmed.trim();
+    }
+  }
+};
+
+/**
+ * Whether a migration statement cannot run inside a transaction block — `CREATE
+ * [UNIQUE] INDEX CONCURRENTLY`, `REINDEX … CONCURRENTLY`, `VACUUM`, `ALTER SYSTEM`,
+ * `CLUSTER`. Such statements fail with SQLSTATE 25001 inside the `BEGIN`/`COMMIT`
+ * that wraps a migration, so `legacyApplyMigrationFile` runs them standalone.
+ * Port of Go's `isPipelineIncompatible` (`pkg/migration/file.go`, supabase/cli#5156).
+ */
+export const legacyIsPipelineIncompatible = (sql: string): boolean => {
+  const upper = legacyTrimLeadingSqlComments(sql).toUpperCase();
+  return (
+    CREATE_INDEX_CONCURRENTLY_PATTERN.test(upper) ||
+    REINDEX_CONCURRENTLY_PATTERN.test(upper) ||
+    VACUUM_PATTERN.test(upper) ||
+    ALTER_SYSTEM_PATTERN.test(upper) ||
+    CLUSTER_PATTERN.test(upper)
+  );
+};
+
+/** A buffered statement awaiting the next batch flush; `version` is the history insert. */
+type LegacyBatchItem =
+  | { readonly kind: "exec"; readonly sql: string }
+  | { readonly kind: "version" };
 
 /**
  * Applies a single migration file to the connected database and records it in
  * `supabase_migrations.schema_migrations`. Mirrors Go's `migration.ApplyMigrations`
- * for one file (`pkg/migration/apply.go` + `(*MigrationFile).ExecBatch`): create
- * the history table, `RESET ALL`, then run the file's statements + the history
- * insert atomically. The whole file is one transaction (Go's `ExecBatch` is
- * implicitly transactional); on failure the transaction is rolled back.
+ * for one file (`pkg/migration/apply.go` + `(*MigrationFile).ExecBatch`): `RESET ALL`
+ * first to clear any session state leaked by a prior file, then create the history
+ * table, then run the file's statements + the history insert.
+ *
+ * Statements run inside a `BEGIN`/`COMMIT` batch, except pipeline-incompatible ones
+ * (`legacyIsPipelineIncompatible` — `CREATE INDEX CONCURRENTLY`, `VACUUM`, …) which
+ * cannot run in a transaction block: the batch is flushed (committed), the statement
+ * runs standalone, then batching resumes — mirroring Go's `ExecBatch` flush logic
+ * (supabase/cli#5156). The history insert goes in the final batch, so the migration
+ * is recorded only after every statement succeeds. A file with no such statements is
+ * a single `BEGIN`/`COMMIT` around everything, identical to the pre-fix behaviour.
  *
  * `mapError` lets the caller tag the failure (e.g. `LegacyDeclarativeApplyError`).
  */
@@ -55,10 +111,15 @@ export const legacyApplyMigrationFile = <E>(
     const version = matches?.[1] ?? "";
     const name = matches?.[2] ?? "";
 
-    yield* createMigrationTable(session);
+    // `RESET ALL` runs FIRST, before the history-table DDL: an earlier migration applied
+    // on this same connection may have left a session default (e.g.
+    // `SET default_transaction_read_only = on`) that would otherwise make this DDL fail
+    // before it is cleared. Go resets connection state at the top of each file's apply,
+    // ahead of any work (`apps/cli-go/pkg/migration/apply.go:65-69`).
     yield* session.exec("RESET ALL");
-    yield* session.exec("BEGIN");
-    // Mirror Go's `MigrationFile.ExecBatch` error context (`pkg/migration/file.go:88-113`):
+    yield* legacyCreateMigrationTable(session);
+
+    // Mirror Go's `MigrationFile.ExecBatch` error context (`pkg/migration/file.go`):
     // on a failed statement, append `At statement: <index>` and the statement text so the
     // error (and the debug bundle) point at the exact failing SQL. (Go also adds a caret /
     // pgErr.Detail / extension-type hint, which need the driver SQLSTATE the session does
@@ -69,26 +130,59 @@ export const legacyApplyMigrationFile = <E>(
         : String(e);
     const atStatement = (e: unknown, index: number, stat: string) =>
       new Error(`${errMessage(e)}\nAt statement: ${index}\n${stat}`);
-    const body = Effect.gen(function* () {
-      for (let i = 0; i < statements.length; i++) {
-        const statement = statements[i] ?? "";
+
+    // `executed` is the global statement index of the next statement to run, so the
+    // error context stays accurate across flushed batches and standalone statements
+    // (Go threads the same counter through `ExecBatch`).
+    let pending: ReadonlyArray<LegacyBatchItem> = [];
+    let executed = 0;
+
+    const flushBatch = Effect.gen(function* () {
+      if (pending.length === 0) return;
+      const items = pending;
+      pending = [];
+      const base = executed;
+      const body = Effect.gen(function* () {
+        for (const [offset, item] of items.entries()) {
+          const index = base + offset;
+          if (item.kind === "version") {
+            // Go defaults to the version-insert statement when all listed statements succeed.
+            yield* session
+              .query(INSERT_MIGRATION_VERSION, [version, name, statements])
+              .pipe(
+                Effect.mapError((cause) => atStatement(cause, index, INSERT_MIGRATION_VERSION)),
+              );
+          } else {
+            yield* session
+              .exec(item.sql)
+              .pipe(Effect.mapError((cause) => atStatement(cause, index, item.sql)));
+          }
+        }
+        yield* session.exec("COMMIT");
+      });
+      yield* session.exec("BEGIN");
+      yield* body.pipe(Effect.tapError(() => session.exec("ROLLBACK").pipe(Effect.ignore)));
+      executed += items.length;
+    });
+
+    for (const statement of statements) {
+      if (legacyIsPipelineIncompatible(statement)) {
+        // Flush the open batch, then run the incompatible statement on its own (no
+        // surrounding transaction) so PostgreSQL accepts it.
+        yield* flushBatch;
+        const index = executed;
         yield* session
           .exec(statement)
-          .pipe(Effect.mapError((cause) => atStatement(cause, i, statement)));
-      }
-      if (version.length > 0) {
-        // Go defaults to the version-insert statement when all listed statements succeed.
-        yield* session
-          .query(INSERT_MIGRATION_VERSION, [version, name, statements])
-          .pipe(
-            Effect.mapError((cause) =>
-              atStatement(cause, statements.length, INSERT_MIGRATION_VERSION),
-            ),
-          );
+          .pipe(Effect.mapError((cause) => atStatement(cause, index, statement)));
+        executed += 1;
+      } else {
+        pending = [...pending, { kind: "exec", sql: statement }];
       }
-      yield* session.exec("COMMIT");
-    });
-    yield* body.pipe(Effect.tapError(() => session.exec("ROLLBACK").pipe(Effect.ignore)));
+    }
+    if (version.length > 0) {
+      pending = [...pending, { kind: "version" }];
+    }
+    yield* flushBatch;
   }).pipe(
     Effect.mapError((error) =>
       mapError(
diff --git a/apps/cli/src/legacy/shared/legacy-migration-apply.unit.test.ts b/apps/cli/src/legacy/shared/legacy-migration-apply.unit.test.ts
index c984b49e95..567be21e75 100644
--- a/apps/cli/src/legacy/shared/legacy-migration-apply.unit.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-migration-apply.unit.test.ts
@@ -6,7 +6,10 @@ import { describe, expect, it } from "@effect/vitest";
 import { Data, Effect, Exit, FileSystem, Path } from "effect";
 
 import type { LegacyDbSession } from "./legacy-db-connection.service.ts";
-import { legacyApplyMigrationFile } from "./legacy-migration-apply.ts";
+import {
+  legacyApplyMigrationFile,
+  legacyIsPipelineIncompatible,
+} from "./legacy-migration-apply.ts";
 
 class TestError extends Data.TaggedError("TestError")<{ readonly message: string }> {}
 
@@ -59,13 +62,24 @@ describe("legacyApplyMigrationFile", () => {
             const execs = calls.filter((c) => c.kind === "exec").map((c) => c.sql);
             expect(execs).toContain("CREATE SCHEMA IF NOT EXISTS supabase_migrations");
             expect(execs).toContain("RESET ALL");
-            // Statements run between BEGIN and COMMIT.
-            const begin = execs.indexOf("BEGIN");
-            const commit = execs.indexOf("COMMIT");
-            expect(begin).toBeGreaterThanOrEqual(0);
-            expect(commit).toBeGreaterThan(begin);
-            expect(execs.indexOf("ALTER TABLE a ADD COLUMN b int")).toBeGreaterThan(begin);
-            expect(execs.indexOf("CREATE INDEX i ON a(b)")).toBeLessThan(commit);
+            // The history-table setup scopes lock_timeout to its own transaction
+            // (SET LOCAL), so it reverts on COMMIT and never leaks into the migration's
+            // statements — matching Go's implicit ExecBatch transaction.
+            // RESET ALL runs FIRST — before the history-table setup transaction — so a
+            // session default leaked by a prior migration is cleared before this DDL.
+            expect(execs[0]).toBe("RESET ALL");
+            const firstBegin = execs.indexOf("BEGIN");
+            const setupCommit = execs.indexOf("COMMIT");
+            const setLocal = execs.indexOf("SET LOCAL lock_timeout = '4s'");
+            expect(firstBegin).toBe(1);
+            expect(setLocal).toBeGreaterThan(firstBegin);
+            expect(setLocal).toBeLessThan(setupCommit);
+            // The migration's own statements run in a later, separate transaction.
+            const lastBegin = execs.lastIndexOf("BEGIN");
+            const lastCommit = execs.lastIndexOf("COMMIT");
+            expect(lastBegin).toBeGreaterThan(setupCommit);
+            expect(execs.indexOf("ALTER TABLE a ADD COLUMN b int")).toBeGreaterThan(lastBegin);
+            expect(execs.indexOf("CREATE INDEX i ON a(b)")).toBeLessThan(lastCommit);
             // History insert carries version, name, and the statements array.
             const insert = calls.find((c) => c.kind === "query");
             expect(insert?.sql).toContain("supabase_migrations.schema_migrations");
@@ -103,4 +117,116 @@ describe("legacyApplyMigrationFile", () => {
       ),
     );
   });
+
+  it.effect("runs a pipeline-incompatible statement outside the surrounding transaction", () => {
+    const dir = mkdtempSync(join(tmpdir(), "legacy-apply-"));
+    const file = join(dir, "20240101120000_add_index.sql");
+    writeFileSync(
+      file,
+      "create table a (id int);\nCREATE INDEX CONCURRENTLY a_idx ON a(id);\nALTER TABLE a ENABLE ROW LEVEL SECURITY;",
+    );
+    const { session, calls } = fakeSession();
+    return run(session, file).pipe(
+      Effect.tap(() =>
+        Effect.sync(() => {
+          const execs = calls.filter((c) => c.kind === "exec").map((c) => c.sql);
+          const concurrently = "CREATE INDEX CONCURRENTLY a_idx ON a(id)";
+          expect(execs).toContain(concurrently);
+          // The CONCURRENTLY statement must not run inside an open transaction, or
+          // PostgreSQL rejects it (SQLSTATE 25001). The batch is flushed first, so the
+          // BEGIN/COMMIT counts before it must balance (no open transaction).
+          const before = execs.slice(0, execs.indexOf(concurrently));
+          expect(before.filter((s) => s === "BEGIN").length).toBe(
+            before.filter((s) => s === "COMMIT").length,
+          );
+          // The compatible statements still ran inside a transaction...
+          expect(before).toContain("BEGIN");
+          expect(before).toContain("COMMIT");
+          // ...and the trailing compatible statement reopens a transaction after it.
+          const after = execs.slice(execs.indexOf(concurrently) + 1);
+          expect(after).toContain("BEGIN");
+          expect(after.indexOf("ALTER TABLE a ENABLE ROW LEVEL SECURITY")).toBeGreaterThanOrEqual(
+            0,
+          );
+          // The migration is still recorded once every statement succeeds.
+          const insert = calls.find((c) => c.kind === "query");
+          expect(insert?.params?.[0]).toBe("20240101120000");
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("reports a pipeline-incompatible statement failure with its statement index", () => {
+    const dir = mkdtempSync(join(tmpdir(), "legacy-apply-"));
+    const file = join(dir, "20240101120000_add_index.sql");
+    writeFileSync(file, "create table a (id int);\nCREATE INDEX CONCURRENTLY a_idx ON a(id);");
+    const { session, calls } = fakeSession({ failOn: "CONCURRENTLY" });
+    return run(session, file).pipe(
+      Effect.exit,
+      Effect.tap((exit) =>
+        Effect.sync(() => {
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const msg = JSON.stringify(exit.cause);
+            // Index 1: the leading `create table a` (index 0) committed in its own batch first.
+            expect(msg).toContain("At statement: 1");
+            expect(msg).toContain("CREATE INDEX CONCURRENTLY a_idx ON a(id)");
+          }
+          // The migration version is not recorded when a statement fails.
+          expect(calls.some((c) => c.kind === "query")).toBe(false);
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+});
+
+describe("legacyIsPipelineIncompatible", () => {
+  // Mirrors Go's `TestIsPipelineIncompatible` (`pkg/migration/file_test.go`, supabase/cli#5156).
+  const cases: ReadonlyArray<readonly [string, string, boolean]> = [
+    [
+      "create index concurrently",
+      "CREATE INDEX CONCURRENTLY widgets_id_idx ON public.widgets(id)",
+      true,
+    ],
+    [
+      "create unique index concurrently",
+      "CREATE UNIQUE INDEX CONCURRENTLY widgets_id_idx ON public.widgets(id)",
+      true,
+    ],
+    [
+      "create index concurrently after comments",
+      "-- cannot run in a transaction\n/* generated */\nCREATE INDEX CONCURRENTLY widgets_id_idx ON public.widgets(id)",
+      true,
+    ],
+    ["reindex table concurrently", "REINDEX TABLE CONCURRENTLY public.widgets", true],
+    [
+      "reindex with options concurrently",
+      "REINDEX (VERBOSE) INDEX CONCURRENTLY widgets_id_idx",
+      true,
+    ],
+    ["vacuum bare", "VACUUM", true],
+    ["vacuum with options", "VACUUM (FULL, ANALYZE) public.widgets", true],
+    ["alter system", "ALTER SYSTEM SET wal_level = 'logical'", true],
+    ["cluster", "CLUSTER public.widgets USING widgets_id_idx", true],
+    [
+      "lower-case create index concurrently",
+      "create index concurrently widgets_id_idx on public.widgets(id)",
+      true,
+    ],
+    ["leading whitespace before concurrently", "   CREATE INDEX CONCURRENTLY a_idx ON a(id)", true],
+    // Negatives — compatible statements that must keep running inside the batch transaction.
+    ["plain create index", "CREATE INDEX widgets_id_idx ON public.widgets(id)", false],
+    ["create table", "create table public.widgets(id bigint primary key)", false],
+    ["reindex without concurrently", "REINDEX TABLE public.widgets", false],
+    ["vacuum-prefixed identifier", "VACUUMING analytics", false],
+    ["concurrently as a column name", "CREATE TABLE t (concurrently int)", false],
+    ["insert", "INSERT INTO public.widgets VALUES (1)", false],
+    ["cluster-prefixed identifier", "CLUSTERED", false],
+  ];
+
+  it.each(cases)("%s", (_name, sql, want) => {
+    expect(legacyIsPipelineIncompatible(sql)).toBe(want);
+  });
 });
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-migration-file.ts b/apps/cli/src/legacy/shared/legacy-migration-file.ts
similarity index 100%
rename from apps/cli/src/legacy/commands/db/shared/legacy-migration-file.ts
rename to apps/cli/src/legacy/shared/legacy-migration-file.ts
diff --git a/apps/cli/src/legacy/commands/db/shared/legacy-migration-file.unit.test.ts b/apps/cli/src/legacy/shared/legacy-migration-file.unit.test.ts
similarity index 100%
rename from apps/cli/src/legacy/commands/db/shared/legacy-migration-file.unit.test.ts
rename to apps/cli/src/legacy/shared/legacy-migration-file.unit.test.ts
diff --git a/apps/cli/src/legacy/shared/legacy-migration-history.ts b/apps/cli/src/legacy/shared/legacy-migration-history.ts
new file mode 100644
index 0000000000..2aabd4323d
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-migration-history.ts
@@ -0,0 +1,436 @@
+import { Effect, type FileSystem, Option, type Path } from "effect";
+
+import { legacyListLocalMigrations } from "../commands/db/shared/legacy-pgdelta.cache.ts";
+import { legacyBold } from "./legacy-colors.ts";
+import type { LegacyDbExecError } from "./legacy-db-connection.errors.ts";
+import type { LegacyDbSession } from "./legacy-db-connection.service.ts";
+import {
+  LEGACY_MIGRATION_VERSION_MAX,
+  legacyParseMigrationVersion,
+} from "./legacy-migration-timestamp.format.ts";
+import { LegacyMigrationsReadError } from "./legacy-migration.errors.ts";
+import { legacySplitAndTrim } from "./legacy-sql-split.ts";
+
+/**
+ * Consolidated `supabase_migrations.schema_migrations` history module — the
+ * single home for the migration-history DDL/DML and the read/reconcile helpers
+ * shared by `db diff/pull`, `migration *`, and the declarative generate/sync
+ * handlers. SQL is verbatim from Go's `pkg/migration/history.go`; the helpers
+ * port `pkg/migration/list.go`, `internal/migration/list/list.go`, and
+ * `internal/db/pull/pull.go`.
+ */
+
+// Migration-history DDL/DML, verbatim from Go's `pkg/migration/history.go`.
+// `SET LOCAL` (not bare `SET`) scopes the timeout to the wrapping transaction so it
+// reverts on `COMMIT` — reproducing Go, where `CreateMigrationTable`/`CreateSeedTable`
+// run through `pgconn.ExecBatch` (an implicit transaction whose `SET` reverts when the
+// batch ends; `history.go:32-33`, `file.go:87`). A bare session-level `SET` would leak
+// the 4s timeout into a caller's real work (e.g. `migration repair`'s TRUNCATE/UPSERT
+// or seed SQL), which Go never does.
+const SET_LOCAL_LOCK_TIMEOUT = "SET LOCAL lock_timeout = '4s'";
+const CREATE_VERSION_SCHEMA = "CREATE SCHEMA IF NOT EXISTS supabase_migrations";
+const CREATE_VERSION_TABLE =
+  "CREATE TABLE IF NOT EXISTS supabase_migrations.schema_migrations (version text NOT NULL PRIMARY KEY)";
+const ADD_STATEMENTS_COLUMN =
+  "ALTER TABLE supabase_migrations.schema_migrations ADD COLUMN IF NOT EXISTS statements text[]";
+const ADD_NAME_COLUMN =
+  "ALTER TABLE supabase_migrations.schema_migrations ADD COLUMN IF NOT EXISTS name text";
+
+/** `INSERT(version, name, statements)` — Go's `INSERT_MIGRATION_VERSION`. */
+export const INSERT_MIGRATION_VERSION =
+  "INSERT INTO supabase_migrations.schema_migrations(version, name, statements) VALUES($1, $2, $3)";
+
+/** Upsert variant used to record an already-applied migration — Go's repair UPSERT. */
+export const UPSERT_MIGRATION_VERSION =
+  "INSERT INTO supabase_migrations.schema_migrations(version, name, statements) VALUES($1, $2, $3) ON CONFLICT (version) DO UPDATE SET name = EXCLUDED.name, statements = EXCLUDED.statements";
+
+/** `DELETE ... WHERE version = ANY($1)` — Go's `DELETE_MIGRATION_VERSION` (repair reverted). */
+export const DELETE_MIGRATION_VERSION =
+  "DELETE FROM supabase_migrations.schema_migrations WHERE version = ANY($1)";
+
+/** `TRUNCATE supabase_migrations.schema_migrations` — Go's repair-all reset. */
+export const TRUNCATE_VERSION_TABLE = "TRUNCATE supabase_migrations.schema_migrations";
+
+/** `SELECT version FROM supabase_migrations.schema_migrations ORDER BY version`. */
+const LIST_MIGRATION_VERSION =
+  "SELECT version FROM supabase_migrations.schema_migrations ORDER BY version";
+
+/** Go's `SELECT_VERSION_TABLE` — full history rows for `migration fetch`. */
+const SELECT_VERSION_TABLE =
+  "SELECT version, coalesce(name, '') as name, statements FROM supabase_migrations.schema_migrations";
+
+/** `supabase_migrations.seed_files` DDL/DML — Go's seed-tracking SQL (`history.go`). */
+const CREATE_SEED_TABLE =
+  "CREATE TABLE IF NOT EXISTS supabase_migrations.seed_files (path text NOT NULL PRIMARY KEY, hash text NOT NULL)";
+export const UPSERT_SEED_FILE =
+  "INSERT INTO supabase_migrations.seed_files(path, hash) VALUES($1, $2) ON CONFLICT (path) DO UPDATE SET hash = EXCLUDED.hash";
+const SELECT_SEED_TABLE = "SELECT path, hash FROM supabase_migrations.seed_files";
+
+/** `pkg/migration/file.go` — `<digits>_<name>.sql`. */
+export const MIGRATE_FILE_PATTERN = /^([0-9]+)_(.*)\.sql$/u;
+
+/**
+ * Creates the migration-history schema/table (idempotent). Go's `CreateMigrationTable`.
+ * The setup runs in one transaction so `SET LOCAL lock_timeout` is scoped to it and
+ * reverts on `COMMIT`, matching Go's implicit `pgconn.ExecBatch` transaction; the GUC
+ * never leaks into the caller's subsequent work. A failed statement rolls back.
+ */
+export const legacyCreateMigrationTable = (session: LegacyDbSession) =>
+  Effect.gen(function* () {
+    yield* session.exec("BEGIN");
+    yield* session.exec(SET_LOCAL_LOCK_TIMEOUT);
+    yield* session.exec(CREATE_VERSION_SCHEMA);
+    yield* session.exec(CREATE_VERSION_TABLE);
+    yield* session.exec(ADD_STATEMENTS_COLUMN);
+    yield* session.exec(ADD_NAME_COLUMN);
+    yield* session.exec("COMMIT");
+  }).pipe(Effect.tapError(() => session.exec("ROLLBACK").pipe(Effect.ignore)));
+
+/**
+ * Creates the `seed_files` schema/table (idempotent). Go's `CreateSeedTable`. Same
+ * transaction-scoped `SET LOCAL lock_timeout` as `legacyCreateMigrationTable` so the
+ * timeout reverts on `COMMIT` and never leaks into the seed SQL the caller runs next.
+ */
+export const legacyCreateSeedTable = (session: LegacyDbSession) =>
+  Effect.gen(function* () {
+    yield* session.exec("BEGIN");
+    yield* session.exec(SET_LOCAL_LOCK_TIMEOUT);
+    yield* session.exec(CREATE_VERSION_SCHEMA);
+    yield* session.exec(CREATE_SEED_TABLE);
+    yield* session.exec("COMMIT");
+  }).pipe(Effect.tapError(() => session.exec("ROLLBACK").pipe(Effect.ignore)));
+
+/** A recorded seed file's path + content hash. Go's `migration.SeedFile`. */
+export interface LegacySeedRow {
+  readonly path: string;
+  readonly hash: string;
+}
+
+/**
+ * Reads `supabase_migrations.seed_files` (path → hash). Mirrors Go's
+ * `getRemoteSeeds` (`pkg/migration/seed.go:17`): a missing table (42P01) means no
+ * seeds applied yet → empty.
+ */
+export const legacyReadSeedTable = (session: LegacyDbSession) =>
+  session.query(SELECT_SEED_TABLE).pipe(
+    Effect.map((rows) =>
+      rows.map<LegacySeedRow>((row) => ({
+        path: String(row["path"] ?? ""),
+        hash: String(row["hash"] ?? ""),
+      })),
+    ),
+    Effect.catch((error) =>
+      legacyIsUndefinedTableError(error)
+        ? Effect.succeed<ReadonlyArray<LegacySeedRow>>([])
+        : Effect.fail(new LegacyMigrationsReadError({ message: error.message })),
+    ),
+  );
+
+/** The outcome of comparing remote vs local migration histories. */
+export type LegacyMigrationSync =
+  | { readonly kind: "in-sync" }
+  | { readonly kind: "missing" }
+  | { readonly kind: "conflict"; readonly suggestion: string };
+
+/**
+ * Reconciles the remote and local migration version lists. Pure port of Go's
+ * `assertRemoteInSync` two-pointer comparison (`internal/db/pull/pull.go:212-258`):
+ * versions that fail to parse as integers are skipped (Go's `Atoi` error →
+ * `continue`); any extra remote/local version is a conflict; an empty local set
+ * is `missing`; otherwise in-sync.
+ */
+export function legacyReconcileMigrations(
+  remote: ReadonlyArray<string>,
+  local: ReadonlyArray<string>,
+): LegacyMigrationSync {
+  // `LEGACY_MIGRATION_VERSION_MAX` is Go's `math.MaxInt` (int64 max) and pins the
+  // exhausted side; `legacyParseMigrationVersion` mirrors Go's `strconv.Atoi`
+  // (digits only, within int64, BigInt for exact ordering) and is shared with
+  // `migration list` so both surfaces skip the same edge-case versions.
+  const extraRemote: Array<string> = [];
+  const extraLocal: Array<string> = [];
+  let i = 0;
+  let j = 0;
+  while (i < remote.length || j < local.length) {
+    let remoteTs = LEGACY_MIGRATION_VERSION_MAX;
+    if (i < remote.length) {
+      const parsed = legacyParseMigrationVersion(remote[i]!);
+      if (parsed === undefined) {
+        i++;
+        continue;
+      }
+      remoteTs = parsed;
+    }
+    let localTs = LEGACY_MIGRATION_VERSION_MAX;
+    if (j < local.length) {
+      const parsed = legacyParseMigrationVersion(local[j]!);
+      if (parsed === undefined) {
+        j++;
+        continue;
+      }
+      localTs = parsed;
+    }
+    if (localTs < remoteTs) {
+      extraLocal.push(local[j]!);
+      j++;
+    } else if (remoteTs < localTs) {
+      extraRemote.push(remote[i]!);
+      i++;
+    } else {
+      i++;
+      j++;
+    }
+  }
+  if (extraRemote.length + extraLocal.length > 0) {
+    return { kind: "conflict", suggestion: legacySuggestMigrationRepair(extraRemote, extraLocal) };
+  }
+  if (local.length === 0) {
+    return { kind: "missing" };
+  }
+  return { kind: "in-sync" };
+}
+
+/** Go's `suggestMigrationRepair` (`internal/db/pull/pull.go:280-289`). */
+export function legacySuggestMigrationRepair(
+  extraRemote: ReadonlyArray<string>,
+  extraLocal: ReadonlyArray<string>,
+): string {
+  let result =
+    "\nMake sure your local git repo is up-to-date. If the error persists, try repairing the migration history table:\n";
+  for (const version of extraRemote) {
+    result += `${legacyBold(`supabase migration repair --status reverted ${version}`)}\n`;
+  }
+  for (const version of extraLocal) {
+    result += `${legacyBold(`supabase migration repair --status applied ${version}`)}\n`;
+  }
+  return result;
+}
+
+/**
+ * Lists the remote project's applied migration versions. Mirrors Go's
+ * `migration.ListRemoteMigrations` (`pkg/migration/list.go:18-31`): ONLY a missing
+ * history table (`pgerrcode.UndefinedTable` = `42P01`) means the remote has no
+ * migrations and returns `[]`; any other error (e.g. a malformed table missing the
+ * `version` column, `42703`) propagates rather than being silently treated as an
+ * initial pull. We match the SQLSTATE like Go; if the driver didn't surface a code,
+ * fall back to a message check that matches a missing relation but NOT a missing
+ * column.
+ */
+export const legacyListRemoteMigrations = (session: LegacyDbSession) =>
+  session.query(LIST_MIGRATION_VERSION).pipe(
+    Effect.map((rows) => rows.map((row) => String(row["version"]))),
+    Effect.catch((error) =>
+      legacyIsUndefinedTableError(error)
+        ? Effect.succeed<ReadonlyArray<string>>([])
+        : Effect.fail(new LegacyMigrationsReadError({ message: error.message })),
+    ),
+  );
+
+/** Whether a query error is Postgres `undefined_table` (42P01), matching Go's `pgerrcode.UndefinedTable`. */
+const legacyIsUndefinedTableError = (error: LegacyDbExecError): boolean => {
+  if (error.code !== undefined) return error.code === "42P01";
+  // No SQLSTATE surfaced: a relation-not-exist message counts, a column-not-exist
+  // one does not (Postgres phrases an undefined column as `column "x" does not exist`).
+  return (
+    /relation .* does not exist/iu.test(error.message) &&
+    !/column .* does not exist/iu.test(error.message)
+  );
+};
+
+/**
+ * Lists local migration file paths (sorted, init-schema skipped). Thin re-export
+ * of `legacyListLocalMigrations` so `migration` handlers reach it through this
+ * shared module rather than importing the `db`-command-scoped cache directly
+ * (keeps the command-family boundary; the `commands/db/shared` cache stays the
+ * single implementation). Mirrors Go's `migration.ListLocalMigrations`.
+ */
+export const legacyListLocalMigrationPaths = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  migrationsDir: string,
+) => legacyListLocalMigrations(fs, path, migrationsDir);
+
+/**
+ * Loads the local migration versions (the `<timestamp>` prefixes). Mirrors Go's
+ * `LoadLocalVersions` (`internal/migration/list/list.go:72`) → `ListLocalMigrations`
+ * with a version-collecting filter.
+ */
+export const legacyLoadLocalVersions = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  migrationsDir: string,
+) =>
+  legacyListLocalMigrations(fs, path, migrationsDir).pipe(
+    Effect.map((paths) =>
+      paths.flatMap((p) => {
+        const match = MIGRATE_FILE_PATTERN.exec(path.basename(p));
+        return match?.[1] !== undefined ? [match[1]] : [];
+      }),
+    ),
+  );
+
+/** Basename of a path, handling both `/` and `\` separators (keeps the helper pure). */
+const baseName = (filePath: string): string => filePath.split(/[\\/]/u).pop() ?? filePath;
+
+/** Outcome of `legacyFindPendingMigrations` — Go's `(slice, error)` as a tagged union. */
+export type LegacyPendingMigrations =
+  | { readonly kind: "pending"; readonly paths: ReadonlyArray<string> }
+  // Go's `ErrMissingLocal`: remote versions absent from the local directory.
+  | { readonly kind: "missing-local"; readonly versions: ReadonlyArray<string> }
+  // Go's `ErrMissingRemote`: out-of-order local migrations before the last remote.
+  | { readonly kind: "missing-remote"; readonly paths: ReadonlyArray<string> };
+
+/**
+ * Pure port of Go's `FindPendingMigrations` (`pkg/migration/apply.go:21`): a
+ * two-pointer walk over local paths + remote versions. Returns the pending local
+ * paths, or flags a remote version missing from local (`missing-local`) or an
+ * out-of-order local migration (`missing-remote`). `localPaths` are full paths
+ * whose basenames match `<version>_<name>.sql`; `remoteVersions` are sorted.
+ */
+export function legacyFindPendingMigrations(
+  localPaths: ReadonlyArray<string>,
+  remoteVersions: ReadonlyArray<string>,
+): LegacyPendingMigrations {
+  const unapplied: Array<string> = [];
+  const missing: Array<string> = [];
+  let i = 0;
+  let j = 0;
+  while (i < remoteVersions.length && j < localPaths.length) {
+    const remote = remoteVersions[i]!;
+    // `legacyListLocalMigrations` guarantees the basename matches the pattern.
+    const local = MIGRATE_FILE_PATTERN.exec(baseName(localPaths[j]!))?.[1] ?? "";
+    if (remote === local) {
+      i++;
+      j++;
+    } else if (remote < local) {
+      missing.push(remote);
+      i++;
+    } else {
+      // Out-of-order local migration (older than an applied remote one).
+      unapplied.push(localPaths[j]!);
+      j++;
+    }
+  }
+  // Any remote versions past the end of local are also missing.
+  if (j === localPaths.length) {
+    for (let k = i; k < remoteVersions.length; k++) missing.push(remoteVersions[k]!);
+  }
+  if (missing.length > 0) return { kind: "missing-local", versions: missing };
+  if (unapplied.length > 0) return { kind: "missing-remote", paths: unapplied };
+  return { kind: "pending", paths: localPaths.slice(remoteVersions.length) };
+}
+
+/**
+ * Loads local migration paths whose version is `<= version` (or all when
+ * `version` is empty). Mirrors Go's `list.LoadPartialMigrations`
+ * (`internal/migration/list/list.go:81`); version comparison is lexical, matching
+ * Go's `v <= version` on zero-padded timestamps.
+ */
+export const legacyLoadPartialMigrations = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  migrationsDir: string,
+  version: string,
+) =>
+  legacyListLocalMigrations(fs, path, migrationsDir).pipe(
+    Effect.map((paths) =>
+      paths.filter((p) => {
+        if (version.length === 0) return true;
+        const v = MIGRATE_FILE_PATTERN.exec(path.basename(p))?.[1];
+        return v !== undefined && v <= version;
+      }),
+    ),
+  );
+
+/** A migration's version, name, and SQL statements — Go's `migration.MigrationFile`. */
+export interface LegacyMigrationFile {
+  readonly version: string;
+  readonly name: string;
+  readonly statements: ReadonlyArray<string>;
+}
+
+/** Coerce a Postgres `text[]` column value into a string array. */
+const toStatements = (value: unknown): ReadonlyArray<string> =>
+  Array.isArray(value) ? value.map((entry) => String(entry)) : [];
+
+/**
+ * Reads the full migration-history rows (version, name, statements). Mirrors Go's
+ * `ReadMigrationTable` (`pkg/migration/history.go:46`) — used by `migration fetch`.
+ */
+export const legacyReadMigrationTable = (session: LegacyDbSession) =>
+  session.query(SELECT_VERSION_TABLE).pipe(
+    Effect.map((rows) =>
+      rows.map<LegacyMigrationFile>((row) => ({
+        version: String(row["version"] ?? ""),
+        name: String(row["name"] ?? ""),
+        statements: toStatements(row["statements"]),
+      })),
+    ),
+    Effect.mapError(
+      (error) =>
+        new LegacyMigrationsReadError({
+          message: `failed to read migration table: ${error.message}`,
+        }),
+    ),
+  );
+
+/**
+ * Resolves the local migration file for a version by globbing `<version>_*.sql`
+ * against the migrations dir. Mirrors Go's `repair.GetMigrationFile`
+ * (`internal/migration/repair/repair.go:90`): the lexically-first match, or
+ * `None` when nothing matches (the caller raises the not-found error so the
+ * exact Go message can be assembled). A missing directory is treated as no match.
+ */
+export const legacyResolveMigrationFile = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  migrationsDir: string,
+  version: string,
+): Effect.Effect<Option.Option<string>, LegacyMigrationsReadError> =>
+  fs.readDirectory(migrationsDir).pipe(
+    Effect.catchTag("PlatformError", (error) =>
+      error.reason._tag === "NotFound"
+        ? Effect.succeed<ReadonlyArray<string>>([])
+        : Effect.fail(
+            new LegacyMigrationsReadError({
+              message: `failed to glob migration files: ${error.message}`,
+            }),
+          ),
+    ),
+    Effect.map((names) => {
+      const prefix = `${version}_`;
+      const matches = names
+        .filter((name) => name.startsWith(prefix) && name.endsWith(".sql"))
+        .sort();
+      return matches.length > 0
+        ? Option.some(path.join(migrationsDir, matches[0]!))
+        : Option.none<string>();
+    }),
+  );
+
+/**
+ * Reads a migration file into its version/name/statements. Mirrors Go's
+ * `NewMigrationFromFile` (`pkg/migration/file.go:36`): split the SQL with the
+ * shared splitter and parse the version + name from the basename.
+ */
+export const legacyReadMigrationFile = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  migrationPath: string,
+): Effect.Effect<LegacyMigrationFile, LegacyMigrationsReadError> =>
+  fs.readFileString(migrationPath).pipe(
+    Effect.mapError(
+      (error) =>
+        new LegacyMigrationsReadError({
+          message: `failed to open migration file: ${error.message}`,
+        }),
+    ),
+    Effect.map((content) => {
+      const match = MIGRATE_FILE_PATTERN.exec(path.basename(migrationPath));
+      return {
+        version: match?.[1] ?? "",
+        name: match?.[2] ?? "",
+        statements: legacySplitAndTrim(content),
+      };
+    }),
+  );
diff --git a/apps/cli/src/legacy/commands/db/pull/pull.sync.unit.test.ts b/apps/cli/src/legacy/shared/legacy-migration-history.unit.test.ts
similarity index 71%
rename from apps/cli/src/legacy/commands/db/pull/pull.sync.unit.test.ts
rename to apps/cli/src/legacy/shared/legacy-migration-history.unit.test.ts
index aa5d67c805..8e61417ba1 100644
--- a/apps/cli/src/legacy/commands/db/pull/pull.sync.unit.test.ts
+++ b/apps/cli/src/legacy/shared/legacy-migration-history.unit.test.ts
@@ -1,13 +1,16 @@
 import { Effect, Exit } from "effect";
 import { describe, expect, it } from "vitest";
 
-import { LegacyDbExecError } from "../../../shared/legacy-db-connection.errors.ts";
-import type { LegacyDbSession } from "../../../shared/legacy-db-connection.service.ts";
+import { LegacyDbExecError } from "./legacy-db-connection.errors.ts";
+import type { LegacyDbSession } from "./legacy-db-connection.service.ts";
 import {
+  legacyFindPendingMigrations,
   legacyListRemoteMigrations,
   legacyReconcileMigrations,
   legacySuggestMigrationRepair,
-} from "./pull.sync.ts";
+} from "./legacy-migration-history.ts";
+
+const mig = (version: string) => `supabase/migrations/${version}_test.sql`;
 
 /** Minimal session whose `query` fails with the given error. */
 const failingSession = (error: LegacyDbExecError): LegacyDbSession => ({
@@ -122,6 +125,44 @@ describe("legacyListRemoteMigrations (suppress only undefined_table, like Go)",
   });
 });
 
+describe("legacyFindPendingMigrations (Go TestPendingMigrations / TestIgnoreVersionMismatch)", () => {
+  it("returns the local paths after the remote count when in sync", () => {
+    const local = ["0", "1", "2"].map(mig);
+    const result = legacyFindPendingMigrations(local, ["0"]);
+    expect(result).toEqual({ kind: "pending", paths: [mig("1"), mig("2")] });
+  });
+
+  it("flags out-of-order local migrations as missing-remote", () => {
+    // local [0,1,2,3], remote [0,2] → unapplied [1] (1 sits before applied 2).
+    const local = ["20221201000000", "20221201000001", "20221201000002", "20221201000003"].map(mig);
+    const result = legacyFindPendingMigrations(local, ["20221201000000", "20221201000002"]);
+    expect(result).toEqual({ kind: "missing-remote", paths: [mig("20221201000001")] });
+  });
+
+  it("flags a remote version absent from local as missing-local", () => {
+    // local [0,2], remote [0,1,2,3,4] → missing [1,3,4].
+    const local = ["20221201000000", "20221201000002"].map(mig);
+    const result = legacyFindPendingMigrations(local, [
+      "20221201000000",
+      "20221201000001",
+      "20221201000002",
+      "20221201000003",
+      "20221201000004",
+    ]);
+    expect(result).toEqual({
+      kind: "missing-local",
+      versions: ["20221201000001", "20221201000003", "20221201000004"],
+    });
+  });
+
+  it("prefers missing-local when both missing-local and missing-remote occur", () => {
+    // local [0,1,2,3], remote [2,4] → unapplied [0,1,3] but remote 4 missing → missing-local [4].
+    const local = ["20221201000000", "20221201000001", "20221201000002", "20221201000003"].map(mig);
+    const result = legacyFindPendingMigrations(local, ["20221201000002", "20221201000004"]);
+    expect(result).toEqual({ kind: "missing-local", versions: ["20221201000004"] });
+  });
+});
+
 describe("legacySuggestMigrationRepair", () => {
   it("lists reverted (remote) then applied (local) repair commands", () => {
     const out = stripAnsi(legacySuggestMigrationRepair(["111"], ["222"]));
diff --git a/apps/cli/src/legacy/shared/legacy-migration-timestamp.format.ts b/apps/cli/src/legacy/shared/legacy-migration-timestamp.format.ts
new file mode 100644
index 0000000000..ee1203597d
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-migration-timestamp.format.ts
@@ -0,0 +1,70 @@
+/**
+ * Port of Go's `utils.FormatTimestampVersion` (`internal/utils/render.go:21`):
+ * parse a `YYYYMMDDHHMMSS` migration version with the strict `time.Parse`
+ * layout `20060102150405` and reformat it as `YYYY-MM-DD HH:MM:SS`. On any parse
+ * failure Go returns the input unchanged, so non-timestamp versions (`0`, `1`,
+ * non-numeric, out-of-range dates) pass through verbatim.
+ *
+ * Pure — no Effect / service dependencies.
+ */
+export function legacyFormatTimestampVersion(version: string): string {
+  const match = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})$/u.exec(version);
+  if (match === null) return version;
+  // The regex matched, so groups 1-6 are present.
+  const yyyy = match[1]!;
+  const mm = match[2]!;
+  const dd = match[3]!;
+  const hh = match[4]!;
+  const min = match[5]!;
+  const ss = match[6]!;
+  const year = Number(yyyy);
+  const month = Number(mm);
+  const day = Number(dd);
+  const hour = Number(hh);
+  const minute = Number(min);
+  const second = Number(ss);
+  // Range-check each field, then a calendar round-trip so impossible dates
+  // (e.g. Feb 30, month 13) fall back to passthrough exactly like Go's
+  // `time.Parse`, which errors rather than normalising overflow.
+  if (month < 1 || month > 12 || day < 1 || day > 31 || hour > 23 || minute > 59 || second > 59) {
+    return version;
+  }
+  const date = new Date(Date.UTC(year, month - 1, day, hour, minute, second));
+  if (
+    date.getUTCFullYear() !== year ||
+    date.getUTCMonth() !== month - 1 ||
+    date.getUTCDate() !== day
+  ) {
+    return version;
+  }
+  return `${yyyy}-${mm}-${dd} ${hh}:${min}:${ss}`;
+}
+
+/**
+ * Go's `math.MaxInt` on a 64-bit build (== `math.MaxInt64`) — the sentinel that
+ * pins the exhausted side of a migration-version two-pointer merge.
+ */
+export const LEGACY_MIGRATION_VERSION_MAX = 9223372036854775807n;
+
+/** Go's `math.MinInt64` — `strconv.Atoi`'s lower bound (`ParseInt(s, 10, 0)`). */
+const LEGACY_MIGRATION_VERSION_MIN = -9223372036854775808n;
+
+/**
+ * Parses a migration version like Go's `strconv.Atoi` (`makeTable` /
+ * `assertRemoteInSync`): `Atoi` == `ParseInt(s, 10, 0)`, so it accepts an optional
+ * leading `+`/`-` sign and base-10 digits within the int64 range, and rejects empty,
+ * whitespace, floats, and `0x`/`0b` forms. A non-parseable or out-of-range version
+ * returns `undefined` (Go's `Atoi` error → `continue`). Signs only ever appear on
+ * malformed history rows (e.g. `-1`); Go still validates and orders them by signed
+ * int — so `migration repair -1 --status reverted` can delete that text row, and the
+ * two-pointer merge sorts `-1` before `0`. BigInt keeps the full int64 range exact:
+ * `Number` loses precision above `Number.MAX_SAFE_INTEGER` (e.g. `Number("9999999999999999")`
+ * rounds to 1e16), which would mis-order versions Go accepts.
+ */
+export const legacyParseMigrationVersion = (value: string): bigint | undefined => {
+  if (!/^[+-]?\d+$/u.test(value)) return undefined;
+  const parsed = BigInt(value);
+  return parsed > LEGACY_MIGRATION_VERSION_MAX || parsed < LEGACY_MIGRATION_VERSION_MIN
+    ? undefined
+    : parsed;
+};
diff --git a/apps/cli/src/legacy/shared/legacy-migration-timestamp.format.unit.test.ts b/apps/cli/src/legacy/shared/legacy-migration-timestamp.format.unit.test.ts
new file mode 100644
index 0000000000..75d3af5659
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-migration-timestamp.format.unit.test.ts
@@ -0,0 +1,69 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  LEGACY_MIGRATION_VERSION_MAX,
+  legacyFormatTimestampVersion,
+  legacyParseMigrationVersion,
+} from "./legacy-migration-timestamp.format.ts";
+
+describe("legacyFormatTimestampVersion", () => {
+  it("reformats a valid YYYYMMDDHHMMSS version", () => {
+    expect(legacyFormatTimestampVersion("20220727064246")).toBe("2022-07-27 06:42:46");
+  });
+
+  it("passes through short numeric versions (Go time.Parse errors → input)", () => {
+    expect(legacyFormatTimestampVersion("0")).toBe("0");
+    expect(legacyFormatTimestampVersion("1")).toBe("1");
+  });
+
+  it("passes through non-numeric versions", () => {
+    expect(legacyFormatTimestampVersion("abc")).toBe("abc");
+  });
+
+  it("passes through out-of-range months/days like Go's strict parse", () => {
+    expect(legacyFormatTimestampVersion("20221327064246")).toBe("20221327064246"); // month 13
+    expect(legacyFormatTimestampVersion("20220230000000")).toBe("20220230000000"); // Feb 30
+    expect(legacyFormatTimestampVersion("20220727256046")).toBe("20220727256046"); // hour 25
+  });
+
+  it("passes through versions that are not exactly 14 digits", () => {
+    expect(legacyFormatTimestampVersion("202207270642460")).toBe("202207270642460"); // 15 digits
+  });
+});
+
+describe("legacyParseMigrationVersion", () => {
+  it("parses a digit-only version to a BigInt", () => {
+    expect(legacyParseMigrationVersion("20220727064246")).toBe(20220727064246n);
+    expect(legacyParseMigrationVersion("0")).toBe(0n);
+  });
+
+  it("rejects non-integer versions like Go's strconv.Atoi", () => {
+    expect(legacyParseMigrationVersion("")).toBeUndefined();
+    expect(legacyParseMigrationVersion("abc")).toBeUndefined();
+    expect(legacyParseMigrationVersion(" 12")).toBeUndefined();
+    expect(legacyParseMigrationVersion("1.0")).toBeUndefined();
+    expect(legacyParseMigrationVersion("0x10")).toBeUndefined();
+    expect(legacyParseMigrationVersion("+")).toBeUndefined();
+  });
+
+  it("accepts a leading +/- sign like strconv.Atoi (for malformed history rows)", () => {
+    // Go's `Atoi` == `ParseInt(s, 10, 0)` accepts a leading sign, so `migration repair -1`
+    // can delete a malformed `-1` row and the two-pointer merge orders `-1` before `0`.
+    expect(legacyParseMigrationVersion("-1")).toBe(-1n);
+    expect(legacyParseMigrationVersion("+5")).toBe(5n);
+  });
+
+  it("accepts the full int64 range but rejects values outside it", () => {
+    // 16 digits Go accepts and surfaces as a conflict — must NOT be skipped.
+    expect(legacyParseMigrationVersion("9999999999999999")).toBe(9999999999999999n);
+    // int64 max/min parse; one beyond either bound is rejected (Go's Atoi range error).
+    expect(legacyParseMigrationVersion(LEGACY_MIGRATION_VERSION_MAX.toString())).toBe(
+      LEGACY_MIGRATION_VERSION_MAX,
+    );
+    expect(
+      legacyParseMigrationVersion((LEGACY_MIGRATION_VERSION_MAX + 1n).toString()),
+    ).toBeUndefined();
+    expect(legacyParseMigrationVersion("-9223372036854775808")).toBe(-9223372036854775808n);
+    expect(legacyParseMigrationVersion("-9223372036854775809")).toBeUndefined();
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-migration.errors.ts b/apps/cli/src/legacy/shared/legacy-migration.errors.ts
new file mode 100644
index 0000000000..1cf0340928
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-migration.errors.ts
@@ -0,0 +1,16 @@
+import { Data } from "effect";
+
+/**
+ * Listing or reading migrations failed for a reason other than the directory
+ * being absent. Byte-matches Go's `migration.ListLocalMigrations`
+ * (`apps/cli-go/pkg/migration/list.go:34-37`), which returns
+ * `"failed to read directory: " + err` for anything but `os.ErrNotExist` rather
+ * than treating an unreadable `supabase/migrations` as "no migrations".
+ *
+ * Lives in `legacy/shared/` (not the `db`-command-scoped `legacy-pgdelta.errors`)
+ * because it is raised by the shared migration-history module and consumed by
+ * both the `db` and `migration` command families.
+ */
+export class LegacyMigrationsReadError extends Data.TaggedError("LegacyMigrationsReadError")<{
+  readonly message: string;
+}> {}
diff --git a/apps/cli/src/legacy/shared/legacy-path-match.ts b/apps/cli/src/legacy/shared/legacy-path-match.ts
new file mode 100644
index 0000000000..b7dadac49b
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-path-match.ts
@@ -0,0 +1,211 @@
+/**
+ * Faithful port of Go's stdlib `path.Match` (`$GOROOT/src/path/match.go`), used
+ * by the seed-file globber to expand `[db.seed] sql_paths` exactly like the Go
+ * CLI's `config.Glob.Files` → `io/fs.Glob` → `path.Match` chain.
+ *
+ * Why a hand port instead of a JS `RegExp`: Go's glob grammar and JS regex
+ * character classes diverge — POSIX classes (`[[:alpha:]]`), `\d`/`\w`, and a
+ * leading `^` mean different things, and Go reports a malformed class as an
+ * error (`path.ErrBadPattern`) where JS would silently reinterpret it. Compiling
+ * each segment to a `RegExp` leaked those JS-only semantics; porting the
+ * algorithm keeps seed globbing byte-compatible with Go, including the
+ * malformed-pattern handling.
+ *
+ * Pure — no Effect / service dependencies. Operates on code points; Go mixes
+ * byte and rune indexing, which is equivalent for the BMP characters that occur
+ * in real seed paths.
+ */
+
+/** Mirrors Go's `path.Match` return `(matched bool, err error)`; `badPattern` ↔ `path.ErrBadPattern`. */
+export interface LegacyPathMatchResult {
+  readonly matched: boolean;
+  readonly badPattern: boolean;
+}
+
+/** Go's `path.ErrBadPattern.Error()` text, surfaced verbatim in seed glob warnings. */
+export const LEGACY_BAD_PATTERN_MESSAGE = "syntax error in pattern";
+
+const BAD_PATTERN: LegacyPathMatchResult = { matched: false, badPattern: true };
+
+/** UTF-16 width (1 or 2 code units) of a code point. */
+const runeWidth = (cp: number): number => (cp > 0xffff ? 2 : 1);
+
+interface ScanChunk {
+  readonly star: boolean;
+  readonly chunk: string;
+  readonly rest: string;
+}
+
+/** Go's `scanChunk`: the next non-`*` segment, possibly preceded by a `*`. */
+const scanChunk = (pattern: string): ScanChunk => {
+  let star = false;
+  let p = pattern;
+  while (p.length > 0 && p[0] === "*") {
+    p = p.slice(1);
+    star = true;
+  }
+  let inrange = false;
+  for (let i = 0; i < p.length; i++) {
+    const c = p[i];
+    if (c === "\\") {
+      if (i + 1 < p.length) i++;
+    } else if (c === "[") {
+      inrange = true;
+    } else if (c === "]") {
+      inrange = false;
+    } else if (c === "*" && !inrange) {
+      return { star, chunk: p.slice(0, i), rest: p.slice(i) };
+    }
+  }
+  return { star, chunk: p, rest: "" };
+};
+
+interface GetEsc {
+  readonly r: number;
+  readonly rest: string;
+  readonly bad: boolean;
+}
+
+/** Go's `getEsc`: a possibly-escaped character from inside a class. */
+const getEsc = (chunk: string): GetEsc => {
+  if (chunk.length === 0 || chunk[0] === "-" || chunk[0] === "]") {
+    return { r: 0, rest: chunk, bad: true };
+  }
+  let c = chunk;
+  if (c[0] === "\\") {
+    c = c.slice(1);
+    if (c.length === 0) return { r: 0, rest: c, bad: true };
+  }
+  const r = c.codePointAt(0)!;
+  const rest = c.slice(runeWidth(r));
+  // Go errors when the class has no closing `]` after this character.
+  return { r, rest, bad: rest.length === 0 };
+};
+
+interface MatchChunk {
+  readonly rest: string;
+  readonly ok: boolean;
+  readonly bad: boolean;
+}
+
+const BAD_CHUNK: MatchChunk = { rest: "", ok: false, bad: true };
+
+/**
+ * Go's `matchChunk`: match the all-single-char-operators `chunk` against the
+ * start of `s`. Once the match fails the loop keeps walking `chunk` (no longer
+ * reading `s`) so a malformed pattern is still reported.
+ */
+const matchChunk = (chunkIn: string, sIn: string): MatchChunk => {
+  let chunk = chunkIn;
+  let s = sIn;
+  let failed = false;
+  while (chunk.length > 0) {
+    if (!failed && s.length === 0) failed = true;
+    const op = chunk[0];
+    if (op === "[") {
+      let r = 0;
+      if (!failed) {
+        r = s.codePointAt(0)!;
+        s = s.slice(runeWidth(r));
+      }
+      chunk = chunk.slice(1);
+      let negated = false;
+      if (chunk.length > 0 && chunk[0] === "^") {
+        negated = true;
+        chunk = chunk.slice(1);
+      }
+      let match = false;
+      let nrange = 0;
+      for (;;) {
+        if (chunk.length > 0 && chunk[0] === "]" && nrange > 0) {
+          chunk = chunk.slice(1);
+          break;
+        }
+        const lo = getEsc(chunk);
+        if (lo.bad) return BAD_CHUNK;
+        chunk = lo.rest;
+        let hi = lo.r;
+        if (chunk[0] === "-") {
+          const hiEsc = getEsc(chunk.slice(1));
+          if (hiEsc.bad) return BAD_CHUNK;
+          chunk = hiEsc.rest;
+          hi = hiEsc.r;
+        }
+        if (lo.r <= r && r <= hi) match = true;
+        nrange++;
+      }
+      if (match === negated) failed = true;
+    } else if (op === "?") {
+      if (!failed) {
+        const cp = s.codePointAt(0)!;
+        if (cp === 0x2f) failed = true; // '/'
+        s = s.slice(runeWidth(cp));
+      }
+      chunk = chunk.slice(1);
+    } else if (op === "\\") {
+      chunk = chunk.slice(1);
+      if (chunk.length === 0) return BAD_CHUNK;
+      if (!failed) {
+        if (chunk[0] !== s[0]) failed = true;
+        s = s.slice(1);
+      }
+      chunk = chunk.slice(1);
+    } else {
+      if (!failed) {
+        if (chunk[0] !== s[0]) failed = true;
+        s = s.slice(1);
+      }
+      chunk = chunk.slice(1);
+    }
+  }
+  return failed ? { rest: "", ok: false, bad: false } : { rest: s, ok: true, bad: false };
+};
+
+/**
+ * Reports whether `name` matches the shell pattern `pattern`, using Go's
+ * `path.Match` semantics. `badPattern` is set (instead of throwing) when the
+ * pattern is malformed, mirroring Go's `path.ErrBadPattern`.
+ */
+export const legacyPathMatch = (pattern: string, name: string): LegacyPathMatchResult => {
+  let pat = pattern;
+  let nm = name;
+  while (pat.length > 0) {
+    const scan = scanChunk(pat);
+    pat = scan.rest;
+    if (scan.star && scan.chunk === "") {
+      // Trailing `*` matches the rest of the name unless it contains a `/`.
+      return { matched: !nm.includes("/"), badPattern: false };
+    }
+    const m = matchChunk(scan.chunk, nm);
+    if (m.bad) return BAD_PATTERN;
+    // If this is the last chunk, the name must be fully consumed; otherwise a
+    // later `*` could still match, so only accept a partial match mid-pattern.
+    if (m.ok && (m.rest.length === 0 || pat.length > 0)) {
+      nm = m.rest;
+      continue;
+    }
+    if (scan.star) {
+      // Look for a match skipping one code point at a time; `*` cannot cross `/`.
+      let advanced = false;
+      for (let i = 0; i < nm.length && nm[i] !== "/"; i++) {
+        const skip = matchChunk(scan.chunk, nm.slice(i + 1));
+        if (skip.bad) return BAD_PATTERN;
+        if (skip.ok) {
+          if (pat.length === 0 && skip.rest.length > 0) continue;
+          nm = skip.rest;
+          advanced = true;
+          break;
+        }
+      }
+      if (advanced) continue;
+    }
+    // No match: still verify the rest of the pattern is well-formed (Go does).
+    while (pat.length > 0) {
+      const tail = scanChunk(pat);
+      pat = tail.rest;
+      if (matchChunk(tail.chunk, "").bad) return BAD_PATTERN;
+    }
+    return { matched: false, badPattern: false };
+  }
+  return { matched: nm.length === 0, badPattern: false };
+};
diff --git a/apps/cli/src/legacy/shared/legacy-path-match.unit.test.ts b/apps/cli/src/legacy/shared/legacy-path-match.unit.test.ts
new file mode 100644
index 0000000000..66a849d48b
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-path-match.unit.test.ts
@@ -0,0 +1,87 @@
+import { describe, expect, it } from "@effect/vitest";
+
+import { legacyPathMatch } from "./legacy-path-match.ts";
+
+describe("legacyPathMatch", () => {
+  describe("literals and wildcards", () => {
+    it.each([
+      ["seed.sql", "seed.sql", true],
+      ["seed.sql", "seed.txt", false],
+      ["*.sql", "seed.sql", true],
+      ["*.sql", "seed.txt", false],
+      ["seed*.sql", "seed_data.sql", true],
+      ["*", "anything", true],
+      ["seed?.sql", "seed1.sql", true],
+      ["seed?.sql", "seed.sql", false],
+    ] as const)("%s ~ %s => %s", (pattern, name, expected) => {
+      expect(legacyPathMatch(pattern, name).matched).toBe(expected);
+    });
+  });
+
+  describe("`*` and `?` never cross `/` (Go's non-`/` rule)", () => {
+    it.each([
+      ["*.sql", "sub/seed.sql", false],
+      ["seed?.sql", "seed/.sql", false],
+    ] as const)("%s ~ %s => %s", (pattern, name, expected) => {
+      expect(legacyPathMatch(pattern, name).matched).toBe(expected);
+    });
+  });
+
+  describe("character classes", () => {
+    it.each([
+      ["[abc].sql", "b.sql", true],
+      ["[abc].sql", "d.sql", false],
+      ["[0-9].sql", "5.sql", true],
+      ["[0-9].sql", "x.sql", false],
+      // Negation is `^` only.
+      ["[^a].sql", "b.sql", true],
+      ["[^a].sql", "a.sql", false],
+    ] as const)("%s ~ %s => %s", (pattern, name, expected) => {
+      expect(legacyPathMatch(pattern, name).matched).toBe(expected);
+    });
+
+    it("treats a leading `!` as a literal class member, NOT negation (Go parity)", () => {
+      // Go's `path.Match` negates only with a leading `^`; `!` is an ordinary
+      // member. So `[!a]` matches `!` and `a`, and rejects anything else.
+      expect(legacyPathMatch("[!a].sql", "!.sql").matched).toBe(true);
+      expect(legacyPathMatch("[!a].sql", "a.sql").matched).toBe(true);
+      expect(legacyPathMatch("[!a].sql", "b.sql").matched).toBe(false);
+    });
+  });
+
+  describe("escapes", () => {
+    it.each([
+      ["\\*.sql", "*.sql", true],
+      ["\\*.sql", "x.sql", false],
+      ["\\[.sql", "[.sql", true],
+    ] as const)("%s ~ %s => %s", (pattern, name, expected) => {
+      expect(legacyPathMatch(pattern, name).matched).toBe(expected);
+    });
+  });
+
+  describe("malformed patterns report badPattern (Go's path.ErrBadPattern)", () => {
+    it.each([
+      "[", // unterminated class
+      "[a", // unterminated class with member
+      "[]", // empty class
+      "[^]", // empty negated class
+      "[*!#@D#", // Go's config_test.go golden case
+      "a\\", // trailing escape
+    ])("%s => badPattern", (pattern) => {
+      const result = legacyPathMatch(pattern, "x");
+      expect(result.badPattern).toBe(true);
+      expect(result.matched).toBe(false);
+    });
+
+    it("does not interpret POSIX/JS-only class syntax as a regex", () => {
+      // `[[:alpha:]]` is NOT a POSIX class. Go parses it as a normal class
+      // `[[:alph]` (members `[ : a l p h`) followed by a literal `]`, so it
+      // matches a class member char followed by `]` — never a JS `\w`-style
+      // range, and never throws.
+      expect(legacyPathMatch("[[:alpha:]]", "a]").matched).toBe(true);
+      expect(legacyPathMatch("[[:alpha:]]", "[]").matched).toBe(true);
+      expect(legacyPathMatch("[[:alpha:]]", "z]").matched).toBe(false);
+      expect(legacyPathMatch("[[:alpha:]]", "a").matched).toBe(false);
+    });
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-seed.ts b/apps/cli/src/legacy/shared/legacy-seed.ts
new file mode 100644
index 0000000000..dc67437c48
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-seed.ts
@@ -0,0 +1,230 @@
+import { createHash } from "node:crypto";
+import { Data, Effect, FileSystem, Path } from "effect";
+
+import { Output } from "../../shared/output/output.service.ts";
+import type { LegacyDbSession } from "./legacy-db-connection.service.ts";
+import {
+  legacyCreateSeedTable,
+  legacyReadSeedTable,
+  UPSERT_SEED_FILE,
+} from "./legacy-migration-history.ts";
+import { LEGACY_BAD_PATTERN_MESSAGE, legacyPathMatch } from "./legacy-path-match.ts";
+import { legacySplitAndTrim } from "./legacy-sql-split.ts";
+
+/** Applying a seed file failed (Go's `SeedData` / `ExecBatchWithCache` errors). */
+export class LegacyMigrationSeedError extends Data.TaggedError("LegacyMigrationSeedError")<{
+  readonly message: string;
+}> {}
+
+/** `[db.seed]` config: `enabled` + the (supabase-prefixed) `sql_paths` glob list. */
+export interface LegacySeedConfig {
+  readonly enabled: boolean;
+  readonly sqlPaths: ReadonlyArray<string>;
+}
+
+// Only metadata is kept during the pending scan — the decoded statements are NOT
+// retained. Go's `SeedFile` (`pkg/migration/file.go:178-182`) holds just
+// `{Path, Hash, Dirty}` and re-parses each file individually inside the apply loop
+// ("Parse each file individually to reduce memory usage", `file.go:198-203`), so a
+// large/many-file seed set never has every file's statements in memory at once.
+interface LegacyPendingSeed {
+  readonly path: string;
+  readonly hash: string;
+  readonly dirty: boolean;
+}
+
+// Go's `io/fs.hasMeta` magic-character set is `*`, `?`, `[`, and `\` (escape) —
+// `glob.go` `hasMeta`. `\` must count so a pattern whose only meta syntax is a
+// backslash escape (e.g. `foo\.sql`, `seed\*.sql`) is globbed via `legacyPathMatch`
+// (which handles the escape) instead of being treated as a literal filename and
+// missing the real file. Go applies `filepath.ToSlash` before globbing, so a `\`
+// here is always a glob escape, never a path separator.
+const hasMeta = (pattern: string): boolean => /[*?[\\]/u.test(pattern);
+
+// Go globs/reads seed paths through an OS-root-rooted `afero.NewOsFs`, where the
+// CLI's "workdir" is just `os.Chdir(workdir)` (`internal/utils/misc.go`) — which
+// only affects RELATIVE paths. An absolute `[db.seed].sql_paths` entry, preserved
+// verbatim by the config loader (`pkg/config/config.go`, gated on `!filepath.IsAbs`),
+// therefore resolves at the OS root, never under the workdir. Mirror that: only
+// join under the workdir when the path is relative (`path.join` would otherwise
+// collapse `/repo` + `/tmp/seed.sql` to `/repo/tmp/seed.sql`).
+const resolveUnderWorkdir = (path: Path.Path, workdir: string, p: string): string =>
+  path.isAbsolute(p) ? p : path.join(workdir, p);
+
+/**
+ * Resolves a single glob pattern against the workdir, returning the matched
+ * paths RELATIVE to the workdir (so `seed_files.path` stays Go-compatible).
+ * Mirrors Go's `fs.Glob`: a literal pattern returns itself iff it exists; a
+ * pattern with metacharacters lists each parent directory and matches per
+ * segment via `legacyPathMatch` (Go's `path.Match`). The caller validates the
+ * whole pattern up front, so a malformed class never reaches here.
+ */
+const globPattern = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  workdir: string,
+  pattern: string,
+): Effect.Effect<ReadonlyArray<string>> =>
+  Effect.gen(function* () {
+    if (!hasMeta(pattern)) {
+      const exists = yield* fs
+        .exists(resolveUnderWorkdir(path, workdir, pattern))
+        .pipe(Effect.orElseSucceed(() => false));
+      return exists ? [pattern] : [];
+    }
+    const slash = pattern.lastIndexOf("/");
+    const dirPattern = slash === -1 ? "" : pattern.slice(0, slash);
+    const filePattern = slash === -1 ? pattern : pattern.slice(slash + 1);
+    const dirs = hasMeta(dirPattern)
+      ? yield* globPattern(fs, path, workdir, dirPattern)
+      : [dirPattern];
+    const result: Array<string> = [];
+    for (const dir of dirs) {
+      const absDir = dir.length === 0 ? workdir : resolveUnderWorkdir(path, workdir, dir);
+      const names = yield* fs.readDirectory(absDir).pipe(Effect.orElseSucceed(() => []));
+      for (const name of names) {
+        if (legacyPathMatch(filePattern, name).matched) {
+          result.push(dir.length === 0 ? name : `${dir}/${name}`);
+        }
+      }
+    }
+    return result;
+  });
+
+/** Go's `config.Glob.Files`: glob each pattern, sort, dedup; warn on bad/no-match. */
+const resolveSeedFiles = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  workdir: string,
+  patterns: ReadonlyArray<string>,
+) =>
+  Effect.gen(function* () {
+    const output = yield* Output;
+    const seen = new Set<string>();
+    const result: Array<string> = [];
+    const unmatched: Array<string> = [];
+    for (const pattern of patterns) {
+      // Go's `fs.Glob` validates the whole pattern up front (`Match(pattern, "")`);
+      // a malformed glob is reported as `failed to glob files: <ErrBadPattern>` and
+      // contributes no matches, exactly like `Glob.Files`'s error branch.
+      if (legacyPathMatch(pattern, "").badPattern) {
+        unmatched.push(`failed to glob files: ${LEGACY_BAD_PATTERN_MESSAGE}`);
+        continue;
+      }
+      const matches = [...(yield* globPattern(fs, path, workdir, pattern))].sort();
+      if (matches.length === 0) unmatched.push(`no files matched pattern: ${pattern}`);
+      for (const match of matches) {
+        if (!seen.has(match)) {
+          seen.add(match);
+          result.push(match);
+        }
+      }
+    }
+    // Go collects all glob errors into one `errors.Join` and prints a single
+    // `WARN: <joined>` line (`config.Glob.Files` → `seed.go:37`), not one per pattern.
+    if (unmatched.length > 0) yield* output.raw(`WARN: ${unmatched.join("\n")}\n`, "stderr");
+    return result;
+  });
+
+/**
+ * Applies pending seed files, port of Go's `applySeedFiles` + `GetPendingSeeds` +
+ * `SeedData` (`internal/migration/apply/apply.go:40`, `pkg/migration/seed.go`):
+ * gated on `db.seed.enabled`; a new seed runs its statements + records its hash;
+ * a changed seed only updates the recorded hash (Go's "dirty" → skip statements);
+ * an unchanged seed is skipped entirely.
+ */
+export const legacyApplySeedFiles = (
+  session: LegacyDbSession,
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  workdir: string,
+  config: LegacySeedConfig,
+) =>
+  Effect.gen(function* () {
+    const output = yield* Output;
+    if (!config.enabled) return;
+
+    const locals = yield* resolveSeedFiles(fs, path, workdir, config.sqlPaths);
+    if (locals.length === 0) return;
+
+    const applied = new Map(
+      (yield* legacyReadSeedTable(session).pipe(
+        Effect.mapError((cause) => new LegacyMigrationSeedError({ message: cause.message })),
+      )).map((row) => [row.path, row.hash] as const),
+    );
+
+    const pending: Array<LegacyPendingSeed> = [];
+    for (const relativePath of locals) {
+      const content = yield* fs.readFile(resolveUnderWorkdir(path, workdir, relativePath)).pipe(
+        Effect.mapError(
+          (cause) =>
+            new LegacyMigrationSeedError({
+              message: `failed to open seed file: ${cause.message}`,
+            }),
+        ),
+      );
+      const hash = createHash("sha256").update(content).digest("hex");
+      const previous = applied.get(relativePath);
+      if (previous === hash) continue; // unchanged → skip entirely
+      // Keep only metadata; the statements are read + split per-file in the apply loop
+      // below (Go hashes each file up front via io.Copy in `NewSeedFile` but does not
+      // retain its contents, `file.go:184-196`).
+      pending.push({
+        path: relativePath,
+        hash,
+        dirty: previous !== undefined, // recorded but changed → only update the hash
+      });
+    }
+    if (pending.length === 0) return;
+
+    yield* legacyCreateSeedTable(session).pipe(
+      Effect.mapError(
+        (cause) =>
+          new LegacyMigrationSeedError({
+            message: `failed to create seed table: ${cause.message}`,
+          }),
+      ),
+    );
+
+    for (const seed of pending) {
+      yield* output.raw(
+        seed.dirty
+          ? `Updating seed hash to ${seed.path}...\n`
+          : `Seeding data from ${seed.path}...\n`,
+        "stderr",
+      );
+      // Read + split this seed's statements here (not up front) so only one file's
+      // statements are in memory at a time, matching Go's `ExecBatchWithCache` →
+      // `parseFile` inside the apply loop (`file.go:198-203`). A dirty seed only
+      // updates its recorded hash, so Go never re-reads it — skip the read.
+      const statements = seed.dirty
+        ? []
+        : legacySplitAndTrim(
+            new TextDecoder().decode(
+              yield* fs.readFile(resolveUnderWorkdir(path, workdir, seed.path)).pipe(
+                Effect.mapError(
+                  (cause) =>
+                    new LegacyMigrationSeedError({
+                      message: `failed to open seed file: ${cause.message}`,
+                    }),
+                ),
+              ),
+            ),
+          );
+      const txn = Effect.gen(function* () {
+        yield* session.exec("BEGIN");
+        if (!seed.dirty) {
+          for (const statement of statements) yield* session.exec(statement);
+        }
+        yield* session.query(UPSERT_SEED_FILE, [seed.path, seed.hash]);
+        yield* session.exec("COMMIT");
+      });
+      yield* txn.pipe(
+        Effect.tapError(() => session.exec("ROLLBACK").pipe(Effect.ignore)),
+        Effect.mapError(
+          (cause) =>
+            new LegacyMigrationSeedError({ message: `failed to send batch: ${cause.message}` }),
+        ),
+      );
+    }
+  });
diff --git a/apps/cli/src/legacy/shared/legacy-seed.unit.test.ts b/apps/cli/src/legacy/shared/legacy-seed.unit.test.ts
new file mode 100644
index 0000000000..671d5ea5f7
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-seed.unit.test.ts
@@ -0,0 +1,81 @@
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, FileSystem, Layer, Path } from "effect";
+
+import { mockOutput } from "../../../tests/helpers/mocks.ts";
+import type { LegacyDbSession } from "./legacy-db-connection.service.ts";
+import { legacyApplySeedFiles } from "./legacy-seed.ts";
+
+function fakeSession() {
+  const queries: Array<{ sql: string; params?: ReadonlyArray<unknown> }> = [];
+  const session: LegacyDbSession = {
+    exec: () => Effect.void,
+    query: (sql, params) =>
+      Effect.sync(() => {
+        queries.push({ sql, params });
+        return [];
+      }),
+    extensionExists: () => Effect.succeed(false),
+    copyToCsv: () => Effect.succeed(new Uint8Array()),
+    queryRaw: () => Effect.succeed({ fields: [], rows: [], commandTag: "" }),
+  };
+  return { session, queries };
+}
+
+const run = (
+  session: LegacyDbSession,
+  workdir: string,
+  sqlPaths: ReadonlyArray<string>,
+  out: ReturnType<typeof mockOutput>,
+) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    return yield* legacyApplySeedFiles(session, fs, path, workdir, { enabled: true, sqlPaths });
+  }).pipe(Effect.provide(Layer.mergeAll(BunServices.layer, out.layer)));
+
+describe("legacyApplySeedFiles seed glob", () => {
+  it.effect("treats a backslash escape as a glob metacharacter (matches the real file)", () => {
+    // Go's `io/fs.hasMeta` counts `\` (escape), so `seed\.sql` globs via path.Match
+    // and matches the literal `seed.sql` — not a file named `seed\.sql`.
+    const dir = mkdtempSync(join(tmpdir(), "legacy-seed-"));
+    writeFileSync(join(dir, "seed.sql"), "insert into t values (1);");
+    const { session, queries } = fakeSession();
+    const out = mockOutput();
+    return run(session, dir, ["seed\\.sql"], out).pipe(
+      Effect.tap(() =>
+        Effect.sync(() => {
+          // The seed file was found and recorded under its clean path.
+          const upsert = queries.find((q) =>
+            q.sql.includes("INSERT INTO supabase_migrations.seed_files"),
+          );
+          expect(upsert?.params?.[0]).toBe("seed.sql");
+          expect(out.rawChunks.map((c) => c.text)).toContain("Seeding data from seed.sql...\n");
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("warns (no match) when a backslash-escaped pattern's literal file is absent", () => {
+    // `missing\.sql` escapes to the literal `missing.sql`; with no such file it matches
+    // nothing and Go emits a single `no files matched pattern` warning.
+    const dir = mkdtempSync(join(tmpdir(), "legacy-seed-"));
+    const { session, queries } = fakeSession();
+    const out = mockOutput();
+    return run(session, dir, ["missing\\.sql"], out).pipe(
+      Effect.tap(() =>
+        Effect.sync(() => {
+          expect(queries.some((q) => q.sql.includes("seed_files"))).toBe(false);
+          expect(out.rawChunks.map((c) => c.text).join("")).toContain(
+            "no files matched pattern: missing\\.sql",
+          );
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-vault-decrypt.ts b/apps/cli/src/legacy/shared/legacy-vault-decrypt.ts
new file mode 100644
index 0000000000..5c1c0d53d2
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-vault-decrypt.ts
@@ -0,0 +1,101 @@
+import { Buffer } from "node:buffer";
+import { decrypt, PrivateKey } from "eciesjs";
+
+/**
+ * dotenvx vault-secret decryption — a port of Go's `config.Secret.Decrypt`
+ * (`apps/cli-go/pkg/config/secret.go:30-73`). Go decrypts with
+ * `github.com/ecies/go/v2`: ECIES over secp256k1 (uncompressed ephemeral key,
+ * HKDF-SHA256 with no salt/info, AES-256-GCM with a 16-byte nonce). dotenvx
+ * itself encrypts with the JS `eciesjs` library, whose defaults match that wire
+ * format byte-for-byte, so we decrypt with `eciesjs` here. Validated against
+ * Go's test vector (`pkg/config/secret_test.go`).
+ *
+ * Go runs this inside `config.Load` (the `DecryptSecretHookFunc` decode hook),
+ * so an `encrypted:` value that cannot be decrypted aborts the whole command
+ * with `failed to parse config: <error>` — it is never silently skipped. The
+ * caller maps a non-`ok` result into that error.
+ */
+
+/** Go's `ENCRYPTED_PREFIX` (`secret.go:28`). */
+const ENCRYPTED_PREFIX = "encrypted:";
+/** Go's `PRIVATE_KEY_PREFIX` (`secret.go:75`). */
+const PRIVATE_KEY_ENV_PREFIX = "DOTENV_PRIVATE_KEY";
+/** Standard base64 alphabet (Go's `base64.StdEncoding`), optional `=` padding. */
+const STD_BASE64_PATTERN = /^[A-Za-z0-9+/]*={0,2}$/u;
+
+/** Whether a `[db.vault]` value is a dotenvx ciphertext (Go's `ENCRYPTED_PREFIX`). */
+export const legacyIsEncryptedSecret = (value: string): boolean =>
+  value.startsWith(ENCRYPTED_PREFIX);
+
+/**
+ * Collects dotenvx private keys from the environment, mirroring Go's env scan
+ * (`secret.go:77-85`): every `DOTENV_PRIVATE_KEY` or `DOTENV_PRIVATE_KEY_*`
+ * variable, comma-split (Go's `strToArr`, empties dropped). The decrypt loop
+ * tries each key until one succeeds, so enumeration order only matters when more
+ * than one distinct key could decrypt the same ciphertext (not a real scenario).
+ */
+export function legacyCollectDotenvPrivateKeys(
+  env: Record<string, string | undefined>,
+): ReadonlyArray<string> {
+  const keys: Array<string> = [];
+  for (const [name, value] of Object.entries(env)) {
+    if (value === undefined) continue;
+    if (name === PRIVATE_KEY_ENV_PREFIX || name.startsWith(`${PRIVATE_KEY_ENV_PREFIX}_`)) {
+      for (const key of value.split(",")) {
+        if (key.length > 0) keys.push(key);
+      }
+    }
+  }
+  return keys;
+}
+
+/** Decrypt outcome — plaintext on success, else Go's error message. */
+export type LegacyDecryptedSecret =
+  | { readonly ok: true; readonly value: string }
+  | { readonly ok: false; readonly error: string };
+
+const errorMessage = (cause: unknown): string =>
+  cause instanceof Error ? cause.message : String(cause);
+
+/** Go's per-key `decrypt` (`secret.go:52-73`): hex key → base64 payload → ECIES. */
+function decryptWithKey(keyHex: string, encryptedValue: string): LegacyDecryptedSecret {
+  if (keyHex.length === 0) return { ok: false, error: "missing private key" };
+  let privateKeyHex: string;
+  try {
+    privateKeyHex = PrivateKey.fromHex(keyHex).toHex();
+  } catch (cause) {
+    return { ok: false, error: `failed to hex decode private key: ${errorMessage(cause)}` };
+  }
+  const encoded = encryptedValue.slice(ENCRYPTED_PREFIX.length);
+  // Node's `Buffer.from(s, "base64")` silently drops invalid characters, unlike
+  // Go's `base64.StdEncoding.DecodeString`, so reject malformed input explicitly.
+  if (!STD_BASE64_PATTERN.test(encoded) || encoded.length % 4 !== 0) {
+    return { ok: false, error: "failed to base64 decode secret: invalid base64 data" };
+  }
+  try {
+    // eciesjs returns a Uint8Array; wrap in Buffer before decoding the plaintext.
+    const plaintext = Buffer.from(decrypt(privateKeyHex, Buffer.from(encoded, "base64")));
+    return { ok: true, value: plaintext.toString("utf8") };
+  } catch (cause) {
+    return { ok: false, error: `failed to decrypt secret: ${errorMessage(cause)}` };
+  }
+}
+
+/**
+ * Decrypts a dotenvx `encrypted:` secret — a port of Go's `Secret.Decrypt`
+ * (`secret.go:30-46`): with no keys, `missing private key`; otherwise try each
+ * key, the first success wins, and on total failure return the last key's error.
+ */
+export function legacyDecryptSecret(
+  encryptedValue: string,
+  keys: ReadonlyArray<string>,
+): LegacyDecryptedSecret {
+  if (keys.length === 0) return { ok: false, error: "missing private key" };
+  let lastError = "missing private key";
+  for (const keyHex of keys) {
+    const attempt = decryptWithKey(keyHex, encryptedValue);
+    if (attempt.ok) return attempt;
+    lastError = attempt.error;
+  }
+  return { ok: false, error: lastError };
+}
diff --git a/apps/cli/src/legacy/shared/legacy-vault-decrypt.unit.test.ts b/apps/cli/src/legacy/shared/legacy-vault-decrypt.unit.test.ts
new file mode 100644
index 0000000000..60a7037af9
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-vault-decrypt.unit.test.ts
@@ -0,0 +1,91 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  legacyCollectDotenvPrivateKeys,
+  legacyDecryptSecret,
+  legacyIsEncryptedSecret,
+} from "./legacy-vault-decrypt.ts";
+
+// Go's test vector — `apps/cli-go/pkg/config/secret_test.go:9-19`. The same
+// keypair/ciphertext must decrypt identically here, proving `eciesjs`
+// cross-decrypts `github.com/ecies/go/v2`'s output.
+const PRIVATE_KEY = "7fd7210cef8f331ee8c55897996aaaafd853a2b20a4dc73d6d75759f65d2a7eb";
+const ENCRYPTED_VALUE =
+  "encrypted:BKiXH15AyRzeohGyUrmB6cGjSklCrrBjdesQlX1VcXo/Xp20Bi2gGZ3AlIqxPQDmjVAALnhZamKnuY73l8Dz1P+BYiZUgxTSLzdCvdYUyVbNekj2UudbdUizBViERtZkuQwZHIv/";
+const WRONG_KEY = "11".repeat(32);
+
+describe("legacyIsEncryptedSecret", () => {
+  it("matches only the leading encrypted: prefix", () => {
+    expect(legacyIsEncryptedSecret(ENCRYPTED_VALUE)).toBe(true);
+    expect(legacyIsEncryptedSecret("encrypted:anything")).toBe(true);
+    // Must START with the prefix — a value that merely contains it is not encrypted.
+    expect(legacyIsEncryptedSecret("not-encrypted:value")).toBe(false);
+    expect(legacyIsEncryptedSecret("plain")).toBe(false);
+  });
+});
+
+describe("legacyDecryptSecret", () => {
+  it("decrypts Go's test vector to the expected plaintext", () => {
+    const result = legacyDecryptSecret(ENCRYPTED_VALUE, [PRIVATE_KEY]);
+    expect(result).toEqual({ ok: true, value: "value" });
+  });
+
+  it("tries each key and the first working one wins", () => {
+    const result = legacyDecryptSecret(ENCRYPTED_VALUE, [WRONG_KEY, PRIVATE_KEY]);
+    expect(result).toEqual({ ok: true, value: "value" });
+  });
+
+  it("fails with 'missing private key' when no keys are available", () => {
+    expect(legacyDecryptSecret(ENCRYPTED_VALUE, [])).toEqual({
+      ok: false,
+      error: "missing private key",
+    });
+  });
+
+  it("fails with a hex-decode error for a non-hex key", () => {
+    const result = legacyDecryptSecret(ENCRYPTED_VALUE, ["nothex"]);
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.error).toContain("failed to hex decode private key:");
+  });
+
+  it("fails with a decrypt error for a valid but wrong key", () => {
+    const result = legacyDecryptSecret(ENCRYPTED_VALUE, [WRONG_KEY]);
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.error).toContain("failed to decrypt secret:");
+  });
+
+  it("fails with a base64 error for malformed ciphertext", () => {
+    const result = legacyDecryptSecret("encrypted:not valid base64!", [PRIVATE_KEY]);
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.error).toContain("failed to base64 decode secret:");
+  });
+
+  it("returns the last key's error when every key fails", () => {
+    // Wrong-but-valid key decrypt-fails, then the non-hex key hex-fails last.
+    const result = legacyDecryptSecret(ENCRYPTED_VALUE, [WRONG_KEY, "nothex"]);
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.error).toContain("failed to hex decode private key:");
+  });
+});
+
+describe("legacyCollectDotenvPrivateKeys", () => {
+  it("collects DOTENV_PRIVATE_KEY and DOTENV_PRIVATE_KEY_* values, comma-split", () => {
+    const keys = legacyCollectDotenvPrivateKeys({
+      DOTENV_PRIVATE_KEY: "aa,bb",
+      DOTENV_PRIVATE_KEY_PRODUCTION: "cc",
+      DOTENV_PUBLIC_KEY: "ignored",
+      PATH: "/usr/bin",
+      EMPTY: undefined,
+    });
+    expect(keys).toEqual(["aa", "bb", "cc"]);
+  });
+
+  it("requires the underscore for the prefixed form and drops empty entries", () => {
+    const keys = legacyCollectDotenvPrivateKeys({
+      // No underscore after the prefix → not a private-key var (Go requires `_`).
+      DOTENV_PRIVATE_KEYX: "nope",
+      DOTENV_PRIVATE_KEY: ",,",
+    });
+    expect(keys).toEqual([]);
+  });
+});
diff --git a/apps/cli/src/legacy/shared/legacy-vault.ts b/apps/cli/src/legacy/shared/legacy-vault.ts
new file mode 100644
index 0000000000..16534f8227
--- /dev/null
+++ b/apps/cli/src/legacy/shared/legacy-vault.ts
@@ -0,0 +1,71 @@
+import { Data, Effect } from "effect";
+
+import { Output } from "../../shared/output/output.service.ts";
+import type { LegacyDbSession } from "./legacy-db-connection.service.ts";
+
+/** Reading or updating `vault.secrets` failed (Go's `UpsertVaultSecrets` errors). */
+export class LegacyMigrationVaultError extends Data.TaggedError("LegacyMigrationVaultError")<{
+  readonly message: string;
+}> {}
+
+/** A resolved `[db.vault]` secret. `resolved` mirrors Go's `len(SHA256) > 0` gate. */
+export interface LegacyVaultSecret {
+  readonly name: string;
+  readonly value: string;
+  readonly resolved: boolean;
+}
+
+const READ_VAULT_KV = "SELECT id, name FROM vault.secrets WHERE name = ANY($1)";
+const UPDATE_VAULT_KV = "SELECT vault.update_secret($1, $2)";
+const CREATE_VAULT_KV = "SELECT vault.create_secret($1, $2)";
+
+/**
+ * Upserts `[db.vault]` secrets into `vault.secrets`. Port of Go's
+ * `vault.UpsertVaultSecrets` (`pkg/vault/batch.go:25`): only resolved secrets
+ * (Go gates on a non-empty SHA256) are processed; existing names are updated by
+ * id, the rest are created. No resolved secrets → no-op (no DB round-trip).
+ */
+export const legacyUpsertVaultSecrets = (
+  session: LegacyDbSession,
+  secrets: ReadonlyArray<LegacyVaultSecret>,
+) =>
+  Effect.gen(function* () {
+    const output = yield* Output;
+    const resolved = secrets.filter((secret) => secret.resolved);
+    if (resolved.length === 0) return;
+
+    yield* output.raw("Updating vault secrets...\n", "stderr");
+
+    const existing = yield* session
+      .query(READ_VAULT_KV, [resolved.map((secret) => secret.name)])
+      .pipe(
+        Effect.mapError(
+          (cause) =>
+            new LegacyMigrationVaultError({ message: `failed to read vault: ${cause.message}` }),
+        ),
+      );
+    const existingByName = new Map(
+      existing.map((row) => [String(row["name"]), String(row["id"])] as const),
+    );
+
+    // One transaction, mirroring Go's implicitly-transactional `SendBatch`.
+    const batch = Effect.gen(function* () {
+      yield* session.exec("BEGIN");
+      for (const secret of resolved) {
+        const id = existingByName.get(secret.name);
+        if (id !== undefined) {
+          yield* session.query(UPDATE_VAULT_KV, [id, secret.value]);
+        } else {
+          yield* session.query(CREATE_VAULT_KV, [secret.value, secret.name]);
+        }
+      }
+      yield* session.exec("COMMIT");
+    });
+    yield* batch.pipe(
+      Effect.tapError(() => session.exec("ROLLBACK").pipe(Effect.ignore)),
+      Effect.mapError(
+        (cause) =>
+          new LegacyMigrationVaultError({ message: `failed to update vault: ${cause.message}` }),
+      ),
+    );
+  });
diff --git a/apps/cli/src/shared/legacy/global-flags.ts b/apps/cli/src/shared/legacy/global-flags.ts
index c30423b810..68b7b111f5 100644
--- a/apps/cli/src/shared/legacy/global-flags.ts
+++ b/apps/cli/src/shared/legacy/global-flags.ts
@@ -1,7 +1,7 @@
 import { Effect } from "effect";
 import { Flag, GlobalFlag } from "effect/unstable/cli";
 
-import { legacyViperEnvBool } from "./legacy-viper-env.ts";
+import { legacyViperBool, legacyViperEnvBool } from "./legacy-viper-env.ts";
 
 // The Effect CLI hoists global flags out of the token stream before the leaf
 // parse and builds ONE tree-wide registry, so a command cannot redeclare an
@@ -107,6 +107,23 @@ export const legacyResolveYes = Effect.gen(function* () {
   return flag || legacyViperEnvBool("SUPABASE_YES");
 });
 
+/**
+ * `--yes` resolved with the project `.env` consulted too, for commands that load the nested
+ * project env before prompting (`migration down`, `migration repair --all`). Go runs
+ * `loadNestedEnv` — which `os.Setenv`s each project-.env key — inside `ParseDatabaseConfig`
+ * before `PromptYesNo` reads `viper.GetBool("YES")` (`pkg/config/config.go:701`,
+ * `internal/utils/console.go:71`), so a `SUPABASE_YES` set only in `supabase/.env`
+ * auto-confirms. The shell env still wins over the file value. `projectEnv` is the loaded map
+ * from `legacyLoadProjectEnv`.
+ */
+export const legacyResolveYesWithProjectEnv = (projectEnv: Record<string, string>) =>
+  Effect.gen(function* () {
+    const flag = yield* LegacyYesFlag;
+    return (
+      flag || legacyViperEnvBool("SUPABASE_YES") || legacyViperBool(projectEnv["SUPABASE_YES"])
+    );
+  });
+
 /**
  * `--experimental` resolved with Go's viper `AutomaticEnv` fallback: the gate in
  * `rootCmd.PersistentPreRunE` reads `viper.GetBool("EXPERIMENTAL")`
diff --git a/apps/cli/src/shared/legacy/legacy-viper-env.ts b/apps/cli/src/shared/legacy/legacy-viper-env.ts
index a3d6fd4a68..ec5db179f6 100644
--- a/apps/cli/src/shared/legacy/legacy-viper-env.ts
+++ b/apps/cli/src/shared/legacy/legacy-viper-env.ts
@@ -25,8 +25,12 @@
 
 const LEGACY_VIPER_TRUE = new Set(["1", "t", "T", "TRUE", "true", "True"]);
 
-/** `viper.GetBool` for a single `SUPABASE_*` env var (see module doc). */
-export function legacyViperEnvBool(name: string): boolean {
-  const raw = process.env[name];
+/** `viper.GetBool` truthiness for an already-resolved env value (see module doc). */
+export function legacyViperBool(raw: string | undefined): boolean {
   return raw !== undefined && LEGACY_VIPER_TRUE.has(raw);
 }
+
+/** `viper.GetBool` for a single `SUPABASE_*` env var read from `process.env` (see module doc). */
+export function legacyViperEnvBool(name: string): boolean {
+  return legacyViperBool(process.env[name]);
+}
diff --git a/apps/cli/src/shared/runtime/stdin.layer.ts b/apps/cli/src/shared/runtime/stdin.layer.ts
index aec68b5731..88edf43ea3 100644
--- a/apps/cli/src/shared/runtime/stdin.layer.ts
+++ b/apps/cli/src/shared/runtime/stdin.layer.ts
@@ -1,4 +1,4 @@
-import { Effect, Layer, Option, Stdio, Stream } from "effect";
+import { Duration, Effect, Layer, Option, Stdio, Stream } from "effect";
 
 import { Tty } from "./tty.service.ts";
 import { Stdin } from "./stdin.service.ts";
@@ -30,9 +30,32 @@ const makeStdin = Effect.gen(function* () {
     return Option.some(bytes);
   }).pipe(Effect.orElseSucceed(() => Option.none<Uint8Array>()));
 
+  // Read one line (up to the first newline), trimmed, bounded by `timeoutMillis`.
+  // Mirrors Go's `Console.ReadLine` (`internal/utils/console.go:38-61`); `Stream.take(1)`
+  // stops at the first line so an interactive TTY isn't drained to EOF. A timeout, EOF,
+  // or read error all collapse to `None` (Go returns "" — i.e. the default — for each).
+  const readLine = (timeoutMillis: number): Effect.Effect<Option.Option<string>> =>
+    stdio.stdin.pipe(
+      Stream.decodeText(),
+      Stream.splitLines,
+      Stream.take(1),
+      Stream.runHead,
+      Effect.map(Option.map((line) => line.trim())),
+      Effect.timeoutOption(Duration.millis(timeoutMillis)),
+      Effect.map(Option.flatten),
+      Effect.orElseSucceed(() => Option.none<string>()),
+    );
+
+  // Stream piped stdin without collecting it (constant memory). Read errors PROPAGATE on
+  // the error channel (unlike `readPipedBytes`'s `orElseSucceed(none)` swallow): Go's
+  // `io.Copy` returns `failed to copy from stdin` and exits non-zero rather than writing a
+  // truncated migration file, so the streaming consumer must surface the failure.
+  const pipedBytesStream = stdio.stdin;
+
   return Stdin.of({
     isTTY: tty.stdinIsTty,
     readPipedBytes,
+    pipedBytesStream,
     readPipedText: readPipedBytes.pipe(
       Effect.map((bytes) => {
         if (Option.isNone(bytes)) {
@@ -42,6 +65,7 @@ const makeStdin = Effect.gen(function* () {
         return text ? Option.some(text) : Option.none<string>();
       }),
     ),
+    readLine,
   });
 });
 
diff --git a/apps/cli/src/shared/runtime/stdin.service.ts b/apps/cli/src/shared/runtime/stdin.service.ts
index e29e776ae7..822c92baed 100644
--- a/apps/cli/src/shared/runtime/stdin.service.ts
+++ b/apps/cli/src/shared/runtime/stdin.service.ts
@@ -1,10 +1,30 @@
-import type { Effect, Option } from "effect";
+import type { Effect, Option, Stream } from "effect";
 import { Context } from "effect";
+import type { PlatformError } from "effect/PlatformError";
 
 interface StdinShape {
   readonly isTTY: boolean;
   readonly readPipedBytes: Effect.Effect<Option.Option<Uint8Array>>;
+  /**
+   * Piped stdin as a byte stream, for consumers that must avoid buffering the whole
+   * pipe (e.g. `migration new` seeding a file from a large `pg_dump`, matching Go's
+   * `io.Copy` streaming). Unlike {@link readPipedBytes}, read errors PROPAGATE on the
+   * error channel — Go's `io.Copy` returns `failed to copy from stdin` and exits
+   * non-zero rather than writing a truncated file, so the caller must map the failure.
+   * Emits nothing for an empty pipe; callers gate on {@link isTTY} themselves (a TTY
+   * should not be drained).
+   */
+  readonly pipedBytesStream: Stream.Stream<Uint8Array, PlatformError>;
   readonly readPipedText: Effect.Effect<Option.Option<string>>;
+  /**
+   * Reads a single line from stdin (up to the first newline), trimmed, bounded by
+   * `timeoutMillis`. Port of Go's `Console.ReadLine` (`internal/utils/console.go:38-61`),
+   * which reads one line with a 10-minute timeout on a TTY and 100 ms otherwise.
+   * Returns `None` on timeout, EOF, or a read error (Go treats all of these as no input).
+   * Unlike {@link readPipedText} (a whole-stream collect), this stops at the first line,
+   * so it works for an interactive terminal as well as a pipe.
+   */
+  readonly readLine: (timeoutMillis: number) => Effect.Effect<Option.Option<string>>;
 }
 
 export class Stdin extends Context.Service<Stdin, StdinShape>()("supabase/runtime/Stdin") {}
diff --git a/apps/cli/tests/helpers/live-env.ts b/apps/cli/tests/helpers/live-env.ts
index f6705d71e0..f34cd1734d 100644
--- a/apps/cli/tests/helpers/live-env.ts
+++ b/apps/cli/tests/helpers/live-env.ts
@@ -71,3 +71,55 @@ export function requireLiveProjectRef(): string {
   }
   return ref;
 }
+
+/**
+ * Whether the live project's *data-plane* — its own Postgres instance — is up
+ * and healthy. This is a stronger gate than `liveProjectRef()`: cli-e2e-ci
+ * currently builds the stack WITHOUT `supabase-postgres-17` (CLI-1825), so a
+ * provisioned project's *record* exists — Management-API reads (orgs / projects
+ * / functions / branches list) work — but the instance never reaches
+ * `ACTIVE_HEALTHY` and its database is unreachable. Commands that talk to the
+ * project Postgres (migration, db, storage) gate on this and SKIP until the full
+ * stack lands, then activate automatically.
+ *
+ * Probes `GET /v1/projects` (already proven reachable by `projects list`) and
+ * matches the live ref. Any failure or missing prerequisite returns `false` —
+ * "not ready" is the safe default, so a probe error skips rather than fails the
+ * suite.
+ */
+export async function liveProjectDataPlaneReady(): Promise<boolean> {
+  const token = process.env["SUPABASE_ACCESS_TOKEN"];
+  const ref = liveProjectRef();
+  if (token === undefined || token.length === 0 || ref === undefined) {
+    return false;
+  }
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 15_000);
+  try {
+    const response = await fetch(`${liveApiBaseUrl()}/v1/projects`, {
+      headers: { Authorization: `Bearer ${token}` },
+      signal: controller.signal,
+    });
+    if (!response.ok) {
+      return false;
+    }
+    const projects: unknown = await response.json();
+    if (!Array.isArray(projects)) {
+      return false;
+    }
+    return projects.some(
+      (candidate) =>
+        candidate !== null &&
+        typeof candidate === "object" &&
+        "ref" in candidate &&
+        candidate.ref === ref &&
+        "status" in candidate &&
+        candidate.status === "ACTIVE_HEALTHY",
+    );
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
diff --git a/apps/cli/tests/helpers/live.ts b/apps/cli/tests/helpers/live.ts
index 78d2558190..89d8092ba3 100644
--- a/apps/cli/tests/helpers/live.ts
+++ b/apps/cli/tests/helpers/live.ts
@@ -5,6 +5,7 @@ import {
   isLiveConfigured,
   LIVE_DEFAULT_PROFILE,
   LIVE_EXIT_TIMEOUT_MS,
+  liveProjectDataPlaneReady,
   liveProjectRef,
 } from "./live-env.ts";
 
@@ -26,6 +27,7 @@ export {
   LIVE_DEFAULT_PROFILE,
   LIVE_EXIT_TIMEOUT_MS,
   liveApiBaseUrl,
+  liveProjectDataPlaneReady,
   liveProjectRef,
   requireLiveProjectRef,
 } from "./live-env.ts";
@@ -45,6 +47,17 @@ export const describeLive = describe.skipIf(!isLiveConfigured());
  */
 export const describeLiveProject = describe.skipIf(!isLiveConfigured() || !liveProjectRef());
 
+/**
+ * `describe` for data-plane live suites (migration / db / storage): runs only
+ * when the live env is configured AND the project's own Postgres instance is
+ * `ACTIVE_HEALTHY`. On a control-plane-only stack — including the current
+ * cli-e2e-ci CI, which omits `supabase-postgres-17` (CLI-1825) — the project DB
+ * is unreachable, so these SKIP rather than fail. They activate automatically
+ * once the full data-plane is provisioned. The readiness probe runs once at
+ * collection time (top-level await); see `liveProjectDataPlaneReady`.
+ */
+export const describeLiveDataPlane = describe.skipIf(!(await liveProjectDataPlaneReady()));
+
 /**
  * Spawn the built CLI against the live platform, injecting the profile so the
  * Management API base resolves to the stack. Defaults to the `legacy` shell,
diff --git a/apps/cli/tests/helpers/mocks.ts b/apps/cli/tests/helpers/mocks.ts
index 9b35e42cba..e3b412e308 100644
--- a/apps/cli/tests/helpers/mocks.ts
+++ b/apps/cli/tests/helpers/mocks.ts
@@ -100,14 +100,26 @@ export function mockStdin(isTTY: boolean, pipedInput?: string | Uint8Array): Lay
           typeof pipedInput === "string" ? new TextEncoder().encode(pipedInput) : pipedInput,
         );
 
+  const pipedText = Option.isSome(pipedBytes)
+    ? Option.some(new TextDecoder().decode(pipedBytes.value))
+    : Option.none<string>();
+
   return Layer.succeed(Stdin, {
     isTTY,
     readPipedBytes: Effect.succeed(pipedBytes),
-    readPipedText: Effect.succeed(
-      Option.isSome(pipedBytes)
-        ? Option.some(new TextDecoder().decode(pipedBytes.value))
-        : Option.none<string>(),
-    ),
+    pipedBytesStream: Option.isSome(pipedBytes)
+      ? Stream.fromIterable([pipedBytes.value])
+      : Stream.empty,
+    readPipedText: Effect.succeed(pipedText),
+    // First line of the piped input (trimmed), or None — the timeout is irrelevant
+    // to a fixed mock. Mirrors the production single-line read.
+    readLine: () =>
+      Effect.succeed(
+        Option.flatMap(pipedText, (text) => {
+          const line = text.split(/\r?\n/u)[0]!.trim();
+          return line.length > 0 ? Option.some(line) : Option.none<string>();
+        }),
+      ),
   });
 }
 
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 346813dc25..1fb26fcfe6 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -50,7 +50,7 @@ catalogs:
       version: 6.23.0
     nx:
       specifier: ^23.0.0
-      version: 23.0.0
+      version: 23.0.1
     oxfmt:
       specifier: ^0.56.0
       version: 0.56.0
@@ -79,7 +79,7 @@ importers:
         version: 1.15.43
       nx:
         specifier: 'catalog:'
-        version: 23.0.0(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.43)
+        version: 23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.43)
       pkg-pr-new:
         specifier: 0.0.75
         version: 0.0.75
@@ -89,6 +89,9 @@ importers:
 
   apps/cli:
     dependencies:
+      eciesjs:
+        specifier: ^0.5.0
+        version: 0.5.0
       jose:
         specifier: ^6.2.3
         version: 6.2.3
@@ -715,6 +718,12 @@ packages:
     resolution: {integrity: sha512-hauBrOdvu08vOsagkZ/Aju5XuiZx6ldsLfByg1htFeldhex+PeMrYauANzFsMJeAA0+dyPLbDoX2OYuvVoLDkQ==}
     engines: {node: '>= 6'}
 
+  '@ecies/ciphers@0.2.6':
+    resolution: {integrity: sha512-patgsRPKGkhhoBjETV4XxD0En4ui5fbX0hzayqI3M8tvNMGUoUvmyYAIWwlxBc1KX5cturfqByYdj5bYGRpN9g==}
+    engines: {bun: '>=1', deno: '>=2.7.10', node: '>=16'}
+    peerDependencies:
+      '@noble/ciphers': ^1.0.0
+
   '@effect/atom-react@4.0.0-beta.85':
     resolution: {integrity: sha512-DsBau/iXF8GN6lpbObhwTsP0HcqzoaSJWzbewIUHp/SY2YeQV2bvo0IfPa0dhfwACZHZmhgzdPUaD7SpFyukmg==}
     peerDependencies:
@@ -1289,12 +1298,6 @@ packages:
   '@napi-rs/wasm-runtime@0.2.4':
     resolution: {integrity: sha512-9zESzOO5aDByvhIAsOy9TbpZ0Ur2AJbUI7UT73kcUTS2mxAMHOBaa1st/jAymNoCtvrit99kkzT1FZuXVcgfIQ==}
 
-  '@napi-rs/wasm-runtime@1.1.5':
-    resolution: {integrity: sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q==}
-    peerDependencies:
-      '@emnapi/core': ^1.7.1
-      '@emnapi/runtime': ^1.7.1
-
   '@napi-rs/wasm-runtime@1.1.6':
     resolution: {integrity: sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg==}
     peerDependencies:
@@ -1356,6 +1359,18 @@ packages:
     cpu: [x64]
     os: [win32]
 
+  '@noble/ciphers@1.3.0':
+    resolution: {integrity: sha512-2I0gnIVPtfnMw9ee9h1dJG7tp81+8Ob3OJb3Mv37rx5L40/b0i7djjCVvGOVqc9AEIQyvyu1i6ypKdFw8R8gQw==}
+    engines: {node: ^14.21.3 || >=16}
+
+  '@noble/curves@1.9.7':
+    resolution: {integrity: sha512-gbKGcRUYIjA3/zCCNaWDciTMFI0dCkvou3TL8Zmy5Nc7sJ47a0jtOeZoTaMxkuqRo9cRhjOdZJXegxYE5FN/xw==}
+    engines: {node: ^14.21.3 || >=16}
+
+  '@noble/hashes@1.8.0':
+    resolution: {integrity: sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==}
+    engines: {node: ^14.21.3 || >=16}
+
   '@nodelib/fs.scandir@2.1.5':
     resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
     engines: {node: '>= 8'}
@@ -1373,109 +1388,55 @@ packages:
     peerDependencies:
       nx: '>= 22 <= 24 || ^23.0.0-0'
 
-  '@nx/nx-darwin-arm64@23.0.0':
-    resolution: {integrity: sha512-c/rXP3LYXJLC1F+9KDrWE+n1nkDnTEfHnA1KAK3A/CSk8EfgY0RhekcdbGISrHqgbccdVTBRTNUeTdwD+w23Xw==}
-    cpu: [arm64]
-    os: [darwin]
-
   '@nx/nx-darwin-arm64@23.0.1':
     resolution: {integrity: sha512-gQJvgPnbI91DBe23Th2CqD9R/S54cPS3C1f0DhyQ8YEf9rR7EEc+sVGjhgVxlhfOk2W7I1Gy6EkXwpN4aDoW4w==}
     cpu: [arm64]
     os: [darwin]
 
-  '@nx/nx-darwin-x64@23.0.0':
-    resolution: {integrity: sha512-fb1+s0dASz/a+0Ex3Qdw6Y1NssMZ58f8SyQtnr+c7ITM8Yi5njWfNVZMk1tAnAv7CSFvUvltaYekS88GMQ/8lQ==}
-    cpu: [x64]
-    os: [darwin]
-
   '@nx/nx-darwin-x64@23.0.1':
     resolution: {integrity: sha512-e/lvzHKN6gpuD7MqEtfH1fOfnR75E55ytYNt8jaRxKI6EvpCq+Q3MunDuh9GQYAkqDrUqE7AhHrHc+eKATVEHw==}
     cpu: [x64]
     os: [darwin]
 
-  '@nx/nx-freebsd-x64@23.0.0':
-    resolution: {integrity: sha512-HYawS59K5IyNu28/0i0ectTAPlyBwPO0vhxw9UMGZ9ni6Yz3WvwPFTGZrWaEVAjGe3pQlQEVVBOr5/0Uw0Sw9A==}
-    cpu: [x64]
-    os: [freebsd]
-
   '@nx/nx-freebsd-x64@23.0.1':
     resolution: {integrity: sha512-f582OhSYN9qHpA9Ox9qnr3kZSZ7gQHs7crmBUutmbXmZQB2TDS/TlhvYSNnxudpwHR/tuWGi2IOQqa7zGOZj1Q==}
     cpu: [x64]
     os: [freebsd]
 
-  '@nx/nx-linux-arm-gnueabihf@23.0.0':
-    resolution: {integrity: sha512-GSPVEUKL/PUuKCubNcH+QtOJ+4+VFHSpKDMTFFjizTh//d4SunC+DE6vvwRt5bCervohCW2B7BicQc6IP2V51g==}
-    cpu: [arm]
-    os: [linux]
-
   '@nx/nx-linux-arm-gnueabihf@23.0.1':
     resolution: {integrity: sha512-VjhqPc6E7aiI0e+lowrkVbdyulsmP9fgMdcX1mCzXCEu/XZDcUbZ5qveR964cMhvm5qKn0ILJtJOUqZgmOT3Xg==}
     cpu: [arm]
     os: [linux]
 
-  '@nx/nx-linux-arm64-gnu@23.0.0':
-    resolution: {integrity: sha512-MkpI1SU+OxJ86SL5XcNJLKXsvnxzDwq4uh7Wbehcs62IWXtyGeuxHo1jYGrobYSV8v9f0Aafp3c2GxSxdZX/9Q==}
-    cpu: [arm64]
-    os: [linux]
-    libc: [glibc]
-
   '@nx/nx-linux-arm64-gnu@23.0.1':
     resolution: {integrity: sha512-zX2JdHQejZWB3DRgNsh77qOVYaSSjSLuBP2qIqc7EWVlCUnR7Aj3e65PTIps4LxMMmUp4twZA2ezS0rtyK2A4w==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@nx/nx-linux-arm64-musl@23.0.0':
-    resolution: {integrity: sha512-yASOY5MpsuzHKSF4xRyoVCIWv65GDlVs9VxZ+aZIfw5R9XbPgiaHaHRGlLBAm0j7WFw7wBCOB3WOxBK+wjC3dQ==}
-    cpu: [arm64]
-    os: [linux]
-    libc: [musl]
-
   '@nx/nx-linux-arm64-musl@23.0.1':
     resolution: {integrity: sha512-9lyhxRNBgNYwHt6paq0OLzoKNoEGF5LnNW2YYrgFY8Cjtsg/Q4pcfZ1vB5o9FX9OmUgUQs3t2d4tU8YDukRUWg==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@nx/nx-linux-x64-gnu@23.0.0':
-    resolution: {integrity: sha512-HvDP11Ub00C7kAMC7NvX+sbV8wM5j+OjLQalys0wlyqZ+7SL9OulQv/cyMCEHZSKW8YPt4326G0+omulZDwIGg==}
-    cpu: [x64]
-    os: [linux]
-    libc: [glibc]
-
   '@nx/nx-linux-x64-gnu@23.0.1':
     resolution: {integrity: sha512-kVszY2xRyyrCXgdCdM1qG1WUhDjNPZxtdWq86a0TyIRJjfJTP9NHqpyhmvj9c2RdZxKVWHotx6fBJzY6Vn2ZrA==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@nx/nx-linux-x64-musl@23.0.0':
-    resolution: {integrity: sha512-t1pSyBrxQ0Dly9VzB8WZXhVQMk044P8AyMRRiZ+NOs1pK4eRqVlmJmwJQw3ZfZZYUhA7B02PV8DHOjactctdag==}
-    cpu: [x64]
-    os: [linux]
-    libc: [musl]
-
   '@nx/nx-linux-x64-musl@23.0.1':
     resolution: {integrity: sha512-co71K2n4zcS1SYR8EBRlCvIko7M1YycO2tZL0nrCrga87AF5dzCwx+wEclpyCR/4tNOY3FrACk4gIkVskh3CdA==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@nx/nx-win32-arm64-msvc@23.0.0':
-    resolution: {integrity: sha512-IKTwZZgejzyUZChQjGss2cCSi2rR0J3FnpyQkjt9I4fFYTNd4YCNs5njovrBjQtVLpi/vv3e96fl3ccjbzIUpA==}
-    cpu: [arm64]
-    os: [win32]
-
   '@nx/nx-win32-arm64-msvc@23.0.1':
     resolution: {integrity: sha512-7oma7iy5fbnn+x5AP7SFGMuleAA2R5RZm26dn+faikyQ4PXjoRAikWJJNiOWAeCA0BaMAeVedI6fJeAsVeDUKg==}
     cpu: [arm64]
     os: [win32]
 
-  '@nx/nx-win32-x64-msvc@23.0.0':
-    resolution: {integrity: sha512-2LSdp8U5gDaXtXbGLiKRdQM0f4yNCaraCpQrz27yjlQbyrULyCiaB00NPBL2JlhH9eQahx/QRyizhkMQ0hzVBA==}
-    cpu: [x64]
-    os: [win32]
-
   '@nx/nx-win32-x64-msvc@23.0.1':
     resolution: {integrity: sha512-TE/wvBa2cpkVXmk/AXUQAneong4JReS2hyNpAUONKG1yXU7TDKe0wvn1xQXxAbyspudT9NuCnVtpVuEkRz8S+Q==}
     cpu: [x64]
@@ -1666,207 +1627,104 @@ packages:
   '@oxc-project/types@0.137.0':
     resolution: {integrity: sha512-WT+Gb24i8hmvo85AIv2oEYouEXkRlKAlT9WaCa3TfLgNCN+GhrJOGZuIlMouAh38Qe4QOx26eUOVsq70qXrywA==}
 
-  '@oxc-resolver/binding-android-arm-eabi@11.20.0':
-    resolution: {integrity: sha512-IjfWOXRgJFNdORDl+Uf1aibNgZY2guOD3zmOhx1BGVb/MIiqlFTdmjpQNplSN58lhWehnX4UNqC3QwpUo8pjJg==}
-    cpu: [arm]
-    os: [android]
-
   '@oxc-resolver/binding-android-arm-eabi@11.21.3':
     resolution: {integrity: sha512-eNU11A2WNizh04v3uyaJCootrHIaS0B9aHYXvAvVnPNk4xYSjMUjHnhQ6dewPN2MRYDskV85d1N0Aw0WNWhcyg==}
     cpu: [arm]
     os: [android]
 
-  '@oxc-resolver/binding-android-arm64@11.20.0':
-    resolution: {integrity: sha512-QqslZAuFQG8Q9xm7JuIn8JUbvywhSBMVhuQHtYW+auirZJloS41oxUUaBXk7uUhZJgp44c5zQLeVvmFaDQB+2Q==}
-    cpu: [arm64]
-    os: [android]
-
   '@oxc-resolver/binding-android-arm64@11.21.3':
     resolution: {integrity: sha512-8Q+ZjTLvn2dIcWsrmhdrEihm7q+ag/k+mkry7Z+t0QbbHaVxXQfvH9AewyVMh/WrpEKhQ3DDgx9fYbqeCpeOEw==}
     cpu: [arm64]
     os: [android]
 
-  '@oxc-resolver/binding-darwin-arm64@11.20.0':
-    resolution: {integrity: sha512-MUcavykj2ewlR+kc5arpg4tC2RvzJkUxWtNv74pf7lcNk00GpIpN43vXMj+j6r4eMmfZhlb8hueKoIb8e9kAGQ==}
-    cpu: [arm64]
-    os: [darwin]
-
   '@oxc-resolver/binding-darwin-arm64@11.21.3':
     resolution: {integrity: sha512-wkh0qKZGHXVUDxFw3oA1TXnU2BDYY/r775oJflGeIr8uDPPoN2pk8gijQIzYRT6hoql/lg3+Tx/SaTn9e2/aGg==}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxc-resolver/binding-darwin-x64@11.20.0':
-    resolution: {integrity: sha512-BGB16nRUK5Etiv//ihPyzj8Lj1px0mhh4YIfe0FDf045ywknfSm0GEbiRESpr6Q4K82AvnyaRIhhluHByvS4bg==}
-    cpu: [x64]
-    os: [darwin]
-
   '@oxc-resolver/binding-darwin-x64@11.21.3':
     resolution: {integrity: sha512-HbNc23FAQYbuyDV2vBWMez4u4mrsm5RAkniGZAWqr6lYZ3N4beeqIb776jzwRl8qL2zRhHVXpUj97X0QgogVzg==}
     cpu: [x64]
     os: [darwin]
 
-  '@oxc-resolver/binding-freebsd-x64@11.20.0':
-    resolution: {integrity: sha512-JZgtePaqj3qmD5XFHJaSLWzHRxQu0LaPkdoM1KJXYADvAaa83ijXHclV3ej3CueeW0wxfIAbGCZVP45J0CA7uQ==}
-    cpu: [x64]
-    os: [freebsd]
-
   '@oxc-resolver/binding-freebsd-x64@11.21.3':
     resolution: {integrity: sha512-K6xNsTUPEUdfrn0+kbMq5nOUB5w1C5pavPQngt4TM2FpN91lP0PBe2srSpamb4d69O7h86oAi/qWX/kZNRSjkw==}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxc-resolver/binding-linux-arm-gnueabihf@11.20.0':
-    resolution: {integrity: sha512-hOQ/p3ry3v3SchUBXicrrnszaI/UmYzM4wtS4RGfwgVUX7a+HbyQSzJ5aOzu+o6XZkFkS3ZXN4PZAzhOb77OSg==}
-    cpu: [arm]
-    os: [linux]
-
   '@oxc-resolver/binding-linux-arm-gnueabihf@11.21.3':
     resolution: {integrity: sha512-VcFmOpcpWX1zoEy8M58tR2M9YxM+Z9RuQhqAx5q0CTmrruaP7Gveejg75hzd/5sg5nk9G3aLALEa3hE2FsmmTQ==}
     cpu: [arm]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-arm-musleabihf@11.20.0':
-    resolution: {integrity: sha512-2ArPksaw0AqeuGBfoS715VF+JvJQAhD2niWgjE5hVO+L+nAfikVQopvngCMX9x4BD8itWoQ3dnikrQyl5Ho5Jg==}
-    cpu: [arm]
-    os: [linux]
-
   '@oxc-resolver/binding-linux-arm-musleabihf@11.21.3':
     resolution: {integrity: sha512-quVoxFLBy43hWaQbbDtQNRwAX5vX76mv7n64icAtQcJ3eNgVeblqmkupF/hAneNthdqSlnd1sTjb3aQSaDPaCQ==}
     cpu: [arm]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-arm64-gnu@11.20.0':
-    resolution: {integrity: sha512-0bJnmYFp62JdZ4nVMDUZ/C58BCZOCcqgKtnUlp7L9Ojf/czIN+3j72YlLPeWLkzlr6SlYvIQA4SGV/HyO0d+qg==}
-    cpu: [arm64]
-    os: [linux]
-    libc: [glibc]
-
   '@oxc-resolver/binding-linux-arm64-gnu@11.21.3':
     resolution: {integrity: sha512-X0AqNZgcD07Q4V3RDK18/vYOj/HQT/FnmEFGYS2jTWqY7JO13ryE3TEs3eAIgUJhBnNkpEaiXqz3VK8M7qQhWQ==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxc-resolver/binding-linux-arm64-musl@11.20.0':
-    resolution: {integrity: sha512-wKHHzPKZo7Ufhv/Bt6yxT7FOgnIgW4gwXcJUipkShGp68W3wGVqvr1Sr0fY65lN0Oy6y41+g2kIDvkgZaMMUkw==}
-    cpu: [arm64]
-    os: [linux]
-    libc: [musl]
-
   '@oxc-resolver/binding-linux-arm64-musl@11.21.3':
     resolution: {integrity: sha512-YkaQnaKYdbuaXvRt5Qd0GpbihzVnyfR6z1SpYfIUC6RTu4NF7lDKPjVkYb+jRI2gedVO2rVpN35Y6akG6ud4Lw==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxc-resolver/binding-linux-ppc64-gnu@11.20.0':
-    resolution: {integrity: sha512-RN8goF7Ie0B79L4i4G6OeBocTgSC56vJbQ65VJje+oXnldVpLnOU7j/AQ/dP94TcCS+Yh6WG8u3Qt4ETteXFNQ==}
-    cpu: [ppc64]
-    os: [linux]
-    libc: [glibc]
-
   '@oxc-resolver/binding-linux-ppc64-gnu@11.21.3':
     resolution: {integrity: sha512-gB9HwhrPiFqUzDeEq+y/CgAijz1YdI6BnXz5GaH2Pa9cWdutchlkGFAiAuGb/PjVQpiK6NFKzFuztxrweoit7A==}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxc-resolver/binding-linux-riscv64-gnu@11.20.0':
-    resolution: {integrity: sha512-5l1yU6/xQEqLZRzxqmMxJfWPslpwCmBsdDGaBvABPehxquCXDC7dd7oraNdKSJUMDXSM7VvVj8H2D2FTjU7oWw==}
-    cpu: [riscv64]
-    os: [linux]
-    libc: [glibc]
-
   '@oxc-resolver/binding-linux-riscv64-gnu@11.21.3':
     resolution: {integrity: sha512-zjDWBlYk8QGv0H8dsPUWqkfjYIIjG2TvspGkzXL0eImbgxtZorA/klKeHyolevoT3Kvbi+1iMr9Lhrh7jf54Og==}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxc-resolver/binding-linux-riscv64-musl@11.20.0':
-    resolution: {integrity: sha512-xHEvkbgz6UC+A3JOyDQy76LkUaxsNSfIr3/GV8slwZsnuooJiIB34gzJfsyvR4JdCYNUUPsRJc/w/oWkODu+hg==}
-    cpu: [riscv64]
-    os: [linux]
-    libc: [musl]
-
   '@oxc-resolver/binding-linux-riscv64-musl@11.21.3':
     resolution: {integrity: sha512-4UfsQvacV388y1zpXL7C1x1FNYaV52JtuNRiuzrfQA2z1z6ElVrsidkGsrvQ5EgeSq1Pj7kaKqrgGkvFuxJ/tw==}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxc-resolver/binding-linux-s390x-gnu@11.20.0':
-    resolution: {integrity: sha512-aWPDUUmSeyHvlW+SoEUd+JIJsQhVhu6a5tBpDRMu058naPAchTgAVGCFy35zjbnFlt0i8hLWziff6HX0D3LU4g==}
-    cpu: [s390x]
-    os: [linux]
-    libc: [glibc]
-
   '@oxc-resolver/binding-linux-s390x-gnu@11.21.3':
     resolution: {integrity: sha512-b5uH+HKH0MP5mNBYaK75SKsJbw52URqrx2LavYdq6wb0l3ExAG5niYRP9DWUNHdKilpaBVM2bXk9HNWrH3ew7Q==}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxc-resolver/binding-linux-x64-gnu@11.20.0':
-    resolution: {integrity: sha512-x2YeSimvhJjKLVD8KSu8f/rqU1potcdEMkApIPJqjZWN7c2Fpt4g2X32WDg1p+XDAmyT7nuQGe0vnhvXeLbH+g==}
-    cpu: [x64]
-    os: [linux]
-    libc: [glibc]
-
   '@oxc-resolver/binding-linux-x64-gnu@11.21.3':
     resolution: {integrity: sha512-PjYlmilBpNRh2ntXNYAK3Am5w/nPfEpnU/96iNx7CI8EzAn12J4JRiec63wHJTH31nLoCNxBg/829pN+3CfG3Q==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxc-resolver/binding-linux-x64-musl@11.20.0':
-    resolution: {integrity: sha512-kcRLEIxpZefeYfLChjpgFf3ilBzRDZ+yobMrpRsQlSrxuFGtm3U6PMU7AaEpMqo3NfDGVyJJseAjnRLzMFHjwQ==}
-    cpu: [x64]
-    os: [linux]
-    libc: [musl]
-
   '@oxc-resolver/binding-linux-x64-musl@11.21.3':
     resolution: {integrity: sha512-QTBAb7JuHlZ7JUEyM8UiQi2f7m/L4swBhP2TNpYIDc9Wp/wRw1G/8sl6i13aIzQAXH7LKIm294LeOHd0lQR8zA==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxc-resolver/binding-openharmony-arm64@11.20.0':
-    resolution: {integrity: sha512-HHcfnApSZGtKhTiHqe8OZruOZe5XuFQH5/E0Yhj3u8fnFvzkM4/k6WjacUf4SvA0SPEAbfbgYmVPuo0VX/fIBQ==}
-    cpu: [arm64]
-    os: [openharmony]
-
   '@oxc-resolver/binding-openharmony-arm64@11.21.3':
     resolution: {integrity: sha512-4j1DFwjwv36ec9kds0jU/ucQ5Ha4ERO/H95BxR5JFf0kqUUAJ1kwII7XhTc1vZrkdJkvLGC9Q2MbpObpum8RBg==}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxc-resolver/binding-wasm32-wasi@11.20.0':
-    resolution: {integrity: sha512-Tn0y1XOFYHNfK1wp1Z5QK8Rcld/bsOwRISQXfqAZ5IBpv8Gz1IvV39fUWNprqNdRizgcvFhOzWwFun2zkJsyBg==}
-    engines: {node: '>=14.0.0'}
-    cpu: [wasm32]
-
   '@oxc-resolver/binding-wasm32-wasi@11.21.3':
     resolution: {integrity: sha512-i8oluoel5kru/j1WNrjmQSiA3GQ7wvIYVR1IwIoZtKogAhya2iub+ZKIeSIkcJOrnzQ18Tzl/F+kL3fYOxZLvA==}
     engines: {node: '>=14.0.0'}
     cpu: [wasm32]
 
-  '@oxc-resolver/binding-win32-arm64-msvc@11.20.0':
-    resolution: {integrity: sha512-qPi25YNPe4YenS8MgsQU2+bIFHxxpLx1LVna2444cEHqNPhNjvWf9zqj4aWE43H9LpAsTmkkAlA3eL5ElBU3mA==}
-    cpu: [arm64]
-    os: [win32]
-
   '@oxc-resolver/binding-win32-arm64-msvc@11.21.3':
     resolution: {integrity: sha512-M/8dw8dD6aOs+NlPJax401CZB9I7Aut84isQLgALGGwke4Afvw+/7yYhZb94yXf6t2sPLhQLmSmtSV+2FhsOWg==}
     cpu: [arm64]
     os: [win32]
 
-  '@oxc-resolver/binding-win32-x64-msvc@11.20.0':
-    resolution: {integrity: sha512-Wb14jWEW8huH6It9F6sXd9vrYmIS7pMrgkU6sxpLxkP+9z+wRgs71hUEhRpcn8FOXAFa27FVWfY2tRpbfTzfLw==}
-    cpu: [x64]
-    os: [win32]
-
   '@oxc-resolver/binding-win32-x64-msvc@11.21.3':
     resolution: {integrity: sha512-H7BCt/VnS9hnmMp42eGhZ99izSCRvlnWwy/N71K1/J8QoExwY4262Z8QiEkMDtduRJrztayDxETTckmUuAVL9Q==}
     cpu: [x64]
@@ -3805,6 +3663,10 @@ packages:
   ecdsa-sig-formatter@1.0.11:
     resolution: {integrity: sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ==}
 
+  eciesjs@0.5.0:
+    resolution: {integrity: sha512-s0J9SEVYAEPg7J63GFMApLYzPH9VNIQIyC6s15JpnqVc0TqcKWdbgFlnAweEBRyMmko2dcs2sfC83Hj4J43tuA==}
+    engines: {bun: '>=1', deno: '>=2.7.10', node: '>=16'}
+
   ee-first@1.1.1:
     resolution: {integrity: sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==}
 
@@ -4104,10 +3966,6 @@ packages:
   form-data-encoder@1.7.2:
     resolution: {integrity: sha512-qfqtYan3rxrnCk1VYaA4H+Ms9xdpPqvLZa6xmMgFvhO32x7/3J/ExcTd6qpxM0vH2GdMI+poehyBZvqfMTto8A==}
 
-  form-data@4.0.5:
-    resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==}
-    engines: {node: '>= 6'}
-
   form-data@4.0.6:
     resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==}
     engines: {node: '>= 6'}
@@ -4375,10 +4233,6 @@ packages:
     resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
     engines: {node: '>= 0.4'}
 
-  hasown@2.0.2:
-    resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==}
-    engines: {node: '>= 0.4'}
-
   hasown@2.0.4:
     resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
     engines: {node: '>= 0.4'}
@@ -5445,18 +5299,6 @@ packages:
       - validate-npm-package-name
       - which
 
-  nx@23.0.0:
-    resolution: {integrity: sha512-60HZVOQErtSTnR+UVPBYI5sYe8R2nrHttI0tVHhEj91kJpbXvL15gSh+rv6lUcAJtDfPymoEn20jGzN4oOLKAg==}
-    hasBin: true
-    peerDependencies:
-      '@swc-node/register': ^1.11.1
-      '@swc/core': ^1.15.8
-    peerDependenciesMeta:
-      '@swc-node/register':
-        optional: true
-      '@swc/core':
-        optional: true
-
   nx@23.0.1:
     resolution: {integrity: sha512-HnK0Ke8FcPeVQffYm1oyzkLNn7khrI8SeDeC3iyLhw/UEMCB24hjI5JSs6Amlyeb0/GaeiuQuts8NkQKd/NpGA==}
     hasBin: true
@@ -5524,9 +5366,6 @@ packages:
     resolution: {integrity: sha512-yFImD+WLElJpLKy8llG1qe4DCmMsL18peRp8XP1JKfig/gISbJkglnpDtX2aTmAn10kZF7164HbN2H8QPsXxGg==}
     engines: {node: ^20.19.0 || >=22.12.0}
 
-  oxc-resolver@11.20.0:
-    resolution: {integrity: sha512-CblytBiV/a/ZXY34dsVU2NxhIOxMXst8CvDCtyBelVITgd7PLrKzbEbA6oKLdPjvDKDzCiW48qzmzZ+mYaqn+g==}
-
   oxc-resolver@11.21.3:
     resolution: {integrity: sha512-2Mx3fKQz7+xgrBONjsxOgCGtMHOn38/HxMzW1I5efwXB5a4lRN0Vp40gYUJFBWJslcrvwoofTrqoTnLbwTd3pA==}
 
@@ -6506,10 +6345,6 @@ packages:
     resolution: {integrity: sha512-RfEzKWcq5fHUOFq7J3rl3Oz6ylKGtcHqUznzj4EcXsxLSIjJcvpbXAQtWGeJQ0xKnimR5e0Cn+cn9TssfMzm+g==}
     hasBin: true
 
-  tmp@0.2.6:
-    resolution: {integrity: sha512-5sJPdPjfI5Kx+qbrDesxkglRBxW//g7hCsqspEjwkewGvBMGIKMOTKzLt1hFVJzyadba3lDUN20O9qhvbQUSTA==}
-    engines: {node: '>=14.14'}
-
   tmp@0.2.7:
     resolution: {integrity: sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==}
     engines: {node: '>=14.14'}
@@ -7198,6 +7033,10 @@ snapshots:
       tunnel-agent: 0.6.0
       uuid: 8.3.2
 
+  '@ecies/ciphers@0.2.6(@noble/ciphers@1.3.0)':
+    dependencies:
+      '@noble/ciphers': 1.3.0
+
   '@effect/atom-react@4.0.0-beta.85(effect@4.0.0-beta.85)(react@19.2.7)(scheduler@0.27.0)':
     dependencies:
       effect: 4.0.0-beta.85
@@ -7252,6 +7091,7 @@ snapshots:
     dependencies:
       '@emnapi/wasi-threads': 1.2.1
       tslib: 2.8.1
+    optional: true
 
   '@emnapi/core@1.11.0':
     dependencies:
@@ -7263,7 +7103,6 @@ snapshots:
     dependencies:
       '@emnapi/wasi-threads': 1.2.2
       tslib: 2.8.1
-    optional: true
 
   '@emnapi/core@1.4.5':
     dependencies:
@@ -7295,11 +7134,11 @@ snapshots:
   '@emnapi/wasi-threads@1.2.1':
     dependencies:
       tslib: 2.8.1
+    optional: true
 
   '@emnapi/wasi-threads@1.2.2':
     dependencies:
       tslib: 2.8.1
-    optional: true
 
   '@esbuild/aix-ppc64@0.28.1':
     optional: true
@@ -7654,17 +7493,10 @@ snapshots:
 
   '@napi-rs/wasm-runtime@0.2.4':
     dependencies:
-      '@emnapi/core': 1.10.0
+      '@emnapi/core': 1.11.1
       '@emnapi/runtime': 1.11.1
       '@tybys/wasm-util': 0.9.0
 
-  '@napi-rs/wasm-runtime@1.1.5(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)':
-    dependencies:
-      '@emnapi/core': 1.10.0
-      '@emnapi/runtime': 1.10.0
-      '@tybys/wasm-util': 0.10.3
-    optional: true
-
   '@napi-rs/wasm-runtime@1.1.6(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)':
     dependencies:
       '@emnapi/core': 1.10.0
@@ -7712,6 +7544,14 @@ snapshots:
   '@next/swc-win32-x64-msvc@16.2.9':
     optional: true
 
+  '@noble/ciphers@1.3.0': {}
+
+  '@noble/curves@1.9.7':
+    dependencies:
+      '@noble/hashes': 1.8.0
+
+  '@noble/hashes@1.8.0': {}
+
   '@nodelib/fs.scandir@2.1.5':
     dependencies:
       '@nodelib/fs.stat': 2.0.5
@@ -7735,63 +7575,33 @@ snapshots:
       tslib: 2.8.1
       yargs-parser: 21.1.1
 
-  '@nx/nx-darwin-arm64@23.0.0':
-    optional: true
-
   '@nx/nx-darwin-arm64@23.0.1':
     optional: true
 
-  '@nx/nx-darwin-x64@23.0.0':
-    optional: true
-
   '@nx/nx-darwin-x64@23.0.1':
     optional: true
 
-  '@nx/nx-freebsd-x64@23.0.0':
-    optional: true
-
   '@nx/nx-freebsd-x64@23.0.1':
     optional: true
 
-  '@nx/nx-linux-arm-gnueabihf@23.0.0':
-    optional: true
-
   '@nx/nx-linux-arm-gnueabihf@23.0.1':
     optional: true
 
-  '@nx/nx-linux-arm64-gnu@23.0.0':
-    optional: true
-
   '@nx/nx-linux-arm64-gnu@23.0.1':
     optional: true
 
-  '@nx/nx-linux-arm64-musl@23.0.0':
-    optional: true
-
   '@nx/nx-linux-arm64-musl@23.0.1':
     optional: true
 
-  '@nx/nx-linux-x64-gnu@23.0.0':
-    optional: true
-
   '@nx/nx-linux-x64-gnu@23.0.1':
     optional: true
 
-  '@nx/nx-linux-x64-musl@23.0.0':
-    optional: true
-
   '@nx/nx-linux-x64-musl@23.0.1':
     optional: true
 
-  '@nx/nx-win32-arm64-msvc@23.0.0':
-    optional: true
-
   '@nx/nx-win32-arm64-msvc@23.0.1':
     optional: true
 
-  '@nx/nx-win32-x64-msvc@23.0.0':
-    optional: true
-
   '@nx/nx-win32-x64-msvc@23.0.1':
     optional: true
 
@@ -7925,109 +7735,54 @@ snapshots:
 
   '@oxc-project/types@0.137.0': {}
 
-  '@oxc-resolver/binding-android-arm-eabi@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-android-arm-eabi@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-android-arm64@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-android-arm64@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-darwin-arm64@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-darwin-arm64@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-darwin-x64@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-darwin-x64@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-freebsd-x64@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-freebsd-x64@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-linux-arm-gnueabihf@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-linux-arm-gnueabihf@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-linux-arm-musleabihf@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-linux-arm-musleabihf@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-linux-arm64-gnu@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-linux-arm64-gnu@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-linux-arm64-musl@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-linux-arm64-musl@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-linux-ppc64-gnu@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-linux-ppc64-gnu@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-linux-riscv64-gnu@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-linux-riscv64-gnu@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-linux-riscv64-musl@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-linux-riscv64-musl@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-linux-s390x-gnu@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-linux-s390x-gnu@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-linux-x64-gnu@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-linux-x64-gnu@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-linux-x64-musl@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-linux-x64-musl@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-openharmony-arm64@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-openharmony-arm64@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-wasm32-wasi@11.20.0':
-    dependencies:
-      '@emnapi/core': 1.10.0
-      '@emnapi/runtime': 1.10.0
-      '@napi-rs/wasm-runtime': 1.1.5(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
-    optional: true
-
   '@oxc-resolver/binding-wasm32-wasi@11.21.3':
     dependencies:
       '@emnapi/core': 1.11.0
@@ -8035,15 +7790,9 @@ snapshots:
       '@napi-rs/wasm-runtime': 1.1.6(@emnapi/core@1.11.0)(@emnapi/runtime@1.11.0)
     optional: true
 
-  '@oxc-resolver/binding-win32-arm64-msvc@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-win32-arm64-msvc@11.21.3':
     optional: true
 
-  '@oxc-resolver/binding-win32-x64-msvc@11.20.0':
-    optional: true
-
   '@oxc-resolver/binding-win32-x64-msvc@11.21.3':
     optional: true
 
@@ -8716,7 +8465,7 @@ snapshots:
       read-pkg: 10.1.0
       registry-auth-token: 5.1.1
       semantic-release: 25.0.5(typescript@6.0.3)
-      semver: 7.8.4
+      semver: 7.8.5
       tempy: 3.2.0
 
   '@semantic-release/release-notes-generator@14.1.1(semantic-release@25.0.5(typescript@6.0.3))':
@@ -8827,7 +8576,7 @@ snapshots:
       '@swc/core': 1.15.43
       colorette: 2.0.20
       debug: 4.4.3
-      oxc-resolver: 11.20.0
+      oxc-resolver: 11.21.3
       pirates: 4.0.7
       tslib: 2.8.1
       typescript: 6.0.3
@@ -9829,6 +9578,13 @@ snapshots:
     dependencies:
       safe-buffer: 5.2.1
 
+  eciesjs@0.5.0:
+    dependencies:
+      '@ecies/ciphers': 0.2.6(@noble/ciphers@1.3.0)
+      '@noble/ciphers': 1.3.0
+      '@noble/curves': 1.9.7
+      '@noble/hashes': 1.8.0
+
   ee-first@1.1.1: {}
 
   effect@4.0.0-beta.85:
@@ -10255,14 +10011,6 @@ snapshots:
 
   form-data-encoder@1.7.2: {}
 
-  form-data@4.0.5:
-    dependencies:
-      asynckit: 0.4.0
-      combined-stream: 1.0.8
-      es-set-tostringtag: 2.1.0
-      hasown: 2.0.4
-      mime-types: 2.1.35
-
   form-data@4.0.6:
     dependencies:
       asynckit: 0.4.0
@@ -10527,10 +10275,6 @@ snapshots:
     dependencies:
       has-symbols: 1.1.0
 
-  hasown@2.0.2:
-    dependencies:
-      function-bind: 1.1.2
-
   hasown@2.0.4:
     dependencies:
       function-bind: 1.1.2
@@ -10966,7 +10710,7 @@ snapshots:
       lodash.isstring: 4.0.1
       lodash.once: 4.1.1
       ms: 2.1.3
-      semver: 7.8.2
+      semver: 7.8.5
 
   jsprim@2.0.2:
     dependencies:
@@ -11793,135 +11537,6 @@ snapshots:
 
   npm@11.17.0: {}
 
-  nx@23.0.0(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.43):
-    dependencies:
-      '@emnapi/core': 1.4.5
-      '@emnapi/runtime': 1.4.5
-      '@emnapi/wasi-threads': 1.0.4
-      '@jest/diff-sequences': 30.0.1
-      '@napi-rs/wasm-runtime': 0.2.4
-      '@tybys/wasm-util': 0.9.0
-      '@yarnpkg/lockfile': 1.1.0
-      '@zkochan/js-yaml': 0.0.7
-      ansi-colors: 4.1.3
-      ansi-regex: 5.0.1
-      ansi-styles: 4.3.0
-      argparse: 2.0.1
-      asynckit: 0.4.0
-      axios: 1.16.0
-      balanced-match: 4.0.3
-      base64-js: 1.5.1
-      bl: 4.1.0
-      brace-expansion: 5.0.6
-      buffer: 5.7.1
-      call-bind-apply-helpers: 1.0.2
-      chalk: 4.1.2
-      cli-cursor: 3.1.0
-      cli-spinners: 2.6.1
-      cliui: 8.0.1
-      clone: 1.0.4
-      color-convert: 2.0.1
-      color-name: 1.1.4
-      combined-stream: 1.0.8
-      defaults: 1.0.4
-      define-lazy-prop: 2.0.0
-      delayed-stream: 1.0.0
-      dotenv: 16.4.7
-      dotenv-expand: 12.0.3
-      dunder-proto: 1.0.1
-      ejs: 5.0.1
-      emoji-regex: 8.0.0
-      end-of-stream: 1.4.5
-      enquirer: 2.3.6
-      es-define-property: 1.0.1
-      es-errors: 1.3.0
-      es-object-atoms: 1.1.1
-      es-set-tostringtag: 2.1.0
-      escalade: 3.2.0
-      escape-string-regexp: 1.0.5
-      figures: 3.2.0
-      flat: 5.0.2
-      follow-redirects: 1.16.0
-      form-data: 4.0.5
-      fs-constants: 1.0.0
-      function-bind: 1.1.2
-      get-caller-file: 2.0.5
-      get-intrinsic: 1.3.0
-      get-proto: 1.0.1
-      gopd: 1.2.0
-      has-flag: 4.0.0
-      has-symbols: 1.1.0
-      has-tostringtag: 1.0.2
-      hasown: 2.0.2
-      ieee754: 1.2.1
-      ignore: 7.0.5
-      inherits: 2.0.4
-      is-docker: 2.2.1
-      is-fullwidth-code-point: 3.0.0
-      is-interactive: 1.0.0
-      is-unicode-supported: 0.1.0
-      is-wsl: 2.2.0
-      isexe: 2.0.0
-      json5: 2.2.3
-      jsonc-parser: 3.3.1
-      lines-and-columns: 2.0.3
-      log-symbols: 4.1.0
-      math-intrinsics: 1.1.0
-      mime-db: 1.52.0
-      mime-types: 2.1.35
-      mimic-fn: 2.1.0
-      minimatch: 10.2.5
-      minimist: 1.2.8
-      npm-run-path: 4.0.1
-      once: 1.4.0
-      onetime: 5.1.2
-      open: 8.4.2
-      ora: 5.4.1
-      path-key: 3.1.1
-      picocolors: 1.1.1
-      proxy-from-env: 2.1.0
-      readable-stream: 3.6.2
-      require-directory: 2.1.1
-      resolve.exports: 2.0.3
-      restore-cursor: 3.1.0
-      safe-buffer: 5.2.1
-      semver: 7.7.4
-      signal-exit: 3.0.7
-      smol-toml: 1.6.1
-      string-width: 4.2.3
-      string_decoder: 1.3.0
-      strip-ansi: 6.0.1
-      strip-bom: 3.0.0
-      supports-color: 7.2.0
-      tar-stream: 2.2.0
-      tmp: 0.2.6
-      tsconfig-paths: 4.2.0
-      tslib: 2.8.1
-      util-deprecate: 1.0.2
-      wcwidth: 1.0.1
-      which: 3.0.1
-      wrap-ansi: 7.0.0
-      wrappy: 1.0.2
-      y18n: 5.0.8
-      yaml: 2.9.0
-      yargs: 17.7.2
-      yargs-parser: 21.1.1
-    optionalDependencies:
-      '@nx/nx-darwin-arm64': 23.0.0
-      '@nx/nx-darwin-x64': 23.0.0
-      '@nx/nx-freebsd-x64': 23.0.0
-      '@nx/nx-linux-arm-gnueabihf': 23.0.0
-      '@nx/nx-linux-arm64-gnu': 23.0.0
-      '@nx/nx-linux-arm64-musl': 23.0.0
-      '@nx/nx-linux-x64-gnu': 23.0.0
-      '@nx/nx-linux-x64-musl': 23.0.0
-      '@nx/nx-win32-arm64-msvc': 23.0.0
-      '@nx/nx-win32-x64-msvc': 23.0.0
-      '@swc-node/register': 1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3)
-      '@swc/core': 1.15.43
-    transitivePeerDependencies:
-      - debug
-
   nx@23.0.1(@swc-node/register@1.11.1(@swc/core@1.15.43)(@swc/types@0.1.27)(typescript@6.0.3))(@swc/core@1.15.43):
     dependencies:
       '@emnapi/core': 1.4.5
@@ -12130,28 +11745,6 @@ snapshots:
       '@oxc-parser/binding-win32-ia32-msvc': 0.137.0
       '@oxc-parser/binding-win32-x64-msvc': 0.137.0
 
-  oxc-resolver@11.20.0:
-    optionalDependencies:
-      '@oxc-resolver/binding-android-arm-eabi': 11.20.0
-      '@oxc-resolver/binding-android-arm64': 11.20.0
-      '@oxc-resolver/binding-darwin-arm64': 11.20.0
-      '@oxc-resolver/binding-darwin-x64': 11.20.0
-      '@oxc-resolver/binding-freebsd-x64': 11.20.0
-      '@oxc-resolver/binding-linux-arm-gnueabihf': 11.20.0
-      '@oxc-resolver/binding-linux-arm-musleabihf': 11.20.0
-      '@oxc-resolver/binding-linux-arm64-gnu': 11.20.0
-      '@oxc-resolver/binding-linux-arm64-musl': 11.20.0
-      '@oxc-resolver/binding-linux-ppc64-gnu': 11.20.0
-      '@oxc-resolver/binding-linux-riscv64-gnu': 11.20.0
-      '@oxc-resolver/binding-linux-riscv64-musl': 11.20.0
-      '@oxc-resolver/binding-linux-s390x-gnu': 11.20.0
-      '@oxc-resolver/binding-linux-x64-gnu': 11.20.0
-      '@oxc-resolver/binding-linux-x64-musl': 11.20.0
-      '@oxc-resolver/binding-openharmony-arm64': 11.20.0
-      '@oxc-resolver/binding-wasm32-wasi': 11.20.0
-      '@oxc-resolver/binding-win32-arm64-msvc': 11.20.0
-      '@oxc-resolver/binding-win32-x64-msvc': 11.20.0
-
   oxc-resolver@11.21.3:
     optionalDependencies:
       '@oxc-resolver/binding-android-arm-eabi': 11.21.3
@@ -13318,8 +12911,6 @@ snapshots:
     dependencies:
       tldts-core: 7.4.5
 
-  tmp@0.2.6: {}
-
   tmp@0.2.7: {}
 
   to-regex-range@5.0.1: